flwr-nightly 1.15.0.dev20250114__py3-none-any.whl → 1.15.0.dev20250123__py3-none-any.whl

flwr/client/clientapp/utils.py

@@ -66,7 +66,7 @@ def get_load_client_app_fn(
         # `fab_hash` is not required since the app is loaded from `runtime_app_dir`.
         elif app_path is not None:
             config = get_project_config(runtime_app_dir)
-            this_fab_version, this_fab_id = get_metadata_from_config(config)
+            this_fab_id, this_fab_version = get_metadata_from_config(config)
 
             if this_fab_version != fab_version or this_fab_id != fab_id:
                 raise LoadClientAppError(

flwr/client/grpc_client/connection.py

@@ -47,12 +47,6 @@ from flwr.proto.transport_pb2 import (  # pylint: disable=E0611
 )
 from flwr.proto.transport_pb2_grpc import FlowerServiceStub  # pylint: disable=E0611
 
-# The following flags can be uncommented for debugging. Other possible values:
-# https://github.com/grpc/grpc/blob/master/doc/environment_variables.md
-# import os
-# os.environ["GRPC_VERBOSITY"] = "debug"
-# os.environ["GRPC_TRACE"] = "tcp,http"
-
 
 def on_channel_state_change(channel_connectivity: str) -> None:
     """Log channel connectivity."""

flwr/client/grpc_rere_client/client_interceptor.py

@@ -15,71 +15,18 @@
 """Flower client interceptor."""
 
 
-import base64
-import collections
-from collections.abc import Sequence
-from logging import WARNING
-from typing import Any, Callable, Optional, Union
+from typing import Any, Callable
 
 import grpc
 from cryptography.hazmat.primitives.asymmetric import ec
+from google.protobuf.message import Message as GrpcMessage
 
-from flwr.common.logger import log
+from flwr.common import now
+from flwr.common.constant import PUBLIC_KEY_HEADER, SIGNATURE_HEADER, TIMESTAMP_HEADER
 from flwr.common.secure_aggregation.crypto.symmetric_encryption import (
-    bytes_to_public_key,
-    compute_hmac,
-    generate_shared_key,
     public_key_to_bytes,
+    sign_message,
 )
-from flwr.proto.fab_pb2 import GetFabRequest  # pylint: disable=E0611
-from flwr.proto.fleet_pb2 import (  # pylint: disable=E0611
-    CreateNodeRequest,
-    DeleteNodeRequest,
-    PingRequest,
-    PullMessagesRequest,
-    PullTaskInsRequest,
-    PushMessagesRequest,
-    PushTaskResRequest,
-)
-from flwr.proto.run_pb2 import GetRunRequest  # pylint: disable=E0611
-
-_PUBLIC_KEY_HEADER = "public-key"
-_AUTH_TOKEN_HEADER = "auth-token"
-
-Request = Union[
-    CreateNodeRequest,
-    DeleteNodeRequest,
-    PullTaskInsRequest,
-    PushTaskResRequest,
-    GetRunRequest,
-    PingRequest,
-    GetFabRequest,
-    PullMessagesRequest,
-    PushMessagesRequest,
-]
-
-
-def _get_value_from_tuples(
-    key_string: str, tuples: Sequence[tuple[str, Union[str, bytes]]]
-) -> bytes:
-    value = next((value for key, value in tuples if key == key_string), "")
-    if isinstance(value, str):
-        return value.encode()
-
-    return value
-
-
-class _ClientCallDetails(
-    collections.namedtuple(
-        "_ClientCallDetails", ("method", "timeout", "metadata", "credentials")
-    ),
-    grpc.ClientCallDetails,  # type: ignore
-):
-    """Details for each client call.
-
-    The class will be passed on as the first argument in continuation function.
-    In our case, `AuthenticateClientInterceptor` adds new metadata to the construct.
-    """
 
 
 class AuthenticateClientInterceptor(grpc.UnaryUnaryClientInterceptor):  # type: ignore
@@ -91,86 +38,33 @@ class AuthenticateClientInterceptor(grpc.UnaryUnaryClientInterceptor):  # type:
         public_key: ec.EllipticCurvePublicKey,
     ):
         self.private_key = private_key
-        self.public_key = public_key
-        self.shared_secret: Optional[bytes] = None
-        self.server_public_key: Optional[ec.EllipticCurvePublicKey] = None
-        self.encoded_public_key = base64.urlsafe_b64encode(
-            public_key_to_bytes(self.public_key)
-        )
+        self.public_key_bytes = public_key_to_bytes(public_key)
 
     def intercept_unary_unary(
         self,
         continuation: Callable[[Any, Any], Any],
         client_call_details: grpc.ClientCallDetails,
-        request: Request,
+        request: GrpcMessage,
     ) -> grpc.Call:
         """Flower client interceptor.
 
         Intercept unary call from client and add necessary authentication header in the
         RPC metadata.
         """
-        metadata = []
-        postprocess = False
-        if client_call_details.metadata is not None:
-            metadata = list(client_call_details.metadata)
-
-        # Always add the public key header
-        metadata.append(
-            (
-                _PUBLIC_KEY_HEADER,
-                self.encoded_public_key,
-            )
-        )
-
-        if isinstance(request, CreateNodeRequest):
-            postprocess = True
-        elif isinstance(
-            request,
-            (
-                DeleteNodeRequest,
-                PullTaskInsRequest,
-                PushTaskResRequest,
-                GetRunRequest,
-                PingRequest,
-                GetFabRequest,
-                PullMessagesRequest,
-                PushMessagesRequest,
-            ),
-        ):
-            if self.shared_secret is None:
-                raise RuntimeError("Failure to compute hmac")
-
-            message_bytes = request.SerializeToString(deterministic=True)
-            metadata.append(
-                (
-                    _AUTH_TOKEN_HEADER,
-                    base64.urlsafe_b64encode(
-                        compute_hmac(self.shared_secret, message_bytes)
-                    ),
-                )
-            )
+        metadata = list(client_call_details.metadata or [])
 
-        client_call_details = _ClientCallDetails(
-            client_call_details.method,
-            client_call_details.timeout,
-            metadata,
-            client_call_details.credentials,
-        )
+        # Add the public key
+        metadata.append((PUBLIC_KEY_HEADER, self.public_key_bytes))
 
-        response = continuation(client_call_details, request)
-        if postprocess:
-            server_public_key_bytes = base64.urlsafe_b64decode(
-                _get_value_from_tuples(_PUBLIC_KEY_HEADER, response.initial_metadata())
-            )
+        # Add timestamp
+        timestamp = now().isoformat()
+        metadata.append((TIMESTAMP_HEADER, timestamp))
 
-            if server_public_key_bytes != b"":
-                self.server_public_key = bytes_to_public_key(server_public_key_bytes)
-            else:
-                log(WARNING, "Can't get server public key, SuperLink may be offline")
+        # Sign and add the signature
+        signature = sign_message(self.private_key, timestamp.encode("ascii"))
+        metadata.append((SIGNATURE_HEADER, signature))
 
-            if self.server_public_key is not None:
-                self.shared_secret = generate_shared_key(
-                    self.private_key, self.server_public_key
-                )
+        # Overwrite the metadata
+        details = client_call_details._replace(metadata=metadata)
 
-        return response
+        return continuation(details, request)

flwr/client/grpc_rere_client/connection.py

@@ -311,3 +311,13 @@ def grpc_request_response(  # pylint: disable=R0913,R0914,R0915,R0917
         yield (receive, send, create_node, delete_node, get_run, get_fab)
     except Exception as exc:  # pylint: disable=broad-except
         log(ERROR, exc)
+    # Cleanup
+    finally:
+        try:
+            if node is not None:
+                # Disable retrying
+                retry_invoker.max_tries = 1
+                delete_node()
+        except grpc.RpcError:
+            pass
+        channel.close()

