cred-semantic-kernel 1.0.0__tar.gz

cred_semantic_kernel-1.0.0/.gitignore

@@ -0,0 +1,50 @@
+node_modules/
+dist/
+build/
+
+# Sprint artifacts
+.factory/
+.sprint-*
+.sprint-pid
+.rewire-done
+.content-rewrite-done
+.hubspot-done
+.integrations-done
+.done
+.validation-report.md
+.sprint-logs/
+.sprint-prompts/
+SESSION_PACKAGE.md
+run-sprint.sh
+validate.sh
+
+# Internal planning docs (not for public repo)
+CLAUDE.md
+PLAN.md
+HANDOFF.md
+VALIDATION.md
+MARKETING-VALIDATION.md
+FINAL-SUBMISSION-VALIDATION.md
+.next/
+out/
+coverage/
+*.tsbuildinfo
+.turbo/
+.DS_Store
+*.pem
+.env
+.env.local
+.env*.local
+!.env.example
+
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.egg-info/
+.pytest_cache/
+.venv/
+venv/
+dist/
+*.dist-info/
+packages/sdk-python/.venv/

cred_semantic_kernel-1.0.0/PKG-INFO

@@ -0,0 +1,76 @@
+Metadata-Version: 2.4
+Name: cred-semantic-kernel
+Version: 1.0.0
+Summary: Cred Semantic Kernel integration — credential delegation plugin for Microsoft Semantic Kernel agents
+Author-email: Cred <hello@cred.ninja>
+License: Apache-2.0
+Keywords: ai-agents,cred,delegation,microsoft,oauth,semantic-kernel
+Requires-Python: >=3.9
+Requires-Dist: cred-auth>=0.1.0
+Requires-Dist: semantic-kernel>=1.0
+Provides-Extra: dev
+Requires-Dist: hatchling; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.21; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# cred-semantic-kernel
+
+Microsoft Semantic Kernel integration for Cred. OAuth2 credential delegation for AI agents.
+
+## Install
+
+```bash
+pip install cred-semantic-kernel
+```
+
+## Quick Start
+
+```python
+import os
+import semantic_kernel as sk
+from cred_semantic_kernel import CredPlugin
+
+kernel = sk.Kernel()
+
+plugin = CredPlugin(
+    agent_token=os.environ["CRED_AGENT_TOKEN"],
+    user_id="user_123",
+    app_client_id="my_app_client_id",
+)
+
+kernel.add_plugin(plugin, plugin_name="cred")
+```
+
+## Plugin Functions
+
+The `cred` plugin exposes one kernel function:
+
+### `delegate`
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `service` | `string` | Service slug (e.g. `google`, `github`) |
+| `scopes` | `string` | Comma-separated OAuth scopes to request |
+
+`user_id` and `app_client_id` are pre-configured at construction time, not agent-controlled.
+
+Returns a JSON string with `access_token`, `token_type`, `expires_in`, `service`, `scopes`, and `delegation_id`.
+
+## Handling Consent
+
+When the user hasn't connected the service, the `delegate` function raises `ConsentRequiredError`.
+The error's `consent_url` attribute contains the URL to redirect the user.
+
+```python
+from cred import ConsentRequiredError
+
+try:
+    result = plugin.delegate(service="google", scopes="calendar.readonly")
+except ConsentRequiredError as e:
+    print(f"Redirect user to: {e.consent_url}")
+```
+
+## Cred Cloud (Coming Soon)
+
+Managed cloud delegation is coming. [Join the waitlist](https://cred.ninja/waitlist).

