visionai-sdk-python 2.1.0__tar.gz → 2.1.1__tar.gz

{visionai_sdk_python-2.1.0 → visionai_sdk_python-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: visionai-sdk-python
-Version: 2.1.0
+Version: 2.1.1
 Summary: VisionAI SDK for Python
 Author-email: Tony Yang <tonyyang@linkervision.com>
 Requires-Python: >=3.11
@@ -250,6 +250,25 @@ client = Client(
 )
 ```
 
+### Token issuers
+
+`allowed_issuers` is optional. When you leave it out, the SDK derives the
+trusted issuers from `auth_url` and accepts a token whose `iss` claim either:
+
+- equals `{auth_url}/keycloak/realms/linker-platform`, the realm every
+  deployment hosts behind its own base URL; or
+- equals an external issuer the site is known to still accept — today only
+  production, which takes its Auth0 tenant alongside Keycloak while it migrates.
+
+That means `auth_url` has to be the site's **public base URL** — the same host
+that appears in the token's `iss` claim. Pointing it at an in-cluster or proxied
+address (for example a backend service URL) derives issuers that no token will
+ever carry, and verification fails with `jwt.InvalidIssuerError`. Pass
+`allowed_issuers` explicitly if you need to talk to a site through such an
+address.
+
+Passing `allowed_issuers` yourself replaces both rules with an exact-match list.
+
 ## Error Handling
 
 ```python

{visionai_sdk_python-2.1.0 → visionai_sdk_python-2.1.1}/README.md

@@ -232,6 +232,25 @@ client = Client(
 )
 ```
 
+### Token issuers
+
+`allowed_issuers` is optional. When you leave it out, the SDK derives the
+trusted issuers from `auth_url` and accepts a token whose `iss` claim either:
+
+- equals `{auth_url}/keycloak/realms/linker-platform`, the realm every
+  deployment hosts behind its own base URL; or
+- equals an external issuer the site is known to still accept — today only
+  production, which takes its Auth0 tenant alongside Keycloak while it migrates.
+
+That means `auth_url` has to be the site's **public base URL** — the same host
+that appears in the token's `iss` claim. Pointing it at an in-cluster or proxied
+address (for example a backend service URL) derives issuers that no token will
+ever carry, and verification fails with `jwt.InvalidIssuerError`. Pass
+`allowed_issuers` explicitly if you need to talk to a site through such an
+address.
+
+Passing `allowed_issuers` yourself replaces both rules with an exact-match list.
+
 ## Error Handling
 
 ```python

{visionai_sdk_python-2.1.0 → visionai_sdk_python-2.1.1}/src/visionai_sdk_python/_base.py

@@ -38,7 +38,7 @@ class _BaseClient:
             vlm_url: Base URL for the VLM inference service.
             allowed_issuers: Optional list of allowed JWT issuers. If provided, tokens
                 whose ``iss`` claim is not in this list will be rejected. If omitted,
-                issuer validation is skipped.
+                the issuers are derived from ``auth_url``.
             verify_ssl: Whether to verify TLS certificates.
             timeout: Default request timeout in seconds.
             max_connections: Maximum number of concurrent connections in the pool.

visionai_sdk_python-2.1.1/src/visionai_sdk_python/constants.py

@@ -0,0 +1,36 @@
+# Resolves the trusted JWT issuers for a VisionAI server base URL.
+#
+# Every deployment hosts its own Keycloak behind the site's public base URL, so
+# the realm issuer is derived from `auth_url` rather than kept in a table. Only
+# sites that additionally accept tokens from an external IdP need an entry here.
+#
+# Long-term: replace this with dynamic discovery from the server's
+# trusted-issuers endpoint (e.g. GET {auth_url}/api/v1/auth/trusted-issuers).
+
+_KEYCLOAK_REALM_PATH = "/keycloak/realms/linker-platform"
+
+# Sites whose tokens may still come from an external IdP, in addition to their
+# own Keycloak realm. Production has not cut over yet; listing both issuers lets
+# an installed SDK keep working across the migration without an upgrade.
+#
+# Drop the entry once production is confirmed migrated — a retired Auth0 tenant
+# name can be re-registered by someone else, so it should not stay trusted
+# indefinitely.
+_EXTERNAL_IDP_ISSUERS: dict[str, list[str]] = {
+    "https://visionai.linkervision.com": [
+        "https://data-engine-prod.us.auth0.com",
+    ],
+}
+
+
+def resolve_allowed_issuers(auth_url: str) -> list[str]:
+    """Return the trusted issuers for the given auth_url.
+
+    Always includes the site's own Keycloak realm issuer, plus any external IdP
+    issuer the site still accepts.
+    """
+    normalized = auth_url.rstrip("/")
+    return [
+        f"{normalized}{_KEYCLOAK_REALM_PATH}",
+        *_EXTERNAL_IDP_ISSUERS.get(normalized, []),
+    ]

