pyoncat 2.8__tar.gz → 2.9__tar.gz

{pyoncat-2.8 → pyoncat-2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyoncat
-Version: 2.8
+Version: 2.9
 Summary: A Python Client for ONCat (the ORNL Neutron Catalog).
 Keywords: ornl,neutron,metadata,catalog
 Author: ONCat Support
@@ -30,7 +30,7 @@ The `pyoncat` package serves as a Python client to more easily interact with the
 
 ### Requirements
 
-- Python version: `>=3.7, <4`
+- Python version: `>=3.9, <4`
 - Python packages: `requests`
 - Optional packages for authenticated API access: `oauthlib`, `requests-oauthlib`
 

{pyoncat-2.8 → pyoncat-2.9}/pyoncat/README.md

@@ -10,7 +10,7 @@ The `pyoncat` package serves as a Python client to more easily interact with the
 
 ### Requirements
 
-- Python version: `>=3.7, <4`
+- Python version: `>=3.9, <4`
 - Python packages: `requests`
 - Optional packages for authenticated API access: `oauthlib`, `requests-oauthlib`
 

{pyoncat-2.8 → pyoncat-2.9}/pyoncat/__init__.py

@@ -34,7 +34,7 @@ from pyoncat.reduction import ReductionFileBuilder
 if TYPE_CHECKING:
     import threading
 
-__version__ = "2.8"
+__version__ = "2.9"
 
 # Sent on every request PyONCat makes, API calls and token requests alike,
 # so server logs can tell PyONCat traffic from other clients.
@@ -937,12 +937,13 @@ class ONCat:
             device_authorization_timeout: float | None
                 Device Authorization Grant only.  An overall caller
                 deadline in seconds for the sign-in, distinct from the
-                RFC 8628 server-side `expires_in`.  When set, polling
-                stops at the deadline with `DeviceAuthorizationTimeout`.
-                Polling also stops no later than the server's own
-                `expires_in` (the effective deadline is the earlier of
-                the two).  `None` (the default) means no overall deadline
-                -- today's behavior.
+                RFC 8628 server-side `expires_in`.  Polling stops at the
+                earlier of the two.  When the caller deadline is reached
+                first, the sign-in raises `DeviceAuthorizationTimeout`;
+                when the server's `expires_in` is reached first (or at
+                the same moment, or no caller deadline is set), it raises
+                `DeviceAuthorizationExpired`.  `None` (the default) means
+                no overall caller deadline.
 
             http_timeout: float | None
                 Device Authorization Grant only.  The connect/read HTTP
@@ -1212,14 +1213,22 @@ class ONCat:
         # The effective deadline is the earlier of the caller's overall
         # `device_authorization_timeout` (clocked from before the
         # initial POST) and the server's own `expires_in` (clocked from
-        # now, once known).
+        # now, once known). Which one it is decides the outcome raised
+        # when it passes: the server expiry means the device code is dead
+        # (`DeviceAuthorizationExpired`, the same outcome as a server
+        # `expired_token`), the caller deadline means the caller gave up
+        # (`DeviceAuthorizationTimeout`). On a tie the device code is dead
+        # either way, so the server expiry wins.
         server_expiry = (
             monotonic() + expires_in if expires_in is not None else None
         )
-        deadlines = [
-            d for d in (caller_deadline, server_expiry) if d is not None
-        ]
-        deadline = min(deadlines) if deadlines else None
+        deadline = caller_deadline
+        deadline_is_server_expiry = False
+        if server_expiry is not None and (
+            caller_deadline is None or server_expiry <= caller_deadline
+        ):
+            deadline = server_expiry
+            deadline_is_server_expiry = True
 
         self._dispatch_device_authorization_challenge(
             prompt,
@@ -1241,10 +1250,18 @@ class ONCat:
 
         while True:
             self._raise_if_cancelled(cancel_event)
-            self._raise_if_past_deadline(deadline, monotonic)
+            self._raise_if_past_deadline(
+                deadline,
+                monotonic,
+                server_expiry=deadline_is_server_expiry,
+            )
             sleep(self._poll_wait_seconds(interval, deadline, monotonic))
             self._raise_if_cancelled(cancel_event)
-            self._raise_if_past_deadline(deadline, monotonic)
+            self._raise_if_past_deadline(
+                deadline,
+                monotonic,
+                server_expiry=deadline_is_server_expiry,
+            )
 
             try:
                 token_response = requests.post(
@@ -1377,14 +1394,32 @@ class ONCat:
 
     @staticmethod
     def _raise_if_past_deadline(
-        deadline: float | None, monotonic: Callable[[], float]
+        deadline: float | None,
+        monotonic: Callable[[], float],
+        *,
+        server_expiry: bool = False,
     ) -> None:
-        if deadline is not None and monotonic() >= deadline:
+        """Raise once `deadline` has passed.
+
+        `server_expiry` says the deadline is the device code's own
+        `expires_in`, so passing it raises `DeviceAuthorizationExpired`;
+        otherwise it is the caller's `device_authorization_timeout` and
+        passing it raises `DeviceAuthorizationTimeout`.
+        """
+        if deadline is None or monotonic() < deadline:
+            return
+        if server_expiry:
             msg = (
-                "Device authorization timed out before the user completed "
-                "the sign-in."
+                "Device authorization expired: the device code's "
+                "expires_in lapsed before the user completed the sign-in."
             )
-            raise DeviceAuthorizationTimeout(msg)
+            raise DeviceAuthorizationExpired(msg)
+        msg = (
+            "Device authorization timed out: the caller's "
+            "device_authorization_timeout lapsed before the user completed "
+            "the sign-in."
+        )
+        raise DeviceAuthorizationTimeout(msg)
 
     def _dispatch_device_authorization_challenge(
         self,
@@ -2160,7 +2195,10 @@ class DeviceAuthorizationDenied(DeviceAuthorizationError):  # ruff: ignore[error
 
 class DeviceAuthorizationExpired(DeviceAuthorizationError):  # ruff: ignore[error-suffix-on-exception-name] - public API name (ADR-000097)
     """Raised when the device code expired before the user approved the
-    sign-in (the IdP returned `expired_token`, RFC 8628 §3.5)."""
+    sign-in: the IdP returned `expired_token` (RFC 8628 §3.5), or the
+    server's `expires_in` lapsed no later than the caller's
+    `device_authorization_timeout`. The code is dead, so a new sign-in
+    must start from a fresh device code."""
 
 
 class DeviceAuthorizationCancelled(DeviceAuthorizationError):  # ruff: ignore[error-suffix-on-exception-name] - public API name (ADR-000097)
@@ -2170,8 +2208,9 @@ class DeviceAuthorizationCancelled(DeviceAuthorizationError):  # ruff: ignore[er
 
 class DeviceAuthorizationTimeout(DeviceAuthorizationError):  # ruff: ignore[error-suffix-on-exception-name] - public API name (ADR-000097)
     """Raised when the sign-in did not complete before the overall
-    caller deadline (`device_authorization_timeout`) or the server's own
-    `expires_in`, whichever came first."""
+    caller deadline (`device_authorization_timeout`) and that deadline
+    came strictly before the server's own `expires_in`. A server expiry
+    reached first raises `DeviceAuthorizationExpired` instead."""
 
 
 class DeviceAuthorizationNetworkError(DeviceAuthorizationError):

{pyoncat-2.8 → pyoncat-2.9}/pyproject.toml

@@ -1,13 +1,13 @@
 [build-system]
-requires = ["poetry"]
-build-backend = "poetry.masonry.api"
+requires = ["poetry-core"]
+build-backend = "poetry.core.masonry.api"
 
 # Poetry requires it's own condfiguration because it predates the
 # "[project]" standard.  See:
 # https://github.com/python-poetry/roadmap/issues/3
 [tool.poetry]
 name = "pyoncat"
-version = "2.8"
+version = "2.9"
 description = "A Python Client for ONCat (the ORNL Neutron Catalog)."
 authors = ["ONCat Support <oncat-support@ornl.gov>"]
 readme = ["pyoncat/README.md", "pyoncat/LICENSE"]