floe-python 0.6.9__tar.gz → 0.6.10__tar.gz

{floe_python-0.6.9 → floe_python-0.6.10}/Cargo.lock

@@ -3340,7 +3340,7 @@ dependencies = [
 
 [[package]]
 name = "floe-cli"
-version = "0.6.9"
+version = "0.6.10"
 dependencies = [
  "assert_cmd",
  "clap",
@@ -3353,7 +3353,7 @@ dependencies = [
 
 [[package]]
 name = "floe-core"
-version = "0.6.9"
+version = "0.6.10"
 dependencies = [
  "apache-avro",
  "arrow",
@@ -3399,7 +3399,7 @@ dependencies = [
 
 [[package]]
 name = "floe-python"
-version = "0.6.9"
+version = "0.6.10"
 dependencies = [
  "floe-core",
  "pyo3",

{floe_python-0.6.9 → floe_python-0.6.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: floe-python
-Version: 0.6.9
+Version: 0.6.10
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: Science/Research

{floe_python-0.6.9 → floe_python-0.6.10}/crates/floe-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floe-core"
-version = "0.6.9"
+version = "0.6.10"
 edition = "2021"
 description = "Core library for Floe, a YAML-driven technical ingestion tool."
 license = "MIT"

{floe_python-0.6.9 → floe_python-0.6.10}/crates/floe-core/src/lineage/mod.rs

@@ -8,12 +8,15 @@ use uuid::Uuid;
 
 use crate::config::{EntityConfig, LineageConfig};
 use crate::run::events::{RunEvent, RunObserver};
+use crate::secret::Secret;
 
 const DEFAULT_PRODUCER: &str = concat!(
     "https://github.com/malon64/floe/releases/tag/v",
     env!("CARGO_PKG_VERSION")
 );
 
+const OPENLINEAGE_API_KEY_ENV: &str = "OPENLINEAGE_API_KEY";
+
 #[derive(Clone)]
 struct ColumnMapping {
     output_name: String,
@@ -44,9 +47,36 @@ fn resolve_lineage_url(base: &str, endpoint: Option<&str>) -> String {
     )
 }
 
+fn is_unresolved_placeholder(value: &str) -> bool {
+    let value = value.trim();
+    value.starts_with("{{") && value.ends_with("}}")
+}
+
+/// Effective Bearer token for lineage POSTs.
+///
+/// An explicit `lineage.api_key` wins for backward compatibility. Otherwise Floe falls back
+/// to the ambient `OPENLINEAGE_API_KEY`, mirroring the OpenLineage Python client so a replayed
+/// manifest authenticates from a runner-mounted Secret without the credential ever being
+/// persisted in the manifest. An unexpanded `{{...}}` placeholder is treated as absent:
+/// profile-supplied lineage is merged after config templating (see `apply_profile_lineage`),
+/// so the raw placeholder would otherwise be sent verbatim as the token.
+fn resolve_api_key(configured: Option<&str>, ambient: Option<String>) -> Option<Secret> {
+    let explicit = configured
+        .map(str::trim)
+        .filter(|key| !key.is_empty() && !is_unresolved_placeholder(key));
+    match explicit {
+        Some(key) => Some(Secret::from(key)),
+        None => ambient
+            .map(|value| value.trim().to_string())
+            .filter(|value| !value.is_empty())
+            .map(Secret::from),
+    }
+}
+
 pub struct OpenLineageObserver {
     client: reqwest::blocking::Client,
     config: LineageConfig,
+    api_key: Option<Secret>,
     entity_start_ms: Mutex<HashMap<String, u128>>,
     entity_run_ids: Mutex<HashMap<String, String>>,
     run_start_ms: Mutex<Option<u128>>,
@@ -155,9 +185,15 @@ impl OpenLineageObserver {
             })
             .collect();
 
+        let api_key = resolve_api_key(
+            config.api_key.as_deref(),
+            std::env::var(OPENLINEAGE_API_KEY_ENV).ok(),
+        );
+
         Ok(Self {
             client,
             config: config.clone(),
+            api_key,
             entity_start_ms: Mutex::new(HashMap::new()),
             entity_run_ids: Mutex::new(HashMap::new()),
             run_start_ms: Mutex::new(None),
@@ -172,8 +208,8 @@ impl OpenLineageObserver {
 
     fn attempt_post(&self, url: &str, body: &Value) -> Result<(), bool> {
         let mut req = self.client.post(url).json(body);
-        if let Some(api_key) = self.config.api_key.as_deref() {
-            req = req.bearer_auth(api_key);
+        if let Some(api_key) = self.api_key.as_ref() {
+            req = req.bearer_auth(api_key.expose());
         }
         match req.send() {
             Err(_) => Err(true),
@@ -608,3 +644,48 @@ impl OpenLineageObserver {
         self.consecutive_failures.load(Ordering::Relaxed)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn expose(key: Option<Secret>) -> Option<String> {
+        key.map(|s| s.expose().to_string())
+    }
+
+    #[test]
+    fn explicit_config_key_wins_over_env() {
+        let key = resolve_api_key(Some("cfg-token"), Some("env-token".to_string()));
+        assert_eq!(expose(key), Some("cfg-token".to_string()));
+    }
+
+    #[test]
+    fn falls_back_to_env_when_config_absent() {
+        let key = resolve_api_key(None, Some("env-token".to_string()));
+        assert_eq!(expose(key), Some("env-token".to_string()));
+    }
+
+    #[test]
+    fn unresolved_placeholder_falls_back_to_env() {
+        let key = resolve_api_key(
+            Some("{{OPENLINEAGE_API_KEY}}"),
+            Some("env-token".to_string()),
+        );
+        assert_eq!(expose(key), Some("env-token".to_string()));
+    }
+
+    #[test]
+    fn unresolved_placeholder_without_env_is_none() {
+        assert!(resolve_api_key(Some("{{OPENLINEAGE_API_KEY}}"), None).is_none());
+    }
+
+    #[test]
+    fn none_when_neither_source_present() {
+        assert!(resolve_api_key(None, None).is_none());
+    }
+
+    #[test]
+    fn blank_values_are_ignored() {
+        assert!(resolve_api_key(Some("   "), Some("   ".to_string())).is_none());
+    }
+}

