ee-client 2.6.1__tar.gz → 2.6.3__tar.gz

{ee_client-2.6.1 → ee_client-2.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ee-client
-Version: 2.6.1
+Version: 2.6.3
 Summary: extends the capabilities of the earthengine-api by providing custom session management and client interactions
 Author-email: Daniel Guerrero <dfgm2006@gmail.com>
 Project-URL: Homepage, https://github.com/dfguerrerom/ee-client

{ee_client-2.6.1 → ee_client-2.6.3}/ee_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ee-client
-Version: 2.6.1
+Version: 2.6.3
 Summary: extends the capabilities of the earthengine-api by providing custom session management and client interactions
 Author-email: Daniel Guerrero <dfgm2006@gmail.com>
 Project-URL: Homepage, https://github.com/dfguerrerom/ee-client

{ee_client-2.6.1 → ee_client-2.6.3}/ee_client.egg-info/SOURCES.txt

@@ -29,4 +29,6 @@ tests/test_data.py
 tests/test_export_image.py
 tests/test_export_table.py
 tests/test_integration_get_assets.py
-tests/test_models.py
+tests/test_models.py
+tests/test_tasks.py
+tests/test_tls_verify.py

{ee_client-2.6.1 → ee_client-2.6.3}/eeclient/__init__.py

@@ -1,6 +1,6 @@
 __title__ = "eeclient"
 __summary__ = "A client for Google Earth Engine"
-__version__ = "2.6.1"
+__version__ = "2.6.3"
 
 __author__ = "Daniel Guerrero"
 __email__ = "dfgm2006@gmail.com"

{ee_client-2.6.1 → ee_client-2.6.3}/eeclient/helpers.py

@@ -13,6 +13,25 @@ from ee.data import convert_asset_id_to_asset_name  # noqa: F401
 
 log = logging.getLogger("eeclient")
 
+# Hosts that legitimately serve self-signed certs in local development.
+# TLS verification is skipped for these (or via EECLIENT_INSECURE_TLS) only —
+# never for arbitrary or production hosts.
+_LOCAL_INSECURE_HOSTS = {"host.docker.internal"}
+
+
+def should_verify_tls(host: Optional[str] = None) -> bool:
+    """Return whether TLS certificates should be verified for ``host``.
+
+    Secure by default. Verification is skipped only for known local-dev hosts
+    that serve self-signed certs, or when the ``EECLIENT_INSECURE_TLS`` env var
+    is explicitly truthy. It is never disabled for arbitrary/production hosts.
+    """
+    if os.getenv("EECLIENT_INSECURE_TLS", "").strip().lower() in {"1", "true", "yes"}:
+        return False
+    if host and host in _LOCAL_INSECURE_HOSTS:
+        return False
+    return True
+
 
 def _get_ee_image(
     ee_object: Union[Image, ImageCollection, Feature, FeatureCollection],
@@ -77,7 +96,7 @@ def get_sepal_headers_from_auth(
         )
 
     session = requests.Session()
-    session.verify = False
+    session.verify = should_verify_tls(sepal_host)
 
     creds_response = session.post(
         f"https://{sepal_host}/api/user/login",
@@ -91,10 +110,8 @@ def get_sepal_headers_from_auth(
 
     creds_response.raise_for_status()
 
-    log.debug(f"Authentication successful. Cookies: {session.cookies}")
-    log.debug(f"Response>>>>>>>>>>: {creds_response.json()}")
-
     sepal_user_obj = SepalUser.model_validate(creds_response.json())
+    log.debug("Authentication successful for user '%s'", sepal_user_obj.username)
 
     cookies_dict = {cookie.name: cookie.value for cookie in session.cookies}
 

{ee_client-2.6.1 → ee_client-2.6.3}/eeclient/sepal_credential_mixin.py

@@ -4,6 +4,7 @@ from eeclient.exceptions import (
     CredentialsFileUnknownError,
     SepalCredentialsUnavailableError,
 )
+from eeclient.helpers import should_verify_tls
 import os
 import logging
 import json
@@ -50,10 +51,7 @@ class SepalCredentialMixin:
             f"https://{self.sepal_host}/api/user-files/download/"
             "?path=%2F.config%2Fearthengine%2Fcredentials"
         )
-        self.verify_ssl = not (
-            self.sepal_host == "host.docker.internal"
-            or self.sepal_host == "danielg.sepal.io"
-        )
+        self.verify_ssl = should_verify_tls(self.sepal_host)
 
         self._google_tokens = self.sepal_user_data.google_tokens
         if self._google_tokens:

{ee_client-2.6.1 → ee_client-2.6.3}/eeclient/tasks.py

@@ -24,9 +24,12 @@ class CamelCaseModel(BaseModel):
 
 class Stage(CamelCaseModel):
     display_name: str
-    complete_work_units: int
-    total_work_units: str
-    description: str
+    # The Cloud API omits these fields on a stage until that stage has
+    # reported progress, so they must be optional to avoid breaking polling
+    # of a freshly-RUNNING task.
+    complete_work_units: Optional[int] = None
+    total_work_units: Optional[str] = None
+    description: Optional[str] = None
 
 
 class TaskMetadata(CamelCaseModel):

{ee_client-2.6.1 → ee_client-2.6.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ee-client"
-version = "2.6.1"
+version = "2.6.3"
 description = "extends the capabilities of the earthengine-api by providing custom session management and client interactions"
 readme = { file = "README.rst",  content-type = "text/x-rst" }
 authors = [
@@ -66,7 +66,7 @@ branch = true
 [tool.commitizen]
 tag_format = "v$major.$minor.$patch$prerelease"
 update_changelog_on_bump = false
-version = "2.6.1"
+version = "2.6.3"
 version_files = [
     "pyproject.toml:version",
     "eeclient/__init__.py:__version__",

ee_client-2.6.3/tests/test_tasks.py

@@ -0,0 +1,60 @@
+"""Tests for the Task / Stage models in eeclient.tasks."""
+
+from eeclient.tasks import Stage, Task
+
+
+def test_stage_allows_missing_work_units():
+    """The Cloud API omits completeWorkUnits/totalWorkUnits on a stage until
+    that stage reports progress; the model must accept this."""
+    stage = Stage.model_validate(
+        {
+            "displayName": "Create List of Assets",
+            "description": "Listing of temporary files.",
+        }
+    )
+    assert stage.display_name == "Create List of Assets"
+    assert stage.complete_work_units is None
+    assert stage.total_work_units is None
+
+
+def test_stage_allows_missing_description():
+    """Some stages omit `description` entirely before reporting progress."""
+    stage = Stage.model_validate({"displayName": "Write Files"})
+    assert stage.display_name == "Write Files"
+    assert stage.description is None
+    assert stage.complete_work_units is None
+    assert stage.total_work_units is None
+
+
+def test_task_validates_with_incomplete_stages():
+    """Regression for issue #22: polling a freshly-RUNNING export returns
+    stages without completeWorkUnits / totalWorkUnits and must not raise."""
+    payload = {
+        "name": "projects/ee-project/operations/ABC123",
+        "metadata": {
+            "@type": "type.googleapis.com/google.earthengine.v1.OperationMetadata",
+            "state": "RUNNING",
+            "description": "my-export",
+            "priority": 100,
+            "createTime": "2026-05-13T12:00:00Z",
+            "type": "EXPORT_IMAGE",
+            "stages": [
+                {
+                    "displayName": "Create List of Assets",
+                    "description": "Listing of temporary files.",
+                },
+                {
+                    "displayName": "Write Files",
+                    "description": "Writing files to the export destination.",
+                },
+            ],
+        },
+        "done": False,
+    }
+
+    task = Task.model_validate(payload)
+    assert task.id == "ABC123"
+    assert task.metadata.stages is not None
+    assert len(task.metadata.stages) == 2
+    assert task.metadata.stages[0].complete_work_units is None
+    assert task.metadata.stages[0].total_work_units is None

ee_client-2.6.3/tests/test_tls_verify.py

@@ -0,0 +1,51 @@
+"""TLS verification policy for ee-client.
+
+Security regression guard: TLS must be verified by default for every host,
+including the maintainer's former personal dev host. Verification may only be
+skipped for known local-dev hosts (self-signed) or via an explicit opt-in env
+var — never for arbitrary or production hosts.
+"""
+
+import pytest
+
+from eeclient.helpers import should_verify_tls
+
+INSECURE_ENV = "EECLIENT_INSECURE_TLS"
+
+
+@pytest.fixture(autouse=True)
+def _clear_insecure_env(monkeypatch):
+    monkeypatch.delenv(INSECURE_ENV, raising=False)
+
+
+@pytest.mark.parametrize(
+    "host",
+    [
+        "sepal.io",
+        "danielg.sepal.io",  # former hardcoded insecure host — must now verify
+        "danielg.sepal.io.attacker.com",  # must not match via substring
+        "anything.example.com",
+        None,  # file-based auth (no host)
+    ],
+)
+def test_verifies_by_default(host):
+    assert should_verify_tls(host) is True
+
+
+def test_local_docker_host_is_skipped():
+    # Local Docker host serves a self-signed cert and cannot be meaningfully
+    # MITM'd; skipping verification there is the one defensible exception.
+    assert should_verify_tls("host.docker.internal") is False
+
+
+@pytest.mark.parametrize("value", ["1", "true", "TRUE", "yes", "Yes"])
+def test_explicit_opt_in_disables_verification(monkeypatch, value):
+    monkeypatch.setenv(INSECURE_ENV, value)
+    assert should_verify_tls("danielg.sepal.io") is False
+    assert should_verify_tls("sepal.io") is False
+
+
+@pytest.mark.parametrize("value", ["", "0", "false", "no", "off"])
+def test_non_truthy_opt_in_keeps_verification(monkeypatch, value):
+    monkeypatch.setenv(INSECURE_ENV, value)
+    assert should_verify_tls("sepal.io") is True