cred_semantic_kernel-1.0.0/README.md

@@ -0,0 +1,60 @@
+# cred-semantic-kernel
+
+Microsoft Semantic Kernel integration for Cred. OAuth2 credential delegation for AI agents.
+
+## Install
+
+```bash
+pip install cred-semantic-kernel
+```
+
+## Quick Start
+
+```python
+import os
+import semantic_kernel as sk
+from cred_semantic_kernel import CredPlugin
+
+kernel = sk.Kernel()
+
+plugin = CredPlugin(
+    agent_token=os.environ["CRED_AGENT_TOKEN"],
+    user_id="user_123",
+    app_client_id="my_app_client_id",
+)
+
+kernel.add_plugin(plugin, plugin_name="cred")
+```
+
+## Plugin Functions
+
+The `cred` plugin exposes one kernel function:
+
+### `delegate`
+
+| Parameter | Type | Description |
+|-----------|------|-------------|
+| `service` | `string` | Service slug (e.g. `google`, `github`) |
+| `scopes` | `string` | Comma-separated OAuth scopes to request |
+
+`user_id` and `app_client_id` are pre-configured at construction time, not agent-controlled.
+
+Returns a JSON string with `access_token`, `token_type`, `expires_in`, `service`, `scopes`, and `delegation_id`.
+
+## Handling Consent
+
+When the user hasn't connected the service, the `delegate` function raises `ConsentRequiredError`.
+The error's `consent_url` attribute contains the URL to redirect the user.
+
+```python
+from cred import ConsentRequiredError
+
+try:
+    result = plugin.delegate(service="google", scopes="calendar.readonly")
+except ConsentRequiredError as e:
+    print(f"Redirect user to: {e.consent_url}")
+```
+
+## Cred Cloud (Coming Soon)
+
+Managed cloud delegation is coming. [Join the waitlist](https://cred.ninja/waitlist).

cred_semantic_kernel-1.0.0/cred_semantic_kernel/__init__.py

@@ -0,0 +1,5 @@
+"""Cred Semantic Kernel integration."""
+
+from .plugin import CredPlugin
+
+__all__ = ["CredPlugin"]

cred_semantic_kernel-1.0.0/cred_semantic_kernel/plugin.py

@@ -0,0 +1,88 @@
+"""Cred Semantic Kernel Plugin.
+
+Provides a kernel function that delegates OAuth credentials for AI agents.
+The plugin is pre-configured with agent identity and app context at construction.
+At runtime, the agent provides ``service`` and ``scopes`` as function parameters.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated, Optional
+
+from semantic_kernel.functions import kernel_function
+
+from cred import Cred
+
+
+class CredPlugin:
+    """Semantic Kernel plugin for Cred credential delegation.
+
+    Pre-configured at construction with the agent token, user ID, and
+    app client ID. Exposes a single ``delegate`` kernel function.
+
+    Example::
+
+        from cred_semantic_kernel import CredPlugin
+        import semantic_kernel as sk
+
+        kernel = sk.Kernel()
+        plugin = CredPlugin(
+            agent_token=os.environ["CRED_AGENT_TOKEN"],
+            user_id="user_123",
+            app_client_id="my_app",
+        )
+        kernel.add_plugin(plugin, plugin_name="cred")
+
+    Raises:
+        ConsentRequiredError: (from delegate at runtime) when the user hasn't
+            connected the requested service. The error message includes
+            ``consent_url`` so the caller can redirect the user.
+    """
+
+    def __init__(
+        self,
+        agent_token: str,
+        user_id: str,
+        app_client_id: str,
+        base_url: str = "https://api.cred.ninja",
+    ) -> None:
+        self._cred = Cred(agent_token=agent_token, base_url=base_url)
+        self._user_id = user_id
+        self._app_client_id = app_client_id
+
+    @kernel_function(
+        name="delegate",
+        description=(
+            "Get a delegated OAuth access token for a third-party service "
+            "on behalf of the current user. "
+            "Returns JSON with access_token, token_type, expires_in, service, scopes, "
+            "and delegation_id. "
+            "Raises an error with consent_url if the user hasn't connected the service."
+        ),
+    )
+    def delegate(
+        self,
+        service: Annotated[str, "Service slug to get a token for (e.g. 'google', 'github', 'google-calendar')."],
+        scopes: Annotated[str, "Comma-separated OAuth scopes to request (e.g. 'calendar.readonly,calendar.events'). Pass empty string to use all consented scopes."],
+    ) -> str:
+        """Delegate credentials and return JSON result."""
+        scope_list: Optional[list[str]] = None
+        if scopes:
+            scope_list = [s.strip() for s in scopes.split(",") if s.strip()]
+
+        result = self._cred.delegate(
+            service=service,
+            user_id=self._user_id,
+            app_client_id=self._app_client_id,
+            scopes=scope_list if scope_list else None,
+        )
+
+        return json.dumps({
+            "access_token": result.access_token,
+            "token_type": result.token_type,
+            "expires_in": result.expires_in,
+            "service": result.service,
+            "scopes": result.scopes,
+            "delegation_id": result.delegation_id,
+        })

