python-etcd3-async 0.1.5__py3-none-any.whl → 0.1.6__py3-none-any.whl

etcd3/__init__.py

@@ -50,7 +50,7 @@ from etcd3.async_single_client import async_client
 
 __author__ = "owasd"
 __email__ = ""
-__version__ = "0.1.0"
+__version__ = "0.1.6"
 
 __all__ = (
     "etcdrpc",

etcd3/async_client_extensions.py

@@ -730,9 +730,9 @@ class AsyncClusterOperations:
     def __init__(self, client):
         self.client = client
 
-    async def add_member(self, urls):
+    async def add_member(self, urls, is_learner=False):
         """Add a member into the cluster."""
-        return await self.client.cluster_manager.add_member(urls)
+        return await self.client.cluster_manager.add_member(urls, is_learner)
 
     async def remove_member(self, member_id):
         """Remove an existing member from the cluster."""

etcd3/async_managers.py

@@ -224,14 +224,19 @@ class AsyncClusterManager:
     def __init__(self, etcd_client):
         self.etcd_client = etcd_client
 
-    async def add_member(self, urls):
+    async def add_member(self, urls, is_learner=False):
         """
         Add a member into the cluster.
 
+        :param urls: peer URLs the member will advertise to the cluster
+        :param is_learner: add as a non-voting learner, which does not
+                           affect quorum on an existing cluster
         :returns: new member
         :rtype: :class:`.Member`
         """
-        member_add_request = etcdrpc.MemberAddRequest(peerURLs=urls)
+        member_add_request = etcdrpc.MemberAddRequest(
+            peerURLs=urls, isLearner=is_learner
+        )
 
         # Create cluster stub directly
         channel = await self.etcd_client._get_channel()

etcd3/async_multi_client.py

@@ -19,7 +19,6 @@ from etcd3.shared import (
     EXCEPTIONS_BY_CODE,
     FAILED_EP_CODES,
     Transactions,
-    EtcdTokenCallCredentials,
     RequestBuilder,
 )
 from etcd3.async_managers import (
@@ -161,8 +160,14 @@ class AsyncMultiEndpointEtcd3Client:
         self.transactions = Transactions()
         self.auth = AsyncAuthOperations(self)
 
-    async def _init_auth(self):
-        """Initialize authentication asynchronously."""
+    async def _init_auth(self, channel=None):
+        """Initialize authentication asynchronously.
+
+        :param channel: Channel to run Authenticate on. Callers from
+            ``_get_channel`` pass the channel they are about to return —
+            re-acquiring here could rebuild (close) that channel.
+        :type channel: grpc.aio.Channel, optional
+        """
         if self._auth_done:
             return
 
@@ -172,7 +177,8 @@ class AsyncMultiEndpointEtcd3Client:
 
             if self._user and self._password:
                 # Create auth stub with auto-reconnection
-                channel = await self._get_channel()
+                if channel is None:
+                    channel = await self._acquire_channel()
                 auth_stub = etcdrpc.AuthStub(channel)
 
                 auth_request = etcdrpc.AuthenticateRequest(
@@ -180,10 +186,11 @@ class AsyncMultiEndpointEtcd3Client:
                 )
 
                 resp = await auth_stub.Authenticate(auth_request, timeout=self.timeout)
+                # Token is attached via self.metadata on every call. Do not
+                # create grpc call credentials here: grpc.aio rejects them on
+                # insecure channels ("call credentials are only valid on
+                # secure channels") and the metadata token works everywhere.
                 self.metadata = (("token", resp.token),)
-                self.call_credentials = grpc.metadata_call_credentials(
-                    EtcdTokenCallCredentials(resp.token)
-                )
 
