prefect-client 2.16.4__py3-none-any.whl → 2.16.6__py3-none-any.whl

prefect/client/orchestration.py

@@ -15,6 +15,7 @@ from typing import (
 )
 from uuid import UUID, uuid4
 
+import certifi
 import httpcore
 import httpx
 import pendulum
@@ -134,8 +135,10 @@ from prefect.settings import (
     PREFECT_API_ENABLE_HTTP2,
     PREFECT_API_KEY,
     PREFECT_API_REQUEST_TIMEOUT,
+    PREFECT_API_SSL_CERT_FILE,
     PREFECT_API_TLS_INSECURE_SKIP_VERIFY,
     PREFECT_API_URL,
+    PREFECT_CLIENT_CSRF_SUPPORT_ENABLED,
     PREFECT_CLOUD_API_URL,
     PREFECT_UNIT_TEST_MODE,
 )
@@ -220,6 +223,11 @@ class PrefectClient:
 
         if PREFECT_API_TLS_INSECURE_SKIP_VERIFY:
             httpx_settings.setdefault("verify", False)
+        else:
+            cert_file = PREFECT_API_SSL_CERT_FILE.value()
+            if not cert_file:
+                cert_file = certifi.where()
+            httpx_settings.setdefault("verify", cert_file)
 
         if api_version is None:
             api_version = SERVER_API_VERSION
@@ -316,7 +324,15 @@ class PrefectClient:
 
         if not PREFECT_UNIT_TEST_MODE:
             httpx_settings.setdefault("follow_redirects", True)
-        self._client = PrefectHttpxClient(**httpx_settings)
+
+        enable_csrf_support = (
+            self.server_type != ServerType.CLOUD
+            and PREFECT_CLIENT_CSRF_SUPPORT_ENABLED.value()
+        )
+
+        self._client = PrefectHttpxClient(
+            **httpx_settings, enable_csrf_support=enable_csrf_support
+        )
         self._loop = None
 
         # See https://www.python-httpx.org/advanced/#custom-transports

prefect/client/schemas/objects.py

@@ -1632,3 +1632,16 @@ class GlobalConcurrencyLimit(ObjectBaseModel):
             " is used as a rate limit."
         ),
     )
+
+
+class CsrfToken(ObjectBaseModel):
+    token: str = Field(
+        default=...,
+        description="The CSRF token",
+    )
+    client: str = Field(
+        default=..., description="The client id associated with the CSRF token"
+    )
+    expiration: DateTimeTZ = Field(
+        default=..., description="The expiration time of the CSRF token"
+    )

prefect/client/subscriptions.py

@@ -74,9 +74,9 @@ class Subscription(Generic[S]):
             auth: Dict[str, Any] = orjson.loads(await websocket.recv())
             assert auth["type"] == "auth_success", auth.get("message")
 
-            message = {"type": "subscribe", "keys": self.keys} | {
-                **(dict(client_id=self.client_id) if self.client_id else {})
-            }
+            message = {"type": "subscribe", "keys": self.keys}
+            if self.client_id:
+                message.update({"client_id": self.client_id})
 
             await websocket.send(orjson.dumps(message).decode())
         except (

prefect/engine.py

@@ -2002,10 +2002,14 @@ async def orchestrate_task_run(
     )
 
     # Emit an event to capture that the task run was in the `PENDING` state.
-    last_event = _emit_task_run_state_change_event(
+    last_event = emit_task_run_state_change_event(
         task_run=task_run, initial_state=None, validated_state=task_run.state
     )
-    last_state = task_run.state
+    last_state = (
+        Pending()
+        if flow_run_context and flow_run_context.autonomous_task_run
+        else task_run.state
+    )
 
     # Completed states with persisted results should have result data. If it's missing,
     # this could be a manual state transition, so we should use the Unknown result type
@@ -2094,7 +2098,7 @@ async def orchestrate_task_run(
                 break
 
