lsst-daf-butler 29.2025.3200__tar.gz → 29.2025.3300__tar.gz

{lsst_daf_butler-29.2025.3200/python/lsst_daf_butler.egg-info → lsst_daf_butler-29.2025.3300}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lsst-daf-butler
-Version: 29.2025.3200
+Version: 29.2025.3300
 Summary: An abstraction layer for reading and writing astronomical data to datastores.
 Author-email: Rubin Observatory Data Management <dm-admin@lists.lsst.org>
 License: BSD 3-Clause License

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/_config.py

@@ -30,6 +30,7 @@ from __future__ import annotations
 from collections.abc import Iterator
 from contextlib import contextmanager
 from functools import cache
+from typing import Literal
 
 from pydantic import AnyHttpUrl, BaseModel
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -57,9 +58,12 @@ class ButlerServerConfig(BaseSettings):
     repositories: dict[str, RepositoryConfig]
     """Mapping from repository name to configuration for the repository."""
 
-    gafaelfawr_url: AnyHttpUrl
+    gafaelfawr_url: AnyHttpUrl | Literal["DISABLED"]
     """URL to the top-level HTTP path where Gafaelfawr can be found (e.g.
     "https://data-int.lsst.cloud").
+
+    This can instead be the special string "DISABLED" to turn off all features
+    requiring Gafaelfawr integration.
     """
 
     authentication: AuthenticationMode
@@ -69,6 +73,10 @@ class ButlerServerConfig(BaseSettings):
     as static files from the `configs/` HTTP route.
     """
 
+    @property
+    def gafaelfawr_enabled(self) -> bool:
+        return self.gafaelfawr_url != "DISABLED"
+
 
 _config: ButlerServerConfig | None = None
 

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/_dependencies.py

@@ -27,8 +27,8 @@
 
 from typing import Annotated
 
-from fastapi import Depends, HTTPException
-from safir.dependencies.gafaelfawr import auth_delegated_token_dependency, auth_dependency
+from fastapi import Depends, Header, HTTPException
+from safir.dependencies.gafaelfawr import auth_delegated_token_dependency
 
 from lsst.daf.butler import LabeledButlerFactory
 
@@ -65,9 +65,29 @@ async def authorizer_dependency() -> GafaelfawrGroupAuthorizer:
     return _authorizer
 
 
+async def user_name_dependency(x_auth_request_user: Annotated[str | None, Header()] = None) -> str | None:
+    """Retrieve the user name from Gafaelfawr authentication headers.
+
+    Parameters
+    ----------
+    x_auth_request_user : FastAPI header
+        Header provided by FastAPI.
+
+    Returns
+    -------
+    user_name : `str` | `None`
+        The user name, if Gafaelfawr is available on this environment.  `None`
+        if Gafaelfawr is not available.
+    """
+    if x_auth_request_user is None and load_config().gafaelfawr_enabled:
+        raise HTTPException(status_code=403, detail="Required X-Auth-Request-User header was not provided")
+
+    return x_auth_request_user
+
+
 async def repository_authorization_dependency(
     repository: str,
-    user_name: Annotated[str, Depends(auth_dependency)],
+    user_name: Annotated[str | None, Depends(user_name_dependency)],
     user_token: Annotated[str, Depends(auth_delegated_token_dependency)],
     authorizer: Annotated[GafaelfawrGroupAuthorizer, Depends(authorizer_dependency)],
 ) -> None:
@@ -87,6 +107,7 @@ async def repository_authorization_dependency(
     authorizer : `GafaelfawrGroupAuthorizer`
         Authorization client that will be used to verify group membership.
     """
+    assert user_name is not None, "Gafaelfawr user name header should have been populated."
     if not await authorizer.is_user_authorized_for_repository(
         repository=repository, user_name=user_name, user_token=user_token
     ):

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/_server.py

@@ -62,13 +62,16 @@ def create_app() -> FastAPI:
     # factory_dependency().
     default_api_path = "/api/butler"
     prefix = f"{default_api_path}/repo/{{repository}}"
+    auth_dependencies = [Depends(repository_authorization_dependency)]
+    if not config.gafaelfawr_enabled:
+        auth_dependencies = []
     for router in (external_router, query_router):
         app.include_router(
             router,
             prefix=prefix,
             # Verify that users have permission to access repository-specific
             # resources.
-            dependencies=[Depends(repository_authorization_dependency)],
+            dependencies=auth_dependencies,
             # document that 422 responses will include a JSON-formatted error
             # message, from `butler_exception_handler()` below.
             responses={422: {"model": ErrorResponseModel}},

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/handlers/_external_query.py

@@ -35,7 +35,6 @@ from typing import Annotated, NamedTuple
 
 from fastapi import APIRouter, Depends
 from fastapi.responses import StreamingResponse
-from safir.dependencies.gafaelfawr import auth_dependency
 
 from lsst.daf.butler import Butler, DataCoordinate, DimensionGroup
 from lsst.daf.butler.remote_butler.server_models import (
@@ -56,7 +55,7 @@ from ...._exceptions import InvalidQueryError
 from ...._query_all_datasets import QueryAllDatasetsParameters, query_all_datasets
 from ....queries import Query
 from ....queries.driver import QueryDriver, QueryTree
-from .._dependencies import factory_dependency
+from .._dependencies import factory_dependency, user_name_dependency
 from .._factory import Factory
 from ._query_serialization import convert_query_page
 from ._query_streaming import StreamingQuery, execute_streaming_query
@@ -93,7 +92,7 @@ class _StreamQueryDriverExecute(StreamingQuery[_QueryContext]):
 async def query_execute(
     request: QueryExecuteRequestModel,
     factory: Annotated[Factory, Depends(factory_dependency)],
-    user_name: Annotated[str, Depends(auth_dependency)],
+    user_name: Annotated[str | None, Depends(user_name_dependency)],
 ) -> StreamingResponse:
     query = _StreamQueryDriverExecute(request, factory)
     return await execute_streaming_query(query, user_name)
@@ -140,7 +139,7 @@ class _StreamQueryAllDatasets(StreamingQuery[_QueryAllDatasetsContext]):
 async def query_all_datasets_execute(
     request: QueryAllDatasetsRequestModel,
     factory: Annotated[Factory, Depends(factory_dependency)],
-    user_name: Annotated[str, Depends(auth_dependency)],
+    user_name: Annotated[str | None, Depends(user_name_dependency)],
 ) -> StreamingResponse:
     query = _StreamQueryAllDatasets(request, factory)
     return await execute_streaming_query(query, user_name)

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/handlers/_query_limits.py

@@ -56,7 +56,7 @@ class QueryLimits:
         self._active_queries = 0
         self._active_users: Counter[str] = Counter()
 
-    async def enforce_query_limits(self, user: str) -> None:
+    async def enforce_query_limits(self, user: str | None) -> None:
         if self._active_queries >= _MAXIMUM_CONCURRENT_STREAMING_QUERIES:
             await _block_retry_for_unit_test()
             raise HTTPException(
@@ -70,7 +70,7 @@ class QueryLimits:
         # replica, which is a non-deterministic but small number.
         # There will be some backpressure from the 429 responses as they
         # attempt to bounce to other replicas on retry.
-        if self._active_users[user] >= 2:
+        if user is not None and self._active_users[user] >= 2:
             _LOG.warning(f"User '{user}' is running many queries simultaneously.")
             raise HTTPException(
                 status_code=429,  # too many requests
@@ -80,14 +80,16 @@ class QueryLimits:
             )
 
     @asynccontextmanager
-    async def track_query(self, user: str) -> AsyncIterator[None]:
+    async def track_query(self, user: str | None) -> AsyncIterator[None]:
         try:
             self._active_queries += 1
-            self._active_users[user] += 1
+            if user is not None:
+                self._active_users[user] += 1
             await _block_query_for_unit_test()
             yield
         finally:
-            self._active_users[user] -= 1
+            if user is not None:
+                self._active_users[user] -= 1
             self._active_queries -= 1
 
 

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/remote_butler/server/handlers/_query_streaming.py

@@ -73,7 +73,7 @@ class StreamingQuery(Protocol[_TContext]):
         """
 
 
-async def execute_streaming_query(query: StreamingQuery, user: str) -> StreamingResponse:
+async def execute_streaming_query(query: StreamingQuery, user: str | None) -> StreamingResponse:
     """Run a query, streaming the response incrementally, one page at a time,
     as newline-separated chunks of JSON.
 
@@ -83,7 +83,7 @@ async def execute_streaming_query(query: StreamingQuery, user: str) -> Streaming
         Callers should define a class implementing the ``StreamingQuery``
         protocol to specify the inner logic that will be called during
         query execution.
-    user : `str`
+    user : `str`, optional
         Name of user running the query -- used to enforce usage limits.
 
     Returns
@@ -125,7 +125,7 @@ async def execute_streaming_query(query: StreamingQuery, user: str) -> Streaming
     )
 
 
-async def _stream_query_pages(query: StreamingQuery, user: str) -> AsyncIterator[str]:
+async def _stream_query_pages(query: StreamingQuery, user: str | None) -> AsyncIterator[str]:
     """Stream the query output with one page object per line, as
     newline-delimited JSON records in the "JSON Lines" format
     (https://jsonlines.org/).

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/python/lsst/daf/butler/tests/server.py

@@ -15,9 +15,9 @@ from lsst.daf.butler.remote_butler.server import create_app
 from lsst.daf.butler.remote_butler.server._config import ButlerServerConfig, RepositoryConfig, mock_config
 from lsst.daf.butler.remote_butler.server._dependencies import (
     auth_delegated_token_dependency,
-    auth_dependency,
     butler_factory_dependency,
     reset_dependency_caches,
+    user_name_dependency,
 )
 from lsst.resources import ResourcePath
 from lsst.resources.s3utils import clean_test_environment_for_s3, getS3Client
@@ -148,7 +148,7 @@ def create_test_server(
                 app.dependency_overrides[butler_factory_dependency] = lambda: server_butler_factory
                 # In an actual deployment, these headers would be provided by
                 # the Gafaelfawr ingress.
-                app.dependency_overrides[auth_dependency] = lambda: "mock-username"
+                app.dependency_overrides[user_name_dependency] = lambda: "mock-username"
                 app.dependency_overrides[auth_delegated_token_dependency] = lambda: "mock-delegated-token"
 
                 # Using TestClient in a context manager ensures that it uses

lsst_daf_butler-29.2025.3300/python/lsst/daf/butler/version.py

@@ -0,0 +1,2 @@
+__all__ = ["__version__"]
+__version__ = "29.2025.3300"

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300/python/lsst_daf_butler.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lsst-daf-butler
-Version: 29.2025.3200
+Version: 29.2025.3300
 Summary: An abstraction layer for reading and writing astronomical data to datastores.
 Author-email: Rubin Observatory Data Management <dm-admin@lists.lsst.org>
 License: BSD 3-Clause License

{lsst_daf_butler-29.2025.3200 → lsst_daf_butler-29.2025.3300}/tests/test_server.py

@@ -631,6 +631,7 @@ class ButlerClientServerAuthorizationTestCase(unittest.TestCase):
         """Test server running in CADC auth mode."""
         with mock_config() as config:
             config.authentication = "cadc"
+            config.gafaelfawr_url = "DISABLED"
             with create_test_server(TESTDIR, server_config=config) as instance:
                 self.assertIsInstance(instance.remote_butler._connection.auth, CadcAuthenticationProvider)
 

lsst_daf_butler-29.2025.3200/python/lsst/daf/butler/version.py

@@ -1,2 +0,0 @@
-__all__ = ["__version__"]
-__version__ = "29.2025.3200"