wherobots-python-sdk 0.5.1__tar.gz → 0.7.0__tar.gz

{wherobots_python_sdk-0.5.1/wherobots_python_sdk.egg-info → wherobots_python_sdk-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wherobots-python-sdk
-Version: 0.5.1
+Version: 0.7.0
 Summary: Python SDK for Wherobots (currently covers the Jobs REST API)
 Author-email: Wherobots <support@wherobots.com>
 License-Expression: Apache-2.0
@@ -13,22 +13,21 @@ Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.10
+Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.34.2
-Requires-Dist: boto3>=1.43.108
+Requires-Dist: boto3>=1.34.0
 Dynamic: license-file
 
 # Wherobots Python SDK
 
 [![CI](https://github.com/wherobots/wherobots-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/wherobots/wherobots-python-sdk/actions/workflows/ci.yml)
-[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![Version](https://img.shields.io/pypi/v/wherobots-python-sdk?color=orange)](https://pypi.org/project/wherobots-python-sdk/)
 
@@ -46,6 +45,7 @@ Additional Wherobots surfaces will be added over time.
 - Typed dataclass models for all API responses (no pydantic dependency)
 - Environment-based configuration
 - Files: list, create folders, upload, download, rename and delete in your Wherobots file area
+- Tasks: list and run tasks such as RasterFlow inference, then follow their runs, logs and cost
 
 ## Installation
 
@@ -118,18 +118,27 @@ job = WherobotsJob(
 
 The API key can also be set via the `WHEROBOTS_API_KEY` environment variable.
 
+Inside a Wherobots notebook or job, no API key is needed. The SDK authenticates as the user who
+launched the workload, using the token Wherobots mounts in the pod. An API key, when set, takes
+precedence.
+
+```python
+job = WherobotsJob(script="s3://bucket/script.py", name="my-job-001")
+```
+
 ## Configuration
 
 ### Environment Variables
 
 | Variable                           | Description                     | Default                              |
 |------------------------------------|---------------------------------|--------------------------------------|
-| `WHEROBOTS_API_KEY`                | API key                         | *(required)*                         |
+| `WHEROBOTS_API_KEY`                | API key                         | *(required outside Wherobots)*       |
 | `WHEROBOTS_REGION`                 | Region override (else org default) | *(none — org default)*            |
 | `WHEROBOTS_API_BASE_URL`          | API base URL                    | `https://api.cloud.wherobots.com`    |
 | `WHEROBOTS_VERSION`               | Wherobots version               | `latest`                             |
 | `WHEROBOTS_REQUEST_TIMEOUT_SECONDS`| HTTP request timeout (seconds) | `30`                                 |
 | `WHEROBOTS_CLIENT_CHAIN`           | Upstream client-attribution chain (see below) | *(none)*              |
+| `WHEROBOTS_ID_TOKEN_PATH`          | Workload identity token, set by Wherobots notebooks and jobs | *(none)* |
 
 ### WherobotsConfig
 
@@ -456,12 +465,53 @@ with wherobots.Wherobots() as wb:
 | Failure | Raised as |
 |---|---|
 | Files is not enabled for this drive in this region | `WherobotsFilesNotEnabledError` (`.drive`, `.region`) |
-| The API key was not accepted | `WherobotsNotAuthenticatedError` |
+| The credentials were not accepted | `WherobotsNotAuthenticatedError` |
 | No such file or folder | `WherobotsFileNotFoundError` |
 | Transfer to or from storage failed | `WherobotsS3Error` |
 
 The three `Wherobots*Error` classes above subclass `WherobotsAPIError`.
 
+## Tasks
+
+A task is a named unit of work, such as RasterFlow inference, that your organization can run.
+`wb.tasks` lists and runs tasks; `wb.task_runs` follows the runs. Tasks need the Runs feature on
+your organization.
+
+```python
+import time
+
+import wherobots
+
+with wherobots.Wherobots() as wb:
+    for task in wb.tasks.list().items:
+        print(task.name, task.display_name, task.regions)
+
+    task = wb.tasks.get("my-task")
+    print(task.input_schema)  # JSON Schema the inputs must satisfy
+
+    started = wb.tasks.run("my-task", {"aoi": "s3://bucket/aoi.geojson"}, name="nightly")
+    run = wb.task_runs.get(started.task_run_id)
+    while run.is_active:
+        time.sleep(10)
+        run = wb.task_runs.get(run.task_run_id)
+
+    print(run.state, run.results, run.error_message)
+    print(wb.task_runs.logs(run.task_run_id).entries)
+    print(wb.task_runs.cost(run.task_run_id).total_cost_usd)
+```
+
+- `tasks.run` uses `region=` if passed, then the configured region, then your organization's
+  default region.
+- Listings return an `OffsetPage`; pass `page.next_offset` as `offset=` for the next one.
+- `TaskRunState.is_active` is `True` for `PENDING`, `SUBMITTED`, `RUNNING` and `CANCELLING`. A
+  state the SDK does not know yet is kept as its raw string and counts as not active, so a
+  polling loop stops on it.
+- A run's state can lag the run by up to 2 minutes.
+- `task_runs.logs` pages forward: pass the previous page's `next_since` as `since=`. It is `None`
+  once the run has finished and every line has been returned.
+- `task_runs.cost` can take up to 45 minutes after a run ends to settle; `is_settling` stays
+  `True` until then.
+
 ## Enums
 
 ### JobStatus
@@ -632,7 +682,7 @@ All exceptions inherit from `WherobotsJobError`.
 | `WherobotsS3Error`         | A transfer to or from storage failed, including Files presigned uploads and downloads. |
 | `WherobotsConfigError`     | Configuration is missing or invalid.                 |
 | `WherobotsTimeoutError`    | Job exceeded the specified timeout.                  |
-| `WherobotsNotAuthenticatedError` | Files: the API key was not accepted (HTTP 401). Subclass of `WherobotsAPIError`. |
+| `WherobotsNotAuthenticatedError` | Files: the credentials were not accepted (HTTP 401). In a Wherobots pod: the workload identity token exchange failed. Subclass of `WherobotsAPIError`. |
 | `WherobotsFilesNotEnabledError` | Files is not enabled for a drive in a region. Has `drive`, `region`. Subclass of `WherobotsAPIError`. |
 | `WherobotsFileNotFoundError` | Files: no such file or folder. Subclass of `WherobotsAPIError`. |
 
@@ -689,6 +739,14 @@ To set up a Storage Integration, follow the
 | GET    | `/runs/{id}/logs`      | Get run logs       |
 | GET    | `/runs/{id}/metrics`   | Get run metrics    |
 | GET    | `/runs`                | List runs          |
+| GET    | `/tasks`               | List tasks         |
+| GET    | `/tasks/{name}`        | Get a task         |
+| POST   | `/tasks/{name}/runs`   | Run a task         |
+| GET    | `/task-runs`           | List task runs     |
+| GET    | `/task-runs/{id}`      | Get a task run     |
+| GET    | `/task-runs/{id}/logs` | Get task run logs  |
+| GET    | `/task-runs/{id}/cost` | Get task run cost  |
+| POST   | `/task-runs/{id}/cancel` | Cancel a task run |
 
 Base URL: `https://api.cloud.wherobots.com`
 

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/README.md

@@ -1,7 +1,7 @@
 # Wherobots Python SDK
 
 [![CI](https://github.com/wherobots/wherobots-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/wherobots/wherobots-python-sdk/actions/workflows/ci.yml)
-[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![Python](https://img.shields.io/badge/python-3.11%2B-blue)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 [![Version](https://img.shields.io/pypi/v/wherobots-python-sdk?color=orange)](https://pypi.org/project/wherobots-python-sdk/)
 
@@ -19,6 +19,7 @@ Additional Wherobots surfaces will be added over time.
 - Typed dataclass models for all API responses (no pydantic dependency)
 - Environment-based configuration
 - Files: list, create folders, upload, download, rename and delete in your Wherobots file area
+- Tasks: list and run tasks such as RasterFlow inference, then follow their runs, logs and cost
 
 ## Installation
 
@@ -91,18 +92,27 @@ job = WherobotsJob(
 
 The API key can also be set via the `WHEROBOTS_API_KEY` environment variable.
 