flwr/client/rest_client/connection.py

@@ -16,7 +16,6 @@
 
 
 import random
-import sys
 import threading
 from collections.abc import Iterator
 from contextlib import contextmanager
@@ -26,17 +25,18 @@ from typing import Callable, Optional, TypeVar, Union
 
 from cryptography.hazmat.primitives.asymmetric import ec
 from google.protobuf.message import Message as GrpcMessage
+from requests.exceptions import ConnectionError as RequestsConnectionError
 
 from flwr.client.heartbeat import start_ping_loop
 from flwr.client.message_handler.message_handler import validate_out_message
 from flwr.common import GRPC_MAX_MESSAGE_LENGTH
 from flwr.common.constant import (
-    MISSING_EXTRA_REST,
     PING_BASE_MULTIPLIER,
     PING_CALL_TIMEOUT,
     PING_DEFAULT_INTERVAL,
     PING_RANDOM_RANGE,
 )
+from flwr.common.exit import ExitCode, flwr_exit
 from flwr.common.logger import log
 from flwr.common.message import Message, Metadata
 from flwr.common.retry_invoker import RetryInvoker
@@ -61,7 +61,7 @@ from flwr.proto.run_pb2 import GetRunRequest, GetRunResponse  # pylint: disable=
 try:
     import requests
 except ModuleNotFoundError:
-    sys.exit(MISSING_EXTRA_REST)
+    flwr_exit(ExitCode.COMMON_MISSING_EXTRA_REST)
 
 
 PATH_CREATE_NODE: str = "api/v0/fleet/create-node"
@@ -379,3 +379,12 @@ def http_request_response(  # pylint: disable=R0913,R0914,R0915,R0917
         yield (receive, send, create_node, delete_node, get_run, get_fab)
     except Exception as exc:  # pylint: disable=broad-except
         log(ERROR, exc)
+    # Cleanup
+    finally:
+        try:
+            if node is not None:
+                # Disable retrying
+                retry_invoker.max_tries = 1
+                delete_node()
+        except RequestsConnectionError:
+            pass

flwr/client/supernode/app.py

@@ -40,6 +40,7 @@ from flwr.common.constant import (
     TRANSPORT_TYPE_GRPC_RERE,
     TRANSPORT_TYPE_REST,
 )
+from flwr.common.exit import ExitCode, flwr_exit
 from flwr.common.exit_handlers import register_exit_handlers
 from flwr.common.logger import log, warn_deprecated_feature
 
@@ -86,6 +87,12 @@ def run_supernode() -> None:
 
     log(DEBUG, "Isolation mode: %s", args.isolation)
 
+    # Register handlers for graceful shutdown
+    register_exit_handlers(
+        event_type=EventType.RUN_SUPERNODE_LEAVE,
+        exit_message="SuperNode terminated gracefully.",
+    )
+
     start_client_internal(
         server_address=args.superlink,
         load_client_app_fn=load_fn,
@@ -103,11 +110,6 @@ def run_supernode() -> None:
         clientappio_api_address=args.clientappio_api_address,
     )
 
-    # Graceful shutdown
-    register_exit_handlers(
-        event_type=EventType.RUN_SUPERNODE_LEAVE,
-    )
-
 
 def run_client_app() -> None:
     """Run Flower client app."""
@@ -280,11 +282,7 @@ def _try_setup_client_authentication(
         return None
 
     if not args.auth_supernode_private_key or not args.auth_supernode_public_key:
-        sys.exit(
-            "Authentication requires file paths to both "
-            "'--auth-supernode-private-key' and '--auth-supernode-public-key'"
-            "to be provided (providing only one of them is not sufficient)."
-        )
+        flwr_exit(ExitCode.SUPERNODE_NODE_AUTH_KEYS_REQUIRED)
 
     try:
         ssh_private_key = load_ssh_private_key(
@@ -294,11 +292,9 @@ def _try_setup_client_authentication(
         if not isinstance(ssh_private_key, ec.EllipticCurvePrivateKey):
             raise ValueError()
     except (ValueError, UnsupportedAlgorithm):
-        sys.exit(
-            "Error: Unable to parse the private key file in "
-            "'--auth-supernode-private-key'. Authentication requires elliptic "
-            "curve private and public key pair. Please ensure that the file "
-            "path points to a valid private key file and try again."
+        flwr_exit(
+            ExitCode.SUPERNODE_NODE_AUTH_KEYS_INVALID,
+            "Unable to parse the private key file.",
         )
 
