snowflake-connector-python 3.14.1__tar.gz → 3.15.0__tar.gz

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/DESCRIPTION.md

@@ -7,8 +7,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.15(TBD)
-  -
+- v3.15.0(Apr 29,2025)
+  - Bumped up min boto and botocore version to 1.24.
+  - OCSP: terminate certificates chain traversal if a trusted certificate already reached.
+  - Added new authentication methods support for programmatic access tokens (PATs), OAuth 2.0 Authorization Code Flow, OAuth 2.0 Client Credentials Flow, and OAuth Token caching.
+    - For OAuth 2.0 Authorization Code Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_authorization_url`, `oauth_token_request_url`, `oauth_redirect_uri`, `oauth_scope`, `oauth_disable_pkce`, `oauth_enable_refresh_tokens` and `oauth_enable_single_use_refresh_tokens` parameters.
+      - Added the `OAUTH_AUTHORIZATION_CODE` value for the parameter authenticator.
+    - For OAuth 2.0 Client Credentials Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_token_request_url`, and `oauth_scope` parameters.
+      - Added the `OAUTH_CLIENT_CREDENTIALS` value for the parameter authenticator.
+    - For OAuth Token caching: Passing a username to driver configuration is required, and the `client_store_temporary_credential property` is to be set to `true`.
 
 - v3.14.1(April 21, 2025)
   - Added support for Python 3.13.

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.14.1
+Version: 3.15.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -39,8 +39,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: boto3>=1.0
-Requires-Dist: botocore>=1.0
+Requires-Dist: boto3>=1.24
+Requires-Dist: botocore>=1.24
 Requires-Dist: cffi<2.0.0,>=1.9
 Requires-Dist: cryptography>=3.1.0
 Requires-Dist: pyOpenSSL<26.0.0,>=22.0.0
@@ -86,8 +86,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.15(TBD)
-  -
+- v3.15.0(Apr 29,2025)
+  - Bumped up min boto and botocore version to 1.24.
+  - OCSP: terminate certificates chain traversal if a trusted certificate already reached.
+  - Added new authentication methods support for programmatic access tokens (PATs), OAuth 2.0 Authorization Code Flow, OAuth 2.0 Client Credentials Flow, and OAuth Token caching.
+    - For OAuth 2.0 Authorization Code Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_authorization_url`, `oauth_token_request_url`, `oauth_redirect_uri`, `oauth_scope`, `oauth_disable_pkce`, `oauth_enable_refresh_tokens` and `oauth_enable_single_use_refresh_tokens` parameters.
+      - Added the `OAUTH_AUTHORIZATION_CODE` value for the parameter authenticator.
+    - For OAuth 2.0 Client Credentials Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_token_request_url`, and `oauth_scope` parameters.
+      - Added the `OAUTH_CLIENT_CREDENTIALS` value for the parameter authenticator.
+    - For OAuth Token caching: Passing a username to driver configuration is required, and the `client_store_temporary_credential property` is to be set to `true`.
 
 - v3.14.1(April 21, 2025)
   - Added support for Python 3.13.

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/setup.cfg

@@ -44,8 +44,8 @@ python_requires = >=3.9
 packages = find_namespace:
 install_requires = 
 	asn1crypto>0.24.0,<2.0.0
-	boto3>=1.0
-	botocore>=1.0
+	boto3>=1.24
+	botocore>=1.24
 	cffi>=1.9,<2.0.0
 	cryptography>=3.1.0
 	pyOpenSSL>=22.0.0,<26.0.0

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/auth/oauth_code.py

@@ -58,6 +58,7 @@ class AuthByOauthCode(AuthByOAuthBase):
         token_cache: TokenCache | None = None,
         refresh_token_enabled: bool = False,
         external_browser_timeout: int | None = None,
+        enable_single_use_refresh_tokens: bool = False,
         **kwargs,
     ) -> None:
         super().__init__(
@@ -81,6 +82,7 @@ class AuthByOauthCode(AuthByOAuthBase):
             logger.debug("oauth pkce is going to be used")
         self._verifier: str | None = None
         self._external_browser_timeout = external_browser_timeout
+        self._enable_single_use_refresh_tokens = enable_single_use_refresh_tokens
 
     def _get_oauth_type_id(self) -> str:
         return OAUTH_TYPE_AUTHORIZATION_CODE
@@ -296,6 +298,8 @@ You can close this window now and go back where you started from.
             "code": code,
             "redirect_uri": callback_server.url,
         }
+        if self._enable_single_use_refresh_tokens:
+            fields["enable_single_use_refresh_tokens"] = "true"
         if self._pkce_enabled:
             assert self._verifier is not None
             fields["code_verifier"] = self._verifier

