scalekit-sdk-python 2.19.0__tar.gz → 2.19.1__tar.gz

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.19.0
+Version: 2.19.1
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/scalekit/_version.py

@@ -1,3 +1,3 @@
 # Single source of truth for the SDK version.
 # Import this in setup.py and scalekit/core.py — never hardcode the version elsewhere.
-__version__ = "2.19.0"
+__version__ = "2.19.1"

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/scalekit/client.py

@@ -19,6 +19,7 @@ from scalekit.core import (
 from scalekit.domain import DomainClient
 from scalekit.connection import ConnectionClient
 from scalekit.m2m_client import M2MClient
+from scalekit.resource import ResourceClient
 from scalekit.organization import OrganizationClient
 from scalekit.directory import DirectoryClient
 from scalekit.users import UserClient
@@ -77,9 +78,19 @@ class ScalekitClient:
         :type                        : ``` str ```
         :param keepalive_time_ms     : How often, in milliseconds, an idle gRPC
                                         connection is verified before reuse.
+                                        Also derives grpc.client_idle_timeout_ms
+                                        (see CLIENT_IDLE_TIMEOUT_CEILING_MS),
+                                        which proactively recycles a connection
+                                        with zero active calls before the
+                                        backend's own MaxConnectionIdle would.
                                         Defaults to 60000; most callers never
                                         need to set this. Set to 0 to disable
-                                        keepalive entirely.
+                                        both of this SDK's own settings for
+                                        these — grpc-core still applies its own
+                                        (much larger) default idle behavior
+                                        when no options are passed at all, so
+                                        this isn't "no idle handling," just no
+                                        SDK-configured one.
         :type                        : ``` int ```
         :param keepalive_timeout_ms  : How long, in milliseconds, to wait for a
                                         keepalive response before treating an
@@ -122,6 +133,7 @@ class ScalekitClient:
             self.organization = OrganizationClient(self.core_client)
             self.directory = DirectoryClient(self.core_client)
             self.m2m_client = M2MClient(self.core_client)
+            self.resources = ResourceClient(self.core_client)
             self.users = UserClient(self.core_client)
             self.roles = RoleClient(self.core_client)
             self.permissions = PermissionClient(self.core_client)

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/scalekit/core.py

@@ -45,6 +45,32 @@ DEFAULT_KEEPALIVE_TIMEOUT_MS = 10_000
 # never even reaches the wire as requested.) Reject 1..59999.
 MIN_KEEPALIVE_TIME_MS = 60_000
 
+# grpc-core exposes 'grpc.client_idle_timeout_ms' (gRFC A9) as the client-side
+# equivalent of what the Go and Node SDKs implement by hand on their
+# self-managed HTTP/2 transports (grpcIdleConnTimeout / idleConnectionTimeoutMs):
+# proactively transition a fully-idle channel so its connection is torn down
+# and lazily recreated on the next call, instead of waiting to discover it's
+# dead (or waiting for the backend to GOAWAY it) only when a real request is
+# written to it. This SDK previously configured keepalive pings but never this
+# option — the gap this constant and CLIENT_IDLE_TIMEOUT_PING_CYCLES close.
+#
+# Must stay strictly BELOW the backend's own grpcKeepaliveMaxConnectionIdle
+# (5 min, scalekit's cmd/grpc.go), not equal to it: landing exactly on the
+# backend's bound is a race — whichever side's timer fires first wins, and the
+# loser is a request written into a socket the other side just closed. Mirrors
+# the Go SDK's grpcIdleConnCeiling and the Node SDK's
+# IDLE_CONNECTION_TIMEOUT_CEILING_MS exactly (both 4 minutes), for the same
+# reason.
+CLIENT_IDLE_TIMEOUT_CEILING_MS = 240_000
+
+# Multiplier applied to keepalive_time_ms before clamping to the ceiling above
+# — mirrors the Go SDK's grpcIdleConnPingCycles / Node SDK's
+# IDLE_PING_CYCLES_BEFORE_CLOSE (both 5) exactly, so this SDK scales down
+# correctly alongside the other two should MIN_KEEPALIVE_TIME_MS itself ever
+# be lowered. Superseded by the ceiling for every currently-valid non-zero
+# keepalive_time_ms (60s x 5 = 300s already exceeds the 4-minute ceiling).
+CLIENT_IDLE_TIMEOUT_PING_CYCLES = 5
+
 # requests defaults to no timeout, so a black-holed connection blocks the
 # calling thread until the OS abandons the socket. Bound the connect and read
 # phases separately with a (connect, read) tuple.
@@ -113,6 +139,22 @@ def _assert_valid_timeout(name: str, value) -> None:
         )
 
 
+def _client_idle_timeout_ms_for(keepalive_time_ms: int) -> int:
+    """Derive grpc.client_idle_timeout_ms from keepalive_time_ms — mirrors the
+    Go SDK's idleConnTimeoutFor / Node SDK's idleConnectionTimeoutMsFor exactly
+    (same formula, same constants), so the three SDKs land on the same idle-close
+    behavior. keepalive_time_ms == 0 (disabled) returns 0, meaning "not set" to
+    the caller (see __grpc_secure_channel — no option is passed, so grpc-core's
+    own much larger default applies), consistent with keepalive_time_ms == 0
+    disabling the ping-based idle detection above too."""
+    if not keepalive_time_ms:
+        return 0
+    scaled = keepalive_time_ms * CLIENT_IDLE_TIMEOUT_PING_CYCLES
+    if scaled <= 0 or scaled > CLIENT_IDLE_TIMEOUT_CEILING_MS:
+        return CLIENT_IDLE_TIMEOUT_CEILING_MS
+    return scaled
+
+
 def _is_success_status(status_code: int) -> bool:
     """200-only would be a footgun: the token/JWKS endpoints are only ever
     expected to reply 200, but a strict != 200 check would misclassify any
@@ -171,9 +213,18 @@ class CoreClient:
                                         connection is verified before reuse.
                                         Must stay above the backend's keepalive
                                         MinTime (30s) with real margin, or the
-                                        server treats this ping as abuse. Defaults
-                                        to 60000. Set to 0 to disable keepalive
-                                        entirely.
+                                        server treats this ping as abuse. Also
+                                        derives grpc.client_idle_timeout_ms (see
+                                        CLIENT_IDLE_TIMEOUT_CEILING_MS), which
+                                        proactively recycles a connection with
+                                        zero active calls before the backend's
+                                        own MaxConnectionIdle would. Defaults to
+                                        60000. Set to 0 to disable both of this
+                                        SDK's own settings for these — grpc-core
+                                        still applies its own (much larger)
+                                        default idle behavior when no options
+                                        are passed at all, so this isn't "no
+                                        idle handling," just no SDK-configured one.
         :type                        : ``` int ```
         :param keepalive_timeout_ms  : How long, in milliseconds, to wait for a
                                         keepalive response before treating an
@@ -242,8 +293,10 @@ class CoreClient:
             channel_credentials,
             call_credentials,
         )
-        # keepalive_time_ms == 0 disables keepalive entirely: no options are
-        # passed, so grpc-core falls back to its own defaults (no idle pings).
+        # keepalive_time_ms == 0 disables keepalive (and, below, the derived
+        # idle-close timeout) entirely: no options are passed, so grpc-core
+        # falls back to its own defaults (no idle pings, ~30 min idle timeout)
+        # — an escape hatch for a network path that rejects this pattern.
         channel_options = []
         if self.keepalive_time_ms:
             # keepalive_permit_without_calls=1 so an idle channel is still
@@ -256,6 +309,10 @@ class CoreClient:
                 ('grpc.keepalive_timeout_ms', self.keepalive_timeout_ms),
                 ('grpc.keepalive_permit_without_calls', 1),
                 ('grpc.http2.max_pings_without_data', 0),
+                # Proactively idle out (and lazily recreate on next use) a
+                # connection with zero active calls before the backend's own
+                # MaxConnectionIdle would — see CLIENT_IDLE_TIMEOUT_CEILING_MS.
+                ('grpc.client_idle_timeout_ms', _client_idle_timeout_ms_for(self.keepalive_time_ms)),
             ]
         self.grpc_secure_channel = grpc.secure_channel(
             self.host, composite_credentials, options=channel_options

scalekit_sdk_python-2.19.1/scalekit/resource.py

@@ -0,0 +1,96 @@
+from typing import Optional, List
+
+from scalekit.core import CoreClient
+from scalekit.v1.clients.clients_pb2 import *
+from scalekit.v1.clients.clients_pb2_grpc import ClientServiceStub
+
+
+class ResourceClient:
+    """API to read and revoke end-user consents granted against a resource"""
+
+    def __init__(self, core_client: CoreClient):
+        """
+        Initializer for Resource Client
+
+        :param core_client    : CoreClient Object
+        :type                 : ``` obj ```
+        :returns
+            None
+        """
+        self.core_client = core_client
+        self.client_service = ClientServiceStub(self.core_client.grpc_secure_channel)
+
+    def list_user_consents(
+        self,
+        resource_id: str,
+        search: Optional[str] = None,
+        page_size: Optional[int] = None,
+        page_token: Optional[str] = None,
+        user_ids: Optional[List[str]] = None,
+    ) -> ListResourceUserConsentsResponse:
+        """
+        Method to list the end-user consents granted against a resource
+
+        Each returned consent carries id, external_user_id, client_id, client_name,
+        scopes and granted_at. The response also carries total_size plus
+        next_page_token / prev_page_token cursors.
+
+        Pass user_ids to match specific external user IDs exactly and
+        case-sensitively. Pass search for a case-insensitive substring match.
+        When both are given, user_ids wins and search is ignored.
+
+        :param resource_id      : Resource id to list consents for (format: res_xxxxx)
+        :type                   : ``` str ```
+        :param search           : Case-insensitive substring match on external user IDs
+        :type                   : ``` str ```
+        :param page_size        : Page size for pagination (max 30)
+        :type                   : ``` int ```
+        :param page_token       : Page token for pagination
+        :type                   : ``` str ```
+        :param user_ids         : Exact match on external user IDs (max 25)
+        :type                   : ``` list ```
+        :returns:
+            List Resource User Consents Response
+        """
+        if not resource_id:
+            raise ValueError("resource_id is required")
+
+        return self.core_client.grpc_exec(
+            self.client_service.ListResourceUserConsents.with_call,
+            ListResourceUserConsentsRequest(
+                resource_id=resource_id,
+                search=search,
+                page_size=page_size,
+                page_token=page_token,
+                filter=ResourceUserConsentFilter(external_user_id=user_ids) if user_ids else None,
+            )
+        )
+
+    def revoke_user_consent(self, client_id: str, consent_id: str) -> RevokeUserConsentResponse:
+        """
+        Method to revoke a single end-user consent held by an API client
+
+        Deletes the consent, so the client is prompted for consent again on its next
+        authorization attempt, and revokes every active refresh token issued to that
+        client for the same user. Access tokens already issued stay valid until they
+        expire.
+
+        Note that client_id is the API client that holds the consent, not the
+        resource id.
+
+        :param client_id        : Client holding the consent (format: m2m_xxxxx)
+        :type                   : ``` str ```
+        :param consent_id       : Consent to revoke (format: usrcnst_xxxxx)
+        :type                   : ``` str ```
+        :returns:
+            Revoke User Consent Response
+        """
+        if not client_id:
+            raise ValueError("client_id is required")
+        if not consent_id:
+            raise ValueError("consent_id is required")
+
+        return self.core_client.grpc_exec(
+            self.client_service.RevokeUserConsent.with_call,
+            RevokeUserConsentRequest(client_id=client_id, consent_id=consent_id)
+        )

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/scalekit_sdk_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scalekit-sdk-python
-Version: 2.19.0
+Version: 2.19.1
 Summary: Scalekit official Python SDK
 Home-page: https://github.com/scalekit-inc/scalekit-sdk-python
 Author: Team Scalekit

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/scalekit_sdk_python.egg-info/SOURCES.txt

@@ -23,6 +23,7 @@ scalekit/organization.py
 scalekit/passwordless.py
 scalekit/permissions.py
 scalekit/providers.py
+scalekit/resource.py
 scalekit/role.py
 scalekit/sessions.py
 scalekit/token.py
@@ -275,6 +276,7 @@ tests/test_organization_slug_logo.py
 tests/test_passwordless.py
 tests/test_permissions.py
 tests/test_providers.py
+tests/test_resource.py
 tests/test_role_defaults_dependent.py
 tests/test_roles.py
 tests/test_sessions.py

{scalekit_sdk_python-2.19.0 → scalekit_sdk_python-2.19.1}/tests/test_keepalive_channel_options.py

@@ -15,6 +15,9 @@ from scalekit.core import (
     CoreClient,
     DEFAULT_KEEPALIVE_TIME_MS,
     DEFAULT_KEEPALIVE_TIMEOUT_MS,
+    CLIENT_IDLE_TIMEOUT_CEILING_MS,
+    CLIENT_IDLE_TIMEOUT_PING_CYCLES,
+    _client_idle_timeout_ms_for,
 )
 
 
@@ -50,8 +53,8 @@ class TestKeepaliveChannelOptions(unittest.TestCase):
         _, mock_secure_channel = _build_client(keepalive_time_ms=0)
         self.assertEqual(self._options_from(mock_secure_channel), [])
 
-    def test_default_construction_includes_all_four_options(self):
-        """Default construction must include all four expected option tuples."""
+    def test_default_construction_includes_all_five_options(self):
+        """Default construction must include all five expected option tuples."""
         _, mock_secure_channel = _build_client()
         options = self._options_from(mock_secure_channel)
         self.assertEqual(
@@ -61,10 +64,12 @@ class TestKeepaliveChannelOptions(unittest.TestCase):
                 ('grpc.keepalive_timeout_ms', DEFAULT_KEEPALIVE_TIMEOUT_MS),
                 ('grpc.keepalive_permit_without_calls', 1),
                 ('grpc.http2.max_pings_without_data', 0),
+                ('grpc.client_idle_timeout_ms', CLIENT_IDLE_TIMEOUT_CEILING_MS),
             ],
         )
-        # Explicit check on the documented default value.
+        # Explicit check on the documented default values.
         self.assertIn(('grpc.keepalive_time_ms', 60000), options)
+        self.assertIn(('grpc.client_idle_timeout_ms', 240000), options)
 
     def test_below_minimum_raises_value_error(self):
         """keepalive_time_ms below the 60s minimum must raise ValueError."""
@@ -83,5 +88,54 @@ class TestKeepaliveChannelOptions(unittest.TestCase):
         self.assertIn(('grpc.keepalive_time_ms', 60000), options)
 
 
+class TestClientIdleTimeout(unittest.TestCase):
+    """Regression tests for the grpc.client_idle_timeout_ms option — the
+    client-side idle-close equivalent of the Go SDK's grpcIdleConnTimeout /
+    Node SDK's idleConnectionTimeoutMs, which this SDK previously omitted."""
+
+    # The backend's own grpc.max_connection_idle enforcement (scalekit's
+    # cmd/grpc.go, grpcKeepaliveMaxConnectionIdle) — kept here as a literal,
+    # not imported, so this test independently pins the actual production
+    # value rather than trusting whatever CLIENT_IDLE_TIMEOUT_CEILING_MS
+    # happens to be set to.
+    _BACKEND_MAX_CONNECTION_IDLE_MS = 5 * 60 * 1000
+
+    def test_ceiling_is_strictly_below_backend_max_connection_idle(self):
+        """Landing exactly on (or above) the backend's own bound is a race —
+        whichever side's timer fires first wins, and the loser is a request
+        written into a socket the other side just closed."""
+        self.assertLess(CLIENT_IDLE_TIMEOUT_CEILING_MS, self._BACKEND_MAX_CONNECTION_IDLE_MS)
+
+    def test_derived_value_scales_with_keepalive_time_when_below_ceiling(self):
+        small = 1000  # hypothetically below the real MIN_KEEPALIVE_TIME_MS floor, to exercise scaling
+        self.assertEqual(
+            _client_idle_timeout_ms_for(small),
+            small * CLIENT_IDLE_TIMEOUT_PING_CYCLES,
+        )
+
+    def test_derived_value_clamps_to_ceiling_at_default_keepalive(self):
+        self.assertEqual(
+            _client_idle_timeout_ms_for(DEFAULT_KEEPALIVE_TIME_MS),
+            CLIENT_IDLE_TIMEOUT_CEILING_MS,
+        )
+
+    def test_disabled_keepalive_derives_to_zero(self):
+        self.assertEqual(_client_idle_timeout_ms_for(0), 0)
+
+    def test_disabling_keepalive_omits_idle_timeout_option_too(self):
+        """keepalive_time_ms=0 must disable BOTH the ping-based and the
+        idle-close detection — a partial disable would be a surprising,
+        undocumented middle state."""
+        _, mock_secure_channel = _build_client(keepalive_time_ms=0)
+        mock_secure_channel.assert_called_once()
+        _, kwargs = mock_secure_channel.call_args
+        options = kwargs["options"]
+        self.assertEqual(options, [])
+        self.assertNotIn(
+            "grpc.client_idle_timeout_ms",
+            [name for name, _ in options],
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

scalekit_sdk_python-2.19.1/tests/test_resource.py

@@ -0,0 +1,81 @@
+from basetest import BaseTest
+
+# A real MCP server resource in the test environment. These tests assert the
+# call shape and the pagination envelope, never the consent contents, so they
+# hold whether or not the resource currently has consents.
+TEST_RESOURCE_ID = "res_90805895235109156"
+
+
+class TestResourceClient(BaseTest):
+    """ Class definition for TestResourceClient Class """
+
+    def test_list_user_consents(self):
+        """ Method to test list user consents for a resource """
+        response = self.scalekit_client.resources.list_user_consents(
+            resource_id=TEST_RESOURCE_ID
+        )
+
+        self.assertEqual(response[1].code().name, "OK")
+        self.assertIsNotNone(response[0].consents)
+        self.assertIsInstance(response[0].total_size, int)
+
+    def test_list_user_consents_with_page_size(self):
+        """ Method to test list user consents with a page size """
+        response = self.scalekit_client.resources.list_user_consents(
+            resource_id=TEST_RESOURCE_ID, page_size=10
+        )
+
+        self.assertEqual(response[1].code().name, "OK")
+        self.assertTrue(len(response[0].consents) <= 10)
+
+    def test_list_user_consents_with_search(self):
+        """ Method to test list user consents with a search term """
+        response = self.scalekit_client.resources.list_user_consents(
+            resource_id=TEST_RESOURCE_ID, search="usr_"
+        )
+
+        self.assertEqual(response[1].code().name, "OK")
+        self.assertIsNotNone(response[0].consents)
+
+    def test_list_user_consents_with_user_ids(self):
+        """ Method to test list user consents with an exact user_ids filter """
+        response = self.scalekit_client.resources.list_user_consents(
+            resource_id=TEST_RESOURCE_ID, user_ids=["usr_does_not_exist"]
+        )
+
+        self.assertEqual(response[1].code().name, "OK")
+        self.assertEqual(len(response[0].consents), 0)
+
+    def test_list_user_consents_user_ids_takes_precedence_over_search(self):
+        """ Method to test that user_ids is honoured alongside search """
+        response = self.scalekit_client.resources.list_user_consents(
+            resource_id=TEST_RESOURCE_ID, user_ids=["usr_does_not_exist"], search="usr_"
+        )
+
+        self.assertEqual(response[1].code().name, "OK")
+        self.assertEqual(len(response[0].consents), 0)
+
+    def test_list_user_consents_without_resource_id(self):
+        """ Method to test list user consents without a resource id """
+        with self.assertRaises(ValueError) as context:
+            self.scalekit_client.resources.list_user_consents(resource_id="")
+
+        self.assertEqual(str(context.exception), "resource_id is required")
+
+    def test_revoke_user_consent_without_client_id(self):
+        """ Method to test revoke user consent without a client id """
+        with self.assertRaises(ValueError) as context:
+            self.scalekit_client.resources.revoke_user_consent(
+                client_id="", consent_id="usrcnst_1234567890"
+            )
+
+        self.assertEqual(str(context.exception), "client_id is required")
+
+    def test_revoke_user_consent_without_consent_id(self):
+        """ Method to test revoke user consent without a consent id """
+        with self.assertRaises(ValueError) as context:
+            self.scalekit_client.resources.revoke_user_consent(
+                client_id="m2m_1234567890", consent_id=""
+            )
+
+        self.assertEqual(str(context.exception), "consent_id is required")