gaard-api 0.2.2__tar.gz → 0.2.3__tar.gz

{gaard_api-0.2.2/src/gaard_api.egg-info → gaard_api-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gaard-api
-Version: 0.2.2
+Version: 0.2.3
 Summary: GAARD backend web services providing admin interface
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -13,6 +13,7 @@ Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: pydantic>=2.7.0
 Requires-Dist: sqlalchemy>=2.0.0
 Requires-Dist: httpx2>=2.5.0
+Requires-Dist: certifi>=2024.8.30
 Provides-Extra: oracle
 Requires-Dist: oracledb>=2.0.0; extra == "oracle"
 Provides-Extra: mssql

{gaard_api-0.2.2 → gaard_api-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gaard-api"
-version = "0.2.2"
+version = "0.2.3"
 description = "GAARD backend web services providing admin interface"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -18,7 +18,8 @@ dependencies = [
     "uvicorn[standard]>=0.30.0",
     "pydantic>=2.7.0",
     "sqlalchemy>=2.0.0",
-    "httpx2>=2.5.0"
+    "httpx2>=2.5.0",
+    "certifi>=2024.8.30"
 ]
 
 [project.optional-dependencies]

{gaard_api-0.2.2 → gaard_api-0.2.3}/src/gaard_api/core/settings.py

@@ -126,7 +126,7 @@ class Settings:
         )
     )
     gaard_package_directory: str = field(
-        default_factory=lambda: env_value("GAARD_PACKAGE_DIRECTORY", "packages")
+        default_factory=lambda: env_value("GAARD_PACKAGE_DIRECTORY", "extensions")
     )
     gaard_package_install_timeout_seconds: int = field(
         default_factory=lambda: env_int_value(

{gaard_api-0.2.2 → gaard_api-0.2.3}/src/gaard_api/license.py

@@ -16,6 +16,7 @@ from gaard_core.errors import GaardError
 
 from gaard_api.admin.models import AdminSetting, DatasourceConnector
 from gaard_api.core.settings import settings
+from gaard_api.tls_http import http_error_summary, post as tls_post
 
 
 logger = logging.getLogger(__name__)
@@ -266,7 +267,7 @@ class LicenseService:
         self._stop_event = threading.Event()
         self._thread: threading.Thread | None = None
         self._consecutive_transient_failures = 0
-        self._http_post = httpx.post
+        self._http_post = tls_post
 
     @property
     def state(self) -> LicenseState:
@@ -281,7 +282,7 @@ class LicenseService:
         with self._state_lock:
             self._state = community_state()
             self._consecutive_transient_failures = 0
-        self._http_post = httpx.post
+        self._http_post = tls_post
 
     def start(self) -> None:
         self.refresh(force=True)
@@ -595,7 +596,7 @@ class LicenseService:
         except httpx.HTTPError as exc:
             return LicenseValidationResult(
                 kind="transient",
-                message=f"Online license validation failed: {exc.__class__.__name__}.",
+                message=f"Online license validation failed: {http_error_summary(exc)}.",
             )
 
         status_code = int(response.status_code)

{gaard_api-0.2.2 → gaard_api-0.2.3}/src/gaard_api/package_updates.py

@@ -28,6 +28,8 @@ from packaging.version import InvalidVersion, Version
 
 from gaard_api.core.settings import settings
 from gaard_api.license import LicensePlan, LicenseState, gaard_api_version
+from gaard_api.tls_http import get as tls_get
+from gaard_api.tls_http import http_error_summary, post as tls_post
 
 
 logger = logging.getLogger(__name__)
@@ -190,15 +192,15 @@ def default_pip_runner(
 
 class PackageUpdateService:
     def __init__(self) -> None:
-        self._http_post: HttpRequest = httpx.post
-        self._http_get: HttpRequest = httpx.get
+        self._http_post: HttpRequest = tls_post
+        self._http_get: HttpRequest = tls_get
         self._package_version: PackageVersionResolver = version
         self._pip_runner: PipRunner = default_pip_runner
         self._lock = threading.Lock()
 
     def reset_for_tests(self) -> None:
-        self._http_post = httpx.post
-        self._http_get = httpx.get
+        self._http_post = tls_post
+        self._http_get = tls_get
         self._package_version = version
         self._pip_runner = default_pip_runner
 
