python-rundeck 2.0.0__tar.gz → 2.0.1__tar.gz

python_rundeck-2.0.1/API_COVERAGE.md

@@ -0,0 +1,88 @@
+# Rundeck Community API coverage
+
+Audited against the Community source tag [v6.3.0](https://github.com/rundeck/rundeck/tree/v6.3.0)
+and the [6.2.1–6.3.0 changes](https://github.com/rundeck/rundeck/compare/v6.2.1...v6.3.0),
+the [API reference](https://docs.rundeck.com/docs/api/), the
+[OpenAPI contract](https://docs.rundeck.com/docs/files/rundeck-api.yml), and the
+[API version history](https://docs.rundeck.com/docs/api/rundeck-api-versions.html).
+The package defaults to API v59 and retains explicit API v14+ selection; each row
+describes the minimum version of the operation rather than the package's oldest
+supported API version. API v60 can be selected explicitly on 6.3.0.
+`Community` means the operation is part of Rundeck Community.
+
+## Community 6.3.0 compatibility (2.0.1)
+
+No new Community routes were introduced in the compared route mappings. API v60
+promotes `/enterprise/cluster/info` and `/enterprise/cluster/member/{memberId}`;
+both are excluded. The Community scheduler remains available.
+
+| HTTP | Route | Minimum API | Edition | Python interface / change | Official source | Tests |
+|---|---|---:|---|---|---|---|
+| POST, PUT | `/system/acl/{name}`, `/project/{project}/acl/{name}` | 17 system / 13 project | Community | JSON `contents` writes; unchanged YAML reads | API ACL reference; RUN-4790 | `test_community_630.py`, `test_system_acl.py`, `test_project_acl.py` (unit); `test_acl_json_lifecycle`, `test_yaml_request_json_response_regression` (integration) |
+| GET; GET, POST | `/job/{id}/meta`, `/project/{project}/jobs/browse` | 46 | Community | Preserve `executionAclValid` metadata, including false values; added in server 6.3.0 | `JobExecutionAclMetadataComponent` at v6.3.0 | `test_job_metadata_is_raw_for_get_and_browse` (unit); `test_job_acl_metadata` (integration) |
+| GET | `/plugin/list`, `/plugin/detail/{service}/{provider}` | 14 / 49 | Community | Preserve `outputs` and property `outputMetadata` | `PluginApiService` at v6.3.0 | `test_plugin_fields_are_preserved` (unit); existing plugin integrations |
+| PUT | `/project/{project}/import` | 14 | Community | Additional configure permission for configuration or node-source import in server 6.3.0 | `ProjectController.apiProjectImport`, PR #10650 | `test_archive_permission_error_keeps_false_options_and_details` (unit); `test_archive_import_requires_configure` (integration) |
+| POST | `/webhook/{token}` | 30 | Community | Opaque public secret unchanged by server-side token hashing | `WebhookService` and `WebhookTokenSecureMigrationService` at v6.3.0 | `test_webhook_event_send_supports_json_and_data` (unit); `test_project_webhook_lifecycle_and_send` (integration) |
+| GET | `/metrics/*`, `/monitoring/*` | legacy / unversioned | Community | Docker legacy metrics variable honored in server 6.3.0 | RUN-4859 | `test_legacy_metrics_enabled_by_docker_variable`, existing monitoring integrations |
+
+Server-version features above are not gated on the selected API version. The
+`executionAclValid` warning does not enforce execution permissions. The source
+tag restores the `${job.serverUrl}` trailing slash (RUN-5051); no URL rewrite is
+performed by this client. Session cookies follow requests' standard behavior.
+
+## Added or corrected in 2.0.0
+
+| HTTP | Route | Minimum API | Edition | Python interface | Official reference | Test |
+|---|---|---:|---|---|---|---|
+| GET | `/api/{v}/` | 14 | Community | `Rundeck.api_info()` | API root / API reference | `tests/unit/test_community_v59.py::test_api_info_and_default_api_version` |
+| GET | `/api/{v}/home/summary` | 14 | Community | `rd.system.summary()` | System endpoints | `tests/unit/test_community_v59.py::test_system_summary_scheduler_and_expired_tokens_routes` |
+| GET | `/api/{v}/scheduler/jobs` | 14 | Community | `rd.scheduler.jobs()` | Scheduler endpoints; v6.2.1 route mapping | `tests/unit/test_community_v59.py::test_system_summary_scheduler_and_expired_tokens_routes` |
+| GET | `/api/{v}/scheduler/server/{uuid}/jobs` | 14 | Community | `rd.scheduler.jobs(server_uuid=...)` | Scheduler endpoints; v6.2.1 route mapping | `tests/unit/test_community_v59.py::test_system_summary_scheduler_and_expired_tokens_routes` |
+| PUT | `/api/{v}/scheduler/takeover` | 14 | Community | `rd.scheduler.takeover(job_id=... or job_ids=[...])` | Scheduler endpoints; v6.2.1 route mapping | `tests/unit/test_scheduler.py` |
+| POST | `/api/{v}/tokens/{user}/removeExpired` | 14 | Community | `rd.tokens.remove_expired(user)` | Tokens endpoints | `tests/unit/test_community_v59.py::test_system_summary_scheduler_and_expired_tokens_routes` |
+| GET | `/monitoring/health/readiness` | n/a | Community | `rd.monitoring.readiness()` | Monitoring endpoints | `tests/unit/test_community_v59.py::test_async_export_post_uses_form_and_monitoring_readiness_is_unversioned` |
+| POST | `/api/{v}/project/{project}/jobs/validateOption` | 47 | Community | `rd.jobs.validate_option(...)` / `project.jobs.validate_option(...)` | Jobs endpoints | `tests/unit/test_community_v59.py::test_option_validation_preserves_false_and_project_context` |
+| POST | `/api/{v}/project/{project}/plugins/save` | 55 | Community | `project.plugins.save(...)` | Project plugin configuration | `tests/unit/test_community_v59.py::test_project_plugins_and_browse_post_contracts` |
+| POST | `/api/{v}/project/{project}/jobs/browse` | 46 | Community | `rd.jobs.browse(..., use_post=True)` | Jobs browse endpoint | `tests/unit/test_community_v59.py::test_project_plugins_and_browse_post_contracts` |
+| POST | `/api/{v}/project/{project}/export/async` | 14 | Community | `project.archive.export_async(..., use_post=True)` | Project archive endpoints | `tests/unit/test_community_v59.py::test_async_export_post_uses_form_and_monitoring_readiness_is_unversioned` |
+| GET | `/api/{v}/authorizations/application/{kind}` | 14 | Community, experimental | `rd.authorizations.application_kind(...)` | Authorization evaluation endpoints | `tests/unit/test_community_v59.py::test_authorization_routes_repeat_actions_as_values` |
+| GET | `/api/{v}/authorizations/application/{type}/{specifier}` | 14 | Community, experimental | `rd.authorizations.application_resource(...)` | Authorization evaluation endpoints | `tests/unit/test_community_v59.py::test_authorization_routes_repeat_actions_as_values` |
+| GET | `/api/{v}/authorizations/project/{project}/{kind}` | 14 | Community, experimental | `rd.authorizations.project_kind(...)` | Authorization evaluation endpoints | `tests/unit/test_community_v59.py::test_authorization_routes_repeat_actions_as_values` |
+| GET | `/api/{v}/authorizations/project/{project}/{type}/{specifier}` | 14 | Community, experimental | `rd.authorizations.project_resource(...)` | Authorization evaluation endpoints | `tests/unit/test_community_v59.py::test_authorization_routes_repeat_actions_as_values` |
+| GET | `/api/{v}/authorizations/project/{project}/job/{id}` | 14 | Community, experimental | `rd.authorizations.project_job(...)` | Authorization evaluation endpoints | `tests/unit/test_community_v59.py::test_authorization_routes_repeat_actions_as_values` |
+| GET | `/api/{v}/system/acl/{name}` | 14 | Community | `rd.system.acl.get(name)` (`Accept: application/yaml`) | System ACL endpoints | `tests/unit/test_system_acl.py` |
+| GET | `/api/{v}/project/{project}/acl/{name}` | 14 | Community | `project.acl.get(name)` (`Accept: application/yaml`) | Project ACL endpoints | `tests/unit/test_project_acl.py` |
+
+The authorization evaluation API is documented as experimental. `actions` is
+sent as a repeated query parameter. Job browse POST keeps metadata and path
+parameters in the query and sends search filters as JSON. Async archive POST
+uses form encoding for execution IDs. `Execution.get_output()` returns the
+server payload unchanged in both historical API v58 and compacted API v59 modes.
+
+## Existing Community operations
+
+The following endpoint families are also exposed by this package and are checked
+by their focused unit tests. Paths below use `{v}` for the selected `/api/{v}`
+prefix. See each test module for the supported verbs, request fields, response
+handling, and pagination behavior.
+
+| HTTP | Route(s) | Minimum API | Edition | Python interface | Official reference | Test |
+|---|---|---:|---|---|---|---|
+| GET, POST, PUT, DELETE | `/project`, `/project/{project}`, `/project/{project}/resources`, `/project/{project}/config`, `/project/{project}/readme`, `/project/{project}/motd`, `/project/{project}/history`, `/project/{project}/acl/{name}` | 14 | Community | `rd.projects` and nested project managers | Projects endpoints | `tests/unit/test_project_*.py`, `tests/unit/test_project_acl.py` |
+| GET, POST, PUT, DELETE | `/project/{project}/jobs`, `/job/{id}`, `/job/{id}/run`, `/job/{id}/executions`, `/project/{project}/jobs/bulk`, `/project/{project}/jobs/delete`, `/project/{project}/jobs/browse` | 14 (browse 46) | Community | `rd.jobs`, `project.jobs`, `Job` | Jobs endpoints | `tests/unit/test_jobs.py`, `tests/unit/test_community_v59.py` |
+| GET, POST, PUT, DELETE | `/execution/{id}`, `/execution/{id}/output`, `/execution/{id}/state`, `/execution/{id}/abort`, `/execution/{id}/retry`, `/project/{project}/executions` | 14 | Community | `rd.executions`, `Execution` | Executions endpoints | `tests/unit/test_executions.py` |
+| GET, POST, PUT, DELETE | `/system/acl`, `/system/executions/{enable,disable,status}`, `/system/logstorage`, `/system/keys/{path}` | 14 | Community | `rd.system`, `rd.keys` | System, key storage endpoints | `tests/unit/test_system_*.py`, `tests/unit/test_key_storage.py` |
+| GET, POST, DELETE | `/tokens`, `/tokens/{id}`, `/tokens/{user}/removeExpired`, `/user`, `/user/{login}` | 14 | Community | `rd.tokens`, `rd.users` | Tokens and user endpoints | `tests/unit/test_tokens.py`, `tests/unit/test_users.py` |
+| GET, POST, PUT, DELETE | `/project/{project}/scm/{plugin}/{action}`, `/plugin/{service}/{name}`, `/project/{project}/webhooks` | 14 | Community | SCM, plugin, and webhook managers | SCM, plugins, webhooks endpoints | `tests/unit/test_project_scm.py`, `tests/unit/test_plugins.py`, `tests/unit/test_webhooks.py` |
+| GET | `/metrics[/metrics|/healthcheck|/ping|/threads]`, `/monitoring[/metrics|/health|/info|/prometheus|/threaddump]` | 14 / unversioned | Community | `rd.metrics`, `rd.monitoring` | Metrics and monitoring endpoints | `tests/unit/test_metrics.py` |
+| POST | `/run/command`, `/project/{project}/run/command` | 14 | Community | `rd.run_command`, `project.run_command` | Command execution endpoint | `tests/unit/test_adhoc.py` |
+
+## Excluded commercial surfaces
+
+| Removed interface / route | Reason | Verification |
+|---|---|---|
+| `rd.config_management` (`/config/...`) | Commercial Config Management product surface | `tests/unit/test_community_v59.py::test_api_info_and_default_api_version` |
+| `Job.tags()` (`/job/{id}/tags`) | Commercial endpoint absent from the Community v6.2.1 contract | `tests/unit/test_jobs.py` |
+
+Commercial-only calendars, runners, licenses, and other product-specific routes
+are outside this client’s Community API coverage.

python_rundeck-2.0.1/CHANGELOG.md

@@ -0,0 +1,100 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [2.0.1] - 2026-11-08
+### Fixed
+- Refresh vulnerable locked dependencies to their latest compatible stable releases;
+  require Requests 2.33+, Black 26.3.1+ and pytest 9.0.3+.
+- Refresh the virtual environment's pip before auditing cached CI environments.
+- ACL writes use the official JSON `contents` envelope and request JSON responses,
+  avoiding raw YAML response errors while retaining YAML reads and public return types.
+- ACL reads unwrap older controllers' JSON envelopes even when YAML was requested.
+- Integration webhook discovery now fails if the created resource disappears.
+
+### Added
+- Rundeck Community 6.3.0 integration coverage in API v59 and v60, alongside
+  6.2.1/v59, 6.0.1/v58 and 5.18.0/v56 compatibility targets.
+- Regression coverage for job execution ACL metadata, plugin output metadata,
+  archive import permissions, forwarded session cookies and legacy Docker metrics.
+
+### Changed
+- Current known API is v60; the default remains v59. Enterprise v60 endpoints remain excluded.
+- Local integration image defaults to `rundeck/rundeck:6.3.0-20261022`.
+- Integration containers are isolated by Compose project and cleaned up on failures.
+- Gitflow feature branches run the integration and Python compatibility matrices.
+
+## [2.0.0] - 2026-10-10
+### Added
+- Community API v59 support, including API discovery, system summary, scheduler job
+  listing, expired-token cleanup, monitoring readiness, option validation, project
+  plugin configuration, POST job browsing, and asynchronous archive export.
+- Experimental authorization-evaluation endpoints and a Community API coverage matrix.
+- Community integration defaults for Rundeck 6.2.1/API v59, with documented 6.0.1/v58
+  and 5.18.0/v56 compatibility runs.
+
+### Changed
+- Default API version is now v59; explicitly selected older versions remain supported.
+- System and project ACL reads explicitly request YAML. HTTP 422 responses map to
+  `RundeckValidationError` while retaining the response body.
+- Scheduler cluster takeover accepts one or multiple job IDs. In Community without
+  cluster mode, takeover has no scheduling state to transfer.
+
+### Removed
+- Removed commercial Config Management interfaces and `Job.tags()`.
+
+## [1.1.0] - 2026-07-25
+### Added
+- Support for `user_agent` and `config_section` parameters in the client configuration.
+- API v57/v58 support: execution metrics, job browse, `metaExclude`, modern
+  monitoring endpoints, and v56/v57 response metadata coverage.
+- Community endpoints for project history/meta/node tags, execution input and
+  output state, job executions, project SCM toggle, and current-user update.
+
+### Changed
+- `__version__` now resolves from the installed package metadata, with a local
+  fallback to `pyproject.toml` when the package is not installed.
+- README configuration section updated to include `user_agent` and `config_section`.
+- Default Rundeck API version updated to v58; the client retains v14
+  compatibility and documents the current server minimum v17 and v34 deprecation.
+- Corrected Community routes and verbs for job forecasts, resource model
+  sources, bulk job actions, bulk job deletion, and job pagination.
+- `Job.tags` and Config Management were incorrectly grouped with scheduler
+  cluster operations in this entry. The first two are commercial surfaces;
+  scheduler listing and takeover are Community endpoints and remain supported.
+
+## [1.0.1] - 2026-01-21
+### Changed
+- CI: skip lint/tests on `main` and build only on tags.
+- Classifier updated to `Development Status :: 5 - Production/Stable`.
+
+## [1.0.0] - 2026-01-21
+### Changed
+- `Job.run` and `Job.retry` now return raw responses by default and support `as_execution=True` for `Execution`.
+- `RundeckObject.refresh` and `Execution.refresh` now return `None` (in-place update).
+- `User.update` now returns the raw response and updates the object in place.
+- Key storage API now uses `StorageKey` objects for `create`/`update`, moves raw content access to `StorageKey.content()`, renames `get_metadata` to `get`, and supports updating via `StorageKey.update()`.
+- System ACL policies are treated as resources and `SystemACL.update()` now updates the object in place.
+- Project webhooks are treated as resources (`project.webhooks`), while event sending remains a utility manager.
+
+## [0.3.0] - 2026-01-14
+### Added
+- README badges for PyPI version, supported Python versions, license, and downloads.
+- Contributor dev setup note in README.
+
+### Changed
+- README translated to English.
+- Installation section now targets PyPI installs.
+- GitLab CI PyPI deployment uses verbose `twine upload`.
+
+## [0.2.0] - 2026-01-12
+### Added
+- Project metadata URLs in `pyproject.toml` (Homepage, Repository, Documentation, Issues, Changelog).
+- Changelog file to track releases.
+
+## [0.1.0] - 2026-01-11
+### Added
+- Initial release of the python-rundeck client library.