     try:
@@ -308,11 +304,9 @@ def _try_setup_client_authentication(
         if not isinstance(ssh_public_key, ec.EllipticCurvePublicKey):
             raise ValueError()
     except (ValueError, UnsupportedAlgorithm):
-        sys.exit(
-            "Error: Unable to parse the public key file in "
-            "'--auth-supernode-public-key'. Authentication requires elliptic "
-            "curve private and public key pair. Please ensure that the file "
-            "path points to a valid public key file and try again."
+        flwr_exit(
+            ExitCode.SUPERNODE_NODE_AUTH_KEYS_INVALID,
+            "Unable to parse the public key file.",
         )
 
     return (

flwr/common/auth_plugin/auth_plugin.py

@@ -38,6 +38,7 @@ class ExecAuthPlugin(ABC):
     def __init__(
         self,
         user_auth_config_path: Path,
+        verify_tls_cert: bool,
     ):
         """Abstract constructor."""
 

flwr/common/config.py

@@ -17,13 +17,13 @@
 
 import os
 import re
+import zipfile
+from io import BytesIO
 from pathlib import Path
-from typing import Any, Optional, Union, cast, get_args
+from typing import IO, Any, Optional, TypeVar, Union, cast, get_args
 
 import tomli
 
-from flwr.cli.config_utils import get_fab_config, validate_fields
-from flwr.common import ConfigsRecord
 from flwr.common.constant import (
     APP_DIR,
     FAB_CONFIG_FILE,
@@ -33,6 +33,10 @@ from flwr.common.constant import (
 )
 from flwr.common.typing import Run, UserConfig, UserConfigValue
 
+from . import ConfigsRecord, object_ref
+
+T_dict = TypeVar("T_dict", bound=dict[str, Any])  # pylint: disable=invalid-name
+
 
 def get_flwr_dir(provided_path: Optional[str] = None) -> Path:
     """Return the Flower home directory based on env variables."""
@@ -80,7 +84,7 @@ def get_project_config(project_dir: Union[str, Path]) -> dict[str, Any]:
         config = tomli.loads(toml_file.read())
 
     # Validate pyproject.toml fields
-    is_valid, errors, _ = validate_fields(config)
+    is_valid, errors, _ = validate_fields_in_config(config)
     if not is_valid:
         error_msg = "\n".join([f"  - {error}" for error in errors])
         raise ValueError(
@@ -91,19 +95,28 @@ def get_project_config(project_dir: Union[str, Path]) -> dict[str, Any]:
 
 
 def fuse_dicts(
-    main_dict: UserConfig,
-    override_dict: UserConfig,
-) -> UserConfig:
+    main_dict: T_dict,
+    override_dict: T_dict,
+    check_keys: bool = True,
+) -> T_dict:
     """Merge a config with the overrides.
 
-    Remove the nesting by adding the nested keys as prefixes separated by dots, and fuse
-    it with the override dict.
+    If `check_keys` is set to True, an error will be raised if the override
+    dictionary contains keys that are not present in the main dictionary.
+    Otherwise, only the keys present in the main dictionary will be updated.
     """
-    fused_dict = main_dict.copy()
+    if not isinstance(main_dict, dict) or not isinstance(override_dict, dict):
+        raise ValueError("Both dictionaries must be of type dict")
+
+    fused_dict = cast(T_dict, main_dict.copy())
 
     for key, value in override_dict.items():
         if key in main_dict:
+            if isinstance(value, dict):
+                fused_dict[key] = fuse_dicts(main_dict[key], value)
             fused_dict[key] = value
+        elif check_keys:
+            raise ValueError(f"Key '{key}' is not present in the main dictionary")
 
     return fused_dict
 
@@ -192,8 +205,8 @@ def unflatten_dict(flat_dict: dict[str, Any]) -> dict[str, Any]:
 
 
 def parse_config_args(
-    config: Optional[list[str]],
-) -> UserConfig:
+    config: Optional[list[str]], flatten: bool = True
+) -> dict[str, Any]:
     """Parse separator separated list of key-value pairs separated by '='."""
     overrides: UserConfig = {}
 
