tinybird 4.5.11.dev0__tar.gz → 4.5.12.dev0__tar.gz

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: tinybird
-Version: 4.5.11.dev0
+Version: 4.5.12.dev0
 Summary: Tinybird Command Line Tool
 Home-page: https://www.tinybird.co/docs/forward/commands
 Author: Tinybird
@@ -52,10 +52,22 @@ The Tinybird command-line tool allows you to use all the Tinybird functionality
 Changelog
 ----------
 
-4.5.10
+4.5.12
 *******
 
+- `Fixed` `tb info` now lists branches and marks the current branch correctly when running on a branch.
+
+
+4.5.11
+*******
+
+- `Added` `tb connection create kafka` now supports SASL ``OAUTHBEARER`` for Amazon MSK clusters with IAM-based authentication. The wizard asks up-front whether the user already has an IAM role for the cluster — if yes, it collects region + role ARN + external ID directly; if no, it walks the user through creating the IAM access policy and trust policy in the AWS Console, copying them to the clipboard.
+- `Added` ``--oauthbearer-aws-external-id`` flag (and matching interactive prompt) so users can supply a pre-shared external ID instead of the one Tinybird auto-generates for the connection.
+- `Added` ``PLAINTEXT`` security protocol now skips the SASL mechanism prompt entirely.
+- `Added` ``.connection`` files generated by the wizard now emit ``KAFKA_SASL_OAUTHBEARER_METHOD``, ``KAFKA_SASL_OAUTHBEARER_AWS_REGION``, ``KAFKA_SASL_OAUTHBEARER_AWS_ROLE_ARN``, and ``KAFKA_SASL_OAUTHBEARER_AWS_EXTERNAL_ID``, with the role ARN stored as a ``tb_secret``.
+- `Fixed` ``tb connection create kafka`` now accepts comma-separated bootstrap-server lists (e.g. ``b-1.kafka:9092,b-2.kafka:9092``) instead of rejecting them as malformed. Validation passes as soon as any one broker is reachable, matching Kafka bootstrap semantics.
 - `Fixed` `tb init` now persists `folder` in `tinybird.config.json`, so subsequent resource creation targets the configured project folder instead of the repository root.
+- `Fixed` Branch names derived from Git refs are now sanitized in `tb preview --name` and `tb branch create/rm/clear`, preventing CI/CD failures with invalid workspace names.
 
 4.5.9
 *******

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/__cli__.py

@@ -4,5 +4,5 @@ __description__ = 'Tinybird Command Line Tool'
 __url__ = 'https://www.tinybird.co/docs/forward/commands'
 __author__ = 'Tinybird'
 __author_email__ = 'support@tinybird.co'
-__version__ = '4.5.11.dev0'
-__revision__ = 'e0b2a62'
+__version__ = '4.5.12.dev0'
+__revision__ = '6a70694'

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/client.py

@@ -1010,16 +1010,29 @@ class TinyB:
         kafka_sasl_mechanism="PLAIN",
         kafka_security_protocol="SASL_SSL",
         kafka_ssl_ca_pem=None,
+        kafka_sasl_oauthbearer_method=None,
+        kafka_sasl_oauthbearer_aws_region=None,
+        kafka_sasl_oauthbearer_aws_role_arn=None,
+        kafka_sasl_oauthbearer_aws_external_id=None,
     ):
+        is_oauthbearer = kafka_sasl_mechanism == "OAUTHBEARER"
         params = {
             "service": "kafka",
             "kafka_security_protocol": kafka_security_protocol,
             "kafka_sasl_mechanism": kafka_sasl_mechanism,
             "kafka_bootstrap_servers": kafka_bootstrap_servers,
-            "kafka_sasl_plain_username": kafka_key,
-            "kafka_sasl_plain_password": kafka_secret,
             "name": kafka_connection_name,
         }
+        if is_oauthbearer:
+            params["kafka_sasl_oauthbearer_method"] = kafka_sasl_oauthbearer_method
+            params["kafka_sasl_oauthbearer_aws_region"] = kafka_sasl_oauthbearer_aws_region
+            params["kafka_sasl_oauthbearer_aws_role_arn"] = kafka_sasl_oauthbearer_aws_role_arn
+            # external_id is optional; the server fills it in from the workspace if absent.
+            if kafka_sasl_oauthbearer_aws_external_id:
+                params["kafka_sasl_oauthbearer_aws_external_id"] = kafka_sasl_oauthbearer_aws_external_id
+        else:
+            params["kafka_sasl_plain_username"] = kafka_key
+            params["kafka_sasl_plain_password"] = kafka_secret
 
