django-database-task 0.2.2__tar.gz → 0.2.3__tar.gz

{django_database_task-0.2.2/django_database_task.egg-info → django_database_task-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-database-task
-Version: 0.2.2
+Version: 0.2.3
 Summary: A database-backed task queue backend for Django 6.0's built-in task framework
 Author-email: Shinya Okano <tokibito@gmail.com>
 Maintainer-email: Shinya Okano <tokibito@gmail.com>
@@ -717,6 +717,40 @@ TASKS = {
 
 When `OIDC_SERVICE_ACCOUNT_EMAIL` is configured, Cloud Tasks will send OIDC tokens with each request. The backend automatically verifies these tokens on the `/tasks/execute/` and `/tasks/purge/` endpoints.
 
+#### Required IAM Roles
+
+To use OIDC authentication, the following IAM roles are required:
+
+| Role | Description |
+|------|-------------|
+| `roles/cloudtasks.enqueuer` | Required to create tasks in Cloud Tasks queues |
+| `roles/iam.serviceAccountUser` | Required to specify the OIDC service account when creating tasks |
+
+**Setup:**
+
+1. Create a service account for OIDC token generation:
+   ```bash
+   gcloud iam service-accounts create cloud-tasks-invoker \
+       --display-name="Cloud Tasks Invoker"
+   ```
+
+2. Grant the Cloud Tasks Enqueuer role to the service account running your application (e.g., App Engine default service account):
+   ```bash
+   gcloud projects add-iam-policy-binding PROJECT_ID \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/cloudtasks.enqueuer"
+   ```
+
+3. Grant the Service Account User role to allow impersonation of the OIDC service account:
+   ```bash
+   gcloud iam service-accounts add-iam-policy-binding \
+       cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/iam.serviceAccountUser"
+   ```
+
+**Note:** The OIDC service account specified in `OIDC_SERVICE_ACCOUNT_EMAIL` does not need any additional roles. It is only used to generate the OIDC token that is included in the HTTP request to your task handler.
+
 ```python
 # settings.py - Automatic OIDC verification
 TASKS = {
@@ -724,7 +758,7 @@ TASKS = {
         "BACKEND": "django_database_task.cloudtasks.CloudTasksDatabaseBackend",
         "QUEUES": [],  # Allow all queue names
         "OPTIONS": {
-            "OIDC_SERVICE_ACCOUNT_EMAIL": "my-sa@project.iam.gserviceaccount.com",
+            "OIDC_SERVICE_ACCOUNT_EMAIL": "cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com",
             # OIDC_AUDIENCE is auto-detected from handler URL if not set
         },
     },

{django_database_task-0.2.2 → django_database_task-0.2.3}/README.md

@@ -681,6 +681,40 @@ TASKS = {
 
 When `OIDC_SERVICE_ACCOUNT_EMAIL` is configured, Cloud Tasks will send OIDC tokens with each request. The backend automatically verifies these tokens on the `/tasks/execute/` and `/tasks/purge/` endpoints.
 
+#### Required IAM Roles
+
+To use OIDC authentication, the following IAM roles are required:
+
+| Role | Description |
+|------|-------------|
+| `roles/cloudtasks.enqueuer` | Required to create tasks in Cloud Tasks queues |
+| `roles/iam.serviceAccountUser` | Required to specify the OIDC service account when creating tasks |
+
+**Setup:**
+
+1. Create a service account for OIDC token generation:
+   ```bash
+   gcloud iam service-accounts create cloud-tasks-invoker \
+       --display-name="Cloud Tasks Invoker"
+   ```
+
+2. Grant the Cloud Tasks Enqueuer role to the service account running your application (e.g., App Engine default service account):
+   ```bash
+   gcloud projects add-iam-policy-binding PROJECT_ID \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/cloudtasks.enqueuer"
+   ```
+
+3. Grant the Service Account User role to allow impersonation of the OIDC service account:
+   ```bash
+   gcloud iam service-accounts add-iam-policy-binding \
+       cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/iam.serviceAccountUser"
+   ```
+
+**Note:** The OIDC service account specified in `OIDC_SERVICE_ACCOUNT_EMAIL` does not need any additional roles. It is only used to generate the OIDC token that is included in the HTTP request to your task handler.
+
 ```python
 # settings.py - Automatic OIDC verification
 TASKS = {
@@ -688,7 +722,7 @@ TASKS = {
         "BACKEND": "django_database_task.cloudtasks.CloudTasksDatabaseBackend",
         "QUEUES": [],  # Allow all queue names
         "OPTIONS": {
-            "OIDC_SERVICE_ACCOUNT_EMAIL": "my-sa@project.iam.gserviceaccount.com",
+            "OIDC_SERVICE_ACCOUNT_EMAIL": "cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com",
             # OIDC_AUDIENCE is auto-detected from handler URL if not set
         },
     },

{django_database_task-0.2.2 → django_database_task-0.2.3}/django_database_task/__init__.py

@@ -2,7 +2,7 @@
 django-database-task: A database-backed task queue backend for Django 6.0's task framework.
 """
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"
 
 
 def __getattr__(name):

{django_database_task-0.2.2 → django_database_task-0.2.3}/django_database_task/backends.py

@@ -1,4 +1,5 @@
 import asyncio
+import logging
 import traceback
 from importlib import import_module
 from inspect import iscoroutinefunction
@@ -10,6 +11,8 @@ from django.tasks.signals import task_enqueued, task_finished, task_started
 from django.utils import timezone
 from django.utils.json import normalize_json
 
+logger = logging.getLogger("django_database_task")
+
 
 class DatabaseTaskBackend(BaseTaskBackend):
     """A task backend that persists tasks in the database."""
@@ -200,6 +203,20 @@ class DatabaseTaskBackend(BaseTaskBackend):
                 ]
             )
 
+            # Send signal for success
+            db_task.refresh_from_db()
+            final_result = self._db_task_to_result(db_task, task)
+            # Note: Django's task_finished handler logs "NoneType: None" after this
+            # due to exc_info=sys.exc_info() being called outside exception context.
+            # This is a known Django issue and will be fixed upstream.
+            logger.info(
+                "Task completed successfully: id=%s path=%s",
+                final_result.id,
+                db_task.task_path,
+            )
+            task_finished.send(sender=self.__class__, task_result=final_result)
+            return final_result
+
         except Exception as e:
             # Failure
             error = TaskError(
@@ -221,9 +238,14 @@ class DatabaseTaskBackend(BaseTaskBackend):
                 update_fields=["status", "errors_json", "finished_at", "updated_at"]
             )
 
-        # Get final result and send signal
-        db_task.refresh_from_db()
-        final_result = self._db_task_to_result(db_task, task)
-        task_finished.send(sender=self.__class__, task_result=final_result)
-
-        return final_result
+            # Send signal for failure (with exception context for Django's logging)
+            db_task.refresh_from_db()
+            final_result = self._db_task_to_result(db_task, task)
+            logger.error(
+                "Task failed: id=%s path=%s error=%s",
+                final_result.id,
+                db_task.task_path,
+                error.exception_class_path,
+            )
+            task_finished.send(sender=self.__class__, task_result=final_result)
+            return final_result

{django_database_task-0.2.2 → django_database_task-0.2.3}/django_database_task/cloudtasks/auth.py

@@ -5,12 +5,16 @@ Provides authentication handler and decorator for verifying OIDC tokens
 sent by Cloud Tasks.
 """
 
+import logging
+import traceback
 from functools import wraps
 
 from django.http import JsonResponse
 from google.auth.transport import requests as google_requests
 from google.oauth2 import id_token
 
+logger = logging.getLogger("django_database_task.cloudtasks.auth")
+
 
 def create_oidc_auth_handler(audience):
     """
@@ -64,8 +68,31 @@ def create_oidc_auth_handler(audience):
             # Attach claims to request for use in view
             request.cloud_tasks_claims = claims
 
+            # Log successful verification
+            service_account = claims.get("email", "unknown")
+            logger.info(
+                "OIDC token verified successfully: service_account=%s audience=%s",
+                service_account,
+                audience,
+            )
+
         except Exception as e:
-            return JsonResponse({"error": f"Invalid token: {e}"}, status=401)
+            # Log the full exception for debugging
+            # Use print as fallback since logging config may not capture this logger
+            error_type = type(e).__name__
+            error_msg = str(e) if str(e) else "No details available"
+            tb = traceback.format_exc()
+            full_error = (
+                f"OIDC token verification failed: {error_type}: {error_msg}\n{tb}"
+            )
+            logger.error(full_error)
+            # Also print to stderr for environments where logging is not configured
+            import sys
+
+            print(full_error, file=sys.stderr)
+            return JsonResponse(
+                {"error": f"Invalid token: {error_type}: {error_msg}"}, status=401
+            )
 
         return None
 

{django_database_task-0.2.2 → django_database_task-0.2.3/django_database_task.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-database-task
-Version: 0.2.2
+Version: 0.2.3
 Summary: A database-backed task queue backend for Django 6.0's built-in task framework
 Author-email: Shinya Okano <tokibito@gmail.com>
 Maintainer-email: Shinya Okano <tokibito@gmail.com>
@@ -717,6 +717,40 @@ TASKS = {
 
 When `OIDC_SERVICE_ACCOUNT_EMAIL` is configured, Cloud Tasks will send OIDC tokens with each request. The backend automatically verifies these tokens on the `/tasks/execute/` and `/tasks/purge/` endpoints.
 
+#### Required IAM Roles
+
+To use OIDC authentication, the following IAM roles are required:
+
+| Role | Description |
+|------|-------------|
+| `roles/cloudtasks.enqueuer` | Required to create tasks in Cloud Tasks queues |
+| `roles/iam.serviceAccountUser` | Required to specify the OIDC service account when creating tasks |
+
+**Setup:**
+
+1. Create a service account for OIDC token generation:
+   ```bash
+   gcloud iam service-accounts create cloud-tasks-invoker \
+       --display-name="Cloud Tasks Invoker"
+   ```
+
+2. Grant the Cloud Tasks Enqueuer role to the service account running your application (e.g., App Engine default service account):
+   ```bash
+   gcloud projects add-iam-policy-binding PROJECT_ID \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/cloudtasks.enqueuer"
+   ```
+
+3. Grant the Service Account User role to allow impersonation of the OIDC service account:
+   ```bash
+   gcloud iam service-accounts add-iam-policy-binding \
+       cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com \
+       --member="serviceAccount:PROJECT_ID@appspot.gserviceaccount.com" \
+       --role="roles/iam.serviceAccountUser"
+   ```
+
+**Note:** The OIDC service account specified in `OIDC_SERVICE_ACCOUNT_EMAIL` does not need any additional roles. It is only used to generate the OIDC token that is included in the HTTP request to your task handler.
+
 ```python
 # settings.py - Automatic OIDC verification
 TASKS = {
@@ -724,7 +758,7 @@ TASKS = {
         "BACKEND": "django_database_task.cloudtasks.CloudTasksDatabaseBackend",
         "QUEUES": [],  # Allow all queue names
         "OPTIONS": {
-            "OIDC_SERVICE_ACCOUNT_EMAIL": "my-sa@project.iam.gserviceaccount.com",
+            "OIDC_SERVICE_ACCOUNT_EMAIL": "cloud-tasks-invoker@PROJECT_ID.iam.gserviceaccount.com",
             # OIDC_AUDIENCE is auto-detected from handler URL if not set
         },
     },

{django_database_task-0.2.2 → django_database_task-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "django-database-task"
-version = "0.2.2"
+version = "0.2.3"
 description = "A database-backed task queue backend for Django 6.0's built-in task framework"
 readme = "README.md"
 license = "MIT"