     # Emit an event to capture the result of proposing a `RUNNING` state.
-    last_event = _emit_task_run_state_change_event(
+    last_event = emit_task_run_state_change_event(
         task_run=task_run,
         initial_state=last_state,
         validated_state=state,
@@ -2187,7 +2191,7 @@ async def orchestrate_task_run(
                     await _check_task_failure_retriable(task, task_run, terminal_state)
                 )
             state = await propose_state(client, terminal_state, task_run_id=task_run.id)
-            last_event = _emit_task_run_state_change_event(
+            last_event = emit_task_run_state_change_event(
                 task_run=task_run,
                 initial_state=last_state,
                 validated_state=state,
@@ -2220,7 +2224,7 @@ async def orchestrate_task_run(
                 )
                 # Attempt to enter a running state again
                 state = await propose_state(client, Running(), task_run_id=task_run.id)
-                last_event = _emit_task_run_state_change_event(
+                last_event = emit_task_run_state_change_event(
                     task_run=task_run,
                     initial_state=last_state,
                     validated_state=state,
@@ -2896,7 +2900,7 @@ async def check_api_reachable(client: PrefectClient, fail_message: str):
     API_HEALTHCHECKS[api_url] = get_deadline(60 * 10)
 
 
-def _emit_task_run_state_change_event(
+def emit_task_run_state_change_event(
     task_run: TaskRun,
     initial_state: Optional[State],
     validated_state: State,

prefect/events/related.py

@@ -74,7 +74,7 @@ async def related_resources_from_run_context(
     if flow_run_id is None:
         return []
 
-    related_objects: list[ResourceCacheEntry] = []
+    related_objects: List[ResourceCacheEntry] = []
 
     async with get_client() as client:
 

prefect/events/schemas.py

@@ -372,9 +372,53 @@ class MetricTrigger(ResourceTrigger):
     )
 
 
-TriggerTypes: TypeAlias = Union[EventTrigger, MetricTrigger]
+class CompositeTrigger(Trigger, abc.ABC):
+    """
+    Requires some number of triggers to have fired within the given time period.
+    """
+
+    type: Literal["compound", "sequence"]
+    triggers: List["TriggerTypes"]
+    within: Optional[timedelta]
+
+
+class CompoundTrigger(CompositeTrigger):
+    """A composite trigger that requires some number of triggers to have
+    fired within the given time period"""
+
+    type: Literal["compound"] = "compound"
+    require: Union[int, Literal["any", "all"]]
+
+    @root_validator
+    def validate_require(cls, values: Dict[str, Any]) -> Dict[str, Any]:
+        require = values.get("require")
+
+        if isinstance(require, int):
+            if require < 1:
+                raise ValueError("required must be at least 1")
+            if require > len(values["triggers"]):
+                raise ValueError(
+                    "required must be less than or equal to the number of triggers"
+                )
+
+        return values
+
+
+class SequenceTrigger(CompositeTrigger):
+    """A composite trigger that requires some number of triggers to have fired
+    within the given time period in a specific order"""
+
+    type: Literal["sequence"] = "sequence"
+
+
+TriggerTypes: TypeAlias = Union[
+    EventTrigger, MetricTrigger, CompoundTrigger, SequenceTrigger
+]
 """The union of all concrete trigger types that a user may actually create"""
 
+CompoundTrigger.update_forward_refs()
+SequenceTrigger.update_forward_refs()
+
 
 class Automation(PrefectBaseModel):
     """Defines an action a user wants to take when a certain number of events

prefect/flows.py

@@ -1345,8 +1345,12 @@ def flow(
     result_serializer: Optional[ResultSerializer] = None,
     cache_result_in_memory: bool = True,
     log_prints: Optional[bool] = None,
-    on_completion: Optional[List[Callable[[FlowSchema, FlowRun, State], None]]] = None,
-    on_failure: Optional[List[Callable[[FlowSchema, FlowRun, State], None]]] = None,
+    on_completion: Optional[
+        List[Callable[[FlowSchema, FlowRun, State], Union[Awaitable[None], None]]]
+    ] = None,
+    on_failure: Optional[
+        List[Callable[[FlowSchema, FlowRun, State], Union[Awaitable[None], None]]]
+    ] = None,
     on_cancellation: Optional[
         List[Callable[[FlowSchema, FlowRun, State], None]]
     ] = None,
@@ -1373,8 +1377,12 @@ def flow(
     result_serializer: Optional[ResultSerializer] = None,
     cache_result_in_memory: bool = True,
     log_prints: Optional[bool] = None,
-    on_completion: Optional[List[Callable[[FlowSchema, FlowRun, State], None]]] = None,
-    on_failure: Optional[List[Callable[[FlowSchema, FlowRun, State], None]]] = None,
+    on_completion: Optional[
+        List[Callable[[FlowSchema, FlowRun, State], Union[Awaitable[None], None]]]
+    ] = None,
+    on_failure: Optional[
+        List[Callable[[FlowSchema, FlowRun, State], Union[Awaitable[None], None]]]
+    ] = None,
     on_cancellation: Optional[
         List[Callable[[FlowSchema, FlowRun, State], None]]
     ] = None,

prefect/server/api/collections_data/views/aggregate-worker-metadata.json

@@ -912,8 +912,7 @@
             "metadata": {
               "name": "{{ name }}",
               "annotations": {
-                "run.googleapis.com/launch-stage": "BETA",
-                "run.googleapis.com/vpc-access-connector": "{{ vpc_connector_name }}"
+                "run.googleapis.com/launch-stage": "BETA"
               }
             },
             "spec": {
@@ -941,6 +940,11 @@
                       "serviceAccountName": "{{ service_account_name }}"
                     }
                   }
+                },
+                "metadata": {
+                  "annotations": {
+                    "run.googleapis.com/vpc-access-connector": "{{ vpc_connector_name }}"
+                  }
                 }
               }
             }
@@ -1093,8 +1097,10 @@
             "launchStage": "{{ launch_stage }}",
             "template": {
               "template": {
+                "serviceAccount": "{{ service_account_name }}",
                 "maxRetries": "{{ max_retries }}",
                 "timeout": "{{ timeout }}",
+                "vpcAccess": "{{ vpc_connector_name }}",
                 "containers": [
                   {
                     "env": [],
@@ -1229,6 +1235,12 @@
               "title": "VPC Connector Name",
               "description": "The name of the VPC connector to use for the Cloud Run job.",
               "type": "string"
+            },
+            "service_account_name": {
+              "title": "Service Account Name",
+              "description": "The name of the service account to use for the task execution of Cloud Run Job. By default Cloud Run jobs run as the default Compute Engine Service Account.",
+              "example": "service-account@example.iam.gserviceaccount.com",
+              "type": "string"
             }
           },
           "definitions": {

prefect/settings.py

@@ -102,7 +102,10 @@ T = TypeVar("T")
 
 DEFAULT_PROFILES_PATH = Path(__file__).parent.joinpath("profiles.toml")
 
-REMOVED_EXPERIMENTAL_FLAGS = {"PREFECT_EXPERIMENTAL_ENABLE_ENHANCED_SCHEDULING_UI"}
+REMOVED_EXPERIMENTAL_FLAGS = {
+    "PREFECT_EXPERIMENTAL_ENABLE_ENHANCED_SCHEDULING_UI",
+    "PREFECT_EXPERIMENTAL_ENABLE_ENHANCED_DEPLOYMENT_PARAMETERS",
+}
 
 
 class Setting(Generic[T]):
@@ -592,6 +595,16 @@ PREFECT_API_TLS_INSECURE_SKIP_VERIFY = Setting(
 This is recommended only during development, e.g. when using self-signed certificates.
 """
 