         if kafka_schema_registry_url:
             params["kafka_schema_registry_url"] = kafka_schema_registry_url
@@ -1185,7 +1198,8 @@ class TinyB:
     def get_access_read_policy(self, service: str, bucket: Optional[str] = None) -> Dict[str, Any]:
         params = {}
         if bucket:
-            params["bucket"] = bucket
+            # The Kafka endpoint scopes the policy via `msk_cluster_arn`, not `bucket`.
+            params["msk_cluster_arn" if service == "kafka" else "bucket"] = bucket
         return self._req(f"/v0/integrations/{service}/policies/read-access-policy?{urlencode(params)}")
 
     def sql_get_format(self, sql: str, with_clickhouse_format: bool = False) -> str:

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/modules/branch.py

@@ -7,7 +7,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 import click
 
-from tinybird.tb.modules.cli import cli
+from tinybird.tb.modules.cli import _looks_like_uuid, cli, ensure_valid_workspace_name
 from tinybird.tb.modules.common import (
     MAIN_BRANCH,
     create_workspace_branch,
@@ -93,7 +93,8 @@ def branch_ls(sort: bool) -> None:
     help="Wait for data branch jobs to finish, showing a progress bar. Disabled by default.",
 )
 def create_branch(branch_name: Optional[str], last_partition: bool, ignore_datasources: List[str], wait: bool) -> None:
-    create_workspace_branch(branch_name, last_partition, False, list(ignore_datasources), wait)
+    normalized_branch_name = ensure_valid_workspace_name(branch_name) if branch_name else branch_name
+    create_workspace_branch(normalized_branch_name, last_partition, False, list(ignore_datasources), wait)
 
 
 @branch.command(name="rm", short_help="Removes an branch from the workspace. It can't be recovered.")
@@ -194,11 +195,14 @@ def clear_branch(
     if branch_name_or_id:
         if branch_name_or_id == MAIN_BRANCH:
             raise CLIException(FeedbackManager.error_not_allowed_in_main_branch())
+        lookup_branch_name_or_id = (
+            branch_name_or_id if _looks_like_uuid(branch_name_or_id) else ensure_valid_workspace_name(branch_name_or_id)
+        )
         workspace_to_clear = next(
             (
                 workspace
                 for workspace in workspace_branches
-                if workspace["name"] == branch_name_or_id or workspace["id"] == branch_name_or_id
+                if workspace["name"] == lookup_branch_name_or_id or workspace["id"] == lookup_branch_name_or_id
             ),
             None,
         )
@@ -210,11 +214,16 @@ def clear_branch(
             raise CLIBranchException(FeedbackManager.error_not_a_branch(cli=get_cli_name()))
 
     if not workspace_to_clear:
-        raise CLIBranchException(FeedbackManager.error_branch(branch=branch_name_or_id or "", cli=get_cli_name()))
+        raise CLIBranchException(
+            FeedbackManager.error_branch(
+                branch=lookup_branch_name_or_id if branch_name_or_id else "",
+                cli=get_cli_name(),
+            )
+        )
 
     branch_name = workspace_to_clear["name"]
     if yes or click.confirm(FeedbackManager.warning_confirm_clear_workspace()):
-        was_current_branch = workspace_to_clear["id"] == config.get("id")
+        was_current_branch = workspace_to_clear["id"] == config["id"]
         client = config.get_client(token=current_main_workspace.get("token"))
         try:
             client.delete_branch(workspace_to_clear["id"])

