mainsequence 9.0.26.dev70__py3-none-any.whl → 9.0.27.dev71__py3-none-any.whl

agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -199,10 +199,8 @@ def publish_report(team_uid: str) -> dict[str, str]:
   Call it from a `def` handler, or from an `async def` handler with
   `await asyncio.to_thread(caller.in_teams, team_uids)`, which keeps the
   request's identity.
-- `team_uids` on the identity is deprecated and warns when read. In a signed
-  HTTP request it raises `RequestIdentityError` when the assertion carried no
-  team list, as every assertion will once the platform stops signing them.
-  Replace every check that reads it with `in_teams()`.
+- The identity has no `team_uids`; the platform signs no team list. Code
+  written for releases that had it reads `in_teams()` instead.
 - Membership is not team administration and not a grant on an object: check
   the exact object and action as well.
 

agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -137,7 +137,7 @@ Keep these separate:
 - administration of the team itself
 
 An application that checks whether its caller or requester belongs to a team
-uses `in_teams()`, never the deprecated `team_uids`; see
+uses `in_teams()`; the identity carries no team list. See
 `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.
 
 ### 5. `Constant` vs `Secret` is a security boundary
@@ -308,9 +308,9 @@ When reviewing an access-control task, look for:
 - using direct user grants where a team should be used
 - using a team when the access is clearly one-off
 - treating team membership as team administration
-- team checks that read the deprecated `team_uids` instead of `in_teams()`,
-  that read an `in_teams()` error as "not a member", or that reuse an older
-  answer (no `max_age_seconds=0`) before a write that must see a removal
+- team checks that do not use `in_teams()`, that read an `in_teams()` error
+  as "not a member", or that reuse an older answer (no `max_age_seconds=0`)
+  before a write that must see a removal
 - storing sensitive data in a `Constant`
 - creating a `Constant` or `Secret` blindly without resolving whether the name already exists
 - weak or unverified claims about who can access a resource

mainsequence/client/models_user.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import datetime
 import math
-import warnings
 from collections.abc import Iterable
 from typing import Any, ClassVar, Literal
 from uuid import UUID
@@ -43,7 +42,7 @@ class RequestUserIdentity(BaseModel):
     ``in_teams()`` asks the platform which teams either of them belongs to.
     """
 
-    model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
+    model_config = ConfigDict(extra="forbid", frozen=True)
 
     uid: str = Field(
         ...,
@@ -58,17 +57,6 @@ class RequestUserIdentity(BaseModel):
         title="Username",
         description="Optional display name authenticated by the runtime gateway.",
     )
-    signed_team_uids: tuple[str, ...] | None = Field(
-        (),
-        alias="team_uids",
-        title="Signed team UIDs (deprecated)",
-        description=(
-            "Canonical UIDs of the active teams the platform signed in the caller "
-            "assertion, None when it signed none. Deprecated: read membership with "
-            "in_teams() (#225). Empty in local mode and on WebSockets, which carry no "
-            "such facts."
-        ),
-    )
     is_organization_admin: bool = Field(
         False,
         title="Organization admin",
@@ -87,37 +75,6 @@ class RequestUserIdentity(BaseModel):
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Request user UID must be a valid UUID.") from exc
 
-    @field_validator("signed_team_uids", mode="before")
-    @classmethod
-    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...] | None:
-        if value is None:
-            return None
-        try:
-            return tuple(str(UUID(str(item).strip())) for item in value)
-        except (AttributeError, TypeError, ValueError) as exc:
-            raise ValueError("Team UIDs must be valid UUIDs.") from exc
-
-    @property
-    def team_uids(self) -> tuple[str, ...]:
-        """Deprecated: the team UIDs the platform signed. Use ``in_teams()``.
-
-        Warns when read. When the caller assertion carried no team list it
-        raises ``RequestIdentityError``; it never answers an empty list for
-        that. Empty in local mode and on WebSockets, as before (#225).
-        """
-        warnings.warn(
-            "RequestUserIdentity.team_uids is deprecated; check membership with "
-            "in_teams() instead.",
-            DeprecationWarning,
-            stacklevel=2,
-        )
-        if self.signed_team_uids is None:
-            raise RequestIdentityError(
-                "The caller assertion carries no team list. Check team membership "
-                "with in_teams()."
-            )
-        return self.signed_team_uids
-
     def in_teams(
         self, team_uids: Iterable[str | UUID], *, max_age_seconds: float | None = None
     ) -> frozenset[str]:

mainsequence/server/caller_assertions.py

@@ -63,8 +63,6 @@ class _VerifiedRequester:
     """The person a requester-bound call works for, as the platform signed it."""
 
     user_uid: str
-    # None when the assertion carries no team list (#225).
-    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
 
 
@@ -75,66 +73,44 @@ class AuthenticatedCaller:
     environment_uid: str
     issued_at: int
     expires_at: int
-    # None when the assertion carries no team list (#225).
-    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
     # The person a requester-bound call works for, None on any other call. The
     # fields above stay the caller's: the acting application (ADR-0036).
     _requester: _VerifiedRequester | None = None
 
 
-def _team_uids(value: object, *, owner: str) -> tuple[str, ...]:
-    if not isinstance(value, list):
-        raise InvalidCallerAssertion(f"{owner} team UIDs are invalid.")
-    team_uids = tuple(_canonical_uid(item) for item in value)
-    if list(team_uids) != sorted(set(team_uids)):
-        raise InvalidCallerAssertion(f"{owner} team UIDs must be sorted and unique.")
-    return team_uids
-
-
 def _admin_flag(value: object, *, owner: str) -> bool:
     if type(value) is not bool:
         raise InvalidCallerAssertion(f"{owner} admin flag is invalid.")
     return value
 
 
-def _signed_team_uids(claims: dict, *, owner: str) -> tuple[str, ...] | None:
-    """The deprecated ``team_uids`` while the platform still signs it, else None.
+def _caller_admin_flag(payload: dict) -> bool:
+    """The caller's admin flag, after checking the exact claim set.
 
-    Membership is checked on demand with ``RequestUserIdentity.in_teams()``
-    (#225); a list that is still signed is checked as before.
+    The assertion names no teams: membership is checked on demand with
+    ``RequestUserIdentity.in_teams()`` (#225), and an assertion that lists
+    teams is refused.
     """
-    if "team_uids" not in claims:
-        return None
-    return _team_uids(claims["team_uids"], owner=owner)
-
-
-def _caller_facts(payload: dict) -> tuple[tuple[str, ...] | None, bool]:
-    """The caller's admin flag, and its team UIDs while the platform signs them."""
     # A requester-bound call also carries "requester", which _requester() checks.
-    if set(payload) - {"requester", "team_uids"} != REQUIRED_CLAIMS:
+    if set(payload) - {"requester"} != REQUIRED_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion claims are invalid.")
-    return (
-        _signed_team_uids(payload, owner="Caller"),
-        _admin_flag(payload["is_organization_admin"], owner="Caller"),
-    )
+    return _admin_flag(payload["is_organization_admin"], owner="Caller")
 
 
 def _requester(payload: dict) -> _VerifiedRequester | None:
     """The person a requester-bound call works for, or None on any other call.
 
     The claim has exactly ``sub`` and ``is_organization_admin``, the person's
-    own User UID and Organization-admin flag, and may still carry the
-    deprecated ``team_uids`` (#225).
+    own User UID and Organization-admin flag.
     """
     if "requester" not in payload:
         return None
     claim = payload["requester"]
-    if not isinstance(claim, dict) or set(claim) - {"team_uids"} != REQUESTER_CLAIMS:
+    if not isinstance(claim, dict) or set(claim) != REQUESTER_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion requester is invalid.")
     return _VerifiedRequester(
         user_uid=_canonical_uid(claim["sub"]),
-        team_uids=_signed_team_uids(claim, owner="Requester"),
         is_organization_admin=_admin_flag(claim["is_organization_admin"], owner="Requester"),
     )
 
@@ -284,7 +260,7 @@ class CallerAssertionVerifier:
                 audience=f"urn:mainsequence:fapi:{self.release_uid}",
                 options={"require": list(REQUIRED_CLAIMS)},
             )
-            team_uids, is_organization_admin = _caller_facts(payload)
+            is_organization_admin = _caller_admin_flag(payload)
             requester = _requester(payload)
             if (
                 payload["aud"] != f"urn:mainsequence:fapi:{self.release_uid}"
@@ -304,7 +280,6 @@ class CallerAssertionVerifier:
                 environment_uid=self.environment_uid,
                 issued_at=iat,
                 expires_at=exp,
-                team_uids=team_uids,
                 is_organization_admin=is_organization_admin,
                 _requester=requester,
             )

mainsequence/server/fastapi.py

@@ -229,7 +229,6 @@ class _RequestIdentityMiddleware:
                         caller = await asyncio.to_thread(self.verifier.verify, assertion)
                         user = RequestUserIdentity(
                             uid=caller.user_uid,
-                            team_uids=caller.team_uids,
                             is_organization_admin=caller.is_organization_admin,
                         )
                         state["resource_release_uid"] = caller.release_uid
@@ -244,7 +243,6 @@ class _RequestIdentityMiddleware:
                             # The person this call works for, with the person's own facts.
                             context.requester = RequestUserIdentity(
                                 uid=caller._requester.user_uid,
-                                team_uids=caller._requester.team_uids,
                                 is_organization_admin=caller._requester.is_organization_admin,
                             )
                     else:

{mainsequence-9.0.26.dev70.dist-info → mainsequence-9.0.27.dev71.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.26.dev70
+Version: 9.0.27.dev71
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.26.dev70.dist-info → mainsequence-9.0.27.dev71.dist-info}/RECORD

@@ -1,10 +1,10 @@
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NcwIQ1QgD4Ku0mG2Hb-Izee8p9fm9LTPHa6gDEWTOSQ,13200
-agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=f6Mn4VJsMz6DQgJgv4Wzi7spiPNXvO-eOKJBqj2ik58,26969
+agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=V2YW1oNlkKCr0_WwieVIZStl7rRfXlk02IdvkzyuneU,26820
 agent_scaffold/skills/mainsequence-inference/SKILL.md,sha256=yv8aAHLQ2FBBSWPIFadY7pGNTwtR-yiR_-UzaGRN9-g,12502
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=8RRZNmC3omhZoxNbmu50MdhBFTQ2CU2THeyNu07Ax18,8659
 agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=pNQICoVW6nRr0HfvyB0Q64TdsqCXTWQUuImpBL-4XUQ,18575
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
-agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=Nw2ptUO70BJNUFrGlmzPscGrSKu61EHQgGKg45vBSDc,15280
+agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=sgAe4buJaMoatRRwBVWZvDcONY9mxJyqElUFX5swoqA,15249
 agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=KfTptbOMO-b8hiVFPgKxRMjmQWZCLB9Sr_kli7kp4hs,16920
 agent_scaffold/skills/sdk_code_repository_execution/SKILL.md,sha256=g4C0Cp5oqQg2LBjT-piWXunmt_hNd5yTK33RMYPAE8I,7313
 mainsequence/__init__.py,sha256=70CbIo7ZG1mzi5uwkqDtVESunBE0RanHjeFg4ptfsA0,385
@@ -45,22 +45,22 @@ mainsequence/client/github_issues.py,sha256=pSTUw3UPrmE6wqnpoJctartTaNSq6iu6PQRr
 mainsequence/client/inference.py,sha256=tYKHRxLR6mA5iLmgd3qURwweWc2OPQuw0__tD3LQgSI,7748
 mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZlYXy0Mig,36488
 mainsequence/client/models_helpers.py,sha256=CQRjBjx3DsREJLRk0vqFsC-Dcll5lUP2ofu6e5UMvhk,49051
-mainsequence/client/models_user.py,sha256=FESX_RYmY_qXXJ-VuZUo_C9Hwx0MrdHP_4b8wb4HycU,52256
+mainsequence/client/models_user.py,sha256=Z3h6MX5aWKFfEvtwHPk1adhfPbG3RZCKbp3Aanor4lo,50502
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
 mainsequence/client/utils.py,sha256=Rk2z-78swO6GepibLlQNdxL1eqYy8vHGrjiZdV3G5CM,31641
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
-mainsequence/server/caller_assertions.py,sha256=AcE9PgkIAu8kMUILSRs6P--wN68DUw5a5D1PC7NQqIs,13116
-mainsequence/server/fastapi.py,sha256=zVPvtlkAZuuD1EgKk_9jPVjfBxOlFjf9aXjDyFlTC54,20250
+mainsequence/server/caller_assertions.py,sha256=IUQ74UL3VqCAAuujTGk3DzCPogRYhWRD9rVoWezdWdU,11979
+mainsequence/server/fastapi.py,sha256=M5zDoFIu9MzuQZdLOXvQPU9Yyqyf_GyXWVn_aravHH4,20123
 mainsequence/server/mcp_skills.py,sha256=-krRwAHCAMipScgGJ19uVkzznhTop1Nz4C_wRY1GUpw,16690
 mainsequence/server/_mcp_skills_upstream/__init__.py,sha256=px283qBMf3z1nxCfN3WHrH9v8Y8jOb1xoBqZMRZcaD8,2694
 mainsequence/server/_mcp_skills_upstream/server.py,sha256=laHsfpoaYX3LcwQ04-GN7r0_C63fG6CzyXDci2rmbHE,7695
 mainsequence/server/_mcp_skills_upstream/shared.py,sha256=JmnX9PoLoyi93nBYnUEPWCdPXor_nQHjHptQDXpFzPs,11978
-mainsequence-9.0.26.dev70.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.26.dev70.dist-info/METADATA,sha256=GDRoS2ymodPcySLWPHDt1dYbh2tB2LxZFBO2fWs1XQc,7531
-mainsequence-9.0.26.dev70.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.26.dev70.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.26.dev70.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.26.dev70.dist-info/RECORD,,
+mainsequence-9.0.27.dev71.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.27.dev71.dist-info/METADATA,sha256=fsXFdkTMGMsdDs7W1h_085WrAvjdsZrLr35ldgLPRpw,7531
+mainsequence-9.0.27.dev71.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.27.dev71.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.27.dev71.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.27.dev71.dist-info/RECORD,,