flwr-nightly 1.15.0.dev20250125__tar.gz → 1.15.0.dev20250128__tar.gz

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flwr-nightly
-Version: 1.15.0.dev20250125
+Version: 1.15.0.dev20250128
 Summary: Flower: A Friendly Federated AI Framework
 Home-page: https://flower.ai
 License: Apache-2.0

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "flwr-nightly"
-version = "1.15.0.dev20250125"
+version = "1.15.0.dev20250128"
 description = "Flower: A Friendly Federated AI Framework"
 license = "Apache-2.0"
 authors = ["The Flower Authors <hello@flower.ai>"]

flwr_nightly-1.15.0.dev20250128/src/py/flwr/cli/auth_plugin/__init__.py

@@ -0,0 +1,31 @@
+# Copyright 2025 Flower Labs GmbH. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+"""Flower user auth plugins."""
+
+
+from flwr.common.auth_plugin import CliAuthPlugin
+from flwr.common.constant import AuthType
+
+from .oidc_cli_plugin import OidcCliPlugin
+
+
+def get_cli_auth_plugins() -> dict[str, type[CliAuthPlugin]]:
+    """Return all CLI authentication plugins."""
+    return {AuthType.OIDC: OidcCliPlugin}
+
+
+__all__ = [
+    "get_cli_auth_plugins",
+]

flwr_nightly-1.15.0.dev20250128/src/py/flwr/cli/auth_plugin/oidc_cli_plugin.py

@@ -0,0 +1,150 @@
+# Copyright 2025 Flower Labs GmbH. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ==============================================================================
+"""Flower CLI user auth plugin for OIDC."""
+
+
+import json
+import time
+from collections.abc import Sequence
+from pathlib import Path
+from typing import Any, Optional, Union
+
+import typer
+
+from flwr.common.auth_plugin import CliAuthPlugin
+from flwr.common.constant import (
+    ACCESS_TOKEN_KEY,
+    AUTH_TYPE_KEY,
+    REFRESH_TOKEN_KEY,
+    AuthType,
+)
+from flwr.common.typing import UserAuthCredentials, UserAuthLoginDetails
+from flwr.proto.exec_pb2 import (  # pylint: disable=E0611
+    GetAuthTokensRequest,
+    GetAuthTokensResponse,
+)
+from flwr.proto.exec_pb2_grpc import ExecStub
+
+
+class OidcCliPlugin(CliAuthPlugin):
+    """Flower OIDC auth plugin for CLI."""
+
+    def __init__(self, credentials_path: Path):
+        self.access_token: Optional[str] = None
+        self.refresh_token: Optional[str] = None
+        self.credentials_path = credentials_path
+
+    @staticmethod
+    def login(
+        login_details: UserAuthLoginDetails,
+        exec_stub: ExecStub,
+    ) -> UserAuthCredentials:
+        """Authenticate the user and retrieve authentication credentials."""
+        typer.secho(
+            "Please login with your user credentials here: "
+            f"{login_details.verification_uri_complete}",
+            fg=typer.colors.BLUE,
+        )
+        start_time = time.time()
+        time.sleep(login_details.interval)
+
+        while (time.time() - start_time) < login_details.expires_in:
+            res: GetAuthTokensResponse = exec_stub.GetAuthTokens(
+                GetAuthTokensRequest(device_code=login_details.device_code)
+            )
+
+            access_token = res.access_token
+            refresh_token = res.refresh_token
+
+            if access_token and refresh_token:
+                typer.secho(
+                    "✅ Login successful.",
+                    fg=typer.colors.GREEN,
+                    bold=False,
+                )
+                return UserAuthCredentials(
+                    access_token=access_token,
+                    refresh_token=refresh_token,
+                )
+
+            time.sleep(login_details.interval)
+
+        typer.secho(
+            "❌ Timeout, failed to sign in.",
+            fg=typer.colors.RED,
+            bold=True,
+        )
+        raise typer.Exit(code=1)
+
+    def store_tokens(self, credentials: UserAuthCredentials) -> None:
+        """Store authentication tokens to the `credentials_path`.
+
+        The credentials, including tokens, will be saved as a JSON file
+        at `credentials_path`.
+        """
+        self.access_token = credentials.access_token
+        self.refresh_token = credentials.refresh_token
+        json_dict = {
+            AUTH_TYPE_KEY: AuthType.OIDC,
+            ACCESS_TOKEN_KEY: credentials.access_token,
+            REFRESH_TOKEN_KEY: credentials.refresh_token,
+        }
+
+        with open(self.credentials_path, "w", encoding="utf-8") as file:
+            json.dump(json_dict, file, indent=4)
+
+    def load_tokens(self) -> None:
+        """Load authentication tokens from the `credentials_path`."""
+        with open(self.credentials_path, encoding="utf-8") as file:
+            json_dict: dict[str, Any] = json.load(file)
+            access_token = json_dict.get(ACCESS_TOKEN_KEY)
+            refresh_token = json_dict.get(REFRESH_TOKEN_KEY)
+
+        if isinstance(access_token, str) and isinstance(refresh_token, str):
+            self.access_token = access_token
+            self.refresh_token = refresh_token
+
+    def write_tokens_to_metadata(
+        self, metadata: Sequence[tuple[str, Union[str, bytes]]]
+    ) -> Sequence[tuple[str, Union[str, bytes]]]:
+        """Write authentication tokens to the provided metadata."""
+        if self.access_token is None or self.refresh_token is None:
+            typer.secho(
+                "❌ Missing authentication tokens. Please login first.",
+                fg=typer.colors.RED,
+                bold=True,
+            )
+            raise typer.Exit(code=1)
+
+        return list(metadata) + [
+            (ACCESS_TOKEN_KEY, self.access_token),
+            (REFRESH_TOKEN_KEY, self.refresh_token),
+        ]
+
+    def read_tokens_from_metadata(
+        self, metadata: Sequence[tuple[str, Union[str, bytes]]]
+    ) -> Optional[UserAuthCredentials]:
+        """Read authentication tokens from the provided metadata."""
+        metadata_dict = dict(metadata)
+        access_token = metadata_dict.get(ACCESS_TOKEN_KEY)
+        refresh_token = metadata_dict.get(REFRESH_TOKEN_KEY)
+
+        if isinstance(access_token, str) and isinstance(refresh_token, str):
+            return UserAuthCredentials(
+                access_token=access_token,
+                refresh_token=refresh_token,
+            )
+
+        return None