+Inside a Wherobots notebook or job, no API key is needed. The SDK authenticates as the user who
+launched the workload, using the token Wherobots mounts in the pod. An API key, when set, takes
+precedence.
+
+```python
+job = WherobotsJob(script="s3://bucket/script.py", name="my-job-001")
+```
+
 ## Configuration
 
 ### Environment Variables
 
 | Variable                           | Description                     | Default                              |
 |------------------------------------|---------------------------------|--------------------------------------|
-| `WHEROBOTS_API_KEY`                | API key                         | *(required)*                         |
+| `WHEROBOTS_API_KEY`                | API key                         | *(required outside Wherobots)*       |
 | `WHEROBOTS_REGION`                 | Region override (else org default) | *(none — org default)*            |
 | `WHEROBOTS_API_BASE_URL`          | API base URL                    | `https://api.cloud.wherobots.com`    |
 | `WHEROBOTS_VERSION`               | Wherobots version               | `latest`                             |
 | `WHEROBOTS_REQUEST_TIMEOUT_SECONDS`| HTTP request timeout (seconds) | `30`                                 |
 | `WHEROBOTS_CLIENT_CHAIN`           | Upstream client-attribution chain (see below) | *(none)*              |
+| `WHEROBOTS_ID_TOKEN_PATH`          | Workload identity token, set by Wherobots notebooks and jobs | *(none)* |
 
 ### WherobotsConfig
 
@@ -429,12 +439,53 @@ with wherobots.Wherobots() as wb:
 | Failure | Raised as |
 |---|---|
 | Files is not enabled for this drive in this region | `WherobotsFilesNotEnabledError` (`.drive`, `.region`) |
-| The API key was not accepted | `WherobotsNotAuthenticatedError` |
+| The credentials were not accepted | `WherobotsNotAuthenticatedError` |
 | No such file or folder | `WherobotsFileNotFoundError` |
 | Transfer to or from storage failed | `WherobotsS3Error` |
 
 The three `Wherobots*Error` classes above subclass `WherobotsAPIError`.
 
+## Tasks
+
+A task is a named unit of work, such as RasterFlow inference, that your organization can run.
+`wb.tasks` lists and runs tasks; `wb.task_runs` follows the runs. Tasks need the Runs feature on
+your organization.
+
+```python
+import time
+
+import wherobots
+
+with wherobots.Wherobots() as wb:
+    for task in wb.tasks.list().items:
+        print(task.name, task.display_name, task.regions)
+
+    task = wb.tasks.get("my-task")
+    print(task.input_schema)  # JSON Schema the inputs must satisfy
+
+    started = wb.tasks.run("my-task", {"aoi": "s3://bucket/aoi.geojson"}, name="nightly")
+    run = wb.task_runs.get(started.task_run_id)
+    while run.is_active:
+        time.sleep(10)
+        run = wb.task_runs.get(run.task_run_id)
+
+    print(run.state, run.results, run.error_message)
+    print(wb.task_runs.logs(run.task_run_id).entries)
+    print(wb.task_runs.cost(run.task_run_id).total_cost_usd)
+```
+
+- `tasks.run` uses `region=` if passed, then the configured region, then your organization's
+  default region.
+- Listings return an `OffsetPage`; pass `page.next_offset` as `offset=` for the next one.
+- `TaskRunState.is_active` is `True` for `PENDING`, `SUBMITTED`, `RUNNING` and `CANCELLING`. A
+  state the SDK does not know yet is kept as its raw string and counts as not active, so a
+  polling loop stops on it.
+- A run's state can lag the run by up to 2 minutes.
+- `task_runs.logs` pages forward: pass the previous page's `next_since` as `since=`. It is `None`
+  once the run has finished and every line has been returned.
+- `task_runs.cost` can take up to 45 minutes after a run ends to settle; `is_settling` stays
+  `True` until then.
+
 ## Enums
 
 ### JobStatus
@@ -605,7 +656,7 @@ All exceptions inherit from `WherobotsJobError`.
 | `WherobotsS3Error`         | A transfer to or from storage failed, including Files presigned uploads and downloads. |
 | `WherobotsConfigError`     | Configuration is missing or invalid.                 |
 | `WherobotsTimeoutError`    | Job exceeded the specified timeout.                  |
-| `WherobotsNotAuthenticatedError` | Files: the API key was not accepted (HTTP 401). Subclass of `WherobotsAPIError`. |
+| `WherobotsNotAuthenticatedError` | Files: the credentials were not accepted (HTTP 401). In a Wherobots pod: the workload identity token exchange failed. Subclass of `WherobotsAPIError`. |
 | `WherobotsFilesNotEnabledError` | Files is not enabled for a drive in a region. Has `drive`, `region`. Subclass of `WherobotsAPIError`. |
 | `WherobotsFileNotFoundError` | Files: no such file or folder. Subclass of `WherobotsAPIError`. |
 
@@ -662,6 +713,14 @@ To set up a Storage Integration, follow the
 | GET    | `/runs/{id}/logs`      | Get run logs       |
 | GET    | `/runs/{id}/metrics`   | Get run metrics    |
 | GET    | `/runs`                | List runs          |
+| GET    | `/tasks`               | List tasks         |
+| GET    | `/tasks/{name}`        | Get a task         |
+| POST   | `/tasks/{name}/runs`   | Run a task         |
+| GET    | `/task-runs`           | List task runs     |
+| GET    | `/task-runs/{id}`      | Get a task run     |
+| GET    | `/task-runs/{id}/logs` | Get task run logs  |
+| GET    | `/task-runs/{id}/cost` | Get task run cost  |
+| POST   | `/task-runs/{id}/cancel` | Cancel a task run |
 
 Base URL: `https://api.cloud.wherobots.com`
 

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=83.0.0", "wheel"]
+requires = ["setuptools>=84.2.1", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -7,7 +7,7 @@ name = "wherobots-python-sdk"
 dynamic = ["version"]
 description = "Python SDK for Wherobots (currently covers the Jobs REST API)"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 license = "Apache-2.0"
 authors = [
     {name = "Wherobots", email = "support@wherobots.com"}
@@ -17,7 +17,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -26,7 +25,7 @@ classifiers = [
 keywords = ["wherobots", "spark", "sedona", "geospatial", "jobs", "sdk", "rest-api"]
 dependencies = [
     "requests>=2.34.2",
-    "boto3>=1.43.108",
+    "boto3>=1.34.0",
 ]
 
 [project.urls]
@@ -38,17 +37,17 @@ Documentation = "https://docs.wherobots.com"
 # PEP 735 dev dependencies — installed with `uv sync --group dev`.
 [dependency-groups]
 dev = [
-    "pytest>=9.1.1",
-    "pytest-cov>=7.1.0",
-    "pytest-mock>=3.16.0",
-    "ruff>=0.16.10,<0.17",
-    "pyrefly>=1.3.2",
-    "import-linter>=2.15",
-    "pre-commit>=4.6.2",
-    "hypothesis>=6.168.4",
-    "cosmic-ray>=8.7.0",
-    "ast-grep-cli>=0.45.3",
-    "types-requests>=2.33.0.20260906",
+    "pytest==9.1.1",
+    "pytest-cov==7.1.0",
+    "pytest-mock==3.17.0",
+    "ruff==0.17.3",
+    "pyrefly==1.4.0",
+    "import-linter==2.15",
+    "pre-commit==4.7.0",
+    "hypothesis==6.170.12",
+    "cosmic-ray==8.7.0",
+    "ast-grep-cli==0.51.0",
+    "types-requests==2.33.0.20261006",
 ]
 
 [tool.setuptools.packages.find]
@@ -60,12 +59,14 @@ wherobots = ["py.typed"]
 [tool.setuptools.dynamic]
 version = {attr = "wherobots.__version__.__version__"}
 
-# SLOP REPELLANT ruff rail: line-length 100, py310 target, select = ["ALL"]
-# plus the typing.Any/typing.cast ban all come from the base config.
+# SLOP REPELLANT ruff rail: line-length 100, select = ["ALL"] and the
+# typing.Any/typing.cast ban come from the base config. The base targets
+# py310 (the kit's floor); this project overrides it to its own py311 floor.
 # NOTE: `lint.select`/`lint.ignore` would REPLACE the base's — tune only via
 # the extend-* keys.
 [tool.ruff]
 extend = ".slop-repellant/ruff-base.toml"
+target-version = "py311"
 # .slop-repellant/ is vendored, kit-MANAGED tooling (re-rendered on
 # slop-repellant-update) — linting it locally would fork the managed files.
 extend-exclude = ["env", ".venv", "venv", "build", "dist", ".slop-repellant"]

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/tests/test_base_client.py

@@ -158,17 +158,70 @@ class TestClientAttributionHeader:
 
 
 class TestClientConfigValidation:
-    def test_missing_api_key_raises(self):
+    def test_missing_credentials_raises(self):
         cfg = WherobotsConfig(api_key=None)
-        with pytest.raises(WherobotsConfigError, match="API key required"):
+        with pytest.raises(WherobotsConfigError, match="No Wherobots credentials found"):
             BaseClient(cfg)
 
     def test_empty_api_key_raises(self):
-        cfg = WherobotsConfig(api_key="")
-        with pytest.raises(WherobotsConfigError, match="API key required"):
+        cfg = WherobotsConfig(api_key="  ")
+        with pytest.raises(WherobotsConfigError, match="No Wherobots credentials found"):
             BaseClient(cfg)
 
 
+# ---------------------------------------------------------------------------
+# Credential selection
+# ---------------------------------------------------------------------------
+
+
+class TestCredentialSelection:
+    @patch("wherobots.api.base.requests.Session")
+    def test_api_key_wins_over_workload_identity(self, MockSession):
+        session = MockSession.return_value
+        session.headers = {}
+        session.auth = None
+
+        BaseClient(
+            WherobotsConfig(
+                api_key="test-key",
+                id_token_path="/var/run/secrets/wherobots/id-token",
+                base_url="https://api.test.wherobots.com",
+            )
+        )
+
+        assert session.headers["X-API-Key"] == "test-key"
+        assert session.auth is None
+
+    @pytest.mark.parametrize("api_key", [None, "  "])
+    @patch("wherobots.api.workload_auth.requests.post")
+    @patch("requests.adapters.HTTPAdapter.send")
+    def test_workload_identity_without_api_key(self, mock_send, mock_post, api_key, tmp_path):
+        id_token = tmp_path / "id-token"
+        id_token.write_text("wid-token", encoding="utf-8")
+        exchange = MagicMock(status_code=200)
+        exchange.json.return_value = {"access_token": "access-1", "expires_in": 3600}
+        mock_post.return_value = exchange
+        api_response = requests.Response()
+        api_response.status_code = 200
+        mock_send.return_value = api_response
+
+        client = BaseClient(
+            WherobotsConfig(
+                api_key=api_key,
+                id_token_path=str(id_token),
+                base_url="https://api.test.wherobots.com/",
+                request_timeout_seconds=12,
+            )
+        )
+        client.get("/runs")
+
+        sent = mock_send.call_args.args[0]
+        assert sent.headers["Authorization"] == "Bearer access-1"
+        assert "X-API-Key" not in sent.headers
+        assert mock_post.call_args.args == ("https://api.test.wherobots.com/ste/oauth2/token",)
+        assert mock_post.call_args.kwargs["timeout"] == 12
+
+
 # ---------------------------------------------------------------------------
 # Request error wrapping
 # ---------------------------------------------------------------------------

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/tests/test_config.py

@@ -88,6 +88,7 @@ class TestFromEnv:
             "WHEROBOTS_VERSION",
             "WHEROBOTS_REQUEST_TIMEOUT_SECONDS",
             "WHEROBOTS_CLIENT_CHAIN",
+            "WHEROBOTS_ID_TOKEN_PATH",
         ]:
             monkeypatch.delenv(var, raising=False)
 
@@ -100,6 +101,7 @@ class TestFromEnv:
         assert cfg.version == "latest"
         assert cfg.request_timeout_seconds == 30
         assert cfg.client_chain is None
+        assert cfg.id_token_path is None
 
     def test_from_env_timeout_override(self, monkeypatch):
         monkeypatch.delenv("WHEROBOTS_REQUEST_TIMEOUT_SECONDS", raising=False)
@@ -116,6 +118,16 @@ class TestFromEnv:
         cfg = WherobotsConfig.from_env(client_chain="client=mcp;ver=0.9")
         assert cfg.client_chain == "client=mcp;ver=0.9"
 
+    def test_blank_explicit_api_key_falls_back_to_env(self, monkeypatch):
+        monkeypatch.setenv("WHEROBOTS_API_KEY", "env-key")
+        cfg = WherobotsConfig.from_env(api_key="  ")
+        assert cfg.api_key == "env-key"
+
+    def test_id_token_path_from_env(self, monkeypatch):
+        monkeypatch.setenv("WHEROBOTS_ID_TOKEN_PATH", "/var/run/secrets/wherobots/id-token")
+        cfg = WherobotsConfig.from_env()
+        assert cfg.id_token_path == "/var/run/secrets/wherobots/id-token"
+
 
 # ---------------------------------------------------------------------------
 # Frozen

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/tests/test_files_api.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import logging
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -14,7 +14,11 @@ from wherobots.api.files import (
     _validate_filename,
 )
 from wherobots.config import WherobotsConfig
-from wherobots.exceptions import WherobotsAPIError, WherobotsValidationError
+from wherobots.exceptions import (
+    WherobotsAPIError,
+    WherobotsNotAuthenticatedError,
+    WherobotsValidationError,
+)
 from wherobots.models import StorageIntegration, TemporaryAwsCredentials
 
 # ---------------------------------------------------------------------------
@@ -45,7 +49,7 @@ def files_api(mock_env):
 @pytest.fixture
 def creds_payload():
     """Sample TemporaryAwsCredentials JSON, well in the future."""
-    expiry = (datetime.now(timezone.utc) + timedelta(hours=1)).isoformat()
+    expiry = (datetime.now(UTC) + timedelta(hours=1)).isoformat()
     return {
         "accessKeyId": "ASIAEXAMPLE0001",
         "secretAccessKey": "supersecretvaluedoNotleak",
@@ -110,6 +114,15 @@ class TestGetStorageCredentials:
         with pytest.raises(WherobotsAPIError, match="Invalid JSON"):
             api.get_storage_credentials("s3://x/y")
 
+    def test_workload_token_exchange_failure_passes_through(self, files_api):
+        api, session = files_api
+        session.request.side_effect = WherobotsNotAuthenticatedError(
+            "Workload identity token exchange was rejected (status 401): Session is expired"
+        )
+
+        with pytest.raises(WherobotsNotAuthenticatedError, match="Session is expired"):
+            api.get_storage_credentials("s3://x/y")
+
     def test_default_access_mode_is_read(self, files_api, creds_payload):
         """Least-privilege default: public callers get read-only creds unless
         they explicitly opt into read_write. The SDK's upload paths pass

{wherobots_python_sdk-0.5.1 → wherobots_python_sdk-0.7.0}/tests/test_models.py

@@ -987,7 +987,7 @@ class TestStorageIntegrationTypes:
 # ---------------------------------------------------------------------------
 
 
-from datetime import datetime, timedelta, timezone  # noqa: E402
+from datetime import UTC, datetime, timedelta  # noqa: E402
 
 
 class TestTemporaryAwsCredentials:
@@ -1006,7 +1006,7 @@ class TestTemporaryAwsCredentials:
         assert creds.expiration.year == 2026
 
     def test_is_expired_true_for_past(self):
-        past = datetime.now(timezone.utc) - timedelta(seconds=1)
+        past = datetime.now(UTC) - timedelta(seconds=1)
         creds = TemporaryAwsCredentials(
             access_key_id="ASIA1234",
             secret_access_key="s",
@@ -1018,7 +1018,7 @@ class TestTemporaryAwsCredentials:
 
     def test_is_expired_respects_leeway(self):
         # 30s in the future, leeway 60s ⇒ considered expired.
-        soon = datetime.now(timezone.utc) + timedelta(seconds=30)
+        soon = datetime.now(UTC) + timedelta(seconds=30)
         creds = TemporaryAwsCredentials(
             access_key_id="ASIA1234",
             secret_access_key="s",
@@ -1034,7 +1034,7 @@ class TestTemporaryAwsCredentials:
             access_key_id="ASIAEXAMPLE1234",
             secret_access_key="ULTRASECRETzzzzzzzz",
             session_token="TOKEN_payload_here",
-            expiration=datetime(2026, 1, 1, tzinfo=timezone.utc),
+            expiration=datetime(2026, 1, 1, tzinfo=UTC),
             region="us-west-2",
         )
         rendered = repr(creds)