mainsequence 3.18.0__tar.gz → 3.18.2__tar.gz

{mainsequence-3.18.0 → mainsequence-3.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 3.18.0
+Version: 3.18.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License: MainSequence GmbH SDK License Agreement

{mainsequence-3.18.0 → mainsequence-3.18.2}/mainsequence/client/models_user.py

@@ -18,6 +18,7 @@ from .base import (
 )
 from .exceptions import ApiError, raise_for_response
 from .utils import (
+    DEFAULT_TIMEOUT,
     make_request,
 )
 
@@ -94,6 +95,29 @@ def _logged_user_header_context(
         "authorization_scheme": authorization_scheme,
     }
 
+
+def _build_request_bound_outbound_headers(headers: Mapping[str, Any]) -> dict[str, str]:
+    excluded = {
+        "connection",
+        "content-length",
+        "host",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "te",
+        "trailer",
+        "trailers",
+        "transfer-encoding",
+        "upgrade",
+    }
+    outbound: dict[str, str] = {}
+    for key, value in headers.items():
+        key_str = str(key)
+        if key_str.lower() in excluded:
+            continue
+        outbound[key_str] = str(value)
+    return outbound
+
 class Organization(BasePydanticModel):
     id: int = Field(
         ...,
@@ -952,6 +976,53 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
     def effective_plan(self) -> Any | None:
         return self.plan if self.plan is not None else self.active_plan_type
 
+    @classmethod
+    def _build_request_bound_identity_user(
+        cls,
+        *,
+        normalized_headers: Mapping[str, Any],
+        user_id: int,
+    ):
+        username = str(
+            normalized_headers.get("X-Username")
+            or normalized_headers.get("x-username")
+            or normalized_headers.get("X-User-Email")
+            or normalized_headers.get("x-user-email")
+            or f"user-{user_id}"
+        ).strip() or f"user-{user_id}"
+        email = str(
+            normalized_headers.get("X-User-Email")
+            or normalized_headers.get("x-user-email")
+            or username
+        ).strip() or username
+
+        payload = {
+            "id": user_id,
+            "username": username,
+            "email": email,
+            "date_joined": None,
+            "is_active": True,
+            "last_login": None,
+            "api_request_limit": None,
+            "mfa_enabled": False,
+            "organization": None,
+            "phone_number": None,
+            "plan": None,
+            "active_plan_type": None,
+            "groups": [],
+            "user_permissions": [],
+            "organization_teams": [],
+            "is_verified": None,
+            "blocked_access": None,
+            "requires_password_change": None,
+            "identity_platform_uid": None,
+        }
+
+        model_construct = getattr(cls, "model_construct", None)
+        if callable(model_construct):
+            return model_construct(**payload)
+        return cls.construct(**payload)
+
     @classmethod
     def get_authenticated_user_details(cls):
         """
@@ -980,6 +1051,35 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
 
         return cls.parse_obj(data)
 
+    @classmethod
+    def _get_request_bound_user(
+        cls,
+        *,
+        headers: Mapping[str, Any],
+        user_id: int | None = None,
+    ) -> User:
+        outbound_headers = _build_request_bound_outbound_headers(headers)
+        if user_id is None:
+            url = f"{cls.get_object_url()}/get_user_details/"
+            params = None
+        else:
+            url = f"{cls.get_object_url()}/{user_id}/"
+            params = {"serializer": "full"}
+
+        response = cls.build_session().get(
+            url,
+            headers=outbound_headers,
+            params=params,
+            timeout=DEFAULT_TIMEOUT,
+        )
+        raise_for_response(response)
+
+        data = response.json()
+        if hasattr(cls, "model_validate"):
+            return cls.model_validate(data)
+
+        return cls.parse_obj(data)
+
     @classmethod
     def get_logged_user(cls) -> User:
         """
@@ -1029,6 +1129,15 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
             normalized_headers[key_str] = value
             normalized_headers[key_str.lower()] = value
 
+        authorization_value = (
+            normalized_headers.get("Authorization")
+            or normalized_headers.get("authorization")
+        )
+        has_bearer_authorization = bool(
+            authorization_value
+            and str(authorization_value).split(" ", 1)[0].lower() == "bearer"
+        )
+
         user_id_raw = (
             normalized_headers.get("X-User-ID")
             or normalized_headers.get("x-user-id")
@@ -1037,20 +1146,19 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         )
 
         if user_id_raw in (None, ""):
-            if normalized_headers.get("authorization") and "Bearer" in normalized_headers.get("authorization"):
+            if has_bearer_authorization:
                 outgoing_authorization = None
                 outgoing_authorization_scheme = None
                 try:
-                    outgoing_headers = cls.LOADERS.auth_headers
-                    outgoing_authorization = (
-                        outgoing_headers.get("Authorization")
-                        or outgoing_headers.get("authorization")
+                    outgoing_headers = _build_request_bound_outbound_headers(headers)
+                    outgoing_authorization = outgoing_headers.get("Authorization") or outgoing_headers.get(
+                        "authorization"
                     )
                     if outgoing_authorization:
                         outgoing_authorization_scheme = str(outgoing_authorization).split(" ", 1)[0]
                 except Exception as auth_exc:
                     logger.exception(
-                        "User.get_logged_user could not inspect outgoing auth headers "
+                        "User.get_logged_user could not inspect request-bound outgoing auth headers "
                         "for /user/api/user/get_user_details/: %s",
                         auth_exc,
                     )
@@ -1061,7 +1169,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
                     outgoing_authorization_scheme,
                 )
                 try:
-                    user = cls.get_authenticated_user_details()
+                    user = cls._get_request_bound_user(headers=headers)
                 except Exception:
                     context = _logged_user_header_context(headers, header_source=header_source)
                     logger.exception(
@@ -1075,6 +1183,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
                         context["authorization_scheme"],
                     )
                     raise
+                _CURRENT_USER.set(user)
                 logger.info(
                     "User.get_logged_user resolved user_id=%s via bearer fallback",
                     user.id,
@@ -1110,7 +1219,20 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
             )
             raise RuntimeError(f"Invalid X-User-ID value: {user_id_raw!r}") from exc
 
-        user = cls.get(pk=user_id, serializer="full")
+        if not has_bearer_authorization:
+            user = cls._build_request_bound_identity_user(
+                normalized_headers=normalized_headers,
+                user_id=user_id,
+            )
+            _CURRENT_USER.set(user)
+            logger.info(
+                "User.get_logged_user resolved user_id=%s via request identity headers without backend auth",
+                user.id,
+            )
+            return user
+
+        user = cls._get_request_bound_user(headers=headers, user_id=user_id)
+        _CURRENT_USER.set(user)
         logger.info(
             "User.get_logged_user resolved user_id=%s via X-User-ID header",
             user.id,

{mainsequence-3.18.0 → mainsequence-3.18.2}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 3.18.0
+Version: 3.18.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License: MainSequence GmbH SDK License Agreement

{mainsequence-3.18.0 → mainsequence-3.18.2}/mainsequence.egg-info/SOURCES.txt

@@ -168,6 +168,7 @@ tests/test_filter_normalization.py
 tests/test_instruments.py
 tests/test_logconf.py
 tests/test_logged_user_components.py
+tests/test_models_user_request_bound_auth.py
 tests/test_pod_project_resolution.py
 tests/test_project_batch_jobs_from_file.py
 tests/test_run_configuration.py

{mainsequence-3.18.0 → mainsequence-3.18.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "3.18.0"
+version = "3.18.2"
 description = "Main Sequence SDK "
 readme = "README.md"
 requires-python = ">=3.11"

mainsequence-3.18.2/tests/test_models_user_request_bound_auth.py

@@ -0,0 +1,170 @@
+from __future__ import annotations
+
+import mainsequence.client.models_user as models_user_mod
+
+
+class _FakeResponse:
+    def __init__(self, payload: dict):
+        self.status_code = 200
+        self._payload = payload
+
+    def json(self):
+        return self._payload
+
+
+def test_get_logged_user_uses_request_bound_headers_for_user_lookup(monkeypatch):
+    monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
+    monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
+
+    captured: dict[str, object] = {}
+
+    class _FakeSession:
+        def get(self, url, *, headers=None, params=None, timeout=None):
+            captured["url"] = url
+            captured["headers"] = headers
+            captured["params"] = params
+            captured["timeout"] = timeout
+            return _FakeResponse(
+                {
+                    "id": 4,
+                    "username": "jose",
+                    "email": "jose@main-sequence.io",
+                    "date_joined": "2026-01-01T00:00:00Z",
+                    "is_active": True,
+                    "api_request_limit": 10000,
+                    "mfa_enabled": False,
+                    "groups": [],
+                    "user_permissions": [],
+                    "organization_teams": [],
+                }
+            )
+
+    monkeypatch.setattr(
+        models_user_mod.User,
+        "build_session",
+        classmethod(lambda cls: _FakeSession()),
+    )
+    monkeypatch.setattr(
+        models_user_mod.User,
+        "get",
+        classmethod(lambda cls, *args, **kwargs: (_ for _ in ()).throw(AssertionError("User.get should not be used"))),
+    )
+
+    auth_token = models_user_mod._CURRENT_AUTH_HEADERS.set(
+        {
+            "X-User-ID": "4",
+            "Authorization": "Bearer inbound-token",
+            "Cookie": "sessionid=abc",
+            "Host": "frontend.test",
+        }
+    )
+    user_token = models_user_mod._CURRENT_USER.set(None)
+    try:
+        user = models_user_mod.User.get_logged_user()
+    finally:
+        models_user_mod._CURRENT_USER.reset(user_token)
+        models_user_mod._CURRENT_AUTH_HEADERS.reset(auth_token)
+
+    assert user.id == 4
+    assert str(captured["url"]).endswith("/user/api/user/4/")
+    assert captured["params"] == {"serializer": "full"}
+    assert captured["headers"]["Authorization"] == "Bearer inbound-token"
+    assert captured["headers"]["Cookie"] == "sessionid=abc"
+    assert "Host" not in captured["headers"]
+
+
+def test_get_logged_user_returns_header_identity_without_backend_auth(monkeypatch):
+    monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
+    monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
+
+    class _FakeSession:
+        def get(self, url, *, headers=None, params=None, timeout=None):
+            raise AssertionError("header-only identity should not trigger backend lookup")
+
+    monkeypatch.setattr(
+        models_user_mod.User,
+        "build_session",
+        classmethod(lambda cls: _FakeSession()),
+    )
+
+    auth_token = models_user_mod._CURRENT_AUTH_HEADERS.set(
+        {
+            "X-User-ID": "4",
+            "X-Username": "dashboard-user",
+            "X-Dashboard-ID": "dashboard-7",
+        }
+    )
+    user_token = models_user_mod._CURRENT_USER.set(None)
+    try:
+        user = models_user_mod.User.get_logged_user()
+    finally:
+        models_user_mod._CURRENT_USER.reset(user_token)
+        models_user_mod._CURRENT_AUTH_HEADERS.reset(auth_token)
+
+    assert user.id == 4
+    assert user.username == "dashboard-user"
+    assert user.email == "dashboard-user"
+    assert user.date_joined is None
+    assert user.api_request_limit is None
+
+
+def test_get_logged_user_bearer_fallback_uses_request_bound_headers(monkeypatch):
+    monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
+    monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
+
+    captured: dict[str, object] = {}
+
+    class _FakeSession:
+        def get(self, url, *, headers=None, params=None, timeout=None):
+            captured["url"] = url
+            captured["headers"] = headers
+            captured["params"] = params
+            captured["timeout"] = timeout
+            return _FakeResponse(
+                {
+                    "id": 7,
+                    "username": "streamlit-user",
+                    "email": "streamlit@main-sequence.io",
+                    "date_joined": "2026-01-01T00:00:00Z",
+                    "is_active": True,
+                    "api_request_limit": 10000,
+                    "mfa_enabled": False,
+                    "groups": [],
+                    "user_permissions": [],
+                    "organization_teams": [],
+                }
+            )
+
+    monkeypatch.setattr(
+        models_user_mod.User,
+        "build_session",
+        classmethod(lambda cls: _FakeSession()),
+    )
+    monkeypatch.setattr(
+        models_user_mod.User,
+        "get_authenticated_user_details",
+        classmethod(
+            lambda cls: (_ for _ in ()).throw(
+                AssertionError("get_authenticated_user_details should not be used in request-bound fallback")
+            )
+        ),
+    )
+
+    auth_token = models_user_mod._CURRENT_AUTH_HEADERS.set(
+        {
+            "Authorization": "Bearer inbound-token",
+            "Cookie": "sessionid=abc",
+        }
+    )
+    user_token = models_user_mod._CURRENT_USER.set(None)
+    try:
+        user = models_user_mod.User.get_logged_user()
+    finally:
+        models_user_mod._CURRENT_USER.reset(user_token)
+        models_user_mod._CURRENT_AUTH_HEADERS.reset(auth_token)
+
+    assert user.id == 7
+    assert str(captured["url"]).endswith("/user/api/user/get_user_details/")
+    assert captured["params"] is None
+    assert captured["headers"]["Authorization"] == "Bearer inbound-token"
+    assert captured["headers"]["Cookie"] == "sessionid=abc"