datamasque-python 1.4.0__tar.gz → 1.5.0__tar.gz

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/HISTORY.rst

@@ -2,6 +2,40 @@
 History
 =======
 
+1.5.0 (2026-10-07)
+------------------
+
+* **Breaking:** Snowflake masking now stages inside Snowflake, so ``SnowflakeConnectionConfig``
+  no longer has the external staging fields ``s3_bucket_name``, ``iam_role_arn``,
+  ``snowflake_azure_container_name``, ``snowflake_azure_connection_string``,
+  ``snowflake_azure_connection_string_encrypted`` and ``snowflake_storage_integration_name``.
+  ``snowflake_stage_location`` and the ``SnowflakeStageLocation`` enum are removed: the server
+  detects a Snowflake SPCS deployment from its own environment, so the client no longer states it.
+* Snowflake connections listed from an older server still parse: the removed fields and
+  ``snowflake_stage_location`` are dropped rather than raising a validation error, and are not sent
+  back on ``create_or_update_connection``.
+* Added ``GcsConnectionConfig`` for Google Cloud Storage file connections (``type: gcs_connection``),
+  with ``bucket`` and ``service_account_key``:
+  the contents of a service account's JSON key file, or the ARN of an AWS Secrets Manager secret that holds it.
+  ``validate_connection`` and ``list_connections`` accept the new type.
+* Added ``CassandraConnectionConfig`` for Apache Cassandra (``db_type: cassandra``).
+  ``database`` is the keyspace; ``user`` and ``password`` are optional,
+  and ``local_datacenter``, ``tls`` and ``direct_connection`` are supported.
+* Added ``SapAseConnectionConfig`` for SAP ASE (Sybase) (``db_type: sap_ase``),
+  with ``tls``, ``tls_server_name`` and ``connect_timeout``.
+  It sends no ``schema``: in ASE the schema is the table owner.
+* Added ``SalesforceConnectionConfig`` for Salesforce (``db_type: salesforce``),
+  which signs in with an OAuth JWT bearer assertion
+  (``instance_url``, ``login_url``, ``client_id``, ``user`` and ``salesforce_private_key_path``,
+  with an optional ``salesforce_private_key_passphrase`` and ``api_version``).
+  Salesforce is a preview connection type on server 3.26.19:
+  creating one fails until an administrator enables preview features.
+* ``DatabaseType`` gains ``cassandra``, ``sap_ase`` and ``salesforce``.
+  ``DatabaseConnectionConfig`` rejects them in favour of the classes above,
+  and ``validate_connection`` and ``list_connections`` dispatch to those classes.
+
+Requires server version 3.26.19
+
 1.4.0 (2026-09-25)
 ------------------
 

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datamasque-python
-Version: 1.4.0
+Version: 1.5.0
 Summary: Official Python client for the DataMasque data-masking API.
 Project-URL: Homepage, https://datamasque.com/
 Project-URL: Documentation, https://datamasque-python.readthedocs.io/

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/datamasque/client/__init__.py

