pipedream 2.1.19__tar.gz → 2.2.0__tar.gz

{pipedream-2.1.19 → pipedream-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: pipedream
-Version: 2.1.19
+Version: 2.2.0
 Summary: 
 Requires-Python: >=3.10,<4.0
 Classifier: Intended Audience :: Developers
@@ -20,11 +20,14 @@ Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Provides-Extra: aiohttp
+Provides-Extra: private-key
 Requires-Dist: aiohttp (>=3.13.4,<4) ; (python_version >= "3.9") and (extra == "aiohttp")
+Requires-Dist: cryptography (>=3.4.0) ; extra == "private-key"
 Requires-Dist: httpx (>=0.21.2)
 Requires-Dist: httpx-aiohttp (==0.1.8) ; (python_version >= "3.9") and (extra == "aiohttp")
 Requires-Dist: pydantic (>=1.9.2)
 Requires-Dist: pydantic-core (>=2.18.2,<3.0.0)
+Requires-Dist: pyjwt (>=2.8.0,<3) ; extra == "private-key"
 Requires-Dist: typing_extensions (>=4.0.0)
 Project-URL: Repository, https://github.com/PipedreamHQ/pipedream-sdk-python
 Description-Content-Type: text/markdown

{pipedream-2.1.19 → pipedream-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ dynamic = ["version"]
 
 [tool.poetry]
 name = "pipedream"
-version = "2.1.19"
+version = "2.2.0"
 description = ""
 readme = "README.md"
 authors = []
@@ -38,10 +38,12 @@ Repository = 'https://github.com/PipedreamHQ/pipedream-sdk-python'
 [tool.poetry.dependencies]
 python = "^3.10"
 aiohttp = { version = ">=3.13.4,<4", optional = true, python = ">=3.9"}
+cryptography = { version = ">=3.4.0", optional = true}
 httpx = ">=0.21.2"
 httpx-aiohttp = { version = "0.1.8", optional = true, python = ">=3.9"}
 pydantic = ">= 1.9.2"
 pydantic-core = ">=2.18.2,<3.0.0"
+pyjwt = { version = ">=2.8.0,<3", optional = true}
 typing_extensions = ">= 4.0.0"
 
 [tool.poetry.group.dev.dependencies]
@@ -93,4 +95,5 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.poetry.extras]
+private-key=["pyjwt", "cryptography"]
 aiohttp=["aiohttp", "httpx-aiohttp"]

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/accounts/client.py

@@ -118,6 +118,7 @@ class AccountsClient:
         oauth_app_id: typing.Optional[str] = None,
         name: typing.Optional[str] = OMIT,
         account_id: typing.Optional[str] = OMIT,
+        app_override_id: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> Account:
         """
@@ -145,6 +146,9 @@ class AccountsClient:
         account_id : typing.Optional[str]
             An existing account ID to reconnect. When provided, the account's credentials are updated instead of creating a new account. Must belong to the same external user and project environment as the connect token, and match the app identified by app_slug.
 
+        app_override_id : typing.Optional[str]
+            An app override ID. The account is linked to the override and the override's pre-defined custom field values are merged over cfmap_json; with account_id, the account is re-linked to this override. Must belong to the app identified by app_slug, and must not select an OAuth client — overrides that do can only connect through the OAuth flow.
+
         request_options : typing.Optional[RequestOptions]
             Request-specific configuration.
 
@@ -178,6 +182,7 @@ class AccountsClient:
             oauth_app_id=oauth_app_id,
             name=name,
             account_id=account_id,
+            app_override_id=app_override_id,
             request_options=request_options,
         )
         return _response.data
@@ -450,6 +455,7 @@ class AsyncAccountsClient:
         oauth_app_id: typing.Optional[str] = None,
         name: typing.Optional[str] = OMIT,
         account_id: typing.Optional[str] = OMIT,
+        app_override_id: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> Account:
         """
@@ -477,6 +483,9 @@ class AsyncAccountsClient:
         account_id : typing.Optional[str]
             An existing account ID to reconnect. When provided, the account's credentials are updated instead of creating a new account. Must belong to the same external user and project environment as the connect token, and match the app identified by app_slug.
 
+        app_override_id : typing.Optional[str]
+            An app override ID. The account is linked to the override and the override's pre-defined custom field values are merged over cfmap_json; with account_id, the account is re-linked to this override. Must belong to the app identified by app_slug, and must not select an OAuth client — overrides that do can only connect through the OAuth flow.
+
         request_options : typing.Optional[RequestOptions]
             Request-specific configuration.
 
