oauth-haystack 1.0.0__tar.gz → 2.0.0__tar.gz

oauth_haystack-2.0.0/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+## [integrations/oauth-v1.0.1] - 2026-08-24
+
+### 🐛 Bug Fixes
+
+- Fix new issues raised by ruff 0.16.0 (#3670)
+- *(oauth)* Rebuild the OAuthRefreshTokenSource refresh lock per event loop (#3790)
+
+### 🧪 Testing
+
+- Trust test modules under Haystack 3.0's deserialization allowlist (#3537)
+
+### 🧹 Chores
+
+- Re-standardize READMEs (#3768)
+
+
+## [integrations/oauth-v1.0.0] - 2026-06-18
+
+### 🚀 Features
+
+- *(oauth)* Add OAuth integration (#3419)
+
+<!-- generated by git-cliff -->

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: oauth-haystack
-Version: 1.0.0
+Version: 2.0.0
 Summary: Haystack integration for oauth
 Project-URL: Documentation, https://github.com/deepset-ai/haystack-core-integrations/tree/main/integrations/oauth#readme
 Project-URL: Issues, https://github.com/deepset-ai/haystack-core-integrations/issues
@@ -12,14 +12,14 @@ Keywords: authentication,haystack,oauth
 Classifier: Development Status :: 4 - Beta
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Requires-Dist: haystack-ai>=2.23.0
 Requires-Dist: httpx>=0.28.0
 Description-Content-Type: text/markdown
@@ -29,6 +29,7 @@ Description-Content-Type: text/markdown
 [![PyPI - Version](https://img.shields.io/pypi/v/oauth-haystack.svg)](https://pypi.org/project/oauth-haystack)
 [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/oauth-haystack.svg)](https://pypi.org/project/oauth-haystack)
 
+- [Integration page](https://haystack.deepset.ai/integrations/oauth)
 - [Changelog](https://github.com/deepset-ai/haystack-core-integrations/blob/main/integrations/oauth/CHANGELOG.md)
 
 ---

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/README.md

@@ -3,6 +3,7 @@
 [![PyPI - Version](https://img.shields.io/pypi/v/oauth-haystack.svg)](https://pypi.org/project/oauth-haystack)
 [![PyPI - Python Version](https://img.shields.io/pypi/pyversions/oauth-haystack.svg)](https://pypi.org/project/oauth-haystack)
 
+- [Integration page](https://haystack.deepset.ai/integrations/oauth)
 - [Changelog](https://github.com/deepset-ai/haystack-core-integrations/blob/main/integrations/oauth/CHANGELOG.md)
 
 ---

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/pyproject.toml

@@ -7,7 +7,7 @@ name = "oauth-haystack"
 dynamic = ["version"]
 description = "Haystack integration for oauth"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 license = "Apache-2.0"
 keywords = [
   "haystack",
@@ -19,11 +19,11 @@ classifiers = [
   "License :: OSI Approved :: Apache Software License",
   "Development Status :: 4 - Beta",
   "Programming Language :: Python",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
   "Programming Language :: Python :: Implementation :: CPython",
   "Programming Language :: Python :: Implementation :: PyPy",
 ]
@@ -132,6 +132,7 @@ ignore = [
     "PLR0912",
     "PLR0913",
     "PLR0915",
+    "PLR0917",
     # Allow `Any` type - used legitimately for dynamic types and SDK boundaries
     "ANN401",
 ]

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/src/haystack_integrations/utils/oauth/sources.py

@@ -12,7 +12,7 @@ from typing import Any, Literal
 
 import httpx
 from haystack import default_from_dict, default_to_dict, logging
-from haystack.utils import Secret, deserialize_callable, deserialize_secrets_inplace, serialize_callable
+from haystack.utils import Secret, deserialize_callable, serialize_callable
 
 from .errors import OAuthConfigError, TokenRefreshError
 
@@ -121,7 +121,10 @@ class OAuthRefreshTokenSource:
 
         # Runtime state — never serialized.
         self._sync_lock = Lock()
+        # `_async_lock_guard` only guards the creation of `_async_lock`; see `_get_async_lock`.
+        self._async_lock_guard = Lock()
         self._async_lock: asyncio.Lock | None = None
+        self._async_lock_loop: asyncio.AbstractEventLoop | None = None
         self._cached_token: str | None = None
         self._expires_at: float = 0.0
         self._current_refresh_token: str | None = None
@@ -178,13 +181,29 @@ class OAuthRefreshTokenSource:
             )
             return self._handle_response(response)
 
+    def _get_async_lock(self) -> asyncio.Lock:
+        """
+        Return the refresh lock for the running event loop, building it if there isn't one yet.
+
+        The lock cannot be created in `__init__`, which is synchronous and may run with no loop. It also cannot be
+        created once and kept for the lifetime of the source: an `asyncio.Lock` binds itself to the loop that first
+        awaits it under contention, and raises `RuntimeError` when awaited from any other one. A source routinely
+        outlives the loop that first used it — one `asyncio.run` per request is a common deployment — so the lock is
+        rebuilt whenever the running loop changes.
+
+        `_async_lock_guard` is held for the check and the assignment only, never across an await, so that two threads
+        driving separate event loops cannot each install a lock and lose mutual exclusion between them.
+        """
+        loop = asyncio.get_running_loop()
+        with self._async_lock_guard:
+            if self._async_lock is None or self._async_lock_loop is not loop:
+                self._async_lock = asyncio.Lock()
+                self._async_lock_loop = loop
+            return self._async_lock
+
     async def resolve_async(self) -> str:
         """Asynchronous counterpart of `resolve`. Use a single instance in either sync or async mode, not both."""
-        # Create the asyncio.Lock lazily (not in __init__): it must bind to the running event loop, but __init__
-        # is sync and may run without one.
-        if self._async_lock is None:
-            self._async_lock = asyncio.Lock()
-        async with self._async_lock:
+        async with self._get_async_lock():
             cached = self._cached_if_valid()
             if cached is not None:
                 return cached
@@ -216,7 +235,6 @@ class OAuthRefreshTokenSource:
     def from_dict(cls, data: dict[str, Any]) -> "OAuthRefreshTokenSource":
         """Deserialize the source from a dictionary."""
         init_params = data["init_parameters"]
-        deserialize_secrets_inplace(init_params, keys=["refresh_token", "client_secret"])
         if init_params.get("on_rotate"):
             init_params["on_rotate"] = deserialize_callable(init_params["on_rotate"])
         return default_from_dict(cls, data)
@@ -431,7 +449,6 @@ class OAuthTokenExchangeSource:
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> "OAuthTokenExchangeSource":
         """Deserialize the source from a dictionary."""
-        deserialize_secrets_inplace(data["init_parameters"], keys=["client_secret"])
         return default_from_dict(cls, data)
 
 
@@ -482,5 +499,4 @@ class OAuthStaticTokenSource:
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> "OAuthStaticTokenSource":
         """Deserialize the source from a dictionary."""
-        deserialize_secrets_inplace(data["init_parameters"], keys=["token"])
         return default_from_dict(cls, data)

oauth_haystack-2.0.0/tests/conftest.py

@@ -0,0 +1,11 @@
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def allow_deserialization_of_test_modules(monkeypatch):
+    """
+    haystack-ai >= 3.0 refuses to deserialize classes and callables from modules outside its
+    trusted-module allowlist. Tools and callbacks defined in the test modules live outside that
+    allowlist, so trust them explicitly; haystack-ai 2.x ignores this environment variable.
+    """
+    monkeypatch.setenv("HAYSTACK_DESERIALIZATION_ALLOWLIST", "tests,test_*")

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/tests/test_resolver.py

@@ -7,6 +7,7 @@ from typing import Any, Literal
 
 import pytest
 from haystack import Pipeline
+from haystack.core.errors import DeserializationError
 from haystack.utils import Secret
 
 from haystack_integrations.components.connectors.oauth import OAuthTokenResolver
@@ -183,7 +184,9 @@ class TestOAuthTokenResolverSerialization:
             "type": "haystack_integrations.components.connectors.oauth.resolver.OAuthTokenResolver",
             "init_parameters": {"token_source": {"type": "some.unknown.Source", "init_parameters": {}}},
         }
-        with pytest.raises(ImportError):
+        # haystack-ai 2.x fails to import the unknown module; haystack-ai >= 3.0 refuses it upfront
+        # because it is not on the trusted-module allowlist
+        with pytest.raises((ImportError, DeserializationError)):
             OAuthTokenResolver.from_dict(data)
 
 

{oauth_haystack-1.0.0 → oauth_haystack-2.0.0}/tests/test_sources.py

@@ -2,6 +2,7 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
+import asyncio
 from unittest.mock import patch
 
 import httpx
@@ -148,6 +149,45 @@ class TestOAuthRefreshTokenSource:
         assert token == "acc-async"
         assert mp.call_count == 1
 
+    @pytest.mark.asyncio
+    async def test_concurrent_resolve_async_refreshes_once(self):
+        """The refresh lock exists to collapse a burst of concurrent callers into a single network refresh."""
+        source = self._source()
+        with patch("httpx.AsyncClient.post", side_effect=self._slow_post("acc-async")) as mp:
+            tokens = await asyncio.gather(*(source.resolve_async() for _ in range(4)))
+        assert tokens == ["acc-async"] * 4
+        assert mp.call_count == 1
+
+    def test_resolve_async_works_in_a_second_event_loop(self):
+        """
+        A source outlives the loop that first used it: one `asyncio.run` per request is a common deployment.
+
+        An `asyncio.Lock` binds to the loop that first awaits it *under contention* and rejects every other one, so
+        a lock built once and cached on the instance made the second loop's first contended refresh raise
+        `RuntimeError: ... is bound to a different event loop`. Both halves of this test must contend for the lock,
+        otherwise the lock is never bound and the bug does not reproduce.
+        """
+        source = self._source()
+
+        async def two_concurrent_callers() -> list[str]:
+            # expires_in=0 keeps the cache from serving the second round, so both rounds really refresh.
+            with patch("httpx.AsyncClient.post", side_effect=self._slow_post("acc-async", expires_in=0)):
+                return list(await asyncio.gather(source.resolve_async(), source.resolve_async()))
+
+        assert asyncio.run(two_concurrent_callers()) == ["acc-async"] * 2
+        # Same source, brand new event loop.
+        assert asyncio.run(two_concurrent_callers()) == ["acc-async"] * 2
+
+    @staticmethod
+    def _slow_post(access_token: str, expires_in: int = 3600):
+        """A patched `post` that yields to the loop, so a second caller reaches the lock while the first holds it."""
+
+        async def _post(*_args, **_kwargs):
+            await asyncio.sleep(0)
+            return _json(access_token=access_token, expires_in=expires_in)
+
+        return _post
+
 
 class TestOAuthTokenExchangeSource:
     def _source(self, **kwargs):