@@ -29,6 +29,7 @@ from datamasque.client.exceptions import (
 from datamasque.client.ifm import DataMasqueIfmClient
 from datamasque.client.models.connection import (
     AzureConnectionConfig,
+    CassandraConnectionConfig,
     ConnectionConfig,
     ConnectionId,
     CosmosDbConnectionConfig,
@@ -38,13 +39,15 @@ from datamasque.client.models.connection import (
     DocumentDbConnectionConfig,
     DynamoConnectionConfig,
     FileConnectionConfig,
+    GcsConnectionConfig,
     LicenseLock,
     MongoConnectionConfig,
     MountedShareConnectionConfig,
     MssqlLinkedServerConnectionConfig,
     S3ConnectionConfig,
+    SalesforceConnectionConfig,
+    SapAseConnectionConfig,
     SnowflakeConnectionConfig,
-    SnowflakeStageLocation,
     SseConfig,
     SseSelection,
 )
@@ -179,6 +182,7 @@ __all__ = [
     "AzureConnectionConfig",
     "BooleanPreview",
     "BooleanStatistics",
+    "CassandraConnectionConfig",
     "ColumnKind",
     "ColumnPreview",
     "CommonStatistics",
@@ -226,6 +230,7 @@ __all__ = [
     "FileRulesetGenerationWithRGConfigRequest",
     "FirstCharsStatistics",
     "ForeignKeyRef",
+    "GcsConnectionConfig",
     "GitSnapshot",
     "HashColumnsTableConfig",
     "IfmAuthError",
@@ -287,6 +292,8 @@ __all__ = [
     "S3ConnectionConfig",
     "SafeDataPreview",
     "SafeDataPreviewOptions",
+    "SalesforceConnectionConfig",
+    "SapAseConnectionConfig",
     "SchemaDiscoveryColumn",
     "SchemaDiscoveryFromConfigRequest",
     "SchemaDiscoveryPage",
@@ -298,7 +305,6 @@ __all__ = [
     "SelectedFileData",
     "SnowflakeConnectionConfig",
     "SnowflakeKeyFile",
-    "SnowflakeStageLocation",
     "SseConfig",
     "SseSelection",
     "SslZipFile",

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/datamasque/client/models/connection.py

@@ -51,15 +51,9 @@ class DatabaseType(Enum):
     databricks = "databricks"
     informix = "informix"
     saphana = "saphana"
-
-
-class SnowflakeStageLocation(str, Enum):
-    """Storage backend for a Snowflake connection's external stage."""
-
-    local = "local"  # Not supported for production use
-    aws_s3 = "aws_s3"
-    azure_blob_storage = "azure_blob_storage"
-    spcs = "spcs"  # DataMasque running inside Snowflake SPCS; staged on the container's own storage
+    cassandra = "cassandra"
+    sap_ase = "sap_ase"
+    salesforce = "salesforce"
 
 
 class SseSelection(Enum):
@@ -285,6 +279,19 @@ class CosmosDbConnectionConfig(MongoConnectionConfig):
         return DatabaseType.cosmosdb
 
 
+# Servers before 3.26.18 still return these on Snowflake connections. With `extra="allow"`
+# they would be sent back on create/update unless dropped here.
+_SNOWFLAKE_EXTERNAL_STAGE_KEYS = (
+    "s3_bucket_name",
+    "iam_role_arn",
+    "snowflake_azure_container_name",
+    "snowflake_azure_connection_string",
+    "snowflake_azure_connection_string_encrypted",
+    "snowflake_storage_integration_name",
+    "snowflake_stage_location",
+)
+
+
 class SnowflakeConnectionConfig(ConnectionConfig):
     """
     Connection configuration for a Snowflake database.
@@ -294,14 +301,14 @@ class SnowflakeConnectionConfig(ConnectionConfig):
     """
 
     database: str
-    # Optional because DataMasque-in-SPCS connections leave these unset: the agent uses the
-    # container's OAuth token + SNOWFLAKE_HOST/SNOWFLAKE_ACCOUNT env and the app-owned QUERY_WAREHOUSE,
-    # so user/account/storage-integration/warehouse are null for stage_location=spcs. Mirrors the app's
-    # canonical model (agent .../schemas/connection/connection.py), which types these `| None = None`.
+    # Optional because connections leave these unset when DataMasque runs inside Snowflake SPCS:
+    # the server detects SPCS from its environment and the agent uses the container's OAuth token,
+    # the SNOWFLAKE_HOST/SNOWFLAKE_ACCOUNT env and the app-owned QUERY_WAREHOUSE, so user/account/
+    # warehouse are None. Mirrors the app's canonical model
+    # (agent .../schemas/connection/connection.py), which types these `| None = None`.
     user: Optional[str] = None
     snowflake_account_id: Optional[str] = None
     snowflake_warehouse: Optional[str] = None
-    snowflake_storage_integration_name: Optional[str] = None
     host: str = ""
     port: Optional[int] = None
     db_schema: Optional[str] = Field(default=None, alias="schema")
@@ -310,12 +317,6 @@ class SnowflakeConnectionConfig(ConnectionConfig):
     password: Optional[str] = None
     snowflake_private_key: Optional[FileId] = None
     snowflake_private_key_passphrase: Optional[str] = None
-    snowflake_stage_location: Optional[SnowflakeStageLocation] = None
-    s3_bucket_name: Optional[str] = None
-    iam_role_arn: Optional[str] = None
-    snowflake_azure_container_name: Optional[str] = None
-    snowflake_azure_connection_string: Optional[str] = None
-    snowflake_azure_connection_string_encrypted: Optional[str] = None
 
     mask_type: Literal["database"] = "database"
     db_type: Literal["snowflake"] = "snowflake"
@@ -338,9 +339,9 @@ class SnowflakeConnectionConfig(ConnectionConfig):
 
     @model_validator(mode="before")
     @classmethod
-    def _strip_encrypted_password(cls, data: dict) -> dict:
+    def _strip_server_only_fields(cls, data: dict) -> dict:
         if isinstance(data, dict):
-            for key in ("password_encrypted", "dbpassword"):
+            for key in ("password_encrypted", "dbpassword", *_SNOWFLAKE_EXTERNAL_STAGE_KEYS):
                 data.pop(key, None)
         return data
 
@@ -366,7 +367,8 @@ class DatabaseConnectionConfig(ConnectionConfig):
     Connection configuration for a SQL database.
 
     Use `DynamoConnectionConfig` for DynamoDB, `SnowflakeConnectionConfig` for Snowflake,
-    and `MongoConnectionConfig` for MongoDB.
+    `MongoConnectionConfig` for MongoDB, `CassandraConnectionConfig` for Apache Cassandra,
+    `SapAseConnectionConfig` for SAP ASE (Sybase) and `SalesforceConnectionConfig` for Salesforce.
     """
 
     host: str
@@ -401,6 +403,12 @@ class DatabaseConnectionConfig(ConnectionConfig):
             raise ValueError("For Azure Cosmos DB, use the CosmosDbConnectionConfig class instead")
         if self.database_type is DatabaseType.databricks:
             raise ValueError("For Databricks SQL Warehouse, use the DatabricksConnectionConfig class instead")
+        if self.database_type is DatabaseType.cassandra:
+            raise ValueError("For Apache Cassandra, use the CassandraConnectionConfig class instead")
+        if self.database_type is DatabaseType.sap_ase:
+            raise ValueError("For SAP ASE (Sybase), use the SapAseConnectionConfig class instead")
+        if self.database_type is DatabaseType.salesforce:
+            raise ValueError("For Salesforce, use the SalesforceConnectionConfig class instead")
         return self
 
     mask_type: Literal["database"] = "database"
@@ -508,6 +516,29 @@ class AzureConnectionConfig(FileConnectionConfig):
         return data
 
 
+class GcsConnectionConfig(FileConnectionConfig):
+    """
+    Connection configuration for a Google Cloud Storage bucket.
+
+    `service_account_key` holds the contents of a service account's JSON key file,
+    or the ARN of an AWS Secrets Manager secret that holds it.
+
+    Requires server version 3.26.19.
+    """
+
+    type: Literal["gcs_connection"] = "gcs_connection"
+    bucket: str = ""
+    service_account_key: Optional[str] = None
+
+    @model_validator(mode="before")
+    @classmethod
+    def _strip_encrypted_service_account_key(cls, data: dict) -> dict:
+        if isinstance(data, dict):
+            # The API returns the encrypted form; drop it so `service_account_key` stays None.
+            data.pop("service_account_key_encrypted", None)
+        return data
+
+
 class MountedShareConnectionConfig(FileConnectionConfig):
     """Connection configuration for a mounted file share."""
 
