stackos-connectors 0.2.2__tar.gz → 0.2.3__tar.gz

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackos-connectors
-Version: 0.2.2
+Version: 0.2.3
 Summary: Named provider connectors with plain data and caller-owned authentication.
 License-Expression: MIT
 License-File: LICENSE
@@ -127,11 +127,11 @@ through `CallOptions(provider_context={"mailbox": ...})`. Google Ads/Workspace
 service-account probes only report resolved-token presence and unverified resource
 access; they make no HTTP call or new-grant claim.
 
-Google JWT validation/signing is shared across the five declared service-account
+Google JWT validation/signing is shared across the six declared service-account
 methods. Credentials never come from ambient identity or key-supplied endpoints.
 Provider details live in `connectors/<provider>/docs/auth.md` and the catalog.
-Google Indexing retains its existing resolved-token action/probe contract; this
-release adds no Indexing JWT acquisition method.
+Google Indexing supports explicit `jwt_bearer` acquisition with the fixed Indexing
+scope. Token acquisition does not establish API enablement or site-owner access.
 
 Provider-local pure helpers cover Telegram authorization request/challenge/state
 translation (`connectors.telegram.auth`), Slack v0 HMAC verification
@@ -191,15 +191,23 @@ Python 3.12 or newer is required. Source:
 Published releases can be installed with:
 
 ```bash
-python -m pip install stackos-connectors==0.2.2
+python -m pip install stackos-connectors==0.2.3
 ```
 
-Or add `stackos-connectors==0.2.2` to your Python dependency requirements.
+Or add `stackos-connectors==0.2.3` to your Python dependency requirements.
 
 Install from a local checkout with `pip install /path/to/StackOSConnectors`, or
 build a wheel with `python -m build --wheel` and install that wheel. Runtime use
 needs only the installed package and its declared dependencies.
 
+### 0.2.3 release notes
+
+- Restore Google Indexing service-account token acquisition through the canonical
+  `get_auth_contract` and `request_token` APIs. The contract fixes the Google token
+  endpoint and Indexing scope, requires a Bearer response, and rejects delegation.
+- Preserve the QuickBooks Online connector from 0.2.2 and the Search Console scope
+  handling from 0.2.1.
+
 ## Publishing
 
 The manual [publish workflow](.github/workflows/publish.yml) uses PyPI Trusted

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/README.md

@@ -111,11 +111,11 @@ through `CallOptions(provider_context={"mailbox": ...})`. Google Ads/Workspace
 service-account probes only report resolved-token presence and unverified resource
 access; they make no HTTP call or new-grant claim.
 
-Google JWT validation/signing is shared across the five declared service-account
+Google JWT validation/signing is shared across the six declared service-account
 methods. Credentials never come from ambient identity or key-supplied endpoints.
 Provider details live in `connectors/<provider>/docs/auth.md` and the catalog.
-Google Indexing retains its existing resolved-token action/probe contract; this
-release adds no Indexing JWT acquisition method.
+Google Indexing supports explicit `jwt_bearer` acquisition with the fixed Indexing
+scope. Token acquisition does not establish API enablement or site-owner access.
 
 Provider-local pure helpers cover Telegram authorization request/challenge/state
 translation (`connectors.telegram.auth`), Slack v0 HMAC verification
@@ -175,15 +175,23 @@ Python 3.12 or newer is required. Source:
 Published releases can be installed with:
 
 ```bash
-python -m pip install stackos-connectors==0.2.2
+python -m pip install stackos-connectors==0.2.3
 ```
 
-Or add `stackos-connectors==0.2.2` to your Python dependency requirements.
+Or add `stackos-connectors==0.2.3` to your Python dependency requirements.
 
 Install from a local checkout with `pip install /path/to/StackOSConnectors`, or
 build a wheel with `python -m build --wheel` and install that wheel. Runtime use
 needs only the installed package and its declared dependencies.
 
