insightfactory-cli 1.1.2.dev31__py3-none-any.whl → 1.2.0.dev34__py3-none-any.whl

if_cli/attribution.py

@@ -0,0 +1,51 @@
+"""The `X-IF-UA` client-attribution header.
+
+The Interfaces API attributes work to the client that made the request by reading
+`X-IF-UA`, a list of RFC 9110 product tokens. It takes the first token, splits it at
+`/` into client and version, and ignores the rest. So a tool that drives `if-cli`
+names itself first through `INSIGHTFACTORY_UA` and `if-cli` appends its own token:
+
+    X-IF-UA: if-cli/1.2.0                          # INSIGHTFACTORY_UA unset
+    X-IF-UA: if-fde-harness/5.10.0 if-cli/1.2.0    # INSIGHTFACTORY_UA=if-fde-harness/5.10.0
+
+The environment value is only ever sent after it matches the product-token grammar,
+so a stray newline or shell fragment in it cannot add a header or reach the factory.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from functools import cache
+from importlib.metadata import version
+
+from if_cli.constants import ENV_UA
+
+HEADER_NAME = "X-IF-UA"
+MAX_CALLER_PRODUCTS_LENGTH = 256
+
+# RFC 9110 section 5.6.2: token = 1*tchar. Section 10.1.5: product = token ["/" product-version].
+_TCHAR = r"[!#$%&'*+\-.^_`|~0-9A-Za-z]"
+_PRODUCT = rf"{_TCHAR}+(?:/{_TCHAR}+)?"
+_PRODUCTS = re.compile(rf"{_PRODUCT}(?: {_PRODUCT})*")
+
+
+@cache
+def _own_product() -> str:
+    return f"if-cli/{version('insightfactory-cli')}"
+
+
+def is_valid_products(value: str) -> bool:
+    """Whether `value` is one or more space-separated product tokens, within the length cap."""
+    return len(value) <= MAX_CALLER_PRODUCTS_LENGTH and _PRODUCTS.fullmatch(value) is not None
+
+
+def build_x_if_ua() -> str:
+    """The `X-IF-UA` value: the caller's products from `INSIGHTFACTORY_UA`, then `if-cli`'s own.
+
+    An unset, empty or invalid `INSIGHTFACTORY_UA` leaves `if-cli`'s token alone.
+    """
+    caller = os.environ.get(ENV_UA)
+    if caller and is_valid_products(caller):
+        return f"{caller} {_own_product()}"
+    return _own_product()

if_cli/constants.py

@@ -1,5 +1,6 @@
 ENV_PROFILE: str = "INSIGHTFACTORY_CONFIG_PROFILE"
 ENV_REQUEST_TIMEOUT: str = "INSIGHTFACTORY_REQUEST_TIMEOUT"
+ENV_UA: str = "INSIGHTFACTORY_UA"
 DEFAULT_SCOPE: str = "openid profile email offline_access"
 LOOPBACK_HOST: str = "127.0.0.1"
 DEFAULT_CALLBACK_PORT: int = 53682

if_cli/http.py

@@ -10,6 +10,7 @@ from email.message import Message
 from typing import NoReturn
 from urllib.parse import ParseResult, urljoin, urlparse
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.constants import ENV_REQUEST_TIMEOUT
 from if_cli.runtime import die
 
@@ -170,6 +171,7 @@ def fetch_with_timeout(
     body: str | bytes | None = None,
     timeout: float | None = None,
     warn_unsafe_retry: bool = False,
+    attribute: bool = True,
 ) -> HttpResponse:
     """Issue one request, dying on timeout.
 
@@ -177,7 +179,15 @@ def fetch_with_timeout(
     sense for a request the caller issued on the user's behalf against the factory.
     It is wrong advice for an OAuth round trip, where retrying is the correct response
     and there is no factory-side state to confirm.
+
+    `attribute` adds the `X-IF-UA` header (see `if_cli.attribution`) unless the
+    caller already set one. It is on for factory requests and off for the token
+    endpoint, which belongs to the identity provider: that is a third party, and the
+    header is for the factory's own client metrics.
     """
+    request_headers = dict(headers or {})
+    if attribute and not any(name.lower() == HEADER_NAME.lower() for name in request_headers):
+        request_headers[HEADER_NAME] = build_x_if_ua()
     data: bytes | None
     if body is None:
         data = None
@@ -185,7 +195,7 @@ def fetch_with_timeout(
         data = body
     else:
         data = body.encode("utf-8")
-    request = urllib.request.Request(url, data=data, headers=headers or {}, method=method)
+    request = urllib.request.Request(url, data=data, headers=request_headers, method=method)
     effective_timeout = resolve_request_timeout(timeout)
     try:
         # Callers pass endpoints validated by parse_http_url or derived from a

if_cli/oauth.py

@@ -128,6 +128,8 @@ def _token_request(token_endpoint: str, form: dict[str, str]) -> dict[str, objec
         headers={"Content-Type": "application/x-www-form-urlencoded"},
         body=urlencode(form),
         timeout=DEFAULT_REQUEST_TIMEOUT_S,
+        # The token endpoint is the identity provider's, not the factory's.
+        attribute=False,
     )
     if not response.ok:
         body = response.text()

if_cli/router/upstream.py

@@ -9,6 +9,7 @@ import mcp_types as types
 from mcp.client import Client
 from mcp.client.streamable_http import streamable_http_client
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.config import Profile
 from if_cli.http import parse_url, url_origin
 from if_cli.oauth import get_valid_token
@@ -200,7 +201,11 @@ class Upstream:
     async def _run(self, action, *, elicitation_callback=None):
         url = f"{self.profile['host']}/mcp"
         try:
-            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
+            async with httpx2.AsyncClient(
+                auth=ProfileBearerAuth(self.profile),
+                timeout=self.timeout,
+                headers={HEADER_NAME: build_x_if_ua()},
+            ) as http_client:
                 async with Client(
                     streamable_http_client(url, http_client=http_client),
                     elicitation_callback=elicitation_callback,

{insightfactory_cli-1.1.2.dev31.dist-info → insightfactory_cli-1.2.0.dev34.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.1.2.dev31
+Version: 1.2.0.dev34
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -128,6 +128,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 

{insightfactory_cli-1.1.2.dev31.dist-info → insightfactory_cli-1.2.0.dev34.dist-info}/RECORD

@@ -1,14 +1,15 @@
 if_cli/__init__.py,sha256=YYcz-hEiXXUjdBFGipOrVHynsyH4ZLqQOCDobvCAu8Y,26
 if_cli/__main__.py,sha256=2hLFIiT-gocMb0VJVzVYtGVIoHrxyMChucRgexbXLSQ,68
+if_cli/attribution.py,sha256=hNp1hBueRUh1EKYs61AZF76voehw70F7gZKiI5zOMCw,1869
 if_cli/cache.py,sha256=UfvHs3GQIVg0sVfKYWw4UGlq8d-8BEXuZIDfC1hwwjA,6587
 if_cli/callback_page.py,sha256=lTHd3-vzlT9ndAL7XYonBfy97lBW7apRw3V7SmhNObo,5907
 if_cli/cli.py,sha256=fF7HvsUgpKhkLFdXLMJ1JXHGjp3RwJt2YmPSEW0d8gY,6270
 if_cli/colour.py,sha256=2hbaM4ubTHGja6YZRD886eqnB7T2IaZyW5rvfOjxe4M,682
 if_cli/config.py,sha256=QiphIhVLDN3sp39xMWKwXEyJWxx4IhXT28oEtmPc0ew,10601
-if_cli/constants.py,sha256=RW43KupAdhXfBsX6MxzZdJ-R57brX0q0TgIq8xXgvPs,269
-if_cli/http.py,sha256=W8HL3uZLeOu5MgmsOavM1Y6x4AcrInIQsAr5hx-j8AE,7671
+if_cli/constants.py,sha256=WxZozWfhMCFWU_Wupa__CaJI9UgqJ28W8cchGtp6p4Q,303
+if_cli/http.py,sha256=LNkQtyUR1DAgLcR2CrNzTMHFQO_j_vfHuOBagmQEYNk,8249
 if_cli/main.py,sha256=pn-X2wrHNplc8ceT5_nEv5XlrTN3KgpK8UU4gAmBiWY,3212
-if_cli/oauth.py,sha256=8QZy4A7NqnWSnTULQct-Tj6RT906RstBJOloSTzgflU,16462
+if_cli/oauth.py,sha256=lSJXzOsOzHlkZX56JWoh9G6-sD9MOGgmwpI18tdhA6c,16563
 if_cli/runtime.py,sha256=Pz2iVclqy-uu1UMQWK2P_Hx7O4zAF30UpSFqQvGN0NY,2663
 if_cli/assets/__init__.py,sha256=2vBBor8lUEQofiC6EvS5BvF_ANhfK8bfR9S0OXI8j3g,41
 if_cli/assets/insightfactoryai-logo.svg,sha256=yFxHkoHl6VNm8ppCInTZCVN_bdOog9h-NV8R4Gw1Qew,8192
@@ -27,9 +28,9 @@ if_cli/router/content.py,sha256=POL2n5NIY8yenQHJe8pUbTuTNpPSUSm0Y6Txbvehzhs,1448
 if_cli/router/log.py,sha256=wtaqsFcD3hPJRu4jCJaDMSedj-43Y07ym62YgrOm1yM,740
 if_cli/router/policy.py,sha256=CclbjuOA5mwwoQiNDa17iQeN9eXRbfy11bS9JFd8gL4,2840
 if_cli/router/server.py,sha256=yCjGAm-tnZBOTg5AfvojnLcKcZLEbQQeT9iqqX8XV5A,27397
-if_cli/router/upstream.py,sha256=Ga0OM918Y1CFyQFGs2wO0ocyjcMe1Wk0LvffOZOaE34,18559
-insightfactory_cli-1.1.2.dev31.dist-info/METADATA,sha256=LkShsicB2QHUEjaS9FmsW9T2dPlGIl92Ew-OMsSCg28,24331
-insightfactory_cli-1.1.2.dev31.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-insightfactory_cli-1.1.2.dev31.dist-info/entry_points.txt,sha256=UlX854D7f-7dBj5F0wGdakVy6vopvP9hA1BN-gv739w,44
-insightfactory_cli-1.1.2.dev31.dist-info/licenses/LICENSE,sha256=8eZ1YAABL398qESVJc_FlK1voYQ0GAh-R_rNBQK6QH8,234
-insightfactory_cli-1.1.2.dev31.dist-info/RECORD,,
+if_cli/router/upstream.py,sha256=Ly4fcuQRywS6db2oDYoe8F4c9hryN75FdBqSWzA09g4,18720
+insightfactory_cli-1.2.0.dev34.dist-info/METADATA,sha256=xbyLKunNzQ2g7wv-86s5ruh_-rnUyetLKVWwYINNBp8,24817
+insightfactory_cli-1.2.0.dev34.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+insightfactory_cli-1.2.0.dev34.dist-info/entry_points.txt,sha256=UlX854D7f-7dBj5F0wGdakVy6vopvP9hA1BN-gv739w,44
+insightfactory_cli-1.2.0.dev34.dist-info/licenses/LICENSE,sha256=8eZ1YAABL398qESVJc_FlK1voYQ0GAh-R_rNBQK6QH8,234
+insightfactory_cli-1.2.0.dev34.dist-info/RECORD,,