             self._auth_done = True
 
@@ -280,11 +287,28 @@ class AsyncMultiEndpointEtcd3Client:
         """Try to rebuild the channel, return True on success, False on failure."""
         try:
             await endpoint.rebuild_channel()
+            # A rebuilt channel may talk to a restarted server whose
+            # token seed changed; force re-authentication on next use.
+            self._auth_done = False
             return True
         except Exception:
             return False
 
     async def _get_channel(self):
+        """Get an available channel, authenticating first when credentials exist.
+
+        Lazy auth: when the client was created with user/password and no
+        token is held yet (initial use or after a channel rebuild), the
+        Authenticate RPC runs before the channel is handed out. All call
+        sites read ``self.metadata`` after ``_get_channel()``, so the
+        token is always attached.
+        """
+        channel = await self._acquire_channel()
+        if self._user and self._password and not self._auth_done:
+            await self._init_auth(channel)
+        return channel
+
+    async def _acquire_channel(self):
         """Get an available channel with automatic reconnection support.
 
         Uses two-phase locking strategy:
@@ -969,14 +993,17 @@ class AsyncMultiEndpointEtcd3Client:
         """
         return await self.lock_ops.lock(name, ttl=ttl)
 
-    async def add_member(self, urls):
+    async def add_member(self, urls, is_learner=False):
         """
         Add a member into the cluster.
 
+        :param urls: peer URLs the member will advertise to the cluster
+        :param is_learner: add as a non-voting learner, which does not
+                           affect quorum on an existing cluster
         :returns: new member
         :rtype: :class:`.Member`
         """
-        return await self.cluster_ops.add_member(urls)
+        return await self.cluster_ops.add_member(urls, is_learner)
 
     async def remove_member(self, member_id):
         """

etcd3/errors.py

@@ -26,6 +26,79 @@ _FAILED_EP_CODES = [
 ]
 
 
+def _is_invalid_auth_token(exc):
+    """Check if an RPC error means the server rejected our auth token."""
+    try:
+        return exc.code() == grpc.StatusCode.UNAUTHENTICATED
+    except Exception:
+        return False
+
+
+async def _try_reauth(client_or_ops):
+    """Re-authenticate after the server rejected our token.
+
+    etcd rotates its token seed on restart, so an existing channel can be
+    fully healthy while the stored token is dead. Drop the token and let
+    the lazy-auth path in ``_get_channel`` mint a fresh one.
+
+    :return: True when a new token was obtained, False when re-auth does
+        not apply (no credentials or non-authenticating client object)
+    """
+    client = getattr(client_or_ops, "client", client_or_ops)
+    if not (
+        getattr(client, "_user", None)
+        and getattr(client, "_password", None)
+        and hasattr(client, "_get_channel")
+    ):
+        return False
+    client._auth_done = False
+    await client._get_channel()
+    return True
+
+
+async def _call_with_auth_retry(payload, self, args, kwargs, error_handler_func):
+    """Run payload; on an invalid-token error re-authenticate and retry once.
+
+    The retry attempt is safe: an UNAUTHENTICATED call never reached the
+    state machine, so the operation was not applied server-side.
+    """
+    try:
+        return await payload(self, *args, **kwargs)
+    except grpc.RpcError as exc:
+        if _is_invalid_auth_token(exc) and await _try_reauth(self):
+            try:
+                return await payload(self, *args, **kwargs)
+            except grpc.RpcError as retry_exc:
+                exc = retry_exc
+        error_handler_func(self, exc)
+
+
+def _try_reauth_sync(client_or_ops):
+    """Sync counterpart of :func:`_try_reauth` (see above)."""
+    client = getattr(client_or_ops, "client", client_or_ops)
+    if not (
+        getattr(client, "_user", None)
+        and getattr(client, "_password", None)
+        and hasattr(client, "_authenticate")
+    ):
+        return False
+    client._authenticate()
+    return True
+
+
+def _call_with_auth_retry_sync(payload, self, args, kwargs, error_handler_func):
+    """Sync counterpart of :func:`_call_with_auth_retry` (see above)."""
+    try:
+        return payload(self, *args, **kwargs)
+    except grpc.RpcError as exc:
+        if _is_invalid_auth_token(exc) and _try_reauth_sync(self):
+            try:
+                return payload(self, *args, **kwargs)
+            except grpc.RpcError as retry_exc:
+                exc = retry_exc
+        error_handler_func(self, exc)
+
+
 def _make_async_handle_errors_with_tracing(error_handler_func, operation_name: str):
     """Factory to create async error handlers with tracing."""
 