cred_semantic_kernel-1.0.0/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "cred-semantic-kernel"
+version = "1.0.0"
+description = "Cred Semantic Kernel integration — credential delegation plugin for Microsoft Semantic Kernel agents"
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.9"
+authors = [{ name = "Cred", email = "hello@cred.ninja" }]
+keywords = ["cred", "semantic-kernel", "microsoft", "oauth", "delegation", "ai-agents"]
+dependencies = [
+    "cred-auth>=0.1.0",
+    "semantic-kernel>=1.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7.0", "pytest-asyncio>=0.21", "hatchling"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["cred_semantic_kernel"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

cred_semantic_kernel-1.0.0/tests/test_plugin.py

@@ -0,0 +1,187 @@
+"""Cred Semantic Kernel plugin tests.
+
+Tests focus on: plugin construction, kernel_function metadata, invocation,
+output JSON, and error propagation. The Cred client is mocked -- no real HTTP.
+"""
+
+import json
+from datetime import datetime, timezone
+from typing import Optional
+import pytest
+import httpx
+from unittest.mock import MagicMock, patch
+
+from cred import DelegationResult, ConsentRequiredError, CredError
+from cred_semantic_kernel import CredPlugin
+
+TOKEN = "cred_at_test"
+USER_ID = "user_123"
+APP_CLIENT_ID = "app_1"
+
+
+def make_delegation_result(
+    *,
+    access_token: str = "at",
+    token_type: str = "Bearer",
+    expires_in: int = 3600,
+    service: str = "google",
+    scopes: Optional[list[str]] = None,
+    delegation_id: str = "del_1",
+) -> DelegationResult:
+    return DelegationResult(
+        access_token=access_token,
+        token_type=token_type,
+        expires_in=expires_in,
+        expires_at=datetime(2026, 3, 1, tzinfo=timezone.utc),
+        service=service,
+        scopes=scopes or [],
+        delegation_id=delegation_id,
+    )
+
+
+@pytest.fixture
+def mock_cred():
+    return MagicMock()
+
+
+@pytest.fixture
+def plugin(mock_cred):
+    with patch("cred_semantic_kernel.plugin.Cred", return_value=mock_cred):
+        return CredPlugin(
+            agent_token=TOKEN,
+            user_id=USER_ID,
+            app_client_id=APP_CLIENT_ID,
+        )
+
+
+# -- constructor ---------------------------------------------------------------
+
+class TestConstructor:
+    def test_creates_cred_client(self):
+        with patch("cred_semantic_kernel.plugin.Cred") as mock_cls:
+            CredPlugin(
+                agent_token=TOKEN,
+                user_id=USER_ID,
+                app_client_id=APP_CLIENT_ID,
+                base_url="http://localhost:3001",
+            )
+            mock_cls.assert_called_once_with(
+                agent_token=TOKEN,
+                base_url="http://localhost:3001",
+            )
+
+    def test_stores_user_id(self, plugin):
+        assert plugin._user_id == USER_ID
+
+    def test_stores_app_client_id(self, plugin):
+        assert plugin._app_client_id == APP_CLIENT_ID
+
+
+# -- kernel_function metadata --------------------------------------------------
+
+class TestKernelFunction:
+    def test_delegate_has_kernel_function_metadata(self, plugin):
+        # kernel_function decorator adds __kernel_function_metadata__
+        assert hasattr(plugin.delegate, "__kernel_function__")
+
+    def test_delegate_is_callable(self, plugin):
+        assert callable(plugin.delegate)
+
+
+# -- delegate invocation -------------------------------------------------------
+
+class TestDelegate:
+    def test_returns_json_with_access_token(self, plugin, mock_cred):