{visionai_sdk_python-2.1.0 → visionai_sdk_python-2.1.1}/src/visionai_sdk_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: visionai-sdk-python
-Version: 2.1.0
+Version: 2.1.1
 Summary: VisionAI SDK for Python
 Author-email: Tony Yang <tonyyang@linkervision.com>
 Requires-Python: >=3.11
@@ -250,6 +250,25 @@ client = Client(
 )
 ```
 
+### Token issuers
+
+`allowed_issuers` is optional. When you leave it out, the SDK derives the
+trusted issuers from `auth_url` and accepts a token whose `iss` claim either:
+
+- equals `{auth_url}/keycloak/realms/linker-platform`, the realm every
+  deployment hosts behind its own base URL; or
+- equals an external issuer the site is known to still accept — today only
+  production, which takes its Auth0 tenant alongside Keycloak while it migrates.
+
+That means `auth_url` has to be the site's **public base URL** — the same host
+that appears in the token's `iss` claim. Pointing it at an in-cluster or proxied
+address (for example a backend service URL) derives issuers that no token will
+ever carry, and verification fails with `jwt.InvalidIssuerError`. Pass
+`allowed_issuers` explicitly if you need to talk to a site through such an
+address.
+
+Passing `allowed_issuers` yourself replaces both rules with an exact-match list.
+
 ## Error Handling
 
 ```python

visionai_sdk_python-2.1.1/src/visionai_sdk_python.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.1.1",
+  "distance": 0,
+  "node": "gfb3ad463150fa3d6530e8390fee3865b9398d8c0",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-09-16"
+}