@@ -34,15 +107,13 @@ def _make_async_handle_errors_with_tracing(error_handler_func, operation_name: s
         async def handler(self, *args, **kwargs):
             tracer = get_tracer()
             if tracer is None:
-                try:
-                    return await payload(self, *args, **kwargs)
-                except grpc.RpcError as exc:
-                    error_handler_func(self, exc)
+                return await _call_with_auth_retry(
+                    payload, self, args, kwargs, error_handler_func
+                )
             with create_span(operation_name, {"operation": operation_name}):
-                try:
-                    return await payload(self, *args, **kwargs)
-                except grpc.RpcError as exc:
-                    error_handler_func(self, exc)
+                return await _call_with_auth_retry(
+                    payload, self, args, kwargs, error_handler_func
+                )
 
         return handler
 
@@ -100,17 +171,13 @@ def _make_sync_handle_errors_with_tracing(error_handler_func, operation_name: st
         def handler(self, *args, **kwargs):
             tracer = get_tracer()
             if tracer is None:
-                try:
-                    return payload(self, *args, **kwargs)
-                except grpc.RpcError as exc:
-                    error_handler_func(self, exc)
-                    return
+                return _call_with_auth_retry_sync(
+                    payload, self, args, kwargs, error_handler_func
+                )
             with create_span(operation_name, {"operation": operation_name}):
-                try:
-                    return payload(self, *args, **kwargs)
-                except grpc.RpcError as exc:
-                    error_handler_func(self, exc)
-                    return
+                return _call_with_auth_retry_sync(
+                    payload, self, args, kwargs, error_handler_func
+                )
 
         return handler
 

etcd3/multi_client.py

@@ -164,21 +164,17 @@ class MultiEndpointEtcd3Client:
         cred_params = [c is not None for c in (user, password)]
 
         if all(cred_params):
-            auth_request = etcdrpc.AuthenticateRequest(name=user, password=password)
-
-            # Create auth stub directly (no caching needed)
-            auth_stub = etcdrpc.AuthStub(self.channel)
-            resp = auth_stub.Authenticate(auth_request, self.timeout)
-            self.metadata = (("token", resp.token),)
-            self.call_credentials = grpc.metadata_call_credentials(
-                self._get_etcd_token_call_credentials(resp.token)
-            )
-
+            self._user = user
+            self._password = password
+            self._authenticate()
         elif any(cred_params):
-            raise Exception(
+            raise ValueError(
                 "if using authentication credentials both user and password "
                 "must be specified."
             )
+        else:
+            self._user = None
+            self._password = None
 
         # Import here to avoid circular dependency
         from etcd3.shared import Transactions
@@ -206,11 +202,19 @@ class MultiEndpointEtcd3Client:
 
         self.maintenance = SyncMaintenanceOperations(self)
 
-    def _get_etcd_token_call_credentials(self, token):
-        """Get token call credentials for authentication."""
-        from etcd3.shared import EtcdTokenCallCredentials
+    def _authenticate(self):
+        """Obtain an auth token on the current channel (metadata-only).
 
-        return EtcdTokenCallCredentials(token)
+        The token rides in ``self.metadata`` on every call. Do not create
+        grpc call credentials here: they are rejected on insecure channels
+        and the metadata token works everywhere, matching the async client.
+        """
+        auth_request = etcdrpc.AuthenticateRequest(
+            name=self._user, password=self._password
+        )
+        auth_stub = etcdrpc.AuthStub(self.channel)
+        resp = auth_stub.Authenticate(auth_request, self.timeout)
+        self.metadata = (("token", resp.token),)
 
     @property
     def _current_endpoint_label(self):
@@ -1159,14 +1163,17 @@ class MultiEndpointEtcd3Client:
         """
         return self.lock_ops.lock(name, ttl=ttl)
 
-    def add_member(self, urls):
+    def add_member(self, urls, is_learner=False):
         """
         Add a member into the cluster.
 
+        :param urls: peer URLs the member will advertise to the cluster
+        :param is_learner: add as a non-voting learner, which does not
+                           affect quorum on an existing cluster
         :returns: new member
         :rtype: :class:`.Member`
         """
-        return self.cluster.add_member(urls)
+        return self.cluster.add_member(urls, is_learner)
 
     def remove_member(self, member_id):
         """

etcd3/shared.py

@@ -9,7 +9,16 @@ import functools
 import grpc
 import etcdrpc
 
-import etcd3.exceptions as exceptions
+# For backward compatibility, expose error handler factories
+from etcd3.errors import (
+    _make_sync_handle_errors_with_tracing,
+    _make_sync_handle_generator_errors_with_tracing,
+    _make_async_handle_errors_with_tracing as _make_async_handle_errors_with_tracing,
+    _make_async_handle_generator_errors_with_tracing as _make_async_handle_generator_errors_with_tracing,
+    _EXCEPTIONS_BY_CODE,
+    _FAILED_EP_CODES,
+)
+
 import etcd3.transactions as transactions
 import etcd3.utils as utils
 
@@ -299,16 +308,6 @@ class RequestBuilder:
         return delete_request
 
 
-# For backward compatibility, expose error handler factories
-from etcd3.errors import (
-    _make_sync_handle_errors_with_tracing,
-    _make_sync_handle_generator_errors_with_tracing,
-    _make_async_handle_errors_with_tracing,
-    _make_async_handle_generator_errors_with_tracing,
-    _EXCEPTIONS_BY_CODE,
-    _FAILED_EP_CODES,
-)
-
 # Re-export for compatibility
 EXCEPTIONS_BY_CODE = _EXCEPTIONS_BY_CODE
 FAILED_EP_CODES = _FAILED_EP_CODES
@@ -324,7 +323,10 @@ def _init_sync_error_handlers(error_handler_func):
 
     This must be called after client module is fully loaded.
     """
-    global _sync_handle_errors, _sync_handle_generator_errors, _sync_handle_keepalive_errors
+    global \
+        _sync_handle_errors, \
+        _sync_handle_generator_errors, \
+        _sync_handle_keepalive_errors
     _sync_handle_errors = _make_sync_handle_errors_with_tracing(
         error_handler_func, "etcd3.operation"
     )

etcd3/sync_cluster_operations.py

@@ -43,14 +43,19 @@ class SyncClusterOperations:
         return self.client.metadata
 
     @_sync_handle_errors
-    def add_member(self, urls):
+    def add_member(self, urls, is_learner=False):
         """
         Add a member into the cluster.
 
+        :param urls: peer URLs the member will advertise to the cluster
+        :param is_learner: add as a non-voting learner, which does not
+                           affect quorum on an existing cluster
         :returns: new member
         :rtype: :class:`.Member`
         """
-        member_add_request = etcdrpc.MemberAddRequest(peerURLs=urls)
+        member_add_request = etcdrpc.MemberAddRequest(
+            peerURLs=urls, isLearner=is_learner
+        )
 
         # Create cluster stub directly
         cluster_stub = etcdrpc.ClusterStub(self.channel)

{python_etcd3_async-0.1.5.dist-info → python_etcd3_async-0.1.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: python-etcd3-async
-Version: 0.1.5
+Version: 0.1.6
 Summary: etcd3 async sdk
 Requires-Python: <4,>=3.12
 Requires-Dist: grpcio==1.76.0

