volcano-sdk-python 0.8.0__py3-none-any.whl → 0.9.1__py3-none-any.whl

volcano_sdk/_session.py

@@ -0,0 +1,70 @@
+"""Internal session continuity checks shared by refresh and revocation."""
+
+from __future__ import annotations
+
+import base64
+import json
+from collections.abc import Mapping
+from typing import TYPE_CHECKING, cast
+from uuid import UUID
+
+from .errors import AuthenticationError
+
+if TYPE_CHECKING:
+    from .models import Session
+
+_JWT_PARTS = 3
+_REFRESH_USER_MISMATCH = "Refreshed session belongs to a different user"
+_REFRESH_SESSION_MISMATCH = "Refreshed credentials belong to a different server session"
+_MISSING_SESSION_ID = "Cannot refresh supplied credentials without a session identifier"
+
+
+def session_id_from_access_token(access_token: str) -> str | None:
+    """Read an untrusted continuity constraint; this never authenticates a user."""
+    parts = access_token.split(".")
+    if len(parts) != _JWT_PARTS:
+        return None
+    padding = "=" * (-len(parts[1]) % 4)
+    try:
+        payload: object = json.loads(
+            base64.urlsafe_b64decode(parts[1] + padding).decode()
+        )
+    except (ValueError, UnicodeDecodeError, RecursionError):
+        return None
+    if not isinstance(payload, Mapping):
+        return None
+    values = cast("Mapping[object, object]", payload)
+    session_id = values.get("session_id")
+    if not isinstance(session_id, str) or not session_id.strip():
+        return None
+    try:
+        return str(UUID(session_id.strip()))
+    except ValueError:
+        return None
+
+
+def validate_refresh_source(current: Session, *, verified: bool = False) -> None:
+    """Require a session constraint for supplied credentials."""
+    if not verified and session_id_from_access_token(current.access_token) is None:
+        raise AuthenticationError(_MISSING_SESSION_ID)
+
+
+def validate_refresh_identity(current: Session | None, refreshed: Session) -> None:
+    """Reject a refresh outside the captured server session or validated user."""
+    if current is None:
+        return
+    session_id = session_id_from_access_token(current.access_token)
+    if session_id is not None and session_id != session_id_from_access_token(
+        refreshed.access_token
+    ):
+        raise AuthenticationError(_REFRESH_SESSION_MISMATCH)
+    if current.user_id is None:
+        return
+    if current.user_id == refreshed.user_id:
+        return
+    try:
+        matches = UUID(current.user_id) == UUID(str(refreshed.user_id))
+    except ValueError:
+        matches = False
+    if not matches:
+        raise AuthenticationError(_REFRESH_USER_MISMATCH)

volcano_sdk/_session_operations.py

@@ -0,0 +1,158 @@
+"""Bound refresh and revocation work to one explicitly established session."""
+
+from __future__ import annotations
+
+from concurrent.futures import Future
+from threading import Lock
+from typing import TYPE_CHECKING, TypeVar
+
+from .errors import SessionChangedError, VolcanoError
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from .models import Session
+
+_T = TypeVar("_T")
+
+
+def _copy_failure(error: BaseException, *, include_cause: bool = True) -> BaseException:
+    """Copy public failure details without retaining request frames or contexts."""
+    copied = type(error).__new__(type(error), *error.args)
+    if isinstance(error, VolcanoError) and isinstance(copied, VolcanoError):
+        copied.status = error.status
+        copied.code = error.code
+        copied.retry_after = error.retry_after
+    if include_cause and isinstance(error.__cause__, VolcanoError):
+        copied.__cause__ = _copy_failure(error.__cause__, include_cause=False)
+    return copied
+
+
+class SessionOperations:
+    """Retain only this session's latest refresh and shared sign-out outcome."""
+
+    def __init__(self, verified: Session | None = None) -> None:
+        self._lock = Lock()
+        self.refreshing: Future[Session] | None = None
+        self.signing_out: Future[BaseException | None] | None = None
+        self._locally_cleared = False
+        self._verified_pair = (
+            (verified.access_token, verified.refresh_token)
+            if verified is not None
+            else None
+        )
+
+    def verify_pair(self, session: Session | None) -> None:
+        with self._lock:
+            if self._locally_cleared:
+                return
+            self._verified_pair = (
+                (session.access_token, session.refresh_token)
+                if session is not None
+                else None
+            )
+
+    def clear_local_credentials(self) -> None:
+        """Keep pending revocation joinable; discard credentials after other clears."""
+        with self._lock:
+            if self.signing_out is not None:
+                return
+            self._locally_cleared = True
+            self._verified_pair = None
+            refreshing = self.refreshing
+        if refreshing is not None:
+            refreshing.add_done_callback(self._forget_refresh)
+
+    def _forget_refresh(self, refreshing: Future[Session]) -> None:
+        with self._lock:
+            if self.refreshing is refreshing:
+                self.refreshing = None
+
+    def has_verified_pair(self, session: Session) -> bool:
+        with self._lock:
+            return session.refresh_token is not None and self._verified_pair == (
+                session.access_token,
+                session.refresh_token,
+            )
+
+    def refresh(self, operation: Callable[[], Session]) -> Session:
+        with self._lock:
+            if self.signing_out is not None or self._locally_cleared:
+                raise SessionChangedError
+            future = self.refreshing
+            if future is None or future.done():
+                future = self.refreshing = Future()
+                owner = True
+            else:
+                owner = False
+        if owner:
+            self._complete(future, operation)
+        return future.result()
+
+    def sign_out(
+        self, operation: Callable[[Future[Session] | None, bool], None]
+    ) -> None:
+        with self._lock:
+            future = self.signing_out
+            if future is None:
+                future = self.signing_out = Future()
+                owner = True
+            else:
+                owner = False
+            preceding = self.refreshing
+            pending = preceding is not None and not preceding.done()
+        if owner:
+            self._complete_revocation(future, operation, preceding, pending=pending)
+        self._sign_out_result(future)
+
+    def wait_for_sign_out(self) -> None:
+        with self._lock:
+            future = self.signing_out
+            pending = future is not None and not future.done()
+        if pending and future is not None:
+            self._sign_out_result(future)
+
+    @staticmethod
+    def _sign_out_result(future: Future[BaseException | None]) -> None:
+        failure = future.result()
+        if failure is not None:
+            # Raising the retained template would attach credential-bearing frames.
+            raise _copy_failure(failure)
+
+    def _complete_revocation(
+        self,
+        future: Future[BaseException | None],
+        operation: Callable[[Future[Session] | None, bool], None],
+        preceding: Future[Session] | None,
+        *,
+        pending: bool,
+    ) -> None:
+        try:
+            self._revoke(operation, preceding, pending=pending)
+        except BaseException as error:
+            future.set_result(_copy_failure(error))
+            raise
+        future.set_result(None)
+
+    def _revoke(
+        self,
+        operation: Callable[[Future[Session] | None, bool], None],
+        preceding: Future[Session] | None,
+        *,
+        pending: bool,
+    ) -> None:
+        try:
+            operation(preceding, pending)
+        finally:
+            with self._lock:
+                self._verified_pair = None
+                self.refreshing = None
+
+    @staticmethod
+    def _complete(future: Future[_T], operation: Callable[[], _T]) -> None:
+        try:
+            future.set_result(operation())
+        except BaseException as error:
+            # Every waiter must finish, including when the owner is interrupted.
+            future.set_exception(error)
+            raise

volcano_sdk/auth.py

@@ -2,11 +2,7 @@
 
 from __future__ import annotations
 
-import base64
-import binascii
-import json
 import secrets
-import threading
 from collections.abc import Mapping
 from contextlib import suppress
 from copy import deepcopy
@@ -43,6 +39,11 @@ from ._generated.models.refresh_o_auth_provider_token_response_200 import (
     RefreshOAuthProviderTokenResponse200,
 )
 from ._generated.types import Unset
+from ._session import (
+    session_id_from_access_token,
+    validate_refresh_identity,
+    validate_refresh_source,
+)
 from ._transport import (
     AuthCallOAuthAPITransport,
     AuthCancelEmailChangeTransport,
@@ -75,6 +76,7 @@ from ._transport import (
 )
 from .errors import (
     AuthenticationError,
+    RateLimitedError,
     SessionChangedError,
     TransportError,
     VolcanoError,
@@ -115,8 +117,8 @@ _INVALID_OAUTH_PARAMETER = "OAuth parameters must be non-empty strings"
 _INVALID_OAUTH_STATE = "OAuth state must not exceed 255 characters"
 _OAUTH_STATE_MISMATCH = "OAuth state mismatch"
 _MAX_OAUTH_STATE_LENGTH = 255
-_JWT_PARTS = 3
 _NO_ACTIVE_SESSION = "No active session"
+_REFRESH_UNAVAILABLE = "No refresh token"
 _T = TypeVar("_T")
 _OAUTH_PROVIDERS: frozenset[str] = frozenset({"apple", "github", "google", "microsoft"})
 _OAUTH_API_METHODS: frozenset[str] = frozenset({"GET", "POST"})
@@ -124,11 +126,13 @@ _HOSTED_AUTH_ACTIONS: frozenset[str] = frozenset({"login", "signup", "forgot-pas
 
 if TYPE_CHECKING:
     from collections.abc import Callable
+    from concurrent.futures import Future
 
     from ._generated.models import (
         AuthListOAuthProvidersResponse200ProvidersItem,
     )
     from ._generated.models.auth_session import AuthSession as GeneratedAuthSession
+    from ._session_operations import SessionOperations
     from ._transport import TransportResponse
 
 
@@ -169,26 +173,6 @@ def _validate_oauth_callback_state(state: str, expected_state: str) -> None:
         raise ValueError(_OAUTH_STATE_MISMATCH)
 
 
-def _session_id_from_access_token(access_token: str) -> str | None:
-    parts = access_token.split(".")
-    if len(parts) != _JWT_PARTS:
-        return None
-    padding = "=" * (-len(parts[1]) % 4)
-    try:
-        payload: object = json.loads(
-            base64.urlsafe_b64decode(parts[1] + padding).decode()
-        )
-    except (binascii.Error, json.JSONDecodeError, UnicodeDecodeError):
-        return None
-    if not isinstance(payload, Mapping):
-        return None
-    values = cast("Mapping[object, object]", payload)
-    session_id = values.get("session_id")
-    if not isinstance(session_id, str) or not session_id.strip():
-        return None
-    return session_id.strip()
-
-
 def _has_complete_values(session: Session) -> bool:
     return all(
         _is_non_empty_string(value)
@@ -468,7 +452,9 @@ class AuthContext(Protocol):
 
     def _capture_session(self) -> tuple[int, Session | None]: ...
 
-    def _capture_session_binding(self) -> tuple[int, int, Session | None]: ...
+    def _capture_session_binding(
+        self,
+    ) -> tuple[int, SessionOperations, Session | None]: ...
 