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/cli/login/login.py

@@ -34,7 +34,11 @@ from flwr.proto.exec_pb2 import (  # pylint: disable=E0611
 )
 from flwr.proto.exec_pb2_grpc import ExecStub
 
-from ..utils import init_channel, try_obtain_cli_auth_plugin
+from ..utils import (
+    init_channel,
+    try_obtain_cli_auth_plugin,
+    unauthenticated_exc_handler,
+)
 
 
 def login(  # pylint: disable=R0914
@@ -81,7 +85,8 @@ def login(  # pylint: disable=R0914
     stub = ExecStub(channel)
 
     login_request = GetLoginDetailsRequest()
-    login_response: GetLoginDetailsResponse = stub.GetLoginDetails(login_request)
+    with unauthenticated_exc_handler():
+        login_response: GetLoginDetailsResponse = stub.GetLoginDetails(login_request)
 
     # Get the auth plugin
     auth_type = login_response.auth_type
@@ -104,7 +109,8 @@ def login(  # pylint: disable=R0914
         expires_in=login_response.expires_in,
         interval=login_response.interval,
     )
-    credentials = auth_plugin.login(details, stub)
+    with unauthenticated_exc_handler():
+        credentials = auth_plugin.login(details, stub)
 
     # Store the tokens
     auth_plugin.store_tokens(credentials)

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/cli/utils.py

@@ -29,20 +29,13 @@ import typer
 
 from flwr.cli.cli_user_auth_interceptor import CliUserAuthInterceptor
 from flwr.common.auth_plugin import CliAuthPlugin
-from flwr.common.constant import AUTH_TYPE, CREDENTIALS_DIR, FLWR_DIR
+from flwr.common.constant import AUTH_TYPE_KEY, CREDENTIALS_DIR, FLWR_DIR
 from flwr.common.grpc import GRPC_MAX_MESSAGE_LENGTH, create_channel
 from flwr.common.logger import log
 
+from .auth_plugin import get_cli_auth_plugins
 from .config_utils import validate_certificate_in_federation_config
 
-try:
-    from flwr.ee import get_cli_auth_plugins
-except ImportError:
-
-    def get_cli_auth_plugins() -> dict[str, type[CliAuthPlugin]]:
-        """Return all CLI authentication plugins."""
-        raise NotImplementedError("No authentication plugins are currently supported.")
-
 
 def prompt_text(
     text: str,
@@ -244,7 +237,7 @@ def try_obtain_cli_auth_plugin(
         try:
             with config_path.open("r", encoding="utf-8") as file:
                 json_file = json.load(file)
-            auth_type = json_file[AUTH_TYPE]
+            auth_type = json_file[AUTH_TYPE_KEY]
         except (FileNotFoundError, KeyError):
             typer.secho(
                 "❌ Missing or invalid credentials for user authentication. "
@@ -308,12 +301,19 @@ def unauthenticated_exc_handler() -> Iterator[None]:
     try:
         yield
     except grpc.RpcError as e:
-        if e.code() != grpc.StatusCode.UNAUTHENTICATED:
-            raise
-        typer.secho(
-            "❌ Authentication failed. Please run `flwr login`"
-            " to authenticate and try again.",
-            fg=typer.colors.RED,
-            bold=True,
-        )
-        raise typer.Exit(code=1) from None
+        if e.code() == grpc.StatusCode.UNAUTHENTICATED:
+            typer.secho(
+                "❌ Authentication failed. Please run `flwr login`"
+                " to authenticate and try again.",
+                fg=typer.colors.RED,
+                bold=True,
+            )
+            raise typer.Exit(code=1) from None
+        if e.code() == grpc.StatusCode.UNIMPLEMENTED:
+            typer.secho(
+                "❌ User authentication is not enabled on this SuperLink.",
+                fg=typer.colors.RED,
+                bold=True,
+            )
+            raise typer.Exit(code=1) from None
+        raise

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/client/supernode/app.py

@@ -16,7 +16,6 @@
 
 
 import argparse
-import sys
 from logging import DEBUG, ERROR, INFO, WARN
 from pathlib import Path
 from typing import Optional
@@ -65,17 +64,6 @@ def run_supernode() -> None:
             "Ignoring `--flwr-dir`.",
         )
 
-    # Exit if unsupported argument is passed by the user
-    if args.app is not None:
-        log(
-            ERROR,
-            "The `app` argument is deprecated. The SuperNode now automatically "
-            "uses the ClientApp delivered from the SuperLink. Providing the app "
-            "directory manually is no longer supported. Please remove the `app` "
-            "argument from your command.",
-        )
-        sys.exit(1)
-
     root_certificates = try_obtain_root_certificates(args, args.superlink)
     load_fn = get_load_client_app_fn(
         default_app_ref="",
@@ -146,18 +134,6 @@ def _parse_args_run_supernode() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         description="Start a Flower SuperNode",
     )
-
-    parser.add_argument(
-        "app",
-        nargs="?",
-        default=None,
-        help=(
-            "(REMOVED) This argument is removed. The SuperNode now automatically "
-            "uses the ClientApp delivered from the SuperLink, so there is no need to "
-            "provide the app directory manually. This argument will be removed in a "
-            "future version."
-        ),
-    )
     _parse_args_common(parser)
     parser.add_argument(
         "--flwr-dir",

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/common/constant.py

@@ -108,7 +108,7 @@ MAX_RETRY_DELAY = 20  # Maximum delay duration between two consecutive retries.
 
 # Constants for user authentication
 CREDENTIALS_DIR = ".credentials"
-AUTH_TYPE = "auth_type"
+AUTH_TYPE_KEY = "auth_type"
 ACCESS_TOKEN_KEY = "access_token"
 REFRESH_TOKEN_KEY = "refresh_token"
 
@@ -200,3 +200,13 @@ class CliOutputFormat:
     def __new__(cls) -> CliOutputFormat:
         """Prevent instantiation."""
         raise TypeError(f"{cls.__name__} cannot be instantiated.")
+
+
+class AuthType:
+    """User authentication types."""
+
+    OIDC = "oidc"
+
+    def __new__(cls) -> AuthType:
+        """Prevent instantiation."""
+        raise TypeError(f"{cls.__name__} cannot be instantiated.")

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/common/logger.py

@@ -17,12 +17,13 @@
 
 import json as _json
 import logging
+import os
 import re
 import sys
 import threading
 import time
 from io import StringIO
-from logging import WARN, LogRecord
+from logging import ERROR, WARN, LogRecord
 from logging.handlers import HTTPHandler
 from queue import Empty, Queue
 from typing import TYPE_CHECKING, Any, Optional, TextIO, Union
@@ -42,6 +43,7 @@ from .constant import LOG_UPLOAD_INTERVAL
 LOGGER_NAME = "flwr"
 FLOWER_LOGGER = logging.getLogger(LOGGER_NAME)
 FLOWER_LOGGER.setLevel(logging.DEBUG)
+log = FLOWER_LOGGER.log  # pylint: disable=invalid-name
 
 LOG_COLORS = {
     "DEBUG": "\033[94m",  # Blue
@@ -101,7 +103,7 @@ class ConsoleHandler(StreamHandler):
 
 
 def update_console_handler(
-    level: Optional[int] = None,
+    level: Optional[Union[int, str]] = None,
     timestamps: Optional[bool] = None,
     colored: Optional[bool] = None,
 ) -> None:
@@ -125,6 +127,22 @@ console_handler = ConsoleHandler(
 console_handler.setLevel(logging.INFO)
 FLOWER_LOGGER.addHandler(console_handler)
 
+# Set log level via env var (show timestamps for `DEBUG`)
+if log_level := os.getenv("PYTHONLOGLEVEL"):
+    try:
+        use_time_stamps = log_level.upper() == "DEBUG"
+        update_console_handler(
+            level=log_level, timestamps=use_time_stamps, colored=True
+        )
+    except Exception:  # pylint: disable=broad-exception-caught
+        # Alert user but don't raise exception
+        log(
+            ERROR,
+            "Failed to set logging level %s. Using default level: %s",
+            log_level,
+            logging.getLevelName(console_handler.level),
+        )
+
 
 class CustomHTTPHandler(HTTPHandler):
     """Custom HTTPHandler which overrides the mapLogRecords method."""
@@ -185,10 +203,6 @@ def configure(
         FLOWER_LOGGER.addHandler(http_handler)
 
 
-logger = logging.getLogger(LOGGER_NAME)  # pylint: disable=invalid-name
-log = logger.log  # pylint: disable=invalid-name
-
-
 def warn_preview_feature(name: str) -> None:
     """Warn the user when they use a preview feature."""
     log(

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/server/app.py

@@ -40,7 +40,7 @@ from flwr.common.args import try_obtain_server_certificates
 from flwr.common.auth_plugin import ExecAuthPlugin
 from flwr.common.config import get_flwr_dir, parse_config_args
 from flwr.common.constant import (
-    AUTH_TYPE,
+    AUTH_TYPE_KEY,
     CLIENT_OCTET,
     EXEC_API_DEFAULT_SERVER_ADDRESS,
     FLEET_API_GRPC_BIDI_DEFAULT_ADDRESS,
@@ -578,7 +578,7 @@ def _try_obtain_exec_auth_plugin(
 
     # Load authentication configuration
     auth_config: dict[str, Any] = config.get("authentication", {})
-    auth_type: str = auth_config.get(AUTH_TYPE, "")
+    auth_type: str = auth_config.get(AUTH_TYPE_KEY, "")
 
     # Load authentication plugin
     try:

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/server/driver/grpc_driver.py

@@ -49,7 +49,7 @@ from flwr.proto.serverappio_pb2_grpc import ServerAppIoStub  # pylint: disable=E
 from .driver import Driver
 
 ERROR_MESSAGE_DRIVER_NOT_CONNECTED = """
-[Driver] Error: Not connected.
+[flwr-serverapp] Error: Not connected.
 
 Call `connect()` on the `GrpcDriverStub` instance before calling any of the other
 `GrpcDriverStub` methods.
@@ -102,7 +102,7 @@ class GrpcDriver(Driver):
         )
         self._grpc_stub = ServerAppIoStub(self._channel)
         _wrap_stub(self._grpc_stub, self._retry_invoker)
-        log(DEBUG, "[Driver] Connected to %s", self._addr)
+        log(DEBUG, "[flwr-serverapp] Connected to %s", self._addr)
 
     def _disconnect(self) -> None:
         """Disconnect from the ServerAppIo API."""
@@ -113,7 +113,7 @@ class GrpcDriver(Driver):
         self._channel = None
         self._grpc_stub = None
         channel.close()
-        log(DEBUG, "[Driver] Disconnected")
+        log(DEBUG, "[flwr-serverapp] Disconnected")
 
     def set_run(self, run_id: int) -> None:
         """Set the run."""

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/server/serverapp/app.py

@@ -122,6 +122,7 @@ def run_serverapp(  # pylint: disable=R0914, disable=W0212, disable=R0915
             # Pull ServerAppInputs from LinkState
             req = PullServerAppInputsRequest()
             res: PullServerAppInputsResponse = driver._stub.PullServerAppInputs(req)
+            log(DEBUG, "flwr-serverapp: PullServerAppInputs")
             if not res.HasField("run"):
                 sleep(3)
                 run_status = None

{flwr_nightly-1.15.0.dev20250125 → flwr_nightly-1.15.0.dev20250128}/src/py/flwr/server/superlink/driver/serverappio_servicer.py

@@ -362,9 +362,8 @@ class ServerAppIoServicer(serverappio_pb2_grpc.ServerAppIoServicer):
     ) -> PullServerAppInputsResponse:
         """Pull ServerApp process inputs."""
         log(DEBUG, "ServerAppIoServicer.PullServerAppInputs")
-        # Init access to LinkState and Ffs
+        # Init access to LinkState
         state = self.state_factory.state()
-        ffs = self.ffs_factory.ffs()
 
         # Lock access to LinkState, preventing obtaining the same pending run_id
         with self.lock:
@@ -374,6 +373,9 @@ class ServerAppIoServicer(serverappio_pb2_grpc.ServerAppIoServicer):
             if run_id is None:
                 return PullServerAppInputsResponse()
 
+            # Init access to Ffs
+            ffs = self.ffs_factory.ffs()
+
             # Retrieve Context, Run and Fab for the run_id
             serverapp_ctxt = state.get_serverapp_context(run_id)
             run = state.get_run(run_id)