@@ -540,9 +571,149 @@ class DatabricksConnectionConfig(ConnectionConfig):
         return data
 
 
+class CassandraConnectionConfig(ConnectionConfig):
+    """
+    Connection configuration for an Apache Cassandra keyspace.
+
+    `database` is the keyspace.
+    `user` and `password` are optional, but a username needs a password.
+    Set `direct_connection` when the node addresses the cluster advertises are unreachable,
+    for example behind NAT or in containers.
+
+    Requires server version 3.26.19.
+    """
+
+    host: str
+    port: int = 9042
+    database: str
+    user: Optional[str] = None
+    password: Optional[str] = None
+    local_datacenter: Optional[str] = None
+    tls: bool = False
+    direct_connection: bool = False
+    is_read_only: bool = False
+
+    mask_type: Literal["database"] = "database"
+    db_type: Literal["cassandra"] = "cassandra"
+
+    @property
+    def database_type(self) -> DatabaseType:
+        return DatabaseType.cassandra
+
+    @model_serializer(mode="wrap")
+    def _serialize(self, handler: Callable) -> dict:
+        d = handler(self)
+        # The server expects the password under the `dbpassword` key.
+        password = d.pop("password", None)
+        if password is not None:
+            d["dbpassword"] = password
+        return d
+
+    @model_validator(mode="before")
+    @classmethod
+    def _strip_encrypted_password(cls, data: dict) -> dict:
+        if isinstance(data, dict):
+            for key in ("password_encrypted", "dbpassword"):
+                data.pop(key, None)
+        return data
+
+
+class SapAseConnectionConfig(ConnectionConfig):
+    """
+    Connection configuration for an SAP ASE (Sybase) database.
+
+    ASE has no schema setting: the schema is the table owner,
+    and an unqualified name resolves to the connecting user's table first, then to `dbo`'s.
+    With `tls` on, the server certificate is always verified;
+    `tls_server_name` only changes the name it is verified against.
+
+    Requires server version 3.26.19.
+    """
+
+    host: str
+    port: int = 5000
+    database: str
+    user: str
+    password: Optional[str] = None
+    tls: bool = False
+    tls_server_name: Optional[str] = None
+    connect_timeout: Optional[int] = None
+    is_read_only: bool = False
+
+    mask_type: Literal["database"] = "database"
+    db_type: Literal["sap_ase"] = "sap_ase"
+
+    @property
+    def database_type(self) -> DatabaseType:
+        return DatabaseType.sap_ase
+
+    @model_serializer(mode="wrap")
+    def _serialize(self, handler: Callable) -> dict:
+        d = handler(self)
+        # The server expects the password under the `dbpassword` key.
+        password = d.pop("password", None)
+        if password is not None:
+            d["dbpassword"] = password
+        return d
+
+    @model_validator(mode="before")
+    @classmethod
+    def _strip_encrypted_password(cls, data: dict) -> dict:
+        if isinstance(data, dict):
+            for key in ("password_encrypted", "dbpassword"):
+                data.pop(key, None)
+        return data
+
+
+class SalesforceConnectionConfig(ConnectionConfig):
+    """
+    Connection configuration for a Salesforce org.
+
+    Salesforce is reached over HTTPS with an OAuth JWT bearer assertion,
+    so it carries no host, port, database or password.
+    `login_url` is the org's My Domain URL and is sent verbatim as the JWT audience,
+    which Salesforce compares exactly.
+    `salesforce_private_key_path` is relative to the DataMasque files sandbox,
+    or to the connection fileset when one is attached.
+    `salesforce_private_key_passphrase` is only needed for an encrypted key.
+    `api_version` is the server's default unless set.
+
+    Requires server version 3.26.19.
+    Salesforce is a preview connection type there:
+    the server refuses to create one until an administrator enables preview features
+    under Settings, Preview Features.
+    """
+
+    instance_url: str
+    login_url: str
+    client_id: str
+    user: str
+    salesforce_private_key_path: str
+    salesforce_private_key_passphrase: Optional[str] = None
+    # Left unset so the server applies its own default, which it stores on the connection.
+    # A default here would keep pinning new connections to it after the server moves on.
+    api_version: Optional[str] = None
+    is_read_only: bool = False
+
+    mask_type: Literal["database"] = "database"
+    db_type: Literal["salesforce"] = "salesforce"
+
+    @property
+    def database_type(self) -> DatabaseType:
+        return DatabaseType.salesforce
+
+    @model_validator(mode="before")
+    @classmethod
+    def _strip_encrypted_passphrase(cls, data: dict) -> dict:
+        if isinstance(data, dict):
+            data.pop("salesforce_private_key_passphrase_encrypted", None)
+        return data
+
+
 FILE_TYPE_MAP: dict[str, type[FileConnectionConfig]] = {
     "s3_connection": S3ConnectionConfig,
     "azure_blob_connection": AzureConnectionConfig,
+    "gcs_connection": GcsConnectionConfig,
     "mounted_share_connection": MountedShareConnectionConfig,
 }
 
@@ -554,6 +725,9 @@ DB_TYPE_MAP: dict[str, type[ConnectionConfig]] = {
     DatabaseType.snowflake.value: SnowflakeConnectionConfig,
     DatabaseType.mssql_linked.value: MssqlLinkedServerConnectionConfig,
     DatabaseType.databricks.value: DatabricksConnectionConfig,
+    DatabaseType.cassandra.value: CassandraConnectionConfig,
+    DatabaseType.sap_ase.value: SapAseConnectionConfig,
+    DatabaseType.salesforce.value: SalesforceConnectionConfig,
     # others use the default `DatabaseConnectionConfig`
 }
 

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "datamasque-python"
-version = "1.4.0"
+version = "1.5.0"
 description = "Official Python client for the DataMasque data-masking API."
 authors = [
     { name = "DataMasque Ltd" },

{datamasque_python-1.4.0 → datamasque_python-1.5.0}/tests/helpers.py

@@ -8,7 +8,6 @@ from datamasque.client.models.connection import (
     DatabaseType,
     S3ConnectionConfig,
     SnowflakeConnectionConfig,
-    SnowflakeStageLocation,
 )
 
 fake = Faker()
@@ -117,44 +116,12 @@ def make_ok_response() -> Response:
     return response
 
 
-def snowflake_connection_config_s3():
+def snowflake_connection_config():
     return SnowflakeConnectionConfig(
-        name="snowflake_s3",
+        name="snowflake",
         database="test_db",
         user="snowflake_user",
         snowflake_account_id="ACCOUNT-123",
         snowflake_warehouse="test_warehouse",
-        snowflake_storage_integration_name="test_integration",
         password="test_password",
-        snowflake_stage_location=SnowflakeStageLocation.aws_s3,
-        s3_bucket_name="test-bucket",
-        iam_role_arn="arn:aws:iam::123456789012:role/test-role",
-    )
-
-
-def snowflake_connection_config_azure():
-    return SnowflakeConnectionConfig(
-        name="snowflake_azure",
-        database="test_db",
-        user="snowflake_user",
-        snowflake_account_id="ACCOUNT-456",
-        snowflake_warehouse="test_warehouse",
-        snowflake_storage_integration_name="test_integration",
-        password="test_password",
-        snowflake_stage_location=SnowflakeStageLocation.azure_blob_storage,
-        snowflake_azure_container_name="test-container",
-        snowflake_azure_connection_string="DefaultEndpointsProtocol=https;AccountName=test;AccountKey=test",
-    )
-
-
-def snowflake_connection_config_local():
-    return SnowflakeConnectionConfig(
-        name="snowflake_local",
-        database="test_db",
-        user="snowflake_user",
-        snowflake_account_id="ACCOUNT-789",
-        snowflake_warehouse="test_warehouse",
-        snowflake_storage_integration_name="test_integration",
-        password="test_password",
-        snowflake_stage_location=SnowflakeStageLocation.local,
     )