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: python-rundeck
-Version: 2.0.0
-Summary: Python client for the Rundeck Community API (v14-v59).
+Version: 2.0.1
+Summary: Python client for the Rundeck Community API (v14-v60, default v59).
 License-Expression: MIT
 License-File: LICENSE
 Keywords: rundeck,api,client
@@ -21,12 +21,12 @@ Classifier: Topic :: System :: Systems Administration
 Classifier: Typing :: Typed
 Provides-Extra: dev
 Requires-Dist: bandit (>=1.7.9,<2.0.0) ; extra == "dev"
-Requires-Dist: black (>=25.11.0,<26.0.0) ; extra == "dev"
+Requires-Dist: black (>=26.3.1,<27.0.0) ; extra == "dev"
 Requires-Dist: flake8 (>=7.0.0,<8.0.0) ; extra == "dev"
 Requires-Dist: isort (>=7.0.0,<8.0.0) ; extra == "dev"
-Requires-Dist: pytest (>=9.0.2,<10.0.0) ; extra == "dev"
+Requires-Dist: pytest (>=9.0.3,<10.0.0) ; extra == "dev"
 Requires-Dist: pytest-cov (>=5.0.0,<6.0.0) ; extra == "dev"
-Requires-Dist: requests (>=2.32.5,<3.0.0)
+Requires-Dist: requests (>=2.33.0,<3.0.0)
 Requires-Dist: ruff (>=0.7.0,<1.0.0) ; extra == "dev"
 Requires-Dist: safety (>=3.2.0,<4.0.0) ; extra == "dev"
 Project-URL: Changelog, https://gitlab.com/pascal.seckinger/python-rundeck/-/blob/main/CHANGELOG.md
@@ -43,7 +43,7 @@ python-rundeck
 ![License](https://img.shields.io/pypi/l/python-rundeck)
 ![Downloads](https://static.pepy.tech/badge/python-rundeck)
 
-Python client for the Rundeck Community API (v14-v59), inspired by the python-gitlab architecture. The default API version is v59; current Rundeck servers require v17 or later and versions below v34 are deprecated. Provides typed managers for Community resources (projects, jobs, executions, tokens, users, system) and SCM (import/export).
+Python client for the Rundeck Community API (v14-v60), inspired by the python-gitlab architecture. Rundeck Community 6.3.0 is the integration reference. The default API version remains v59; use `api_version=60` explicitly with 6.3.0. Current Rundeck servers require v17 or later and versions below v34 are deprecated. Provides typed managers for Community resources (projects, jobs, executions, tokens, users, system) and SCM (import/export).
 
 Version 2.0 removes commercial-only Config Management and job-tag endpoints. Cluster schedule listing and takeover are Community operations and remain available. The authorization-evaluation endpoints are experimental in Rundeck and are exposed as such by this client.
 
@@ -158,6 +158,16 @@ Utility managers:
 Note: `project.webhooks.create(...)` returns the raw API response (e.g., `{"msg": "Saved webhook"}`)
 because the Rundeck API does not return the created webhook object.
 
+Compatibility with Community 6.3.0 (2.0.1)
+---------------------------------------
+- API v60 is recognized; the default stays v59 to retain compatibility with Community 6.2.1. The new v60 cluster endpoints are Enterprise-only and excluded.
+- ACL creation and updates send the YAML text inside a JSON `contents` envelope and request JSON responses. Reads still request YAML and unwrap legacy JSON responses from older project ACL controllers. Python signatures and resource return conventions are unchanged.
+- `job.meta(meta="executionAclValid")` and `project.jobs.browse(meta="executionAclValid")` expose the server's saved-user authorization warning. It does not block execution. Plugin `outputs` and property `outputMetadata` are preserved when returned by the server.
+- Archive imports with `importConfig=True` or `importNodesSources=True` also require project `configure` authorization on 6.3.0. Use explicit `False` values for jobs-only imports. Authorization failures retain the server response in `RundeckAuthenticationError.response_body`.
+- Webhook tokens remain opaque public secrets. The server handles hashing and migration; callers must continue sending the original secret.
+- Session authentication uses standard cookie handling; 6.3.0 fixes direct HTTP authentication when the public URL is HTTPS behind forwarded headers.
+- The stable 6.3.0 sources restore the trailing slash on `${job.serverUrl}` (RUN-5051), despite the earlier release-note wording. The client does not rewrite job context URLs.
+
 Migration from 1.1.0
 -------------------
 - Set `api_version=59` explicitly when upgrading a server/client pair gradually; the default is now 59.
@@ -526,8 +536,11 @@ Development and testing
 - Formatting/Lint: `black src/rundeck tests/`, `ruff check src/rundeck tests/`
 - Typing: `mypy src/rundeck/`
 - Tests: `pytest`
-- Local integration tests: `scripts/run-integration.sh` starts Rundeck Community 6.2.1 by default with API v59. Use `RUNDECK_IMAGE=rundeck/rundeck:6.0.1 RUNDECK_API_VERSION=58` or `RUNDECK_IMAGE=rundeck/rundeck:5.18.0 RUNDECK_API_VERSION=56` for compatibility runs. Add `KEEP_STACK=1` to keep the instance running after tests. Dedicated teardown script: `scripts/stop-integration.sh`.
+- Local integration tests: `scripts/run-integration.sh` starts `rundeck/rundeck:6.3.0-20261022` with API v59. Each run has an isolated Compose project and cleans up even when tests fail. With `KEEP_STACK=1`, the script prints the project name needed by `scripts/stop-integration.sh`.
+- GitLab runs five integration targets: 6.3.0/API 59, 6.3.0/API 60, 6.2.1/API 59, 6.0.1/API 58 and 5.18.0/API 56. Set `RUNDECK_IMAGE` and `RUNDECK_API_VERSION` to run each target locally. Python compatibility tests retain 3.11–3.15 (3.15-rc Docker image).
+- To exercise the 6.3.0 session regression and legacy metrics: `RUNDECK_PUBLIC_URL=https://rundeck.example.invalid RUNDECK_METRICS_LEGACY_ENABLED=true scripts/run-integration.sh`. The client still connects to `RUNDECK_URL` (default `http://localhost:4440`). The public URL defaults to the client URL, ensuring session redirects also work on older servers. Optional `RUNDECK_HTTP_PORT` changes the published port; set `RUNDECK_URL` accordingly.
 - The docker compose stack mounts `tokens.properties` at the repo root to seed a local admin token for integration tests. This file is only intended for local testing.
+- Run local compatibility targets sequentially, stopping each stack before starting the next. This keeps at most one Rundeck JVM and one PostgreSQL container active.
 
 Code structure
 --------------

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/README.md

@@ -5,7 +5,7 @@ python-rundeck
 ![License](https://img.shields.io/pypi/l/python-rundeck)
 ![Downloads](https://static.pepy.tech/badge/python-rundeck)
 
-Python client for the Rundeck Community API (v14-v59), inspired by the python-gitlab architecture. The default API version is v59; current Rundeck servers require v17 or later and versions below v34 are deprecated. Provides typed managers for Community resources (projects, jobs, executions, tokens, users, system) and SCM (import/export).
+Python client for the Rundeck Community API (v14-v60), inspired by the python-gitlab architecture. Rundeck Community 6.3.0 is the integration reference. The default API version remains v59; use `api_version=60` explicitly with 6.3.0. Current Rundeck servers require v17 or later and versions below v34 are deprecated. Provides typed managers for Community resources (projects, jobs, executions, tokens, users, system) and SCM (import/export).
 
 Version 2.0 removes commercial-only Config Management and job-tag endpoints. Cluster schedule listing and takeover are Community operations and remain available. The authorization-evaluation endpoints are experimental in Rundeck and are exposed as such by this client.
 
@@ -120,6 +120,16 @@ Utility managers:
 Note: `project.webhooks.create(...)` returns the raw API response (e.g., `{"msg": "Saved webhook"}`)
 because the Rundeck API does not return the created webhook object.
 
