licos-dev-sdk 0.5.0__tar.gz → 0.6.0__tar.gz

licos_dev_sdk-0.6.0/PKG-INFO

@@ -0,0 +1,42 @@
+Metadata-Version: 2.4
+Name: licos-dev-sdk
+Version: 0.6.0
+Summary: LICOS Dev SDK - file generation and model capability clients
+Requires-Python: >=3.10
+Requires-Dist: beautifulsoup4>=4.12
+Requires-Dist: docxtpl>=0.16
+Requires-Dist: graphviz>=0.20
+Requires-Dist: jinja2>=3.1
+Requires-Dist: licos-platform-sdk>=0.7.0
+Requires-Dist: matplotlib>=3.9
+Requires-Dist: mistune>=3.0
+Requires-Dist: openpyxl>=3.1
+Requires-Dist: pillow>=10.0
+Requires-Dist: pypdf>=5.0
+Requires-Dist: python-barcode>=0.15
+Requires-Dist: python-docx>=1.1
+Requires-Dist: python-pptx>=1.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: qrcode[pil]>=8.0
+Requires-Dist: skia-pathops>=0.9.2
+Requires-Dist: uharfbuzz>=0.50.0
+Requires-Dist: weasyprint>=62.0
+Requires-Dist: xlsxwriter>=3.2
+Provides-Extra: ppt-master
+Requires-Dist: licos-ppt-master-assets==0.0.1; extra == 'ppt-master'
+Description-Content-Type: text/markdown
+
+# licos-dev-sdk
+
+服务端模型和文件工具 SDK。模型目录、模型调用及积分检查默认使用项目所有者身份。需要以网页登录用户执行时，在本次请求创建客户端并显式传 `user_token`：
+
+```python
+from licos_dev_sdk import LLMClient, check_credit_availability
+
+availability = check_credit_availability(user_token=token, resource_code='LLM_INVOKE')
+result = LLMClient(user_token=token).invoke('你好')
+```
+
+Token 不含 `Bearer ` 前缀。用户信息来自平台认证结果；不从 `LICOS_CURRENT_USER_ID` 或 `LICOS_USER_TOKEN` 推断网页登录身份。Token 失效直接报错，由调用方更新会话。项目资源归属和平台签发的计费上下文保持独立。
+
+可观测性继续使用项目身份；文件生成无需用户 Token。完整约定见仓库的 `tools/IDENTITY.md`。

licos_dev_sdk-0.6.0/README.md

@@ -0,0 +1,14 @@
+# licos-dev-sdk
+
+服务端模型和文件工具 SDK。模型目录、模型调用及积分检查默认使用项目所有者身份。需要以网页登录用户执行时，在本次请求创建客户端并显式传 `user_token`：
+
+```python
+from licos_dev_sdk import LLMClient, check_credit_availability
+
+availability = check_credit_availability(user_token=token, resource_code='LLM_INVOKE')
+result = LLMClient(user_token=token).invoke('你好')
+```
+
+Token 不含 `Bearer ` 前缀。用户信息来自平台认证结果；不从 `LICOS_CURRENT_USER_ID` 或 `LICOS_USER_TOKEN` 推断网页登录身份。Token 失效直接报错，由调用方更新会话。项目资源归属和平台签发的计费上下文保持独立。
+
+可观测性继续使用项目身份；文件生成无需用户 Token。完整约定见仓库的 `tools/IDENTITY.md`。

{licos_dev_sdk-0.5.0 → licos_dev_sdk-0.6.0}/pyproject.toml

@@ -4,11 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "licos-dev-sdk"
-version = "0.5.0"
+version = "0.6.0"
 description = "LICOS Dev SDK - file generation and model capability clients"
+readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "licos-platform-sdk>=0.6.1",
+    "licos-platform-sdk>=0.7.0",
     "weasyprint>=62.0",
     "python-docx>=1.1",
     "docxtpl>=0.16",