+### 0.2.3 release notes
+
+- Restore Google Indexing service-account token acquisition through the canonical
+  `get_auth_contract` and `request_token` APIs. The contract fixes the Google token
+  endpoint and Indexing scope, requires a Bearer response, and rejects delegation.
+- Preserve the QuickBooks Online connector from 0.2.2 and the Search Console scope
+  handling from 0.2.1.
+
 ## Publishing
 
 The manual [publish workflow](.github/workflows/publish.yml) uses PyPI Trusted

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "stackos-connectors"
-version = "0.2.2"
+version = "0.2.3"
 description = "Named provider connectors with plain data and caller-owned authentication."
 readme = "README.md"
 requires-python = ">=3.12"

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/src/stackos_connectors/connectors/google_indexing/catalog.json

@@ -41,7 +41,20 @@
             "type": "secret"
           }
         ],
-        "description": "Use the Google service-account key to acquire an access token outside this library. Execution accepts the resolved access_token; provider resource access must be granted separately."
+        "description": "Use request_token with the Google service-account key to acquire an access token. Execution accepts the resolved access_token; provider resource access must be granted separately. Credential storage and refresh scheduling remain consumer-owned.",
+        "auth_type": "oauth",
+        "interactive": false
+      },
+      "evidence_source": "oauth_response",
+      "protocol": {
+        "grant_types": [
+          "jwt_bearer"
+        ],
+        "flow": "jwt_bearer",
+        "authorization_endpoint": null,
+        "pkce_mode": "unavailable",
+        "authorization_params": [],
+        "required_token_type": "Bearer"
       }
     }
   ],
@@ -221,5 +234,12 @@
     "path": "shared/icons/integration.svg",
     "media_type": "image/svg+xml",
     "kind": "fallback"
+  },
+  "auth_protocol": {
+    "flow": "jwt_bearer",
+    "token_endpoint": "https://oauth2.googleapis.com/token",
+    "scopes": [
+      "https://www.googleapis.com/auth/indexing"
+    ]
   }
 }

stackos_connectors-0.2.3/src/stackos_connectors/connectors/google_indexing/docs/auth.md

@@ -0,0 +1,30 @@
+# Google Indexing authentication
+
+The [bundled catalog](../catalog.json) is the installed contract for method fields,
+scopes, endpoints and supported grants. Read it through `describe`; use
+`get_auth_contract` for immutable protocol facts.
+
+| Saved method | Explicit token grants |
+| --- | --- |
+| `service-account` | `jwt_bearer` |
+
+Call `request_token` with resolved `service_account_json` to sign an RSA JWT and
+exchange it at `https://oauth2.googleapis.com/token`. The signed request uses only
+`https://www.googleapis.com/auth/indexing`. The shared Google key validator rejects
+alternate token endpoints and external credential sources. Delegation is not
+supported. A successful response requires a Bearer token and a positive expiry;
+omitted scope remains omitted provider evidence.
+
+Actions and `probe_credentials` accept the resolved `access_token`. Discovery,
+probes and actions never acquire or refresh credentials implicitly. The consumer
+owns key and token custody, refresh timing, permissions, persistence and audit.
+
+Token acquisition does not verify API enablement or site-owner access. The service
+account needs delegated site-owner access in Search Console. This property role
+is separate from Workspace user impersonation. Existing eligibility, quota and
+notification semantics remain in the [provider notes](google-indexing.md).
+
+Provider references retained from the reviewed catalog:
+
+- [Indexing prerequisites](https://developers.google.com/search/apis/indexing-api/v3/prereqs)
+- [Indexing API usage](https://developers.google.com/search/apis/indexing-api/v3/using-api)

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/src/stackos_connectors/connectors/google_search_console/docs/auth.md

@@ -21,7 +21,7 @@ The full `webmasters` scope also permits read operations. Consumers can use
 without changing stored provider scope evidence. Read-only scope never satisfies
 a sitemap submission requirement. Property permissions remain separate.
 
-Service-account token success does not establish Search Console property access. Inventory probes can succeed with no properties. Google Indexing is a separate resolved-token contract; no new Indexing JWT grant is supplied.
+Service-account token success does not establish Search Console property access. Inventory probes can succeed with no properties. Google Indexing has a separate [service-account authentication contract](../../google_indexing/docs/auth.md) and scope.
 
 `request_token` receives resolved application/key fields and performs only the requested grant. Actions and `probe_credentials` receive resolved execution fields. Discovery, probes and actions never acquire or refresh implicitly. The consumer owns credential/state/PKCE custody, callbacks, refresh timing and concurrency, permissions, persistence and audit. Token results and authorization URLs are sensitive in-process values.
 

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/src/stackos_connectors/shared/google/service_account.py

@@ -19,6 +19,7 @@ JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer"
 GOOGLE_SERVICE_ACCOUNT_PROVIDERS = frozenset(
     {
         "google-search-console",
+        "google-indexing",
         "google-analytics",
         "google-tag-manager",
         "google-ads",

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/tests/auth/test_google_service_account.py

@@ -81,11 +81,12 @@ async def test_explicit_jwt_grant():
         "google-ads",
         "google-workspace",
         "google-search-console",
+        "google-indexing",
         "google-analytics",
         "google-tag-manager",
     ],
 )
-async def test_five_released_jwt_providers(provider):
+async def test_released_jwt_providers(provider):
     from urllib.parse import parse_qs
 
     from stackos_connectors.auth import get_auth_contract
@@ -107,12 +108,44 @@ async def test_five_released_jwt_providers(provider):
         )
 
     async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http:
-        await request_token(
+        result = await request_token(
             provider,
             auth=ConnectorAuth("service-account", {"service_account_json": value}),
             grant_type="jwt_bearer",
             http=http,
         )
+        assert not http.is_closed
+    assert result.access_token == "token"
+    assert result.token_type == "Bearer" and result.expires_in == 3600
+    assert result.scopes is None and not result.scopes_present
+
+
+@pytest.mark.parametrize(
+    "response,invalid_field",
+    [
+        ({"expires_in": 3600}, "token_type"),
+        ({"expires_in": 3600, "token_type": "Basic"}, "token_type"),
+        ({"token_type": "Bearer"}, "expires_in"),
+        ({"expires_in": 0, "token_type": "Bearer"}, "expires_in"),
+        ({"expires_in": 3600, "token_type": "Bearer", "scope": ""}, "scope"),
+    ],
+)
+async def test_google_indexing_rejects_invalid_token_response(response, invalid_field):
+    _, value = make_key()
+    async with httpx.AsyncClient(
+        transport=httpx.MockTransport(
+            lambda r: httpx.Response(200, json={"access_token": "token", **response})
+        )
+    ) as http:
+        with pytest.raises(OAuthTokenError) as caught:
+            await request_token(
+                "google-indexing",
+                auth=ConnectorAuth("service-account", {"service_account_json": value}),
+                grant_type="jwt_bearer",
+                http=http,
+            )
+    assert caught.value.provider_key == "google-indexing"
+    assert invalid_field in caught.value.invalid_fields
 
 
 @pytest.mark.parametrize(

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/tests/auth/test_oauth_contracts.py

@@ -65,7 +65,7 @@ def test_authorization_request_preserves_linear_protocol_and_hides_state():
     [
         ("missing", "oauth2_token"),
         ("pipedrive", "api_token"),
-        ("google-indexing", "service-account"),
+        ("google-indexing", "oauth2_authorization_code"),
         ("linear", "missing"),
     ],
 )
@@ -74,6 +74,34 @@ def test_unsupported_auth_does_not_gain_a_protocol(provider, method):
         get_auth_contract(provider, method=method)
 
 
+def test_google_indexing_contract_has_fixed_jwt_protocol():
+    from stackos_connectors.shared.google.service_account import (
+        GOOGLE_SERVICE_ACCOUNT_PROVIDERS,
+    )
+
+    contract = get_auth_contract(
+        "google-indexing",
+        method="service-account",
+        config={"token_endpoint": "https://untrusted.example/token", "scopes": ["invented"]},
+    )
+    assert "google-indexing" in GOOGLE_SERVICE_ACCOUNT_PROVIDERS
+    assert contract.flow == "jwt_bearer"
+    assert contract.token_endpoint == "https://oauth2.googleapis.com/token"
+    assert contract.scopes == ("https://www.googleapis.com/auth/indexing",)
+    assert contract.grant_types == ("jwt_bearer",)
+    assert contract.required_token_type == "Bearer"
+    assert contract.authorization_endpoint is None
+    assert contract.pkce_mode == "unavailable"
+    assert contract.authorization_params == ()
+    assert contract.delegated_subject is None
+    with pytest.raises(OAuthTokenError, match="only for Google Workspace"):
+        get_auth_contract(
+            "google-indexing",
+            method="service-account",
+            config={"delegated_subject": "user@example.com"},
+        )
+
+
 def test_dynamic_endpoints_and_delegation():
     assert (
         "/organizations/"

