mantelo 2.2.1__tar.gz → 2.2.2__tar.gz

{mantelo-2.2.1 → mantelo-2.2.2}/.gitignore

@@ -12,3 +12,4 @@ mantelo/version.py
 __pycache__
 
 docs/_build
+.ruff_cache/

mantelo-2.2.2/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"2.2.2"}

{mantelo-2.2.1 → mantelo-2.2.2}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [2.2.2](https://github.com/derlin/mantelo/compare/v2.2.1...v2.2.2) (2026-11-11)
+
+
+### 🐛 Bug Fixes
+
+* grant kc-admin-api scope to test client for keycloak 26.8.2 ([458eee9](https://github.com/derlin/mantelo/commit/458eee9f2ce9a4969adf2be1aa1aea8ba0349caa))
+
+
+### 💬 Documentation
+
+* state tested keycloak versions ([a0a07bc](https://github.com/derlin/mantelo/commit/a0a07bc97ea7a5092d69429fdddf1e0f30ddd663))
+
+
+### 🦀 Build and CI
+
+* keep a stable build check for branch protection ([94d655b](https://github.com/derlin/mantelo/commit/94d655b852bf28ac44d56a1730630f954a5d4ee4))
+* test against oldest supported and latest keycloak ([55bf108](https://github.com/derlin/mantelo/commit/55bf108a0d7f096748b0a0a2bb9114dde23c0f35))
+* update actions to latest ([764f83b](https://github.com/derlin/mantelo/commit/764f83be18aa37c249b7a15b30738fcf6e1966d8))
+
 ## [2.2.1](https://github.com/derlin/mantelo/compare/v2.2.0...v2.2.1) (2026-04-13)
 
 

{mantelo-2.2.1 → mantelo-2.2.2}/CONTRIBUTING.md

@@ -54,7 +54,8 @@ Documentation
   docs-open  Open the documentation locally (requires make docs to have ran).
 
 Development
-  lint   Run ruff to format and lint (inside docker).
+  lint   Check formatting and lint with ruff.
+  format  Format and auto-fix with ruff.
   test   Run tests with tox (inside docker).
   mypy   Run mypy locally to check types.
   export-realms  Export test realms after changes in Keycloak Test Server.

{mantelo-2.2.1 → mantelo-2.2.2}/Makefile

@@ -1,4 +1,4 @@
-.PHONY: all help build docs lint test mypy export-realms
+.PHONY: all help build docs lint format test mypy export-realms
 
 default: help
 
@@ -30,8 +30,13 @@ docs-test: ## Test the documentation code snippets.
 
 ##@ Development
 
-lint: ## Run ruff to format and lint (inside docker).
-	docker run --rm -e LINT_FOLDER_PYTHON=mantelo -v $(CURDIR):/app divio/lint /bin/lint ${ARGS} --run=python
+lint: ## Check formatting and lint with ruff.
+	ruff format --check mantelo tests
+	ruff check mantelo tests
+
+format: ## Format and auto-fix with ruff.
+	ruff format mantelo tests
+	ruff check --fix --show-fixes mantelo tests
 
 test: ## Run tests with tox (inside docker).
 	coverage erase || true

{mantelo-2.2.1 → mantelo-2.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mantelo
-Version: 2.2.1
+Version: 2.2.2
 Summary: ✨ Keycloak Admin REST Api Client for Python ✨
 Author-email: Lucy Linder <lucy.derlin@gmail.com>
 License:                                  Apache License
@@ -230,6 +230,7 @@ Requires-Dist: attrs
 Requires-Dist: requests
 Provides-Extra: dev
 Requires-Dist: build; extra == "dev"
+Requires-Dist: ruff; extra == "dev"
 Requires-Dist: coverage; extra == "dev"
 Requires-Dist: tox; extra == "dev"
 Requires-Dist: mypy; extra == "dev"
@@ -313,6 +314,8 @@ To get started, install the package:
 pip install mantelo
 ```
 
+CI tests mantelo against Keycloak 26.0 and the latest release. Older versions may work, but are not tested.
+
 Now, assuming you have a Keycloak Server running, what's left is to:
 
 1. authenticate, see [🔐 Authenticate to Keycloak](#-authenticate-to-keycloak)
@@ -408,7 +411,8 @@ client = KeycloakAdmin.from_username_password(
 > - to have "Client authentication" enabled,
 > - to support the `Service accounts roles` authentication flow,
 > 
-> - to have one or more service account roles granting access to Admin endpoints.
+> - to have one or more service account roles granting access to Admin endpoints,
+> - since Keycloak 26.8.2, to have the `kc-admin-api` client scope as a default scope.
 > 
 > Go to your client's "Credentials" tab to find the client secret.
 

{mantelo-2.2.1 → mantelo-2.2.2}/README.md

@@ -64,6 +64,8 @@ To get started, install the package:
 pip install mantelo
 ```
 
+CI tests mantelo against Keycloak 26.0 and the latest release. Older versions may work, but are not tested.
+
 Now, assuming you have a Keycloak Server running, what's left is to:
 
 1. authenticate, see [🔐 Authenticate to Keycloak](#-authenticate-to-keycloak)
@@ -159,7 +161,8 @@ client = KeycloakAdmin.from_username_password(
 > - to have "Client authentication" enabled,
 > - to support the `Service accounts roles` authentication flow,
 > 
-> - to have one or more service account roles granting access to Admin endpoints.
+> - to have one or more service account roles granting access to Admin endpoints,
+> - since Keycloak 26.8.2, to have the `kc-admin-api` client scope as a default scope.
 > 
 > Go to your client's "Credentials" tab to find the client secret.
 

{mantelo-2.2.1 → mantelo-2.2.2}/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   keycloak:
-    image: quay.io/keycloak/keycloak:latest
+    image: quay.io/keycloak/keycloak:${KEYCLOAK_VERSION:-latest}
     command: start-dev --import-realm
     ports:
       - 9090:8080

{mantelo-2.2.1 → mantelo-2.2.2}/docs/00-getting_started.rst

@@ -15,6 +15,8 @@ To get started, install the package:
 
     pip install mantelo
 
+CI tests mantelo against Keycloak 26.0 and the latest release. Older versions may work, but are not tested.
+
 Now, assuming you have a Keycloak Server running, what's left is to:
 
 1. authenticate to Keycloak, :ref:`authentication`

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo/__init__.py

@@ -8,4 +8,4 @@ from .client import KeycloakAdmin
 from .exceptions import AuthenticationException, HttpException
 
 
-__all__ = ["KeycloakAdmin", "AuthenticationException", "HttpException"]
+__all__ = ["AuthenticationException", "HttpException", "KeycloakAdmin"]

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo/connection.py

@@ -116,11 +116,8 @@ class Token:
 
         :return: True if a refresh token exists and is still valid.
         """
-        if (exp := self.refresh_expires_at) and _now() < (
-            exp - timedelta(seconds=2)
-        ):
-            return True
-        return False
+        exp = self.refresh_expires_at
+        return bool(exp and _now() < (exp - timedelta(seconds=2)))
 
     @classmethod
     def from_dict(cls, data: dict, now: datetime | None = None) -> "Token":

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo/exceptions.py

@@ -1,3 +1,5 @@
+import contextlib
+
 import requests
 from attrs import field, frozen
 
@@ -41,11 +43,9 @@ class HttpException(ManteloException):
     @classmethod
     def from_response(cls, response: requests.Response) -> "HttpException":
         json = {}
-        try:
-            # Most API use JSON, but not all!
+        # Most API use JSON, but not all!
+        with contextlib.suppress(Exception):
             json = response.json()
-        except Exception:  # noqa: S110
-            pass
 
         return cls(
             url=response.request.url or "",

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo/version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.2.1'
-__version_tuple__ = version_tuple = (2, 2, 1)
+__version__ = version = '2.2.2'
+__version_tuple__ = version_tuple = (2, 2, 2)
 
-__commit_id__ = commit_id = 'g19e2c97f3'
+__commit_id__ = commit_id = 'g40c5e5f7a'

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mantelo
-Version: 2.2.1
+Version: 2.2.2
 Summary: ✨ Keycloak Admin REST Api Client for Python ✨
 Author-email: Lucy Linder <lucy.derlin@gmail.com>
 License:                                  Apache License
@@ -230,6 +230,7 @@ Requires-Dist: attrs
 Requires-Dist: requests
 Provides-Extra: dev
 Requires-Dist: build; extra == "dev"
+Requires-Dist: ruff; extra == "dev"
 Requires-Dist: coverage; extra == "dev"
 Requires-Dist: tox; extra == "dev"
 Requires-Dist: mypy; extra == "dev"
@@ -313,6 +314,8 @@ To get started, install the package:
 pip install mantelo
 ```
 
+CI tests mantelo against Keycloak 26.0 and the latest release. Older versions may work, but are not tested.
+
 Now, assuming you have a Keycloak Server running, what's left is to:
 
 1. authenticate, see [🔐 Authenticate to Keycloak](#-authenticate-to-keycloak)
@@ -408,7 +411,8 @@ client = KeycloakAdmin.from_username_password(
 > - to have "Client authentication" enabled,
 > - to support the `Service accounts roles` authentication flow,
 > 
-> - to have one or more service account roles granting access to Admin endpoints.
+> - to have one or more service account roles granting access to Admin endpoints,
+> - since Keycloak 26.8.2, to have the `kc-admin-api` client scope as a default scope.
 > 
 > Go to your client's "Credentials" tab to find the client secret.
 

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo.egg-info/SOURCES.txt

@@ -41,6 +41,8 @@ mantelo.egg-info/PKG-INFO
 mantelo.egg-info/SOURCES.txt
 mantelo.egg-info/dependency_links.txt
 mantelo.egg-info/requires.txt
+mantelo.egg-info/scm_file_list.json
+mantelo.egg-info/scm_version.json
 mantelo.egg-info/top_level.txt
 mantelo/internal/__init__.py
 mantelo/internal/api.py

{mantelo-2.2.1 → mantelo-2.2.2}/mantelo.egg-info/requires.txt

@@ -3,6 +3,7 @@ requests
 
 [dev]
 build
+ruff
 coverage
 tox
 mypy

mantelo-2.2.2/mantelo.egg-info/scm_file_list.json

@@ -0,0 +1,58 @@
+{
+  "files": [
+    ".github/workflows/build.yml",
+    ".github/workflows/release-please-config.json",
+    ".github/workflows/release.yml",
+    ".github/workflows/weekly.yml",
+    ".gitignore",
+    ".readthedocs.yaml",
+    ".release-please-manifest.json",
+    "CHANGELOG.md",
+    "CODEOWNERS",
+    "CONTRIBUTING.md",
+    "LICENSE",
+    "MANIFEST.in",
+    "Makefile",
+    "README.md",
+    "docker-compose.yml",
+    "docs/00-getting_started.rst",
+    "docs/01-authentication.rst",
+    "docs/02-making-calls.rst",
+    "docs/03-examples.rst",
+    "docs/04-faq.rst",
+    "docs/90-api.rst",
+    "docs/Makefile",
+    "docs/_static/css/custom.css",
+    "docs/_static/images/mantelo-128.png",
+    "docs/_static/images/mantelo-256.png",
+    "docs/_static/images/mantelo-512.png",
+    "docs/_static/images/mantelo-social-preview.png",
+    "docs/_static/images/mantelo-text-900.png",
+    "docs/_static/images/mantelo.ico",
+    "docs/_static/images/mantelo.svg",
+    "docs/_templates/.gitkeep",
+    "docs/_templates/layout.html",
+    "docs/conf.py",
+    "docs/index.rst",
+    "docs/make.bat",
+    "mantelo/__init__.py",
+    "mantelo/client.py",
+    "mantelo/connection.py",
+    "mantelo/exceptions.py",
+    "mantelo/internal/__init__.py",
+    "mantelo/internal/api.py",
+    "mantelo/internal/serializers.py",
+    "mantelo/py.typed",
+    "pyproject.toml",
+    "tests/__init__.py",
+    "tests/conftest.py",
+    "tests/constants.py",
+    "tests/internal/test_api.py",
+    "tests/internal/test_serialiers.py",
+    "tests/realms/master-realm.json",
+    "tests/realms/orwell-realm.json",
+    "tests/test_client.py",
+    "tests/test_connection.py",
+    "tox.ini"
+  ]
+}

mantelo-2.2.2/mantelo.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.2.2",
+  "distance": 0,
+  "node": "g40c5e5f7a89f4a1b717762d7b0e77d203eceedb2",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-11-11"
+}

{mantelo-2.2.1 → mantelo-2.2.2}/pyproject.toml

@@ -47,6 +47,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
   "build",
+  "ruff",
   "coverage",
   "tox",
   "mypy",
@@ -98,14 +99,61 @@ write_to = "mantelo/version.py"
 
 
 [tool.ruff]
-extend = "/presets/ruff.toml"
-target-version = "py310"      # lowest supported version
+line-length = 79
+target-version = "py310" # lowest supported version
 
 [tool.ruff.lint]
-extend-ignore = [
-  "S101",  # allow asserts
+# S101 (assert used) is deliberately not selected: we allow asserts.
+select = [
+  "F",    # Pyflakes
+  "E",    # pycodestyle errors
+  "W",    # pycodestyle warnings
+  "I",    # isort
+  "UP",   # pyupgrade
+  "YTT",  # flake8-2020 (usage of sys package)
+  "S110", # try-except-pass detected, consider logging the exception
+  "B",    # flake8-bugbear
+  "C4",   # flake8-comprehensions
+  "T10",  # flake8-debugger
+  "EXE",  # flake8-executable
+  "FA",   # flake8-future-annotations
+  "ISC",  # flake8-implicit-str-concat
+  "PIE",  # flake8-pie (misc lints)
+  "T20",  # flake8-print
+  "PT",   # flake8-pytest-style
+  "RSE",  # flake8-raise
+  "RET",  # flake8-return
+  "SIM",  # flake8-simplify
+  "DTZ",  # flake8-datetimez (token expiry relies on aware datetimes)
+  "LOG",  # flake8-logging
+  "G",    # flake8-logging-format
+  "PERF", # perflint
+  "PLE",  # pylint ("E" subset)
+  "PLW",  # pylint ("W" subset)
+  "FLY",  # static join to f-string
+  "RUF",  # ruff miscellaneous lints
 ]
 
+ignore = [
+  "E501",    # line too long (the formatter owns line length)
+  "B904",    # raise-without-from-inside-except
+  "RET505",  # superfluous else return
+  "PLW2901", # redefined loop name
+  "RUF012",  # mutable class default
+  # Tests assert on the exception message via `excinfo.value`, which is
+  # stricter than `match=`, so requiring `match=` would be a step back.
+  "PT011",   # pytest.raises too broad
+
+  # conflicts with the ruff formatter
+  "W191",
+  "ISC001",
+  "ISC002",
+]
+
+[tool.ruff.lint.isort]
+lines-after-imports = 2
+lines-between-types = 0
+
 
 [tool.coverage.report]
 # Regexes for lines to exclude from consideration

{mantelo-2.2.1 → mantelo-2.2.2}/tests/conftest.py

@@ -2,17 +2,16 @@ from unittest.mock import MagicMock
 
 import pytest
 
-from mantelo.internal import serializers
 from mantelo.connection import (
     ClientCredentialsConnection,
     UsernamePasswordConnection,
 )
-from mantelo.internal import api
+from mantelo.internal import api, serializers
 
 from . import constants
 
 
-@pytest.fixture()
+@pytest.fixture
 def openid_connection_password():
     return UsernamePasswordConnection(
         server_url=constants.TEST_SERVER_URL,
@@ -23,7 +22,7 @@ def openid_connection_password():
     )
 
 
-@pytest.fixture()
+@pytest.fixture
 def openid_connection_sa():
     return ClientCredentialsConnection(
         server_url=constants.TEST_SERVER_URL,
@@ -33,7 +32,7 @@ def openid_connection_sa():
     )
 
 
-@pytest.fixture()
+@pytest.fixture
 def openid_connection_admin():
     return UsernamePasswordConnection(
         server_url=constants.TEST_SERVER_URL,
@@ -44,7 +43,7 @@ def openid_connection_admin():
     )
 
 
-@pytest.fixture()
+@pytest.fixture
 def mock_session():
     session = MagicMock()
     session.request.return_value = MagicMock(status_code=200)
@@ -55,7 +54,7 @@ def mock_session():
     return session
 
 
-@pytest.fixture()
+@pytest.fixture
 def mock_store(mock_session):
     return api.Store(
         base_url="https://example.com",

{mantelo-2.2.1 → mantelo-2.2.2}/tests/realms/orwell-realm.json

@@ -574,6 +574,28 @@
     ]
   },
   "clientScopes": [
+    {
+      "attributes": {
+        "display.on.consent.screen": "false",
+        "include.in.token.scope": "true"
+      },
+      "description": "Grants access to the Keycloak Admin REST API by adding its required audience to the token",
+      "name": "kc-admin-api",
+      "protocol": "openid-connect",
+      "protocolMappers": [
+        {
+          "config": {
+            "access.token.claim": "true",
+            "introspection.token.claim": "true",
+            "lightweight.claim": "true"
+          },
+          "consentRequired": false,
+          "name": "admin-api-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-admin-api-audience-mapper"
+        }
+      ]
+    },
     {
       "attributes": {
         "consent.screen.text": "${offlineAccessScopeConsentText}",
@@ -1375,6 +1397,7 @@
       "defaultClientScopes": [
         "web-origins",
         "acr",
+        "kc-admin-api",
         "profile",
         "roles",
         "email"

{mantelo-2.2.1 → mantelo-2.2.2}/tests/test_connection.py

@@ -1,14 +1,15 @@
-import pytest
+from datetime import datetime, timedelta, timezone
 
+import pytest
+import requests
 from attrs import evolve
+
 from mantelo.connection import (
-    Token,
     AuthenticationException,
     ClientCredentialsConnection,
+    Token,
     UsernamePasswordConnection,
 )
-from datetime import datetime, timedelta, timezone
-import requests
 
 
 def test_token_from_dict():
@@ -35,7 +36,7 @@ def test_token_from_dict():
 
 
 def test_refresh_without_expire():
-    with pytest.raises(TypeError, match="Missing refresh_expires_in."):
+    with pytest.raises(TypeError, match=r"Missing refresh_expires_in\."):
         Token(
             access_token="<any>",
             expires_in=123,
@@ -145,12 +146,12 @@ def test_ClientCredentialsconnection_init():
 
 
 def test_openidconnection_default_values():
-    args = dict(
-        server_url="https://kc.test",
-        realm_name="test",
-        client_id="foo-client",
-        client_secret="s3cr3t",
-    )
+    args = {
+        "server_url": "https://kc.test",
+        "realm_name": "test",
+        "client_id": "foo-client",
+        "client_secret": "s3cr3t",
+    }
 
     # Defaults
     conn = ClientCredentialsConnection(**args)

mantelo-2.2.1/.release-please-manifest.json

@@ -1 +0,0 @@
-{".":"2.2.1"}

{mantelo-2.2.1 → mantelo-2.2.2}/tests/internal/test_api.py

@@ -3,8 +3,8 @@ from unittest.mock import MagicMock, Mock, PropertyMock
 import pytest
 import requests
 
-from mantelo.internal import api as _api
 from mantelo import exceptions
+from mantelo.internal import api as _api
 from mantelo.internal.serializers import JsonSerializer