+        mock_cred.delegate.return_value = make_delegation_result(
+            access_token="ya29.mock",
+            expires_in=3600,
+            service="google",
+            scopes=["calendar.readonly"],
+            delegation_id="del_abc",
+        )
+
+        result_str = plugin.delegate(service="google", scopes="calendar.readonly")
+        result = json.loads(result_str)
+
+        assert result["access_token"] == "ya29.mock"
+        assert result["token_type"] == "Bearer"
+        assert result["expires_in"] == 3600
+        assert result["service"] == "google"
+        assert result["scopes"] == ["calendar.readonly"]
+        assert result["delegation_id"] == "del_abc"
+
+    def test_passes_service_user_app_to_cred(self, plugin, mock_cred):
+        mock_cred.delegate.return_value = make_delegation_result(service="github")
+
+        plugin.delegate(service="github", scopes="repo")
+
+        mock_cred.delegate.assert_called_once_with(
+            service="github",
+            user_id=USER_ID,
+            app_client_id=APP_CLIENT_ID,
+            scopes=["repo"],
+        )
+
+    def test_parses_comma_separated_scopes(self, plugin, mock_cred):
+        mock_cred.delegate.return_value = make_delegation_result(
+            scopes=["calendar.readonly", "calendar.events"],
+        )
+
+        plugin.delegate(service="google", scopes="calendar.readonly, calendar.events")
+
+        call_kwargs = mock_cred.delegate.call_args.kwargs
+        assert call_kwargs["scopes"] == ["calendar.readonly", "calendar.events"]
+
+    def test_passes_none_scopes_when_empty_string(self, plugin, mock_cred):
+        mock_cred.delegate.return_value = make_delegation_result()
+
+        plugin.delegate(service="google", scopes="")
+
+        call_kwargs = mock_cred.delegate.call_args.kwargs
+        assert call_kwargs["scopes"] is None
+
+    def test_propagates_consent_required_error(self, plugin, mock_cred):
+        mock_cred.delegate.side_effect = ConsentRequiredError(
+            "User has not consented",
+            "https://api.cred.ninja/api/connect/google/authorize?app_client_id=app_1",
+        )
+
+        with pytest.raises(ConsentRequiredError) as exc_info:
+            plugin.delegate(service="google", scopes="calendar.readonly")
+
+        assert "/api/connect/google/authorize" in exc_info.value.consent_url
+
+    def test_propagates_cred_error_on_401(self, plugin, mock_cred):
+        mock_cred.delegate.side_effect = CredError(
+            "Invalid agent token", "unauthorized", 401
+        )
+
+        with pytest.raises(CredError) as exc_info:
+            plugin.delegate(service="google", scopes="")
+
+        assert exc_info.value.status_code == 401
+
+    def test_real_cred_client_delegates_against_mock_server(self):
+        plugin = CredPlugin(
+            agent_token=TOKEN,
+            user_id=USER_ID,
+            app_client_id=APP_CLIENT_ID,
+            base_url="https://cred.example.com",
+        )
+
+        with patch("httpx.Client.request", return_value=httpx.Response(
+            200,
+            json={
+                "access_token": "ya29.real",
+                "token_type": "Bearer",
+                "expires_in": 3600,
+                "service": "google",
+                "scopes": ["calendar.readonly"],
+                "delegation_id": "del_real",
+            },
+        )) as request_mock:
+            result_str = plugin.delegate(service="google", scopes="calendar.readonly")
+
+        payload = json.loads(result_str)
+        assert payload["access_token"] == "ya29.real"
+        assert request_mock.called