@@ -221,16 +234,16 @@ def parse_config_args(
             matches = pattern.findall(config_line)
             toml_str = "\n".join(f"{k} = {v}" for k, v in matches)
             overrides.update(tomli.loads(toml_str))
-            flat_overrides = flatten_dict(overrides)
+            flat_overrides = flatten_dict(overrides) if flatten else overrides
 
     return flat_overrides
 
 
 def get_metadata_from_config(config: dict[str, Any]) -> tuple[str, str]:
-    """Extract `fab_version` and `fab_id` from a project config."""
+    """Extract `fab_id` and `fab_version` from a project config."""
     return (
-        config["project"]["version"],
         f"{config['tool']['flwr']['app']['publisher']}/{config['project']['name']}",
+        config["project"]["version"],
     )
 
 
@@ -241,3 +254,127 @@ def user_config_to_configsrecord(config: UserConfig) -> ConfigsRecord:
         c_record[k] = v
 
     return c_record
+
+
+def get_fab_config(fab_file: Union[Path, bytes]) -> dict[str, Any]:
+    """Extract the config from a FAB file or path.
+
+    Parameters
+    ----------
+    fab_file : Union[Path, bytes]
+        The Flower App Bundle file to validate and extract the metadata from.
+        It can either be a path to the file or the file itself as bytes.
+
+    Returns
+    -------
+    Dict[str, Any]
+        The `config` of the given Flower App Bundle.
+    """
+    fab_file_archive: Union[Path, IO[bytes]]
+    if isinstance(fab_file, bytes):
+        fab_file_archive = BytesIO(fab_file)
+    elif isinstance(fab_file, Path):
+        fab_file_archive = fab_file
+    else:
+        raise ValueError("fab_file must be either a Path or bytes")
+
+    with zipfile.ZipFile(fab_file_archive, "r") as zipf:
+        with zipf.open("pyproject.toml") as file:
+            toml_content = file.read().decode("utf-8")
+        try:
+            conf = tomli.loads(toml_content)
+        except tomli.TOMLDecodeError:
+            raise ValueError("Invalid TOML content in pyproject.toml") from None
+
+        is_valid, errors, _ = validate_config(conf, check_module=False)
+        if not is_valid:
+            raise ValueError(errors)
+
+        return conf
+
+
+def _validate_run_config(config_dict: dict[str, Any], errors: list[str]) -> None:
+    for key, value in config_dict.items():
+        if isinstance(value, dict):
+            _validate_run_config(config_dict[key], errors)
+        elif not isinstance(value, get_args(UserConfigValue)):
+            raise ValueError(
+                f"The value for key {key} needs to be of type `int`, `float`, "
+                "`bool, `str`, or  a `dict` of those.",
+            )
+
+
+# pylint: disable=too-many-branches
+def validate_fields_in_config(
+    config: dict[str, Any]
+) -> tuple[bool, list[str], list[str]]:
+    """Validate pyproject.toml fields."""
+    errors = []
+    warnings = []
+
+    if "project" not in config:
+        errors.append("Missing [project] section")
+    else:
+        if "name" not in config["project"]:
+            errors.append('Property "name" missing in [project]')
+        if "version" not in config["project"]:
+            errors.append('Property "version" missing in [project]')
+        if "description" not in config["project"]:
+            warnings.append('Recommended property "description" missing in [project]')
+        if "license" not in config["project"]:
+            warnings.append('Recommended property "license" missing in [project]')
+        if "authors" not in config["project"]:
+            warnings.append('Recommended property "authors" missing in [project]')
+
+    if (
+        "tool" not in config
+        or "flwr" not in config["tool"]
+        or "app" not in config["tool"]["flwr"]
+    ):
+        errors.append("Missing [tool.flwr.app] section")
+    else:
+        if "publisher" not in config["tool"]["flwr"]["app"]:
+            errors.append('Property "publisher" missing in [tool.flwr.app]')
+        if "config" in config["tool"]["flwr"]["app"]:
+            _validate_run_config(config["tool"]["flwr"]["app"]["config"], errors)
+        if "components" not in config["tool"]["flwr"]["app"]:
+            errors.append("Missing [tool.flwr.app.components] section")
+        else:
+            if "serverapp" not in config["tool"]["flwr"]["app"]["components"]:
+                errors.append(
+                    'Property "serverapp" missing in [tool.flwr.app.components]'
+                )
+            if "clientapp" not in config["tool"]["flwr"]["app"]["components"]:
+                errors.append(
+                    'Property "clientapp" missing in [tool.flwr.app.components]'
+                )
+
+    return len(errors) == 0, errors, warnings
+
+
+def validate_config(
+    config: dict[str, Any],
+    check_module: bool = True,
+    project_dir: Optional[Union[str, Path]] = None,
+) -> tuple[bool, list[str], list[str]]:
+    """Validate pyproject.toml."""
+    is_valid, errors, warnings = validate_fields_in_config(config)
+
+    if not is_valid:
+        return False, errors, warnings
+
+    # Validate serverapp
+    serverapp_ref = config["tool"]["flwr"]["app"]["components"]["serverapp"]
+    is_valid, reason = object_ref.validate(serverapp_ref, check_module, project_dir)
+
+    if not is_valid and isinstance(reason, str):
+        return False, [reason], []
+
+    # Validate clientapp
+    clientapp_ref = config["tool"]["flwr"]["app"]["components"]["clientapp"]
+    is_valid, reason = object_ref.validate(clientapp_ref, check_module, project_dir)
+
+    if not is_valid and isinstance(reason, str):
+        return False, [reason], []
+
+    return True, [], []

