datacontract-cli 1.2.8__tar.gz → 1.2.9__tar.gz

{datacontract_cli-1.2.8/datacontract_cli.egg-info → datacontract_cli-1.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datacontract-cli
-Version: 1.2.8
+Version: 1.2.9
 Summary: The datacontract CLI is an open source command-line tool for working with Data Contracts. It uses data contract YAML files to lint the data contract, connect to data sources and execute schema and quality tests, detect breaking changes, and export to different formats. The tool is written in Python. It can be used as a standalone CLI tool, in a CI/CD pipeline, or directly as a Python library.
 Author-email: Jochen Christ <jochen.christ@entropy-data.com>, Stefan Negele <stefan.negele@innoq.com>, Simon Harrer <simon.harrer@entropy-data.com>
 License-Expression: MIT
@@ -73,7 +73,7 @@ Requires-Dist: rich>=12.4.4; extra == "dataframe"
 Provides-Extra: databricks
 Requires-Dist: ibis-framework[databricks]<13.0.0,>=10.0.0; extra == "databricks"
 Requires-Dist: databricks-sql-connector<4.7.0,>=3.7.0; extra == "databricks"
-Requires-Dist: databricks-sdk<0.154.0; extra == "databricks"
+Requires-Dist: databricks-sdk<0.157.0; extra == "databricks"
 Requires-Dist: packaging<27.0,>=21.3; extra == "databricks"
 Provides-Extra: databricks-runtime
 Requires-Dist: datacontract-cli[databricks]; extra == "databricks-runtime"
@@ -107,8 +107,9 @@ Requires-Dist: duckdb-extension-azure<1.6.0,>=1.5.0; extra == "azure"
 Requires-Dist: azure-identity<1.27,>=1.17.1; extra == "azure"
 Requires-Dist: azure-storage-blob<12.32,>=12.24; extra == "azure"
 Provides-Extra: snowflake
-Requires-Dist: snowflake-connector-python[pandas]<4.9,>=3.6; extra == "snowflake"
+Requires-Dist: snowflake-connector-python[pandas]<5.2,>=3.17; extra == "snowflake"
 Requires-Dist: ibis-framework[snowflake]<13.0.0,>=10.0.0; extra == "snowflake"
+Requires-Dist: packaging<27.0,>=21.3; extra == "snowflake"
 Provides-Extra: sqlserver
 Requires-Dist: ibis-framework[mssql]<13.0.0,>=10.0.0; extra == "sqlserver"
 Requires-Dist: packaging<27.0,>=21.3; extra == "sqlserver"
@@ -144,7 +145,7 @@ Requires-Dist: pyarrow>=18.1.0; extra == "parquet"
 Provides-Extra: rdf
 Requires-Dist: rdflib==7.6.0; extra == "rdf"
 Provides-Extra: api
-Requires-Dist: fastapi<0.144.0,>=0.115.0; extra == "api"
+Requires-Dist: fastapi<0.162.0,>=0.115.0; extra == "api"
 Requires-Dist: uvicorn<0.55.0,>=0.44.0; extra == "api"
 Provides-Extra: protobuf
 Requires-Dist: proto-schema-parser<3.0,>=1.0; extra == "protobuf"
@@ -164,10 +165,10 @@ Requires-Dist: pre-commit<4.7.0,>=3.7.1; extra == "dev"
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: pytest-xdist; extra == "dev"
-Requires-Dist: pymssql==2.4.4; extra == "dev"
+Requires-Dist: pymssql==2.4.5; extra == "dev"
 Requires-Dist: psycopg2-binary<3.0,>=2.9; extra == "dev"
-Requires-Dist: mysql-connector-python<26.8.0,>=8.0.30; extra == "dev"
-Requires-Dist: ruff==0.17.1; extra == "dev"
+Requires-Dist: mysql-connector-python<26.11.0,>=8.0.30; extra == "dev"
+Requires-Dist: ruff==0.17.2; extra == "dev"
 Requires-Dist: testcontainers[kafka,minio,mssql,mysql,postgres]==4.15.0; extra == "dev"
 Requires-Dist: trino==0.340.0; extra == "dev"
 Dynamic: license-file

datacontract_cli-1.2.9/datacontract/__init__.py

@@ -0,0 +1,30 @@
+# Configuration so that yaml.safe_dump dumps strings with line breaks with yaml literal |
+import warnings
+
+import yaml
+
+yaml.SafeDumper.org_represent_str = yaml.SafeDumper.represent_str
+
+
+def repr_str(dumper, data):
+    if "\n" in data:
+        return dumper.represent_scalar("tag:yaml.org,2002:str", data, style="|")
+    return dumper.org_represent_str(data)
+
+
+yaml.add_representer(str, repr_str, Dumper=yaml.SafeDumper)
+
+# snowflake-connector-python 5.x warns on every connection about a changing logout default, and about the 4.x
+# parameter names we keep passing because Python 3.10 installs still get 4.x.
+warnings.filterwarnings(
+    "ignore", message="enable_server_session_keep_alive_auto_detection was not set", category=FutureWarning
+)
+warnings.filterwarnings(
+    "ignore",
+    message="'(private_key_file_pwd|network_timeout|socket_timeout)' is deprecated",
+    category=DeprecationWarning,
+)
+
+from datacontract.config import Config  # noqa: E402
+
+__all__ = ["Config"]

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/api.py

@@ -12,7 +12,7 @@ from fastapi.security.api_key import APIKeyHeader
 from pydantic import BaseModel, Field, ValidationError
 
 from datacontract.config import Config, known_env_names
-from datacontract.config.variables import CONTRACT_VARIABLES_ENV, allowed_environment, resolve_variables
+from datacontract.config.variables import CONTRACT_VARIABLES_ENV, allowed_environment, resolve_server_variables
 from datacontract.data_contract import DataContract, ExportFormat
 from datacontract.model.breaking import BreakingChangeEntry, Perspective
 from datacontract.model.changelog import ChangelogEntry
@@ -443,6 +443,22 @@ AUTHENTICATION_RESPONSES: dict[int | str, dict] = {
 
 _CONFIG_HEADER_PREFIX = "datacontract-"
 
+# Options naming a file or folder on the server's disk, or the server's own workload identity: the operator's
+# to choose, never the caller's, or a caller could have the server log in as the operator to a host of their choosing.
+_SERVER_ONLY_OPTIONS = frozenset(
+    {
+        "DATACONTRACT_CUSTOM_QUALITY_CHECKS",
+        "DATACONTRACT_SNOWFLAKE_PRIVATE_KEY_FILE",
+        "DATACONTRACT_SNOWFLAKE_PRIVATE_KEY_PATH",
+        "DATACONTRACT_SNOWFLAKE_TOKEN_FILE_PATH",
+        "DATACONTRACT_SNOWFLAKE_WORKLOAD_IDENTITY_PROVIDER",
+        "DATACONTRACT_BIGQUERY_ACCOUNT_INFO_JSON_PATH",
+        "DATACONTRACT_DATABRICKS_PROFILE",
+        "DATACONTRACT_ORACLE_CLIENT_DIR",
+        "DATACONTRACT_DUCKDB_DATABASE",
+    }
+)
+
 
 def config_from_headers(headers) -> "Config | None":
     """Build a per-request Config from configuration option headers.
@@ -452,8 +468,8 @@ def config_from_headers(headers) -> "Config | None":
     → ``DATACONTRACT_SNOWFLAKE_PASSWORD``, ``entropy-data-api-key`` →
     ``ENTROPY_DATA_API_KEY``. Returns None when no config headers are present,
     so env-var-configured deployments behave exactly as before. Unknown
-    ``datacontract-*`` option names are rejected with a 400, and so is the
-    custom quality checks folder.
+    ``datacontract-*`` option names are rejected with a 400, and so are options
+    only the operator may set.
     """
     known = known_env_names()
     values = {}
@@ -461,11 +477,10 @@ def config_from_headers(headers) -> "Config | None":
         lowered = name.lower()
         env = lowered.upper().replace("-", "_")
         if lowered.startswith(_CONFIG_HEADER_PREFIX) or env in known:
-            if env == "DATACONTRACT_CUSTOM_QUALITY_CHECKS":
-                # A folder on the server's disk is the operator's to choose, never the caller's.
+            if env in _SERVER_ONLY_OPTIONS:
                 raise HTTPException(
                     status_code=status.HTTP_400_BAD_REQUEST,
-                    detail="The custom quality checks folder is configured by the API server, not per request.",
+                    detail=f"{env} is set on the API server. It is not possible to override it per request.",
                 )
             values[env] = value
     if not values:
@@ -516,12 +531,25 @@ _ENVIRONMENT_CREDENTIAL_TARGETS: dict[str, tuple[str, str | None, tuple[str, ...
     "hive": ("host", "hive_host", ("hive_password",)),
     "redshift": ("host", "redshift_host", ("redshift_password",)),
     "sqlserver": ("host", "sqlserver_host", ("sqlserver_password",)),
+    "mssql": ("host", "sqlserver_host", ("sqlserver_password",)),
     "snowflake": (
         "account",
         "snowflake_account",
-        ("snowflake_password", "snowflake_token", "snowflake_private_key"),
+        (
+            "snowflake_password",
+            "snowflake_token",
+            "snowflake_private_key",
+            "snowflake_private_key_file",
+            "snowflake_private_key_path",
+            "snowflake_token_file_path",
+            "snowflake_workload_identity_provider",
+        ),
+    ),
+    "databricks": (
+        "host",
+        "databricks_server_hostname",
+        ("databricks_token", "databricks_client_secret", "databricks_profile"),
     ),
-    "databricks": ("host", "databricks_server_hostname", ("databricks_token", "databricks_client_secret")),
     # Kafka's broker host is always the contract's `server.host` (no environment
     # option pins it), so an environment-held SASL password can never be paired
     # with a posted contract safely -- host_field is None, so it is always rejected.
@@ -539,13 +567,17 @@ def _selected_server(body: str, server_name: str | None, config):
     """
     from datacontract.engines.data_contract_test import get_server
     from datacontract.lint import resolve
+    from datacontract.model.server import get_server_type
 
     try:
         data_contract = resolve.resolve_data_contract(data_contract_str=body, config=config)
         server = get_server(data_contract, server_name)
-        # Guard the server type the test will run against, not a ${VAR:-local} reference to it.
-        variables = allowed_environment(_allowed_contract_variables())
-        return server and server.model_copy(update={"type": resolve_variables(server.type, variables=variables)})
+        if server is None:
+            return None
+        # Guard the server type the test will connect to: references like ${VAR:-local} resolved, and
+        # `custom` + customType or an ODCS synonym such as `postgresql` mapped to the type the CLI dispatches on.
+        server = resolve_server_variables(server, allowed_environment(_allowed_contract_variables()))
+        return server.model_copy(update={"type": get_server_type(server)})
     except Exception:
         return None
 
@@ -630,11 +662,23 @@ def _reject_environment_credentials_to_untrusted_host(body: str, server_name: st
     target_attr, host_field, secret_fields = guard
     if not any(resolved.option_source(field) == "env" for field in secret_fields):
         return  # no environment-held secret for this server type; nothing to protect
-    if host_field is not None and resolved.option_source(host_field) == "env":
-        return  # the operator pinned the target host; the contract's host is ignored
     held = [
         env_name(field, Config.model_fields[field]) for field in secret_fields if resolved.option_source(field) == "env"
     ]
+    if host_field is not None and resolved.option_source(host_field) == "env":
+        # Snowflake's host and port override the address the pinned account resolves to.
+        redirects = [
+            env_name(field, Config.model_fields[field])
+            for field in ("snowflake_host", "snowflake_port")
+            if server.type == "snowflake" and resolved.option_source(field) == "request"
+        ]
+        if not redirects:
+            return  # the operator pinned the target host; the contract's host is ignored
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"{', '.join(redirects)} cannot be set per request while the API server uses its own Snowflake "
+            f"credential ({', '.join(held)}). Remove it, or send all credentials with the request.",
+        )
     if host_field is not None:
         env_var = env_name(host_field, Config.model_fields[host_field])
         detail = (

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/cli.py

@@ -35,8 +35,7 @@ custom_quality_checks_option = Annotated[
     Optional[Path],
     typer.Option(
         metavar="DIR",
-        help="Folder with the custom quality checks the contract's quality rules use, one YAML file per check. "
-        "Defaults to DATACONTRACT_CUSTOM_QUALITY_CHECKS.",
+        help="Folder with custom quality checks. Defaults to DATACONTRACT_CUSTOM_QUALITY_CHECKS.",
     ),
 ]
 

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/config/settings.py

@@ -136,6 +136,8 @@ class Config(BaseSettings):
     bigquery_account_info_json_path: str | None = None
     bigquery_billing_project: str | None = None
     bigquery_impersonation_account: str | None = None
+    bigquery_location: str | None = None
+    bigquery_kms_key_name: str | None = None
     # overrides for the contract's servers block
     bigquery_project: str | None = None
     bigquery_dataset: str | None = None
@@ -279,8 +281,10 @@ class Config(BaseSettings):
     snowflake_username: str | None = None
     snowflake_password: SecretStr | None = None
     snowflake_authenticator: str | None = None
+    snowflake_workload_identity_provider: str | None = None
     snowflake_role: str | None = None
     snowflake_token: SecretStr | None = None
+    snowflake_token_file_path: str | None = None
     snowflake_passcode: SecretStr | None = None
     snowflake_private_key: SecretStr | None = None
     snowflake_private_key_file: str | None = None
@@ -582,6 +586,12 @@ class Config(BaseSettings):
     def get_bigquery_impersonation_account(self, required: bool = False) -> str | None:
         return self._str_option("bigquery_impersonation_account", required)
 
+    def get_bigquery_location(self, required: bool = False) -> str | None:
+        return self._str_option("bigquery_location", required)
+
+    def get_bigquery_kms_key_name(self, required: bool = False) -> str | None:
+        return self._str_option("bigquery_kms_key_name", required)
+
     def get_bigquery_project(self, required: bool = False) -> str | None:
         return self._str_option("bigquery_project", required)
 
@@ -902,12 +912,18 @@ class Config(BaseSettings):
     def get_snowflake_authenticator(self, required: bool = False) -> str | None:
         return self._str_option("snowflake_authenticator", required)
 
+    def get_snowflake_workload_identity_provider(self, required: bool = False) -> str | None:
+        return self._str_option("snowflake_workload_identity_provider", required)
+
     def get_snowflake_role(self, required: bool = False) -> str | None:
         return self._str_option("snowflake_role", required)
 
     def get_snowflake_token(self, required: bool = False) -> str | None:
         return self._str_option("snowflake_token", required)
 
+    def get_snowflake_token_file_path(self, required: bool = False) -> str | None:
+        return self._str_option("snowflake_token_file_path", required)
+
     def get_snowflake_passcode(self, required: bool = False) -> str | None:
         return self._str_option("snowflake_passcode", required)
 

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/engines/checks/check_spec.py

@@ -151,6 +151,7 @@ class CheckSpec:
     valid_min_items: Optional[int] = None  # INVALID_COUNT, array columns
     valid_max_items: Optional[int] = None  # INVALID_COUNT, array columns
     valid_unique_items: Optional[bool] = None  # INVALID_COUNT, array columns
+    value_type: Optional[str] = None  # the declared type a value stored untyped is cast to
 
     expected_category: Optional[str] = None  # FIELD_TYPE: human-readable label (display only)
     expected_type_label: Optional[str] = None  # FIELD_TYPE: human-readable expected type
@@ -166,6 +167,7 @@ class CheckSpec:
     query: Optional[str] = None  # CUSTOM_SQL (placeholders already substituted)
     dialect: Optional[str] = None  # CUSTOM_SQL input SQL dialect
     diagnostics: Optional[dict] = None  # CUSTOM_SQL: reported alongside the measured value
+    custom_quality_check: Optional[str] = None  # CUSTOM_SQL: the check's ID and arguments, as between(min=1, max=100)
     warnings: Optional[List[str]] = None  # for the run's log
 
     seconds: Optional[int] = None  # FRESHNESS / RETENTION threshold in seconds

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/engines/checks/create_checks.py

@@ -28,6 +28,7 @@ from datacontract.engines.checks.check_spec import METADATA_METRICS, CheckSpec,
 from datacontract.engines.checks.custom_quality_check import (
     COLUMN_PLACEHOLDERS,
     ENGINE,
+    CustomQualityChecks,
     CustomQualityCheckUnusable,
     Instance,
     instantiate,
@@ -54,6 +55,7 @@ _NESTED_CHECK_SERVER_TYPES = {
     "kafka",
     "trino",
     "athena",
+    "snowflake",
 } | _FILE_SERVER_TYPES
 
 
@@ -212,10 +214,14 @@ def prepare_query(
         names |= dict.fromkeys(COLUMN_PLACEHOLDERS, field_name)
 
     def identifier(name: str, forced: bool) -> str:
-        return ".".join(
+        parts = [
             exp.to_identifier(part, quoted=forced or not bare.fullmatch(part)).sql(dialect=dialect)
             for part in name.split(".")
-        )
+        ]
+        if dialect == "snowflake" and name == field_name:
+            # Snowflake reaches into a column's value with `:`; a dot would name a table's column
+            return parts[0] + "".join(f":{part}" for part in parts[1:])
+        return ".".join(parts)
 
     if instance is not None:
         return instance.render(dialect, names, identifier)
@@ -234,7 +240,7 @@ def create_checks(
     server: Optional[Server],
     schema_name: str = "all",
     variables: Optional[Mapping[str, str]] = None,
-    custom_quality_checks: Optional[str] = None,
+    custom_quality_checks: Optional[CustomQualityChecks] = None,
 ) -> List[CheckSpec]:
     checks: List[CheckSpec] = []
     if data_contract.schema_ is None:
@@ -265,7 +271,7 @@ def _to_schema_checks(
     schema_object: SchemaObject,
     server: Optional[Server],
     variables: Optional[Mapping[str, str]] = None,
-    custom_quality_checks: Optional[str] = None,
+    custom_quality_checks: Optional[CustomQualityChecks] = None,
 ) -> List[CheckSpec]:
     checks: List[CheckSpec] = []
     server_type = get_server_type(server) if server is not None else None
@@ -598,6 +604,7 @@ def _to_schema_checks(
 
         # A check the server cannot run is reported, not dropped.
         for check in checks[first_check:]:
+            check.value_type = prop_type
             if check.preset_result == "warning":
                 # An unrunnable rule keeps its own, more specific reason.
                 continue
@@ -831,7 +838,7 @@ def _quality_checks(
     quality_list: List[DataQuality],
     server: Optional[Server],
     variables: Optional[Mapping[str, str]] = None,
-    custom_quality_checks: Optional[str] = None,
+    custom_quality_checks: Optional[CustomQualityChecks] = None,
 ) -> List[CheckSpec]:
     checks: List[CheckSpec] = []
     for count, quality in enumerate(quality_list):
@@ -933,7 +940,7 @@ def _quality_rule_checks(
     count: int,
     server: Optional[Server],
     variables: Optional[Mapping[str, str]] = None,
-    custom_quality_checks: Optional[str] = None,
+    custom_quality_checks: Optional[CustomQualityChecks] = None,
 ) -> List[CheckSpec]:
     """The checks of a single ODCS quality rule (``count`` is its index in the list)."""
     if quality.type == "custom" and quality.engine == "soda" and quality.implementation:
@@ -1000,6 +1007,7 @@ def _quality_rule_checks(
                 severity=rule.severity,
                 dimension=rule.dimension,
                 diagnostics=instance.diagnostics,
+                custom_quality_check=instance.call,
                 warnings=instance.warnings,
             )
         ]

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/engines/checks/custom_quality_check.py

@@ -8,7 +8,9 @@ import re
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Callable, Mapping, Optional
+from urllib.parse import quote, urlparse
 
+import requests
 import sqlglot
 import yaml
 from open_data_contract_standard.model import DataQuality
@@ -17,9 +19,11 @@ from sqlglot import exp
 from sqlglot.dialects.dialect import Dialect
 from sqlglot.tokens import TokenType
 
+from datacontract.config import Config
 from datacontract.config.variables import _ENUM_VALUES
 from datacontract.engines.checks.sql_guard import _DIALECT_BY_SERVER_TYPE
-from datacontract.lint.resolve import _SafeLoaderNoTimestamp
+from datacontract.integration.entropy_data import _get_api_key_or_none, _get_host
+from datacontract.lint.resolve import _api_key_for, _SafeLoaderNoTimestamp
 
 ENGINE = "datacontract-cli"
 
@@ -91,41 +95,104 @@ class CustomQualityCheck:
     warnings: list[str] = field(default_factory=list)
 
 
-def load(directory: str, check_id: str) -> CustomQualityCheck:
-    folder = Path(directory)
-    if not folder.is_dir():
-        problem = "is a file, not a folder" if folder.exists() else "does not exist"
-        raise CustomQualityCheckError(f"The custom quality checks folder {directory} {problem}.")
-    # The ID comes from the contract, so it is looked up among the files, never joined into a path.
-    # IDs are unique ignoring case.
-    files: dict[str, list[Path]] = {}
-    for path in sorted(folder.iterdir()):
-        if path.is_file() and path.suffix in (".yaml", ".yml"):
-            files.setdefault(path.stem.lower(), []).append(path)
-    paths = files.get(check_id.lower(), [])
-    if len(paths) > 1:
-        raise CustomQualityCheckError(
-            f"The custom quality check '{check_id}' is defined twice: {', '.join(path.name for path in paths)}."
+class CustomQualityChecks:
+    """Where a test run finds its custom quality checks: the folder first, then Entropy Data."""
+
+    def __init__(self, config: Config, untrusted_contract: bool = False):
+        self.directory = config.get_custom_quality_checks()
+        # An untrusted caller may set the host per request (API header); checks still come from the platform
+        # as the environment sees it, or the request would choose where the server sends its GET.
+        self.host = _get_host(None if untrusted_contract else config).rstrip("/")
+        self.api_key = _api_key_for(self.host, config, untrusted_contract)
+        # A key the request brought for its own host is not sent to the environment's host.
+        self.ignored_request_host = (
+            _get_host(config)
+            if untrusted_contract and self.api_key is None and _get_api_key_or_none(config) is not None
+            else None
         )
-    if not paths or paths[0].stem != check_id:
-        ids = sorted(path.stem for group in files.values() for path in group)
-        if len(ids) <= 7:
-            hint = f" Available: {', '.join(ids) or 'none'}."
-        else:
-            similar = difflib.get_close_matches(check_id, ids, n=3)
-            hint = f" Did you mean {', '.join(similar)}?" if similar else ""
-        raise CustomQualityCheckError(f"There is no custom quality check with the ID '{check_id}'.{hint}")
-    try:
-        document = yaml.load(paths[0].read_text(encoding="utf-8"), Loader=_SafeLoaderNoTimestamp)
-    except yaml.YAMLError as e:
-        raise CustomQualityCheckError(f"The custom quality check '{check_id}' is not valid YAML: {e}")
-    return _parse(check_id, document)
+        # lowercased ID -> the check's YAML, or why Entropy Data could not provide it
+        self._fetched: dict[str, str | CustomQualityCheckError] = {}
+
+    def load(self, check_id: str) -> CustomQualityCheck:
+        """The check with ``check_id``, regardless of case."""
+        if self.directory is not None:
+            folder = Path(self.directory)
+            if not folder.is_dir():
+                problem = "is a file, not a folder" if folder.exists() else "does not exist"
+                raise CustomQualityCheckError(f"The custom quality checks folder {self.directory} {problem}.")
+            # The ID comes from the contract, so it is looked up among the files, never joined into a path.
+            files: dict[str, list[Path]] = {}
+            for path in sorted(folder.iterdir()):
+                if path.is_file() and path.suffix in (".yaml", ".yml"):
+                    files.setdefault(path.stem.lower(), []).append(path)
+            paths = files.get(check_id.lower(), [])
+            if len(paths) > 1:
+                raise CustomQualityCheckError(
+                    f"The custom quality check '{check_id}' is defined twice: {', '.join(path.name for path in paths)}."
+                )
+            if paths:
+                return _parse(check_id, paths[0].read_text(encoding="utf-8"))
+            if self.api_key is None:
+                ids = sorted(path.stem for group in files.values() for path in group)
+                if len(ids) <= 7:
+                    hint = f" Available: {', '.join(ids) or 'none'}."
+                else:
+                    similar = difflib.get_close_matches(check_id, ids, n=3)
+                    hint = f" Did you mean {', '.join(similar)}?" if similar else ""
+                raise CustomQualityCheckError(f"There is no custom quality check with the ID '{check_id}'.{hint}")
+
+        key = check_id.lower()
+        if key not in self._fetched:
+            reason = None
+            try:
+                # Not following redirects keeps the API key from travelling to another host.
+                response = requests.get(
+                    f"{self.host}/api/custom-quality-checks/{quote(check_id, safe='')}/check.yaml",
+                    headers={"x-api-key": self.api_key, "Accept": "application/yaml"},
+                    timeout=10,
+                    allow_redirects=False,
+                )
+            except requests.RequestException as e:
+                reason = str(e)
+            else:
+                if response.status_code == 200:
+                    self._fetched[key] = response.content.decode("utf-8")
+                elif response.status_code == 404:
+                    self._fetched[key] = CustomQualityCheckError(
+                        f"Neither '{self.directory}' nor Entropy Data has the custom quality check '{check_id}'."
+                        if self.directory is not None
+                        else f"Entropy Data has no custom quality check '{check_id}'."
+                    )
+                elif response.is_redirect:
+                    reason = (
+                        f"HTTP {response.status_code} redirect to '{response.headers.get('Location')}' is not followed"
+                    )
+                elif response.status_code in (401, 403):
+                    reason = f"the API key was rejected (HTTP {response.status_code})"
+                else:
+                    reason = f"HTTP {response.status_code} {response.reason}"
+            if reason is not None:
+                source = urlparse(self.host).netloc or self.host
+                self._fetched[key] = CustomQualityCheckError(
+                    f"The custom quality check '{check_id}' is not in '{self.directory}' and could not be loaded "
+                    f"from {source}: {reason}."
+                    if self.directory is not None
+                    else f"Could not load the custom quality check '{check_id}' from {source}: {reason}."
+                )
+        fetched = self._fetched[key]
+        if isinstance(fetched, CustomQualityCheckError):
+            raise fetched
+        return _parse(check_id, fetched)
 
 
-def _parse(check_id: str, document) -> CustomQualityCheck:
+def _parse(check_id: str, text: str) -> CustomQualityCheck:
     def invalid(detail: str) -> CustomQualityCheckError:
         return CustomQualityCheckError(f"The custom quality check '{check_id}' is invalid: {detail}")
 
+    try:
+        document = yaml.load(text, Loader=_SafeLoaderNoTimestamp)
+    except yaml.YAMLError as e:
+        raise CustomQualityCheckError(f"The custom quality check '{check_id}' is not valid YAML: {e}")
     if not isinstance(document, dict):
         raise invalid("it must be a YAML mapping.")
     # Unknown keys only warn, so a file written for a newer version still runs.
@@ -232,6 +299,8 @@ class Instance:
     # The rule with the check's defaults filled in: expected result and dimension.
     quality: DataQuality
     name: str
+    # The check's ID with the rule's arguments, as between(min=1, max=100)
+    call: str
     diagnostics: dict
     warnings: list[str]
 
@@ -365,7 +434,7 @@ def instantiate(
     model: str,
     field_name: Optional[str],
     dialect: Optional[str],
-    directory: Optional[str],
+    custom_quality_checks: Optional[CustomQualityChecks],
 ) -> Instance:
     """The rule's custom quality check for a server whose rules are written in ``dialect``."""
     implementation = quality.implementation if isinstance(quality.implementation, dict) else {}
@@ -386,6 +455,8 @@ def instantiate(
             f"The custom quality check ID '{check_id}' must not contain spaces, slashes, "
             "or any of the characters \\ % ; # ?"
         )
+    if check_id in (".", ".."):
+        raise unusable(f"'{check_id}' is no valid custom quality check ID.")
     location = model if field_name is None else f"{model}.{field_name}"
     rule_warnings += [
         f"Custom quality check '{check_id}' on {location}: Unknown key 'implementation.{key}' is ignored."
@@ -414,13 +485,22 @@ def instantiate(
         or f"{check_id}({', '.join(f'{argument}={value_text(value)}' for argument, value in given.items())})"
     )
 
-    if directory is None:
+    if custom_quality_checks is None or (
+        custom_quality_checks.directory is None and custom_quality_checks.api_key is None
+    ):
+        if custom_quality_checks is not None and custom_quality_checks.ignored_request_host is not None:
+            raise unusable(
+                f"The rule uses the custom quality check '{check_id}', but the request's API key belongs to its "
+                f"entropy-data-host '{custom_quality_checks.ignored_request_host}', so set ENTROPY_DATA_HOST to that "
+                "host on the server running the API."
+            )
         raise unusable(
-            f"The rule uses the custom quality check '{check_id}', but no custom quality checks folder is "
-            f"configured. Pass --custom-quality-checks or set DATACONTRACT_CUSTOM_QUALITY_CHECKS.",
+            f"The rule uses the custom quality check '{check_id}', but neither a custom quality checks folder nor "
+            f"an Entropy Data API key is configured. Pass --custom-quality-checks, or set "
+            f"DATACONTRACT_CUSTOM_QUALITY_CHECKS or ENTROPY_DATA_API_KEY.",
         )
     try:
-        check = load(directory, check_id)
+        check = custom_quality_checks.load(check_id)
     except CustomQualityCheckError as e:
         raise unusable(str(e))
 
@@ -453,6 +533,7 @@ def instantiate(
                 for item in (value if isinstance(value, list) else [value])
             ]
             arguments[argument] = (False, numbers if isinstance(value, list) else numbers[0])
+    call = f"{check.id}({', '.join(f'{name}={value_text(value)}' for name, (_, value) in arguments.items())})"
     if quality.description:
         name = quality.description
     elif check.description:
@@ -472,7 +553,7 @@ def instantiate(
 
         name = reference_pattern(TABLE_PLACEHOLDERS + COLUMN_PLACEHOLDERS).sub(fill, check.description)
     else:
-        name = f"{check.id}({', '.join(f'{name}={value_text(value)}' for name, (_, value) in arguments.items())})"
+        name = call
 
     for argument, (identifier, value) in arguments.items():
         if identifier and (not isinstance(value, str) or not value):
@@ -534,6 +615,7 @@ def instantiate(
         arguments=arguments,
         quality=quality.model_copy(update=updates),
         name=name,
+        call=call,
         diagnostics={
             "custom_quality_check": check.id,
             "query": query_dialect,

{datacontract_cli-1.2.8 → datacontract_cli-1.2.9}/datacontract/engines/data_contract_test.py

@@ -12,6 +12,7 @@ from open_data_contract_standard.model import OpenDataContractStandard, Server
 from datacontract.config import Config
 from datacontract.engines.checks.check_spec import MetricType
 from datacontract.engines.checks.create_checks import create_checks, to_schema_name
+from datacontract.engines.checks.custom_quality_check import CustomQualityChecks
 from datacontract.engines.checks.dimensions import default_dimension
 
 if typing.TYPE_CHECKING:
@@ -123,6 +124,7 @@ def execute_data_contract_test(
         )
 
     model_filters = resolve_row_filters(data_contract, server, run, filter, filters, schema_name)
+    custom_quality_checks = CustomQualityChecks(config, untrusted_contract)
 
     if server.type == "hana":
         from datacontract.engines.hana.check_hana_execute import check_hana_execute
@@ -140,6 +142,7 @@ def execute_data_contract_test(
             quality_ids=quality_ids,
             tags=tags,
             config=config,
+            custom_quality_checks=custom_quality_checks,
         )
         return
 
@@ -148,7 +151,7 @@ def execute_data_contract_test(
         server,
         schema_name=schema_name,
         variables=variables,
-        custom_quality_checks=config.get_custom_quality_checks(),
+        custom_quality_checks=custom_quality_checks,
     )
     if check_categories is not None:
         specs = [s for s in specs if s.category in check_categories]