+PREFECT_API_SSL_CERT_FILE = Setting(
+    str,
+    default=os.environ.get("SSL_CERT_FILE"),
+)
+"""
+This configuration settings option specifies the path to an SSL certificate file. 
+When set, it allows the application to use the specified certificate for secure communication. 
+If left unset, the setting will default to the value provided by the `SSL_CERT_FILE` environment variable.
+"""
+
 PREFECT_API_URL = Setting(
     str,
     default=None,
@@ -657,6 +670,21 @@ A comma-separated list of extra HTTP status codes to retry on. Defaults to an em
 may result in unexpected behavior.
 """
 
+PREFECT_CLIENT_CSRF_SUPPORT_ENABLED = Setting(bool, default=True)
+"""
+Determines if CSRF token handling is active in the Prefect client for API
+requests.
+
+When enabled (`True`), the client automatically manages CSRF tokens by
+retrieving, storing, and including them in applicable state-changing requests
+(POST, PUT, PATCH, DELETE) to the API.
+
+Disabling this setting (`False`) means the client will not handle CSRF tokens,
+which might be suitable for environments where CSRF protection is disabled.
+
+Defaults to `True`, ensuring CSRF protection is enabled by default.
+"""
+
 PREFECT_CLOUD_API_URL = Setting(
     str,
     default="https://api.prefect.cloud/api",
@@ -1207,6 +1235,33 @@ Note this setting only applies when calling `prefect server start`; if hosting t
 API with another tool you will need to configure this there instead.
 """
 
+PREFECT_SERVER_CSRF_PROTECTION_ENABLED = Setting(bool, default=True)
+"""
+Controls the activation of CSRF protection for the Prefect server API.
+
+When enabled (`True`), the server enforces CSRF validation checks on incoming
+state-changing requests (POST, PUT, PATCH, DELETE), requiring a valid CSRF
+token to be included in the request headers or body. This adds a layer of
+security by preventing unauthorized or malicious sites from making requests on
+behalf of authenticated users.
+
+It is recommended to enable this setting in production environments where the
+API is exposed to web clients to safeguard against CSRF attacks.
+
+Note: Enabling this setting requires corresponding support in the client for
+CSRF token management. See PREFECT_CLIENT_CSRF_SUPPORT_ENABLED for more.
+"""
+
+PREFECT_SERVER_CSRF_TOKEN_EXPIRATION = Setting(timedelta, default=timedelta(hours=1))
+"""
+Specifies the duration for which a CSRF token remains valid after being issued
+by the server.
+
+The default expiration time is set to 1 hour, which offers a reasonable
+compromise. Adjust this setting based on your specific security requirements
+and usage patterns.
+"""
+
 PREFECT_UI_ENABLED = Setting(
     bool,
     default=True,
@@ -1292,12 +1347,12 @@ PREFECT_API_MAX_FLOW_RUN_GRAPH_ARTIFACTS = Setting(int, default=10000)
 The maximum number of artifacts to show on a flow run graph on the v2 API
 """
 
-PREFECT_EXPERIMENTAL_ENABLE_ARTIFACTS_ON_FLOW_RUN_GRAPH = Setting(bool, default=False)
+PREFECT_EXPERIMENTAL_ENABLE_ARTIFACTS_ON_FLOW_RUN_GRAPH = Setting(bool, default=True)
 """
 Whether or not to enable artifacts on the flow run graph.
 """
 
-PREFECT_EXPERIMENTAL_ENABLE_STATES_ON_FLOW_RUN_GRAPH = Setting(bool, default=False)
+PREFECT_EXPERIMENTAL_ENABLE_STATES_ON_FLOW_RUN_GRAPH = Setting(bool, default=True)
 """
 Whether or not to enable flow run states on the flow run graph.
 """
@@ -1342,11 +1397,6 @@ PREFECT_EXPERIMENTAL_ENABLE_ENHANCED_CANCELLATION = Setting(bool, default=True)
 Whether or not to enable experimental enhanced flow run cancellation.
 """
 