@@ -442,7 +444,8 @@ class PackageUpdateService:
             )
         except httpx.HTTPError as exc:
             raise PackageUpdateError(
-                f"Package download failed before receiving a response: {exc.__class__.__name__}."
+                "Package download failed before receiving a response: "
+                f"{http_error_summary(exc)}."
             ) from exc
 
         status_code = int(response.status_code)
@@ -575,7 +578,8 @@ class PackageUpdateService:
             )
         except httpx.HTTPError as exc:
             raise PackageUpdateError(
-                f"Package file download failed before receiving a response: {exc.__class__.__name__}."
+                "Package file download failed before receiving a response: "
+                f"{http_error_summary(exc)}."
             ) from exc
 
         status_code = int(response.status_code)
@@ -894,7 +898,7 @@ class PackageUpdateService:
         }
 
     def _package_root(self) -> Path:
-        configured = str(settings.gaard_package_directory or "packages").strip() or "packages"
+        configured = str(settings.gaard_package_directory or "extensions").strip() or "extensions"
         path = Path(configured)
         if not path.is_absolute():
             path = Path.cwd() / path

gaard_api-0.2.3/src/gaard_api/tls_http.py

@@ -0,0 +1,50 @@
+from __future__ import annotations
+
+from functools import lru_cache
+import os
+import ssl
+from typing import Any
+from urllib.parse import urlparse
+
+import certifi
+import httpx2 as httpx
+
+
+def post(url: str, **kwargs: Any) -> httpx.Response:
+    return request_with_certifi_fallback(httpx.post, url, **kwargs)
+
+
+def get(url: str, **kwargs: Any) -> httpx.Response:
+    return request_with_certifi_fallback(httpx.get, url, **kwargs)
+
+
+def request_with_certifi_fallback(request: Any, url: str, **kwargs: Any) -> httpx.Response:
+    try:
+        return request(url, **kwargs)
+    except httpx.ConnectError as exc:
+        if not should_retry_with_certifi(url, kwargs):
+            raise
+        try:
+            return request(url, **{**kwargs, "verify": certifi_ssl_context()})
+        except httpx.HTTPError as fallback_exc:
+            raise fallback_exc from exc
+
+
+def should_retry_with_certifi(url: str, kwargs: dict[str, Any]) -> bool:
+    if kwargs.get("verify") is not None:
+        return False
+    if os.environ.get("SSL_CERT_FILE") or os.environ.get("SSL_CERT_DIR"):
+        return False
+    return urlparse(url).scheme == "https"
+
+
+@lru_cache(maxsize=1)
+def certifi_ssl_context() -> ssl.SSLContext:
+    return ssl.create_default_context(cafile=certifi.where())
+
+
+def http_error_summary(exc: httpx.HTTPError) -> str:
+    detail = str(exc).strip()
+    if detail:
+        return f"{exc.__class__.__name__}: {detail}"
+    return exc.__class__.__name__

{gaard_api-0.2.2 → gaard_api-0.2.3/src/gaard_api.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gaard-api
-Version: 0.2.2
+Version: 0.2.3
 Summary: GAARD backend web services providing admin interface
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -13,6 +13,7 @@ Requires-Dist: uvicorn[standard]>=0.30.0
 Requires-Dist: pydantic>=2.7.0
 Requires-Dist: sqlalchemy>=2.0.0
 Requires-Dist: httpx2>=2.5.0
+Requires-Dist: certifi>=2024.8.30
 Provides-Extra: oracle
 Requires-Dist: oracledb>=2.0.0; extra == "oracle"
 Provides-Extra: mssql

{gaard_api-0.2.2 → gaard_api-0.2.3}/src/gaard_api.egg-info/SOURCES.txt

@@ -11,8 +11,10 @@ src/gaard_api/extensions.py
 src/gaard_api/license.py
 src/gaard_api/main.py
 src/gaard_api/package_updates.py
+src/gaard_api/py.typed
 src/gaard_api/query_hooks.py
 src/gaard_api/server_cli.py
+src/gaard_api/tls_http.py
 src/gaard_api.egg-info/PKG-INFO
 src/gaard_api.egg-info/SOURCES.txt
 src/gaard_api.egg-info/dependency_links.txt
@@ -55,4 +57,5 @@ tests/test_license_service.py
 tests/test_prompt_runtime.py
 tests/test_query_error_messages.py
 tests/test_server_cli.py
-tests/test_settings.py
+tests/test_settings.py
+tests/test_tls_http.py

{gaard_api-0.2.2 → gaard_api-0.2.3}/src/gaard_api.egg-info/requires.txt

@@ -7,6 +7,7 @@ uvicorn[standard]>=0.30.0
 pydantic>=2.7.0
 sqlalchemy>=2.0.0
 httpx2>=2.5.0
+certifi>=2024.8.30
 
 [all-datasources]
 oracledb>=2.0.0

{gaard_api-0.2.2 → gaard_api-0.2.3}/tests/test_license_api.py

@@ -287,6 +287,19 @@ def test_package_update_requires_paid_license(license_client: TestClient) -> Non
     assert response.json()["error"]["code"] == "LICENSE_ENTITLEMENT_REQUIRED"
 
 
+def test_package_updates_default_to_extensions_directory(
+    tmp_path: Path,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(settings, "gaard_package_directory", "")
+
+    package_root = package_update_service._package_root()
+
+    assert package_root == tmp_path / "extensions"
+    assert package_root.is_dir()
+
+
 def test_paid_license_can_download_extract_and_install_package_updates(
     license_client: TestClient,
     tmp_path: Path,

{gaard_api-0.2.2 → gaard_api-0.2.3}/tests/test_settings.py

@@ -13,6 +13,7 @@ def test_settings_use_llm_defaults_and_ignore_metadata_env(monkeypatch) -> None:
     assert settings.gaard_sql_generation_mode == "llm"
     assert settings.gaard_result_interpretation_mode == "llm"
     assert settings.gaard_intent_classification_mode == "auto"
+    assert settings.gaard_package_directory == "extensions"
 
 
 def test_settings_can_seed_runtime_defaults_from_process_env(monkeypatch) -> None:

gaard_api-0.2.3/tests/test_tls_http.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+import ssl
+
+import httpx2 as httpx
+import pytest
+
+from gaard_api.tls_http import request_with_certifi_fallback
+
+
+def test_https_connect_error_retries_with_certifi_context() -> None:
+    calls: list[dict] = []
+
+    def fake_request(url: str, **kwargs):
+        calls.append(kwargs)
+        if len(calls) == 1:
+            raise httpx.ConnectError(("certificate is not trusted",))
+        return httpx.Response(200, json={"ok": True})
+
+    response = request_with_certifi_fallback(
+        fake_request,
+        "https://getgaard.com/api/license/validate",
+        json={"product": "gaard"},
+        timeout=10.0,
+    )
+
+    assert response.status_code == 200
+    assert "verify" not in calls[0]
+    assert isinstance(calls[1]["verify"], ssl.SSLContext)
+
+
+def test_connect_error_does_not_retry_when_verify_is_explicit() -> None:
+    calls = 0
+
+    def fake_request(url: str, **kwargs):
+        nonlocal calls
+        calls += 1
+        raise httpx.ConnectError(("certificate is not trusted",))
+
+    context = ssl.create_default_context()
+    with pytest.raises(httpx.ConnectError):
+        request_with_certifi_fallback(
+            fake_request,
+            "https://getgaard.com/api/license/validate",
+            verify=context,
+            timeout=10.0,
+        )
+
+    assert calls == 1
+
+
+def test_connect_error_does_not_retry_when_ssl_cert_file_is_configured(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    calls = 0
+
+    def fake_request(url: str, **kwargs):
+        nonlocal calls
+        calls += 1
+        raise httpx.ConnectError(("certificate is not trusted",))
+
+    monkeypatch.setenv("SSL_CERT_FILE", "/custom/ca.pem")
+    with pytest.raises(httpx.ConnectError):
+        request_with_certifi_fallback(
+            fake_request,
+            "https://getgaard.com/api/license/validate",
+            timeout=10.0,
+        )
+
+    assert calls == 1