     def _update_session_user_if_current(
         self, user: Mapping[str, JSONValue], generation: int
@@ -487,6 +473,7 @@ class AuthContext(Protocol):
         self,
         generation: int,
         *,
+        lineage: SessionOperations | None = None,
         event: AuthChangeEvent = "SIGNED_OUT",
         notifications: list[Callable[[], None]] | None = None,
     ) -> bool: ...
@@ -503,8 +490,7 @@ class Auth:
     def __init__(self, client: AuthContext) -> None:
         """Create an authentication facade backed by a client."""
         self._client = client
-        self._refresh_lock = threading.RLock()
-        self._rejected_refresh: tuple[int, int] | None = None
+        self._rejected_refresh: tuple[int, SessionOperations] | None = None
 
     def get_session(self) -> Session | None:
         """Return the immutable locally held session without validating it."""
@@ -604,33 +590,37 @@ class Auth:
 
     def request_email_change(self, *, new_email: str) -> EmailChangeResult:
         """Request a confirmation email without changing the current session."""
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthRequestEmailChangeTransport", self._client._transport)
-        response = invoke(
-            transport.auth_request_email_change,
-            authorization=current.access_token,
-            new_email=new_email,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_request_email_change,
+                authorization=access_token,
+                new_email=new_email,
+            ),
+            binding=binding,
         )
         result = _email_change_result_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def cancel_email_change(self) -> None:
         """Cancel a pending email change without changing the current session."""
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthCancelEmailChangeTransport", self._client._transport)
-        response = invoke(
-            transport.auth_cancel_email_change,
-            authorization=current.access_token,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_cancel_email_change,
+                authorization=access_token,
+            ),
+            binding=binding,
         )
         response_payload(response, 200)
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
 
     def confirm_email_change(self, *, token: str) -> User:
         """Confirm a pending email change and return the updated user."""
@@ -650,48 +640,54 @@ class Auth:
 
     def delete_all_other_sessions(self) -> None:
         """Delete every other session while preserving the current session."""
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthDeleteAllMySessionsTransport", self._client._transport)
-        response = invoke(
-            transport.auth_delete_all_my_sessions,
-            authorization=current.access_token,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_delete_all_my_sessions,
+                authorization=access_token,
+            ),
+            binding=binding,
         )
         response_payload(response, 204)
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
 
     def list_sessions(self, *, page: int = 1, limit: int = 20) -> SessionPage:
         """List sessions in the stable offset-paginated activity order."""
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthGetMySessionsTransport", self._client._transport)
-        response = invoke(
-            transport.auth_get_my_sessions,
-            authorization=current.access_token,
-            page=page,
-            limit=limit,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_get_my_sessions,
+                authorization=access_token,
+                page=page,
+                limit=limit,
+            ),
+            binding=binding,
         )
         result = _session_page_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def list_linked_oauth_providers(self) -> tuple[LinkedOAuthProvider, ...]:
         """List OAuth providers linked to the current account."""
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthListOAuthProvidersTransport", self._client._transport)
-        response = invoke(
-            transport.auth_list_oauth_providers,
-            authorization=current.access_token,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_list_oauth_providers,
+                authorization=access_token,
+            ),
+            binding=binding,
         )
         result = _linked_oauth_providers_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def get_hosted_auth_url(
@@ -777,38 +773,42 @@ class Auth:
     def link_oauth_provider(self, *, provider: OAuthProviderName) -> str:
         """Return the authorization URL for linking an OAuth provider."""
         provider_name = _oauth_provider_name(provider)
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthLinkOAuthProviderTransport", self._client._transport)
-        response = invoke(
-            transport.auth_link_oauth_provider,
-            authorization=current.access_token,
-            provider=provider_name,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_link_oauth_provider,
+                authorization=access_token,
+                provider=provider_name,
+            ),
+            binding=binding,
         )
         result = _oauth_link_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def unlink_oauth_provider(self, *, provider: OAuthProviderName) -> None:
         """Unlink an OAuth provider from the current account."""
         provider_name = _oauth_provider_name(provider)
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast(
             "AuthUnlinkOAuthProviderTransport",
             self._client._transport,
         )
-        response = invoke(
-            transport.auth_unlink_oauth_provider,
-            authorization=current.access_token,
-            provider=provider_name,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_unlink_oauth_provider,
+                authorization=access_token,
+                provider=provider_name,
+            ),
+            binding=binding,
         )
         response_payload(response, 204)
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
 
     def get_oauth_provider_token(
         self,
@@ -817,23 +817,25 @@ class Auth:
     ) -> OAuthProviderTokenStatus:
         """Return validity metadata for a server-held OAuth provider token."""
         provider_name = _oauth_provider_name(provider)
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast(
             "AuthGetOAuthProviderTokenTransport",
             self._client._transport,
         )
-        response = invoke(
-            transport.auth_get_oauth_provider_token,
-            authorization=current.access_token,
-            provider=provider_name,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_get_oauth_provider_token,
+                authorization=access_token,
+                provider=provider_name,
+            ),
+            binding=binding,
         )
         result = _oauth_provider_token_status_from_payload(
             response_payload(response, 200)
         )
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def refresh_oauth_provider_token(
@@ -843,23 +845,25 @@ class Auth:
     ) -> OAuthProviderTokenStatus:
         """Refresh a server-held OAuth provider token and return its status."""
         provider_name = _oauth_provider_name(provider)
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast(
             "AuthRefreshOAuthProviderTokenTransport",
             self._client._transport,
         )
-        response = invoke(
-            transport.auth_refresh_oauth_provider_token,
-            authorization=current.access_token,
-            provider=provider_name,
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_refresh_oauth_provider_token,
+                authorization=access_token,
+                provider=provider_name,
+            ),
+            binding=binding,
         )
         result = _oauth_provider_token_status_from_payload(
             response_payload(response, 200)
         )
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def call_oauth_api(
@@ -873,53 +877,61 @@ class Auth:
         """Call a provider API through Volcano's fixed-host server proxy."""
         provider_name = _oauth_provider_name(provider)
         request_method = _oauth_api_method(method)
-        generation, current = self._client._capture_session()
-        if current is None:
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         transport = cast("AuthCallOAuthAPITransport", self._client._transport)
-        response = invoke(
-            transport.auth_call_oauth_api,
-            authorization=current.access_token,
-            provider=provider_name,
-            endpoint=endpoint,
-            method=request_method,
-            body=body,
+        request_body = deepcopy(dict(body)) if body is not None else None
+        response = self._session_request(
+            lambda access_token: invoke(
+                transport.auth_call_oauth_api,
+                authorization=access_token,
+                provider=provider_name,
+                endpoint=endpoint,
+                method=request_method,
+                body=request_body,
+            ),
+            binding=binding,
         )
         result = _oauth_api_data_from_payload(response_payload(response, 200))
-        if self._client._capture_session()[0] != generation:
-            raise SessionChangedError
+        self._owned_refresh_session(binding)
         return result
 
     def delete_session(self, *, session_id: str) -> None:
         """Delete one session and clear local state when it is current."""
-        generation, current = self._client._capture_session()
+        binding = self._client._capture_session_binding()
+        generation, lineage, current = binding
         if current is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
-        current_session_id = _session_id_from_access_token(current.access_token)
+        current_session_id = session_id_from_access_token(current.access_token)
         deletes_current = (
             current_session_id is not None
             and current_session_id.casefold() == session_id.casefold()
         )
         transport = cast("AuthDeleteMySessionTransport", self._client._transport)
         try:
-            response = invoke(
-                transport.auth_delete_my_session,
-                authorization=current.access_token,
-                session_id=session_id,
+            response = self._session_request(
+                lambda access_token: invoke(
+                    transport.auth_delete_my_session,
+                    authorization=access_token,
+                    session_id=session_id,
+                ),
+                binding=binding,
             )
             response_payload(response, 204)
         except TransportError as error:
             if deletes_current and not self._client._clear_session_if_current(
-                generation
+                generation, lineage=lineage
             ):
                 raise SessionChangedError from error
             raise
         if deletes_current:
-            current_unchanged = self._client._clear_session_if_current(generation)
+            if not self._client._clear_session_if_current(generation, lineage=lineage):
+                raise SessionChangedError
         else:
-            current_unchanged = self._client._capture_session()[0] == generation
-        if not current_unchanged:
-            raise SessionChangedError
+            _, active_lineage, active_session = self._client._capture_session_binding()
+            if active_lineage is not lineage or active_session is None:
+                raise SessionChangedError
 
     def confirm_email(self, *, token: str) -> None:
         """Confirm an email with its token without changing local state."""
@@ -953,7 +965,7 @@ class Auth:
         response_payload(response, 200)
 
     def _update_current_user(
-        self, payload: object, binding: tuple[int, int, Session | None]
+        self, payload: object, binding: tuple[int, SessionOperations, Session | None]
     ) -> User:
         generation = self._owned_refresh_session(binding)[0]
         user, snapshot = _user_from_payload(payload)
@@ -1030,7 +1042,7 @@ class Auth:
         self,
         operation: Callable[[str], TransportResponse],
         *,
-        binding: tuple[int, int, Session | None] | None = None,
+        binding: tuple[int, SessionOperations, Session | None] | None = None,
     ) -> TransportResponse:
         if binding is None:
             binding = self._client._capture_session_binding()
@@ -1057,24 +1069,31 @@ class Auth:
         self._owned_refresh_session(binding)
         return response
 
-    def _validate_read_failure(self, binding: tuple[int, int, Session | None]) -> None:
+    def _validate_read_failure(
+        self, binding: tuple[int, SessionOperations, Session | None]
+    ) -> None:
         with suppress(AuthenticationError):
             self._owned_refresh_session(binding)
 
     def _refresh_session_for_binding(
-        self, binding: tuple[int, int, Session | None]
+        self, binding: tuple[int, SessionOperations, Session | None]
     ) -> Session:
-        generation, _, current = binding
+        generation, owner, current = binding
         if current is None:
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         notifications: list[Callable[[], None]] = []
         try:
-            with self._refresh_lock:
-                active_generation, _, _ = self._owned_refresh_session(binding)
-                if active_generation == generation:
-                    self._perform_refresh(binding, current, notifications)
+            active_generation, _, _ = self._owned_refresh_session(binding)
+            if active_generation == generation:
+                owner.refresh(
+                    lambda: self._perform_refresh(binding, current, notifications)
+                )
+            if owner.signing_out is not None:
+                raise SessionChangedError
+        except VolcanoError:
+            self._validate_read_failure(binding)
+            raise
         finally:
-            # Only the dispatcher owner drains, after refresh coordination is released.
             for dispatch in notifications:
                 dispatch()
         active = self._owned_refresh_session(binding)[2]
@@ -1083,14 +1102,14 @@ class Auth:
         return active
 
     def _owned_refresh_session(
-        self, binding: tuple[int, int, Session | None]
-    ) -> tuple[int, int, Session | None]:
+        self, binding: tuple[int, SessionOperations, Session | None]
+    ) -> tuple[int, SessionOperations, Session | None]:
         generation, lineage, _ = binding
         active = self._client._capture_session_binding()
-        if self._rejected_refresh == (generation, lineage) and active == (
-            generation + 1,
-            lineage + 1,
-            None,
+        if (
+            self._rejected_refresh == (generation, lineage)
+            and active[0] == generation + 1
+            and active[2] is None
         ):
             raise AuthenticationError(_NO_ACTIVE_SESSION)
         if active[1] != lineage or active[2] is None:
@@ -1099,35 +1118,49 @@ class Auth:
 
     def _perform_refresh(
         self,
-        binding: tuple[int, int, Session | None],
+        binding: tuple[int, SessionOperations, Session | None],
         current: Session,
         notifications: list[Callable[[], None]],
-    ) -> None:
-        generation, lineage, _ = binding
+    ) -> Session:
+        generation, owner, _ = binding
+        active_generation, _, active = self._owned_refresh_session(binding)
+        if active_generation != generation and active is not None:
+            return active
+        if current.refresh_token is None:
+            raise AuthenticationError(_REFRESH_UNAVAILABLE)
+        verified = owner.has_verified_pair(current)
+        validate_refresh_source(current, verified=verified)
+        owner.verify_pair(None)
         try:
-            refreshed = self._request_refreshed_session(current)
+            refreshed = self._request_refreshed_session(current.refresh_token)
+        except RateLimitedError:
+            if verified:
+                owner.verify_pair(current)
+            raise
         except AuthenticationError:
-            if not self._client._clear_session_if_current(
+            if owner.signing_out is None and self._client._clear_session_if_current(
                 generation, notifications=notifications
             ):
-                raise SessionChangedError from None
-            self._rejected_refresh = (generation, lineage)
-            raise
-        except VolcanoError:
-            self._owned_refresh_session(binding)
+                self._rejected_refresh = (generation, owner)
             raise
-        if not self._client._set_session_if_current(
-            refreshed, generation, event="TOKEN_REFRESHED", notifications=notifications
-        ):
-            raise SessionChangedError
+        validate_refresh_identity(current, refreshed)
+        owner.verify_pair(refreshed)
+        if owner.signing_out is None:
+            self._client._set_session_if_current(
+                refreshed,
+                generation,
+                event="TOKEN_REFRESHED",
+                notifications=notifications,
+            )
+        return refreshed
 
-    def _request_refreshed_session(self, current: Session) -> Session:
+    def _request_refreshed_session(self, refresh_token: str) -> Session:
         transport = cast("AuthRefreshTransport", self._client._transport)
         try:
             response = invoke(
                 transport.auth_refresh,
                 authorization=self._client._anon_token(),
-                refresh_token=current.refresh_token,
+                refresh_token=refresh_token,
             )
             return _session_from_payload(response_payload(response, 200))
         except (KeyError, TypeError, ValueError) as error:
@@ -1135,21 +1168,108 @@ class Auth:
 
     def sign_out(self) -> None:
         """Revoke and clear the current session."""
-        generation, current = self._client._capture_session()
+        binding = self._client._capture_session_binding()
+        if binding[2] is None:
+            binding[1].wait_for_sign_out()
+            return
+        notifications: list[Callable[[], None]] = []
+        try:
+            binding[1].sign_out(
+                lambda preceding, pending: self._sign_out_captured(
+                    binding, preceding, notifications, pending=pending
+                )
+            )
+        finally:
+            for dispatch in notifications:
+                dispatch()
+
+    def _sign_out_captured(
+        self,
+        binding: tuple[int, SessionOperations, Session | None],
+        preceding: Future[Session] | None,
+        notifications: list[Callable[[], None]],
+        *,
+        pending: bool,
+    ) -> None:
+        generation, owner, current = binding
+        refresh_error: VolcanoError | None = None
+        if preceding is not None:
+            try:
+                current = preceding.result()
+            except VolcanoError as caught:
+                refresh_error = caught
         if current is None:
             return
-        transport = cast("AuthLogoutTransport", self._client._transport)
         error: VolcanoError | None = None
         try:
-            response = invoke(
-                transport.auth_logout,
-                authorization=self._client._anon_token(),
-                refresh_token=current.refresh_token,
+            self._revoke_session(
+                current, owner, refresh_error if pending else None, joined=pending
             )
-            response_payload(response, 204)
         except VolcanoError as caught:
             error = caught
-        if not self._client._clear_session_if_current(generation):
+        if not self._client._clear_session_if_current(
+            generation, lineage=owner, notifications=notifications
+        ):
             raise SessionChangedError from error
         if error is not None:
             raise error
+
+    def _revoke_session(
+        self,
+        session: Session,
+        owner: SessionOperations,
+        refresh_error: VolcanoError | None,
+        *,
+        joined: bool,
+    ) -> None:
+        session_id = session_id_from_access_token(session.access_token)
+        verified = owner.has_verified_pair(session)
+        if session_id is not None and not verified:
+            self._revoke_access_session(
+                session, session_id, refresh_error, joined=joined
+            )
+            return
+        if refresh_error is not None and not verified:
+            raise refresh_error
+        if session.refresh_token is not None:
+            transport = cast("AuthLogoutTransport", self._client._transport)
+            response = invoke(
+                transport.auth_logout,
+                authorization=self._client._anon_token(),
+                refresh_token=session.refresh_token,
+            )
+        else:
+            return
+        response_payload(response, 204)
+
+    def _revoke_access_session(
+        self,
+        session: Session,
+        session_id: str,
+        refresh_error: VolcanoError | None,
+        *,
+        joined: bool,
+    ) -> None:
+        transport = cast("AuthDeleteMySessionTransport", self._client._transport)
+        response = invoke(
+            transport.auth_delete_my_session,
+            authorization=session.access_token,
+            session_id=session_id,
+        )
+        if (
+            response.status_code == HTTPStatus.UNAUTHORIZED
+            and session.refresh_token is not None
+        ):
+            if refresh_error is not None:
+                raise refresh_error
+            if joined:
+                response_payload(response, 204)
+                return
+            refreshed = self._request_refreshed_session(session.refresh_token)
+            validate_refresh_identity(session, refreshed)
+            response = invoke(
+                transport.auth_delete_my_session,
+                authorization=refreshed.access_token,
+                session_id=session_id,
+            )
+        response_payload(response, 204)

volcano_sdk/client.py

@@ -5,9 +5,11 @@ from __future__ import annotations
 import threading
 from collections import deque
 from dataclasses import replace
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, TypedDict, Unpack
 from uuid import UUID
 
+from ._session import validate_refresh_identity
+from ._session_operations import SessionOperations
 from ._transport import GeneratedTransport, Transport
 from .auth import Auth
 from .database import Database
@@ -32,6 +34,39 @@ if TYPE_CHECKING:
 _NO_ACTIVE_SESSION = "No active session"
 _NO_SERVICE_KEY = "No service key configured"
 _PROFILE_USER_MISMATCH = "Profile user does not match the active session"
+_BOOTSTRAP_ACCESS_REQUIRED = "refresh_token requires access_token"
+
+
+class _BootstrapCredentials(TypedDict, total=False):
+    access_token: str | None
+    refresh_token: str | None
+
+
+def _validate_bootstrap_credential(name: str, token: object) -> None:
+    if token is not None and (not isinstance(token, str) or not token.strip()):
+        message = f"{name} must be a non-empty string"
+        raise ValueError(message)
+
+
+def _bootstrap_session(
+    credentials: _BootstrapCredentials,
+) -> Session | None:
+    unknown = credentials.keys() - {"access_token", "refresh_token"}
+    if unknown:
+        message = f"Unexpected keyword argument: {next(iter(unknown))}"
+        raise TypeError(message)
+    access_token = credentials.get("access_token")
+    refresh_token = credentials.get("refresh_token")
+    if access_token is None:
+        if refresh_token is not None:
+            raise ValueError(_BOOTSTRAP_ACCESS_REQUIRED)
+        return None
+    for name, token in (
+        ("access_token", access_token),
+        ("refresh_token", refresh_token),
+    ):
+        _validate_bootstrap_credential(name, token)
+    return Session(access_token=access_token, refresh_token=refresh_token)
 
 
 class _CallbackOutcome:
@@ -65,6 +100,7 @@ class VolcanoClient:
         timeout: float = 60.0,
         _transport: Transport | None = None,
         _realtime_client_factory: CentrifugeFactory | None = None,
+        **credentials: Unpack[_BootstrapCredentials],
     ) -> None:
         """Create a client for a Volcano project."""
         self._api_url = api_url.rstrip("/")
@@ -72,8 +108,8 @@ class VolcanoClient:
         self._service_key = service_key
         self._session_lock = threading.Lock()
         self._session_generation = 0
-        self._session_lineage = 0
-        self._current_session: Session | None = None
+        self._session_lineage = SessionOperations()
+        self._current_session = _bootstrap_session(credentials)
         self._auth_callbacks: dict[int, AuthStateCallback] = {}
         self._next_auth_callback_id = 0
         self._auth_notifications: deque[
@@ -146,7 +182,7 @@ class VolcanoClient:
         with self._session_lock:
             self._current_session = session
             self._session_generation += 1
-            self._session_lineage += 1
+            self._session_lineage = SessionOperations()
             if event is None:
                 return
             callback_ids = tuple(self._auth_callbacks)
@@ -158,7 +194,7 @@ class VolcanoClient:
         with self._session_lock:
             return self._session_generation, self._current_session
 
-    def _capture_session_binding(self) -> tuple[int, int, Session | None]:
+    def _capture_session_binding(self) -> tuple[int, SessionOperations, Session | None]:
         with self._session_lock:
             return (
                 self._session_generation,
@@ -173,15 +209,16 @@ class VolcanoClient:
             current = self._current_session
             if generation != self._session_generation or current is None:
                 return False
+            user_id = str(user["id"]) if current.user_id is None else current.user_id
             try:
-                same_user = UUID(str(user["id"])) == UUID(current.user_id)
+                same_user = UUID(str(user["id"])) == UUID(user_id)
             except ValueError:
                 same_user = False
             if not same_user:
                 raise AuthenticationError(_PROFILE_USER_MISMATCH)
             # Profile updates do not replace credentials or invalidate other requests.
             self._current_session = replace(
-                current, user={**user, "id": current.user_id}
+                current, user_id=user_id, user={**user, "id": user_id}
             )
         return True
 
@@ -196,10 +233,12 @@ class VolcanoClient:
         with self._session_lock:
             if generation != self._session_generation:
                 return False
+            if event == "TOKEN_REFRESHED":
+                validate_refresh_identity(self._current_session, session)
             self._current_session = session
             self._session_generation += 1
             if event != "TOKEN_REFRESHED":
-                self._session_lineage += 1
+                self._session_lineage = SessionOperations(session)
             callback_ids = tuple(self._auth_callbacks)
             dispatch = self._enqueue_auth_state_change(callback_ids, event, session)
         if dispatch:
@@ -210,15 +249,21 @@ class VolcanoClient:
         self,
         generation: int,
         *,
+        lineage: SessionOperations | None = None,
         event: AuthChangeEvent = "SIGNED_OUT",
         notifications: list[Callable[[], None]] | None = None,
     ) -> bool:
         with self._session_lock:
-            if generation != self._session_generation:
+            if lineage is not None:
+                if lineage != self._session_lineage:
+                    return False
+            elif generation != self._session_generation:
                 return False
+            if self._current_session is None:
+                return True
             self._current_session = None
+            self._session_lineage.clear_local_credentials()
             self._session_generation += 1
-            self._session_lineage += 1
             callback_ids = tuple(self._auth_callbacks)
             dispatch = self._enqueue_auth_state_change(callback_ids, event, None)
         if dispatch:

volcano_sdk/models.py

@@ -84,11 +84,11 @@ class User:
 
 @dataclass(frozen=True, slots=True)
 class Session:
-    """Authenticated user session."""
+    """Local credentials with optional refresh credentials and user identity."""
 
     access_token: str
-    refresh_token: str
-    user_id: str
+    refresh_token: str | None = None
+    user_id: str | None = None
     user: Mapping[str, JSONValue] | None = field(default=None, repr=False, hash=False)
 
     def __post_init__(self) -> None:

volcano_sdk/realtime.py

@@ -25,6 +25,7 @@ from ._transport import (
 from .models import JSONValue, _freeze_json
 
 if TYPE_CHECKING:
+    from ._session_operations import SessionOperations
     from .models import Session
 
 MessageCallback = Callable[[Any], Any]
@@ -205,7 +206,7 @@ def _postgres_fetch_config(
 
 @dataclass(frozen=True, slots=True)
 class _PostgresDeliveryIdentity:
-    session_lineage: int
+    session_lineage: SessionOperations | None
     subscription_epoch: int
 
 
@@ -282,7 +283,9 @@ class RealtimeContext(Protocol):
 
     def _session_token(self) -> str: ...
 
-    def _capture_session_binding(self) -> tuple[int, int, Session | None]: ...
+    def _capture_session_binding(
+        self,
+    ) -> tuple[int, SessionOperations, Session | None]: ...
 
 
 class CentrifugeSubscription(Protocol):
@@ -608,7 +611,7 @@ class Channel:
         self._callback_task: asyncio.Task[None] | None = None
         self._pending_presence_sync: Any = NO_PENDING_CALLBACK
         self._postgres_epoch = 0
-        self._postgres_session_lineage = 0
+        self._postgres_session_lineage: SessionOperations | None = None
         self._postgres_lock = asyncio.Lock()
         self._postgres_worker: PostgresFetchWorker[_PostgresDelivery] | None = None
         self._postgres_filters: dict[
@@ -732,11 +735,12 @@ class Channel:
         self,
         identity: _PostgresDeliveryIdentity,
     ) -> bool:
-        _generation, lineage, _session = (
+        _generation, lineage, session = (
             self._realtime._client_context._capture_session_binding()
         )
         return (
             self._subscribed
+            and session is not None
             and identity.subscription_epoch == self._postgres_epoch
             and identity.session_lineage == lineage
         )
@@ -1161,7 +1165,7 @@ class Realtime:
         self._api_url = api_url
         self._client_factory = client_factory
         self._connection: _VolcanoCentrifugeConnection | None = None
-        self._connection_session_lineage: int | None = None
+        self._connection_session_lineage: SessionOperations | None = None
         self._connection_access_token: str | None = None
         self._connection_lock = asyncio.Lock()
         self._channels: dict[str, Channel] = {}
@@ -1401,7 +1405,7 @@ class Realtime:
         self._connection_access_token = session.access_token
         return session.access_token
 
-    def _session_for_lineage(self, expected_lineage: int) -> Session:
+    def _session_for_lineage(self, expected_lineage: SessionOperations) -> Session:
         _generation, lineage, session = self._client_context._capture_session_binding()
         if session is None:
             raise RuntimeError(NO_ACTIVE_SESSION)
@@ -1409,7 +1413,7 @@ class Realtime:
             raise RuntimeError(CONNECTION_SESSION_CHANGED)
         return session
 
-    def _connection_lineage(self) -> int:
+    def _connection_lineage(self) -> SessionOperations:
         lineage = self._connection_session_lineage
         if lineage is None:
             raise RuntimeError(CONNECTION_SESSION_UNAVAILABLE)

volcano_sdk/storage.py

@@ -35,6 +35,7 @@ from .models import (
 )
 
 if TYPE_CHECKING:
+    from ._session_operations import SessionOperations
     from .auth import Auth
 
 _INVALID_STORAGE_PAGE = "Expected a complete storage page"
@@ -292,7 +293,9 @@ class StorageContext(Protocol):
 
     def _session_token(self) -> str: ...
 
-    def _capture_session_binding(self) -> tuple[int, int, Session | None]: ...
+    def _capture_session_binding(
+        self,
+    ) -> tuple[int, SessionOperations, Session | None]: ...
 
 
 class StorageListTransport(Protocol):
@@ -707,7 +710,9 @@ class StorageBucket:
             self._remove_path(path, binding)
         return path_list
 
-    def _remove_path(self, path: str, binding: tuple[int, int, Session | None]) -> None:
+    def _remove_path(
+        self, path: str, binding: tuple[int, SessionOperations, Session | None]
+    ) -> None:
         transport = cast("StorageDeleteTransport", self._client._transport)
         response = self._client.auth._session_request(
             lambda token: invoke(

{volcano_sdk_python-0.8.0.dist-info → volcano_sdk_python-0.9.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: volcano-sdk-python
-Version: 0.8.0
+Version: 0.9.1
 Summary: Official Python SDK for Volcano
 Project-URL: Homepage, https://volcano.dev
 Project-URL: Repository, https://github.com/Kong/volcano-sdk-python
@@ -593,6 +593,14 @@ Success returns `None`. The reset revokes the recovered account's existing sessi
 sign it in. The client keeps any unrelated local session unchanged; sign in with the new password
 when the reset flow completes.
 
+To start with only a supplied user access token, pass `access_token` to
+`VolcanoClient`. Construction makes no request and leaves `refresh_token`,
+`user_id`, and `user` as `None` until supplied or validated by the server.
+`get_user()` validates and caches the profile without changing credentials.
+Without a refresh token, `refresh_session()` raises `AuthenticationError` and
+`sign_out()` revokes the server session using the access token and clears local state.
+Supply `refresh_token` with `access_token` to enable refresh. See the [token bootstrap example](https://github.com/Kong/volcano-sdk-python/blob/main/docs/README.md#use-a-supplied-access-token).
+
 Copy a complete native session into another client's memory:
 
 ```python
@@ -650,9 +658,13 @@ client.auth.sign_out()
 assert client.auth.get_session() is None
 ```
 
+Sign-out uses the refresh token directly when the SDK received both credentials together from
+sign-in or a validated refresh. Supplied credentials use the access-token session; on HTTP 401,
+the SDK can refresh once and revoke that same session without adopting the renewed credentials.
 Calling `sign_out()` without a session succeeds without a request. A revocation failure is raised
-after the captured local session is cleared. A newer session established while sign-out is in
-flight remains current.
+after the captured local session is cleared. Sign-out waits for an already-running refresh and uses its validated credentials.
+Later refresh attempts raise `SessionChangedError` without a request. Concurrent sign-out calls
+share one result. A separate sign-in or adoption remains current.
 
 Realtime is async. Channels wrap `centrifuge-python`; the underlying client and
 subscription objects are not part of the public API.

{volcano_sdk_python-0.8.0.dist-info → volcano_sdk_python-0.9.1.dist-info}/RECORD

@@ -4,19 +4,21 @@ volcano_sdk/_lock_guard.py,sha256=VhHTgBc4e5EDj8j15vVIhdBOTp6fvD628x3hVBeF39o,57
 volcano_sdk/_lock_renewer.py,sha256=tFo1ZeRiPKB5VSbW61uoMpNR67ZDYyMEe-dCjpAM3As,841
 volcano_sdk/_lock_worker.py,sha256=QhSmwR0WcwgT-7ueJMlbCogLqOakQ5eRAtyWV74fgV0,3057
 volcano_sdk/_realtime_fetch_worker.py,sha256=zQTgFF4cIUBeAL4J2OpWAlz_sIynv2BLfu588EogAdo,9269
+volcano_sdk/_session.py,sha256=LYCv2NCDlL5Slh2YLEG8VQ8z-kDaKDYWW4vGdMvUf1U,2474
+volcano_sdk/_session_operations.py,sha256=1vI9gtwjxG2eUGT-nIYnMEgRldJqgIj2lRLukBbG64E,5518
 volcano_sdk/_transport.py,sha256=AFd47C3X1WAHwq3f9V2ux0WNzwGIn4NBxrwgaIN-xl0,58296
-volcano_sdk/auth.py,sha256=Z5UCrqdvmHBS6n6ZleXya04hYV94rH4SRV1GW2yimXo,43185
-volcano_sdk/client.py,sha256=KutjBUOEJyK73OibKilrcWazpWeXKEZYUehSAH8qxUE,10366
+volcano_sdk/auth.py,sha256=iKq8o0K8geVKXrnLzhvOjAQoX_Nd0yQDJqDH4bemWaM,47366
+volcano_sdk/client.py,sha256=CJJnf_iTcXnyY2Y57LXJVAn39mTUsepblUg9op-Thzo,12283
 volcano_sdk/connection_string.py,sha256=LlTZigsrCF4IfAqQ8SDTWJv35hnnzNu1MfeVv5JW-Kk,2331
 volcano_sdk/database.py,sha256=p_5OaqlBjKAtIUfKQCflXM_CGqokrVmpOMsp6KHiJ8A,9493
 volcano_sdk/errors.py,sha256=ffs66FIN_jhyh5SMj7KdXb-zVV3DSgVK6xJEPNA5h9Y,1613
 volcano_sdk/functions.py,sha256=zDeAKyCieNnI6wzb9iZMlg9_cbjaYWXYbXHb7jzCle4,10126
 volcano_sdk/locks.py,sha256=eSkidfHQ_wml5-1LT2hBtHxeALP6E1cGYK0FzHjbrNk,9241
 volcano_sdk/logs.py,sha256=lxORRQBvsnJ0BdMau19MXrIeig5_mEucQSyJ4F1CZxU,4666
-volcano_sdk/models.py,sha256=43zM6LQ9eJ3Hn6q9PiVSozSmOzPSr4m4OL8G8KVb-gg,8619
+volcano_sdk/models.py,sha256=n5EdzkWzmOstXsuFlvfGOILRemQAqG2P4VCLMelW8SA,8690
 volcano_sdk/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
-volcano_sdk/realtime.py,sha256=VkxZyrC7PlddnCSv8wBBLVg4nPWjpyuGo1FoBWhpf6M,59295
-volcano_sdk/storage.py,sha256=1bAgzGO-dhUCVG8B-5x40jenHeh68Id2csIJF57KSGk,26126
+volcano_sdk/realtime.py,sha256=3p5ueLCeveaR4_ItqlLv-exkMCODqxDQNHj1aYB_YE4,59506
+volcano_sdk/storage.py,sha256=p16OV5ADI6JjMAJ7gx2gcmwk9t8--YiIZcOSLQLVlDY,26238
 volcano_sdk/_generated/__init__.py,sha256=ZlB8wMYdN6EjpUS5W_lX3jsxq9G1kOcmUr-j3Fccfn8,164
 volcano_sdk/_generated/client.py,sha256=GDzw6T2uRmPlUb1DImpBGxwy0dNbhmBknfvvIQW0GuU,12387
 volcano_sdk/_generated/errors.py,sha256=trp-p5qn1_JLRxGZhdHtICaNPaCrcDCe4TgIihBravk,546
@@ -773,7 +775,7 @@ volcano_sdk/_generated/models/usage_data_point.py,sha256=d4U08JbVTiIMM_l2BmRILL1
 volcano_sdk/_generated/models/variable.py,sha256=tvGDOMv77gW6j5skufnfrlNAhzCzA1F7nuPCQWx79yY,5926
 volcano_sdk/_generated/models/variable_deploy_source.py,sha256=G_aCiFHzQx8WhJFs0GvYZEFclfTrfkDvd3kT1e3vty8,463
 volcano_sdk/_generated/models/variable_status.py,sha256=THSsKBSiAYG4kAtBzGA4TZqxjgx8hdL0Q4qCdZfOj00,391
-volcano_sdk_python-0.8.0.dist-info/METADATA,sha256=lJ43KIGGSaMGAsRRM_EqJYI9AJXnEibMrg9CqElZU78,34010
-volcano_sdk_python-0.8.0.dist-info/WHEEL,sha256=THafob7ofN-NsuMN7Mg4qZyHaQI7KkD-QlcQatYhXPo,87
-volcano_sdk_python-0.8.0.dist-info/licenses/LICENSE,sha256=AIHJy-5MFqM8fHfuGFTTb9a8rvJGypcVgN4aZ-7XTWw,11387
-volcano_sdk_python-0.8.0.dist-info/RECORD,,
+volcano_sdk_python-0.9.1.dist-info/METADATA,sha256=zPhzqaYqvRyeIoZlgMAlmRbvskDedIxy6kclHDME__4,35125
+volcano_sdk_python-0.9.1.dist-info/WHEEL,sha256=THafob7ofN-NsuMN7Mg4qZyHaQI7KkD-QlcQatYhXPo,87
+volcano_sdk_python-0.9.1.dist-info/licenses/LICENSE,sha256=AIHJy-5MFqM8fHfuGFTTb9a8rvJGypcVgN4aZ-7XTWw,11387
+volcano_sdk_python-0.9.1.dist-info/RECORD,,