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/connection.py

@@ -2,7 +2,6 @@
 from __future__ import annotations
 
 import atexit
-import collections.abc
 import logging
 import os
 import pathlib
@@ -94,6 +93,7 @@ from .errorcode import (
     ER_INVALID_WIF_SETTINGS,
     ER_NO_ACCOUNT_NAME,
     ER_NO_CLIENT_ID,
+    ER_NO_CLIENT_SECRET,
     ER_NO_NUMPY,
     ER_NO_PASSWORD,
     ER_NO_USER,
@@ -346,11 +346,20 @@ DEFAULT_CONFIGURATION: dict[str, tuple[Any, type | tuple[type, ...]]] = {
         str,
         # SNOW-1825621: OAUTH implementation
     ),
-    "oauth_security_features": (
-        ("pkce",),
-        collections.abc.Iterable,  # of strings
+    "oauth_disable_pkce": (
+        False,
+        bool,
         # SNOW-1825621: OAUTH PKCE
     ),
+    "oauth_enable_refresh_tokens": (
+        False,
+        bool,
+    ),
+    "oauth_enable_single_use_refresh_tokens": (
+        False,
+        bool,
+        # Client-side opt-in to single-use refresh tokens.
+    ),
     "check_arrow_conversion_error_on_every_column": (
         True,
         bool,
@@ -838,21 +847,6 @@ class SnowflakeConnection:
     def unsafe_file_write(self, value: bool) -> None:
         self._unsafe_file_write = value
 
-    class _OAuthSecurityFeatures(NamedTuple):
-        pkce_enabled: bool
-        refresh_token_enabled: bool
-
-    @property
-    def oauth_security_features(self) -> _OAuthSecurityFeatures:
-        features = self._oauth_security_features
-        if isinstance(features, str):
-            features = features.split(" ")
-        features = [feat.lower() for feat in features]
-        return self._OAuthSecurityFeatures(
-            pkce_enabled="pkce" in features,
-            refresh_token_enabled="refresh_token" in features,
-        )
-
     @property
     def check_arrow_conversion_error_on_every_column(self) -> bool:
         return self._check_arrow_conversion_error_on_every_column
@@ -1210,9 +1204,7 @@ class SnowflakeConnection:
                     backoff_generator=self._backoff_generator,
                 )
             elif self._authenticator == OAUTH_AUTHORIZATION_CODE:
-                self._check_experimental_authentication_flag()
-                self._check_oauth_required_parameters()
-                features = self.oauth_security_features
+                self._check_oauth_parameters()
                 if self._role and (self._oauth_scope == ""):
                     # if role is known then let's inject it into scope
                     self._oauth_scope = _OAUTH_DEFAULT_SCOPE.format(role=self._role)
@@ -1228,19 +1220,18 @@ class SnowflakeConnection:
                     ),
                     redirect_uri=self._oauth_redirect_uri,
                     scope=self._oauth_scope,
-                    pkce_enabled=features.pkce_enabled,
+                    pkce_enabled=not self._oauth_disable_pkce,
                     token_cache=(
                         auth.get_token_cache()
                         if self._client_store_temporary_credential
                         else None
                     ),
-                    refresh_token_enabled=features.refresh_token_enabled,
+                    refresh_token_enabled=self._oauth_enable_refresh_tokens,
                     external_browser_timeout=self._external_browser_timeout,
+                    enable_single_use_refresh_tokens=self._oauth_enable_single_use_refresh_tokens,
                 )
             elif self._authenticator == OAUTH_CLIENT_CREDENTIALS:
-                self._check_experimental_authentication_flag()
-                self._check_oauth_required_parameters()
-                features = self.oauth_security_features
+                self._check_oauth_parameters()
                 if self._role and (self._oauth_scope == ""):
                     # if role is known then let's inject it into scope
                     self._oauth_scope = _OAUTH_DEFAULT_SCOPE.format(role=self._role)
@@ -1257,7 +1248,7 @@ class SnowflakeConnection:
                         if self._client_store_temporary_credential
                         else None
                     ),
-                    refresh_token_enabled=features.refresh_token_enabled,
+                    refresh_token_enabled=self._oauth_enable_refresh_tokens,
                 )
             elif self._authenticator == USR_PWD_MFA_AUTHENTICATOR:
                 self._session_parameters[PARAMETER_CLIENT_REQUEST_MFA_TOKEN] = (
@@ -2245,7 +2236,7 @@ class SnowflakeConnection:
                 },
             )
 
-    def _check_oauth_required_parameters(self) -> None:
+    def _check_oauth_parameters(self) -> None:
         if self._oauth_client_id is None:
             Error.errorhandler_wrapper(
                 self,
@@ -2263,6 +2254,32 @@ class SnowflakeConnection:
                 ProgrammingError,
                 {
                     "msg": "Oauth code flow requirement 'client_secret' is empty",
-                    "errno": ER_NO_CLIENT_ID,
+                    "errno": ER_NO_CLIENT_SECRET,
+                },
+            )
+        if (
+            self._oauth_authorization_url
+            and not self._oauth_authorization_url.startswith("https://")
+        ):
+            Error.errorhandler_wrapper(
+                self,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "OAuth supports only authorization urls that use 'https' scheme",
+                    "errno": ER_INVALID_VALUE,
+                },
+            )
+        if self._oauth_redirect_uri and not (
+            self._oauth_redirect_uri.startswith("http://")
+            or self._oauth_redirect_uri.startswith("https://")
+        ):
+            Error.errorhandler_wrapper(
+                self,
+                None,
+                ProgrammingError,
+                {
+                    "msg": "OAuth supports only authorization urls that use 'http(s)' scheme",
+                    "errno": ER_INVALID_VALUE,
                 },
             )

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/connection_diagnostic.py

@@ -579,7 +579,7 @@ class ConnectionDiagnostic:
                     cert_reqs=cert_reqs,
                 )
             resp = http.request(
-                "GET", "https://nonexistentdomain.invalidtld", timeout=10.0
+                "GET", "https://nonexistentdomain.invalid", timeout=10.0
             )
 
             # squid does not throw exception.  Check HTML

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/errorcode.py

@@ -34,6 +34,7 @@ ER_OAUTH_SERVER_TIMEOUT = 251016
 ER_INVALID_WIF_SETTINGS = 251017
 ER_WIF_CREDENTIALS_NOT_FOUND = 251018
 ER_EXPERIMENTAL_AUTHENTICATION_NOT_SUPPORTED = 251019
+ER_NO_CLIENT_SECRET = 251020
 
 # cursor
 ER_FAILED_TO_REWRITE_MULTI_ROW_INSERT = 252001

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/ocsp_asn1crypto.py

@@ -394,15 +394,22 @@ class SnowflakeOCSPAsn1Crypto(SnowflakeOCSP):
         from OpenSSL.crypto import FILETYPE_ASN1, dump_certificate
 
         cert_map = OrderedDict()
-        logger.debug("# of certificates: %s", len(connection.get_peer_cert_chain()))
-
-        for cert_openssl in connection.get_peer_cert_chain():
+        cert_chain = connection.get_peer_cert_chain()
+        logger.debug("# of certificates: %s", len(cert_chain))
+        self._lazy_read_ca_bundle()
+        for cert_openssl in cert_chain:
             cert_der = dump_certificate(FILETYPE_ASN1, cert_openssl)
             cert = Certificate.load(cert_der)
             logger.debug(
                 "subject: %s, issuer: %s", cert.subject.native, cert.issuer.native
             )
             cert_map[cert.subject.sha256] = cert
+            if cert.issuer.sha256 in SnowflakeOCSP.ROOT_CERTIFICATES_DICT:
+                logger.debug(
+                    "A trusted root certificate found: %s, stopping chain traversal here",
+                    cert.subject.native,
+                )
+                break
 
         return self.create_pair_issuer_subject(cert_map)
 

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/tool/dump_ocsp_response.py

@@ -1,38 +1,55 @@
 #!/usr/bin/env python
 from __future__ import annotations
 
+import logging
+import sys
 import time
-from os import path
+from argparse import ArgumentParser, Namespace
 from time import gmtime, strftime
 
 from asn1crypto import ocsp as asn1crypto_ocsp
 
 from snowflake.connector.compat import urlsplit
 from snowflake.connector.ocsp_asn1crypto import SnowflakeOCSPAsn1Crypto as SFOCSP
+from snowflake.connector.ocsp_snowflake import OCSPTelemetryData
 from snowflake.connector.ssl_wrap_socket import _openssl_connect
 
 
+def _parse_args() -> Namespace:
+    parser = ArgumentParser(
+        prog="dump_ocsp_response",
+        description="Dump OCSP Response for the URLs (an internal tool).",
+    )
+    parser.add_argument(
+        "-o",
+        "--output-file",
+        required=False,
+        help="Dump output file",
+        type=str,
+        default=None,
+    )
+    parser.add_argument(
+        "--log-level",
+        required=False,
+        help="Log level",
+        choices=["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"],
+    )
+    parser.add_argument("--log-file", required=False, help="Log file", default=None)
+    parser.add_argument("urls", nargs="+", help="URLs to dump OCSP Response for")
+    return parser.parse_args()
+
+
 def main() -> None:
     """Internal Tool: OCSP response dumper."""
-
-    def help() -> None:
-        print("Dump OCSP Response for the URL. ")
-        print(
-            """
-Usage: {} <url> [<url> ...]
-""".format(
-                path.basename(sys.argv[0])
+    args = _parse_args()
+    if args.log_level:
+        if args.log_file:
+            logging.basicConfig(
+                filename=args.log_file, level=getattr(logging, args.log_level.upper())
             )
-        )
-        sys.exit(2)
-
-    import sys
-
-    if len(sys.argv) < 2:
-        help()
-
-    urls = sys.argv[1:]
-    dump_ocsp_response(urls, output_filename=None)
+        else:
+            logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
+    dump_ocsp_response(args.urls, output_filename=args.output_file)
 
 
 def dump_good_status(current_time, single_response) -> None:
@@ -87,7 +104,7 @@ def dump_ocsp_response(urls, output_filename):
         for issuer, subject in cert_data:
             _, _ = ocsp.create_ocsp_request(issuer, subject)
             _, _, _, cert_id, ocsp_response_der = ocsp.validate_by_direct_connection(
-                issuer, subject
+                issuer, subject, OCSPTelemetryData()
             )
             ocsp_response = asn1crypto_ocsp.OCSPResponse.load(ocsp_response_der)
             print("------------------------------------------------------------")
@@ -115,7 +132,7 @@ def dump_ocsp_response(urls, output_filename):
 
         if output_filename:
             SFOCSP.OCSP_CACHE.write_ocsp_response_cache_file(ocsp, output_filename)
-    return SFOCSP.OCSP_CACHE.CACHE
+    return SFOCSP.OCSP_CACHE
 
 
 if __name__ == "__main__":

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake/connector/version.py

@@ -1,3 +1,3 @@
 # Update this for the versions
 # Don't change the forth version number from None
-VERSION = (3, 14, 1, None)
+VERSION = (3, 15, 0, None)

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake_connector_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: snowflake-connector-python
-Version: 3.14.1
+Version: 3.15.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -39,8 +39,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.txt
 License-File: NOTICE
 Requires-Dist: asn1crypto<2.0.0,>0.24.0
-Requires-Dist: boto3>=1.0
-Requires-Dist: botocore>=1.0
+Requires-Dist: boto3>=1.24
+Requires-Dist: botocore>=1.24
 Requires-Dist: cffi<2.0.0,>=1.9
 Requires-Dist: cryptography>=3.1.0
 Requires-Dist: pyOpenSSL<26.0.0,>=22.0.0
@@ -86,8 +86,17 @@ https://docs.snowflake.com/
 Source code is also available at: https://github.com/snowflakedb/snowflake-connector-python
 
 # Release Notes
-- v3.15(TBD)
-  -
+- v3.15.0(Apr 29,2025)
+  - Bumped up min boto and botocore version to 1.24.
+  - OCSP: terminate certificates chain traversal if a trusted certificate already reached.
+  - Added new authentication methods support for programmatic access tokens (PATs), OAuth 2.0 Authorization Code Flow, OAuth 2.0 Client Credentials Flow, and OAuth Token caching.
+    - For OAuth 2.0 Authorization Code Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_authorization_url`, `oauth_token_request_url`, `oauth_redirect_uri`, `oauth_scope`, `oauth_disable_pkce`, `oauth_enable_refresh_tokens` and `oauth_enable_single_use_refresh_tokens` parameters.
+      - Added the `OAUTH_AUTHORIZATION_CODE` value for the parameter authenticator.
+    - For OAuth 2.0 Client Credentials Flow:
+      - Added the `oauth_client_id`, `oauth_client_secret`, `oauth_token_request_url`, and `oauth_scope` parameters.
+      - Added the `OAUTH_CLIENT_CREDENTIALS` value for the parameter authenticator.
+    - For OAuth Token caching: Passing a username to driver configuration is required, and the `client_store_temporary_credential property` is to be set to `true`.
 
 - v3.14.1(April 21, 2025)
   - Added support for Python 3.13.

{snowflake_connector_python-3.14.1 → snowflake_connector_python-3.15.0}/src/snowflake_connector_python.egg-info/requires.txt

@@ -1,6 +1,6 @@
 asn1crypto<2.0.0,>0.24.0
-boto3>=1.0
-botocore>=1.0
+boto3>=1.24
+botocore>=1.24
 cffi<2.0.0,>=1.9
 cryptography>=3.1.0
 pyOpenSSL<26.0.0,>=22.0.0