-PREFECT_EXPERIMENTAL_ENABLE_ENHANCED_DEPLOYMENT_PARAMETERS = Setting(bool, default=True)
-"""
-Whether or not to enable enhanced deployment parameters.
-"""
-
 PREFECT_EXPERIMENTAL_WARN_ENHANCED_CANCELLATION = Setting(bool, default=False)
 """
 Whether or not to warn when experimental enhanced flow run cancellation is used.
@@ -1525,6 +1575,10 @@ PREFECT_EXPERIMENTAL_ENABLE_WORK_QUEUE_STATUS = Setting(bool, default=True)
 Whether or not to enable experimental work queue status in-place of work queue health.
 """
 
+PREFECT_EXPERIMENTAL_ENABLE_PYDANTIC_V2_INTERNALS = Setting(bool, default=False)
+"""
+Whether or not to enable internal experimental Pydantic v2 behavior.
+"""
 
 # Defaults -----------------------------------------------------------------------------
 

prefect/task_server.py

@@ -6,7 +6,7 @@ import socket
 import sys
 from contextlib import AsyncExitStack
 from functools import partial
-from typing import Optional, Type
+from typing import List, Optional, Type
 
 import anyio
 from websockets.exceptions import InvalidStatusCode
@@ -15,7 +15,7 @@ from prefect import Task, get_client
 from prefect._internal.concurrency.api import create_call, from_sync
 from prefect.client.schemas.objects import TaskRun
 from prefect.client.subscriptions import Subscription
-from prefect.engine import propose_state
+from prefect.engine import emit_task_run_state_change_event, propose_state
 from prefect.logging.loggers import get_logger
 from prefect.results import ResultFactory
 from prefect.settings import (
@@ -72,7 +72,7 @@ class TaskServer:
         *tasks: Task,
         task_runner: Optional[Type[BaseTaskRunner]] = None,
     ):
-        self.tasks: list[Task] = tasks
+        self.tasks: List[Task] = tasks
 
         self.task_runner: BaseTaskRunner = task_runner or ConcurrentTaskRunner()
         self.started: bool = False
@@ -205,6 +205,12 @@ class TaskServer:
                 " Task run may have already begun execution."
             )
 
+        emit_task_run_state_change_event(
+            task_run=task_run,
+            initial_state=task_run.state,
+            validated_state=state,
+        )
+
         self._runs_task_group.start_soon(
             partial(
                 submit_autonomous_task_run_to_engine,

prefect/tasks.py

@@ -283,13 +283,14 @@ class Task(Generic[P, R]):
         if not hasattr(self.fn, "__qualname__"):
             self.task_key = to_qualified_name(type(self.fn))
         else:
-            if self.fn.__module__ == "__main__":
-                task_definition_path = inspect.getsourcefile(self.fn)
-                self.task_key = hash_objects(
-                    self.name, os.path.abspath(task_definition_path)
+            try:
+                task_origin_hash = hash_objects(
+                    self.name, os.path.abspath(inspect.getsourcefile(self.fn))
                 )
-            else:
-                self.task_key = to_qualified_name(self.fn)
+            except TypeError:
+                task_origin_hash = "unknown-source-file"
+
+            self.task_key = f"{self.fn.__qualname__}-{task_origin_hash}"
 
         self.cache_key_fn = cache_key_fn
         self.cache_expiration = cache_expiration
@@ -390,8 +391,12 @@ class Task(Generic[P, R]):
         timeout_seconds: Union[int, float] = None,
         log_prints: Optional[bool] = NotSet,
         refresh_cache: Optional[bool] = NotSet,
-        on_completion: Optional[List[Callable[["Task", TaskRun, State], None]]] = None,
-        on_failure: Optional[List[Callable[["Task", TaskRun, State], None]]] = None,
+        on_completion: Optional[
+            List[Callable[["Task", TaskRun, State], Union[Awaitable[None], None]]]
+        ] = None,
+        on_failure: Optional[
+            List[Callable[["Task", TaskRun, State], Union[Awaitable[None], None]]]
+        ] = None,
         retry_condition_fn: Optional[Callable[["Task", TaskRun, State], bool]] = None,
         viz_return_value: Optional[Any] = None,
     ):

