datamasque-python 1.1.3__tar.gz → 1.1.5__tar.gz

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/HISTORY.rst

@@ -2,6 +2,21 @@
 History
 =======
 
+1.1.5 (2026-06-29)
+------------------
+
+* Added support for DataMasque deployments on Snowpark Container Services (SPCS):
+
+  * Added ``spcs_pat`` to ``DataMasqueInstanceConfig`` for authenticating through the SPCS app gateway.
+  * Added ``SpcsGatewayAuthError``, raised when the gateway rejects the PAT.
+  * Added the ``spcs`` option to ``SnowflakeStageLocation``.
+  * Made several ``SnowflakeConnectionConfig`` fields optional, since SPCS-staged connections leave them unset.
+
+1.1.4 (2026-06-29)
+------------------
+
+* Added ``DatabaseType.saphana`` for SAP HANA support.
+
 1.1.3 (2026-06-26)
 ------------------
 

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datamasque-python
-Version: 1.1.3
+Version: 1.1.5
 Summary: Official Python client for the DataMasque data-masking API.
 Project-URL: Homepage, https://datamasque.com/
 Project-URL: Documentation, https://datamasque-python.readthedocs.io/
@@ -74,6 +74,11 @@ Authentication is performed on the first request if ``authenticate()`` is not ca
 and is automatically retried once on a 401 response.
 ``client.healthcheck()`` is available as a lightweight readiness probe that does not consume credentials.
 
+For a DataMasque instance hosted on Snowpark Container Services (SPCS)
+(a ``*.snowflakecomputing.app`` ``base_url``),
+pass a Snowflake Programmatic Access Token as ``spcs_pat`` on ``DataMasqueInstanceConfig``.
+See the `usage docs <https://datamasque-python.readthedocs.io/en/latest/usage.html>`_ for details.
+
 Error handling
 ==============
 

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/README.rst

@@ -42,6 +42,11 @@ Authentication is performed on the first request if ``authenticate()`` is not ca
 and is automatically retried once on a 401 response.
 ``client.healthcheck()`` is available as a lightweight readiness probe that does not consume credentials.
 
+For a DataMasque instance hosted on Snowpark Container Services (SPCS)
+(a ``*.snowflakecomputing.app`` ``base_url``),
+pass a Snowflake Programmatic Access Token as ``spcs_pat`` on ``DataMasqueInstanceConfig``.
+See the `usage docs <https://datamasque-python.readthedocs.io/en/latest/usage.html>`_ for details.
+
 Error handling
 ==============
 

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/datamasque/client/base.py

@@ -21,6 +21,7 @@ from datamasque.client.exceptions import (
     DataMasqueTransportError,
 )
 from datamasque.client.models.dm_instance import DataMasqueInstanceConfig
+from datamasque.client.spcs import install_spcs_gateway_auth
 
 logger = logging.getLogger(__name__)
 
@@ -137,6 +138,8 @@ class BaseClient:
         self.verify_ssl = connection_config.verify_ssl
         self.token_source = connection_config.token_source
         self._session = _build_session(self.verify_ssl)
+        if connection_config.spcs_pat:
+            install_spcs_gateway_auth(self._session, connection_config.spcs_pat)
 
     @contextmanager
     def _maybe_suppress_insecure_warning(self) -> Iterator[None]:

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/datamasque/client/exceptions.py

@@ -84,6 +84,22 @@ class IfmAuthError(DataMasqueIfmError):
     """Raised when the IFM client cannot obtain or refresh a JWT (e.g. invalid credentials, missing scope)."""
 
 
+class SpcsGatewayAuthError(DataMasqueException):
+    """
+    Raised when a Snowflake SPCS app gateway rejects the configured `spcs_pat`.
+
+    The message includes the Snowflake-provided detail, request id,
+    and a hint at the likely cause
+    (for example an expired token, or a network policy that excludes your IP).
+
+    Deliberately a direct subclass of `DataMasqueException` rather than
+    `DataMasqueApiError`:
+    the client's 401 re-authenticate-and-retry path keys off `DataMasqueApiError`,
+    so keeping this outside that subtree
+    ensures a gateway rejection aborts immediately instead of looping.
+    """
+
+
 class RunNotCancellableError(DataMasqueUserError):
     """
     Raised when `cancel_run` is called against a run that is no longer eligible for cancellation.

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/datamasque/client/models/connection.py

@@ -48,6 +48,7 @@ class DatabaseType(Enum):
     databricks_lakebase = "databricks_lakebase"
     databricks = "databricks"
     informix = "informix"
+    saphana = "saphana"
 
 
 class SnowflakeStageLocation(str, Enum):
@@ -56,6 +57,7 @@ class SnowflakeStageLocation(str, Enum):
     local = "local"  # Not supported for production use
     aws_s3 = "aws_s3"
     azure_blob_storage = "azure_blob_storage"
+    spcs = "spcs"  # DataMasque running inside Snowflake SPCS; staged on the container's own storage
 
 
 class SseSelection(Enum):
@@ -233,10 +235,14 @@ class SnowflakeConnectionConfig(ConnectionConfig):
     """
 
     database: str
-    user: str
-    snowflake_account_id: str
-    snowflake_warehouse: str
-    snowflake_storage_integration_name: str
+    # Optional because DataMasque-in-SPCS connections leave these unset: the agent uses the
+    # container's OAuth token + SNOWFLAKE_HOST/SNOWFLAKE_ACCOUNT env and the app-owned QUERY_WAREHOUSE,
+    # so user/account/storage-integration/warehouse are null for stage_location=spcs. Mirrors the app's
+    # canonical model (agent .../schemas/connection/connection.py), which types these `| None = None`.
+    user: Optional[str] = None
+    snowflake_account_id: Optional[str] = None
+    snowflake_warehouse: Optional[str] = None
+    snowflake_storage_integration_name: Optional[str] = None
     host: str = ""
     port: Optional[int] = None
     db_schema: Optional[str] = Field(default=None, alias="schema")

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/datamasque/client/models/dm_instance.py

@@ -20,6 +20,11 @@ class DataMasqueInstanceConfig(BaseModel):
     the client prepends it with `Token ` when sending the `Authorization` header.
     The client calls `token_source` on each authentication attempt,
     so the callable is free to fetch and refresh tokens out-of-band (e.g. from a secrets manager).
+
+    `spcs_pat` is an optional Snowflake Programmatic Access Token
+    for reaching a DataMasque instance hosted on Snowpark Container Services (SPCS).
+    It layers underneath whichever DataMasque auth method
+    (`password` or `token_source`) you choose.
     """
 
     model_config = ConfigDict(arbitrary_types_allowed=True)
@@ -29,6 +34,14 @@ class DataMasqueInstanceConfig(BaseModel):
     password: Optional[str] = None
     verify_ssl: bool = True
     token_source: Optional[Callable[[], str]] = None
+    spcs_pat: Optional[str] = None
+    """Snowflake Programmatic Access Token
+    for a DataMasque instance hosted on Snowpark Container Services (SPCS),
+    where `base_url` ends in `.snowflakecomputing.app`.
+
+    Create the token in Snowsight (User profile → Programmatic access tokens)
+    for an account that can reach the SPCS app.
+    Leave unset for instances that are not hosted on SPCS."""
 
     @model_validator(mode="after")
     def _validate_auth_source(self) -> "DataMasqueInstanceConfig":

