sweatstack 0.91.0__tar.gz → 0.92.0__tar.gz

{sweatstack-0.91.0 → sweatstack-0.92.0}/CHANGELOG.md

@@ -6,6 +6,32 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [0.92.0] - 2026-10-08
+
+Portal links are created with the user's token, when the user acts. Requires the SweatStack API
+release that replaces `action_url` with `destination` (see the platform changelog).
+
+### Changed
+
+- **BREAKING: `issue.action_url` is replaced by `issue.destination`** on `oauth.userinfo()` and
+  `profile.status()`. Show a button only when `destination` is set, and on click pass it to
+  `portal.sessions.create()` for the URL. A destination the client does not know yet parses
+  instead of failing.
+- **BREAKING: `portal.sessions.create()` authenticates with the client's user token**, not the
+  app's `client_id` and `client_secret`. Call it on a client that holds the user's access token;
+  the Portal is branded for the app that token was issued to. A delegated token raises
+  `SweatStackAuthError`.
+- Without `return_url` the Portal no longer links back to your app's URL: it tells the user to
+  close the page. `return_url` must equal or sit under one of your app's registered redirect
+  URIs.
+
+### Upgrading
+
+| Before | After |
+|---|---|
+| `user.issue.action_url` | `client.portal.sessions.create(user.issue.destination, return_url=...).url` |
+| `Client(client_id=..., client_secret=...).portal.sessions.create(...)` | the same call on the client holding the user's token |
+
 ## [0.91.0] - 2026-10-08
 
 One namespace per API resource: `client.activities.list()` instead of `client.get_activities()`.

{sweatstack-0.91.0 → sweatstack-0.92.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sweatstack
-Version: 0.91.0
+Version: 0.92.0
 Summary: The official Python client for SweatStack
 Project-URL: Homepage, https://sweatstack.no
 Project-URL: Documentation, https://docs.sweatstack.no/learn/python/

{sweatstack-0.91.0 → sweatstack-0.92.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sweatstack"
-version = "0.91.0"
+version = "0.92.0"
 description = "The official Python client for SweatStack"
 readme = "README.md"
 license = "MIT"

{sweatstack-0.91.0 → sweatstack-0.92.0}/skills/sweatstack-python/api.md

@@ -103,7 +103,7 @@ client.whoami()                                               # the user this cl
 ## portal and oauth
 
 ```python
-client.portal.sessions.create("manage-integrations", return_url=None)  # app credentials, no user token
+client.portal.sessions.create("manage-integrations", return_url=None)  # user token; mint on click, never store
 
 client.oauth.userinfo()                 # OpenID claims + issue (needs the profile scope)
 verifier, challenge = client.oauth.generate_pkce_params()

{sweatstack-0.91.0 → sweatstack-0.92.0}/skills/sweatstack-python/data-models.md

@@ -59,7 +59,8 @@ taxonomy is preserved (`is_standard` is `False`) instead of failing.
   `email`, `registered_at`, `issue`.
 - **AccountStatusResponse** (`profile.status()`, beta): `issue` (`StatusIssueResponse | None`:
   `code` (open set), `status` (`CapabilityStatus`: `ready`, `syncing`, `action_required`,
-  `unavailable`), `message` (display only), `action_url`) and `capabilities`
-  (`dict[Capability, CapabilityStatus]`). Branch on `status`, show `message`, show a button
-  only when `action_url` is set.
+  `unavailable`), `message` (display only), `destination` (`PortalDestination | None`)) and
+  `capabilities` (`dict[Capability, CapabilityStatus]`). Branch on `status`, show `message`,
+  show a button only when `destination` is set, and on click pass it to
+  `portal.sessions.create()`.
 - **PortalSessionResponse**: `url` (opaque; never build one by hand).

{sweatstack-0.91.0 → sweatstack-0.92.0}/skills/sweatstack-python/streamlit.md

@@ -121,9 +121,13 @@ activities = auth.client.activities.list()
 user = auth.client.oauth.userinfo()
 if user.issue:
     st.warning(user.issue.message)
-    if user.issue.action_url:
-        st.link_button("Fix it", user.issue.action_url)
+    if user.issue.destination:
+        # Minted fresh on each run and never stored. return_url must equal or sit under one of
+        # your app's registered redirect URIs.
+        session = auth.client.portal.sessions.create(
+            user.issue.destination, return_url="https://your-app.streamlit.app"
+        )
+        st.link_button("Fix it", session.url)
 ```
 
-`auth.client` carries the app credentials, so `auth.client.portal.sessions.create("manage-integrations",
-return_url=...)` works too. See [api.md](api.md#portal-and-oauth) and [data-models.md](data-models.md).
+See [api.md](api.md#portal-and-oauth) and [data-models.md](data-models.md).

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/client.py

@@ -860,9 +860,8 @@ class Client:
             skip_token_check: Use the raw token without the expiry check (used during
                 refresh, to avoid recursion).
             auth: If False, send no Authorization header and never load or refresh a token.
-                For endpoints that authenticate with the app's own credentials in the body
-                (Portal sessions, the token exchange), so a user's bearer is never sent where
-                it is not needed.
+                For the token exchange, which authenticates with the app's own credentials in
+                the body, so a user's bearer is never sent where it is not needed.
         """
         headers = httpx.Headers({"User-Agent": f"python-sweatstack/{__version__}"})
         if not auth:

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/openapi_schemas.py

@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  openapi.json
-#   timestamp: 2026-10-05T10:01:09+00:00
+#   timestamp: 2026-10-08T18:52:13+00:00
 
 from __future__ import annotations
 from open_sport_taxonomy.pydantic import SportField  # OST sport type (see schemas.py)
@@ -199,6 +199,12 @@ class BodySaveOrUpdateIntegrationProviderTenantsTenantIdIntegrationProvidersInte
     webhook_secret: SecretStr | None = Field(None, title='Webhook Secret')
 
 
+class BodyStartReprocessInPlaceAdminOperationsReprocessInPlacePost(BaseModel):
+    user_ids: str | None = Field('', title='User Ids')
+    runners: int | None = Field(1, title='Runners')
+    batch_size: int | None = Field(0, title='Batch Size')
+
+
 class BodyUpdateManagedUserApiV1UsersUserIdPut(BaseModel):
     first_name: str | None = Field(None, title='First Name')
     last_name: str | None = Field(None, title='Last Name')
@@ -522,10 +528,8 @@ class PortalDestination(Enum):
 
 
 class PortalSessionRequest(BaseModel):
-    client_id: str = Field(..., title='Client Id')
-    client_secret: SecretStr | None = Field(None, title='Client Secret')
     destination: PortalDestination
-    return_url: str | None = Field(None, title='Return Url')
+    return_url: constr(max_length=2048) | None = Field(None, title='Return Url')
 
 
 class PortalSessionResponse(BaseModel):
@@ -628,7 +632,7 @@ class StatusIssueResponse(BaseModel):
     code: StatusIssueCode
     status: CapabilityStatus
     message: str = Field(..., title='Message')
-    action_url: str | None = Field(None, title='Action Url')
+    destination: PortalDestination | None = None
 
 
 class TTERef(BaseModel):

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/resources/oauth.py

@@ -145,9 +145,10 @@ class OAuth(Resource):
         Requires the ``profile`` scope. Besides ``sub``, ``name``, ``given_name``,
         ``family_name``, ``email`` and ``registered_at``, the response has ``issue`` (beta):
         ``None`` when there is nothing to say, otherwise the one thing to tell the user now.
-        ``issue.action_url`` opens the Portal; it is ``None`` on delegated tokens and on
-        ``syncing`` or ``unavailable`` issues, so show a button only when it is set. Without
-        the ``profile`` scope, ``client.profile.status()`` gives the same ``issue``.
+        ``issue.destination`` says the user can fix it in the Portal: pass it to
+        ``client.portal.sessions.create()`` when they click. It is ``None`` on delegated tokens
+        and on ``syncing`` or ``unavailable`` issues, so show a button only when it is set.
+        Without the ``profile`` scope, ``client.profile.status()`` gives the same ``issue``.
 
         Returns:
             UserInfoResponse: The claims and the optional ``issue``.

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/resources/portal.py

@@ -30,58 +30,55 @@ class PortalSessions(Resource):
         *,
         return_url: str | None = None,
     ) -> PortalSessionResponse:
-        """Creates a Portal link for this app's users.
+        """Creates a Portal link for the user this client acts for.
 
         Endpoint: ``POST /api/v1/portal/sessions``
 
         **Beta**: the server documents the Portal as beta.
 
-        Most apps don't need this: ``issue.action_url`` from ``client.oauth.userinfo()`` or
-        ``client.profile.status()`` is already such a link. Create one to choose the
-        destination or the return link.
+        The only way to get a Portal URL. Call it when the user acts, typically with
+        ``issue.destination`` from ``client.oauth.userinfo()`` or ``client.profile.status()``,
+        and send the user straight there: don't store or reuse the URL.
 
