worldarray 0.10.1__tar.gz → 0.10.2__tar.gz

{worldarray-0.10.1 → worldarray-0.10.2}/.github/workflows/ci.yml

@@ -3,6 +3,8 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    - cron: "0 6 * * 1"  # weekly, so a new dependency release is tried without a push
 jobs:
   test:
     strategy:
@@ -20,3 +22,17 @@ jobs:
       - run: uv run ruff format --check src tests
       - run: uv run pytest -q
       - run: uv run mkdocs build --strict
+  # what a fresh install gets: the newest release of every dependency, not the lock's
+  newest:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --group dev --upgrade
+      - run: uv pip list | grep -E "^(tensorstore|numpy) "
+      - run: uv run pytest -q

{worldarray-0.10.1 → worldarray-0.10.2}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.10.2 (2026-11-13)
+
+0.10.1's fix, on tensorstore 0.1.86. No placement change, no unit table change, and no
+default changes.
+
+- A `gs://` open with a stale Google login falls back to the public https URL on
+  tensorstore 0.1.86 too. 0.10.1 knew the failed login by the source locations in
+  tensorstore's error, which 0.1.86 leaves out, so with the newest tensorstore (what a
+  fresh install gets) the open still raised. The token endpoint's own error code
+  (`invalid_grant`, and the other OAuth 2.0 codes) is now matched as well. On 0.1.86 a
+  token endpoint out of reach is raised as any unreachable host is, not passed over.
+- CI also runs the tests on the newest release of every dependency, weekly and on every
+  pull request; 0.10.1 passed on the lock's tensorstore 0.1.78.
+
 ## 0.10.1 (2026-11-13)
 
 A fix for `gs://` with a stale Google login. No placement change, no unit table change,

{worldarray-0.10.1 → worldarray-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: worldarray
-Version: 0.10.1
+Version: 0.10.2
 Summary: Read zarr, N5 and Neuroglancer precomputed volumes in world coordinates through tensorstore: correct voxel placement, pyramid levels, padded region reads, resampling. numpy + tensorstore only.
 Project-URL: Homepage, https://janeliascicomp.github.io/worldarray/
 Project-URL: Documentation, https://janeliascicomp.github.io/worldarray/

{worldarray-0.10.1 → worldarray-0.10.2}/docs/spec.md

@@ -540,10 +540,13 @@ this document and that one differ, fix one of them.
    is read as that unit on every axis; tensorstore is given only the array members of
    `attributes.json`, so attributes it would reject do not stop the open. The next way is tried only when the error
    starts `PERMISSION_DENIED` or `UNAUTHENTICATED`, or came from getting an access token,
-   which tensorstore marks with its `internal/oauth2/` code among the error's source
-   locations (0.10.1): Google refuses an expired gcloud login with HTTP 400 `invalid_grant`,
+   which tensorstore up to 0.1.85 marks with its `internal/oauth2/` code among the error's
+   source locations (0.10.1), and which is otherwise known by the token endpoint's own error
+   code, an OAuth 2.0 one (RFC 6749 §5.2) as the body's string `error`, where a store's error
+   body holds an object (0.10.2: tensorstore 0.1.86 leaves source locations out): Google refuses an expired gcloud login with HTTP 400 `invalid_grant`,
    which starts neither (cellmap-flow, on David's Mac), and a token endpoint out of reach
-   leaves no token either, so the public URL is worth trying. When the last way fails too
+   leaves no token either, so the public URL is worth trying; from 0.1.86 an unreachable
+   token endpoint carries no such mark and is raised as any unreachable host is. When the last way fails too
    after a refusal, its error carries the first refusal as its cause, so a stale login is
    still in the traceback of a private bucket's 403. The way that worked is remembered per
    (driver, bucket) for the process. Format probing runs all probe keys under one way before
@@ -1058,7 +1061,10 @@ chunkmirage derives from raw attributes carries a `layered` note beside the pack
   fallback; detection ignores the directory suffix and finds a precomputed scale key.
   0.10.1: a failed login counts as a refusal and is the cause of a later failure; end to
   end, a `gs://` open whose token refresh is answered 400 `invalid_grant` (an https proxy
-  playing www.googleapis.com under a test CA) reads through the public URL.
+  playing www.googleapis.com under a test CA) reads through the public URL. 0.10.2: the
+  same on tensorstore 0.1.86's messages, and CI runs the suite on the newest release of
+  every dependency as well as the lock's, weekly and on every pull request: 0.10.1 passed
+  on the lock's tensorstore 0.1.78 and failed on 0.1.86, which a fresh install got.
 