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/modules/cli.py

@@ -68,6 +68,7 @@ PROJECT_TYPE_TYPESCRIPT = "ts-sdk"
 PROJECT_TYPE_PYTHON = "python-sdk"
 PROJECT_TYPE_CLI = "cli"
 PROJECT_TYPES = {PROJECT_TYPE_TYPESCRIPT, PROJECT_TYPE_PYTHON, PROJECT_TYPE_CLI}
+UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
 
 
 CLI_PROJECT_MARKERS = (
@@ -163,16 +164,44 @@ def is_main_git_branch(branch_name: Optional[str]) -> bool:
     return branch_name in {"main", "master"}
 
 
-def sanitize_branch_name(branch_name: str) -> str:
+def sanitize_branch_name(branch_name: str, *, enforce_workspace_prefix_rules: bool = True) -> str:
     sanitized = re.sub(r"[^a-zA-Z0-9_]", "_", branch_name)
     sanitized = re.sub(r"_+", "_", sanitized)
-    return sanitized.strip("_")
+    sanitized = sanitized.strip("_")
+    if enforce_workspace_prefix_rules:
+        if sanitized and sanitized[0].isdigit():
+            sanitized = f"branch_{sanitized}"
+        if sanitized.startswith("d_"):
+            sanitized = f"branch_{sanitized}"
+    return sanitized
+
+
+def _looks_like_uuid(value: str) -> bool:
+    return bool(UUID_PATTERN.fullmatch(value))
+
+
+def ensure_valid_workspace_name(name: str, *, context: str = "Branch") -> str:
+    sanitized = sanitize_branch_name(name)
+    if not sanitized:
+        raise CLIException(
+            FeedbackManager.error(
+                message=(
+                    f"{context} name '{name}' is not valid. "
+                    "Name must start with a letter and contain only letters, numbers, and underscores."
+                )
+            )
+        )
+
+    if sanitized != name:
+        click.echo(FeedbackManager.warning_branch_name_sanitized(context=context, original=name, sanitized=sanitized))
+
+    return sanitized
 
 
 def get_tinybird_branch_name_from_git_branch(branch_name: Optional[str]) -> Optional[str]:
     if not branch_name:
         return None
-    sanitized = sanitize_branch_name(branch_name)
+    sanitized = sanitize_branch_name(branch_name, enforce_workspace_prefix_rules=False)
     return sanitized or None
 
 

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/modules/common.py

@@ -1105,26 +1105,57 @@ def is_url_valid(url):
         return False
 
 
-def validate_kafka_bootstrap_servers(host_and_port):
-    if not isinstance(host_and_port, str):
-        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    parts = host_and_port.split(":")
+def _parse_kafka_host_port(entry: str) -> tuple[str, int]:
+    """Parse a single Kafka bootstrap entry of the form 'host' or 'host:port'.
+
+    Raises CLIException on malformed input. Defaults the port to 9092 when omitted.
+    """
+    parts = entry.split(":")
     if len(parts) > 2:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
     host = parts[0]
     port_str = parts[1] if len(parts) == 2 else "9092"
     try:
-        port = int(port_str)
+        return host, int(port_str)
     except Exception:
         raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
-    with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
-        try:
-            sock.settimeout(3)
-            sock.connect((host, port))
-        except TimeoutError:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port))
-        except Exception:
-            raise CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+
+def validate_kafka_bootstrap_servers(host_and_port):
+    """Validate a Kafka bootstrap-servers string (single entry or comma-separated list).
+
+    Format is checked for every entry. Connectivity is then probed per entry — Kafka
+    only needs one reachable bootstrap broker to discover the rest of the cluster,
+    so the validator passes as long as at least one host accepts a TCP connection.
+    The last connection error is re-raised when every host is unreachable.
+    """
+    if not isinstance(host_and_port, str):
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    entries = [e.strip() for e in host_and_port.split(",") if e.strip()]
+    if not entries:
+        raise CLIException(FeedbackManager.error_kafka_bootstrap_server())
+
+    # Format-check every entry up front so the user hears about all bad ones at
+    # once rather than discovering them sequentially.
+    hosts = [_parse_kafka_host_port(e) for e in entries]
+
+    last_error: Optional[CLIException] = None
+    for host, port in hosts:
+        with closing(socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
+            try:
+                sock.settimeout(3)
+                sock.connect((host, port))
+                return  # at least one reachable broker is enough
+            except TimeoutError:
+                last_error = CLIException(
+                    FeedbackManager.error_kafka_bootstrap_server_conn_timeout(host=host, port=port)
+                )
+            except Exception:
+                last_error = CLIException(FeedbackManager.error_kafka_bootstrap_server_conn(host=host, port=port))
+
+    if last_error is not None:
+        raise last_error
 