-        This is a server-to-server call. It authenticates with the client's own app
-        credentials (``client_id``, and ``client_secret`` if the app has one) in the request
-        body, never with a user token; the user is identified when they open the link. A
-        client on the default ``client_id`` creates a Portal branded as the SweatStack Python
-        client. The URL is opaque: never build one by hand.
+        Needs a client holding the user's own access token (the one from your OAuth flow).
+        The Portal is branded for the app that token was issued to. The URL is opaque: never
+        build one by hand.
 
         Args:
             destination: ``"manage-integrations"`` or ``"manage-teams"``. A string the client
                 does not know is sent as is, so a newer destination works before the SDK
                 learns it.
-            return_url: Where "Back to {app}" points; must be one of the app's registered
-                redirect URIs. Omit it to have the Portal tell the user to close the page,
-                which suits native apps.
+            return_url: Where "Back to {app}" points. It follows the same rule as an OAuth
+                redirect URI: it must equal or sit under one of the app's registered redirect
+                URIs. Omit it to have the Portal tell the user to close the page, which suits
+                native apps and installed PWAs.
 
         Returns:
             PortalSessionResponse: ``url``, to send the user to.
 
         Raises:
-            SweatStackAuthError: If the app credentials are invalid (401).
-            SweatStackBadRequestError: If ``return_url`` is not registered for the app, or
-                ``client_id`` is not an application (400).
+            SweatStackAuthError: If the client has no access token (401), or the token is
+                delegated (403): a link minted for a coach would open the coach's own account.
+            SweatStackBadRequestError: If ``return_url`` does not belong to the app, or the
+                token was not issued to an app (400).
             SweatStackAPIError: If the API request fails for any other reason.
 
         Examples:
             ```python
             from sweatstack import Client
 
-            app = Client(client_id="YOUR_CLIENT_ID", client_secret="YOUR_CLIENT_SECRET")
-            session = app.portal.sessions.create(
-                "manage-integrations", return_url="https://example.com/app/"
-            )
-            print(session.url)
+            client = Client()  # holds the user's access token
+            user = client.oauth.userinfo()
+            if user.issue and user.issue.destination:
+                session = client.portal.sessions.create(
+                    user.issue.destination, return_url="https://example.com/app/settings"
+                )
+                print(session.url)
             ```
         """
         client = self._client
-        body: dict[str, Any] = {
-            "client_id": client.client_id,
-            "destination": client._enums_to_strings([destination])[0],
-        }
-        if client.client_secret is not None:
-            body["client_secret"] = client.client_secret.get_secret_value()
+        body: dict[str, Any] = {"destination": client._enums_to_strings([destination])[0]}
         if return_url is not None:
             body["return_url"] = return_url
-        response = client._request("post", "/api/v1/portal/sessions", json=body, auth=False)
+        response = client._request("post", "/api/v1/portal/sessions", json=body)
         return PortalSessionResponse.model_validate(response.json())

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/resources/profile.py

@@ -25,17 +25,18 @@ class Profile(Resource):
         **Beta**: the server documents this endpoint as beta.
 
         ``issue`` is ``None`` when there is nothing to tell the user, otherwise
-        ``{code, status, message, action_url}``. Branch on ``issue.status``
+        ``{code, status, message, destination}``. Branch on ``issue.status``
         (:class:`CapabilityStatus`: ``ready``, ``syncing``, ``action_required``,
         ``unavailable``), show ``issue.message``, and show a button only when
-        ``issue.action_url`` is set. Don't parse ``message`` or branch on ``code``.
+        ``issue.destination`` is set: on click, pass it to ``client.portal.sessions.create()``.
+        Don't parse ``message`` or branch on ``code``.
 
         ``capabilities`` maps each :class:`Capability` (``activities``, ``activity_history``,
         ``dailies``, ``workouts``) to a :class:`CapabilityStatus`. Codes and capability keys are
         open sets: a value the client doesn't know parses as a pseudo-member; ignore it.
 
         Accepts a token with ``data:read`` or ``profile``. Delegated tokens are allowed and
-        always get ``action_url=None``.
+        always get ``destination=None``.
 
         Returns:
             AccountStatusResponse: ``issue`` and ``capabilities``.
@@ -51,7 +52,7 @@ class Profile(Resource):
             client = Client()
             status = client.profile.status()
             if status.issue:
-                print(status.issue.message, status.issue.action_url)
+                print(status.issue.message, status.issue.destination)
             ```
         """
         response = self._client._request("get", "/api/v1/profile/status")

{sweatstack-0.91.0 → sweatstack-0.92.0}/src/sweatstack/schemas.py

@@ -56,12 +56,12 @@ def _open_enum(enum_cls: type[Enum]) -> None:
     """Let ``enum_cls`` accept values the bundled schema does not know yet.
 
     The server treats some enums as open sets (new metrics, scopes, daily measures, status
-    codes and capabilities appear without notice). An unknown value becomes a pseudo-member
-    with ``.value`` and ``.name`` set to the string, cached so repeated lookups return the
-    same object, instead of a validation error that would break the client until it is
-    updated. Closed enums (``CapabilityStatus``, ``PortalDestination``, ...) are left strict
-    on purpose: the server promises those never grow, or a value the client does not know
-    is not something it should act on.
+    codes, capabilities and Portal destinations appear without notice). An unknown value
+    becomes a pseudo-member with ``.value`` and ``.name`` set to the string, cached so repeated
+    lookups return the same object, instead of a validation error that would break the client
+    until it is updated. Closed enums (``CapabilityStatus``, ...) are left strict on purpose:
+    the server promises those never grow, or a value the client does not know is not something
+    it should act on.
     """
 
     @classmethod
@@ -75,7 +75,7 @@ def _open_enum(enum_cls: type[Enum]) -> None:
     enum_cls._missing_ = _missing_  # ty: ignore[invalid-assignment]  # patched onto a generated enum
 
 
-for _open in (Metric, Scope, DailyMeasure, StatusIssueCode, Capability):
+for _open in (Metric, Scope, DailyMeasure, StatusIssueCode, Capability, PortalDestination):
     _open_enum(_open)
 
 

{sweatstack-0.91.0 → sweatstack-0.92.0}/tests/test_account_status.py

@@ -16,6 +16,7 @@ from sweatstack import (
     AccountStatusResponse,
     Capability,
     CapabilityStatus,
+    PortalDestination,
     StatusIssueCode,
     StatusIssueResponse,
     UserInfoResponse,
@@ -30,7 +31,7 @@ DOCS_PAYLOADS = {
             "code": "no_source_connected",
             "status": "action_required",
             "message": "No data source is connected yet.",
-            "action_url": "https://app.sweatstack.no/portal/integrations?app=x",
+            "destination": "manage-integrations",
         }
     },
     "still_syncing": {
@@ -38,7 +39,7 @@ DOCS_PAYLOADS = {
             "code": "sync_pending",
             "status": "syncing",
             "message": "Garmin Connect data is still arriving.",
-            "action_url": None,
+            "destination": None,
         }
     },
     "history_not_shared": {
@@ -46,7 +47,7 @@ DOCS_PAYLOADS = {
             "code": "activity_history_not_granted",
             "status": "action_required",
             "message": "Garmin Connect isn't sharing past activities.",
-            "action_url": "https://app.sweatstack.no/portal/integrations?app=x",
+            "destination": "manage-integrations",
         }
     },
     "permanently_limited": {
@@ -54,7 +55,7 @@ DOCS_PAYLOADS = {
             "code": "dailies_unavailable",
             "status": "unavailable",
             "message": "No connected source provides daily health data.",
-            "action_url": None,
+            "destination": None,
         }
     },
     "all_good": {"issue": None},
@@ -110,7 +111,8 @@ class TestDocumentedPayloads:
             assert user.issue.status == CapabilityStatus(payload["issue"]["status"])
             assert user.issue.code == StatusIssueCode(payload["issue"]["code"])
             assert user.issue.message == payload["issue"]["message"]
-            assert user.issue.action_url == payload["issue"]["action_url"]
+            expected = payload["issue"]["destination"]
+            assert user.issue.destination == (expected and PortalDestination(expected))
 
     @pytest.mark.parametrize("payload", DOCS_PAYLOADS.values(), ids=DOCS_PAYLOADS.keys())
     def test_profile_status_round_trip(self, payload):
@@ -124,21 +126,22 @@ class TestDocumentedPayloads:
         user = UserInfoResponse.model_validate({**USERINFO, **DOCS_PAYLOADS["history_not_shared"]})
         shown = []
         if user.issue:
-            shown.append((user.issue.message, user.issue.action_url))
+            shown.append((user.issue.message, user.issue.destination))
         assert shown == [
             (
                 "Garmin Connect isn't sharing past activities.",
-                "https://app.sweatstack.no/portal/integrations?app=x",
+                PortalDestination.manage_integrations,
             )
         ]
 
-    def test_action_url_absent_means_no_button(self):
+    def test_destination_absent_means_no_button(self):
         user = UserInfoResponse.model_validate({**USERINFO, **DOCS_PAYLOADS["still_syncing"]})
-        assert user.issue is not None and user.issue.action_url is None
+        assert user.issue is not None and user.issue.destination is None
 
 
 class TestOpenSets:
-    """Codes and capability keys are open sets by contract; the status set is closed."""
+    """Codes, capability keys and destinations are open sets by contract; the status set is
+    closed."""
 
     def test_unknown_code_parses_as_pseudo_member(self):
         issue = StatusIssueResponse.model_validate(
@@ -148,6 +151,13 @@ class TestOpenSets:
         assert StatusIssueCode("something_new") is issue.code  # cached
         assert StatusIssueResponse.model_validate(issue.model_dump()).code == issue.code
 
+    def test_unknown_destination_parses_as_pseudo_member(self):
+        """A destination added on the server must not break `userinfo()` on an older client."""
+        issue = StatusIssueResponse.model_validate(
+            {"code": "x", "status": "action_required", "message": "x", "destination": "manage-new"}
+        )
+        assert issue.destination.value == "manage-new"
+
     def test_unknown_capability_key_parses_and_known_keys_still_resolve(self):
         status = AccountStatusResponse.model_validate(
             {"issue": None, "capabilities": {**CAPABILITIES, "dailies_history": "syncing"}}

{sweatstack-0.91.0 → sweatstack-0.92.0}/tests/test_identity.py

@@ -8,7 +8,7 @@ import httpx
 import pytest
 from pydantic import SecretStr
 
-from sweatstack import UserInfoResponse, UserSummary
+from sweatstack import PortalDestination, UserInfoResponse, UserSummary
 from sweatstack.client import Client
 
 
@@ -73,7 +73,7 @@ class TestUserinfo:
                 "code": "no_source_connected",
                 "status": "action_required",
                 "message": "No data source is connected yet.",
-                "action_url": "https://app.sweatstack.no/portal/x",
+                "destination": "manage-integrations",
             },
         }
         http = MagicMock()
@@ -83,4 +83,5 @@ class TestUserinfo:
         with patch.object(client, "_http_client", return_value=http):
             user = client.oauth.userinfo()
         assert isinstance(user, UserInfoResponse)
-        assert user.issue is not None and user.issue.action_url.endswith("/portal/x")
+        assert user.issue is not None
+        assert user.issue.destination == PortalDestination.manage_integrations

{sweatstack-0.91.0 → sweatstack-0.92.0}/tests/test_portal.py

@@ -1,10 +1,9 @@
-"""Portal sessions: ``POST /api/v1/portal/sessions`` with the app's own credentials."""
+"""Portal sessions: ``POST /api/v1/portal/sessions`` with the user's access token."""
 
-from unittest.mock import MagicMock, PropertyMock, patch
+from unittest.mock import MagicMock, patch
 
 import httpx
 import pytest
-from pydantic import SecretStr
 
 from sweatstack import PortalDestination, PortalSessionResponse
 from sweatstack.client import Client
@@ -44,18 +43,17 @@ def _mint(app, **kwargs):
 
 
 class TestRequestBody:
-    def test_public_client_sends_id_and_destination_only(self, app):
+    def test_sends_the_destination_and_nothing_about_the_app(self, app):
+        """The app is the token's audience, so the body names no client and carries no secret."""
         session, call, _ = _mint(app, destination="manage-integrations")
         assert call["url"] == "/api/v1/portal/sessions"
-        assert call["json"] == {"client_id": "app_123", "destination": "manage-integrations"}
+        assert call["json"] == {"destination": "manage-integrations"}
         assert isinstance(session, PortalSessionResponse)
         assert session.url.startswith("https://app.sweatstack.no/portal/")
 
-    def test_confidential_client_sends_its_secret(self, app):
-        app._client_secret = SecretStr("s3cret")
+    def test_accepts_the_enum(self, app):
         _, call, _ = _mint(app, destination=PortalDestination.manage_teams)
-        assert call["json"]["client_secret"] == "s3cret"
-        assert call["json"]["destination"] == "manage-teams"
+        assert call["json"] == {"destination": "manage-teams"}
 
     def test_return_url_is_forwarded_only_when_given(self, app):
         _, call, _ = _mint(
@@ -70,36 +68,29 @@ class TestRequestBody:
         assert call["json"]["destination"] == "manage-something-new"
 
 
-class TestNoUserToken:
-    def test_minting_uses_the_unauthenticated_http_client(self, app):
+class TestUserToken:
+    def test_minting_sends_the_users_bearer(self, app):
         _, _, http_client_kwargs = _mint(app, destination="manage-integrations")
-        assert http_client_kwargs == {"auth": False}
-
-    def test_auth_false_sends_no_authorization_header_and_never_loads_a_token(self, app):
-        app._api_key = SecretStr("user-bearer")
-        with patch.object(Client, "api_key", new_callable=PropertyMock) as api_key:
-            api_key.side_effect = AssertionError("token load/refresh must not run for auth=False")
-            with app._http_client(auth=False) as http:
-                assert "authorization" not in {k.lower() for k in http.headers}
-                assert http.headers["user-agent"].startswith("python-sweatstack/")
-
-    def test_auth_true_still_sends_the_bearer(self, app):
-        app._api_key = SecretStr("user-bearer")
-        with app._http_client(skip_token_check=True) as http:
-            assert http.headers["authorization"] == "Bearer user-bearer"
+        assert http_client_kwargs == {"auth": True}
 
 
 class TestErrors:
-    def test_bad_credentials(self, app):
-        http = _http_returning(401, {"detail": "Invalid client credentials"})
+    def test_no_token_or_a_delegated_one(self, app):
+        http = _http_returning(403, {"detail": "Delegated token not allowed."})
         with (
             patch.object(app, "_http_client", return_value=http),
             pytest.raises(SweatStackAuthError),
         ):
             app.portal.sessions.create("manage-integrations")
 
-    def test_unregistered_return_url(self, app):
-        http = _http_returning(400, {"detail": "return_url is not registered for this application"})
+    def test_return_url_outside_the_redirect_uris(self, app):
+        http = _http_returning(
+            400,
+            {
+                "detail": "return_url must equal or sit under one of the application's "
+                "registered redirect URIs"
+            },
+        )
         with (
             patch.object(app, "_http_client", return_value=http),
             pytest.raises(SweatStackBadRequestError),

{sweatstack-0.91.0 → sweatstack-0.92.0}/tests/test_transport.py

@@ -9,7 +9,7 @@ import base64
 import json
 import threading
 import time
-from unittest.mock import patch
+from unittest.mock import PropertyMock, patch
 
 import httpx
 import pytest
@@ -152,11 +152,20 @@ class TestConnections:
     def test_authorization_is_per_request(self):
         client, seen = _client(_statuses(200))
         client._request("get", "/api/v1/traces/")
-        client._request("post", "/api/v1/portal/sessions", json={}, auth=False)
+        client._request("post", "/api/v1/oauth/token", data={}, auth=False)
         assert seen[0].headers["authorization"] == "Bearer user-token"
         assert "authorization" not in seen[1].headers
         assert all(r.headers["user-agent"].startswith("python-sweatstack/") for r in seen)
 
+    def test_auth_false_sends_no_authorization_header_and_never_loads_a_token(self):
+        """The token exchange runs before there is a token to load or refresh."""
+        client = Client(api_key="user-bearer", url=URL)
+        with patch.object(Client, "api_key", new_callable=PropertyMock) as api_key:
+            api_key.side_effect = AssertionError("token load/refresh must not run for auth=False")
+            with client._http_client(auth=False) as http:
+                assert "authorization" not in {k.lower() for k in http.headers}
+                assert http.headers["user-agent"].startswith("python-sweatstack/")
+
     def test_close_releases_the_pool_and_the_next_call_opens_one(self):
         client = Client(api_key="x", url=URL)
         pool = client._pool()

{sweatstack-0.91.0 → sweatstack-0.92.0}/uv.lock

@@ -2748,7 +2748,7 @@ wheels = [
 
 [[package]]
 name = "sweatstack"
-version = "0.91.0"
+version = "0.92.0"
 source = { editable = "." }
 dependencies = [
     { name = "email-validator" },