gumloop 0.3.4__tar.gz → 0.3.5__tar.gz

{gumloop-0.3.4 → gumloop-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gumloop
-Version: 0.3.4
+Version: 0.3.5
 Summary: Python client for the Gumloop API
 Project-URL: Homepage, https://github.com/gumloop/gumloop-py
 Project-URL: Bug Tracker, https://github.com/gumloop/gumloop-py/issues

{gumloop-0.3.4 → gumloop-0.3.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "gumloop"
-version = "0.3.4"
+version = "0.3.5"
 description = "Python client for the Gumloop API"
 readme = "README.md"
 requires-python = ">=3.10"

{gumloop-0.3.4 → gumloop-0.3.5}/src/gumloop/__init__.py

@@ -6,7 +6,7 @@ from gumloop.errors import AuthenticationError
 from gumloop.errors import GumloopError
 from gumloop.oauth import OAuth
 
-__version__ = "0.3.3"
+__version__ = "0.3.5"
 __all__ = [
     "APIStatusError",
     "AsyncGumloop",

gumloop-0.3.5/src/gumloop/_auth.py

@@ -0,0 +1,35 @@
+"""Credential resolution shared by the sync and async transports."""
+
+from __future__ import annotations
+
+import os
+
+from gumloop.errors import AuthenticationError
+
+
+class EnvToken(str):
+    """Access token sourced from ``GUMLOOP_ACCESS_TOKEN``.
+
+    Stays live: ``current()`` returns the env var's present value, so
+    platform-rotated tokens (e.g. per-call sandbox credentials) are picked up
+    on every request. Explicit tokens are plain strings and never change.
+    """
+
+    @classmethod
+    def from_env(cls) -> EnvToken | None:
+        token = os.environ.get("GUMLOOP_ACCESS_TOKEN")
+        return cls(token) if token else None
+
+    def current(self) -> str:
+        return os.environ.get("GUMLOOP_ACCESS_TOKEN") or str(self)
+
+
+def auth_headers(access_token: str | None, user_id: str | None) -> dict[str, str]:
+    if isinstance(access_token, EnvToken):
+        access_token = access_token.current()
+    if not access_token:
+        raise AuthenticationError("access_token, api_key, or GUMLOOP_ACCESS_TOKEN is required")
+    headers = {"Authorization": f"Bearer {access_token}"}
+    if user_id:
+        headers["x-auth-key"] = user_id
+    return headers

{gumloop-0.3.4 → gumloop-0.3.5}/src/gumloop/_client.py

@@ -7,6 +7,7 @@ from typing import Any
 
 import httpx
 
+from gumloop._auth import EnvToken
 from gumloop._http import AsyncHttpClient
 from gumloop._http import HttpClient
 from gumloop.oauth import OAuth
@@ -59,7 +60,7 @@ class Gumloop:
         stream_timeout: float | None = DEFAULT_STREAM_TIMEOUT,
     ) -> None:
         self.api_key = api_key
-        self.access_token = access_token or api_key or os.environ.get("GUMLOOP_ACCESS_TOKEN")
+        self.access_token = access_token or api_key or EnvToken.from_env()
         # Personal Gumloop API keys are user-scoped; the backend uses the
         # x-auth-key header to look up the owner's stored secret. OAuth
         # callers omit it because the bearer token already identifies them.
@@ -115,7 +116,7 @@ class AsyncGumloop:
         stream_timeout: float | None = DEFAULT_STREAM_TIMEOUT,
     ) -> None:
         self.api_key = api_key
-        self.access_token = access_token or api_key or os.environ.get("GUMLOOP_ACCESS_TOKEN")
+        self.access_token = access_token or api_key or EnvToken.from_env()
         self.user_id = user_id or os.environ.get("GUMLOOP_USER_ID")
         # Defaults to production; GUMLOOP_BASE_URL is an optional override.
         self.base_url = (base_url or os.environ.get("GUMLOOP_BASE_URL") or DEFAULT_BASE_URL).rstrip("/")

{gumloop-0.3.4 → gumloop-0.3.5}/src/gumloop/_http.py

@@ -13,7 +13,7 @@ from httpx_sse import ServerSentEvent
 from pydantic import BaseModel
 from pydantic import ValidationError
 
-from gumloop.errors import AuthenticationError
+from gumloop._auth import auth_headers
 from gumloop.errors import to_api_error
 from gumloop.types import StreamEvent
 
@@ -23,15 +23,6 @@ _DONE_SENTINEL = "[DONE]"
 _T = TypeVar("_T", bound=BaseModel)
 
 
-def _auth_headers(access_token: str | None, user_id: str | None) -> dict[str, str]:
-    if not access_token:
-        raise AuthenticationError("access_token, api_key, or GUMLOOP_ACCESS_TOKEN is required")
-    headers = {"Authorization": f"Bearer {access_token}"}
-    if user_id:
-        headers["x-auth-key"] = user_id
-    return headers
-
-
 def _omit_none_params(params: Mapping[str, Any] | None) -> dict[str, Any] | None:
     # Backend treats absent ``?foo`` and ``?foo=`` as different signals
     # ("not provided" vs "empty string"); drop None values so the wire URL
@@ -120,7 +111,7 @@ class HttpClient:
         # Endpoints whose streaming variant lives on the stream host (e.g. chat
         # completions) must accept their unary counterparts at the same host —
         # the api host has no handler for them.
-        headers = _auth_headers(self.access_token, self.user_id)
+        headers = auth_headers(self.access_token, self.user_id)
         headers["Content-Type"] = "application/json"
         response = self._client.post(
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -140,7 +131,7 @@ class HttpClient:
         json: Any = None,
         params: Mapping[str, Any] | None = None,
     ) -> Iterator[StreamEvent]:
-        headers = {**_auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
+        headers = {**auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
         with self._client.stream(
             method,
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -166,7 +157,7 @@ class HttpClient:
     ) -> Iterator[_T]:
         # Skips the StreamEvent envelope and honors OpenRouter's `data: [DONE]`
         # terminator. Unparseable events (keep-alives, comments) are skipped.
-        headers = {**_auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
+        headers = {**auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
         with self._client.stream(
             method,
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -194,7 +185,7 @@ class HttpClient:
     def _request(self, method: str, path: str, **kwargs: Any) -> Any:
         # Headers are rebuilt per request so ``access_token`` / ``user_id``
         # can be rotated on a live client without reconstructing it.
-        headers = _auth_headers(self.access_token, self.user_id)
+        headers = auth_headers(self.access_token, self.user_id)
         if not kwargs.get("files"):
             headers["Content-Type"] = "application/json"
         response = self._client.request(method, path, headers=headers, **kwargs)
@@ -261,7 +252,7 @@ class AsyncHttpClient:
         return await self._request("DELETE", path)
 
     async def post_to_stream_host(self, path: str, *, json: Any = None) -> Any:
-        headers = _auth_headers(self.access_token, self.user_id)
+        headers = auth_headers(self.access_token, self.user_id)
         headers["Content-Type"] = "application/json"
         response = await self._client.post(
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -281,7 +272,7 @@ class AsyncHttpClient:
         json: Any = None,
         params: Mapping[str, Any] | None = None,
     ) -> AsyncIterator[StreamEvent]:
-        headers = {**_auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
+        headers = {**auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
         async with self._client.stream(
             method,
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -305,7 +296,7 @@ class AsyncHttpClient:
         json: Any = None,
         params: Mapping[str, Any] | None = None,
     ) -> AsyncIterator[_T]:
-        headers = {**_auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
+        headers = {**auth_headers(self.access_token, self.user_id), "Accept": "text/event-stream"}
         async with self._client.stream(
             method,
             f"{self._stream_base_url}/{path.lstrip('/')}",
@@ -331,7 +322,7 @@ class AsyncHttpClient:
                     continue
 
     async def _request(self, method: str, path: str, **kwargs: Any) -> Any:
-        headers = _auth_headers(self.access_token, self.user_id)
+        headers = auth_headers(self.access_token, self.user_id)
         if not kwargs.get("files"):
             headers["Content-Type"] = "application/json"
         response = await self._client.request(method, path, headers=headers, **kwargs)

{gumloop-0.3.4 → gumloop-0.3.5}/tests/sdk/test_client.py

@@ -60,6 +60,75 @@ def test_missing_credential_raises_clear_auth_error(monkeypatch: pytest.MonkeyPa
         Gumloop().models.list()
 
 
+@respx.mock
+def test_env_sourced_token_follows_env_rotation(monkeypatch: pytest.MonkeyPatch) -> None:
+    """A client built from GUMLOOP_ACCESS_TOKEN must send the CURRENT env
+    value per request: platforms (e.g. the agent sandbox) rotate the token
+    between requests on a live client."""
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "tok-1")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+    client = Gumloop()
+
+    client.models.list()
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "tok-2")
+    client.models.list()
+
+    assert auth_header(route.calls[0].request) == "Bearer tok-1"
+    assert auth_header(route.calls[1].request) == "Bearer tok-2"
+
+
+@respx.mock
+def test_env_sourced_token_falls_back_to_snapshot_when_env_cleared(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "tok-1")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+    client = Gumloop()
+
+    monkeypatch.delenv("GUMLOOP_ACCESS_TOKEN")
+    client.models.list()
+
+    assert auth_header(route.calls[0].request) == "Bearer tok-1"
+
+
+@pytest.mark.parametrize(
+    "kwargs, expected_header",
+    [
+        ({"access_token": "explicit-tok"}, "Bearer explicit-tok"),
+        ({"api_key": "gum_xxx"}, "Bearer gum_xxx"),
+    ],
+)
+@respx.mock
+def test_explicit_credential_ignores_env_rotation(
+    monkeypatch: pytest.MonkeyPatch, kwargs: dict[str, str], expected_header: str
+) -> None:
+    """Explicitly passed credentials are immutable — a env var appearing or
+    rotating later must never hijack the client's identity."""
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "env-tok")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+    client = Gumloop(**kwargs)
+
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "env-tok-2")
+    client.models.list()
+
+    assert auth_header(route.calls[0].request) == expected_header
+
+
+@respx.mock
+def test_async_env_sourced_token_follows_env_rotation(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "tok-1")
+    route = respx.get(f"{API_BASE}/models").mock(return_value=httpx.Response(200, json={"model_groups": []}))
+
+    async def run() -> None:
+        async with AsyncGumloop() as client:
+            await client.models.list()
+            monkeypatch.setenv("GUMLOOP_ACCESS_TOKEN", "tok-2")
+            await client.models.list()
+
+    asyncio.run(run())
+
+    assert auth_header(route.calls[0].request) == "Bearer tok-1"
+    assert auth_header(route.calls[1].request) == "Bearer tok-2"
+
+
 @respx.mock
 def test_non_success_response_raises_gumloop_status_error(client: Gumloop) -> None:
     error = {

{gumloop-0.3.4 → gumloop-0.3.5}/uv.lock

@@ -355,7 +355,7 @@ wheels = [
 
 [[package]]
 name = "gumloop"
-version = "0.3.4"
+version = "0.3.5"
 source = { editable = "." }
 dependencies = [
     { name = "click" },