visionai-sdk-python 2.1.0__py3-none-any.whl → 2.1.1__py3-none-any.whl

visionai_sdk_python/_base.py

@@ -38,7 +38,7 @@ class _BaseClient:
             vlm_url: Base URL for the VLM inference service.
             allowed_issuers: Optional list of allowed JWT issuers. If provided, tokens
                 whose ``iss`` claim is not in this list will be rejected. If omitted,
-                issuer validation is skipped.
+                the issuers are derived from ``auth_url``.
             verify_ssl: Whether to verify TLS certificates.
             timeout: Default request timeout in seconds.
             max_connections: Maximum number of concurrent connections in the pool.

visionai_sdk_python/constants.py

@@ -1,49 +1,36 @@
-# Maps known VisionAI server base URLs to their trusted JWT issuers.
-# Keys are normalized (no trailing slash).
-# Values are exact issuer strings as they appear in the JWT `iss` claim.
+# Resolves the trusted JWT issuers for a VisionAI server base URL.
 #
-# Long-term: replace this static table with dynamic discovery from the server's
+# Every deployment hosts its own Keycloak behind the site's public base URL, so
+# the realm issuer is derived from `auth_url` rather than kept in a table. Only
+# sites that additionally accept tokens from an external IdP need an entry here.
+#
+# Long-term: replace this with dynamic discovery from the server's
 # trusted-issuers endpoint (e.g. GET {auth_url}/api/v1/auth/trusted-issuers).
 
 _KEYCLOAK_REALM_PATH = "/keycloak/realms/linker-platform"
 
-# On-premise deployments backed by Keycloak (realm: linker-platform).
-# Issuer = base_url + _KEYCLOAK_REALM_PATH for all entries.
-_KEYCLOAK_BASE_URLS: list[str] = [
-    "https://offline.visionai.linkervision.com",
-    "https://lighthouse.visionai.linkervision.ai",
-    "https://lighthouse-production.visionai.linkervision.ai",
-]
-
-# Cloud deployments backed by Auth0 (one tenant per environment).
-_AUTH0_URL_TO_ISSUERS: dict[str, list[str]] = {
+# Sites whose tokens may still come from an external IdP, in addition to their
+# own Keycloak realm. Production has not cut over yet; listing both issuers lets
+# an installed SDK keep working across the migration without an upgrade.
+#
+# Drop the entry once production is confirmed migrated — a retired Auth0 tenant
+# name can be re-registered by someone else, so it should not stay trusted
+# indefinitely.
+_EXTERNAL_IDP_ISSUERS: dict[str, list[str]] = {
     "https://visionai.linkervision.com": [
         "https://data-engine-prod.us.auth0.com",
     ],
-    "https://staging.visionai.linkervision.com": [
-        "https://data-engine-staging.jp.auth0.com",
-    ],
-    "https://dev2.visionai.linkervision.com": [
-        "https://data-engine-dev2.jp.auth0.com",
-    ],
-    "https://dev.visionai.linkervision.com": [
-        "https://dev-045acunea5v1mm3l.us.auth0.com",
-    ],
-}
-
-_AUTH_URL_TO_ISSUERS: dict[str, list[str]] = {
-    **{url: [f"{url}{_KEYCLOAK_REALM_PATH}"] for url in _KEYCLOAK_BASE_URLS},
-    **_AUTH0_URL_TO_ISSUERS,
 }
 
 
 def resolve_allowed_issuers(auth_url: str) -> list[str]:
     """Return the trusted issuers for the given auth_url.
 
-    If the URL is in the known table, return its configured issuers.
-    Otherwise, assume a Keycloak deployment and derive the issuer from auth_url.
+    Always includes the site's own Keycloak realm issuer, plus any external IdP
+    issuer the site still accepts.
     """
     normalized = auth_url.rstrip("/")
-    if known := _AUTH_URL_TO_ISSUERS.get(normalized):
-        return known
-    return [f"{normalized}{_KEYCLOAK_REALM_PATH}"]
+    return [
+        f"{normalized}{_KEYCLOAK_REALM_PATH}",
+        *_EXTERNAL_IDP_ISSUERS.get(normalized, []),
+    ]

{visionai_sdk_python-2.1.0.dist-info → visionai_sdk_python-2.1.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: visionai-sdk-python
-Version: 2.1.0
+Version: 2.1.1
 Summary: VisionAI SDK for Python
 Author-email: Tony Yang <tonyyang@linkervision.com>
 Requires-Python: >=3.11
@@ -250,6 +250,25 @@ client = Client(
 )
 ```
 
+### Token issuers
+
+`allowed_issuers` is optional. When you leave it out, the SDK derives the
+trusted issuers from `auth_url` and accepts a token whose `iss` claim either:
+
+- equals `{auth_url}/keycloak/realms/linker-platform`, the realm every
+  deployment hosts behind its own base URL; or
+- equals an external issuer the site is known to still accept — today only
+  production, which takes its Auth0 tenant alongside Keycloak while it migrates.
+
+That means `auth_url` has to be the site's **public base URL** — the same host
+that appears in the token's `iss` claim. Pointing it at an in-cluster or proxied
+address (for example a backend service URL) derives issuers that no token will
+ever carry, and verification fails with `jwt.InvalidIssuerError`. Pass
+`allowed_issuers` explicitly if you need to talk to a site through such an
+address.
+
+Passing `allowed_issuers` yourself replaces both rules with an exact-match list.
+
 ## Error Handling
 
 ```python

{visionai_sdk_python-2.1.0.dist-info → visionai_sdk_python-2.1.1.dist-info}/RECORD

@@ -1,11 +1,11 @@
 visionai_sdk_python/__init__.py,sha256=y2RFANz0iHxxrATkwIv9cDRkuICybgfMpTbjVX79lRw,569
-visionai_sdk_python/_base.py,sha256=6MoFyrOr4I3TkoXkBuZIlnih0xHB4QNuOWGug0vh2Ho,8117
+visionai_sdk_python/_base.py,sha256=VC4EGUqUzTkrN63ByKL_kPOckXjRfFNXWVXByGZhVfM,8130
 visionai_sdk_python/_jwt_verifier.py,sha256=h4CAK1iiDAJ-oKnXrLbCJw5rWcsVe94QNY12ne1Wzto,8442
 visionai_sdk_python/_request_attribution.py,sha256=zQk_bSLsu1RTp1Fe3MGUUX8YRzq3iqfBTmhhjM7BuRU,1907
 visionai_sdk_python/_source_header.py,sha256=DWiR-TGclET4UrqmAEO7bYPtf9XuLSE4FGQjZIgVWiY,5133
 visionai_sdk_python/async_client.py,sha256=u133WD2wqaUSNz-Rq3DgHDBQuPmArHgJtoiIpke5O-M,3876
 visionai_sdk_python/client.py,sha256=7hvlq0evaPLolm1hDXS44EaaZR7OUIkEpOrUCbGaz2Y,3736
-visionai_sdk_python/constants.py,sha256=hDLdISOkrrEifLumVy0gPLO2NmUDxdfe2UIueizpbh8,1868
+visionai_sdk_python/constants.py,sha256=KWhoxZdlwqXwhUJDqERStq2mrms-MA8aRDqBwbIvNO0,1471
 visionai_sdk_python/endpoints.py,sha256=CC-AoxXzg39sMAhqx1CTS3gRWKx_H7VOqBANRLVotoU,183
 visionai_sdk_python/exceptions.py,sha256=r4bxvsQGNTVa7-ISX1JAC7VRJ-6qs3n30l3j3qxai-Y,1047
 visionai_sdk_python/instrumentation.py,sha256=tTTL5Op0fZULpmoOKW8dw8-2ReOQUEpMvHrf-R5C_yg,24512
@@ -21,7 +21,7 @@ visionai_sdk_python/vlm/async_resource.py,sha256=pOuHpzsbw6NawGQHROcLzs_ezKg78DI
 visionai_sdk_python/vlm/models.py,sha256=yDFjo4LfAxqXYBnl6ZW7YUJQoKKRkQWtqBJi2ruI6Jw,984
 visionai_sdk_python/vlm/preprocess.py,sha256=ZpJJa13h8_YKwh_P7Pn8WIXV0x-r2xJi-ETgCFsGw-Y,7892
 visionai_sdk_python/vlm/resource.py,sha256=VaNybrunD_8eNDbAAJwaxkUrbR4amGATM4CGvQsX7Qk,3608
-visionai_sdk_python-2.1.0.dist-info/METADATA,sha256=pfpkNogDKiyBO6IKQahREvsZG1OL585-c4vxslTaE6E,27696
-visionai_sdk_python-2.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-visionai_sdk_python-2.1.0.dist-info/top_level.txt,sha256=79a5MCSLLv6Mbfun-8RS-G6O927hahBwDqJjeuWLdvM,20
-visionai_sdk_python-2.1.0.dist-info/RECORD,,
+visionai_sdk_python-2.1.1.dist-info/METADATA,sha256=Y2oQtkae1coZFW8Ltl9NVikIKIImK01nJPh6R5bRvdc,28624
+visionai_sdk_python-2.1.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+visionai_sdk_python-2.1.1.dist-info/top_level.txt,sha256=79a5MCSLLv6Mbfun-8RS-G6O927hahBwDqJjeuWLdvM,20
+visionai_sdk_python-2.1.1.dist-info/RECORD,,