@@ -518,6 +527,7 @@ class AsyncAccountsClient:
             oauth_app_id=oauth_app_id,
             name=name,
             account_id=account_id,
+            app_override_id=app_override_id,
             request_options=request_options,
         )
         return _response.data

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/accounts/raw_client.py

@@ -139,6 +139,7 @@ class RawAccountsClient:
         oauth_app_id: typing.Optional[str] = None,
         name: typing.Optional[str] = OMIT,
         account_id: typing.Optional[str] = OMIT,
+        app_override_id: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> HttpResponse[Account]:
         """
@@ -166,6 +167,9 @@ class RawAccountsClient:
         account_id : typing.Optional[str]
             An existing account ID to reconnect. When provided, the account's credentials are updated instead of creating a new account. Must belong to the same external user and project environment as the connect token, and match the app identified by app_slug.
 
+        app_override_id : typing.Optional[str]
+            An app override ID. The account is linked to the override and the override's pre-defined custom field values are merged over cfmap_json; with account_id, the account is re-linked to this override. Must belong to the app identified by app_slug, and must not select an OAuth client — overrides that do can only connect through the OAuth flow.
+
         request_options : typing.Optional[RequestOptions]
             Request-specific configuration.
 
@@ -187,6 +191,7 @@ class RawAccountsClient:
                 "connect_token": connect_token,
                 "name": name,
                 "account_id": account_id,
+                "app_override_id": app_override_id,
             },
             headers={
                 "content-type": "application/json",
@@ -564,6 +569,7 @@ class AsyncRawAccountsClient:
         oauth_app_id: typing.Optional[str] = None,
         name: typing.Optional[str] = OMIT,
         account_id: typing.Optional[str] = OMIT,
+        app_override_id: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> AsyncHttpResponse[Account]:
         """
@@ -591,6 +597,9 @@ class AsyncRawAccountsClient:
         account_id : typing.Optional[str]
             An existing account ID to reconnect. When provided, the account's credentials are updated instead of creating a new account. Must belong to the same external user and project environment as the connect token, and match the app identified by app_slug.
 
+        app_override_id : typing.Optional[str]
+            An app override ID. The account is linked to the override and the override's pre-defined custom field values are merged over cfmap_json; with account_id, the account is re-linked to this override. Must belong to the app identified by app_slug, and must not select an OAuth client — overrides that do can only connect through the OAuth flow.
+
         request_options : typing.Optional[RequestOptions]
             Request-specific configuration.
 
@@ -612,6 +621,7 @@ class AsyncRawAccountsClient:
                 "connect_token": connect_token,
                 "name": name,
                 "account_id": account_id,
+                "app_override_id": app_override_id,
             },
             headers={
                 "content-type": "application/json",

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/core/client_wrapper.py

@@ -34,12 +34,12 @@ class BaseClientWrapper:
         import platform
 
         headers: typing.Dict[str, str] = {
-            "User-Agent": "pipedream/2.1.19",
+            "User-Agent": "pipedream/2.2.0",
             "X-Fern-Language": "Python",
             "X-Fern-Runtime": f"python/{platform.python_version()}",
             "X-Fern-Platform": f"{platform.system().lower()}/{platform.release()}",
             "X-Fern-SDK-Name": "pipedream",
-            "X-Fern-SDK-Version": "2.1.19",
+            "X-Fern-SDK-Version": "2.2.0",
             **(self.get_custom_headers() or {}),
         }
         if self._project_environment is not None:

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/oauth_tokens/client.py

@@ -30,7 +30,11 @@ class OauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> CreateOAuthTokenResponse:
@@ -41,7 +45,14 @@ class OauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -65,11 +76,15 @@ class OauthTokensClient:
         )
         client.oauth_tokens.create(
             client_id="client_id",
-            client_secret="client_secret",
         )
         """
         _response = self._raw_client.create(
-            client_id=client_id, client_secret=client_secret, scope=scope, request_options=request_options
+            client_id=client_id,
+            client_secret=client_secret,
+            client_assertion_type=client_assertion_type,
+            client_assertion=client_assertion,
+            scope=scope,
+            request_options=request_options,
         )
         return _response.data
 
@@ -93,7 +108,11 @@ class AsyncOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> CreateOAuthTokenResponse:
@@ -104,7 +123,14 @@ class AsyncOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -133,13 +159,17 @@ class AsyncOauthTokensClient:
         async def main() -> None:
             await client.oauth_tokens.create(
                 client_id="client_id",
-                client_secret="client_secret",
             )
 
 
         asyncio.run(main())
         """
         _response = await self._raw_client.create(
-            client_id=client_id, client_secret=client_secret, scope=scope, request_options=request_options
+            client_id=client_id,
+            client_secret=client_secret,
+            client_assertion_type=client_assertion_type,
+            client_assertion=client_assertion,
+            scope=scope,
+            request_options=request_options,
         )
         return _response.data