{python_etcd3_async-0.1.5.dist-info → python_etcd3_async-0.1.6.dist-info}/RECORD

@@ -1,18 +1,18 @@
-etcd3/__init__.py,sha256=gK79kTpBAMmbuVRuXc3kxxBjbjhNPTpqdaphqUwSals,3353
+etcd3/__init__.py,sha256=SB6RBboBlNB86OdfisuMJIAgdpq87uez2JrUGfhLL4E,3353
 etcd3/async_client.py,sha256=r10DHsJP6rWD55N5iq28ONRcU3VgWQozTJiLbFnKUEs,1499
-etcd3/async_client_extensions.py,sha256=umle1miB5KgsKWrShdhw1nI-hXADOGju1_l2rXf2N1E,34184
+etcd3/async_client_extensions.py,sha256=-L6FYftLfwzxWNKMZZCgu0SILBLLtSwsLUZ8Np8ixOY,34214
 etcd3/async_config.py,sha256=tjGR_SP25uYpC0wI9LoHxKgPuL7yaSHWtUQrcPrx0uQ,3530
 etcd3/async_endpoint.py,sha256=pXlMaV7acNQPFohYV3eCWfVTDSgvZlbwy42z0tx3rm4,4595
-etcd3/async_managers.py,sha256=WJkLaD38N60b0eqWQTlUQ-jX1NDyMqSrYxHO6NtItV8,18122
+etcd3/async_managers.py,sha256=qEDED9SbYy8xrMn180fK3FdlVzJnqV_Rs_5wvDLYnYA,18391
 etcd3/async_monitor.py,sha256=iZPac3Pqn5bI0ONguJJctQsi4b2ft4hWPknug6jj5RY,453
-etcd3/async_multi_client.py,sha256=urqRbf-lQ2AAljiAFP5Y6PzsJLHWXF9UTCZBiD2l2rU,45205
+etcd3/async_multi_client.py,sha256=N_FbfIHxCIKltdcJx7P0n14bLVwtdvZnpYl8jWk31yQ,46709
 etcd3/async_single_client.py,sha256=VO-ct-x6jPnqf2tPUlMYeitftxvgJTrM5KzyV7WaRhI,4506
 etcd3/async_watch.py,sha256=m6I2BAoI54J-ZPVVMxao6XJQXvVyQ88Hp2QeauD9z20,15962
 etcd3/auth.py,sha256=gWd6Cl2CMe4P6i4SsLQ_9UMv9bNSCs_QAMqyOVfKQ3k,21896
 etcd3/client.py,sha256=KXC7IwVOQlgky5GBg2Qmf-pNBwHlgR27rzKe-7tBSD4,1332
 etcd3/config.py,sha256=3Jm6Nbpdp-hiToR_FtM6cgktV5vB_5Da3S-aENtAtYU,6069
 etcd3/endpoint.py,sha256=aSMBmEitAADW0ABAZhc8L7jPYsQo8amEWKv6LJbsmC4,2589
-etcd3/errors.py,sha256=abSlnMmq5pG_7tJZK9hK1odR9O-7KPPjv1YE2OGccYM,6760
+etcd3/errors.py,sha256=kCy_vXTC8pInVv4UZqyGgc6LLcEevw1pWMlapWZCr4I,9084
 etcd3/events.py,sha256=TBWIiw6c_PcdAaBv_-jEqbOZNWTzTkZfDbHrYCkR9n0,903
 etcd3/exceptions.py,sha256=mkCdJAyWIJiVwHnT7PvDQ8aJTN3d8mW4KXs_V91Lr74,1093
 etcd3/leases.py,sha256=pkJVfYWCZ_uBXSjla5TXFfNf_D6yoTJnkntefOaPRrk,2788
@@ -21,11 +21,11 @@ etcd3/log.py,sha256=sMo6av48x9Nf_YDIWdSv8R-VUeVXi1n17wGDAAaFnlM,4282
 etcd3/log_formatters.py,sha256=weWgMQjuI_cZFBEUORGCgkFJQIPvDUaiCLJN64t7s9o,7304
 etcd3/log_sampling.py,sha256=7PhNz-HOZ6sHdBiXS29YJ3baHY_L1VwJaq4NZt2yX78,6692
 etcd3/members.py,sha256=4t71YSzPfoEzyNMIRGFuJQXoydfHUwlk_JDxTM8moeg,1325
-etcd3/multi_client.py,sha256=Y6JoWZeUfn8JyezFtI0eqJ9Zr0kMw9BZVbzFy8AEizw,44208
+etcd3/multi_client.py,sha256=FiI85nMgc2Atni6GgEPW67kXVtjllS6c6W6uRf8HRck,44550
 etcd3/observability.py,sha256=BLOUMs1H2icF-tEWB_RoZFKoCNoXZt1ZZERGfckesW4,14215
-etcd3/shared.py,sha256=tGCM8NTGQoTtOUBk6w4ve3bymcsn9VSr0YsBiBERXKA,10913
+etcd3/shared.py,sha256=RGzbc7SNprvC-QFODVfP9HR2hD1oAc9tVaNwVQ6GGmI,10999
 etcd3/single_client.py,sha256=sG3tna7i_1y5u_XuwvsH0BeMQIj6uaKL5XgOYRpratI,5014
-etcd3/sync_cluster_operations.py,sha256=sCI1ntT4LXKhq-lMw_HX0zdpAyaaLzSFjwZMcM9OSjo,4050
+etcd3/sync_cluster_operations.py,sha256=YgJGjqdSEhzp-0A1QIwXJtZNw-IbjDnxTDCiZKJydIE,4319
 etcd3/sync_kv_operations.py,sha256=yMeq6sLvcY-DbMIZGyzDxOyU_4mT5FEse7rGaJJUqA8,22150
 etcd3/sync_lock_operations.py,sha256=XkezEM0lDGKhj3BPiMtmfFteWatm-XbZewAtjcreuwM,1091
 etcd3/sync_maintenance_operations.py,sha256=oDXRfrMsTYvpMKbvD0K1k1nwgzyYcnjmqO8jZ3QZfUI,8397
@@ -49,6 +49,6 @@ etcdrpc/rpc.proto,sha256=UD4vXbdPUNHSLSx7K_UltWqJjWswHBKSs0t9aNMA4qg,31351
 etcdrpc/rpc_pb2.py,sha256=8qhnULNr8jym0qyivDVqJB86H_u1Rb_K8iY8FNT9e0s,30252
 etcdrpc/rpc_pb2.pyi,sha256=TfPtHXIluO_D1rchVMVfoSgZTPQLk-YNhmcJBIt9XIk,35473
 etcdrpc/rpc_pb2_grpc.py,sha256=HOifyKL0X3BmLkS1r0tWTMfyfChBiy76O6Ys12kT5n8,73810
-python_etcd3_async-0.1.5.dist-info/METADATA,sha256=JvloI7KUXRtpZrxkwbDvIHnYd-gpvGovMnf8s9JwYjE,8723
-python_etcd3_async-0.1.5.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-python_etcd3_async-0.1.5.dist-info/RECORD,,
+python_etcd3_async-0.1.6.dist-info/METADATA,sha256=WBABRd9BOnhf7XzvTGViH3mGsym5srfDLgXo5cN9aWg,8723
+python_etcd3_async-0.1.6.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+python_etcd3_async-0.1.6.dist-info/RECORD,,

{python_etcd3_async-0.1.5.dist-info → python_etcd3_async-0.1.6.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.4
 Root-Is-Purelib: true
 Tag: py3-none-any