lumera 0.39.0.dev1__tar.gz → 0.41.0.dev1__tar.gz

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lumera
-Version: 0.39.0.dev1
+Version: 0.41.0.dev1
 Summary: SDK for building on Lumera platform
 Requires-Python: >=3.11
 Requires-Dist: requests

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/lumera/_utils.py

@@ -205,7 +205,7 @@ def _parse_expiry(expires_at: int | float | str | None) -> float:
     raise TypeError(f"Unsupported expires_at format: {type(expires_at)!r}")
 
 
-def _fetch_access_token(provider: str) -> tuple[str, float]:
+def _fetch_access_token(provider: str) -> tuple[str, float, str]:
     provider = provider.lower().strip()
     if not provider:
         raise ValueError("provider is required")
@@ -218,15 +218,16 @@ def _fetch_access_token(provider: str) -> tuple[str, float]:
     data = resp.json()
     access_token = data.get("access_token")
     expires_at = data.get("expires_at")
+    credential_scope = str(data.get("credential_scope") or "")
 
     if not access_token:
         raise RuntimeError(f"Malformed response from Lumera when fetching {provider} access token")
 
     expiry_ts = _parse_expiry(expires_at)
-    return access_token, expiry_ts
+    return access_token, expiry_ts, credential_scope
 
 
-def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
+def get_access_token(provider: str, min_valid_seconds: int = 900, *, cache: bool = True) -> str:
     """Get the raw access token string for *provider*.
 
     .. deprecated::
@@ -239,8 +240,8 @@ def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
     providers this is the token itself; for basic-auth providers it is the
     base64-encoded ``username:password``.
 
-    Results are cached in-process; a fresh fetch is performed when the cached
-    token is within *min_valid_seconds* of expiry (default 15 min).
+    Shared results are cached in-process; delegated results are never cached.
+    Pass ``cache=False`` to bypass and avoid populating shared caches.
     """
     global _token_cache
 
@@ -250,19 +251,22 @@ def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
 
     now = _time.time()
 
-    cached = _token_cache.get(provider)
+    cached = _token_cache.get(provider) if cache else None
     if cached is not None:
         access_token, expiry_ts = cached
         if (expiry_ts - now) >= min_valid_seconds:
             return access_token
 
-    access_token, expiry_ts = _fetch_access_token(provider)
-    _token_cache[provider] = (access_token, expiry_ts)
+    access_token, expiry_ts, credential_scope = _fetch_access_token(provider)
+    if credential_scope == "delegated":
+        _evict_credential_caches(provider)
+    elif cache:
+        _token_cache[provider] = (access_token, expiry_ts)
     return access_token
 
 
-def get_google_access_token(min_valid_seconds: int = 900) -> str:
-    return get_access_token("google", min_valid_seconds=min_valid_seconds)
+def get_google_access_token(min_valid_seconds: int = 900, *, cache: bool = True) -> str:
+    return get_access_token("google", min_valid_seconds=min_valid_seconds, cache=cache)
 
 
 @dataclass(frozen=True)
@@ -305,6 +309,9 @@ class Credentials:
     extra_headers: dict[str, str] | None = None
     """Additional provider-required HTTP headers."""
 
+    credential_scope: str = ""
+    """Credential isolation mode. ``"delegated"`` values are never cached."""
+
     def as_header_dict(self) -> dict[str, str]:
         """Return headers suitable for ``requests.get(headers=...)``."""
         headers = {self.header_name: self.header_value}
@@ -316,6 +323,13 @@ class Credentials:
 _credentials_cache: dict[tuple[str, str], tuple[Credentials, float]] = {}
 
 
+def _evict_credential_caches(api_name: str) -> None:
+    _token_cache.pop(api_name, None)
+    for key in tuple(_credentials_cache):
+        if key[0] == api_name:
+            _credentials_cache.pop(key, None)
+
+
 def _fetch_credentials(api_name: str, provider: str | None = None) -> Credentials:
     api_name = api_name.lower().strip()
     if not api_name:
@@ -340,6 +354,7 @@ def _fetch_credentials(api_name: str, provider: str | None = None) -> Credential
     # Collect provider-specific extra fields (anything beyond the standard set).
     _standard_keys = {
         "access_token",
+        "credential_scope",
         "auth_type",
         "header_name",
         "header_value",
@@ -362,6 +377,7 @@ def _fetch_credentials(api_name: str, provider: str | None = None) -> Credential
         token=access_token,
         provider=str(data.get("provider") or provider_hint or api_name),
         header_name=data.get("header_name", "Authorization"),
+        credential_scope=str(data.get("credential_scope") or ""),
         header_value=data.get("header_value", f"Bearer {access_token}"),
         username=data.get("username"),
         expires_at=expiry_ts if expiry_ts != float("inf") else None,
@@ -374,14 +390,16 @@ def get_credentials(
     api_name: str | None = None,
     provider: str | None = None,
     min_valid_seconds: int = 900,
+    *,
+    cache: bool = True,
 ) -> Credentials:
     """Get a :class:`Credentials` object for *api_name*.
 
     This is the recommended way to obtain integration credentials.  The
     returned object includes the auth type, ready-to-use HTTP headers, and
-    (where applicable) the username.  Results are cached in-process; a
-    fresh fetch is performed when the cached credential is within
-    *min_valid_seconds* of expiry (default 15 min).
+    (where applicable) the username. Shared results are cached in-process;
+    delegated results are never cached. Pass ``cache=False`` to bypass and
+    avoid populating shared caches.
 
     Works with any auth type configured in the Lumera integrations page
     (bearer token, basic auth, etc.).
@@ -432,7 +450,7 @@ def get_credentials(
 
     now = _time.time()
     cache_key = (api_name, provider_hint)
-    cached = _credentials_cache.get(cache_key)
+    cached = _credentials_cache.get(cache_key) if cache else None
     if cached is not None:
         creds, expiry_ts = cached
         if (expiry_ts - now) >= min_valid_seconds:
@@ -440,10 +458,12 @@ def get_credentials(
 
     creds = _fetch_credentials(api_name, provider=provider_hint or None)
     expiry_ts = creds.expires_at if creds.expires_at is not None else float("inf")
-    _credentials_cache[cache_key] = (creds, expiry_ts)
-
-    # Keep the legacy _token_cache in sync so get_access_token stays fast.
-    _token_cache[api_name] = (creds.token, expiry_ts)
+    if creds.credential_scope == "delegated":
+        _evict_credential_caches(api_name)
+    elif cache:
+        _credentials_cache[cache_key] = (creds, expiry_ts)
+        # Keep the legacy _token_cache in sync so get_access_token stays fast.
+        _token_cache[api_name] = (creds.token, expiry_ts)
 
     return creds
 

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/lumera/integrations/__init__.py

@@ -45,6 +45,7 @@ Available integrations:
 - ``bill`` - BILL AP/AR and BILL Spend & Expense APIs
 - ``finch`` - Finch organization and payroll API with batch handling
 - ``google`` - Google APIs (Docs, Slides, Sheets, Drive)
+- ``kafka`` - Bounded, on-demand Kafka produce and consumer-group polls
 - ``netsuite`` - NetSuite REST API and SuiteQL (M2M or OAuth)
 - ``salesforce`` - Salesforce REST API via customer-owned Client Credentials
 - ``slack`` - Slack (messages, files, reactions)
@@ -69,7 +70,7 @@ from .._utils import (
     list_integration_connections,
     list_integrations,
 )
-from . import bill, finch, google, netsuite, salesforce, slack, snowflake
+from . import bill, finch, google, kafka, netsuite, salesforce, slack, snowflake
 
 __all__ = [
     "Credentials",
@@ -80,6 +81,7 @@ __all__ = [
     "bill",
     "finch",
     "google",
+    "kafka",
     "netsuite",
     "salesforce",
     "slack",

lumera-0.41.0.dev1/lumera/integrations/kafka.py

@@ -0,0 +1,242 @@
+"""Bounded, server-mediated Kafka produce and consume operations.
+
+Kafka SASL credentials never enter the Python runtime. Each call asks Lumera's
+backend to create a temporary Kafka client, perform one acknowledged produce
+or bounded consumer-group poll, and close the client again.
+
+Example::
+
+    from lumera.integrations.kafka import get_client
+
+    kafka = get_client("finance_kafka")
+    kafka.push("finance.events", {"invoice_id": "inv_123"})
+    batch = kafka.pull("finance.events", group_id="lumera-ap-import")
+    for record in batch.records:
+        print(record.json())
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+from collections.abc import Iterable, Mapping
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Any, Literal
+from urllib.parse import quote as _url_quote
+
+from lumera._utils import (
+    API_BASE,
+    _api_headers,
+    _get_session,
+    _raise_if_project_scope_denied,
+)
+
+_MAX_TIMEOUT_SECONDS = 30
+_MAX_PULL_RECORDS = 500
+_TRANSPORT_GRACE_SECONDS = 5
+
+KafkaValue = bytes | bytearray | memoryview | str | dict[str, Any] | list[Any]
+KafkaHeaderValue = bytes | bytearray | memoryview | str
+KafkaHeaders = Mapping[str, KafkaHeaderValue] | Iterable[tuple[str, KafkaHeaderValue]]
+
+
+class KafkaAPIError(Exception):
+    """Raised when Lumera cannot complete a Kafka operation."""
+
+    def __init__(self, status_code: int, body: str) -> None:
+        self.status_code = status_code
+        self.body = body
+        super().__init__(f"Kafka integration error ({status_code}): {body}")
+
+
+@dataclass(frozen=True)
+class KafkaHeader:
+    key: str
+    value: bytes
+
+
+@dataclass(frozen=True)
+class KafkaRecord:
+    topic: str
+    partition: int
+    offset: int
+    timestamp: datetime
+    key: bytes | None
+    value: bytes
+    headers: tuple[KafkaHeader, ...]
+
+    def text(self, encoding: str = "utf-8") -> str:
+        """Decode the record value as text."""
+        return self.value.decode(encoding)
+
+    def json(self) -> object:
+        """Decode the record value as UTF-8 JSON."""
+        return json.loads(self.value)
+
+
+@dataclass(frozen=True)
+class KafkaPushResult:
+    topic: str
+    partition: int
+    offset: int
+    timestamp: datetime
+
+
+@dataclass(frozen=True)
+class KafkaPullResult:
+    records: tuple[KafkaRecord, ...]
+    committed: bool
+    timed_out: bool
+
+
+class KafkaClient:
+    """On-demand Kafka client backed by a project-scoped Lumera connection."""
+
+    def __init__(self, api_name: str = "kafka", timeout: int = 10) -> None:
+        if not api_name.strip():
+            raise ValueError("api_name is required")
+        self.api_name = api_name.strip()
+        self.timeout = _validate_timeout(timeout)
+
+    def push(
+        self,
+        topic: str,
+        value: KafkaValue,
+        *,
+        key: KafkaHeaderValue | None = None,
+        headers: KafkaHeaders | None = None,
+        timeout: int | None = None,
+    ) -> KafkaPushResult:
+        """Produce one record and wait for Kafka's acknowledged offset.
+
+        ``dict`` and ``list`` values are serialized as compact UTF-8 JSON.
+        Strings are UTF-8 encoded; bytes remain unchanged.
+        """
+        operation_timeout = self.timeout if timeout is None else _validate_timeout(timeout)
+        payload: dict[str, Any] = {
+            "topic": topic,
+            "value_base64": _encode_base64(value, allow_json=True),
+            "timeout_seconds": operation_timeout,
+        }
+        if key is not None:
+            payload["key_base64"] = _encode_base64(key, allow_json=False)
+        if headers is not None:
+            items = headers.items() if isinstance(headers, Mapping) else headers
+            payload["headers"] = [
+                {"key": name, "value_base64": _encode_base64(item, allow_json=False)}
+                for name, item in items
+            ]
+
+        data = self._request("push", payload, operation_timeout)
+        return KafkaPushResult(
+            topic=str(data["topic"]),
+            partition=int(data["partition"]),
+            offset=int(data["offset"]),
+            timestamp=_parse_timestamp(data["timestamp"]),
+        )
+
+    def pull(
+        self,
+        topic: str,
+        *,
+        group_id: str,
+        max_records: int = 100,
+        timeout: int | None = None,
+        offset_reset: Literal["earliest", "latest"] = "earliest",
+        commit: bool = True,
+    ) -> KafkaPullResult:
+        """Poll once with a temporary consumer and optionally commit offsets.
+
+        Use a stable ``group_id`` across invocations. ``offset_reset`` matters
+        only when the group has no previously committed topic offset.
+        """
+        if not group_id.strip():
+            raise ValueError("group_id is required")
+        if not 1 <= max_records <= _MAX_PULL_RECORDS:
+            raise ValueError(f"max_records must be between 1 and {_MAX_PULL_RECORDS}")
+        if offset_reset not in {"earliest", "latest"}:
+            raise ValueError("offset_reset must be earliest or latest")
+        operation_timeout = self.timeout if timeout is None else _validate_timeout(timeout)
+        data = self._request(
+            "pull",
+            {
+                "topic": topic,
+                "group_id": group_id,
+                "max_records": max_records,
+                "timeout_seconds": operation_timeout,
+                "offset_reset": offset_reset,
+                "commit": commit,
+            },
+            operation_timeout,
+        )
+        records = tuple(_parse_record(item) for item in data.get("records", []))
+        return KafkaPullResult(
+            records=records,
+            committed=bool(data.get("committed", False)),
+            timed_out=bool(data.get("timed_out", False)),
+        )
+
+    def _request(self, operation: str, payload: dict[str, Any], timeout: int) -> dict[str, Any]:
+        url = f"{API_BASE}/connections/{_url_quote(self.api_name, safe='')}/kafka/{operation}"
+        response = _get_session().post(
+            url,
+            json=payload,
+            headers=_api_headers(content_type="application/json"),
+            timeout=timeout + _TRANSPORT_GRACE_SECONDS,
+        )
+        _raise_if_project_scope_denied(response, self.api_name, url)
+        if not response.ok:
+            raise KafkaAPIError(response.status_code, response.text[:500])
+        data = response.json()
+        if not isinstance(data, dict):
+            raise KafkaAPIError(response.status_code, "Invalid Kafka integration response")
+        return data
+
+
+def get_client(api_name: str = "kafka", timeout: int = 10) -> KafkaClient:
+    """Create a lightweight, on-demand client for one Kafka connection."""
+    return KafkaClient(api_name=api_name, timeout=timeout)
+
+
+def _validate_timeout(timeout: int) -> int:
+    if not isinstance(timeout, int) or not 1 <= timeout <= _MAX_TIMEOUT_SECONDS:
+        raise ValueError(f"timeout must be between 1 and {_MAX_TIMEOUT_SECONDS} seconds")
+    return timeout
+
+
+def _encode_base64(value: KafkaValue | KafkaHeaderValue, *, allow_json: bool) -> str:
+    if isinstance(value, str):
+        raw = value.encode("utf-8")
+    elif isinstance(value, (bytes, bytearray, memoryview)):
+        raw = bytes(value)
+    elif allow_json and isinstance(value, (dict, list)):
+        raw = json.dumps(value, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    else:
+        raise TypeError("Kafka values must be bytes, str, dict, or list")
+    return base64.b64encode(raw).decode("ascii")
+
+
+def _parse_timestamp(value: object) -> datetime:
+    if not isinstance(value, str):
+        raise ValueError("Kafka timestamp must be an RFC 3339 string")
+    return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def _parse_record(data: dict[str, Any]) -> KafkaRecord:
+    key = data.get("key_base64")
+    return KafkaRecord(
+        topic=str(data["topic"]),
+        partition=int(data["partition"]),
+        offset=int(data["offset"]),
+        timestamp=_parse_timestamp(data["timestamp"]),
+        key=base64.b64decode(key, validate=True) if isinstance(key, str) else None,
+        value=base64.b64decode(str(data["value_base64"]), validate=True),
+        headers=tuple(
+            KafkaHeader(
+                key=str(header["key"]),
+                value=base64.b64decode(str(header["value_base64"]), validate=True),
+            )
+            for header in data.get("headers", [])
+        ),
+    )

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/lumera.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lumera
-Version: 0.39.0.dev1
+Version: 0.41.0.dev1
 Summary: SDK for building on Lumera platform
 Requires-Python: >=3.11
 Requires-Dist: requests

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/lumera.egg-info/SOURCES.txt

@@ -39,6 +39,7 @@ lumera/integrations/__init__.py
 lumera/integrations/bill.py
 lumera/integrations/finch.py
 lumera/integrations/google.py
+lumera/integrations/kafka.py
 lumera/integrations/netsuite.py
 lumera/integrations/salesforce.py
 lumera/integrations/slack.py
@@ -65,6 +66,7 @@ tests/test_function_resources.py
 tests/test_integrations_bill.py
 tests/test_integrations_finch.py
 tests/test_integrations_google.py
+tests/test_integrations_kafka.py
 tests/test_integrations_netsuite.py
 tests/test_integrations_salesforce.py
 tests/test_integrations_snowflake.py

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lumera"
-version = "0.39.0.dev1"
+version = "0.41.0.dev1"
 description = "SDK for building on Lumera platform"
 requires-python = ">=3.11"
 dependencies = [

lumera-0.41.0.dev1/tests/test_integrations_kafka.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+import base64
+from typing import Any
+
+import pytest
+
+from lumera.integrations import kafka
+
+
+class FakeResponse:
+    def __init__(self, data: dict[str, Any], status_code: int = 200) -> None:
+        self._data = data
+        self.status_code = status_code
+        self.ok = status_code < 400
+        self.text = str(data)
+
+    def json(self) -> dict[str, Any]:
+        return self._data
+
+
+class FakeSession:
+    def __init__(self, response: FakeResponse) -> None:
+        self.response = response
+        self.url = ""
+        self.kwargs: dict[str, Any] = {}
+
+    def post(self, url: str, **kwargs: object) -> FakeResponse:
+        self.url, self.kwargs = url, kwargs
+        return self.response
+
+
+def install_session(monkeypatch: pytest.MonkeyPatch, response: FakeResponse) -> FakeSession:
+    session = FakeSession(response)
+    monkeypatch.setattr(kafka, "_get_session", lambda: session)
+    monkeypatch.setattr(kafka, "_api_headers", lambda **_: {"X-Lumera-Project": "finance"})
+    return session
+
+
+def test_push_json_is_binary_safe_and_uses_project_scoped_backend(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    session = install_session(
+        monkeypatch,
+        FakeResponse(
+            {
+                "topic": "finance.events",
+                "partition": 2,
+                "offset": 41,
+                "timestamp": "2026-08-25T10:30:00Z",
+            }
+        ),
+    )
+
+    result = kafka.get_client("finance_kafka").push(
+        "finance.events",
+        {"invoice_id": "inv_123"},
+        key=b"invoice-key",
+        headers={"trace": "abc"},
+    )
+
+    assert session.url.endswith("/connections/finance_kafka/kafka/push")
+    payload = session.kwargs["json"]
+    assert base64.b64decode(payload["value_base64"]) == b'{"invoice_id":"inv_123"}'
+    assert base64.b64decode(payload["key_base64"]) == b"invoice-key"
+    assert base64.b64decode(payload["headers"][0]["value_base64"]) == b"abc"
+    assert session.kwargs["headers"]["X-Lumera-Project"] == "finance"
+    assert result.partition == 2
+    assert result.offset == 41
+
+
+def test_pull_decodes_records_and_preserves_explicit_commit_choice(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    session = install_session(
+        monkeypatch,
+        FakeResponse(
+            {
+                "records": [
+                    {
+                        "topic": "finance.events",
+                        "partition": 1,
+                        "offset": 42,
+                        "timestamp": "2026-08-25T10:31:00Z",
+                        "key_base64": None,
+                        "value_base64": base64.b64encode(b'{"amount":25}').decode(),
+                        "headers": [
+                            {
+                                "key": "trace",
+                                "value_base64": base64.b64encode(b"xyz").decode(),
+                            }
+                        ],
+                    }
+                ],
+                "committed": False,
+                "timed_out": False,
+            }
+        ),
+    )
+
+    batch = kafka.get_client("finance_kafka").pull(
+        "finance.events", group_id="lumera-ap-import", max_records=25, commit=False
+    )
+
+    assert session.url.endswith("/connections/finance_kafka/kafka/pull")
+    assert session.kwargs["json"]["group_id"] == "lumera-ap-import"
+    assert session.kwargs["json"]["commit"] is False
+    assert batch.committed is False
+    assert batch.records[0].json() == {"amount": 25}
+    assert batch.records[0].headers[0].value == b"xyz"
+
+
+def test_kafka_client_rejects_unbounded_requests() -> None:
+    with pytest.raises(ValueError, match="between 1 and 30"):
+        kafka.get_client(timeout=60)
+    with pytest.raises(ValueError, match="between 1 and 500"):
+        kafka.get_client().pull("finance.events", group_id="finance", max_records=501)
+
+
+def test_kafka_provider_errors_are_typed(monkeypatch: pytest.MonkeyPatch) -> None:
+    install_session(monkeypatch, FakeResponse({"message": "broker rejected request"}, 502))
+
+    with pytest.raises(kafka.KafkaAPIError) as exc:
+        kafka.get_client().push("finance.events", b"message")
+
+    assert exc.value.status_code == 502

{lumera-0.39.0.dev1 → lumera-0.41.0.dev1}/tests/test_sdk.py

@@ -648,6 +648,106 @@ def test_get_credentials_cache_key_includes_provider_hint(
     assert calls == [{"provider": "slack"}, {"provider": "teams"}]
 
 
+def test_delegated_credentials_are_never_cached(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"member-token-{calls}",
+                    "provider": "google",
+                    "credential_scope": "delegated",
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    tokens = [_utils.get_credentials("google_drive", provider="google").token for _ in range(3)]
+
+    assert tokens == ["member-token-1", "member-token-2", "member-token-3"]
+    assert calls == 3
+    assert _utils._credentials_cache == {}
+    assert _utils._token_cache == {}
+
+
+def test_cache_false_bootstraps_and_evicts_delegated_credentials(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    responses = ["", "delegated", "delegated"]
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            scope = responses[calls]
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"token-{calls}",
+                    "provider": "google",
+                    "credential_scope": scope,
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    shared = _utils.get_credentials("google_drive", provider="google")
+    delegated = _utils.get_credentials("google_drive", provider="google", cache=False)
+    fetched_again = _utils.get_credentials("google_drive", provider="google")
+
+    assert shared.credential_scope == ""
+    assert delegated.credential_scope == "delegated"
+    assert fetched_again.token == "token-3"
+    assert calls == 3
+    assert _utils._credentials_cache == {}
+    assert _utils._token_cache == {}
+
+
+def test_delegated_legacy_access_tokens_are_never_cached(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"legacy-{calls}",
+                    "credential_scope": "delegated",
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    assert _utils.get_access_token("google") == "legacy-1"
+    assert _utils.get_access_token("google") == "legacy-2"
+    assert calls == 2
+    assert _utils._token_cache == {}
+
+
 def test_get_credentials_preserves_positional_min_valid_seconds(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: