datamasque-python 1.3.1__tar.gz → 1.4.0__tar.gz

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/CONTRIBUTING.rst

@@ -149,6 +149,12 @@ Pull requests
 5. Open a PR against ``main`` and describe what the change does and why.
 6. The maintainers will review and either merge, request changes, or close with an explanation.
 
+Changelog
+=========
+
+Create a new version heading in ``HISTORY.rst``,
+and add one concise bullet point for each high-level change.
+
 Commit messages
 ===============
 

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/HISTORY.rst

@@ -2,6 +2,29 @@
 History
 =======
 
+1.4.0 (2026-09-25)
+------------------
+
+* Added ``LicenseLock`` (``locked_at`` and ``editable_from``) and a read-only ``license_lock`` field on connection configs.
+  The server reports it only on instances whose license caps the number of connections
+  and counts that connection's type against the cap,
+  once a connection's first run has finished successfully;
+  otherwise it is ``None``.
+  It is excluded when a config is serialized back to the API,
+  as it must never be sent on create or update.
+
+* Added ``unlicensed_feature_warnings`` to ``Ruleset`` and ``RulesetLibrary``: at most one sentence naming the features
+  each uses that the server's license does not allow.
+
+* Added read-only ``target_frozen``, ``frozen_target_fields`` and ``deletion_frozen`` fields on connection configs.
+  ``target_frozen`` is ``True`` while the connection's protected fields are locked under the license edit lock,
+  ``frozen_target_fields`` lists those locked fields as server config keys, such as ``schema`` (empty when not frozen),
+  and ``deletion_frozen`` is whether deleting the connection is currently blocked
+  (it can differ from ``target_frozen``: deletion stays allowed while over the connection cap).
+  All three are excluded when a config is serialized back to the API.
+
+Requires server version 3.26.18
+
 1.3.1 (2026-09-09)
 ------------------
 

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datamasque-python
-Version: 1.3.1
+Version: 1.4.0
 Summary: Official Python client for the DataMasque data-masking API.
 Project-URL: Homepage, https://datamasque.com/
 Project-URL: Documentation, https://datamasque-python.readthedocs.io/

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/__init__.py

@@ -38,6 +38,7 @@ from datamasque.client.models.connection import (
     DocumentDbConnectionConfig,
     DynamoConnectionConfig,
     FileConnectionConfig,
+    LicenseLock,
     MongoConnectionConfig,
     MountedShareConnectionConfig,
     MssqlLinkedServerConnectionConfig,
@@ -243,6 +244,7 @@ __all__ = [
     "LengthUnit",
     "LengthsStatistics",
     "LicenseInfo",
+    "LicenseLock",
     "Locator",
     "MaskType",
     "MaskedFormEntry",

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/models/connection.py

@@ -1,5 +1,6 @@
 """Connection configuration models for the DataMasque API."""
 
+from datetime import datetime
 from enum import Enum
 from typing import Any, Callable, Literal, NewType, Optional
 
@@ -99,6 +100,22 @@ class SseConfig(BaseModel):
         return self
 
 
+class LicenseLock(BaseModel):
+    """
+    Read-only license-lock metadata for a connection.
+
+    The server reports this only on instances whose license has a finite connection cap
+    and counts this connection's type against that cap,
+    once the connection's first run has finished successfully;
+    otherwise it is `null`.
+    """
+
+    model_config = ConfigDict(extra="allow")
+
+    locked_at: datetime
+    editable_from: datetime
+
+
 class ConnectionConfig(BaseModel):
     """
     Base class for all connection configurations.
@@ -111,6 +128,16 @@ class ConnectionConfig(BaseModel):
 
     name: str
     id: Optional[ConnectionId] = None
+    # Server-populated and read-only, so it is excluded when serializing a config back to the API.
+    license_lock: Optional[LicenseLock] = Field(default=None, exclude=True)
+    # Whether the connection's protected fields are currently locked under the license edit lock.
+    target_frozen: bool = Field(default=False, exclude=True)
+    # The protected fields currently locked, as server config keys (e.g. `schema`, not `db_schema`);
+    # empty when `target_frozen` is False.
+    frozen_target_fields: list[str] = Field(default_factory=list, exclude=True)
+    # Whether deleting the connection is currently blocked. Not always equal to `target_frozen`:
+    # deletion stays allowed while over the connection cap, so a downgrade can be recovered from.
+    deletion_frozen: bool = Field(default=False, exclude=True)
 
 
 class DynamoConnectionConfig(ConnectionConfig):

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/models/ruleset.py

@@ -46,3 +46,10 @@ class Ruleset(GitTrackedEntity):
     is_valid: Optional[ValidationStatus] = Field(default=None, exclude=True)
     validation_errors: list[ValidationErrorDetails] = Field(default_factory=list, exclude=True)
     """Validation errors surfaced by the server; empty when valid."""
+    unlicensed_feature_warnings: Optional[list[str]] = Field(default=None, exclude=True)
+    """
+    At most one sentence, naming every feature the ruleset uses that the server's license does not allow.
+    Empty when the ruleset needs nothing its license withholds,
+    and `None` when the server does not know which features the ruleset uses, for example before it has passed
+    validation. `None` is not the same as having no warnings.
+    """

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/models/ruleset_library.py

@@ -21,5 +21,12 @@ class RulesetLibrary(GitTrackedEntity):
     is_valid: Optional[ValidationStatus] = Field(default=None, exclude=True)
     validation_errors: list[ValidationErrorDetails] = Field(default_factory=list, exclude=True)
     """Validation errors surfaced by the server; empty when valid."""
+    unlicensed_feature_warnings: Optional[list[str]] = Field(default=None, exclude=True)
+    """
+    At most one sentence, naming every feature the library uses that the server's license does not allow.
+    Empty when the license allows every feature,
+    and `None` when the server does not know which features the library uses, for example before it has passed
+    validation.
+    """
     created: Optional[datetime] = Field(default=None, exclude=True)
     modified: Optional[datetime] = Field(default=None, exclude=True)

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/ruleset_libraries.py

@@ -64,7 +64,8 @@ class RulesetLibraryClient(BaseClient):
         Creates a new ruleset library on the server.
 
         Sets the library's server-assigned fields
-        (`id`, `is_valid`, `validation_errors`, `git`, `created`, `modified`) and returns the library.
+        (`id`, `is_valid`, `validation_errors`, `unlicensed_feature_warnings`, `git`, `created`, `modified`)
+        and returns the library.
         """
 
         data = library.model_dump(exclude_none=True, by_alias=True, mode="json")
@@ -73,6 +74,7 @@ class RulesetLibraryClient(BaseClient):
         library.id = created_library.id
         library.is_valid = created_library.is_valid
         library.validation_errors = created_library.validation_errors
+        library.unlicensed_feature_warnings = created_library.unlicensed_feature_warnings
         library.git = created_library.git
         library.created = created_library.created
         library.modified = created_library.modified
@@ -94,6 +96,7 @@ class RulesetLibraryClient(BaseClient):
         updated_library = RulesetLibrary.model_validate(response.json())
         library.is_valid = updated_library.is_valid
         library.validation_errors = updated_library.validation_errors
+        library.unlicensed_feature_warnings = updated_library.unlicensed_feature_warnings
         library.git = updated_library.git
         library.modified = updated_library.modified
         logger.debug('Update of ruleset library "%s" successful', library.name)

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/datamasque/client/rulesets.py

@@ -20,7 +20,7 @@ class RulesetClient(BaseClient):
         """
         Creates or updates a ruleset.
 
-        Populates the given ruleset's `id`, `is_valid`, `validation_errors`,
+        Populates the given ruleset's `id`, `is_valid`, `validation_errors`, `unlicensed_feature_warnings`,
         and `git` fields from the server response, and returns the same ruleset instance for convenience.
         """
 
@@ -30,6 +30,7 @@ class RulesetClient(BaseClient):
         ruleset.id = created.id
         ruleset.is_valid = created.is_valid
         ruleset.validation_errors = created.validation_errors
+        ruleset.unlicensed_feature_warnings = created.unlicensed_feature_warnings
         ruleset.git = created.git
 
         if response.status_code == 201:

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "datamasque-python"
-version = "1.3.1"
+version = "1.4.0"
 description = "Official Python client for the DataMasque data-masking API."
 authors = [
     { name = "DataMasque Ltd" },

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/tests/test_connections.py

@@ -1,11 +1,14 @@
 """Tests for `ConnectionClient` (CRUD + Snowflake-specific behaviour)."""
 
+from datetime import datetime, timezone
+
 import pytest
 import requests_mock
 
 from datamasque.client.exceptions import DataMasqueApiError, DataMasqueException
 from datamasque.client.models.connection import (
     AzureConnectionConfig,
+    ConnectionConfig,
     ConnectionId,
     CosmosDbConnectionConfig,
     DatabaseConnectionConfig,
@@ -13,6 +16,7 @@ from datamasque.client.models.connection import (
     DatabricksConnectionConfig,
     DocumentDbConnectionConfig,
     DynamoConnectionConfig,
+    LicenseLock,
     MongoConnectionConfig,
     MountedShareConnectionConfig,
     MssqlLinkedServerConnectionConfig,
@@ -682,6 +686,200 @@ def test_s3_connection_model_validate():
     assert conn.iam_role_arn == "arn:aws:iam::111122223333:role/s3-role"
 
 
+def test_connection_model_validate_parses_license_lock() -> None:
+    payload = {
+        "id": "88dabb63-aca5-4cc4-8f76-f78736a42f39",
+        "name": "s3",
+        "mask_type": "file",
+        "type": "s3_connection",
+        "base_directory": "data/",
+        "is_file_mask_source": True,
+        "is_file_mask_destination": False,
+        "bucket": "my-bucket",
+        "license_lock": {
+            "locked_at": "2026-01-01T12:00:00Z",
+            "editable_from": "2026-04-01T12:00:00Z",
+        },
+    }
+
+    conn = validate_connection(payload)
+
+    assert isinstance(conn.license_lock, LicenseLock)
+    assert conn.license_lock.locked_at == datetime(2026, 1, 1, 12, 0, tzinfo=timezone.utc)
+    assert conn.license_lock.editable_from == datetime(2026, 4, 1, 12, 0, tzinfo=timezone.utc)
+
+
+def test_connection_model_validate_null_license_lock() -> None:
+    payload = {
+        "id": "id-1",
+        "name": "s3",
+        "mask_type": "file",
+        "type": "s3_connection",
+        "base_directory": "",
+        "is_file_mask_source": True,
+        "is_file_mask_destination": False,
+        "bucket": "my-bucket",
+        "license_lock": None,
+    }
+
+    conn = validate_connection(payload)
+    assert conn.license_lock is None
+
+
+def test_connection_model_validate_parses_freeze_fields() -> None:
+    payload = {
+        "id": "db-1",
+        "name": "pg",
+        "mask_type": "database",
+        "db_type": "postgres",
+        "host": "h",
+        "port": 5432,
+        "database": "d",
+        "user": "u",
+        "schema": "public",
+        "target_frozen": True,
+        "frozen_target_fields": ["host", "port"],
+        "deletion_frozen": True,
+    }
+
+    conn = validate_connection(payload)
+
+    assert conn.target_frozen is True
+    assert conn.frozen_target_fields == ["host", "port"]
+    assert conn.deletion_frozen is True
+
+
+def test_connection_freeze_fields_default_when_absent() -> None:
+    payload = {
+        "id": "db-1",
+        "name": "pg",
+        "mask_type": "database",
+        "db_type": "postgres",
+        "host": "h",
+        "port": 5432,
+        "database": "d",
+        "user": "u",
+        "schema": "public",
+    }
+
+    conn = validate_connection(payload)
+
+    assert conn.target_frozen is False
+    assert conn.frozen_target_fields == []
+    assert conn.deletion_frozen is False
+
+
+_LICENSE_LOCK_PAYLOAD = {"locked_at": "2026-01-01T12:00:00Z", "editable_from": "2026-04-01T12:00:00Z"}
+
+
+@pytest.mark.parametrize(
+    "config_class, payload",
+    [
+        # Default serializer.
+        (
+            S3ConnectionConfig,
+            {
+                "id": "id-1",
+                "name": "s3",
+                "mask_type": "file",
+                "type": "s3_connection",
+                "base_directory": "",
+                "is_file_mask_source": True,
+                "is_file_mask_destination": False,
+                "bucket": "my-bucket",
+            },
+        ),
+        # Each subclass below overrides `@model_serializer`, so exclusion must be proven for each.
+        (
+            DatabaseConnectionConfig,
+            {
+                "id": "db-1",
+                "name": "pg",
+                "mask_type": "database",
+                "db_type": "postgres",
+                "host": "h",
+                "port": 5432,
+                "database": "d",
+                "user": "u",
+                "schema": "public",
+                "is_read_only": False,
+            },
+        ),
+        (
+            DynamoConnectionConfig,
+            {
+                "id": "dyn-1",
+                "name": "dyn",
+                "mask_type": "database",
+                "db_type": "dynamo_db",
+                "s3_bucket_name": "bucket",
+                "dynamo_append_datetime": False,
+                "dynamo_append_suffix": "-masked",
+                "dynamo_replace_tables": True,
+                "dynamo_default_region": "us-east-1",
+            },
+        ),
+        (
+            MongoConnectionConfig,
+            {
+                "id": "mongo-1",
+                "name": "mongo",
+                "mask_type": "database",
+                "db_type": "mongodb",
+                "host": "mongo.example",
+                "port": 27017,
+                "database": "people",
+                "user": "alice",
+                "auth_source": "admin",
+                "tls": True,
+                "direct_connection": False,
+                "replica_set": "rs0",
+                "is_read_only": False,
+            },
+        ),
+        (
+            SnowflakeConnectionConfig,
+            {
+                "id": "sf-1",
+                "name": "snowflake",
+                "mask_type": "database",
+                "db_type": "snowflake",
+                "user": "snowman",
+                "database": "icicle",
+                "snowflake_account_id": "ABCDEF-123456",
+                "snowflake_warehouse": "warehouse1",
+                "snowflake_storage_integration_name": "mysi",
+                "host": "snowflake.com",
+                "port": 443,
+                "s3_bucket_name": "ice-bucket",
+                "iam_role_arn": "role",
+                "snowflake_stage_location": "aws_s3",
+                "is_read_only": False,
+            },
+        ),
+    ],
+)
+def test_read_only_server_fields_are_excluded_when_serializing(
+    config_class: type[ConnectionConfig], payload: dict
+) -> None:
+    # `license_lock` and the target-freeze fields are server-populated and read-only, so they must
+    # never be sent back on create/update. Cover the subclasses with custom `@model_serializer`
+    # overrides, not just the default serializer.
+    conn = config_class.model_validate(
+        {
+            **payload,
+            "license_lock": _LICENSE_LOCK_PAYLOAD,
+            "target_frozen": True,
+            "frozen_target_fields": ["host"],
+            "deletion_frozen": True,
+        }
+    )
+
+    dumped = conn.model_dump(by_alias=True, mode="json")
+    for field in ("license_lock", "target_frozen", "frozen_target_fields", "deletion_frozen"):
+        assert field not in dumped
+
+
 def test_s3_connection_model_validate_no_iam_role():
     payload = {
         "id": "id-1",

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/tests/test_ruleset_library.py

@@ -1,7 +1,7 @@
 """Tests for ruleset library support in the DataMasque client."""
 
 from datetime import datetime
-from typing import Any
+from typing import Any, Optional
 
 import pytest
 import requests_mock
@@ -739,3 +739,37 @@ def test_create_ruleset_library_collapses_git_snapshot(
     assert result.git.commit_sha == "abc123"
     assert result.git.repo_url == "https://git.example.com/repo.git"
     assert result.git.synced_at == datetime.fromisoformat("2025-06-01T10:00:00+00:00")
+
+
+UNSTRUCTURED_WARNING = "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."
+
+
+@pytest.mark.parametrize("returned", [[UNSTRUCTURED_WARNING], [], None])
+def test_create_and_update_ruleset_library_populate_unlicensed_feature_warnings(
+    client: DataMasqueClient, ruleset_library: RulesetLibrary, returned: Optional[list[str]]
+) -> None:
+    """`None` (not yet validated) stays distinct from `[]` (no warnings) on both the create and the update path."""
+    response = {
+        "id": LIBRARY_ID_1,
+        "name": "test_library",
+        "namespace": "test_ns",
+        "config_yaml": "version: '1.0'\nfunctions: []",
+        "is_valid": "valid",
+        "unlicensed_feature_warnings": returned,
+        "created": "2025-06-01T10:00:00Z",
+        "modified": "2025-06-01T10:00:00Z",
+    }
+
+    with requests_mock.Mocker() as m:
+        m.post("http://test-server/api/ruleset-libraries/", json=response, status_code=201)
+        m.put(f"http://test-server/api/ruleset-libraries/{LIBRARY_ID_1}/", json=response)
+
+        created = client.create_ruleset_library(ruleset_library)
+        assert created.unlicensed_feature_warnings == returned
+        assert "unlicensed_feature_warnings" not in m.last_request.json()
+
+        created.unlicensed_feature_warnings = ["stale"]
+        updated = client.update_ruleset_library(created)
+
+    assert updated.unlicensed_feature_warnings == returned
+    assert "unlicensed_feature_warnings" not in m.last_request.json()

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/tests/test_rulesets.py

@@ -177,6 +177,86 @@ def test_create_or_update_ruleset_validation_errors_empty_when_valid(client, rul
     assert result.validation_errors == []
 
 
+UNSTRUCTURED_WARNING = "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."
+SUBSETTING_WARNING = "Foundation license does not allow Subsetting. Upgrade to Structured or Enterprise."
+
+
+@pytest.mark.parametrize(
+    ("returned", "expected"),
+    [
+        ([UNSTRUCTURED_WARNING, SUBSETTING_WARNING], [UNSTRUCTURED_WARNING, SUBSETTING_WARNING]),
+        ([], []),
+        (None, None),
+    ],
+    ids=["warned", "fully_licensed", "not_yet_known"],
+)
+def test_create_or_update_ruleset_populates_unlicensed_feature_warnings(client, ruleset, returned, expected):
+    """Every warning the server sends is carried, and an empty list stays distinct from `None`."""
+    with requests_mock.Mocker() as m:
+        m.post(
+            "http://test-server/api/rulesets/?upsert=true",
+            json={"id": "2", "name": "test_ruleset", "is_valid": "valid", "unlicensed_feature_warnings": returned},
+            status_code=201,
+        )
+        result = client.create_or_update_ruleset(ruleset)
+
+    assert result.unlicensed_feature_warnings == expected
+
+
+def test_create_or_update_ruleset_unlicensed_feature_warnings_default_to_none(client, ruleset):
+    """A server that omits the field leaves the warnings unknown rather than empty."""
+    with requests_mock.Mocker() as m:
+        m.post(
+            "http://test-server/api/rulesets/?upsert=true",
+            json={"id": "2", "name": "test_ruleset", "is_valid": "in_progress"},
+            status_code=201,
+        )
+        result = client.create_or_update_ruleset(ruleset)
+
+    assert result.unlicensed_feature_warnings is None
+
+
+def test_list_rulesets_unlicensed_feature_warnings(client):
+    """Each listed ruleset carries its own `unlicensed_feature_warnings`, including `None` for an unvalidated one."""
+    with requests_mock.Mocker() as m:
+        m.get(
+            "http://test-server/api/v2/rulesets/",
+            json=[
+                {
+                    "id": "1",
+                    "name": "unstructured_ruleset",
+                    "mask_type": "database",
+                    "is_valid": "valid",
+                    "unlicensed_feature_warnings": [
+                        "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."
+                    ],
+                },
+                {
+                    "id": "2",
+                    "name": "licensed_ruleset",
+                    "mask_type": "database",
+                    "is_valid": "valid",
+                    "unlicensed_feature_warnings": [],
+                },
+                {
+                    "id": "3",
+                    "name": "unvalidated_ruleset",
+                    "mask_type": "database",
+                    "is_valid": "in_progress",
+                    "unlicensed_feature_warnings": None,
+                },
+            ],
+            status_code=200,
+        )
+        rulesets = client.list_rulesets()
+
+    assert rulesets[0].unlicensed_feature_warnings == [
+        "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."
+    ]
+    assert rulesets[1].unlicensed_feature_warnings == []
+    assert rulesets[2].unlicensed_feature_warnings is None
+
+
 def test_create_or_update_ruleset_does_not_send_read_only_fields(client, ruleset):
     """Read-only server fields must never be echoed back into a re-submit's request body."""
     with requests_mock.Mocker() as m:
@@ -187,6 +267,9 @@ def test_create_or_update_ruleset_does_not_send_read_only_fields(client, ruleset
                 "name": "test_ruleset",
                 "is_valid": "invalid",
                 "validation_errors": [{"message": "bad", "validation_error_type": "ruleset"}],
+                "unlicensed_feature_warnings": [
+                    "Foundation license does not allow Unstructured Masking. Upgrade to Enterprise."
+                ],
             },
             status_code=201,
         )
@@ -196,7 +279,7 @@ def test_create_or_update_ruleset_does_not_send_read_only_fields(client, ruleset
         client.create_or_update_ruleset(ruleset)
 
     body = m.last_request.json()
-    for read_only_field in ("id", "is_valid", "validation_errors"):
+    for read_only_field in ("id", "is_valid", "validation_errors", "unlicensed_feature_warnings"):
         assert read_only_field not in body
     # Input fields are still present.
     assert body["config_yaml"] == "version: '1.0'\ntasks: []"

{datamasque_python-1.3.1 → datamasque_python-1.4.0}/uv.lock

@@ -419,7 +419,7 @@ toml = [
 
 [[package]]
 name = "datamasque-python"
-version = "1.3.1"
+version = "1.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "pydantic" },