panda-server-source 0.8.1__tar.gz → 1.0.0__tar.gz

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panda-server-source
-Version: 0.8.1
+Version: 1.0.0
 Summary: Unified PanDA Server and JEDI Package - Source Only
 Project-URL: Homepage, https://panda-wms.readthedocs.io/en/latest/
 Author-email: PanDA Team <panda-support@cern.ch>
@@ -11,6 +11,8 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.10
+Requires-Dist: panda-client-light
+Requires-Dist: panda-common
 Description-Content-Type: text/markdown
 
 # Monorepo for the PanDA Server and JEDI

panda_server_source-1.0.0/PandaPkgInfo.py

@@ -0,0 +1 @@
+release_version = "1.0.0"

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jedibrokerage/AtlasAnalJobBroker.py

@@ -1117,7 +1117,14 @@ class AtlasAnalJobBroker(JobBrokerBase):
             msg_map = {}
             for tmpSiteName in self.get_unified_sites(scanSiteList):
                 tmpSiteSpec = self.siteMapper.getSite(tmpSiteName)
-                # check at the site
+                # check direct access
+                if taskSpec.allowInputLAN() == "only" and not tmpSiteSpec.isDirectIO() and not tmpSiteSpec.always_use_direct_io() and not inputChunk.isMerging:
+                    tmp_msg = f"  skip site={tmpSiteName} since direct IO is disabled "
+                    tmp_msg += "criteria=-remoteio"
+                    msg_map[tmpSiteName] = tmp_msg
+                    continue
+
+                # check disk space
                 if tmpSiteSpec.maxwdir:
                     if CoreUtils.use_direct_io_for_job(taskSpec, tmpSiteSpec, inputChunk):
                         minDiskCount = minDiskCountR

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jedibrokerage/GenJobBroker.py

@@ -370,13 +370,13 @@ class GenJobBroker(JobBrokerBase):
         # append candidates
         newScanSiteList = []
         for siteCandidateSpec in candidateSpecList:
-            # append
-            inputChunk.addSiteCandidate(siteCandidateSpec)
+            # append only if all files are available at the site when file dispatch is disabled
             if panda_config.disable_file_dispatch and len(siteCandidateSpec.localDiskFiles) < total_num_files:
                 tmpLog.debug(
                     f"  skip {siteCandidateSpec.siteName} due to input file dispatch is disabled and not all files are available at the site ({len(siteCandidateSpec.localDiskFiles)} < {total_num_files})"
                 )
                 continue
+            inputChunk.addSiteCandidate(siteCandidateSpec)
             newScanSiteList.append(siteCandidateSpec.siteName)
             tmpLog.debug(f"  use {siteCandidateSpec.siteName} with weight={siteCandidateSpec.weight} nFiles={len(siteCandidateSpec.localDiskFiles)}")
         scanSiteList = newScanSiteList

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jedicore/JediTaskBuffer.py

@@ -198,11 +198,6 @@ class JediTaskBuffer(TaskBuffer.TaskBuffer, CommandReceiveInterface):
         with self.proxyPool.get() as proxy:
             return proxy.getTaskDatasetsWithID_JEDI(jediTaskID, pid, lockTask)
 
-    # get JEDI tasks with selection criteria
-    def getTaskIDsWithCriteria_JEDI(self, criteria, nTasks=50):
-        with self.proxyPool.get() as proxy:
-            return proxy.getTaskIDsWithCriteria_JEDI(criteria, nTasks)
-
     # get JEDI tasks to be finished
     def getTasksToBeFinished_JEDI(self, vo, prodSourceLabel, pid, nTasks=50, target_tasks=None):
         with self.proxyPool.get() as proxy:

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jediorder/ContentsFeeder.py

@@ -125,7 +125,7 @@ class ContentsFeederThread(WorkerThread):
             datasetsIdxConsistency = []
 