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/tests/auth/test_probes.py

@@ -372,7 +372,12 @@ def test_probe_bindings_are_fixed_and_metadata_discovery_does_not_probe(monkeypa
     monkeypatch.setattr("stackos_connectors.probe.probe_credentials", forbidden)
     description = get_default_client().describe("google-indexing")
     assert description["probe_implementation"].startswith("stackos_connectors.")
-    assert "auth_protocol" not in description
+    assert description["auth_protocol"]["flow"] == "jwt_bearer"
+    method = description["auth_methods"][0]
+    assert method["evidence_source"] == "oauth_response"
+    assert method["setup"]["auth_type"] == "oauth"
+    assert not method["setup"]["interactive"]
+    assert method["fields_schema"]["required"] == ["access_token"]
     # Every catalog-local binding is importable from the standalone wheel. Pure
     # config projection must neither construct a provider nor perform a probe.
     bound = {

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/tests/packaging/installed_auth_consumer.py

@@ -123,7 +123,7 @@ async def main():
         for key, metadata in client.registry.connector_metadata.items()
         if "auth_protocol" in metadata
     }
-    assert len(providers) == 16 and "google-indexing" not in providers
+    assert len(providers) == 17 and "google-indexing" in providers
     methods = 0
     for key, metadata in providers.items():
         assert root.joinpath("connectors", key.replace("-", "_"), "docs", "auth.md").is_file()
@@ -148,6 +148,8 @@ async def main():
 
     grant_calls = []
     for provider in providers:
+        if provider == "google-indexing":
+            continue  # Its only grant is exercised with a generated JSON key below.
         application_only = provider in {"reddit", "taboola"}
         grant = "client_credentials" if application_only else "authorization_code"
         method = "client_credentials" if application_only else "oauth2_authorization_code"
@@ -254,6 +256,30 @@ async def main():
             http=http,
         )
     assert signed.access_token == ACCESS and not signed.scopes_present
+
+    def indexing_jwt_edge(request):
+        assert str(request.url) == "https://oauth2.googleapis.com/token"
+        body = parse_qs(request.content.decode())
+        assert body["grant_type"] == ["urn:ietf:params:oauth:grant-type:jwt-bearer"]
+        encoded = body["assertion"][0].split(".")[1]
+        claims = json.loads(base64.urlsafe_b64decode(encoded + "=" * (-len(encoded) % 4)))
+        assert claims["scope"] == "https://www.googleapis.com/auth/indexing"
+        assert claims["aud"] == "https://oauth2.googleapis.com/token"
+        assert "sub" not in claims
+        return httpx.Response(
+            200, json={"access_token": ACCESS, "expires_in": 3600, "token_type": "Bearer"}
+        )
+
+    async with httpx.AsyncClient(transport=httpx.MockTransport(indexing_jwt_edge)) as http:
+        indexing = await request_token(
+            "google-indexing",
+            auth=ConnectorAuth("service-account", {"service_account_json": key_json}),
+            grant_type="jwt_bearer",
+            http=http,
+        )
+        assert not http.is_closed
+    assert indexing.access_token == ACCESS and not indexing.scopes_present
+    assert indexing.token_type == "Bearer" and indexing.expires_in == 3600
     try:
         await request_token(
             "taboola",
@@ -363,6 +389,7 @@ async def main():
                     "refresh",
                     "client_credentials",
                     "delegated_jwt",
+                    "indexing_jwt",
                     "probe",
                     "action",
                     "telegram",

{stackos_connectors-0.2.2 → stackos_connectors-0.2.3}/tests/packaging/test_grouped_layout.py

@@ -16,8 +16,8 @@ def test_auth_protocol_resources_have_integration_owners():
         for key, metadata in registry.connector_metadata.items()
         if "auth_protocol" in metadata
     }
-    assert len(protocols) == 16
-    assert "google-indexing" not in protocols
+    assert len(protocols) == 17
+    assert "google-indexing" in protocols
     for key, metadata in protocols.items():
         document = json.loads(
             root.joinpath("connectors", key.replace("-", "_"), "catalog.json").read_text()