vgi-python 0.22.0__tar.gz → 0.22.1__tar.gz

{vgi_python-0.22.0 → vgi_python-0.22.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vgi-python
-Version: 0.22.0
+Version: 0.22.1
 Summary: Vector Gateway Interface - Connect DuckDB to external programs via Apache Arrow
 Project-URL: Homepage, https://query.farm
 Project-URL: Repository, https://github.com/Query-farm/vgi-python
@@ -162,7 +162,7 @@ Requires-Dist: httpx>=0.24
 Requires-Dist: platformdirs
 Requires-Dist: pyarrow
 Requires-Dist: typer>=0.9
-Requires-Dist: vgi-rpc>=0.28.2
+Requires-Dist: vgi-rpc>=0.28.3
 Provides-Extra: azure
 Requires-Dist: azure-identity>=1.16.0; extra == 'azure'
 Requires-Dist: pymssql>=2.3.0; extra == 'azure'

{vgi_python-0.22.0 → vgi_python-0.22.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vgi-python"
-version = "0.22.0"
+version = "0.22.1"
 description = "Vector Gateway Interface - Connect DuckDB to external programs via Apache Arrow"
 readme = "README.md"
 keywords = [
@@ -40,7 +40,7 @@ dependencies = [
     "pyarrow",
     "typer>=0.9",
     "platformdirs",
-    "vgi-rpc>=0.28.2",
+    "vgi-rpc>=0.28.3",
     "httpx>=0.24",
 ]
 

{vgi_python-0.22.0 → vgi_python-0.22.1}/tests/test_serve.py

@@ -206,6 +206,57 @@ class TestCreateApp:
 
         assert isinstance(app, falcon.App)
 
+    @staticmethod
+    def _health_proof_header(**env: str) -> str | None:
+        """Serve an app under ``env`` and read the proof capability header.
+
+        Args:
+            **env: ``VGI_PROXY_PROOF_*`` values to set for the duration.
+
+        Returns:
+            The ``VGI-Proxy-Proof-Required`` value, or ``None`` when absent.
+
+        """
+        import falcon.testing
+
+        with pytest.MonkeyPatch.context() as mp:
+            for key in ("VGI_PROXY_PROOF_MODE", "VGI_PROXY_PROOF_ORIGIN_ID", "VGI_PROXY_PROOF_SECRETS"):
+                mp.delenv(key, raising=False)
+            for key, value in env.items():
+                mp.setenv(key, value)
+            app = create_app(_SingleWorker, prefix="/vgi", describe=False)
+            resp = falcon.testing.TestClient(app).simulate_get("/vgi/health")
+        assert resp.status_code == 200
+        return {k.lower(): v for k, v in resp.headers.items()}.get("vgi-proxy-proof-required")
+
+    def test_advertises_proof_required_in_require_mode(self) -> None:
+        """A ``require``-mode worker tells proxies it actually enforces.
+
+        Derived from ``VGI_PROXY_PROOF_MODE`` rather than passed separately,
+        because that env var is also where the gate itself comes from — so the
+        advertisement cannot drift from the posture it describes.
+        """
+        value = self._health_proof_header(
+            VGI_PROXY_PROOF_MODE="require",
+            VGI_PROXY_PROOF_ORIGIN_ID="worker-a",
+            VGI_PROXY_PROOF_SECRETS="k:" + "11" * 32,
+        )
+        assert value == "true"
+
+    @pytest.mark.parametrize("mode", ["off", "allow"])
+    def test_does_not_advertise_below_require(self, mode: str) -> None:
+        """Only ``require`` advertises — ``allow`` never denies, so it must not.
+
+        A proxy reads this to confirm a rollout landed; an ``allow``-mode worker
+        that claimed to require would report the rollout complete while every
+        unproofed direct caller still sailed through.
+        """
+        env = {"VGI_PROXY_PROOF_MODE": mode}
+        if mode != "off":
+            env["VGI_PROXY_PROOF_ORIGIN_ID"] = "worker-a"
+            env["VGI_PROXY_PROOF_SECRETS"] = "k:" + "11" * 32
+        assert self._health_proof_header(**env) is None
+
     def test_signing_key_passed(self) -> None:
         """Explicit signing_key is accepted without warning."""
         import warnings

{vgi_python-0.22.0 → vgi_python-0.22.1}/uv.lock

@@ -2228,7 +2228,7 @@ requires-dist = [
 
 [[package]]
 name = "vgi-python"
-version = "0.22.0"
+version = "0.22.1"
 source = { editable = "." }
 dependencies = [
     { name = "click" },
@@ -2338,7 +2338,7 @@ requires-dist = [
     { name = "vgi-python", extras = ["test-fixtures"], marker = "extra == 'test-fixtures-writable'" },
     { name = "vgi-python", extras = ["test-fixtures", "test-fixtures-writable", "http", "oauth", "otel", "sentry", "azure"], marker = "extra == 'dev'" },
     { name = "vgi-python", extras = ["transactor"], marker = "extra == 'test-fixtures-writable'" },
-    { name = "vgi-rpc", specifier = ">=0.28.2" },
+    { name = "vgi-rpc", specifier = ">=0.28.3" },
     { name = "vgi-rpc", extras = ["conformance", "external", "http", "oauth", "otel", "sentry"], marker = "extra == 'dev'" },
     { name = "vgi-rpc", extras = ["http"], marker = "extra == 'http'" },
     { name = "vgi-rpc", extras = ["oauth"], marker = "extra == 'oauth'" },
@@ -2367,7 +2367,7 @@ docs = [
 
 [[package]]
 name = "vgi-rpc"
-version = "0.28.2"
+version = "0.28.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "docstring-parser" },
@@ -2375,9 +2375,9 @@ dependencies = [
     { name = "pywin32", marker = "sys_platform == 'win32'" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/89/a0/00252e2d6986094c13bf35b7f7e1e95b0a3b0497c210b2c88cc72b82b3c7/vgi_rpc-0.28.2.tar.gz", hash = "sha256:4fcfcd5c42a0242aee9d1f40e16fab6559f6401feccf44fe50ad91ee473dc5f4", size = 905341, upload-time = "2026-07-27T13:56:23.482Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a0/5a/1996a64ca9ecb0a030cee5a4b9944301f20d6269369b39a5d30f07bf71a9/vgi_rpc-0.28.3.tar.gz", hash = "sha256:772f535912926ce47c17c3eba33769ad226171277159c591f441169f642e14d6", size = 908548, upload-time = "2026-07-27T16:45:47.344Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3c/1d/0a34b627d4f6d3bf83e61a5897fb32e5bf1543708380ee1a6eaeeb56a8d7/vgi_rpc-0.28.2-py3-none-any.whl", hash = "sha256:dc96d11b2ced0fa36e653ed475c653f4124748b2372da1866028da4975eb9b8f", size = 404897, upload-time = "2026-07-27T13:56:21.549Z" },
+    { url = "https://files.pythonhosted.org/packages/70/d1/db1b3aa48d1d0526bc30ad72e51ad8fd7f67f693310de8c143e707a87d0a/vgi_rpc-0.28.3-py3-none-any.whl", hash = "sha256:bf913b9b95ac4abde4e4ddad5b228c1d81bd748268773f9a2e5fa9626cc68bf7", size = 406388, upload-time = "2026-07-27T16:45:45.905Z" },
 ]
 
 [package.optional-dependencies]

{vgi_python-0.22.0 → vgi_python-0.22.1}/vgi/serve.py

@@ -202,6 +202,7 @@ def create_app(
     signing_key: bytes | None = None,
     log_level: int = logging.INFO,
     authenticate: Callable[[falcon.Request], AuthContext] | None = None,
+    proxy_proof_required: bool | None = None,
     oauth_resource_metadata: Any = None,
     otel_config: OtelConfig | None = None,
     max_stream_response_bytes: int | None = None,
@@ -224,6 +225,12 @@ def create_app(
         authenticate: Optional callback that validates each HTTP request
             and returns an `AuthContext`. When ``None``, all requests are
             anonymous.
+        proxy_proof_required: Whether to advertise ``VGI-Proxy-Proof-Required``
+            so a proxy can confirm this worker actually enforces the proof it
+            mints. ``None`` (the default) derives it from
+            ``VGI_PROXY_PROOF_MODE``, which is also where the gate itself comes
+            from — so the advertisement cannot drift from the posture. Pass a
+            bool only when supplying a hand-built gate via ``authenticate``.
         oauth_resource_metadata: Optional `OAuthResourceMetadata` for
             RFC 9728 discovery endpoint.
         otel_config: Optional OpenTelemetry configuration.  When provided,
@@ -259,6 +266,9 @@ def create_app(
     if signing_key is None:
         signing_key = os.urandom(32)
 
+    if proxy_proof_required is None:
+        proxy_proof_required = (os.environ.get("VGI_PROXY_PROOF_MODE") or "").strip().lower() == "require"
+
     worker = worker_cls(quiet=True, log_level=log_level)
     worker._vgi_tracer = VgiTracer.create(otel_config)
     worker._signing_key = signing_key
@@ -271,6 +281,7 @@ def create_app(
         cors_origins=cors_origins,
         token_key=signing_key,
         authenticate=authenticate,
+        proxy_proof_required=proxy_proof_required,
         oauth_resource_metadata=oauth_resource_metadata,
         otel_config=otel_config,
         max_stream_response_bytes=max_stream_response_bytes,