             # get task
-            tmpStat, taskSpec = self.taskBufferIF.getTaskWithID_JEDI(jediTaskID, False, real_run, self.pid, 10, clearError=True)
+            tmpStat, taskSpec = self.taskBufferIF.getTaskWithID_JEDI(jediTaskID, False, real_run, self.pid, 10)
             if not tmpStat or taskSpec is None:
                 self.logger.debug(f"failed to get taskSpec for jediTaskID={jediTaskID}")
                 continue
@@ -627,14 +627,15 @@ class ContentsFeederThread(WorkerThread):
                                 setFrozenTime = False
                                 skip_secondaries = True
                     tmpLog.debug("end loop")
-            # task holdup by workflow if no master inputs are ready
-            if not taskOnHold and not taskBroken and allUpdated and nFilesMasterReady == 0 and checkedMaster and taskSpec.is_workflow_holdup():
+            # task holdup by workflow if not enough master inputs are ready and parent steps are not all done
+            insufficient_ready_files = nFilesMasterReady == 0 or (nFilesPerJob and nFilesMasterReady < nFilesPerJob)
+            if not taskOnHold and not taskBroken and allUpdated and insufficient_ready_files and checkedMaster and taskSpec.is_workflow_holdup():
                 # hold up by the workflow
                 taskOnHold = True
                 tmpLog.debug("task to hold up by workflow")
             # no master input
             if not taskOnHold and not taskBroken and allUpdated and nFilesMaster == 0 and checkedMaster:
-                tmpErrStr = "no master input files. input dataset is empty"
+                tmpErrStr = "primary input dataset is empty or all files are excluded "
                 if master_offset:
                     tmpErrStr += f" with offset={master_offset}"
                 tmpLog.error(tmpErrStr)
@@ -688,7 +689,7 @@ class ContentsFeederThread(WorkerThread):
                     allRet = self.taskBufferIF.updateTaskStatusByContFeeder_JEDI(jediTaskID, taskSpec, pid=self.pid, setFrozenTime=setFrozenTime)
                 elif allUpdated:
                     # all OK
-                    allRet, newTaskStatus = self.taskBufferIF.updateTaskStatusByContFeeder_JEDI(
+                    _, newTaskStatus = self.taskBufferIF.updateTaskStatusByContFeeder_JEDI(
                         jediTaskID, getTaskStatus=True, pid=self.pid, useWorldCloud=taskSpec.useWorldCloud()
                     )
                     tmpMsg = f"set task_status={newTaskStatus}"

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jediorder/JobGenerator.py

@@ -1318,7 +1318,7 @@ class JobGeneratorThread(WorkerThread):
                                 jobSpec.transferType = siteCandidate.remoteProtocol
                                 jobSpec.sourceSite = siteCandidate.remoteSource
                             elif not inputChunk.isMerging and not taskSpec.useLocalIO() and (taskSpec.allowInputLAN() is not None and siteSpec.isDirectIO()):
-                                jobSpec.transferType = "direct"
+                                jobSpec.transferType = taskParamMap.get("transferType", "direct")
                             # collect old PandaIDs
                             if tmpFileSpec.PandaID is not None and tmpFileSpec.PandaID not in subOldPandaIDs:
                                 subOldPandaIDs.append(tmpFileSpec.PandaID)

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jediorder/JobSplitter.py

@@ -210,6 +210,8 @@ class JobSplitter:
                     maxWalltime = taskSpec.getMaxWalltime()
                 if maxWalltime is None:
                     maxWalltime = siteSpec.maxtime
+                elif maxWalltime > siteSpec.maxtime:
+                    maxWalltime = siteSpec.maxtime
                 # core count
                 if siteSpec.coreCount:
                     coreCount = siteSpec.coreCount

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jedipprocess/PostProcessorBase.py

@@ -8,6 +8,7 @@ from pandacommon.pandautils.PandaUtils import naive_utcnow
 from pandajedi.jedicore import Interaction
 from pandaserver.config import panda_config
 from pandaserver.taskbuffer import EventServiceUtils
+from pandaserver.taskbuffer.JediTaskSpec import JediTaskSpec
 
