onehouse-python-sdk 0.1.0__tar.gz

onehouse_python_sdk-0.1.0/.gitignore

@@ -0,0 +1,25 @@
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.egg
+*.egg-info/
+dist/
+build/
+.eggs/
+.venv/
+venv/
+env/
+.env
+*.env
+.tox/
+.pytest_cache/
+.coverage
+.mypy_cache/
+.ruff_cache/
+*.so
+
+# Test & coverage reports
+coverage.xml
+test-results.xml
+htmlcov/

onehouse_python_sdk-0.1.0/PKG-INFO

@@ -0,0 +1,134 @@
+Metadata-Version: 2.4
+Name: onehouse-python-sdk
+Version: 0.1.0
+Summary: Onehouse Python SDK — modular data-plane clients for LakeBase and beyond
+Project-URL: Homepage, https://github.com/onehouseinc/onehouse-python-sdk
+Project-URL: Repository, https://github.com/onehouseinc/onehouse-python-sdk
+Project-URL: Issues, https://github.com/onehouseinc/onehouse-python-sdk/issues
+Author-email: Onehouse Team <eng@onehouse.ai>
+License: Proprietary
+Keywords: auth,azure,lakebase,oauth2,oidc,onehouse,postgresql,saml
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Database
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Provides-Extra: dev
+Requires-Dist: pytest-cov>=4.0; extra == 'dev'
+Requires-Dist: pytest-mock>=3.0; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Provides-Extra: lakebase
+Requires-Dist: certifi>=2024.1; extra == 'lakebase'
+Requires-Dist: psycopg2-binary>=2.9; extra == 'lakebase'
+Description-Content-Type: text/markdown
+
+# onehouse-python-sdk
+
+Python SDK for connecting to [Onehouse](https://www.onehouse.ai) data-plane services.
+
+The base package has **zero required dependencies**. Drivers ship as optional extras so you only install what you need.
+
+```bash
+pip install onehouse-python-sdk[lakebase]
+```
+
+## LakeBase
+
+LakeBase is Onehouse's PostgreSQL-compatible managed lakehouse engine. This SDK provides a `psycopg2`-backed client that handles the browser-based and federated authentication flows LakeBase clusters require, on top of standard username/password auth.
+
+### Installation
+
+```bash
+pip install onehouse-python-sdk[lakebase]
+```
+
+Requires Python 3.9+.
+
+### Quickstart
+
+```python
+from onehouse_python_sdk import LakebaseClient
+
+# Username / password
+with LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    user="admin",
+    password="secret",
+) as client:
+    rows = client.fetchall("SELECT * FROM mytable WHERE id = %s", (42,))
+```
+
+### Authentication flows
+
+| Flow | Parameters |
+|------|------------|
+| Username / password | `user`, `password` |
+| OIDC Device Flow (Okta / Auth0) | `browser_auth=true`, `oidc_client_id`, `oidc_issuer_url`, `oidc_iam_role` |
+| Azure AD OAuth2 | `browser_auth=true`, `azure_oauth_tenant_id`, `azure_oauth_client_id`, `azure_oauth_client_secret` |
+| Azure Entra ID SAML | `browser_auth=true`, `azure_tenant_id`, `azure_entity_id` |
+| Built-in login form | `browser_auth=true` _(default when no IdP params are set)_ |
+| External redirect | `browser_auth=true`, `auth_redirect_url` |
+
+```python
+# OIDC Device Flow
+client = LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    browser_auth="true",
+    oidc_client_id="0oaXXXXX",
+    oidc_issuer_url="https://myorg.okta.com",
+    oidc_iam_role="arn:aws:iam::123456789012:role/LakeBaseRole",
+)
+
+# Azure AD OAuth2
+client = LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    browser_auth="true",
+    azure_oauth_tenant_id="your-tenant-id",
+    azure_oauth_client_id="your-client-id",
+    azure_oauth_client_secret="your-client-secret",
+)
+```
+
+DSN string form is also supported:
+
+```python
+client = LakebaseClient().connect(
+    "postgresql://<cluster-host>:5432/mydb"
+    "?browser_auth=true"
+    "&oidc_client_id=0oaXXXX"
+    "&oidc_issuer_url=https://myorg.okta.com"
+    "&oidc_iam_role=arn:aws:iam::123456789012:role/LakeBaseRole"
+)
+```
+
+### Client API
+
+All clients implement the `SqlClient` interface:
+
+| Method | Description |
+|--------|-------------|
+| `connect(dsn=None, **kwargs) → self` | Establish connection, returns self for chaining |
+| `execute(sql, params)` | Run a statement, return rowcount |
+| `fetchall(sql, params)` | Run a query, return `list[tuple]` |
+| `fetchone(sql, params)` | Run a query, return first row or `None` |
+| `cursor()` | Raw cursor for advanced use |
+| `raw_connection` | Underlying `psycopg2` connection |
+| `close()` | Close the connection |
+| `__enter__` / `__exit__` | Context manager — closes on exit |
+
+### Notes
+
+- **Credential caching** — auth tokens are cached for 4 minutes per connection parameters to avoid repeated browser prompts within the same process.
+- **Callback port** — the local auth callback server defaults to port `8888` at path `/lakebase`. Override with `auth_callback_port` and `auth_callback_path`.

onehouse_python_sdk-0.1.0/README.md

@@ -0,0 +1,104 @@
+# onehouse-python-sdk
+
+Python SDK for connecting to [Onehouse](https://www.onehouse.ai) data-plane services.
+
+The base package has **zero required dependencies**. Drivers ship as optional extras so you only install what you need.
+
+```bash
+pip install onehouse-python-sdk[lakebase]
+```
+
+## LakeBase
+
+LakeBase is Onehouse's PostgreSQL-compatible managed lakehouse engine. This SDK provides a `psycopg2`-backed client that handles the browser-based and federated authentication flows LakeBase clusters require, on top of standard username/password auth.
+
+### Installation
+
+```bash
+pip install onehouse-python-sdk[lakebase]
+```
+
+Requires Python 3.9+.
+
+### Quickstart
+
+```python
+from onehouse_python_sdk import LakebaseClient
+
+# Username / password
+with LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    user="admin",
+    password="secret",
+) as client:
+    rows = client.fetchall("SELECT * FROM mytable WHERE id = %s", (42,))
+```
+
+### Authentication flows
+
+| Flow | Parameters |
+|------|------------|
+| Username / password | `user`, `password` |
+| OIDC Device Flow (Okta / Auth0) | `browser_auth=true`, `oidc_client_id`, `oidc_issuer_url`, `oidc_iam_role` |
+| Azure AD OAuth2 | `browser_auth=true`, `azure_oauth_tenant_id`, `azure_oauth_client_id`, `azure_oauth_client_secret` |
+| Azure Entra ID SAML | `browser_auth=true`, `azure_tenant_id`, `azure_entity_id` |
+| Built-in login form | `browser_auth=true` _(default when no IdP params are set)_ |
+| External redirect | `browser_auth=true`, `auth_redirect_url` |
+
+```python
+# OIDC Device Flow
+client = LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    browser_auth="true",
+    oidc_client_id="0oaXXXXX",
+    oidc_issuer_url="https://myorg.okta.com",
+    oidc_iam_role="arn:aws:iam::123456789012:role/LakeBaseRole",
+)
+
+# Azure AD OAuth2
+client = LakebaseClient().connect(
+    host="<cluster-host>",
+    port=5432,
+    dbname="mydb",
+    browser_auth="true",
+    azure_oauth_tenant_id="your-tenant-id",
+    azure_oauth_client_id="your-client-id",
+    azure_oauth_client_secret="your-client-secret",
+)
+```
+
+DSN string form is also supported:
+
+```python
+client = LakebaseClient().connect(
+    "postgresql://<cluster-host>:5432/mydb"
+    "?browser_auth=true"
+    "&oidc_client_id=0oaXXXX"
+    "&oidc_issuer_url=https://myorg.okta.com"
+    "&oidc_iam_role=arn:aws:iam::123456789012:role/LakeBaseRole"
+)
+```
+
+### Client API
+
+All clients implement the `SqlClient` interface:
+
+| Method | Description |
+|--------|-------------|
+| `connect(dsn=None, **kwargs) → self` | Establish connection, returns self for chaining |
+| `execute(sql, params)` | Run a statement, return rowcount |
+| `fetchall(sql, params)` | Run a query, return `list[tuple]` |
+| `fetchone(sql, params)` | Run a query, return first row or `None` |
+| `cursor()` | Raw cursor for advanced use |
+| `raw_connection` | Underlying `psycopg2` connection |
+| `close()` | Close the connection |
+| `__enter__` / `__exit__` | Context manager — closes on exit |
+
+### Notes
+
+- **Credential caching** — auth tokens are cached for 4 minutes per connection parameters to avoid repeated browser prompts within the same process.
+- **Callback port** — the local auth callback server defaults to port `8888` at path `/lakebase`. Override with `auth_callback_port` and `auth_callback_path`.

onehouse_python_sdk-0.1.0/pyproject.toml

@@ -0,0 +1,64 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "onehouse-python-sdk"
+version = "0.1.0"
+description = "Onehouse Python SDK — modular data-plane clients for LakeBase and beyond"
+readme = "README.md"
+license = { text = "Proprietary" }
+requires-python = ">=3.9"
+authors = [{ name = "Onehouse Team", email = "eng@onehouse.ai" }]
+keywords = ["onehouse", "lakebase", "postgresql", "oidc", "saml", "azure", "oauth2", "auth"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: Other/Proprietary License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Database",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = []
+
+[project.optional-dependencies]
+lakebase = [
+    "psycopg2-binary>=2.9",
+    "certifi>=2024.1",
+]
+dev = [
+    "pytest>=7.0",
+    "pytest-cov>=4.0",
+    "pytest-mock>=3.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/onehouseinc/onehouse-python-sdk"
+Repository = "https://github.com/onehouseinc/onehouse-python-sdk"
+Issues = "https://github.com/onehouseinc/onehouse-python-sdk/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/onehouse_python_sdk"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "--cov=onehouse_python_sdk --cov-report=term-missing --cov-report=html"
+markers = [
+    "live: requires a running LakeBase cluster (set LAKEBASE_TEST_DSN)",
+]
+
+[tool.coverage.run]
+source = ["src/onehouse_python_sdk"]
+
+[tool.coverage.report]
+exclude_lines = [
+    "pragma: no cover",
+    "if __name__ == .__main__.:",
+]

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/__init__.py

@@ -0,0 +1,8 @@
+"""Onehouse Python SDK — modular data-plane and control-plane clients."""
+
+from . import exceptions
+from .base import SqlClient
+from .lakebase.client import LakebaseClient
+
+__all__ = ["SqlClient", "LakebaseClient", "exceptions"]
+__version__ = "0.1.0"

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/base.py

@@ -0,0 +1,50 @@
+from abc import ABC, abstractmethod
+from typing import Any, Optional
+
+
+class SqlClient(ABC):
+    """Abstract base for all Onehouse SQL clients.
+
+    Subclasses implement connect() and raw_connection. The convenience methods
+    (execute, fetchall, fetchone) delegate to a raw DB-API 2.0 cursor so that
+    simple one-liners work without boilerplate, while raw_connection provides
+    an escape hatch for advanced use cases (streaming, metadata, etc.).
+    """
+
+    @abstractmethod
+    def connect(self, **kwargs) -> "SqlClient":
+        """Establish the underlying connection and return self."""
+        ...
+
+    @property
+    @abstractmethod
+    def raw_connection(self) -> Any:
+        """The underlying DB-API 2.0 connection object."""
+        ...
+
+    def cursor(self):
+        return self.raw_connection.cursor()
+
+    def execute(self, sql: str, params: Optional[tuple] = None) -> int:
+        cur = self.cursor()
+        cur.execute(sql, params)
+        return cur.rowcount
+
+    def fetchall(self, sql: str, params: Optional[tuple] = None) -> list:
+        cur = self.cursor()
+        cur.execute(sql, params)
+        return cur.fetchall()
+
+    def fetchone(self, sql: str, params: Optional[tuple] = None) -> Optional[tuple]:
+        cur = self.cursor()
+        cur.execute(sql, params)
+        return cur.fetchone()
+
+    def close(self) -> None:
+        self.raw_connection.close()
+
+    def __enter__(self) -> "SqlClient":
+        return self
+
+    def __exit__(self, *_) -> None:
+        self.close()

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/exceptions.py

@@ -0,0 +1,10 @@
+class OnehouseSdkError(Exception):
+    pass
+
+
+class ConnectionError(OnehouseSdkError):
+    pass
+
+
+class QueryError(OnehouseSdkError):
+    pass

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/lakebase/__init__.py

@@ -0,0 +1,6 @@
+"""LakeBase subpackage — psycopg2 backend with browser-based auth."""
+
+from .client import LakebaseClient
+from .connection import connect
+
+__all__ = ["LakebaseClient", "connect"]

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/lakebase/auth/__init__.py

@@ -0,0 +1,24 @@
+from .browser_auth import (
+    AuthenticationError,
+    BrowserAuthHandler,
+    DEFAULT_CALLBACK_PATH,
+    DEFAULT_CALLBACK_PORT,
+)
+from .oidc_device_flow import OidcAuthenticationError, OidcDeviceFlowHandler
+from .azure_oauth import AzureOAuthError, AzureOAuthHandler
+from .saml import build_azure_entra_login_url, generate_saml_authn_request
+from .local_auth_server import LocalAuthServer
+
+__all__ = [
+    "AuthenticationError",
+    "AzureOAuthError",
+    "AzureOAuthHandler",
+    "BrowserAuthHandler",
+    "DEFAULT_CALLBACK_PATH",
+    "DEFAULT_CALLBACK_PORT",
+    "LocalAuthServer",
+    "OidcAuthenticationError",
+    "OidcDeviceFlowHandler",
+    "build_azure_entra_login_url",
+    "generate_saml_authn_request",
+]

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/lakebase/auth/_ssl.py

@@ -0,0 +1,23 @@
+"""Shared SSL context that trusts the OS native cert store when available."""
+
+import ssl
+
+
+def default_ssl_context() -> ssl.SSLContext:
+    """Return an SSLContext for outbound HTTPS (token endpoints, IdP).
+
+    Prefers the OS native trust store via the optional ``truststore`` package
+    — required on corporate environments that MITM HTTPS with an internal CA
+    (Zscaler, Netskope, etc.) deployed to the Windows/macOS root store but
+    not to certifi's bundle.  Falls back to certifi, then Python defaults.
+    """
+    try:
+        import truststore
+        return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    except ImportError:
+        pass
+    try:
+        import certifi
+        return ssl.create_default_context(cafile=certifi.where())
+    except ImportError:
+        return ssl.create_default_context()

onehouse_python_sdk-0.1.0/src/onehouse_python_sdk/lakebase/auth/azure_oauth.py

@@ -0,0 +1,194 @@
+"""Azure AD OAuth2 Authorization Code flow (form_post response mode)."""
+
+import base64
+import gzip
+import json
+import logging
+import os
+import secrets
+import urllib.parse
+import urllib.request
+import webbrowser
+import zlib
+from typing import Optional
+
+from ._ssl import default_ssl_context
+from .local_auth_server import LocalAuthServer
+
+logger = logging.getLogger(__name__)
+
+_DEFAULT_TIMEOUT_SECONDS = 120
+
+
+class AzureOAuthError(Exception):
+    pass
+
+
+class AzureOAuthHandler:
+    """Authenticates via Azure AD OAuth2 Authorization Code flow.
+
+    Azure POSTs the authorization code (form_post response mode), so a local
+    callback server is required.  The token exchange requests a SAML2 token
+    (``requested_token_type=urn:ietf:params:oauth:token-type:saml2``);
+    the result is GZIP-compressed and base64-encoded for the PostgreSQL password.
+    """
+
+    def __init__(
+        self,
+        tenant_id: str,
+        client_id: str,
+        client_secret: str,
+        scope: str = "openid",
+        iam_role_arn: Optional[str] = None,
+        callback_path: str = "/lakebase",
+    ) -> None:
+        self._tenant_id = tenant_id
+        self._client_id = client_id
+        self._client_secret = client_secret
+        self._scope = scope or "openid"
+        self._iam_role_arn = iam_role_arn
+        self._callback_path = callback_path
+
+    def authenticate(self, callback_port: int, auth_server: LocalAuthServer) -> dict:
+        """Opens browser, waits for callback, exchanges code for token.
+
+        Returns dict with keys ``user``, ``password``, and optionally ``options``.
+        """
+        state = secrets.token_urlsafe(32)
+        redirect_uri = f"http://localhost:{callback_port}{self._callback_path}"
+        auth_url = self._build_authorization_url(redirect_uri, state)
+
+        webbrowser.open(auth_url)
+        logger.info("=" * 80)
+        logger.info("AZURE AD OAUTH2 AUTHENTICATION REQUIRED")
+        logger.info("=" * 80)
+        logger.info("Please complete authentication in the opened browser window.")
+        logger.info("\nIf the browser didn't open automatically, visit:")
+        logger.info("    %s", auth_url)
+        logger.info("=" * 80)
+
+        event = auth_server.start()
+        if not event.wait(timeout=_DEFAULT_TIMEOUT_SECONDS):
+            raise AzureOAuthError(
+                f"Azure OAuth2 timed out after {_DEFAULT_TIMEOUT_SECONDS}s"
+            )
+
+        callback_data = auth_server.get_result()
+        returned_state = callback_data.get("state")
+        if returned_state != state:
+            raise AzureOAuthError("State parameter mismatch — possible CSRF attack")
+
+        # SAML response posted directly (some Azure Entra configurations)
+        saml_assertion = callback_data.get("SAMLResponse")
+        if saml_assertion:
+            password = base64.b64encode(
+                saml_assertion.encode("utf-8")
+            ).decode("ascii")
+        else:
+            code = callback_data.get("code")
+            if not code:
+                error = callback_data.get("error", "unknown_error")
+                desc = callback_data.get("error_description", "No description")
+                raise AzureOAuthError(f"OAuth2 error: {error} — {desc}")
+            password = self._exchange_code_for_token(code, redirect_uri)
+
+        result = {"user": "user", "password": password}
+        if self._iam_role_arn:
+            result["options"] = f"-c onehouse.lakebase_iam_role={self._iam_role_arn}"
+        return result
+
+    def _build_authorization_url(self, redirect_uri: str, state: str) -> str:
+        base = (
+            f"https://login.microsoftonline.com/{self._tenant_id}/oauth2/v2.0/authorize"
+        )
+        params = {
+            "client_id": self._client_id,
+            "response_type": "code",
+            "response_mode": "form_post",
+            "redirect_uri": redirect_uri,
+            "scope": self._scope,
+            "state": state,
+        }
+        return f"{base}?{urllib.parse.urlencode(params)}"
+
+    def _exchange_code_for_token(self, code: str, redirect_uri: str) -> str:
+        token_url = (
+            f"https://login.microsoftonline.com/{self._tenant_id}/oauth2/token"
+        )
+        params = {
+            "grant_type": "authorization_code",
+            "code": code,
+            "client_id": self._client_id,
+            "client_secret": self._client_secret,
+            "redirect_uri": redirect_uri,
+            "resource": self._client_id,
+            "requested_token_type": "urn:ietf:params:oauth:token-type:saml2",
+        }
+        body = urllib.parse.urlencode(params).encode()
+        req = urllib.request.Request(
+            token_url,
+            data=body,
+            headers={"Content-Type": "application/x-www-form-urlencoded"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=30, context=default_ssl_context()) as resp:
+                data = json.loads(resp.read().decode())
+        except urllib.error.HTTPError as exc:
+            raise AzureOAuthError(
+                f"Token exchange failed ({exc.code}): {exc.read().decode()}"
+            ) from exc
+
+        if "access_token" in data:
+            try:
+                # Azure may use URL-safe base64 (-/_ in place of +/) and strip padding.
+                tok = data["access_token"]
+                tok_padded = tok + "=" * (-len(tok) % 4)
+                saml_bytes = base64.urlsafe_b64decode(tok_padded)
+                try:
+                    # Some tenants return DEFLATE-compressed SAML; others plain XML bytes.
+                    saml_content = zlib.decompress(saml_bytes, -zlib.MAX_WBITS).decode("utf-8")
+                except zlib.error:
+                    saml_content = saml_bytes.decode("utf-8")
+                # Wrap in a proper SAML Response envelope with the
+                # required <samlp:Status> Success element.  STS
+                # AssumeRoleWithSAML requires a full Response, not a
+                # bare Assertion.
+                if "<samlp:Response" not in saml_content and "<Response" not in saml_content:
+                    saml_content = (
+                        '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">'
+                        '<samlp:Status><samlp:StatusCode '
+                        'Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>'
+                        '</samlp:Status>'
+                        f'{saml_content}'
+                        '</samlp:Response>'
+                    )
+                # Wire encoding: base64(gzip(base64(xml))) — the XML is
+                # base64'd first, then gzipped, then base64'd again.
+                # Confirmed by decoding a password emitted by v7 JDBC.
+                inner_b64 = base64.b64encode(saml_content.encode("utf-8")).decode("ascii")
+                compressed = gzip.compress(inner_b64.encode("utf-8"))
+                return "gzip:" + base64.b64encode(compressed).decode("ascii")
+            except Exception:
+                logger.warning("Could not parse access_token as SAML; treating as opaque token")
+
+        if "id_token" in data:
+            if self._iam_role_arn:
+                self._log_id_token_claims(data["id_token"])
+            return data["id_token"]
+
+        raise AzureOAuthError("Token response missing id_token and access_token")
+
+    def _log_id_token_claims(self, id_token: str) -> None:
+        """Decode and log JWT claims for diagnostics (no signature validation)."""
+        try:
+            parts = id_token.split(".")
+            if len(parts) != 3:
+                return
+            # Add padding
+            payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
+            payload = json.loads(base64.urlsafe_b64decode(payload_b64).decode("utf-8"))
+            logger.info("Azure ID token claims: iss=%s aud=%s sub=%s",
+                        payload.get("iss"), payload.get("aud"), payload.get("sub"))
+        except Exception:
+            pass