+Compatibility with Community 6.3.0 (2.0.1)
+---------------------------------------
+- API v60 is recognized; the default stays v59 to retain compatibility with Community 6.2.1. The new v60 cluster endpoints are Enterprise-only and excluded.
+- ACL creation and updates send the YAML text inside a JSON `contents` envelope and request JSON responses. Reads still request YAML and unwrap legacy JSON responses from older project ACL controllers. Python signatures and resource return conventions are unchanged.
+- `job.meta(meta="executionAclValid")` and `project.jobs.browse(meta="executionAclValid")` expose the server's saved-user authorization warning. It does not block execution. Plugin `outputs` and property `outputMetadata` are preserved when returned by the server.
+- Archive imports with `importConfig=True` or `importNodesSources=True` also require project `configure` authorization on 6.3.0. Use explicit `False` values for jobs-only imports. Authorization failures retain the server response in `RundeckAuthenticationError.response_body`.
+- Webhook tokens remain opaque public secrets. The server handles hashing and migration; callers must continue sending the original secret.
+- Session authentication uses standard cookie handling; 6.3.0 fixes direct HTTP authentication when the public URL is HTTPS behind forwarded headers.
+- The stable 6.3.0 sources restore the trailing slash on `${job.serverUrl}` (RUN-5051), despite the earlier release-note wording. The client does not rewrite job context URLs.
+
 Migration from 1.1.0
 -------------------
 - Set `api_version=59` explicitly when upgrading a server/client pair gradually; the default is now 59.
@@ -488,8 +498,11 @@ Development and testing
 - Formatting/Lint: `black src/rundeck tests/`, `ruff check src/rundeck tests/`
 - Typing: `mypy src/rundeck/`
 - Tests: `pytest`
-- Local integration tests: `scripts/run-integration.sh` starts Rundeck Community 6.2.1 by default with API v59. Use `RUNDECK_IMAGE=rundeck/rundeck:6.0.1 RUNDECK_API_VERSION=58` or `RUNDECK_IMAGE=rundeck/rundeck:5.18.0 RUNDECK_API_VERSION=56` for compatibility runs. Add `KEEP_STACK=1` to keep the instance running after tests. Dedicated teardown script: `scripts/stop-integration.sh`.
+- Local integration tests: `scripts/run-integration.sh` starts `rundeck/rundeck:6.3.0-20261022` with API v59. Each run has an isolated Compose project and cleans up even when tests fail. With `KEEP_STACK=1`, the script prints the project name needed by `scripts/stop-integration.sh`.
+- GitLab runs five integration targets: 6.3.0/API 59, 6.3.0/API 60, 6.2.1/API 59, 6.0.1/API 58 and 5.18.0/API 56. Set `RUNDECK_IMAGE` and `RUNDECK_API_VERSION` to run each target locally. Python compatibility tests retain 3.11–3.15 (3.15-rc Docker image).
+- To exercise the 6.3.0 session regression and legacy metrics: `RUNDECK_PUBLIC_URL=https://rundeck.example.invalid RUNDECK_METRICS_LEGACY_ENABLED=true scripts/run-integration.sh`. The client still connects to `RUNDECK_URL` (default `http://localhost:4440`). The public URL defaults to the client URL, ensuring session redirects also work on older servers. Optional `RUNDECK_HTTP_PORT` changes the published port; set `RUNDECK_URL` accordingly.
 - The docker compose stack mounts `tokens.properties` at the repo root to seed a local admin token for integration tests. This file is only intended for local testing.
+- Run local compatibility targets sequentially, stopping each stack before starting the next. This keeps at most one Rundeck JVM and one PostgreSQL container active.
 
 Code structure
 --------------

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "python-rundeck"
-version = "2.0.0"
-description = "Python client for the Rundeck Community API (v14-v59)."
+version = "2.0.1"
+description = "Python client for the Rundeck Community API (v14-v60, default v59)."
 authors = [
     {name = "Pascal Seckinger",email = "pascal.seckinger@protonmail.com"}
 ]
@@ -23,7 +23,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "requests (>=2.32.5,<3.0.0)"
+    "requests (>=2.33.0,<3.0.0)"
 ]
 
 [project.urls]
@@ -36,10 +36,10 @@ Changelog = "https://gitlab.com/pascal.seckinger/python-rundeck/-/blob/main/CHAN
 [project.optional-dependencies]
 dev = [
     "bandit (>=1.7.9,<2.0.0)",
-    "black (>=25.11.0,<26.0.0)",
+    "black (>=26.3.1,<27.0.0)",
     "flake8 (>=7.0.0,<8.0.0)",
     "isort (>=7.0.0,<8.0.0)",
-    "pytest (>=9.0.2,<10.0.0)",
+    "pytest (>=9.0.3,<10.0.0)",
     "pytest-cov (>=5.0.0,<6.0.0)",
     "ruff (>=0.7.0,<1.0.0)",
     "safety (>=3.2.0,<4.0.0)",
@@ -47,7 +47,11 @@ dev = [
 
 [tool.poetry]
 packages = [{include = "rundeck", from = "src"}]
-include = ["src/rundeck/py.typed"]
+include = [
+    "src/rundeck/py.typed",
+    {path = "API_COVERAGE.md", format = "sdist"},
+    {path = "CHANGELOG.md", format = "sdist"},
+]
 
 [build-system]
 requires = ["poetry-core>=2.0.0,<3.0.0"]
@@ -56,10 +60,10 @@ build-backend = "poetry.core.masonry.api"
 [dependency-groups]
 dev = [
     "bandit (>=1.7.9,<2.0.0)",
-    "black (>=25.11.0,<26.0.0)",
+    "black (>=26.3.1,<27.0.0)",
     "flake8 (>=7.0.0,<8.0.0)",
     "isort (>=7.0.0,<8.0.0)",
-    "pytest (>=9.0.2,<10.0.0)",
+    "pytest (>=9.0.3,<10.0.0)",
     "pytest-cov (>=5.0.0,<6.0.0)",
     "ruff (>=0.7.0,<1.0.0)",
     "safety (>=3.2.0,<4.0.0)"

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/src/rundeck/const.py

@@ -40,13 +40,14 @@ FORMAT_JSON = "json"
 