 # port for SMTP server
 smtpPortList = [25, 587]
@@ -60,7 +61,7 @@ class PostProcessorBase(object):
     def doBasicPostProcess(self, taskSpec, tmpLog):
         # update task status
         taskSpec.lockedBy = None
-        taskSpec.status = self.getFinalTaskStatus(taskSpec)
+        taskSpec.status = self.getFinalTaskStatus(taskSpec, update_error_dialog=True)
         if taskSpec.status == "failed":
             # set dialog for preprocess
             if taskSpec.usePrePro() and not taskSpec.checkPreProcessed():
@@ -177,7 +178,17 @@ class PostProcessorBase(object):
         return nFiles, nFilesFinished, totalInputEvents, totalOkEvents, taskCompleteness
 
     # get final task status
-    def getFinalTaskStatus(self, taskSpec, checkParent=True, checkGoal=False):
+    def getFinalTaskStatus(self, taskSpec: JediTaskSpec, checkParent: bool = True, checkGoal: bool = False, update_error_dialog: bool = False):
+        """
+        Get final task status based on the number of files and events, and the status of parent task if needed.
+
+        Args:
+        - taskSpec: the task specification object
+        - checkParent: if True, check the status of parent task and set failed if the parent task is failed, broken, or aborted. If False, ignore the parent status.
+        - checkGoal: if True, return True if the goal is reached and False otherwise. If False, return the final task status.
+        - update_error_dialog: if True, update error dialog for failed tasks
+
+        """
         # count nFiles and nEvents
         nFiles, nFilesFinished, totalInputEvents, totalOkEvents, taskCompleteness = self.getTaskCompleteness(taskSpec)
         # set new task status
@@ -189,12 +200,16 @@ class PostProcessorBase(object):
             status = "paused"
         elif self.failOnZeroOkFile and nFiles == nFilesFinished == 0:
             status = "failed"
+            if update_error_dialog:
+                taskSpec.setErrDiag("failed due to no input", True)
         elif nFiles == nFilesFinished:
             # check parent status
             if checkParent and taskSpec.parent_tid not in [None, taskSpec.jediTaskID]:
                 parent_status = self.taskBufferIF.getTaskStatus_JEDI(taskSpec.parent_tid)
                 if parent_status in ["failed", "broken", "aborted"]:
                     status = "failed"
+                    if update_error_dialog:
+                        taskSpec.setErrDiag(f"failed since the parent task is {parent_status} although all files were processed", True)
                 elif parent_status != "done":
                     status = "finished"
                 else:
@@ -212,6 +227,8 @@ class PostProcessorBase(object):
                 status = "done"
         elif nFilesFinished == 0:
             status = "failed"
+            if update_error_dialog:
+                taskSpec.setErrDiag("failed since no file was successfully processed", True)
         else:
             status = "finished"
         # task goal
@@ -227,6 +244,8 @@ class PostProcessorBase(object):
         ):
             if taskCompleteness < taskGoal:
                 status = "failed"
+                if update_error_dialog:
+                    taskSpec.setErrDiag(f"failed since the task completeness {taskCompleteness:.1f} is less than the goal {taskGoal:.1f}", True)
         # HPO tasks always go to finished
         if taskSpec.is_hpo_workflow():
             event_stat = self.taskBufferIF.get_event_statistics(taskSpec.jediTaskID)
@@ -242,7 +261,7 @@ class PostProcessorBase(object):
         return status
 
     # pre-check
-    def doPreCheck(self, taskSpec, tmpLog):
+    def doPreCheck(self, taskSpec: JediTaskSpec, tmpLog):
         # send task to exhausted
         if (
             taskSpec.useExhausted()

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandajedi/jedisetup/AtlasTaskSetupper.py

@@ -197,7 +197,7 @@ class AtlasTaskSetupper(TaskSetupperBase):
                                                         targetName,
                                                         locForDouble,
                                                         copies=1,
-                                                        owner=userName,
+                                                        owner=None,
                                                         lifetime=lifetime,
                                                         activity=activity,
                                                         grouping="NONE",

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/file_server_api.py

@@ -687,7 +687,7 @@ def upload_file_recovery_request(
     user_name = req.subprocess_env["SSL_CLIENT_S_DN"]
     creation_time = naive_utcnow().strftime("%Y-%m-%d %H:%M:%S")
 
-    tmp_logger = LogWrapper(_logger, f"put_file_recovery_request < task_id={task_id} >")
+    tmp_logger = LogWrapper(_logger, f"upload_file_recovery_request < task_id={task_id} >")
     tmp_logger.debug(f"Start user={user_name}")
 
     try:

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/http_client.py

@@ -34,10 +34,6 @@ class HttpClient:
         # request a compressed response
         self.compress = True
 
-        # SSL cert/key
-        self.ssl_certificate = self._x509()
-        self.ssl_key = self._x509()
-
         # OIDC
         self.oidc = os.getenv("PANDA_AUTH") == "oidc"
         self.auth_vo = os.getenv("PANDA_AUTH_VO") if self.oidc else None
@@ -46,6 +42,10 @@ class HttpClient:
             with open(self.id_token[5:], "r") as f:
                 self.id_token = f.read().strip()
 
+        # SSL cert/key
+        self.ssl_certificate = self._x509() if not self.oidc else None
+        self.ssl_key = self._x509() if not self.oidc else None
+
     def _x509(self):
         # retrieve the X509_USER_PROXY from the environment variables
         try:

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/job_api.py

@@ -78,7 +78,7 @@ def get_status(req: PandaRequest, job_ids: List[int], timeout: int = 60) -> Dict
 
 
 @request_validation(_logger, secure=True)
-def get_description(self, job_ids: List[int]) -> Dict:
+def get_description(req: PandaRequest, job_ids: List[int]) -> Dict:
     """
     Get description of a job.
 
@@ -300,7 +300,6 @@ def reassign(req: PandaRequest, job_ids: List[int]):
     Returns:
         dict: The system response `{"success": True}`.
     """
-    # TODO: think about the default values for for_pending and first_submission. The resolve_true and resolve_false functions are confusing me.
 
     tmp_logger = LogWrapper(_logger, f"reassign job_ids={job_ids}")
     tmp_logger.debug("Start")

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/metaconfig_api.py

@@ -88,7 +88,7 @@ def get_site_specs(req: PandaRequest, type: str = "analysis") -> dict:
     return generate_response(True, data=site_specs)
 
 
-@request_validation(_logger, secure=True, production=True, request_method="GET")
+@request_validation(_logger, secure=True, request_method="GET")
 def get_resource_types(req: PandaRequest):
     """
     Get resource types

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/pilot_api.py

@@ -153,6 +153,10 @@ def acquire_jobs(
     except (ValueError, TypeError):
         remaining_time = 0
 
+    # harvester ID was not set, but we haver the scheduler ID, which should be the same
+    if not harvester_id and scheduler_id:
+        harvester_id = scheduler_id
+
     tmp_logger.debug(
         f"{site_name}, n_jobs={n_jobs}, memory={memory}, disk={disk_space}, source_label={prod_source_label}, "
         f"node={node}, ce={computing_element}, user={prod_user_id}, proxy={get_proxy_key}, "
@@ -715,7 +719,7 @@ def update_worker_status(req: PandaRequest, worker_id, harvester_id, status, tim
     """
     tmp_logger = LogWrapper(
         _logger,
-        f"updateWorkerPilotStatus worker_id={worker_id} harvester_id={harvester_id} status={status} node_id={node_id} PID={os.getpid()}",
+        f"update_worker_status worker_id={worker_id} harvester_id={harvester_id} status={status} node_id={node_id} PID={os.getpid()}",
     )
     tmp_logger.debug("Start")
 

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/task_api.py

@@ -1132,6 +1132,92 @@ def get_tasks_modified_since(req, since: str, dn: str = None, full: bool = False
     return generate_response(True, data=tasks)
 
 
+@request_validation(_logger, secure=True, request_method="GET")
+def get_tasks_detailed_info_since(req, since: str, filters: str = None, n_tasks: int = 500) -> Dict[str, Any]:
+    """
+    Get detailed task info for tasks modified since a given time.
+
+    Fetches task IDs for tasks modified since ``since`` (max 30-day window), applies optional
+    field filters, and returns full detail (all JediTaskSpec fields + jobParamsTemplate +
+    taskParams) for each matching task. The request is always scoped to the authenticated user
+    (DN from the request certificate) unless userName is explicity specified in the filters.
+
+    Filters are split server-side: plain-value patterns (no regex metacharacters) become SQL
+    equality conditions pushed to the DB; patterns with metacharacters are applied in Python via
+    ``re.search`` on the full task dict returned by ``get_task_details_json``.
+
+    API details:
+        HTTP Method: GET
+        Path: /v1/task/get_tasks_detailed_info_since
+
+    Args:
+        req(PandaRequest): internally generated request object
+        since(str): time in the format ``%Y-%m-%d %H:%M:%S``
+        filters(str, optional): JSON-encoded dict of {field: pattern} pairs.
+            Plain values (no regex metacharacters) become SQL equality conditions.
+            Regex patterns (containing ``|``, ``.``, ``*``, etc.) are matched with
+            ``re.search`` after fetching full task details. Unrecognised field names are
+            silently ignored. Example: ``{"status": "finished|done", "prodSourceLabel": "user"}``
+        n_tasks(int, optional): maximum number of task IDs to retrieve (default 500)
+
+    Returns:
+        dict: The system response ``{"success": success, "message": message, "data": data}``.
+              On success ``data`` is a list of task detail dicts.
+    """
+    tmp_logger = LogWrapper(_logger, "get_tasks_detailed_info_since")
+    tmp_logger.debug("Start")
+
+    compact_dn = clean_user_id(get_dn(req)) or get_dn(req)
+
+    # userName is always the authenticated user; other filters come from the caller
+    sql_criteria = {"userName": compact_dn}
+    regex_filters = {}
+    if filters:
+        try:
+            parsed_filters = json.loads(filters)
+            if not isinstance(parsed_filters, dict):
+                return generate_response(False, message="filters must be a JSON object")
+            for field, pattern in parsed_filters.items():
+                if re.escape(pattern) == pattern:
+                    sql_criteria[field] = pattern
+                else:
+                    regex_filters[field] = pattern
+        except (json.JSONDecodeError, ValueError):
+            return generate_response(False, message="filters is not valid JSON")
+
+    tmp_logger.debug(f"parameters dn:{compact_dn} since:{since} sql_criteria:{sql_criteria} regex_filters:{regex_filters} n_tasks:{n_tasks}")
+
+    # Step 1: get task IDs via SQL (time range + equality criteria)
+    task_ids = global_task_buffer.getTaskIDsWithCriteria_JEDI(sql_criteria, since=since, nTasks=n_tasks)
+    if task_ids is None:
+        return generate_response(False, message="Failed to retrieve task IDs")
+
+    # Step 2: fetch full details and apply Python regex filters
+    result = []
+    for task_id in task_ids:
+        details = global_task_buffer.get_task_details_json(task_id)
+        if details is None:
+            continue
+        if regex_filters:
+            skip = False
+            for field, pattern in regex_filters.items():
+                if field not in details:
+                    continue  # silently ignore unrecognised fields
+                try:
+                    if re.search(pattern, str(details[field])) is None:
+                        skip = True
+                        break
+                except re.error:
+                    skip = True
+                    break
+            if skip:
+                continue
+        result.append(details)
+
+    tmp_logger.debug(f"Done, returning {len(result)} tasks")
+    return generate_response(True, data=result)
+
+
 @request_validation(_logger, secure=True, request_method="GET")
 def get_datasets_and_files(req, task_id, dataset_types: List[str] = ("input", "pseudo_input")) -> Dict[str, Any]:
     """

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/api/v1/tests/task_api_tests.py

@@ -541,6 +541,53 @@ class TestTaskAPI(unittest.TestCase):
         expected_response = {"status": 0, "success": output["success"]}
         self.assertEqual(output, expected_response)
 
+    def test_get_tasks_detailed_info_since(self):
+        url = f"{api_url_ssl}/task/get_tasks_detailed_info_since"
+        print(f"Testing URL: {url}")
+
+        one_week_ago = datetime.now() - timedelta(weeks=1)
+        since_str = one_week_ago.strftime("%Y-%m-%d %H:%M:%S")
+
+        # Basic call without filters: always succeeds; data is a list
+        data = {"since": since_str}
+        status, output = self.http_client.get(url, data)
+        print(output)
+        self.assertEqual(status, 0)
+        self.assertTrue(output["success"])
+        self.assertIsInstance(output["data"], list)
+
+        # Plain-value filter pushed to SQL
+        import json
+
+        data = {"since": since_str, "filters": json.dumps({"prodSourceLabel": "user"})}
+        status, output = self.http_client.get(url, data)
+        print(output)
+        self.assertEqual(status, 0)
+        self.assertTrue(output["success"])
+        self.assertIsInstance(output["data"], list)
+
+        # Regex filter applied in Python
+        data = {"since": since_str, "filters": json.dumps({"status": "finished|done"})}
+        status, output = self.http_client.get(url, data)
+        print(output)
+        self.assertEqual(status, 0)
+        self.assertTrue(output["success"])
+        self.assertIsInstance(output["data"], list)
+
+        # Invalid JSON filters → success=False
+        data = {"since": since_str, "filters": "not_valid_json"}
+        status, output = self.http_client.get(url, data)
+        print(output)
+        self.assertEqual(status, 0)
+        self.assertFalse(output["success"])
+
+        if JEDI_TASK_ID != -1:
+            # Real task: verify each returned dict has expected keys
+            data = {"since": since_str}
+            status, output = self.http_client.get(url, data)
+            for task_info in output.get("data", []):
+                self.assertIn("jediTaskID", task_info)
+                self.assertIn("status", task_info)
 
     def test_get_job_descriptions(self):
         # def get_job_descriptions(req: PandaRequest, task_id: int, unsuccessful_only: bool = False) -> Dict:

{panda_server_source-0.8.1 → panda_server_source-1.0.0}/pandaserver/daemons/scripts/worker_synchronization.py

@@ -4,8 +4,9 @@ import traceback
 
 from pandacommon.pandalogger.PandaLogger import PandaLogger
 from pandacommon.pandautils.thread_utils import GenericThread
+
 from pandaserver.config import panda_config
-from pandaserver.taskbuffer.Utils import create_shards
+from pandaserver.srvcore.CoreUtils import create_shards
 
 # logger
 _logger = PandaLogger().getLogger("worker_sync")

panda_server_source-1.0.0/pandaserver/pandamcp/client_utils/get_panda_token.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# get_panda_token.sh
+# Replicates panda-client's device authorization flow to get an id_token.
+# Usage: source get_panda_token.sh
+
+PANDA_SERVER=${PANDA_SERVER:-"https://pandaserver.cern.ch:25443"}
+VO=${VO:-"atlas"}
+TOKEN_FILE=${TOKEN_FILE:-"${HOME}/.panda_id_token"}
+
+echo "==> Fetching auth config from ${PANDA_SERVER}/auth/${VO}_auth_config.json"
+# -k disables TLS certificate verification; acceptable for a developer helper script
+AUTH_CONFIG=$(curl -sk "${PANDA_SERVER}/auth/${VO}_auth_config.json")
+if [ -z "$AUTH_CONFIG" ]; then
+    echo "ERROR: Failed to fetch auth config"
+    return 1 2>/dev/null || exit 1
+fi
+
+# Parse the fields from the auth config
+read -r CLIENT_ID CLIENT_SECRET AUDIENCE OIDC_CONFIG_URL < <(
+    python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+print(d['client_id'], d.get('client_secret') or '', d['audience'], d['oidc_config_url'])
+" <<< "$AUTH_CONFIG")
+
+echo "==> client_id: $CLIENT_ID"
+echo "==> audience:  $AUDIENCE"
+
+# Fetch OIDC endpoints
+OIDC_CONFIG=$(curl -sk "$OIDC_CONFIG_URL")
+read -r DEVICE_ENDPOINT TOKEN_ENDPOINT < <(
+    python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+print(d['device_authorization_endpoint'], d['token_endpoint'])
+" <<< "$OIDC_CONFIG")
+
+echo "==> Requesting device code..."
+DEVICE_RESPONSE=$(curl -sk -X POST "$DEVICE_ENDPOINT" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "client_id=${CLIENT_ID}&scope=openid profile email offline_access&audience=${AUDIENCE}")
+
+# Parse device response
+# device_code: code to include in token request
+# verification_uri_complete: URL to open in browser for user authentication
+# expires_in: time in seconds before device code expires
+# Interval: polling interval in seconds
+read -r DEVICE_CODE VERIFICATION_URI EXPIRES_IN INTERVAL < <(
+    python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+print(d['device_code'], d['verification_uri_complete'], d['expires_in'], d.get('interval', 5))
+" <<< "$DEVICE_RESPONSE")
+
+if ! [[ "$EXPIRES_IN" =~ ^[0-9]+$ ]] || ! [[ "$INTERVAL" =~ ^[0-9]+$ ]]; then
+    echo "ERROR: Invalid expires_in or interval in device response"
+    return 1 2>/dev/null || exit 1
+fi
+
+echo ""
+echo "==> Please open the following URL in your browser and sign in:"
+echo ""
+echo "    $VERIFICATION_URI"
+echo ""
+read -rp "Press Enter once you have signed in..."
+
+# Poll for token
+echo "==> Polling for token..."
+ELAPSED=0
+while [ "$ELAPSED" -lt "$EXPIRES_IN" ]; do
+    # client_secret is empty for public clients; included here for confidential client support
+    TOKEN_RESPONSE=$(curl -sk -X POST "$TOKEN_ENDPOINT" \
+        -H "Content-Type: application/x-www-form-urlencoded" \
+        -d "client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=${DEVICE_CODE}")
+
+    ERROR=$(echo "$TOKEN_RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin).get('error',''))" 2>/dev/null)
+
+    if [ "$ERROR" == "authorization_pending" ]; then
+        # RFC 8628 requires waiting at least interval seconds between polls; +1 adds a small buffer
+        sleep $((INTERVAL + 1))
+        ELAPSED=$((ELAPSED + INTERVAL + 1))
+        continue
+    elif [ -z "$ERROR" ]; then
+        read -r ID_TOKEN TOKEN_EXPIRES_IN < <(
+            python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+print(d['id_token'], d.get('expires_in', ''))
+" <<< "$TOKEN_RESPONSE")
+        echo "$TOKEN_RESPONSE" > "$TOKEN_FILE"
+        EXPIRY_STR=$(date -d "+${TOKEN_EXPIRES_IN} seconds" 2>/dev/null || date -v "+${TOKEN_EXPIRES_IN}S" 2>/dev/null || echo "unknown")
+        echo ""
+        echo "==> Token saved to $TOKEN_FILE"
+        echo "==> Token expires at: $EXPIRY_STR"
+        break
+    else
+        echo "ERROR: $TOKEN_RESPONSE"
+        return 1 2>/dev/null || exit 1
+    fi
+done
+
+if [ -z "$ID_TOKEN" ]; then
+    echo "ERROR: Timed out waiting for authentication"
+    return 1 2>/dev/null || exit 1
+fi
+
+echo "==> Token generated successfully!"
+
+# Executed as source get_panda_token.sh: export token to current shell
+if [[ "${BASH_SOURCE[0]}" != "${0}" ]]; then
+    # id_token is exported as ACCESS_TOKEN to match the name panda-client tools expect
+    export ACCESS_TOKEN=$ID_TOKEN
+    # TOKEN_FILE exported so callers can extract other fields (e.g. refresh_token) without hardcoding the path
+    export TOKEN_FILE
+    echo "==> ACCESS_TOKEN exported to current shell (full response in \$TOKEN_FILE: $TOKEN_FILE)"
+# Executed as ./get_panda_token.sh: print instructions to export token manually since we can't modify the parent shell's environment
+else
+    echo ""
+    echo "Run the following to set your token:"
+    echo ""
+    echo "  export ACCESS_TOKEN=$ID_TOKEN"
+    echo "  export TOKEN_FILE=$TOKEN_FILE"
+fi