visionai_sdk_python-2.1.1/tests/test__base.py

@@ -0,0 +1,198 @@
+import jwt
+import pytest
+
+from visionai_sdk_python._base import _BaseClient
+from visionai_sdk_python.constants import resolve_allowed_issuers
+
+
+def test_init_stores_attributes() -> None:
+    client = _BaseClient(
+        auth_url="https://auth.example.com", vlm_url="https://vlm.example.com"
+    )
+    assert client.auth_url == "https://auth.example.com"
+    assert client.vlm_url == "https://vlm.example.com"
+    assert client.verify_ssl is True
+    assert client.timeout == 10.0
+    assert client.max_connections == 100
+    assert client.max_keepalive_connections == 20
+
+
+@pytest.mark.parametrize(
+    "base_url, path, expected",
+    [
+        # Standard case
+        ("https://auth.example.com", "token", "https://auth.example.com/token"),
+        # Trailing slash on base
+        ("https://auth.example.com/", "token", "https://auth.example.com/token"),
+        # Leading slash on path
+        ("https://auth.example.com", "/token", "https://auth.example.com/token"),
+        # Both have slashes — should not double-slash
+        ("https://auth.example.com/", "/token", "https://auth.example.com/token"),
+        # Nested path
+        ("https://vlm.example.com", "v1/infer", "https://vlm.example.com/v1/infer"),
+        # Empty path — should not raise, returns base with trailing slash
+        ("https://auth.example.com", "", "https://auth.example.com/"),
+    ],
+)
+def test_slash_normalization(base_url: str, path: str, expected: str) -> None:
+    assert _BaseClient._build_url(base_url, path) == expected
+
+
+def test_auth_header() -> None:
+    headers = _BaseClient._build_auth_header(access_token="my-token")
+    assert headers["Authorization"] == "Bearer my-token"
+
+
+@pytest.mark.parametrize("empty_url", ["", "  "])
+def test_init_raises_on_empty_auth_url(empty_url: str) -> None:
+    with pytest.raises(ValueError, match="auth_url"):
+        _BaseClient(auth_url=empty_url, vlm_url="https://vlm.example.com")
+
+
+@pytest.mark.parametrize("empty_url", ["", "  "])
+def test_init_raises_on_empty_vlm_url(empty_url: str) -> None:
+    with pytest.raises(ValueError, match="vlm_url"):
+        _BaseClient(auth_url="https://auth.example.com", vlm_url=empty_url)
+
+
+def test_auth_header_raises_on_empty_token() -> None:
+    with pytest.raises(ValueError, match="access_token"):
+        _BaseClient._build_auth_header(access_token="")
+
+
+_KEYCLOAK_SITES = [
+    "https://staging.visionai.linkervision.com",
+    "https://dev.visionai.linkervision.com",
+    "https://dev2.visionai.linkervision.com",
+    "https://dev3.visionai.linkervision.com",
+    "https://offline.visionai.linkervision.com",
+    "https://lighthouse.visionai.linkervision.ai",
+    "https://lighthouse-production.visionai.linkervision.ai",
+]
+
+
+@pytest.mark.parametrize("auth_url", _KEYCLOAK_SITES)
+def test_resolve_allowed_issuers_for_keycloak_sites(auth_url: str) -> None:
+    """Every site that has cut over to Keycloak resolves to its realm issuer."""
+    assert resolve_allowed_issuers(auth_url) == [
+        f"{auth_url}/keycloak/realms/linker-platform"
+    ]
+
+
+def test_resolve_allowed_issuers_for_production() -> None:
+    """Production accepts its Auth0 tenant and its Keycloak realm during the cutover."""
+    assert resolve_allowed_issuers("https://visionai.linkervision.com") == [
+        "https://visionai.linkervision.com/keycloak/realms/linker-platform",
+        "https://data-engine-prod.us.auth0.com",
+    ]
+
+
+def test_resolve_allowed_issuers_falls_back_to_keycloak() -> None:
+    """An unknown host is assumed to be a Keycloak deployment."""
+    assert resolve_allowed_issuers("https://somewhere.example.com") == [
+        "https://somewhere.example.com/keycloak/realms/linker-platform"
+    ]
+
+
+@pytest.mark.parametrize(
+    "auth_url",
+    [
+        "https://dev.visionai.linkervision.com/",
+        "https://dev.visionai.linkervision.com///",
+    ],
+)
+def test_resolve_allowed_issuers_ignores_trailing_slashes(auth_url: str) -> None:
+    assert resolve_allowed_issuers(auth_url) == [
+        "https://dev.visionai.linkervision.com/keycloak/realms/linker-platform"
+    ]
+
+
+def test_client_defaults_to_resolved_issuers() -> None:
+    """Omitting allowed_issuers pins the client to the site's own issuer."""
+    client = _BaseClient(
+        auth_url="https://dev.visionai.linkervision.com",
+        vlm_url="https://vlm.example.com",
+    )
+    client._jwt_verifier._validate_issuer(
+        "https://dev.visionai.linkervision.com/keycloak/realms/linker-platform"
+    )
+    with pytest.raises(jwt.InvalidIssuerError):
+        client._jwt_verifier._validate_issuer("https://data-engine-dev2.jp.auth0.com")
+
+
+def test_production_accepts_both_issuers_across_the_migration() -> None:
+    """Production keeps working whether the token comes from Auth0 or Keycloak."""
+    client = _BaseClient(
+        auth_url="https://visionai.linkervision.com",
+        vlm_url="https://vlm.example.com",
+    )
+    client._jwt_verifier._validate_issuer("https://data-engine-prod.us.auth0.com")
+    client._jwt_verifier._validate_issuer(
+        "https://visionai.linkervision.com/keycloak/realms/linker-platform"
+    )
+
+
+@pytest.mark.parametrize(
+    "issuer",
+    [
+        # Same realm path, different host.
+        "https://evil.example.com/keycloak/realms/linker-platform",
+        # Site host as a substring of an attacker-controlled one.
+        "https://dev.visionai.linkervision.com.evil.example.com/keycloak/realms/x",
+        # Right host, wrong scheme.
+        "http://dev.visionai.linkervision.com/keycloak/realms/linker-platform",
+        # Right host, different realm.
+        "https://dev.visionai.linkervision.com/keycloak/realms/another-realm",
+    ],
+)
+def test_default_issuers_reject_lookalikes(issuer: str) -> None:
+    """The derived issuer is matched exactly — near misses are not accepted."""
+    client = _BaseClient(
+        auth_url="https://dev.visionai.linkervision.com",
+        vlm_url="https://vlm.example.com",
+    )
+    with pytest.raises(jwt.InvalidIssuerError):
+        client._jwt_verifier._validate_issuer(issuer)
+
+
+_ALLOWED_ISSUERS = [
+    "https://offline.visionai.linkervision.com/keycloak/realms/linker-platform",
+    "https://data-engine-prod.us.auth0.com",
+]
+
+
+@pytest.mark.parametrize("issuer", _ALLOWED_ISSUERS)
+def test_validate_issuer_passes_for_allowed(issuer: str) -> None:
+    client = _BaseClient(
+        auth_url="https://auth.example.com",
+        vlm_url="https://vlm.example.com",
+        allowed_issuers=_ALLOWED_ISSUERS,
+    )
+    client._jwt_verifier._validate_issuer(issuer)  # should not raise
+
+
+@pytest.mark.parametrize(
+    "issuer",
+    [
+        "https://evil.com/keycloak/realms/linker-platform",
+        "https://attacker.auth0.com/",
+        "https://offline.visionai.linkervision.com/keycloak/realms/other-realm",
+    ],
+)
+def test_validate_issuer_raises_for_unknown(issuer: str) -> None:
+    client = _BaseClient(
+        auth_url="https://auth.example.com",
+        vlm_url="https://vlm.example.com",
+        allowed_issuers=_ALLOWED_ISSUERS,
+    )
+    with pytest.raises(jwt.InvalidIssuerError):
+        client._jwt_verifier._validate_issuer(issuer)
+
+
+def test_validate_issuer_raises_for_unknown_when_no_allowed_issuers() -> None:
+    client = _BaseClient(
+        auth_url="https://auth.example.com",
+        vlm_url="https://vlm.example.com",
+    )
+    with pytest.raises(jwt.InvalidIssuerError):
+        client._jwt_verifier._validate_issuer("https://anyone.com/")  # should not raise

visionai_sdk_python-2.1.0/src/visionai_sdk_python/constants.py

@@ -1,49 +0,0 @@
-# Maps known VisionAI server base URLs to their trusted JWT issuers.
-# Keys are normalized (no trailing slash).
-# Values are exact issuer strings as they appear in the JWT `iss` claim.
-#
-# Long-term: replace this static table with dynamic discovery from the server's
-# trusted-issuers endpoint (e.g. GET {auth_url}/api/v1/auth/trusted-issuers).
-
-_KEYCLOAK_REALM_PATH = "/keycloak/realms/linker-platform"
-
-# On-premise deployments backed by Keycloak (realm: linker-platform).
-# Issuer = base_url + _KEYCLOAK_REALM_PATH for all entries.
-_KEYCLOAK_BASE_URLS: list[str] = [
-    "https://offline.visionai.linkervision.com",
-    "https://lighthouse.visionai.linkervision.ai",
-    "https://lighthouse-production.visionai.linkervision.ai",
-]
-
-# Cloud deployments backed by Auth0 (one tenant per environment).
-_AUTH0_URL_TO_ISSUERS: dict[str, list[str]] = {
-    "https://visionai.linkervision.com": [
-        "https://data-engine-prod.us.auth0.com",
-    ],
-    "https://staging.visionai.linkervision.com": [
-        "https://data-engine-staging.jp.auth0.com",
-    ],
-    "https://dev2.visionai.linkervision.com": [
-        "https://data-engine-dev2.jp.auth0.com",
-    ],
-    "https://dev.visionai.linkervision.com": [
-        "https://dev-045acunea5v1mm3l.us.auth0.com",
-    ],
-}
-
-_AUTH_URL_TO_ISSUERS: dict[str, list[str]] = {
-    **{url: [f"{url}{_KEYCLOAK_REALM_PATH}"] for url in _KEYCLOAK_BASE_URLS},
-    **_AUTH0_URL_TO_ISSUERS,
-}
-
-
-def resolve_allowed_issuers(auth_url: str) -> list[str]:
-    """Return the trusted issuers for the given auth_url.
-
-    If the URL is in the known table, return its configured issuers.
-    Otherwise, assume a Keycloak deployment and derive the issuer from auth_url.
-    """
-    normalized = auth_url.rstrip("/")
-    if known := _AUTH_URL_TO_ISSUERS.get(normalized):
-        return known
-    return [f"{normalized}{_KEYCLOAK_REALM_PATH}"]

visionai_sdk_python-2.1.0/src/visionai_sdk_python.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "2.1.0",
-  "distance": 0,
-  "node": "g72bde18e5ad7c772f12e7d313f7396f24342ef92",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-09-14"
-}

visionai_sdk_python-2.1.0/tests/test__base.py

@@ -1,102 +0,0 @@
-import jwt
-import pytest
-
-from visionai_sdk_python._base import _BaseClient
-
-
-def test_init_stores_attributes() -> None:
-    client = _BaseClient(
-        auth_url="https://auth.example.com", vlm_url="https://vlm.example.com"
-    )
-    assert client.auth_url == "https://auth.example.com"
-    assert client.vlm_url == "https://vlm.example.com"
-    assert client.verify_ssl is True
-    assert client.timeout == 10.0
-    assert client.max_connections == 100
-    assert client.max_keepalive_connections == 20
-
-
-@pytest.mark.parametrize(
-    "base_url, path, expected",
-    [
-        # Standard case
-        ("https://auth.example.com", "token", "https://auth.example.com/token"),
-        # Trailing slash on base
-        ("https://auth.example.com/", "token", "https://auth.example.com/token"),
-        # Leading slash on path
-        ("https://auth.example.com", "/token", "https://auth.example.com/token"),
-        # Both have slashes — should not double-slash
-        ("https://auth.example.com/", "/token", "https://auth.example.com/token"),
-        # Nested path
-        ("https://vlm.example.com", "v1/infer", "https://vlm.example.com/v1/infer"),
-        # Empty path — should not raise, returns base with trailing slash
-        ("https://auth.example.com", "", "https://auth.example.com/"),
-    ],
-)
-def test_slash_normalization(base_url: str, path: str, expected: str) -> None:
-    assert _BaseClient._build_url(base_url, path) == expected
-
-
-def test_auth_header() -> None:
-    headers = _BaseClient._build_auth_header(access_token="my-token")
-    assert headers["Authorization"] == "Bearer my-token"
-
-
-@pytest.mark.parametrize("empty_url", ["", "  "])
-def test_init_raises_on_empty_auth_url(empty_url: str) -> None:
-    with pytest.raises(ValueError, match="auth_url"):
-        _BaseClient(auth_url=empty_url, vlm_url="https://vlm.example.com")
-
-
-@pytest.mark.parametrize("empty_url", ["", "  "])
-def test_init_raises_on_empty_vlm_url(empty_url: str) -> None:
-    with pytest.raises(ValueError, match="vlm_url"):
-        _BaseClient(auth_url="https://auth.example.com", vlm_url=empty_url)
-
-
-def test_auth_header_raises_on_empty_token() -> None:
-    with pytest.raises(ValueError, match="access_token"):
-        _BaseClient._build_auth_header(access_token="")
-
-
-_ALLOWED_ISSUERS = [
-    "https://offline.visionai.linkervision.com/keycloak/realms/linker-platform",
-    "https://data-engine-staging.jp.auth0.com",
-]
-
-
-@pytest.mark.parametrize("issuer", _ALLOWED_ISSUERS)
-def test_validate_issuer_passes_for_allowed(issuer: str) -> None:
-    client = _BaseClient(
-        auth_url="https://auth.example.com",
-        vlm_url="https://vlm.example.com",
-        allowed_issuers=_ALLOWED_ISSUERS,
-    )
-    client._jwt_verifier._validate_issuer(issuer)  # should not raise
-
-
-@pytest.mark.parametrize(
-    "issuer",
-    [
-        "https://evil.com/keycloak/realms/linker-platform",
-        "https://attacker.auth0.com/",
-        "https://offline.visionai.linkervision.com/keycloak/realms/other-realm",
-    ],
-)
-def test_validate_issuer_raises_for_unknown(issuer: str) -> None:
-    client = _BaseClient(
-        auth_url="https://auth.example.com",
-        vlm_url="https://vlm.example.com",
-        allowed_issuers=_ALLOWED_ISSUERS,
-    )
-    with pytest.raises(jwt.InvalidIssuerError):
-        client._jwt_verifier._validate_issuer(issuer)
-
-
-def test_validate_issuer_raises_for_unknown_when_no_allowed_issuers() -> None:
-    client = _BaseClient(
-        auth_url="https://auth.example.com",
-        vlm_url="https://vlm.example.com",
-    )
-    with pytest.raises(jwt.InvalidIssuerError):
-        client._jwt_verifier._validate_issuer("https://anyone.com/")  # should not raise