 
 def validate_kafka_key(s):
@@ -1137,9 +1168,11 @@ def validate_kafka_secret(s):
         raise CLIException("Password format is not correct, it must be a string")
 
 
-def validate_string_connector_param(param, s):
+def validate_string_connector_param(param: str, s: str) -> None:
     if not isinstance(s, str):
         raise CLIConnectionException(param + " format is not correct, it must be a string")
+    if not s or not s.strip():
+        raise CLIConnectionException(param + " cannot be empty")
 
 
 def validate_connection_name(client, connection_name, service):

{tinybird-4.5.11.dev0 → tinybird-4.5.12.dev0}/tinybird/tb/modules/connection.py

@@ -40,6 +40,18 @@ from tinybird.tb.modules.feedback_manager import FeedbackManager, get_cli_name
 from tinybird.tb.modules.project import Project
 from tinybird.tb.modules.secret import save_secret_to_env_file
 
+
+def _upper_or_none(_ctx: click.Context, _param: click.Parameter, value: Optional[str]) -> Optional[str]:
+    """Click callback that uppercases the option value if present.
+
+    Kafka SASL mechanisms and security protocols are matched case-sensitively
+    downstream (CLI, client, server), so we normalize at the flag layer to
+    accept user input like `--sasl-mechanism oauthbearer` without silently
+    falling through the case-sensitive branches and breaking the request.
+    """
+    return value.upper() if value else value
+
+
 DATA_CONNECTOR_SETTINGS: Dict[DataConnectorType, List[str]] = {
     DataConnectorType.KAFKA: [
         "kafka_bootstrap_servers",
@@ -247,15 +259,22 @@ def connection_create_gcs(ctx: Context) -> None:
 @click.option("--schema-registry-url", default=None, help="Avro Confluent Schema Registry URL")
 @click.option(
     "--sasl-mechanism",
-    default="PLAIN",
+    default=None,
+    callback=_upper_or_none,
     help="Authentication method for connection-based protocols. Defaults to 'PLAIN'",
 )
 @click.option(
     "--security-protocol",
-    default="SASL_SSL",
+    default=None,
+    callback=_upper_or_none,
     help="Security protocol for connection-based protocols. Defaults to 'SASL_SSL'",
 )
 @click.option("--ssl-ca-pem", default=None, help="Path or content of the CA Certificate file in PEM format")
+@click.option(
+    "--oauthbearer-aws-external-id",
+    default=None,
+    help="Pre-shared external_id for the AWS assume-role call (OAUTHBEARER+AWS only). If omitted, the wizard prompts for one and falls back to a Tinybird-generated value.",
+)
 @click.pass_context
 def connection_create_kafka_cmd(
     ctx: Context,
@@ -268,6 +287,7 @@ def connection_create_kafka_cmd(
     sasl_mechanism: Optional[str],
     security_protocol: Optional[str],
     ssl_ca_pem: Optional[str],
+    oauthbearer_aws_external_id: Optional[str],
 ) -> None:
     env: str = ctx.ensure_object(dict)["env"]
     project: Project = ctx.ensure_object(dict)["project"]
@@ -295,6 +315,7 @@ def connection_create_kafka_cmd(
         sasl_mechanism=sasl_mechanism,
         security_protocol=security_protocol,
         ssl_ca_pem=ssl_ca_pem,
+        oauthbearer_aws_external_id=oauthbearer_aws_external_id,
     )
 
     if not result["error"]: