mainsequence 6.0.28__tar.gz → 6.0.30__tar.gz

{mainsequence-6.0.28/mainsequence.egg-info → mainsequence-6.0.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 6.0.28
+Version: 6.0.30
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary
@@ -31,13 +31,10 @@ Requires-Dist: pygments>=2.20.0
 Requires-Dist: pyyaml
 Requires-Dist: requests>=2.33.0
 Requires-Dist: sqlalchemy<3,>=2
-Requires-Dist: starlette
 Requires-Dist: structlog
 Requires-Dist: tqdm
 Requires-Dist: typer
 Requires-Dist: urllib3>=2.7.0
-Provides-Extra: fastapi
-Requires-Dist: fastapi<1,>=0.115; extra == "fastapi"
 Provides-Extra: local-data
 Requires-Dist: duckdb>=1.4.2; extra == "local-data"
 Requires-Dist: pyarrow>=23.0.1; extra == "local-data"

{mainsequence-6.0.28 → mainsequence-6.0.30}/agent_scaffold/AGENTS.md

@@ -107,13 +107,14 @@ Working rules for this role:
 User-resolution rule for agents:
 
 - use `User.get_logged_user()` only when code is running with request-bound identity context:
-  - FastAPI with `LoggedUserContextMiddleware` installed by the application
   - Streamlit
   - code that explicitly binds `_CURRENT_AUTH_HEADERS`
 - treat its result as `RequestUserIdentity`: the human caller's canonical `uid` and optional
   `username`, never a numeric id or a full account profile
-- in FastAPI handlers, prefer `request.state.user` or `request.state.user_uid`; never use
-  `request.state.user_id`
+- in FastAPI handlers, use the Main Sequence platform-injected
+  `request.state.user` or `request.state.user_uid`; do not use
+  `User.get_logged_user()` as the handler entry point
+- never use `request.state.user_id`
 - use `User.get_authenticated_user_details()` in standalone authenticated CLI or script code that
   is not request-bound
 - keep authentication context separate from route-level authorization, deployment ownership,

{mainsequence-6.0.28 → mainsequence-6.0.30}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -92,25 +92,39 @@ Record:
 - whether the API uses backend transport or a contract-defined direct
   development transport
 
-Use `LoggedUserContextMiddleware` when the platform-authenticated request user
-must be available through `request.state`. This middleware binds request headers
-to the SDK request context; it is not an authorization policy by itself. The
-application must install it explicitly with
-`app.add_middleware(LoggedUserContextMiddleware)`.
+FastAPI releases receive the authenticated human from the Main Sequence
+platform through injected request state. No SDK authentication setup is
+required in project code:
 
-The middleware exposes only the human caller's UID-based request identity:
+```python
+from fastapi import FastAPI, Request
 
-- `request.state.user` is `RequestUserIdentity`
+
+app = FastAPI()
+
+
+@app.get("/me")
+def get_me(request: Request) -> dict[str, str | None]:
+    return {
+        "uid": request.state.user_uid,
+        "username": request.state.user.username,
+    }
+```
+
+Route code must not detect local versus deployed execution, parse
+authentication headers, or resolve the request user itself. Consume only the
+platform-injected human caller identity:
+
+- `request.state.user` contains canonical `uid` and optional `username`
 - `request.state.user_uid` is the canonical public user UUID
 - `request.state.user_id` does not exist
 
-In deployed runtimes, identity comes from the trusted gateway's `X-User-UID`.
-For direct local API development, a bearer-authenticated request is validated
-through `/api/v1/users/me/`; this supports testing a local service through a
-Cloudflare tunnel before deploying it. Never inject `X-User-UID` from frontend code, and
-never confuse the requesting human with the release owner, workload principal,
-or runtime target. Use the UID for application authorization after identity has
-been resolved.
+This identity is the human making the current HTTP request. It is not the
+release creator, deployment owner, runtime workload principal, or runtime
+target. Pass request state explicitly to shared services; do not use
+`User.get_logged_user()` as a FastAPI entry point. Platform-injected identity is
+not resource authorization; use `request.state.user_uid` when applying the
+endpoint's authorization policy.
 
 ### 2. Implement the provider
 

{mainsequence-6.0.28 → mainsequence-6.0.30}/mainsequence/client/models_user.py

@@ -1201,8 +1201,9 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
 
         if not headers:
             raise RequestIdentityError(
-                "No request identity is available. Bind request headers with "
-                "LoggedUserContextMiddleware or provide Streamlit request headers."
+                "No request identity is available. Provide an explicitly bound "
+                "request-header context or Streamlit request headers. FastAPI "
+                "handlers should use request.state.user instead."
             )
 
         normalized_headers = _normalize_request_headers(headers)

{mainsequence-6.0.28 → mainsequence-6.0.30/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 6.0.28
+Version: 6.0.30
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary
@@ -31,13 +31,10 @@ Requires-Dist: pygments>=2.20.0
 Requires-Dist: pyyaml
 Requires-Dist: requests>=2.33.0
 Requires-Dist: sqlalchemy<3,>=2
-Requires-Dist: starlette
 Requires-Dist: structlog
 Requires-Dist: tqdm
 Requires-Dist: typer
 Requires-Dist: urllib3>=2.7.0
-Provides-Extra: fastapi
-Requires-Dist: fastapi<1,>=0.115; extra == "fastapi"
 Provides-Extra: local-data
 Requires-Dist: duckdb>=1.4.2; extra == "local-data"
 Requires-Dist: pyarrow>=23.0.1; extra == "local-data"

{mainsequence-6.0.28 → mainsequence-6.0.30}/mainsequence.egg-info/SOURCES.txt

@@ -58,8 +58,6 @@ mainsequence/client/data_sources_interfaces/__init__.py
 mainsequence/client/data_sources_interfaces/duckdb.py
 mainsequence/client/data_sources_interfaces/local_paths.py
 mainsequence/client/data_sources_interfaces/sqlite.py
-mainsequence/client/fastapi/__init__.py
-mainsequence/client/fastapi/auth.py
 mainsequence/client/metatables/__init__.py
 mainsequence/client/metatables/core.py
 mainsequence/instrumentation/__init__.py
@@ -102,7 +100,6 @@ tests/test_data_node_storage_dimension_queries.py
 tests/test_data_node_update_flow.py
 tests/test_dependency_extras.py
 tests/test_duckdb_interface_dimensions.py
-tests/test_fastapi_request_identity.py
 tests/test_filter_normalization.py
 tests/test_instrumentation.py
 tests/test_logconf.py

{mainsequence-6.0.28 → mainsequence-6.0.30}/mainsequence.egg-info/requires.txt

@@ -16,15 +16,11 @@ pygments>=2.20.0
 pyyaml
 requests>=2.33.0
 sqlalchemy<3,>=2
-starlette
 structlog
 tqdm
 typer
 urllib3>=2.7.0
 
-[fastapi]
-fastapi<1,>=0.115
-
 [local-data]
 duckdb>=1.4.2
 pyarrow>=23.0.1

{mainsequence-6.0.28 → mainsequence-6.0.30}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "6.0.28"
+version = "6.0.30"
 description = "Main Sequence SDK "
 readme = "README.md"
 requires-python = ">=3.13"
@@ -40,7 +40,6 @@ dependencies = [
   "pyyaml",
   "requests>=2.33.0",
   "sqlalchemy>=2,<3",
-  "starlette",
   "structlog",
   "tqdm",
   "typer",
@@ -48,9 +47,6 @@ dependencies = [
 ]
 
 [project.optional-dependencies]
-"fastapi" = [
-  "fastapi>=0.115,<1",
-]
 "local-data" = [
   "duckdb>=1.4.2",
   "pyarrow>=23.0.1",

{mainsequence-6.0.28 → mainsequence-6.0.30}/tests/test_models_user_request_bound_auth.py

@@ -170,7 +170,7 @@ def test_get_logged_user_rejects_mismatched_bearer_and_gateway_uid(monkeypatch):
         )
 
 
-def test_get_logged_user_uses_identity_bound_by_middleware():
+def test_get_logged_user_uses_explicitly_bound_identity_context():
     expected = models_user_mod.RequestUserIdentity(uid=USER_UID, username="jose")
     token = models_user_mod._CURRENT_USER.set(expected)
     try:

mainsequence-6.0.28/mainsequence/client/fastapi/__init__.py

@@ -1,3 +0,0 @@
-from .auth import LoggedUserContextMiddleware
-
-__all__ = ["LoggedUserContextMiddleware"]

mainsequence-6.0.28/mainsequence/client/fastapi/auth.py

@@ -1,66 +0,0 @@
-from __future__ import annotations
-
-from starlette.concurrency import run_in_threadpool
-from starlette.requests import Request
-from starlette.responses import JSONResponse
-from starlette.types import ASGIApp, Receive, Scope, Send
-
-from mainsequence.client.exceptions import AuthenticationError, PermissionDeniedError
-
-
-def _load_auth_bindings():
-    from mainsequence.client.models_user import (
-        _CURRENT_AUTH_HEADERS,
-        _CURRENT_USER,
-        RequestIdentityError,
-        User,
-    )
-
-    return User, RequestIdentityError, _CURRENT_AUTH_HEADERS, _CURRENT_USER
-
-
-class LoggedUserContextMiddleware:
-    """Resolve and bind the human making each authenticated FastAPI request."""
-
-    def __init__(self, app: ASGIApp) -> None:
-        self.app = app
-
-    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
-        if scope["type"] != "http":
-            await self.app(scope, receive, send)
-            return
-
-        request = Request(scope)
-        if request.method == "OPTIONS":
-            await self.app(scope, receive, send)
-            return
-
-        User, RequestIdentityError, current_auth_headers, current_user = (
-            _load_auth_bindings()
-        )
-        headers_token = current_auth_headers.set(request.headers)
-        user_token = current_user.set(None)
-        resolved_user_token = None
-        try:
-            try:
-                user = await run_in_threadpool(User.get_logged_user)
-            except (RequestIdentityError, AuthenticationError, PermissionDeniedError):
-                response = JSONResponse(
-                    {"detail": "Authenticated request user could not be resolved."},
-                    status_code=401,
-                )
-                await response(scope, receive, send)
-                return
-
-            resolved_user_token = current_user.set(user)
-            request.state.user = user
-            request.state.user_uid = user.uid
-            await self.app(scope, receive, send)
-        finally:
-            if resolved_user_token is not None:
-                current_user.reset(resolved_user_token)
-            current_user.reset(user_token)
-            current_auth_headers.reset(headers_token)
-
-
-__all__ = ["LoggedUserContextMiddleware"]

mainsequence-6.0.28/tests/test_fastapi_request_identity.py

@@ -1,108 +0,0 @@
-from __future__ import annotations
-
-import asyncio
-import json
-
-from starlette.applications import Starlette
-from starlette.requests import Request
-from starlette.responses import JSONResponse, Response
-from starlette.routing import Route
-
-from mainsequence.client.fastapi import LoggedUserContextMiddleware
-from mainsequence.client.models_user import _CURRENT_AUTH_HEADERS, _CURRENT_USER
-
-USER_UID = "8f5d6b54-2f5e-4a8b-bb10-0b17f3f4c123"
-
-
-def _request(app: Starlette, *, method: str = "GET", headers=None):
-    messages: list[dict] = []
-    scope = {
-        "type": "http",
-        "asgi": {"version": "3.0"},
-        "http_version": "1.1",
-        "method": method,
-        "scheme": "http",
-        "path": "/identity",
-        "raw_path": b"/identity",
-        "query_string": b"",
-        "headers": [
-            (str(key).lower().encode(), str(value).encode())
-            for key, value in (headers or {}).items()
-        ],
-        "client": ("testclient", 50000),
-        "server": ("testserver", 80),
-    }
-
-    async def receive():
-        return {"type": "http.request", "body": b"", "more_body": False}
-
-    async def send(message):
-        messages.append(message)
-
-    asyncio.run(app(scope, receive, send))
-    status = next(message["status"] for message in messages if message["type"] == "http.response.start")
-    body = b"".join(
-        message.get("body", b"")
-        for message in messages
-        if message["type"] == "http.response.body"
-    )
-    return status, json.loads(body) if body else None
-
-
-def _build_app(route_calls: list[str]) -> Starlette:
-    async def identity(request: Request) -> JSONResponse:
-        route_calls.append("identity")
-        return JSONResponse(
-            {
-                "uid": request.state.user.uid,
-                "state_uid": request.state.user_uid,
-                "has_numeric_id": hasattr(request.state, "user_id"),
-            }
-        )
-
-    async def preflight(request: Request) -> Response:
-        route_calls.append("preflight")
-        return Response(status_code=204)
-
-    app = Starlette(
-        routes=[
-            Route("/identity", identity),
-            Route("/identity", preflight, methods=["OPTIONS"]),
-        ]
-    )
-    app.add_middleware(LoggedUserContextMiddleware)
-    return app
-
-
-def test_middleware_exposes_uid_only_request_state_and_resets_context():
-    route_calls: list[str] = []
-    status, body = _request(
-        _build_app(route_calls),
-        headers={"X-User-UID": USER_UID, "X-Username": "jose"},
-    )
-
-    assert status == 200
-    assert body == {
-        "uid": USER_UID,
-        "state_uid": USER_UID,
-        "has_numeric_id": False,
-    }
-    assert route_calls == ["identity"]
-    assert _CURRENT_AUTH_HEADERS.get() is None
-    assert _CURRENT_USER.get() is None
-
-
-def test_middleware_returns_401_without_running_route():
-    route_calls: list[str] = []
-    status, _ = _request(_build_app(route_calls))
-
-    assert status == 401
-    assert route_calls == []
-
-
-def test_middleware_allows_unauthenticated_options_preflight():
-    route_calls: list[str] = []
-    status, _ = _request(_build_app(route_calls), method="OPTIONS")
-
-    assert status == 204
-    assert route_calls == ["preflight"]