datamasque_python-1.1.5/datamasque/client/spcs.py

@@ -0,0 +1,179 @@
+"""
+Snowflake SPCS app gateway authentication for `DataMasqueClient`.
+
+When a DataMasque instance is hosted on Snowpark Container Services (SPCS),
+its app ingress (`*.snowflakecomputing.app`) fronts every request
+with a Snowflake gateway that must be cleared first.
+We authenticate to the gateway with a Programmatic Access Token (PAT),
+sent on `X-SF-SPCS-Authorization: Snowflake Token="<PAT>"`.
+The gateway accepts the PAT on this alternate header
+and strips it before forwarding to the container,
+so DataMasque's own `Authorization: Token <key>` flow rides through untouched.
+
+`install_spcs_gateway_auth` attaches this behaviour to a client's `requests.Session`:
+it sets the header on the session
+(so it is sent on every request, including the unauthenticated login)
+and registers a response hook
+that turns a gateway-originated rejection into a clear `SpcsGatewayAuthError`.
+"""
+
+import re
+from typing import Any, Optional
+
+import requests
+
+from datamasque.client.exceptions import SpcsGatewayAuthError
+
+SPCS_GATEWAY_AUTH_HEADER = "X-SF-SPCS-Authorization"
+
+# Body-shape discriminators for SPCS gateway error responses.
+# The gateway emits JSON with `responseType` (ERROR_<UPPER_SNAKE>), `requestId`
+# (canonical UUID), and `detail` (free text). All three must be present and
+# match these patterns for the body to count as gateway-originated.
+_GATEWAY_RESPONSE_TYPE_RE = re.compile(r"^ERROR_[A-Z][A-Z0-9_]+$")
+_UUID_RE = re.compile(
+    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+    re.IGNORECASE,
+)
+
+# Header-shape discriminators for "this response transited a Snowflake SPCS
+# gateway". The Server header and the `sfc-ss-` cookie name prefix both appear
+# on every gateway-handled response (success and error alike) and aren't
+# plausible to spoof by accident.
+_SPCS_GATEWAY_SERVER_VALUE = "_"
+_SPCS_COOKIE_PREFIX = "sfc-ss-"
+
+
+def _has_spcs_gateway_header_signature(response: requests.Response) -> bool:
+    """
+    True if at least one header-level Snowflake gateway marker is present.
+
+    Looks for either `Server: _` (the gateway's literal Server header value)
+    or any `Set-Cookie` carrying the `sfc-ss-` cookie name prefix.
+    Either is sufficient — both indicate the response was emitted by,
+    or transited, Snowflake's SPCS ingress.
+    """
+    if response.headers.get("server", "").strip() == _SPCS_GATEWAY_SERVER_VALUE:
+        return True
+    # `Set-Cookie` may appear multiple times; `requests` flattens duplicates
+    # via a comma-separated value in `.headers`, but our prefix substring
+    # check is order- and count-insensitive.
+    return _SPCS_COOKIE_PREFIX in response.headers.get("set-cookie", "")
+
+
+def _is_spcs_gateway_error_body(response: requests.Response) -> Optional[dict]:
+    """
+    Return the parsed body iff it is a structurally-valid gateway error.
+
+    All four conditions must hold:
+      1. The body parses as JSON and is a dict.
+      2. Keys `responseType`, `requestId`, `detail` are all present and string-typed.
+      3. `responseType` matches `^ERROR_<UPPER_SNAKE>$`.
+      4. `requestId` is a canonical 8-4-4-4-12 UUID.
+
+    Returns the parsed dict (truthy) on match, `None` on miss.
+    """
+    try:
+        data = response.json()
+    except ValueError:
+        return None
+    if not isinstance(data, dict):
+        return None
+    response_type = data.get("responseType")
+    request_id = data.get("requestId")
+    detail = data.get("detail")
+    if not (isinstance(response_type, str) and isinstance(request_id, str) and isinstance(detail, str)):
+        return None
+    if _GATEWAY_RESPONSE_TYPE_RE.match(response_type) and _UUID_RE.match(request_id):
+        return data
+    return None
+
+
+def _hint_for_gateway_detail(detail: str) -> str:
+    """Map common Snowflake gateway `detail` strings to a one-line cause hint."""
+    d = (detail or "").lower()
+    if "network policy" in d:
+        return (
+            "PAT requires a network policy attached to the user (or account) "
+            "that permits your current public IP. Run `CREATE NETWORK POLICY "
+            "... ALLOWED_IP_LIST = ('<your.ip>/32')` and `ALTER USER <pat-user> "
+            "SET NETWORK_POLICY = <policy>`."
+        )
+    if "invalid" in d and "token" in d:
+        return (
+            "PAT is malformed, expired, or revoked. Create a new PAT in Snowsight "
+            "(User profile -> Programmatic access tokens) and update `spcs_pat`."
+        )
+    if "expired" in d:
+        return "PAT has expired. Create a fresh one in Snowsight and update `spcs_pat`."
+    if "authentication" in d or "unauthorized" in d:
+        return (
+            "Generic auth rejection. Verify the PAT was created by a user that "
+            "has access to this SPCS app, and that any account-level network "
+            "policy includes your current public IP."
+        )
+    return "Unknown gateway rejection — see the Snowflake `detail` string above and the Snowflake PAT docs."
+
+
+def _check_spcs_gateway_response(response: requests.Response) -> None:
+    """
+    Raise `SpcsGatewayAuthError` iff `response` is a gateway-originated rejection.
+
+    Two-layer discriminator — both must hold:
+      * **Body originated at the gateway**:
+        strict shape match on the JSON body
+        (multiple fields, typed, with format constraints)
+        via `_is_spcs_gateway_error_body`.
+      * **Response transited an SPCS gateway**:
+        header signature confirms via `_has_spcs_gateway_header_signature`.
+
+    Either layer alone could in principle false-positive on an unrelated upstream
+    that happened to emit one of those signals;
+    the conjunction is what makes the check robust.
+    Legitimate DataMasque 401s (DRF `{"detail": "..."}`)
+    have the gateway header signature but fail the body shape —
+    so they correctly flow through
+    to the client's normal re-auth-and-retry path untouched.
+    """
+    if response.status_code not in (401, 403):
+        return
+    if not _has_spcs_gateway_header_signature(response):
+        return
+    data = _is_spcs_gateway_error_body(response)
+    if data is None:
+        return
+
+    response_type = data["responseType"]
+    request_id = data["requestId"]
+    detail = data["detail"]
+    hint = _hint_for_gateway_detail(detail)
+    raise SpcsGatewayAuthError(
+        f"SPCS gateway rejected the PAT (HTTP {response.status_code}, "
+        f"{response_type}). The request never reached DataMasque.\n"
+        f'  Snowflake said:   "{detail}"\n'
+        f"  Snowflake reqId:  {request_id}\n"
+        f"  Likely cause:     {hint}\n"
+        f"  Fix in Snowsight on the account hosting this SPCS app, then retry."
+    )
+
+
+def _spcs_gateway_response_hook(response: requests.Response, *args: Any, **kwargs: Any) -> None:
+    """`requests` response hook: raise on a gateway-originated auth rejection."""
+    _check_spcs_gateway_response(response)
+
+
+def install_spcs_gateway_auth(session: requests.Session, pat: str) -> None:
+    """
+    Configure `session` to authenticate to a Snowflake SPCS app gateway.
+
+    Sets the `X-SF-SPCS-Authorization` header on the session
+    (so it rides on every request, including the unauthenticated login)
+    and registers a response hook
+    that raises `SpcsGatewayAuthError` on a gateway rejection.
+
+    Scoping is automatic:
+    the client's session only ever talks to its own `base_url`,
+    so there is no need to match per-request hosts.
+    """
+    session.headers[SPCS_GATEWAY_AUTH_HEADER] = f'Snowflake Token="{pat}"'
+    session.hooks["response"].append(_spcs_gateway_response_hook)

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/docs/client.rst

@@ -60,6 +60,14 @@ datamasque.client.files module
    :undoc-members:
    :show-inheritance:
 
+datamasque.client.spcs module
+-----------------------------
+
+.. automodule:: datamasque.client.spcs
+   :members:
+   :undoc-members:
+   :show-inheritance:
+
 datamasque.client.ifm module
 ----------------------------
 

datamasque_python-1.1.5/docs/usage.rst

@@ -0,0 +1,49 @@
+=====
+Usage
+=====
+
+To use DataMasque Python in a project:
+
+.. code-block:: python
+
+    from datamasque.client import DataMasqueClient
+    from datamasque.client.models.dm_instance import DataMasqueInstanceConfig
+
+    config = DataMasqueInstanceConfig(
+        base_url="https://datamasque.example.com",
+        username="api_user",
+        password="api_password",
+    )
+    client = DataMasqueClient(config)
+    client.authenticate()
+
+    for connection in client.list_connections():
+        print(connection.name)
+
+Connecting to an SPCS-hosted instance
+=====================================
+
+When DataMasque is hosted on Snowpark Container Services (SPCS),
+its `base_url` ends in `.snowflakecomputing.app`
+and requests must first clear the Snowflake gateway.
+Pass a Snowflake Programmatic Access Token (PAT) as `spcs_pat`
+and the client clears the gateway for you,
+independently of your DataMasque `username`/`password` (or `token_source`) auth.
+
+.. code-block:: python
+
+    config = DataMasqueInstanceConfig(
+        base_url="https://my-app.snowflakecomputing.app",
+        username="api_user",
+        password="api_password",
+        spcs_pat="<snowflake-programmatic-access-token>",
+    )
+    client = DataMasqueClient(config)
+    client.authenticate()
+
+Create the PAT in Snowsight (User profile → Programmatic access tokens)
+for an account that can reach the SPCS app.
+If the gateway rejects the PAT
+(for example it has expired, or a network policy excludes your IP),
+the client raises `SpcsGatewayAuthError`
+with the Snowflake-provided detail and a hint at the likely cause.

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "datamasque-python"
-version = "1.1.3"
+version = "1.1.5"
 description = "Official Python client for the DataMasque data-masking API."
 authors = [
     { name = "DataMasque Ltd" },

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/tests/test_connections.py

@@ -952,6 +952,36 @@ def test_snowflake_connection_model_validate_with_stage_location():
     assert conn.password is None
 
 
+def test_snowflake_connection_model_validate_with_spcs_stage_location():
+    """
+    A Snowflake connection staged in SPCS must deserialise (regression for ui-testing MR !185).
+
+    When DataMasque runs inside Snowflake SPCS it saves connections with
+    `snowflake_stage_location=spcs`. Listing connections deserialises every
+    one, so an unknown stage value used to raise `ValidationError` and break
+    `create_or_update_connection` for unrelated connections on a shared instance.
+    """
+    payload = {
+        "id": "a1b2c3d4-0000-0000-0000-000000000000",
+        "name": "snowflake_spcs",
+        "mask_type": "database",
+        "db_type": "snowflake",
+        "user": "snowman",
+        "database": "icicle",
+        "snowflake_account_id": "ABCDEF-123456",
+        "snowflake_warehouse": "warehouse1",
+        "snowflake_storage_integration_name": "mysi",
+        "snowflake_stage_location": "spcs",
+    }
+
+    conn = SnowflakeConnectionConfig.model_validate(payload)
+
+    assert conn.snowflake_stage_location is SnowflakeStageLocation.spcs
+    # SPCS staging carries no external-storage fields.
+    assert conn.s3_bucket_name is None
+    assert conn.snowflake_azure_container_name is None
+
+
 def test_snowflake_connection_model_validate_without_stage_location():
     payload = {
         "id": "id-3",

datamasque_python-1.1.5/tests/test_spcs.py

@@ -0,0 +1,157 @@
+"""Tests for Snowflake SPCS app gateway auth (`spcs_pat` on the client)."""
+
+from unittest.mock import patch
+
+import pytest
+import requests_mock
+
+from datamasque.client import DataMasqueClient
+from datamasque.client.exceptions import SpcsGatewayAuthError
+from datamasque.client.models.dm_instance import DataMasqueInstanceConfig
+from datamasque.client.spcs import (
+    SPCS_GATEWAY_AUTH_HEADER,
+    _hint_for_gateway_detail,
+)
+
+BASE_URL = "https://my-app.snowflakecomputing.app"
+PAT = "PAT123"
+EXPECTED_HEADER = 'Snowflake Token="PAT123"'
+VALID_UUID = "12345678-1234-1234-1234-123456789abc"
+
+# Headers/body that together mark a response as a gateway-originated rejection.
+GATEWAY_HEADERS = {"Server": "_"}
+
+
+def _gateway_error_body(detail="Invalid token", response_type="ERROR_INVALID_TOKEN"):
+    return {"responseType": response_type, "requestId": VALID_UUID, "detail": detail}
+
+
+@pytest.fixture
+def spcs_config():
+    return DataMasqueInstanceConfig(
+        base_url=BASE_URL,
+        username="api_user",
+        password="api_password",
+        spcs_pat=PAT,
+    )
+
+
+@pytest.fixture
+def spcs_client(spcs_config):
+    client = DataMasqueClient(spcs_config)
+    client.token = "Token dm-token"  # pretend we're already authenticated with DM
+    return client
+
+
+def test_spcs_header_present_on_authenticated_request(spcs_client):
+    with requests_mock.Mocker() as m:
+        m.get(f"{BASE_URL}/api/anything/", json={}, status_code=200)
+        spcs_client.make_request("GET", "/api/anything/")
+
+    assert m.last_request.headers[SPCS_GATEWAY_AUTH_HEADER] == EXPECTED_HEADER
+    # DM's own auth header rides alongside, untouched.
+    assert m.last_request.headers["Authorization"] == "Token dm-token"
+
+
+def test_spcs_header_present_on_login_request(spcs_config):
+    """The header must ride on the unauthenticated login POST too (it must clear the gateway)."""
+    client = DataMasqueClient(spcs_config)
+    with requests_mock.Mocker() as m:
+        m.post(f"{BASE_URL}/api/auth/token/login/", json={"key": "k"}, status_code=200)
+        client.authenticate()
+
+    assert m.last_request.headers[SPCS_GATEWAY_AUTH_HEADER] == EXPECTED_HEADER
+    # Login is unauthenticated — no DM Authorization header on this request.
+    assert "Authorization" not in m.last_request.headers
+
+
+def test_no_spcs_pat_means_no_header_and_no_hook(client):
+    """The default client (no spcs_pat) is entirely unaffected."""
+    assert SPCS_GATEWAY_AUTH_HEADER not in client._session.headers
+    assert client._session.hooks["response"] == []
+
+    client.token = "Token dm-token"
+    with requests_mock.Mocker() as m:
+        m.get("http://test-server/api/anything/", json={}, status_code=200)
+        client.make_request("GET", "/api/anything/")
+    assert SPCS_GATEWAY_AUTH_HEADER not in m.last_request.headers
+
+
+def test_gateway_401_raises_and_does_not_retry(spcs_config):
+    """A gateway rejection aborts immediately — no re-auth, no retry loop."""
+    with patch.object(DataMasqueClient, "authenticate") as mock_auth:
+        client = DataMasqueClient(spcs_config)
+        client.token = "Token dm-token"
+        with requests_mock.Mocker() as m:
+            # A single response: a second call would 404 and fail the test loudly.
+            m.get(
+                f"{BASE_URL}/api/anything/",
+                json=_gateway_error_body(),
+                status_code=401,
+                headers=GATEWAY_HEADERS,
+            )
+            with pytest.raises(SpcsGatewayAuthError) as exc:
+                client.make_request("GET", "/api/anything/")
+
+        assert m.call_count == 1
+        mock_auth.assert_not_called()
+    # The helpful hint is surfaced.
+    assert "PAT is malformed, expired, or revoked" in str(exc.value)
+    assert VALID_UUID in str(exc.value)
+
+
+def test_normal_dm_401_still_retries(spcs_config):
+    """A genuine DataMasque 401 (no gateway signature) flows to the normal re-auth retry."""
+    client = DataMasqueClient(spcs_config)
+    with requests_mock.Mocker() as m:
+        m.post(f"{BASE_URL}/api/auth/token/login/", json={"key": "k"}, status_code=200)
+        m.get(
+            f"{BASE_URL}/api/anything/",
+            [
+                # DRF-shaped 401, no gateway Server header → not a gateway rejection.
+                {"json": {"detail": "Authentication credentials were not provided."}, "status_code": 401},
+                {"json": {"ok": True}, "status_code": 200},
+            ],
+        )
+        # Should NOT raise SpcsGatewayAuthError; should re-auth and succeed.
+        response = client.make_request("GET", "/api/anything/")
+
+    assert response.status_code == 200
+    assert client.token == "Token k"  # re-auth happened
+
+
+def test_gateway_signature_without_body_shape_passes_through(spcs_config):
+    """Gateway header present but DM-shaped body → treated as a normal DM 401, not a gateway rejection."""
+    client = DataMasqueClient(spcs_config)
+    with requests_mock.Mocker() as m:
+        m.post(f"{BASE_URL}/api/auth/token/login/", json={"key": "k"}, status_code=200)
+        m.get(
+            f"{BASE_URL}/api/anything/",
+            [
+                {"json": {"detail": "nope"}, "status_code": 401, "headers": GATEWAY_HEADERS},
+                {"json": {"ok": True}, "status_code": 200},
+            ],
+        )
+        response = client.make_request("GET", "/api/anything/")  # must not raise
+
+    assert response.status_code == 200
+
+
+@pytest.mark.parametrize(
+    "detail, expected_substring",
+    [
+        ("Request failed network policy check", "network policy"),
+        ("Invalid token supplied", "malformed, expired, or revoked"),
+        ("The token has expired", "PAT has expired"),
+        ("Unauthorized request", "Generic auth rejection"),
+        ("Something totally unexpected", "Unknown gateway rejection"),
+    ],
+)
+def test_hint_for_gateway_detail(detail, expected_substring):
+    assert expected_substring in _hint_for_gateway_detail(detail)
+
+
+def test_spcs_pat_coexists_with_password_and_token_source():
+    """`spcs_pat` is orthogonal to the password/token_source XOR — both combos validate."""
+    DataMasqueInstanceConfig(base_url=BASE_URL, username="u", password="p", spcs_pat=PAT)
+    DataMasqueInstanceConfig(base_url=BASE_URL, username="u", token_source=lambda: "t", spcs_pat=PAT)