{floe_python-0.6.9 → floe_python-0.6.10}/crates/floe-core/tests/unit/run/lineage.rs

@@ -1092,3 +1092,68 @@ fn iceberg_accepted_dataset_namespace_defaults_to_job_namespace() {
     _start_mock.assert();
     _complete_mock.assert();
 }
+
+// Sole owner of the process-wide OPENLINEAGE_API_KEY variable. The crate has no
+// serial-test harness, so all three auth paths are asserted inside one test that
+// controls the variable's lifecycle; no other test reads it, and every other lineage
+// test either sets an explicit api_key (which wins over the env regardless) or does not
+// match on request headers, so this cannot race them.
+#[test]
+fn api_key_resolution_over_the_wire() {
+    std::env::remove_var("OPENLINEAGE_API_KEY");
+
+    // No config api_key and no env var => request carries no Authorization header.
+    {
+        let mut server = mockito::Server::new();
+        let mock = server
+            .mock("POST", "/api/v1/lineage")
+            .match_header("authorization", mockito::Matcher::Missing)
+            .with_status(200)
+            .expect(1)
+            .create();
+        let config = make_config(&server.url(), None);
+        let obs = OpenLineageObserver::new(&config, &[], "config.yml").unwrap();
+        obs.on_event(run_started_event());
+        mock.assert();
+    }
+
+    // Manifest replay with api_key omitted + env var set => Bearer token from the env.
+    {
+        let mut server = mockito::Server::new();
+        let mock = server
+            .mock("POST", "/api/v1/lineage")
+            .match_header("authorization", "Bearer env-replay-token")
+            .with_status(200)
+            .expect(1)
+            .create();
+        let manifest = format!(
+            r#"{{"spec_version":"0.3","report_base_uri":"file:///tmp","entities":[],"lineage":{{"url":"{}","namespace":"test-ns"}}}}"#,
+            server.url()
+        );
+        std::env::set_var("OPENLINEAGE_API_KEY", "env-replay-token");
+        let (config, _) =
+            floe_core::config_from_manifest_json(&manifest).expect("reconstruct manifest config");
+        let lineage = config.lineage.expect("manifest lineage block");
+        let obs = OpenLineageObserver::new(&lineage, &[], "").unwrap();
+        obs.on_event(run_started_event());
+        mock.assert();
+    }
+
+    // Explicit config api_key wins even when the env var is present (backward compatible).
+    {
+        let mut server = mockito::Server::new();
+        let mock = server
+            .mock("POST", "/api/v1/lineage")
+            .match_header("authorization", "Bearer cfg-token")
+            .with_status(200)
+            .expect(1)
+            .create();
+        let mut config = make_config(&server.url(), None);
+        config.api_key = Some("cfg-token".to_string());
+        let obs = OpenLineageObserver::new(&config, &[], "config.yml").unwrap();
+        obs.on_event(run_started_event());
+        mock.assert();
+    }
+
+    std::env::remove_var("OPENLINEAGE_API_KEY");
+}

{floe_python-0.6.9 → floe_python-0.6.10}/crates/floe-python/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floe-python"
-version = "0.6.9"
+version = "0.6.10"
 edition = "2021"
 description = "Python bindings for floe-core (PyO3-based)"
 license = "Apache-2.0"
@@ -14,7 +14,7 @@ name = "_floe"
 crate-type = ["cdylib"]
 
 [dependencies]
-floe-core = { path = "../floe-core", version = "0.6.9", default-features = false }
+floe-core = { path = "../floe-core", version = "0.6.10", default-features = false }
 pyo3 = { version = "0.29", features = ["extension-module", "abi3-py310"] }
 serde_json = "1"
 

{floe_python-0.6.9 → floe_python-0.6.10}/crates/floe-python/pyproject.duckdb.toml

@@ -22,7 +22,7 @@ build-backend = "maturin"
 
 [project]
 name = "floe-duckdb"
-version = "0.6.9"
+version = "0.6.10"
 description = "DuckDB companion extension for floe — adds the native DuckDB sink to the floe Python package"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -46,7 +46,7 @@ classifiers = [
 # only contributes the compiled DuckDB extension module into that package. Pin to
 # the exact lean version so the companion's `_floe_duckdb` ABI always matches the
 # `floe` package it plugs into.
-dependencies = ["floe-python==0.6.9"]
+dependencies = ["floe-python==0.6.10"]
 
 [project.urls]
 Homepage = "https://github.com/malon64/floe"

{floe_python-0.6.9 → floe_python-0.6.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "floe-python"
-version = "0.6.9"
+version = "0.6.10"
 description = "Python bindings for floe-core — run floe pipelines at Rust speed from Python and notebooks"
 readme = "README.md"
 requires-python = ">=3.10"