mainsequence 9.0.8.dev45__tar.gz → 9.0.9.dev46__tar.gz

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.8.dev45
+Version: 9.0.9.dev46
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence/cli/browser_auth.py

@@ -15,7 +15,7 @@ import threading
 import time
 import webbrowser
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlparse
 
@@ -37,7 +37,8 @@ class BrowserAuthError(RuntimeError):
 class BrowserAuthCallback:
     """Authorization callback payload captured from the local loopback receiver."""
 
-    code: str | None = None
+    # The authorization code is a bearer credential: it stays out of repr() and str().
+    code: str | None = field(default=None, repr=False)
     state: str | None = None
     error: str | None = None
     error_description: str | None = None

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence/client/agent_runtime_models.py

@@ -353,7 +353,8 @@ class AgentRuntimePresence(BasePydanticModel):
 
 
 class AgentSessionRuntimeAccess(BasePydanticModel):
-    model_config = ConfigDict(extra="allow")
+    # A validation error must not echo the input: it holds the bearer token.
+    model_config = ConfigDict(extra="allow", hide_input_in_errors=True)
 
     coding_agent_service_uid: str | None = Field(
         None,
@@ -373,6 +374,7 @@ class AgentSessionRuntimeAccess(BasePydanticModel):
     token: str | None = Field(
         None,
         description="Bearer token that authorizes calls to the coding-agent gateway.",
+        repr=False,
     )
     expires_at: str | None = Field(
         None,

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence/client/models_foundry.py

@@ -7,7 +7,7 @@ from uuid import UUID
 
 import yaml
 from cachetools import TTLCache, cachedmethod
-from pydantic import Field, SecretStr
+from pydantic import ConfigDict, Field, SecretStr
 
 from .base import (
     BaseObjectOrm,
@@ -891,6 +891,10 @@ class Secret(
     BasePydanticModel,
     BaseObjectOrm,
 ):
+    # `value` is a SecretStr once read, but a validation error would echo the
+    # plaintext it was given.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     HYDRATE_FILTER_GET_FROM_DETAIL: ClassVar[bool] = True
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]]] = {
         "uid": ["in", "exact"],

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence/client/models_helpers.py

@@ -6,7 +6,7 @@ from decimal import Decimal
 from typing import Any, ClassVar, Literal
 from uuid import UUID
 
-from pydantic import BaseModel, Field, PositiveInt
+from pydantic import BaseModel, ConfigDict, Field, PositiveInt
 
 from .base import (
     BaseObjectOrm,
@@ -798,6 +798,10 @@ class ResourceReleaseRuntimePresence(BasePydanticModel):
 
 
 class ResourceReleaseRuntimeAccess(BasePydanticModel):
+    # `access` holds the runtime's bearer token, so neither repr() nor a
+    # validation error shows it.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     resource_release_uid: str
     # The canonical vocabulary ResourceRelease.release_kind reads (#119): this
     # payload names a release kind, so it names it the same way.
@@ -805,7 +809,7 @@ class ResourceReleaseRuntimeAccess(BasePydanticModel):
     routing: ResourceReleaseRuntimeRouting
     runtime_access: ResourceReleaseRuntimeAdmission
     runtime_presence: ResourceReleaseRuntimePresence
-    access: dict[str, Any] | None = None
+    access: dict[str, Any] | None = Field(default=None, repr=False)
 
 
 class ResourceRelease(

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence/client/utils.py

@@ -278,8 +278,9 @@ class BaseAuthProvider:
 
 @dataclass
 class SessionJWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     header_keyword: str = "Bearer"
 
     def __post_init__(self):
@@ -324,12 +325,13 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
     `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
     exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
     Otherwise the proof is that bootstrap secret. The token is never kept on the
-    provider. Throttled (`429`) and temporarily unavailable (`503`) exchanges are
-    retried within the timeout budget; a rejected one (`401`) fails at once.
+    provider, and the secret is left out of `repr()` and `str()`. Throttled
+    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
+    timeout budget; a rejected one (`401`) fails at once.
     """
 
     credential_id: str | None = None
-    credential_secret: str | None = None
+    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
@@ -481,8 +483,9 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
 @dataclass
 class JWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     refresh_url: str | None = None
     obtain_url: str | None = None
     header_keyword: str = "Bearer"

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.8.dev45
+Version: 9.0.9.dev46
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/mainsequence.egg-info/SOURCES.txt

@@ -75,6 +75,7 @@ tests/test_code_repository_branch_contract.py
 tests/test_code_repository_documentation_contract.py
 tests/test_code_repository_runtime_context.py
 tests/test_code_repository_skills.py
+tests/test_credential_repr.py
 tests/test_dependency_extras.py
 tests/test_dev_release_version.py
 tests/test_environment_resource_context.py

{mainsequence-9.0.8.dev45 → mainsequence-9.0.9.dev46}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.8.dev45"
+version = "9.0.9.dev46"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

mainsequence-9.0.9.dev46/tests/test_credential_repr.py

@@ -0,0 +1,172 @@
+"""Credentials stay out of repr(), str(), log lines and validation errors.
+
+Each object below holds a credential and still uses it: only the text the object
+becomes when it is printed, formatted or logged leaves the credential out.
+"""
+
+from __future__ import annotations
+
+import logging
+
+import pydantic
+import pytest
+
+from mainsequence.cli.browser_auth import BrowserAuthCallback
+from mainsequence.client.agent_runtime_models import AgentSessionRuntimeAccess
+from mainsequence.client.models_foundry import Secret
+from mainsequence.client.models_helpers import ResourceReleaseRuntimeAccess
+from mainsequence.client.utils import (
+    JWTAuthProvider,
+    RuntimeCredentialAuthProvider,
+    SessionJWTAuthProvider,
+)
+from tests.client.support import _ready_runtime_contract, _runtime_access_payload
+
+BOOTSTRAP_SECRET = "bootstrap-secret-7c1d"
+ACCESS_TOKEN = "access-token-5e2a"
+REFRESH_TOKEN = "refresh-token-9b4f"
+GATEWAY_TOKEN = "gateway-token-3a8e"
+RELEASE_TOKEN = "release-token-6d0c"
+AUTHORIZATION_CODE = "authorization-code-2f7b"
+SECRET_VALUE = "secret-value-8e5a"
+TOKEN_URL = "https://backend.example/api/v1/runtime-credentials/token/"
+
+
+def _shown(obj, caplog) -> str:
+    """Return repr(), str() and a log line that formats the object both ways."""
+    caplog.clear()
+    caplog.set_level(logging.INFO, logger=__name__)
+    logging.getLogger(__name__).info("%s %r", obj, obj)
+    return "\n".join((repr(obj), str(obj), caplog.text))
+
+
+def _error_text(raised: pytest.ExceptionInfo) -> str:
+    return f"{raised.value}\n{raised.value!r}"
+
+
+@pytest.mark.parametrize("source", ["environment", "argument"])
+def test_runtime_credential_provider_leaves_the_bootstrap_secret_out(monkeypatch, caplog, source):
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
+    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
+    if source == "environment":
+        monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", BOOTSTRAP_SECRET)
+        provider = RuntimeCredentialAuthProvider(token_url=TOKEN_URL)
+    else:
+        monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
+        provider = RuntimeCredentialAuthProvider(
+            credential_secret=BOOTSTRAP_SECRET, token_url=TOKEN_URL
+        )
+
+    shown = _shown(provider, caplog)
+
+    assert provider.credential_secret == BOOTSTRAP_SECRET
+    assert BOOTSTRAP_SECRET not in shown
+    assert "credential_id='cred-id'" in shown
+
+
+def test_jwt_provider_leaves_its_tokens_out(monkeypatch, caplog):
+    monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", ACCESS_TOKEN)
+    monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", REFRESH_TOKEN)
+
+    for provider in (
+        JWTAuthProvider(),
+        JWTAuthProvider(access_token=ACCESS_TOKEN, refresh_token=REFRESH_TOKEN),
+    ):
+        shown = _shown(provider, caplog)
+
+        assert provider.get_headers()["Authorization"] == f"Bearer {ACCESS_TOKEN}"
+        assert provider.refresh_token == REFRESH_TOKEN
+        assert ACCESS_TOKEN not in shown
+        assert REFRESH_TOKEN not in shown
+        assert "header_keyword='Bearer'" in shown
+
+
+def test_session_jwt_provider_leaves_its_token_out(monkeypatch, caplog):
+    monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", ACCESS_TOKEN)
+    monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
+    provider = SessionJWTAuthProvider()
+
+    shown = _shown(provider, caplog)
+
+    assert provider.get_headers()["Authorization"] == f"Bearer {ACCESS_TOKEN}"
+    assert ACCESS_TOKEN not in shown
+    assert "header_keyword='Bearer'" in shown
+
+
+def test_agent_session_runtime_access_leaves_its_token_out(caplog):
+    access = AgentSessionRuntimeAccess.model_validate(
+        {
+            "mode": "token",
+            "rpc_url": "https://runtime.example/",
+            "token": GATEWAY_TOKEN,
+            **_ready_runtime_contract(),
+        }
+    )
+
+    shown = _shown(access, caplog)
+
+    assert access.token == GATEWAY_TOKEN
+    assert access.model_dump()["token"] == GATEWAY_TOKEN
+    assert GATEWAY_TOKEN not in shown
+    assert "rpc_url='https://runtime.example/'" in shown
+
+
+def test_agent_session_runtime_access_validation_error_leaves_the_token_out():
+    with pytest.raises(pydantic.ValidationError) as raised:
+        AgentSessionRuntimeAccess.model_validate({"mode": "token", "token": GATEWAY_TOKEN})
+
+    assert "runtime_interaction" in str(raised.value)
+    assert GATEWAY_TOKEN not in _error_text(raised)
+
+
+def _release_runtime_access_payload() -> dict:
+    payload = _runtime_access_payload(state="ready", can_request=True)
+    payload["access"]["token"] = RELEASE_TOKEN
+    return payload
+
+
+def test_resource_release_runtime_access_leaves_its_token_out(caplog):
+    access = ResourceReleaseRuntimeAccess.model_validate(_release_runtime_access_payload())
+
+    shown = _shown(access, caplog)
+
+    assert access.access["token"] == RELEASE_TOKEN
+    assert access.model_dump()["access"]["token"] == RELEASE_TOKEN
+    assert RELEASE_TOKEN not in shown
+    assert "resource_release_uid='2f4c4c3d-5669-4da5-9d86-b84633c1e6ed'" in shown
+
+
+def test_resource_release_runtime_access_validation_error_leaves_the_token_out():
+    payload = _release_runtime_access_payload()
+    del payload["routing"]
+    # A shown input is cut in its middle; this order puts the token at its end.
+    payload["access"] = {"mode": "token", "token": RELEASE_TOKEN}
+
+    with pytest.raises(pydantic.ValidationError) as raised:
+        ResourceReleaseRuntimeAccess.model_validate(payload)
+
+    assert "routing" in str(raised.value)
+    assert RELEASE_TOKEN not in _error_text(raised)
+
+
+def test_secret_leaves_its_value_out(caplog):
+    secret = Secret(name="POLYGON_API_KEY", value=SECRET_VALUE)
+
+    shown = _shown(secret, caplog)
+
+    assert secret.value.get_secret_value() == SECRET_VALUE
+    assert SECRET_VALUE not in shown
+    with pytest.raises(pydantic.ValidationError) as raised:
+        Secret.model_validate({"value": SECRET_VALUE})
+    assert "name" in str(raised.value)
+    assert SECRET_VALUE not in _error_text(raised)
+
+
+def test_browser_auth_callback_leaves_the_authorization_code_out(caplog):
+    callback = BrowserAuthCallback(code=AUTHORIZATION_CODE, state="state-1")
+
+    shown = _shown(callback, caplog)
+
+    assert callback.code == AUTHORIZATION_CODE
+    assert AUTHORIZATION_CODE not in shown
+    assert "state='state-1'" in shown