prefect/utilities/callables.py

@@ -1,6 +1,7 @@
 """
 Utilities for working with Python callables.
 """
+
 import inspect
 from functools import partial
 from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
@@ -8,13 +9,13 @@ from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
 import cloudpickle
 
 from prefect._internal.pydantic import HAS_PYDANTIC_V2
+from prefect._internal.pydantic.v1_schema import has_v1_type_as_param
 
 if HAS_PYDANTIC_V2:
     import pydantic.v1 as pydantic
 
     from prefect._internal.pydantic.v2_schema import (
         create_v2_schema,
-        has_v2_type_as_param,
         process_v2_params,
     )
 else:
@@ -312,8 +313,9 @@ def parameter_schema(fn: Callable) -> ParameterSchema:
         ParameterSchema: the argument schema
     """
     try:
-        signature = inspect.signature(fn, eval_str=True)
+        signature = inspect.signature(fn, eval_str=True)  # novm
     except (NameError, TypeError):
+        # `eval_str` is not available in Python < 3.10
         signature = inspect.signature(fn)
 
     model_fields = {}
@@ -323,7 +325,7 @@ def parameter_schema(fn: Callable) -> ParameterSchema:
     class ModelConfig:
         arbitrary_types_allowed = True
 
-    if HAS_PYDANTIC_V2 and has_v2_type_as_param(signature):
+    if HAS_PYDANTIC_V2 and not has_v1_type_as_param(signature):
         create_schema = create_v2_schema
         process_params = process_v2_params
     else:

prefect/utilities/schema_tools/hydration.py

@@ -149,9 +149,13 @@ def null_handler(obj: Dict, ctx: HydrationContext):
 @handler("json")
 def json_handler(obj: Dict, ctx: HydrationContext):
     if "value" in obj:
+        if isinstance(obj["value"], dict):
+            dehydrated_json = _hydrate(obj["value"], ctx)
+        else:
+            dehydrated_json = obj["value"]
         try:
-            return json.loads(obj["value"])
-        except json.decoder.JSONDecodeError as e:
+            return json.loads(dehydrated_json)
+        except (json.decoder.JSONDecodeError, TypeError) as e:
             return InvalidJSON(detail=str(e))
     else:
         # If `value` is not in the object, we need special handling to help
@@ -166,11 +170,15 @@ def json_handler(obj: Dict, ctx: HydrationContext):
 @handler("workspace_variable")
 def workspace_variable_handler(obj: Dict, ctx: HydrationContext):
     if "variable_name" in obj:
-        variable = obj["variable_name"]
-        if variable in ctx.workspace_variables:
-            return ctx.workspace_variables[variable]
+        if isinstance(obj["variable_name"], dict):
+            dehydrated_variable = _hydrate(obj["variable_name"], ctx)
+        else:
+            dehydrated_variable = obj["variable_name"]
+
+        if dehydrated_variable in ctx.workspace_variables:
+            return ctx.workspace_variables[dehydrated_variable]
         else:
-            return WorkspaceVariableNotFound(detail=variable)
+            return WorkspaceVariableNotFound(detail=dehydrated_variable)
     else:
         # Special handling if `variable_name` is not in the object.
         # If an object looks like {"__prefect_kind": "workspace_variable"}

{prefect_client-2.16.4.dist-info → prefect_client-2.16.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: prefect-client
-Version: 2.16.4
+Version: 2.16.6
 Summary: Workflow orchestration and management.
 Home-page: https://www.prefect.io
 Author: Prefect Technologies, Inc.