{datamasque_python-1.1.3 → datamasque_python-1.1.5}/uv.lock

@@ -300,7 +300,7 @@ wheels = [
 
 [package.optional-dependencies]
 toml = [
-    { name = "tomli", marker = "python_full_version < '3.10'" },
+    { name = "tomli" },
 ]
 
 [[package]]
@@ -423,12 +423,12 @@ wheels = [
 
 [package.optional-dependencies]
 toml = [
-    { name = "tomli", marker = "python_full_version >= '3.10' and python_full_version <= '3.11'" },
+    { name = "tomli", marker = "python_full_version <= '3.11'" },
 ]
 
 [[package]]
 name = "datamasque-python"
-version = "1.1.3"
+version = "1.1.5"
 source = { editable = "." }
 dependencies = [
     { name = "pydantic" },
@@ -503,7 +503,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -518,7 +518,7 @@ resolution-markers = [
     "python_full_version < '3.10'",
 ]
 dependencies = [
-    { name = "tzdata", marker = "python_full_version < '3.10'" },
+    { name = "tzdata" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/3d/84/e95acaa848b855e15c83331d0401ee5f84b2f60889255c2e055cb4fb6bdf/faker-37.12.0.tar.gz", hash = "sha256:7505e59a7e02fa9010f06c3e1e92f8250d4cfbb30632296140c2d6dbef09b0fa", size = 1935741, upload-time = "2025-10-24T15:19:58.764Z" }
 wheels = [
@@ -535,7 +535,7 @@ resolution-markers = [
     "python_full_version == '3.10.*'",
 ]
 dependencies = [
-    { name = "tzdata", marker = "python_full_version >= '3.10' and sys_platform == 'win32'" },
+    { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/70/03/14428edc541467c460d363f6e94bee9acc271f3e62470630fc9a647d0cf2/faker-40.8.0.tar.gz", hash = "sha256:936a3c9be6c004433f20aa4d99095df5dec82b8c7ad07459756041f8c1728875", size = 1956493, upload-time = "2026-03-04T16:18:48.161Z" }
 wheels = [
@@ -582,7 +582,7 @@ name = "importlib-metadata"
 version = "8.7.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "zipp", marker = "python_full_version < '3.10'" },
+    { name = "zipp" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f3/49/3b30cad09e7771a4982d9975a8cbf64f00d4a1ececb53297f1d9a7be1b10/importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb", size = 57107, upload-time = "2025-12-21T10:00:19.278Z" }
 wheels = [
@@ -1070,13 +1070,13 @@ resolution-markers = [
     "python_full_version < '3.10'",
 ]
 dependencies = [
-    { name = "colorama", marker = "python_full_version < '3.10' and sys_platform == 'win32'" },
-    { name = "exceptiongroup", marker = "python_full_version < '3.10'" },
-    { name = "iniconfig", version = "2.1.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.10'" },
-    { name = "packaging", marker = "python_full_version < '3.10'" },
-    { name = "pluggy", marker = "python_full_version < '3.10'" },
-    { name = "pygments", marker = "python_full_version < '3.10'" },
-    { name = "tomli", marker = "python_full_version < '3.10'" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "exceptiongroup" },
+    { name = "iniconfig", version = "2.1.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+    { name = "tomli" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/a3/5c/00a0e072241553e1a7496d638deababa67c5058571567b92a7eaa258397c/pytest-8.4.2.tar.gz", hash = "sha256:86c0d0b93306b961d58d62a4db4879f27fe25513d4b969df351abdddb3c30e01", size = 1519618, upload-time = "2025-09-04T14:34:22.711Z" }
 wheels = [
@@ -1093,13 +1093,13 @@ resolution-markers = [
     "python_full_version == '3.10.*'",
 ]
 dependencies = [
-    { name = "colorama", marker = "python_full_version >= '3.10' and sys_platform == 'win32'" },
-    { name = "exceptiongroup", marker = "python_full_version == '3.10.*'" },
-    { name = "iniconfig", version = "2.3.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.10'" },
-    { name = "packaging", marker = "python_full_version >= '3.10'" },
-    { name = "pluggy", marker = "python_full_version >= '3.10'" },
-    { name = "pygments", marker = "python_full_version >= '3.10'" },
-    { name = "tomli", marker = "python_full_version == '3.10.*'" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
+    { name = "iniconfig", version = "2.3.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+    { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
 wheels = [
@@ -1200,24 +1200,24 @@ resolution-markers = [
     "python_full_version < '3.10'",
 ]
 dependencies = [
-    { name = "alabaster", version = "0.7.16", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.10'" },
-    { name = "babel", marker = "python_full_version < '3.10'" },
-    { name = "colorama", marker = "python_full_version < '3.10' and sys_platform == 'win32'" },
-    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.10'" },
-    { name = "imagesize", version = "1.5.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.10'" },
-    { name = "importlib-metadata", marker = "python_full_version < '3.10'" },
-    { name = "jinja2", marker = "python_full_version < '3.10'" },
-    { name = "packaging", marker = "python_full_version < '3.10'" },
-    { name = "pygments", marker = "python_full_version < '3.10'" },
-    { name = "requests", marker = "python_full_version < '3.10'" },
-    { name = "snowballstemmer", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-applehelp", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-devhelp", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-jsmath", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-qthelp", marker = "python_full_version < '3.10'" },
-    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version < '3.10'" },
-    { name = "tomli", marker = "python_full_version < '3.10'" },
+    { name = "alabaster", version = "0.7.16", source = { registry = "https://pypi.org/simple" } },
+    { name = "babel" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" } },
+    { name = "imagesize", version = "1.5.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "importlib-metadata" },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pygments" },
+    { name = "requests" },
+    { name = "snowballstemmer" },
+    { name = "sphinxcontrib-applehelp" },
+    { name = "sphinxcontrib-devhelp" },
+    { name = "sphinxcontrib-htmlhelp" },
+    { name = "sphinxcontrib-jsmath" },
+    { name = "sphinxcontrib-qthelp" },
+    { name = "sphinxcontrib-serializinghtml" },
+    { name = "tomli" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/5b/be/50e50cb4f2eff47df05673d361095cafd95521d2a22521b920c67a372dcb/sphinx-7.4.7.tar.gz", hash = "sha256:242f92a7ea7e6c5b406fdc2615413890ba9f699114a9c09192d7dfead2ee9cfe", size = 8067911, upload-time = "2024-07-20T14:46:56.059Z" }
 wheels = [
@@ -1232,23 +1232,23 @@ resolution-markers = [
     "python_full_version == '3.10.*'",
 ]
 dependencies = [
-    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.10.*'" },
-    { name = "babel", marker = "python_full_version == '3.10.*'" },
-    { name = "colorama", marker = "python_full_version == '3.10.*' and sys_platform == 'win32'" },
-    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.10.*'" },
-    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.10.*'" },
-    { name = "jinja2", marker = "python_full_version == '3.10.*'" },
-    { name = "packaging", marker = "python_full_version == '3.10.*'" },
-    { name = "pygments", marker = "python_full_version == '3.10.*'" },
-    { name = "requests", marker = "python_full_version == '3.10.*'" },
-    { name = "snowballstemmer", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-applehelp", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-devhelp", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-jsmath", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-qthelp", marker = "python_full_version == '3.10.*'" },
-    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version == '3.10.*'" },
-    { name = "tomli", marker = "python_full_version == '3.10.*'" },
+    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "babel" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "docutils", version = "0.21.2", source = { registry = "https://pypi.org/simple" } },
+    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pygments" },
+    { name = "requests" },
+    { name = "snowballstemmer" },
+    { name = "sphinxcontrib-applehelp" },
+    { name = "sphinxcontrib-devhelp" },
+    { name = "sphinxcontrib-htmlhelp" },
+    { name = "sphinxcontrib-jsmath" },
+    { name = "sphinxcontrib-qthelp" },
+    { name = "sphinxcontrib-serializinghtml" },
+    { name = "tomli" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/be0b61178fe2cdcb67e2a92fc9ebb488e3c51c4f74a36a7824c0adf23425/sphinx-8.1.3.tar.gz", hash = "sha256:43c1911eecb0d3e161ad78611bc905d1ad0e523e4ddc202a58a821773dc4c927", size = 8184611, upload-time = "2024-10-13T20:27:13.93Z" }
 wheels = [
@@ -1263,23 +1263,23 @@ resolution-markers = [
     "python_full_version == '3.11.*'",
 ]
 dependencies = [
-    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
-    { name = "babel", marker = "python_full_version == '3.11.*'" },
-    { name = "colorama", marker = "python_full_version == '3.11.*' and sys_platform == 'win32'" },
-    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
-    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" },
-    { name = "jinja2", marker = "python_full_version == '3.11.*'" },
-    { name = "packaging", marker = "python_full_version == '3.11.*'" },
-    { name = "pygments", marker = "python_full_version == '3.11.*'" },
-    { name = "requests", marker = "python_full_version == '3.11.*'" },
-    { name = "roman-numerals", marker = "python_full_version == '3.11.*'" },
-    { name = "snowballstemmer", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-applehelp", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-devhelp", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-jsmath", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-qthelp", marker = "python_full_version == '3.11.*'" },
-    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version == '3.11.*'" },
+    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "babel" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" } },
+    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pygments" },
+    { name = "requests" },
+    { name = "roman-numerals" },
+    { name = "snowballstemmer" },
+    { name = "sphinxcontrib-applehelp" },
+    { name = "sphinxcontrib-devhelp" },
+    { name = "sphinxcontrib-htmlhelp" },
+    { name = "sphinxcontrib-jsmath" },
+    { name = "sphinxcontrib-qthelp" },
+    { name = "sphinxcontrib-serializinghtml" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/42/50/a8c6ccc36d5eacdfd7913ddccd15a9cee03ecafc5ee2bc40e1f168d85022/sphinx-9.0.4.tar.gz", hash = "sha256:594ef59d042972abbc581d8baa577404abe4e6c3b04ef61bd7fc2acbd51f3fa3", size = 8710502, upload-time = "2025-12-04T07:45:27.343Z" }
 wheels = [
@@ -1294,23 +1294,23 @@ resolution-markers = [
     "python_full_version >= '3.12'",
 ]
 dependencies = [
-    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
-    { name = "babel", marker = "python_full_version >= '3.12'" },
-    { name = "colorama", marker = "python_full_version >= '3.12' and sys_platform == 'win32'" },
-    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
-    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" },
-    { name = "jinja2", marker = "python_full_version >= '3.12'" },
-    { name = "packaging", marker = "python_full_version >= '3.12'" },
-    { name = "pygments", marker = "python_full_version >= '3.12'" },
-    { name = "requests", marker = "python_full_version >= '3.12'" },
-    { name = "roman-numerals", marker = "python_full_version >= '3.12'" },
-    { name = "snowballstemmer", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-applehelp", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-devhelp", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-htmlhelp", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-jsmath", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-qthelp", marker = "python_full_version >= '3.12'" },
-    { name = "sphinxcontrib-serializinghtml", marker = "python_full_version >= '3.12'" },
+    { name = "alabaster", version = "1.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "babel" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "docutils", version = "0.22.4", source = { registry = "https://pypi.org/simple" } },
+    { name = "imagesize", version = "2.0.0", source = { registry = "https://pypi.org/simple" } },
+    { name = "jinja2" },
+    { name = "packaging" },
+    { name = "pygments" },
+    { name = "requests" },
+    { name = "roman-numerals" },
+    { name = "snowballstemmer" },
+    { name = "sphinxcontrib-applehelp" },
+    { name = "sphinxcontrib-devhelp" },
+    { name = "sphinxcontrib-htmlhelp" },
+    { name = "sphinxcontrib-jsmath" },
+    { name = "sphinxcontrib-qthelp" },
+    { name = "sphinxcontrib-serializinghtml" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/cd/bd/f08eb0f4eed5c83f1ba2a3bd18f7745a2b1525fad70660a1c00224ec468a/sphinx-9.1.0.tar.gz", hash = "sha256:7741722357dd75f8190766926071fed3bdc211c74dd2d7d4df5404da95930ddb", size = 8718324, upload-time = "2025-12-31T15:09:27.646Z" }
 wheels = [

datamasque_python-1.1.3/docs/usage.rst

@@ -1,21 +0,0 @@
-=====
-Usage
-=====
-
-To use DataMasque Python in a project:
-
-.. code-block:: python
-
-    from datamasque.client import DataMasqueClient
-    from datamasque.client.models.dm_instance import DataMasqueInstanceConfig
-
-    config = DataMasqueInstanceConfig(
-        base_url="https://datamasque.example.com",
-        username="api_user",
-        password="api_password",
-    )
-    client = DataMasqueClient(config)
-    client.authenticate()
-
-    for connection in client.list_connections():
-        print(connection.name)