 Reads: every statement in Behaviour 1, 2, 3 and 9; a document-less group probed through
 `s0`, integer and `"first"` levels, `detect(missing_ok=True)`, `index_box`; funlib keys on

{worldarray-0.10.1 → worldarray-0.10.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "worldarray"
-version = "0.10.1"
+version = "0.10.2"
 description = "Read zarr, N5 and Neuroglancer precomputed volumes in world coordinates through tensorstore: correct voxel placement, pyramid levels, padded region reads, resampling. numpy + tensorstore only."
 readme = "README.md"
 license = { file = "LICENSE" }

{worldarray-0.10.1 → worldarray-0.10.2}/src/worldarray/__init__.py

@@ -28,7 +28,7 @@ from .write import (
     parse_chunk_key,
 )
 
-__version__ = "0.10.1"
+__version__ = "0.10.2"
 
 __all__ = [
     "ArrayMeta",

{worldarray-0.10.1 → worldarray-0.10.2}/src/worldarray/store.py

@@ -158,12 +158,22 @@ class Refused(Exception):
     """A read was refused for want of credentials (not a missing key, not a network error)."""
 
 
+# An OAuth 2.0 token endpoint's error codes (RFC 6749, 5.2), the string "error" member of the
+# body it answers; a store's own error bodies hold an object there. Quotes may come escaped.
+_TOKEN_ERROR = re.compile(
+    r'error\\*"\s*:\s*\\*"(?:invalid_grant|invalid_client|invalid_request|invalid_scope'
+    r'|unauthorized_client|unsupported_grant_type)\\*"'
+)
+
+
 def login_failed(error: BaseException) -> bool:
     """``error`` came from getting an access token, before any request reached the store: a
     stale Google login (HTTP 400 ``invalid_grant``, which starts neither refusal code), a
-    rejected client, or a token endpoint out of reach. tensorstore names its oauth2 code
-    among the error's source locations."""
-    return "tensorstore/internal/oauth2/" in str(error)
+    rejected client, or (up to tensorstore 0.1.85) a token endpoint out of reach. Up to
+    0.1.85 tensorstore names its oauth2 code among the error's source locations; 0.1.86
+    leaves source locations out, so the token endpoint's own error code is matched too."""
+    message = str(error)
+    return "tensorstore/internal/oauth2/" in message or bool(_TOKEN_ERROR.search(message))
 
 
 def is_refused(error: BaseException) -> bool:

{worldarray-0.10.1 → worldarray-0.10.2}/tests/test_access.py

@@ -116,6 +116,10 @@ _STALE_LOGIN = (  # tensorstore's error for gcloud's login after a reauth policy
 
 
 def test_a_failed_login_is_a_refusal_and_the_cause_of_a_later_one():
+    # tensorstore 0.1.86 leaves source locations out; the token endpoint's error code remains
+    login = r"Bad Request [HTTP code 400] [http_response_body='{\"error\": \"invalid_grant\"}']"
+    store_400 = r"Bad Request [HTTP code 400] [http_response_body='{\"error\": {\"code\": 400}}']"
+    assert store.is_refused(ValueError(login)) and not store.is_refused(ValueError(store_400))
     unreachable = (
         "UNAVAILABLE: CURL error Could not resolve host [source locations='"
         "tensorstore/internal/curl/curl_transport.cc:475\n"

{worldarray-0.10.1 → worldarray-0.10.2}/uv.lock

@@ -1247,7 +1247,7 @@ wheels = [
 
 [[package]]
 name = "worldarray"
-version = "0.10.1"
+version = "0.10.2"
 source = { editable = "." }
 dependencies = [
     { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },