lumera 0.40.0__tar.gz → 0.41.0.dev1__tar.gz

{lumera-0.40.0 → lumera-0.41.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lumera
-Version: 0.40.0
+Version: 0.41.0.dev1
 Summary: SDK for building on Lumera platform
 Requires-Python: >=3.11
 Requires-Dist: requests

{lumera-0.40.0 → lumera-0.41.0.dev1}/lumera/_utils.py

@@ -205,7 +205,7 @@ def _parse_expiry(expires_at: int | float | str | None) -> float:
     raise TypeError(f"Unsupported expires_at format: {type(expires_at)!r}")
 
 
-def _fetch_access_token(provider: str) -> tuple[str, float]:
+def _fetch_access_token(provider: str) -> tuple[str, float, str]:
     provider = provider.lower().strip()
     if not provider:
         raise ValueError("provider is required")
@@ -218,15 +218,16 @@ def _fetch_access_token(provider: str) -> tuple[str, float]:
     data = resp.json()
     access_token = data.get("access_token")
     expires_at = data.get("expires_at")
+    credential_scope = str(data.get("credential_scope") or "")
 
     if not access_token:
         raise RuntimeError(f"Malformed response from Lumera when fetching {provider} access token")
 
     expiry_ts = _parse_expiry(expires_at)
-    return access_token, expiry_ts
+    return access_token, expiry_ts, credential_scope
 
 
-def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
+def get_access_token(provider: str, min_valid_seconds: int = 900, *, cache: bool = True) -> str:
     """Get the raw access token string for *provider*.
 
     .. deprecated::
@@ -239,8 +240,8 @@ def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
     providers this is the token itself; for basic-auth providers it is the
     base64-encoded ``username:password``.
 
-    Results are cached in-process; a fresh fetch is performed when the cached
-    token is within *min_valid_seconds* of expiry (default 15 min).
+    Shared results are cached in-process; delegated results are never cached.
+    Pass ``cache=False`` to bypass and avoid populating shared caches.
     """
     global _token_cache
 
@@ -250,19 +251,22 @@ def get_access_token(provider: str, min_valid_seconds: int = 900) -> str:
 
     now = _time.time()
 
-    cached = _token_cache.get(provider)
+    cached = _token_cache.get(provider) if cache else None
     if cached is not None:
         access_token, expiry_ts = cached
         if (expiry_ts - now) >= min_valid_seconds:
             return access_token
 
-    access_token, expiry_ts = _fetch_access_token(provider)
-    _token_cache[provider] = (access_token, expiry_ts)
+    access_token, expiry_ts, credential_scope = _fetch_access_token(provider)
+    if credential_scope == "delegated":
+        _evict_credential_caches(provider)
+    elif cache:
+        _token_cache[provider] = (access_token, expiry_ts)
     return access_token
 
 
-def get_google_access_token(min_valid_seconds: int = 900) -> str:
-    return get_access_token("google", min_valid_seconds=min_valid_seconds)
+def get_google_access_token(min_valid_seconds: int = 900, *, cache: bool = True) -> str:
+    return get_access_token("google", min_valid_seconds=min_valid_seconds, cache=cache)
 
 
 @dataclass(frozen=True)
@@ -305,6 +309,9 @@ class Credentials:
     extra_headers: dict[str, str] | None = None
     """Additional provider-required HTTP headers."""
 
+    credential_scope: str = ""
+    """Credential isolation mode. ``"delegated"`` values are never cached."""
+
     def as_header_dict(self) -> dict[str, str]:
         """Return headers suitable for ``requests.get(headers=...)``."""
         headers = {self.header_name: self.header_value}
@@ -316,6 +323,13 @@ class Credentials:
 _credentials_cache: dict[tuple[str, str], tuple[Credentials, float]] = {}
 
 
+def _evict_credential_caches(api_name: str) -> None:
+    _token_cache.pop(api_name, None)
+    for key in tuple(_credentials_cache):
+        if key[0] == api_name:
+            _credentials_cache.pop(key, None)
+
+
 def _fetch_credentials(api_name: str, provider: str | None = None) -> Credentials:
     api_name = api_name.lower().strip()
     if not api_name:
@@ -340,6 +354,7 @@ def _fetch_credentials(api_name: str, provider: str | None = None) -> Credential
     # Collect provider-specific extra fields (anything beyond the standard set).
     _standard_keys = {
         "access_token",
+        "credential_scope",
         "auth_type",
         "header_name",
         "header_value",
@@ -362,6 +377,7 @@ def _fetch_credentials(api_name: str, provider: str | None = None) -> Credential
         token=access_token,
         provider=str(data.get("provider") or provider_hint or api_name),
         header_name=data.get("header_name", "Authorization"),
+        credential_scope=str(data.get("credential_scope") or ""),
         header_value=data.get("header_value", f"Bearer {access_token}"),
         username=data.get("username"),
         expires_at=expiry_ts if expiry_ts != float("inf") else None,
@@ -374,14 +390,16 @@ def get_credentials(
     api_name: str | None = None,
     provider: str | None = None,
     min_valid_seconds: int = 900,
+    *,
+    cache: bool = True,
 ) -> Credentials:
     """Get a :class:`Credentials` object for *api_name*.
 
     This is the recommended way to obtain integration credentials.  The
     returned object includes the auth type, ready-to-use HTTP headers, and
-    (where applicable) the username.  Results are cached in-process; a
-    fresh fetch is performed when the cached credential is within
-    *min_valid_seconds* of expiry (default 15 min).
+    (where applicable) the username. Shared results are cached in-process;
+    delegated results are never cached. Pass ``cache=False`` to bypass and
+    avoid populating shared caches.
 
     Works with any auth type configured in the Lumera integrations page
     (bearer token, basic auth, etc.).
@@ -432,7 +450,7 @@ def get_credentials(
 
     now = _time.time()
     cache_key = (api_name, provider_hint)
-    cached = _credentials_cache.get(cache_key)
+    cached = _credentials_cache.get(cache_key) if cache else None
     if cached is not None:
         creds, expiry_ts = cached
         if (expiry_ts - now) >= min_valid_seconds:
@@ -440,10 +458,12 @@ def get_credentials(
 
     creds = _fetch_credentials(api_name, provider=provider_hint or None)
     expiry_ts = creds.expires_at if creds.expires_at is not None else float("inf")
-    _credentials_cache[cache_key] = (creds, expiry_ts)
-
-    # Keep the legacy _token_cache in sync so get_access_token stays fast.
-    _token_cache[api_name] = (creds.token, expiry_ts)
+    if creds.credential_scope == "delegated":
+        _evict_credential_caches(api_name)
+    elif cache:
+        _credentials_cache[cache_key] = (creds, expiry_ts)
+        # Keep the legacy _token_cache in sync so get_access_token stays fast.
+        _token_cache[api_name] = (creds.token, expiry_ts)
 
     return creds
 

{lumera-0.40.0 → lumera-0.41.0.dev1}/lumera.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lumera
-Version: 0.40.0
+Version: 0.41.0.dev1
 Summary: SDK for building on Lumera platform
 Requires-Python: >=3.11
 Requires-Dist: requests

{lumera-0.40.0 → lumera-0.41.0.dev1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lumera"
-version = "0.40.0"
+version = "0.41.0.dev1"
 description = "SDK for building on Lumera platform"
 requires-python = ">=3.11"
 dependencies = [

{lumera-0.40.0 → lumera-0.41.0.dev1}/tests/test_sdk.py

@@ -648,6 +648,106 @@ def test_get_credentials_cache_key_includes_provider_hint(
     assert calls == [{"provider": "slack"}, {"provider": "teams"}]
 
 
+def test_delegated_credentials_are_never_cached(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"member-token-{calls}",
+                    "provider": "google",
+                    "credential_scope": "delegated",
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    tokens = [_utils.get_credentials("google_drive", provider="google").token for _ in range(3)]
+
+    assert tokens == ["member-token-1", "member-token-2", "member-token-3"]
+    assert calls == 3
+    assert _utils._credentials_cache == {}
+    assert _utils._token_cache == {}
+
+
+def test_cache_false_bootstraps_and_evicts_delegated_credentials(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    responses = ["", "delegated", "delegated"]
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            scope = responses[calls]
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"token-{calls}",
+                    "provider": "google",
+                    "credential_scope": scope,
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    shared = _utils.get_credentials("google_drive", provider="google")
+    delegated = _utils.get_credentials("google_drive", provider="google", cache=False)
+    fetched_again = _utils.get_credentials("google_drive", provider="google")
+
+    assert shared.credential_scope == ""
+    assert delegated.credential_scope == "delegated"
+    assert fetched_again.token == "token-3"
+    assert calls == 3
+    assert _utils._credentials_cache == {}
+    assert _utils._token_cache == {}
+
+
+def test_delegated_legacy_access_tokens_are_never_cached(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv(sdk.TOKEN_ENV, "tok")
+    _utils._credentials_cache.clear()
+    _utils._token_cache.clear()
+    calls = 0
+
+    class MockSession:
+        def get(self, url: str, **kwargs: object) -> DummyResponse:
+            nonlocal calls
+            del url, kwargs
+            calls += 1
+            return DummyResponse(
+                status_code=200,
+                json_data={
+                    "access_token": f"legacy-{calls}",
+                    "credential_scope": "delegated",
+                    "expires_at": "2030-01-01T00:00:00Z",
+                },
+            )
+
+    monkeypatch.setattr(_utils, "_get_session", lambda: MockSession())
+
+    assert _utils.get_access_token("google") == "legacy-1"
+    assert _utils.get_access_token("google") == "legacy-2"
+    assert calls == 2
+    assert _utils._token_cache == {}
+
+
 def test_get_credentials_preserves_positional_min_valid_seconds(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: