openrunner-sdk 2.37.6__tar.gz → 2.37.7__tar.gz

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openrunner-sdk
-Version: 2.37.6
+Version: 2.37.7
 Summary: OpenRunner SDK - W&B-compatible ML experiment tracking client
 Project-URL: Homepage, https://github.com/jqueguiner/openrunner
 Project-URL: Repository, https://github.com/jqueguiner/openrunner

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/openrunner/__init__.py

@@ -181,7 +181,7 @@ launch.from_run = _launch_from_run  # type: ignore[attr-defined]
 # openrunner.trace.patch_openai() syntax
 trace.patch_openai = _patch_openai  # type: ignore[attr-defined]
 
-__version__ = "2.37.6"
+__version__ = "2.37.7"
 
 logger = logging.getLogger("openrunner")
 

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/openrunner/api_client.py

@@ -147,6 +147,39 @@ class APIClient:
             logger.warning("post_metrics failed: %s", e)
             return 0
 
+    def create_api_key(
+        self,
+        name: str,
+        scopes: list[str] | None = None,
+        scope_project_id: str | None = None,
+        scope_org_id: str | None = None,
+    ) -> dict[str, Any] | None:
+        """POST /users/me/api-keys -- mint a scoped API key.
+
+        ``scopes`` are fine-grained capability scopes, e.g.
+        ``["drift:read", "drift:write"]``; None/empty means full access.
+        ``scope_project_id`` / ``scope_org_id`` further restrict the key to a
+        single project/org. The plaintext key is returned ONCE, in the ``key``
+        field of the response dict -- it is never retrievable again.
+
+        Returns the created-key dict (incl. plaintext ``key``), or None on
+        failure.
+        """
+        try:
+            body: dict[str, Any] = {"name": name}
+            if scopes:
+                body["scopes"] = scopes
+            if scope_project_id:
+                body["scope_project_id"] = scope_project_id
+            if scope_org_id:
+                body["scope_org_id"] = scope_org_id
+            response = self._request("post", "/users/me/api-keys", json=body)
+            response.raise_for_status()
+            return response.json()
+        except Exception as e:
+            logger.warning("create_api_key failed: %s", e)
+            return None
+
     def post_inference_events(
         self,
         project_id: str,

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/openrunner/cli.py

@@ -4339,6 +4339,39 @@ def drift_group() -> None:
     pass
 
 
+@drift_group.command("key")
+@click.option("--project", "-p", default=None, help="Project org/name or UUID to scope the key to")
+@click.option("--name", "-n", default=None, help="Key name (default: drift-<project>)")
+@click.option("--read-only", is_flag=True, help="Mint a drift:read-only key (no ingest)")
+@click.option("--json", "as_json", is_flag=True, help="Print the key record as JSON")
+def drift_key(project, name, read_only, as_json) -> None:
+    """Mint an API key scoped to inference-drift only (read+write by default).
+
+    The key carries ONLY ``drift:read``+``drift:write`` (or ``drift:read`` with
+    --read-only) and is bound to the project — it cannot touch runs, datasets,
+    artifacts, weights, or any other domain. Give this to a container/service
+    that reports drift events instead of a full-access key. The plaintext key is
+    shown ONCE; store it as the container's ``OPENRUNNER_API_KEY``.
+    """
+    import json as _json
+
+    client, pid = _drift_client_project(project)
+    scopes = ["drift:read"] if read_only else ["drift:read", "drift:write"]
+    key_name = name or f"drift-{(project or _load_settings().get('project') or pid)}".replace("/", "-")
+    rec = client.create_api_key(key_name, scopes=scopes, scope_project_id=pid)
+    client.close()
+    if not rec or not rec.get("key"):
+        click.echo("Error: failed to mint drift key (check login / project membership).", err=True)
+        raise SystemExit(1)
+    if as_json:
+        click.echo(_json.dumps(rec))
+        return
+    click.echo(f"name:   {rec.get('name')}")
+    click.echo(f"scopes: {','.join(rec.get('scopes') or scopes)}")
+    click.echo(f"key:    {rec['key']}")
+    click.echo("\nStore as the container env OPENRUNNER_API_KEY — shown only once.")
+
+
 @drift_group.command("report")
 @click.argument("events_json", type=click.Path(exists=True))
 @click.option("--project", "-p", default=None, help="Project org/name or UUID")

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/openrunner/install_commands.py

@@ -2743,12 +2743,19 @@ the reference). Do each step; ask only when genuinely ambiguous.
 - If several, ask which to instrument (default: the prediction routes). Honour
   `--endpoint PATH` when given.
 
-## Step 2 -- resolve project + creds
+## Step 2 -- resolve project + mint a DRIFT-ONLY key for the container
 - `openrunner login` if needed. Resolve the project id (from the `org/name` arg,
   else `APIClient.list_projects()`; ask if ambiguous).
-- Creds are read from the service env at runtime: `OPENRUNNER_API_KEY`
-  (+ `OPENRUNNER_BASE_URL`). Confirm they are set in the deployment env; **never
-  hardcode the key**. Store `PROJECT_ID` as a module constant or env var.
+- **Mint a scoped key for this container** -- do NOT reuse the user's full key.
+  Run `openrunner drift key --project ORG/NAME --name drift-<service>` (add
+  `--json` to capture it). It returns a key carrying ONLY `drift:read` +
+  `drift:write`, bound to that project: it can report/read drift and nothing else
+  (no runs, datasets, artifacts, weights). Shown once.
+- Inject it as the container's `OPENRUNNER_API_KEY` (+ optional
+  `OPENRUNNER_BASE_URL`) via `.env.example` / deploy secret -- **never hardcode
+  the key** in source. Store `PROJECT_ID` as a module constant or env var.
+- If key minting fails (e.g. the user lacks membership), fall back to the
+  existing `OPENRUNNER_API_KEY` from env and note it is broader than needed.
 
 ## Step 3 -- add the non-blocking reporter module
 Create `openrunner_drift.py` (match the repo layout) with a background batcher

{openrunner_sdk-2.37.6 → openrunner_sdk-2.37.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openrunner-sdk"
-version = "2.37.6"
+version = "2.37.7"
 description = "OpenRunner SDK - W&B-compatible ML experiment tracking client"
 readme = "README.md"
 license = {text = "MIT"}