PyPI - fastapi-m8 - Versions diffs - 4.2.1__tar.gz → 4.2.2__tar.gz - Mend

fastapi-m8 4.2.1tar.gz → 4.2.2tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (64) hide show

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/.github/workflows/CI.yaml RENAMED Viewed

@@ -16,10 +16,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -36,10 +36,10 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
           cache: "pip"
@@ -53,10 +53,10 @@ jobs:
   security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14"
@@ -87,10 +87,10 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/.github/workflows/PiPy.yml RENAMED Viewed

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
@@ -51,7 +51,7 @@ jobs:
           path: dist/
       - name: Publish release distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
   sbom:
     name: Generate & attach SBOM
@@ -63,9 +63,9 @@ jobs:
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-m8
-Version: 4.2.1
+Version: 4.2.2
 Summary: FastAPI application framework for m8 consumer microservices.
 Author-email: Eli Serra <e.serra173@gmail.com>
 License:                                  Apache License
@@ -215,7 +215,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.12
 Requires-Dist: anyio>=4.0
-Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<4.0.0,>=3.1.0
+Requires-Dist: auth-sdk-m8[config,events,fastapi,observability,security]<4.0.0,>=3.1.2
 Requires-Dist: fastapi>=0.136.3
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: packaging>=24.0
@@ -659,6 +659,18 @@ untouched.
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
+> **Ordinary expiry never surfaces as a `503`.** The refresh check runs lazily
+> on every call, before the private request is sent: once past
+> `exp - SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS`, the client re-exchanges first.
+> Continuous traffic therefore never presents an actually expired service
+> token to the issuer. The one case where a `503` legitimately occurs is a
+> withdrawn/rotated consumer secret, or a request whose latency races the
+> leeway margin — the issuer answers `401`, the cached token is dropped, and
+> that single request fails closed while the next one re-mints and succeeds
+> (never retried automatically — introspection consumes the caller's quota).
+> Accepted operational behavior; documented rather than pre-empted by a
+> second re-mint mechanism, since the proactive one above already covers it.
 ### Remote API-Key Principal
 Resolves a user API key presented by an external client to its owner's current

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/README.md RENAMED Viewed

@@ -402,6 +402,18 @@ untouched.
 | `SERVICE_TOKEN_SCOPES` | No | `["introspection"]` | Scopes requested when minting a service token; fa-auth narrows to the subset the bootstrap credential was granted. |
 | `SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS` | No | `30` | Refresh a cached service token this many seconds before its `exp` so a call never races expiry. |
+> **Ordinary expiry never surfaces as a `503`.** The refresh check runs lazily
+> on every call, before the private request is sent: once past
+> `exp - SERVICE_TOKEN_REFRESH_LEEWAY_SECONDS`, the client re-exchanges first.
+> Continuous traffic therefore never presents an actually expired service
+> token to the issuer. The one case where a `503` legitimately occurs is a
+> withdrawn/rotated consumer secret, or a request whose latency races the
+> leeway margin — the issuer answers `401`, the cached token is dropped, and
+> that single request fails closed while the next one re-mints and succeeds
+> (never retried automatically — introspection consumes the caller's quota).
+> Accepted operational behavior; documented rather than pre-empted by a
+> second re-mint mechanism, since the proactive one above already covers it.
 ### Remote API-Key Principal
 Resolves a user API key presented by an external client to its owner's current

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/constraints-all.txt RENAMED Viewed

@@ -25,7 +25,7 @@ attrs==26.1.0
     # via
     #   outcome
     #   trio
-auth-sdk-m8[config,events,fastapi,observability,security]==3.1.0
+auth-sdk-m8[config,events,fastapi,observability,security]==3.1.2
     # via
     #   fastapi-m8
     #   fastapi-m8 (pyproject.toml)

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/constraints.txt RENAMED Viewed

@@ -16,7 +16,7 @@ anyio==4.14.1
     #   fastapi-m8 (pyproject.toml)
     #   httpx
     #   starlette
-auth-sdk-m8[config,events,fastapi,observability,security]==3.1.0
+auth-sdk-m8[config,events,fastapi,observability,security]==3.1.2
     # via
     #   fastapi-m8
     #   fastapi-m8 (pyproject.toml)

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/fastapi_m8/_version.py RENAMED Viewed

@@ -1,3 +1,3 @@
 """Single source of truth for the package version."""
-__version__ = "4.2.1"
+__version__ = "4.2.2"

{fastapi_m8-4.2.1 → fastapi_m8-4.2.2}/pyproject.toml RENAMED Viewed

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 [project]
 name = "fastapi-m8"
-version = "4.2.1"
+version = "4.2.2"
 description = "FastAPI application framework for m8 consumer microservices."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -26,7 +26,7 @@ dependencies = [
     "httpx>=0.27.0",
     "packaging>=24.0",
     "anyio>=4.0",
-    "auth-sdk-m8[config,security,fastapi,observability,events]>=3.1.0,<4.0.0",
+    "auth-sdk-m8[config,security,fastapi,observability,events]>=3.1.2,<4.0.0",
 ]
 [project.optional-dependencies]