{licos_dev_sdk-0.5.0 → licos_dev_sdk-0.6.0}/src/licos_dev_sdk/model.py

@@ -27,6 +27,7 @@ from licos_platform_sdk._runtime import (
     platform_base_url,
     resolve_user_token,
     should_refresh_user_token,
+    require_user_token,
 )
 from ._usage_identity import UsageIdentityLease, has_signature
 
@@ -1222,13 +1223,12 @@ def _model_runtime(
 ) -> ModelRuntime:
     resolved_base_url = normalize_base_url(base_url) if base_url else platform_base_url()
     owner_user_id = user_id or env("LICOS_USER_ID") or env("AGENT_USER_ID")
-    current_user_id = env("LICOS_CURRENT_USER_ID") or env("AGENT_CURRENT_USER_ID")
     resolved_workspace_id = _workspace_id(workspace_id)
-    runtime_user_token = (user_token or env("LICOS_USER_TOKEN") or "").strip()
-    explicit_user_token = bool(runtime_user_token)
+    runtime_user_token = require_user_token(user_token) if user_token is not None else None
+    explicit_user_token = user_token is not None
     token = runtime_user_token or resolve_user_token(
         resolved_base_url,
-        current_user_id or owner_user_id,
+        owner_user_id,
     )
     owner_project_id = env("LICOS_PROJECT_ID") or env("AGENT_PROJECT_ID")
     owner_project_name = env("LICOS_OWNER_PROJECT_NAME") or env("AGENT_OWNER_PROJECT_NAME")
@@ -1267,29 +1267,17 @@ def _model_runtime(
         or env("AGENT_USAGE_SCENE")
         or ("plugin" if owner_plugin_id else "ai_coding" if owner_project_id else "sdk")
     )
-    current_user_name = env("LICOS_CURRENT_USER_NAME") or env("AGENT_CURRENT_USER_NAME")
-    current_org_id = (
-        env("LICOS_CURRENT_ORG_ID")
-        or env("LICOS_CURRENT_USER_ORG_ID")
-        or env("AGENT_CURRENT_ORG_ID")
-        or env("LICOS_CURRENT_TENANT_ID")
-        or env("AGENT_CURRENT_TENANT_ID")
-    )
-    current_org_name = env("LICOS_CURRENT_ORG_NAME") or env("AGENT_CURRENT_ORG_NAME")
-    if not current_user_id or not current_user_name:
-        (
-            fetched_current_user_id,
-            fetched_current_user_name,
-            fetched_current_org_id,
-            fetched_current_org_name,
-        ) = _fetch_current_user_context(
-            resolved_base_url,
-            token,
+    try:
+        current_user_id, current_user_name, current_org_id, current_org_name = _fetch_current_user_context(
+            resolved_base_url, token,
+        )
+    except ApiError as error:
+        if explicit_user_token or not should_refresh_user_token(error):
+            raise
+        token = resolve_user_token(resolved_base_url, owner_user_id, force_refresh=True)
+        current_user_id, current_user_name, current_org_id, current_org_name = _fetch_current_user_context(
+            resolved_base_url, token,
         )
-        current_user_id = current_user_id or fetched_current_user_id
-        current_user_name = current_user_name or fetched_current_user_name
-        current_org_id = current_org_id or fetched_current_org_id
-        current_org_name = current_org_name or fetched_current_org_name
     if owner_project_id:
         if not resolved_workspace_id:
             raise ConfigurationError("project owner workspace ID is not configured")
@@ -1342,27 +1330,13 @@ def _refresh_model_runtime(runtime: ModelRuntime) -> ModelRuntime:
         return runtime
     token = resolve_user_token(
         runtime.base_url,
-        runtime.current_user_id or runtime.user_id,
+        runtime.user_id,
         force_refresh=True,
     )
-    current_user_id = runtime.current_user_id
-    current_user_name = runtime.current_user_name
-    current_org_id = runtime.current_org_id
-    current_org_name = runtime.current_org_name
-    if not current_user_id or not current_user_name:
-        (
-            fetched_current_user_id,
-            fetched_current_user_name,
-            fetched_current_org_id,
-            fetched_current_org_name,
-        ) = _fetch_current_user_context(
-            runtime.base_url,
-            token,
-        )
-        current_user_id = current_user_id or fetched_current_user_id
-        current_user_name = current_user_name or fetched_current_user_name
-        current_org_id = current_org_id or fetched_current_org_id
-        current_org_name = current_org_name or fetched_current_org_name
+    current_user_id, current_user_name, current_org_id, current_org_name = _fetch_current_user_context(
+        runtime.base_url,
+        token,
+    )
     return replace(
         runtime,
         token=token,
@@ -1404,10 +1378,7 @@ def _check_credit_availability(
             )
             break
         except ApiError as exc:
-            if (
-                attempt == 0
-                and should_refresh_user_token(exc)
-            ):
+            if attempt == 0 and not runtime.explicit_user_token and should_refresh_user_token(exc):
                 _, _, subject_token = _credit_subject(runtime, force_refresh=True)
                 continue
             raise
@@ -1444,12 +1415,12 @@ def _credit_subject(
         if current_user_id
         else (runtime.owner_org_id or "").strip() or None
     )
-    if subject_user_id == owner_user_id and not force_refresh:
+    if runtime.explicit_user_token or not force_refresh:
         token = runtime.token
     else:
         token = resolve_user_token(
             runtime.base_url,
-            subject_user_id,
+            owner_user_id,
             force_refresh=force_refresh,
         )
     return subject_user_id, subject_org_id, token
@@ -1496,19 +1467,24 @@ def _fetch_current_user_context(
     base_url: str,
     token: str,
 ) -> tuple[str | None, str | None, str | None, str | None]:
-    try:
-        payload = _request_json(
-            "GET",
-            f"{base_url}/api/v1/admin/auth/me",
-            token=token,
-            timeout=30,
+    payload = _request_json(
+        "GET",
+        f"{base_url}/api/v1/admin/auth/me",
+        token=token,
+        timeout=30,
+    )
+    if payload.get("code") not in (None, 0) or payload.get("success") is False:
+        raise ApiError(
+            str(payload.get("message") or "User authentication failed"),
+            code=payload.get("code"),
+            details=payload,
         )
-    except ApiError:
-        return None, None, None, None
     data = payload.get("data") if isinstance(payload, dict) else None
     if not isinstance(data, dict):
         data = payload if isinstance(payload, dict) else {}
     user_id = _first_non_empty_field(data, ["id", "userId", "user_id", "sub"])
+    if not user_id:
+        raise ApiError("Authenticated user response missing id")
     user_name = _first_non_empty_field(data, ["username", "userName", "name", "displayName"])
     org_id = _first_non_empty_field(data, ["tenantId", "tenant_id"])
     org_name = _first_non_empty_field(data, ["tenantName", "tenant_name", "orgName", "org_name"])
@@ -1580,7 +1556,7 @@ def _fetch_model_catalogs(
             timeout=30,
         )
     except ApiError as exc:
-        if not refresh and should_refresh_user_token(exc):
+        if not refresh and not runtime.explicit_user_token and should_refresh_user_token(exc):
             return _fetch_model_catalogs(
                 _refresh_model_runtime(runtime),
                 refresh=True,
@@ -2115,7 +2091,7 @@ def _fetch_model_detail(
             timeout=30,
         )
     except ApiError as exc:
-        if not refresh and should_refresh_user_token(exc):
+        if not refresh and not runtime.explicit_user_token and should_refresh_user_token(exc):
             return _fetch_model_detail(
                 _refresh_model_runtime(runtime),
                 model_code,
@@ -2563,7 +2539,7 @@ def _post_model_json(
                 timeout=request_timeout,
             )
         except ApiError as exc:
-            if attempt == 0 and should_refresh_user_token(exc):
+            if attempt == 0 and not active_runtime.explicit_user_token and should_refresh_user_token(exc):
                 active_runtime = _refresh_model_runtime(active_runtime)
                 continue
             raise
@@ -2680,7 +2656,7 @@ def _stream_model_json(
                 return
         except urlerror.HTTPError as exc:
             error = _api_error_from_http(exc)
-            if attempt == 0 and should_refresh_user_token(error):
+            if attempt == 0 and not active_runtime.explicit_user_token and should_refresh_user_token(error):
                 active_runtime = _refresh_model_runtime(active_runtime)
                 continue
             raise error from exc
@@ -2775,7 +2751,7 @@ def _await_async_model_result(
                 timeout=timeout or _request_timeout(),
             )
         except ApiError as exc:
-            if should_refresh_user_token(exc):
+            if not active_runtime.explicit_user_token and should_refresh_user_token(exc):
                 active_runtime = _refresh_model_runtime(active_runtime)
                 request_headers = {
                     **_request_headers(endpoint, active_runtime),

{licos_dev_sdk-0.5.0 → licos_dev_sdk-0.6.0}/tests/test_model.py

@@ -354,10 +354,22 @@ class ModelSdkTests(unittest.TestCase):
         self.assertEqual(len(sent), 1)
         self.assertEqual(sent[0]["requestId"], "request-flush")
 
-    def test_credit_availability_uses_current_user_token_and_workspace(self) -> None:
+    def test_credit_availability_defaults_to_project_identity(self) -> None:
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 exchange_body = json.loads(req.data.decode("utf-8"))
                 token = (
@@ -386,9 +398,9 @@ class ModelSdkTests(unittest.TestCase):
             )
 
         self.assertTrue(result["allowed"])
-        self.assertEqual(captured["headers"]["Authorization"], "Bearer current-user-token")
-        self.assertEqual(captured["headers"]["X-user-id"], "current-user-1")
-        self.assertEqual(captured["headers"]["X-tenant-id"], "current-org-1")
+        self.assertEqual(captured["headers"]["Authorization"], "Bearer owner-user-token")
+        self.assertEqual(captured["headers"]["X-user-id"], "user-1")
+        self.assertEqual(captured["headers"]["X-tenant-id"], "owner-org-1")
         self.assertEqual(captured["headers"]["X-workspace-id"], "workspace-1")
         self.assertEqual(
             captured["body"],
@@ -427,10 +439,22 @@ class ModelSdkTests(unittest.TestCase):
         self.assertEqual(captured["headers"]["X-User-Id"], "owner-user")
         self.assertEqual(captured["headers"]["X-Tenant-Id"], "owner-org")
 
-    def test_credit_availability_exchanges_current_user_token_even_when_owner_token_is_explicit(self) -> None:
+    def test_credit_availability_keeps_explicit_token(self) -> None:
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 captured["exchange_body"] = json.loads(req.data.decode("utf-8"))
                 return _FakeResponse(
@@ -451,15 +475,27 @@ class ModelSdkTests(unittest.TestCase):
             )
 
         self.assertTrue(result["allowed"])
-        self.assertEqual(captured["exchange_body"], {"userId": "current-user-1"})
-        self.assertEqual(captured["headers"]["Authorization"], "Bearer current-user-token")
-        self.assertEqual(captured["headers"]["X-user-id"], "current-user-1")
-        self.assertEqual(captured["headers"]["X-tenant-id"], "current-org-1")
+        self.assertNotIn("exchange_body", captured)
+        self.assertEqual(captured["headers"]["Authorization"], "Bearer owner-token")
+        self.assertEqual(captured["headers"]["X-user-id"], "user-1")
+        self.assertEqual(captured["headers"]["X-tenant-id"], "owner-org-1")
 
     def test_llm_invoke_resolves_catalog_and_user_token(self) -> None:
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 captured["exchange_headers"] = dict(req.header_items())
                 captured["exchange_body"] = json.loads(req.data.decode("utf-8"))
@@ -485,7 +521,7 @@ class ModelSdkTests(unittest.TestCase):
 
         self.assertEqual(result.text, "hello")
         self.assertEqual(captured["exchange_headers"]["Authorization"], "Bearer ai-agent-token")
-        self.assertEqual(captured["exchange_body"], {"userId": "current-user-1"})
+        self.assertEqual(captured["exchange_body"], {"userId": "user-1"})
         self.assertEqual(captured["catalog_headers"]["Authorization"], "Bearer user-token")
         self.assertEqual(captured["detail_headers"]["Authorization"], "Bearer user-token")
         self.assertEqual(captured["chat_headers"]["Authorization"], "Bearer user-token")
@@ -496,7 +532,7 @@ class ModelSdkTests(unittest.TestCase):
         self.assertNotIn("x-request-id", normalized_chat_headers)
         self.assertNotIn("x-aios-request-id", normalized_chat_headers)
         self.assertNotIn("x-client-request-id", normalized_chat_headers)
-        self.assertEqual(normalized_chat_headers["x-licos-current-user-id"], "current-user-1")
+        self.assertEqual(normalized_chat_headers["x-licos-current-user-id"], "user-1")
         self.assertEqual(normalized_chat_headers["x-provider-route"], "provider-a")
         self.assertEqual(
             [name for name in normalized_chat_headers if name == "x-licos-current-user-id"],
@@ -513,6 +549,18 @@ class ModelSdkTests(unittest.TestCase):
 
     def test_llm_stream_does_not_report_incomplete_transport_stream(self) -> None:
         def fake_urlopen(req: Any, timeout: int = 0) -> Any:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -538,6 +586,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> Any:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -638,7 +698,8 @@ class ModelSdkTests(unittest.TestCase):
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if req.full_url == "http://platform.example/api/v1/admin/auth/me":
-                raise AssertionError("explicit current user must not be replaced with owner token context")
+                self.assertEqual(req.get_header("Authorization"), "Bearer request-token")
+                return _FakeResponse({"code": 0, "data": {"id": "personal-caller"}})
             if _is_available_models_request(req):
                 captured["catalog_url"] = req.full_url
                 captured["catalog_headers"] = dict(req.header_items())
@@ -648,13 +709,13 @@ class ModelSdkTests(unittest.TestCase):
             raise AssertionError(req.full_url)
 
         with mock.patch.object(model.request, "urlopen", fake_urlopen):
-            endpoint = model.resolve_llm_endpoint()
+            endpoint = model.resolve_llm_endpoint(user_token="request-token")
 
         query = parse.parse_qs(parse.urlparse(captured["catalog_url"]).query)
         catalog_headers = {key.lower(): value for key, value in captured["catalog_headers"].items()}
-        self.assertEqual(endpoint.request_headers["X-Licos-Current-User-Id"], "personal-current-user")
+        self.assertEqual(endpoint.request_headers["X-Licos-Current-User-Id"], "personal-caller")
         self.assertNotIn("X-Licos-Current-Org-Id", endpoint.request_headers)
-        self.assertEqual(catalog_headers["x-licos-current-user-id"], "personal-current-user")
+        self.assertEqual(catalog_headers["x-licos-current-user-id"], "personal-caller")
         self.assertNotIn("x-licos-current-org-id", catalog_headers)
         self.assertNotIn("currentUserId", query)
         self.assertNotIn("currentOrgId", query)
@@ -699,6 +760,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -734,6 +807,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -774,6 +859,18 @@ class ModelSdkTests(unittest.TestCase):
         chat_tokens: list[str] = []
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": next(tokens)}})
             if _is_available_models_request(req):
@@ -803,6 +900,18 @@ class ModelSdkTests(unittest.TestCase):
 
     def test_resolve_llm_endpoint_applies_model_detail_limits(self) -> None:
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -823,6 +932,18 @@ class ModelSdkTests(unittest.TestCase):
 
     def test_resolve_llm_endpoint_parses_catalog_limit_suffixes(self) -> None:
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -842,6 +963,18 @@ class ModelSdkTests(unittest.TestCase):
 
     def test_resolve_llm_endpoint_accepts_explicit_model(self) -> None:
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -867,6 +1000,18 @@ class ModelSdkTests(unittest.TestCase):
         fake_langchain_openai.ChatOpenAI = FakeChatOpenAI
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 captured["exchange_headers"] = dict(req.header_items())
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
@@ -913,7 +1058,7 @@ class ModelSdkTests(unittest.TestCase):
         normalized_default_headers = {
             key.lower(): value for key, value in kwargs["default_headers"].items()
         }
-        self.assertEqual(normalized_default_headers["x-licos-current-user-id"], "current-user-1")
+        self.assertEqual(normalized_default_headers["x-licos-current-user-id"], "user-1")
         self.assertEqual(normalized_default_headers["x-caller"], "caller")
         self.assertEqual(normalized_default_headers["x-provider-route"], "provider-a")
 
@@ -921,6 +1066,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -948,6 +1105,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -984,6 +1153,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1010,6 +1191,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1038,6 +1231,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1075,6 +1280,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1104,6 +1321,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1131,6 +1360,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1160,6 +1401,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1185,6 +1438,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):
@@ -1214,6 +1479,18 @@ class ModelSdkTests(unittest.TestCase):
         captured: dict[str, Any] = {}
 
         def fake_urlopen(req: Any, timeout: int = 0) -> _FakeResponse:
+            if req.full_url.endswith("/admin/auth/me"):
+                return _FakeResponse(
+                    {
+                        "code": 0,
+                        "data": {
+                            "id": "user-1",
+                            "username": "Owner User",
+                            "tenantId": "owner-org-1",
+                            "tenantName": "Owner Org",
+                        },
+                    }
+                )
             if req.full_url == "http://platform.example/api/v1/internal/auth/ai-user-token":
                 return _FakeResponse({"code": 0, "success": True, "data": {"accessToken": "user-token"}})
             if _is_available_models_request(req):

licos_dev_sdk-0.6.0/tests/test_request_identity.py

@@ -0,0 +1,86 @@
+import os
+from concurrent.futures import ThreadPoolExecutor
+from unittest import TestCase, mock
+
+from licos_dev_sdk import model
+from licos_platform_sdk import ConfigurationError, ApiError
+
+
+class ModelIdentityTests(TestCase):
+    def test_expired_project_credentials_refresh_the_same_owner(self):
+        with mock.patch.dict(os.environ, {"LICOS_CURRENT_USER_ID": "initializer"}, clear=True), \
+                mock.patch.object(model, "resolve_user_token", side_effect=["expired", "renewed"]) as exchange, \
+                mock.patch.object(model, "_request_json", side_effect=[
+                    ApiError("expired", status=401), {"code": 0, "data": {"id": "owner"}}
+                ]):
+            runtime = model._model_runtime(base_url="https://platform.example", user_id="owner")
+        self.assertEqual(runtime.token, "renewed")
+        self.assertEqual(runtime.current_user_id, "owner")
+        self.assertEqual(exchange.call_args_list, [
+            mock.call("https://platform.example", "owner"),
+            mock.call("https://platform.example", "owner", force_refresh=True),
+        ])
+
+    def test_business_authentication_error_is_not_a_user_profile(self):
+        with mock.patch.object(model, "_request_json", return_value={
+            "code": 10002, "message": "expired", "data": {"id": "stale-user"}
+        }), mock.patch.object(model, "resolve_user_token") as exchange:
+            with self.assertRaisesRegex(ApiError, "expired"):
+                model._model_runtime(base_url="https://platform.example", user_token="expired")
+            exchange.assert_not_called()
+
+    def test_concurrent_request_identity_ignores_initialization_environment(self):
+        def respond(method, url, *, token, **kwargs):
+            self.assertTrue(url.endswith("/auth/me"))
+            return {"code": 0, "data": {"id": token, "username": token, "tenantId": token + "-org"}}
+
+        with mock.patch.dict(
+            os.environ,
+            {
+                "LICOS_USER_ID": "owner",
+                "LICOS_USER_TOKEN": "ambient",
+                "LICOS_CURRENT_USER_ID": "initializer",
+                "LICOS_CURRENT_ORG_ID": "initializer-org",
+            },
+            clear=True,
+        ), mock.patch.object(model, "_request_json", side_effect=respond), ThreadPoolExecutor(2) as pool:
+            values = list(
+                pool.map(
+                    lambda token: model._model_runtime(base_url="https://platform.example", user_token=token),
+                    ["alice", "bob"],
+                )
+            )
+        self.assertEqual(
+            [(value.current_user_id, value.current_org_id, value.user_id) for value in values],
+            [("alice", "alice-org", "owner"), ("bob", "bob-org", "owner")],
+        )
+
+    def test_invalid_explicit_tokens_never_exchange_identity(self):
+        with mock.patch.object(model, "resolve_user_token") as exchange, mock.patch.object(
+            model, "_request_json", side_effect=ApiError("expired", status=401)
+        ) as http:
+            with self.assertRaises(ConfigurationError):
+                model._model_runtime(base_url="https://platform.example", user_token=" ")
+            http.assert_not_called()
+            with self.assertRaises(ApiError):
+                model._model_runtime(base_url="https://platform.example", user_token="expired")
+            http.assert_called_once()
+            exchange.assert_not_called()
+
+    def test_credit_authentication_failure_does_not_retry_with_runtime_identity(self):
+        runtime = model.ModelRuntime(
+            base_url="https://platform.example",
+            token="caller",
+            user_id="owner",
+            current_user_id="caller",
+            explicit_user_token=True,
+        )
+        with mock.patch.object(
+            model, "_request_json", side_effect=ApiError("expired", status=401)
+        ) as http, mock.patch.object(model, "resolve_user_token") as exchange:
+            with self.assertRaises(ApiError):
+                model._check_credit_availability(
+                    runtime, estimated_points=1, resource_type="MODEL_TOOL", resource_code="LLM_INVOKE"
+                )
+            http.assert_called_once()
+            exchange.assert_not_called()

licos_dev_sdk-0.5.0/PKG-INFO

@@ -1,26 +0,0 @@
-Metadata-Version: 2.4
-Name: licos-dev-sdk
-Version: 0.5.0
-Summary: LICOS Dev SDK - file generation and model capability clients
-Requires-Python: >=3.10
-Requires-Dist: beautifulsoup4>=4.12
-Requires-Dist: docxtpl>=0.16
-Requires-Dist: graphviz>=0.20
-Requires-Dist: jinja2>=3.1
-Requires-Dist: licos-platform-sdk>=0.6.1
-Requires-Dist: matplotlib>=3.9
-Requires-Dist: mistune>=3.0
-Requires-Dist: openpyxl>=3.1
-Requires-Dist: pillow>=10.0
-Requires-Dist: pypdf>=5.0
-Requires-Dist: python-barcode>=0.15
-Requires-Dist: python-docx>=1.1
-Requires-Dist: python-pptx>=1.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: qrcode[pil]>=8.0
-Requires-Dist: skia-pathops>=0.9.2
-Requires-Dist: uharfbuzz>=0.50.0
-Requires-Dist: weasyprint>=62.0
-Requires-Dist: xlsxwriter>=3.2
-Provides-Extra: ppt-master
-Requires-Dist: licos-ppt-master-assets==0.0.1; extra == 'ppt-master'