insightfactory-cli 1.1.2.dev31__tar.gz → 1.2.0.dev34__tar.gz

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/CHANGELOG.md

@@ -11,6 +11,20 @@ that: every PR into `develop` must add an entry here, and a tag whose version ha
 section fails rather than releasing an empty page. The version only moves when the
 last one has been released, so a cycle's PRs share a section.
 
+## 1.2.0
+
+### Added
+
+- Factory requests carry an `X-IF-UA` header of RFC 9110 product tokens, so the
+  Interfaces API can attribute work to the client that made it. The value is
+  `if-cli/<version>`, with the contents of `INSIGHTFACTORY_UA` in front when that
+  variable holds valid product tokens, for example
+  `if-fde-harness/5.10.0 if-cli/1.2.0`. The CLI drops a value that fails the
+  grammar or exceeds 256 characters and sends its own token alone. `api`, OAuth
+  discovery and the `if-cli mcp` router's calls to each factory send the header.
+  Token requests to the identity provider do not, and a header the caller sets
+  itself replaces the built one.
+
 ## 1.1.2
 
 ### Added

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.1.2.dev31
+Version: 1.2.0.dev34
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -128,6 +128,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/README.md

@@ -104,6 +104,14 @@ accepted and completed the request after `if-cli` gave up, so re-issuing a
 timeout message tells you to confirm the current state before retrying rather
 than repeat the call.
 
+Every request to the factory carries an `X-IF-UA` header naming the client,
+`if-cli/<version>` by default. A tool that runs `if-cli` can name itself first
+by setting `INSIGHTFACTORY_UA` to one or more RFC 9110 product tokens, such as
+`if-fde-harness/5.10.0`, and the header becomes
+`if-fde-harness/5.10.0 if-cli/<version>`. The CLI ignores a value that is not
+valid product-token syntax or is longer than 256 characters. Token requests to
+the identity provider never carry the header.
+
 Override the config directory with `INSIGHTFACTORY_CONFIG_DIR`, which is useful
 in tests and CI. The default is `~/.insightfactory`.
 

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.1.2.dev31"
+version = "1.2.0.dev34"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

insightfactory_cli-1.2.0.dev34/src/if_cli/attribution.py

@@ -0,0 +1,51 @@
+"""The `X-IF-UA` client-attribution header.
+
+The Interfaces API attributes work to the client that made the request by reading
+`X-IF-UA`, a list of RFC 9110 product tokens. It takes the first token, splits it at
+`/` into client and version, and ignores the rest. So a tool that drives `if-cli`
+names itself first through `INSIGHTFACTORY_UA` and `if-cli` appends its own token:
+
+    X-IF-UA: if-cli/1.2.0                          # INSIGHTFACTORY_UA unset
+    X-IF-UA: if-fde-harness/5.10.0 if-cli/1.2.0    # INSIGHTFACTORY_UA=if-fde-harness/5.10.0
+
+The environment value is only ever sent after it matches the product-token grammar,
+so a stray newline or shell fragment in it cannot add a header or reach the factory.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from functools import cache
+from importlib.metadata import version
+
+from if_cli.constants import ENV_UA
+
+HEADER_NAME = "X-IF-UA"
+MAX_CALLER_PRODUCTS_LENGTH = 256
+
+# RFC 9110 section 5.6.2: token = 1*tchar. Section 10.1.5: product = token ["/" product-version].
+_TCHAR = r"[!#$%&'*+\-.^_`|~0-9A-Za-z]"
+_PRODUCT = rf"{_TCHAR}+(?:/{_TCHAR}+)?"
+_PRODUCTS = re.compile(rf"{_PRODUCT}(?: {_PRODUCT})*")
+
+
+@cache
+def _own_product() -> str:
+    return f"if-cli/{version('insightfactory-cli')}"
+
+
+def is_valid_products(value: str) -> bool:
+    """Whether `value` is one or more space-separated product tokens, within the length cap."""
+    return len(value) <= MAX_CALLER_PRODUCTS_LENGTH and _PRODUCTS.fullmatch(value) is not None
+
+
+def build_x_if_ua() -> str:
+    """The `X-IF-UA` value: the caller's products from `INSIGHTFACTORY_UA`, then `if-cli`'s own.
+
+    An unset, empty or invalid `INSIGHTFACTORY_UA` leaves `if-cli`'s token alone.
+    """
+    caller = os.environ.get(ENV_UA)
+    if caller and is_valid_products(caller):
+        return f"{caller} {_own_product()}"
+    return _own_product()

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/src/if_cli/constants.py

@@ -1,5 +1,6 @@
 ENV_PROFILE: str = "INSIGHTFACTORY_CONFIG_PROFILE"
 ENV_REQUEST_TIMEOUT: str = "INSIGHTFACTORY_REQUEST_TIMEOUT"
+ENV_UA: str = "INSIGHTFACTORY_UA"
 DEFAULT_SCOPE: str = "openid profile email offline_access"
 LOOPBACK_HOST: str = "127.0.0.1"
 DEFAULT_CALLBACK_PORT: int = 53682

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/src/if_cli/http.py

@@ -10,6 +10,7 @@ from email.message import Message
 from typing import NoReturn
 from urllib.parse import ParseResult, urljoin, urlparse
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.constants import ENV_REQUEST_TIMEOUT
 from if_cli.runtime import die
 
@@ -170,6 +171,7 @@ def fetch_with_timeout(
     body: str | bytes | None = None,
     timeout: float | None = None,
     warn_unsafe_retry: bool = False,
+    attribute: bool = True,
 ) -> HttpResponse:
     """Issue one request, dying on timeout.
 
@@ -177,7 +179,15 @@ def fetch_with_timeout(
     sense for a request the caller issued on the user's behalf against the factory.
     It is wrong advice for an OAuth round trip, where retrying is the correct response
     and there is no factory-side state to confirm.
+
+    `attribute` adds the `X-IF-UA` header (see `if_cli.attribution`) unless the
+    caller already set one. It is on for factory requests and off for the token
+    endpoint, which belongs to the identity provider: that is a third party, and the
+    header is for the factory's own client metrics.
     """
+    request_headers = dict(headers or {})
+    if attribute and not any(name.lower() == HEADER_NAME.lower() for name in request_headers):
+        request_headers[HEADER_NAME] = build_x_if_ua()
     data: bytes | None
     if body is None:
         data = None
@@ -185,7 +195,7 @@ def fetch_with_timeout(
         data = body
     else:
         data = body.encode("utf-8")
-    request = urllib.request.Request(url, data=data, headers=headers or {}, method=method)
+    request = urllib.request.Request(url, data=data, headers=request_headers, method=method)
     effective_timeout = resolve_request_timeout(timeout)
     try:
         # Callers pass endpoints validated by parse_http_url or derived from a

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/src/if_cli/oauth.py

@@ -128,6 +128,8 @@ def _token_request(token_endpoint: str, form: dict[str, str]) -> dict[str, objec
         headers={"Content-Type": "application/x-www-form-urlencoded"},
         body=urlencode(form),
         timeout=DEFAULT_REQUEST_TIMEOUT_S,
+        # The token endpoint is the identity provider's, not the factory's.
+        attribute=False,
     )
     if not response.ok:
         body = response.text()

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/src/if_cli/router/upstream.py

@@ -9,6 +9,7 @@ import mcp_types as types
 from mcp.client import Client
 from mcp.client.streamable_http import streamable_http_client
 
+from if_cli.attribution import HEADER_NAME, build_x_if_ua
 from if_cli.config import Profile
 from if_cli.http import parse_url, url_origin
 from if_cli.oauth import get_valid_token
@@ -200,7 +201,11 @@ class Upstream:
     async def _run(self, action, *, elicitation_callback=None):
         url = f"{self.profile['host']}/mcp"
         try:
-            async with httpx2.AsyncClient(auth=ProfileBearerAuth(self.profile), timeout=self.timeout) as http_client:
+            async with httpx2.AsyncClient(
+                auth=ProfileBearerAuth(self.profile),
+                timeout=self.timeout,
+                headers={HEADER_NAME: build_x_if_ua()},
+            ) as http_client:
                 async with Client(
                     streamable_http_client(url, http_client=http_client),
                     elicitation_callback=elicitation_callback,

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/tests/conftest.py

@@ -7,5 +7,7 @@ import pytest
 def isolate_insightfactory_home(tmp_path, monkeypatch):
     monkeypatch.setenv("INSIGHTFACTORY_CONFIG_DIR", str(tmp_path))
     monkeypatch.delenv("INSIGHTFACTORY_CONFIG_PROFILE", raising=False)
+    # The FDE harness sets this in the shells it runs, tests included.
+    monkeypatch.delenv("INSIGHTFACTORY_UA", raising=False)
     monkeypatch.setenv("NO_COLOR", "1")
     return tmp_path

insightfactory_cli-1.2.0.dev34/tests/test_attribution.py

@@ -0,0 +1,160 @@
+from __future__ import annotations
+
+from importlib.metadata import version
+
+import pytest
+
+from if_cli import oauth
+from if_cli.attribution import MAX_CALLER_PRODUCTS_LENGTH, build_x_if_ua
+from if_cli.cache import store_tokens
+from if_cli.config import Profile
+from if_cli.http import fetch_with_timeout
+from tests.servers import Request, Response, ThreadedServer
+
+OWN = f"if-cli/{version('insightfactory-cli')}"
+
+
+def _header(headers: dict[str, str], name: str = "X-IF-UA") -> str | None:
+    matches = [value for key, value in headers.items() if key.lower() == name.lower()]
+    assert len(matches) <= 1, f"{name} sent more than once: {matches}"
+    return matches[0] if matches else None
+
+
+def _recording_server(response: Response | None = None) -> tuple[ThreadedServer, list[dict[str, str]]]:
+    seen: list[dict[str, str]] = []
+
+    def handler(request: Request) -> Response:
+        seen.append(request.headers)
+        return response or Response(body={"ok": True})
+
+    return ThreadedServer(handler).start(), seen
+
+
+def _profile(host: str) -> Profile:
+    return {
+        "name": "a",
+        "host": host,
+        "audience": f"{host}/api",
+        "callback_port": 0,
+        "client_id": None,
+        "organization": None,
+    }
+
+
+def test_unset_sends_only_the_cli_token():
+    assert build_x_if_ua() == OWN
+
+
+@pytest.mark.parametrize(
+    "caller",
+    [
+        "if-fde-harness/5.10.0",
+        "if-fde-harness-mcp",
+        "if-fde-harness/5.10.0 other/1",
+        "a!#$%&'*+-.^_`|~z/9",
+    ],
+)
+def test_a_valid_value_goes_first(monkeypatch, caller: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == f"{caller} {OWN}"
+
+
+@pytest.mark.parametrize(
+    "caller",
+    [
+        "",
+        " ",
+        "\t",
+        "if-fde-harness/5.10.0\nX-Injected: 1",
+        "if-fde-harness/5.10.0\r\n",
+        "if-fde-harness/5.10.0\n",
+        "$(whoami)",
+        "if-fde-harness/$(whoami)",
+        " if-fde-harness/5.10.0",
+        "if-fde-harness/5.10.0 ",
+        "if-fde-harness/5.10.0  other/1",
+        "if-fde-harness/",
+        "/5.10.0",
+        "a/b/c",
+        "if-fde-harness/5.10.0 (comment)",
+        "harnessé/1",
+        "x" * (MAX_CALLER_PRODUCTS_LENGTH + 1),
+    ],
+)
+def test_an_invalid_value_is_dropped(monkeypatch, caller: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == OWN
+
+
+def test_a_value_at_the_cap_is_kept(monkeypatch):
+    caller = "x" * MAX_CALLER_PRODUCTS_LENGTH
+    monkeypatch.setenv("INSIGHTFACTORY_UA", caller)
+    assert build_x_if_ua() == f"{caller} {OWN}"
+
+
+def test_fetch_with_timeout_sends_the_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health")
+    finally:
+        server.close()
+    assert _header(seen[0]) == f"if-fde-harness/5.10.0 {OWN}"
+
+
+def test_fetch_with_timeout_never_puts_an_invalid_value_on_the_wire(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0\r\nX-Injected: 1")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health")
+    finally:
+        server.close()
+    assert _header(seen[0]) == OWN
+    assert _header(seen[0], "X-Injected") is None
+
+
+@pytest.mark.parametrize("name", ["X-IF-UA", "x-if-ua"])
+def test_a_caller_supplied_header_wins(monkeypatch, name: str):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server()
+    try:
+        fetch_with_timeout(f"{server.origin}/api/health", headers={name: "custom/1"})
+    finally:
+        server.close()
+    assert _header(seen[0]) == "custom/1"
+
+
+def test_oauth_discovery_on_the_factory_carries_the_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    server, seen = _recording_server(
+        Response(
+            body={
+                "authorization_endpoint": "https://factory.example/authorize",
+                "token_endpoint": "https://factory.example/oauth/token",
+            }
+        )
+    )
+    try:
+        oauth._discover(server.origin)
+    finally:
+        server.close()
+    assert _header(seen[0]) == f"if-fde-harness/5.10.0 {OWN}"
+
+
+def test_the_identity_provider_token_request_carries_no_header(monkeypatch):
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness/5.10.0")
+    idp, seen = _recording_server(Response(body={"access_token": "refreshed-token", "expires_in": 3600}))
+    try:
+        profile = _profile("https://factory.example")
+        store_tokens(
+            profile["host"],
+            {"access_token": "stale-token", "refresh_token": "refresh-tok", "expires_in": 0},
+            f"{idp.origin}/token",
+            "test-client",
+            replace=True,
+        )
+        assert oauth.get_valid_token(profile, force_refresh=True) == "refreshed-token"
+    finally:
+        idp.close()
+    assert len(seen) == 1
+    assert _header(seen[0]) is None

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/tests/test_router_upstream.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import inspect
 import re
+from importlib.metadata import version
 from typing import Any
 
 import pytest
@@ -15,7 +16,7 @@ import mcp_types as types  # noqa: E402
 from if_cli.cache import store_tokens  # noqa: E402
 from if_cli.config import Profile  # noqa: E402
 from if_cli.router.upstream import ConnectUrlRecorder, ProfileBearerAuth, Upstream  # noqa: E402
-from tests.servers import Response, ThreadedServer  # noqa: E402
+from tests.servers import Request, Response, ThreadedServer  # noqa: E402
 
 
 def _profile(host: str) -> Profile:
@@ -85,6 +86,30 @@ def test_auth_remints_the_token_once_on_a_401_and_retries():
         idp.close()
 
 
+def test_the_upstream_client_names_the_router_and_the_cli(monkeypatch):
+    """The router runs with its MCP registration env, so the harness token goes first."""
+    monkeypatch.setenv("INSIGHTFACTORY_UA", "if-fde-harness-mcp")
+    seen: list[dict[str, str]] = []
+
+    def handler(request: Request) -> Response:
+        seen.append(request.headers)
+        # Any error ends the session; only the first request's headers matter.
+        return Response(status=500, body="")
+
+    server = ThreadedServer(handler).start()
+    try:
+        profile = _profile(server.origin)
+        store_tokens(profile["host"], {"access_token": "test-token", "expires_in": 3600}, "", "c", replace=True)
+        with pytest.raises(Exception):
+            anyio.run(Upstream("prd", profile, timeout=5).list_tools)
+    finally:
+        server.close()
+    assert seen, "the router never reached the factory"
+    headers = {name.lower(): value for name, value in seen[0].items()}
+    assert headers["x-if-ua"] == f"if-fde-harness-mcp if-cli/{version('insightfactory-cli')}"
+    assert headers["authorization"] == "Bearer test-token"
+
+
 def _url_request(url: str, message: str = "Connect your Databricks account.") -> types.ElicitRequest:
     return types.ElicitRequest(params=types.ElicitRequestURLParams(message=message, url=url))
 

{insightfactory_cli-1.1.2.dev31 → insightfactory_cli-1.2.0.dev34}/uv.lock

@@ -305,7 +305,7 @@ wheels = [
 
 [[package]]
 name = "insightfactory-cli"
-version = "1.1.2"
+version = "1.2.0"
 source = { editable = "." }
 
 [package.optional-dependencies]