 # API versions. The library remains compatible with legacy Rundeck servers
 # using v14, while current Rundeck servers require at least v17.
-API_VERSION_CURRENT = "59"
+API_VERSION_CURRENT = "60"
 API_VERSION_MIN = "14"
 API_VERSION_SERVER_MIN = "17"
 API_VERSION_DEPRECATION = "34"
 
 # Defaults
-DEFAULT_API_VERSION = API_VERSION_CURRENT
+# v60 adds Enterprise endpoints only; keep the Community-compatible default.
+DEFAULT_API_VERSION = "59"
 DEFAULT_TIMEOUT = 30
 USER_AGENT = "python-rundeck"
 

python_rundeck-2.0.1/src/rundeck/v1/objects/acl.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from typing import Any
+
+from rundeck.utils import build_headers
+
+
+class YamlPolicyMixin:
+    def _get_yaml(self, path: str) -> str:
+        response = self.rd.http_get(
+            path, raw=True, headers={"Accept": "application/yaml"}
+        )
+        # Some older project ACL controllers return a JSON envelope despite Accept.
+        if (
+            "application/json"
+            in getattr(response, "headers", {}).get("Content-Type", "").lower()
+        ):
+            result = response.json()
+            if isinstance(result, dict) and isinstance(result.get("contents"), str):
+                return result["contents"]
+        return response.text
+
+    def _yaml_headers(self) -> dict[str, str]:
+        return (
+            build_headers(accept="application/json", content_type="application/json")
+            or {}
+        )
+
+    def _post_yaml(self, path: str, content: Any) -> Any:
+        return self.rd.http_post(
+            path, json={"contents": content}, headers=self._yaml_headers()
+        )
+
+    def _put_yaml(self, path: str, content: Any) -> Any:
+        return self.rd.http_put(
+            path, json={"contents": content}, headers=self._yaml_headers()
+        )

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/src/rundeck/v1/objects/projects.py

@@ -193,10 +193,7 @@ class ProjectACLManager(YamlPolicyMixin, RundeckObjectManager):
     def get(self, policy_name: str) -> str:
         """Récupère une politique ACL projet (contenu texte)."""
         path = self._build_path(policy_name)
-        response = self.rd.http_get(
-            path, raw=True, headers={"Accept": "application/yaml"}
-        )
-        return response.text
+        return self._get_yaml(path)
 
     def create(self, policy_name: str, content: str) -> dict[str, Any]:
         """Crée une politique ACL projet."""
@@ -484,6 +481,9 @@ class ProjectArchiveManager(RundeckObjectManager):
     ) -> Any:
         """
         Importe une archive ZIP dans le projet.
+
+        Community 6.3+ exige aussi le droit configure lorsque importConfig ou
+        importNodesSources est activé. Les options et refus sont transmis tels quels.
         """
         params = compact(
             component_options,

{python_rundeck-2.0.0 → python_rundeck-2.0.1}/src/rundeck/v1/objects/system.py

@@ -67,10 +67,7 @@ class SystemACLManager(YamlPolicyMixin, RundeckObjectManager[SystemACL]):
     def get(self, policy_name: str) -> SystemACL:
         """Récupère une politique ACL (contenu texte)."""
         path = self._build_path(policy_name)
-        response = self.rd.http_get(
-            path, raw=True, headers={"Accept": "application/yaml"}
-        )
-        return self._wrap({"name": policy_name, "content": response.text})
+        return self._wrap({"name": policy_name, "content": self._get_yaml(path)})
 
     def create(self, policy_name: str, content: str) -> SystemACL:
         """Crée une politique ACL système."""

python_rundeck-2.0.0/src/rundeck/v1/objects/acl.py

@@ -1,24 +0,0 @@
-from __future__ import annotations
-
-from typing import Any
-
-from rundeck.utils import build_headers
-
-
-class YamlPolicyMixin:
-    _yaml_content_type = "application/yaml"
-
-    def _yaml_headers(self) -> dict[str, str]:
-        headers = build_headers(
-            accept=self._yaml_content_type, content_type=self._yaml_content_type
-        )
-        return headers or {
-            "Accept": self._yaml_content_type,
-            "Content-Type": self._yaml_content_type,
-        }
-
-    def _post_yaml(self, path: str, content: Any) -> Any:
-        return self.rd.http_post(path, data=content, headers=self._yaml_headers())
-
-    def _put_yaml(self, path: str, content: Any) -> Any:
-        return self.rd.http_put(path, data=content, headers=self._yaml_headers())