flwr/common/constant.py

@@ -17,14 +17,6 @@
 
 from __future__ import annotations
 
-MISSING_EXTRA_REST = """
-Extra dependencies required for using the REST-based Fleet API are missing.
-
-To use the REST API, install `flwr` with the `rest` extra:
-
-    `pip install flwr[rest]`.
-"""
-
 TRANSPORT_TYPE_GRPC_BIDI = "grpc-bidi"
 TRANSPORT_TYPE_GRPC_RERE = "grpc-rere"
 TRANSPORT_TYPE_GRPC_ADAPTER = "grpc-adapter"
@@ -83,6 +75,9 @@ FAB_HASH_TRUNCATION = 8
 FLWR_DIR = ".flwr"  # The default Flower directory: ~/.flwr/
 FLWR_HOME = "FLWR_HOME"  # If set, override the default Flower directory
 
+# Constant for SuperLink
+SUPERLINK_NODE_ID = 1
+
 # Constants entries in Node config for Simulation
 PARTITION_ID_KEY = "partition-id"
 NUM_PARTITIONS_KEY = "num-partitions"
@@ -117,6 +112,12 @@ AUTH_TYPE = "auth_type"
 ACCESS_TOKEN_KEY = "access_token"
 REFRESH_TOKEN_KEY = "refresh_token"
 
+# Constants for node authentication
+PUBLIC_KEY_HEADER = "public-key-bin"  # Must end with "-bin" for binary data
+SIGNATURE_HEADER = "signature-bin"  # Must end with "-bin" for binary data
+TIMESTAMP_HEADER = "timestamp"
+TIMESTAMP_TOLERANCE = 10  # Tolerance for timestamp verification
+
 
 class MessageType:
     """Message type."""

flwr/common/exit/__init__.py

@@ -0,0 +1,24 @@
+# Copyright 2025 Flower Labs GmbH. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+"""Flower exit functionality."""
+
+
+from .exit import flwr_exit
+from .exit_code import ExitCode
+
+__all__ = [
+    "ExitCode",
+    "flwr_exit",
+]