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/oauth_tokens/raw_client.py

@@ -25,7 +25,11 @@ class RawOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> HttpResponse[CreateOAuthTokenResponse]:
@@ -36,7 +40,14 @@ class RawOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -55,6 +66,8 @@ class RawOauthTokensClient:
             json={
                 "client_id": client_id,
                 "client_secret": client_secret,
+                "client_assertion_type": client_assertion_type,
+                "client_assertion": client_assertion,
                 "scope": scope,
                 "grant_type": "client_credentials",
             },
@@ -103,7 +116,11 @@ class AsyncRawOauthTokensClient:
         self,
         *,
         client_id: str,
-        client_secret: str,
+        client_secret: typing.Optional[str] = OMIT,
+        client_assertion_type: typing.Optional[
+            typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]
+        ] = OMIT,
+        client_assertion: typing.Optional[str] = OMIT,
         scope: typing.Optional[str] = OMIT,
         request_options: typing.Optional[RequestOptions] = None,
     ) -> AsyncHttpResponse[CreateOAuthTokenResponse]:
@@ -114,7 +131,14 @@ class AsyncRawOauthTokensClient:
         ----------
         client_id : str
 
-        client_secret : str
+        client_secret : typing.Optional[str]
+            The client secret, for clients that authenticate with a client secret.
+
+        client_assertion_type : typing.Optional[typing.Literal["urn:ietf:params:oauth:client-assertion-type:jwt-bearer"]]
+            Required with `client_assertion`.
+
+        client_assertion : typing.Optional[str]
+            For clients that authenticate with a public key: a JWT signed with the client's private key (ES256 or RS256). Claims: `iss` and `sub` set to the client ID, `aud` set to `https://api.pipedream.com`, `exp` at most 1 hour ahead, and a unique `jti`. Sign a new assertion for every request, including retries.
 
         scope : typing.Optional[str]
             Optional space-separated scopes for the access token. Defaults to `*`.
@@ -133,6 +157,8 @@ class AsyncRawOauthTokensClient:
             json={
                 "client_id": client_id,
                 "client_secret": client_secret,
+                "client_assertion_type": client_assertion_type,
+                "client_assertion": client_assertion,
                 "scope": scope,
                 "grant_type": "client_credentials",
             },

{pipedream-2.1.19 → pipedream-2.2.0}/src/pipedream/pipedream.py

@@ -5,6 +5,12 @@ import httpx
 from .client import AsyncClient, Client
 from .core.client_wrapper import AsyncClientWrapper, SyncClientWrapper
 from .core.logging import LogConfig, Logger
+from .private_key_jwt import (
+    AsyncPrivateKeyJwtTokenProvider,
+    ClientAssertionSigner,
+    PrivateKeyJwtTokenProvider,
+    issuer_from_base_url,
+)
 from .types.project_environment import ProjectEnvironment
 from .workflows.client import AsyncWorkflowsClient, WorkflowsClient
 
@@ -31,6 +37,52 @@ def install_request_hook(
     ).append(hook)
 
 
+def _resolve_credentials(
+    client_secret: typing.Optional[str],
+    private_key: typing.Optional[str],
+) -> typing.Tuple[typing.Optional[str], typing.Optional[str]]:
+    """Returns (client_secret, private_key) with at most one of them set.
+
+    An explicitly passed credential wins over the other one in the environment.
+    Passing both, or setting both PIPEDREAM_CLIENT_SECRET and
+    PIPEDREAM_PRIVATE_KEY with neither passed, raises ValueError.
+    """
+    env_secret = os.getenv("PIPEDREAM_CLIENT_SECRET")
+    # client_secret defaults to the environment variable, so a value equal to
+    # it is treated as coming from the environment.
+    secret_passed = bool(client_secret) and client_secret != env_secret
+    if private_key and secret_passed:
+        raise ValueError("Pass either client_secret or private_key, not both")
+    if private_key:
+        return None, private_key
+    if secret_passed:
+        return client_secret, None
+    env_key = os.getenv("PIPEDREAM_PRIVATE_KEY")
+    if client_secret and env_key:
+        raise ValueError(
+            "Both PIPEDREAM_CLIENT_SECRET and PIPEDREAM_PRIVATE_KEY are set; set only the one your client uses"
+        )
+    return client_secret, env_key
+
+
+def _assertion_signer(
+    client_id: typing.Optional[str],
+    private_key: str,
+    key_id: typing.Optional[str],
+    base_url: str,
+) -> ClientAssertionSigner:
+    if not client_id:
+        raise ValueError("client_id is required when authenticating with private_key")
+    return ClientAssertionSigner(
+        client_id=client_id,
+        private_key=private_key,
+        key_id=key_id or os.getenv("PIPEDREAM_KEY_ID"),
+        # The assertion audience is the API's issuer identifier: the base URL's
+        # origin (https://api.pipedream.com by default).
+        audience=issuer_from_base_url(base_url),
+    )
+
+
 class Pipedream(Client):
 
     def __init__(
@@ -39,6 +91,8 @@ class Pipedream(Client):
         access_token: typing.Optional[str] = os.getenv("PIPEDREAM_ACCESS_TOKEN"),
         client_id: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_ID"),
         client_secret: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_SECRET"),
+        private_key: typing.Optional[str] = None,
+        key_id: typing.Optional[str] = None,
         project_id: typing.Optional[str] = os.getenv("PIPEDREAM_PROJECT_ID"),
         project_environment: typing.Optional[ProjectEnvironment] = os.getenv(
             "PIPEDREAM_PROJECT_ENVIRONMENT",
@@ -73,8 +127,30 @@ class Pipedream(Client):
             logging=logging,
         )
 
+        client_secret, private_key = _resolve_credentials(client_secret, private_key)
+
         if access_token:
             super().__init__(token=(lambda: access_token), **common_kwargs)
+        elif private_key:
+            signer = _assertion_signer(client_id, private_key, key_id, resolved_base_url)
+            super().__init__(token=lambda: self._token_provider.get_token(), **common_kwargs)
+            # Token requests use their own unauthenticated wrapper over the same
+            # HTTP client, like the generated client-secret flow.
+            wrapper = self._client_wrapper
+            self._token_provider = PrivateKeyJwtTokenProvider(
+                client_id=typing.cast(str, client_id),
+                signer=signer,
+                client_wrapper=SyncClientWrapper(
+                    project_id=project_id,
+                    project_environment=project_environment,
+                    headers=headers,
+                    base_url=wrapper.get_base_url(),
+                    timeout=wrapper.get_timeout(),
+                    max_retries=wrapper.get_max_retries(),
+                    logging=logging,
+                    httpx_client=wrapper.httpx_client.httpx_client,
+                ),
+            )
         else:
             super().__init__(client_id=client_id, client_secret=client_secret, **common_kwargs)
 
@@ -101,6 +177,8 @@ class AsyncPipedream(AsyncClient):
         access_token: typing.Optional[str] = os.getenv("PIPEDREAM_ACCESS_TOKEN"),
         client_id: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_ID"),
         client_secret: typing.Optional[str] = os.getenv("PIPEDREAM_CLIENT_SECRET"),
+        private_key: typing.Optional[str] = None,
+        key_id: typing.Optional[str] = None,
         project_id: typing.Optional[str] = os.getenv("PIPEDREAM_PROJECT_ID"),
         project_environment: typing.Optional[ProjectEnvironment] = os.getenv(
             "PIPEDREAM_PROJECT_ENVIRONMENT",
@@ -135,8 +213,33 @@ class AsyncPipedream(AsyncClient):
             logging=logging,
         )
 
+        client_secret, private_key = _resolve_credentials(client_secret, private_key)
+
         if access_token:
             super().__init__(token=(lambda: access_token), **common_kwargs)
+        elif private_key:
+            signer = _assertion_signer(client_id, private_key, key_id, resolved_base_url)
+            super().__init__(token=(lambda: ""), **common_kwargs)
+            # Wire the async token provider the way the generated client-secret
+            # flow does: no sync token, an async one, and token requests on
+            # their own unauthenticated wrapper over the same HTTP client.
+            wrapper = self._client_wrapper
+            token_provider = AsyncPrivateKeyJwtTokenProvider(
+                client_id=typing.cast(str, client_id),
+                signer=signer,
+                client_wrapper=AsyncClientWrapper(
+                    project_id=project_id,
+                    project_environment=project_environment,
+                    headers=headers,
+                    base_url=wrapper.get_base_url(),
+                    timeout=wrapper.get_timeout(),
+                    max_retries=wrapper.get_max_retries(),
+                    logging=logging,
+                    httpx_client=wrapper.httpx_client.httpx_client,
+                ),
+            )
+            wrapper._token = None
+            wrapper._async_token = token_provider.get_token
         else:
             super().__init__(client_id=client_id, client_secret=client_secret, **common_kwargs)