Skip to content

auth

Client-side Bearer token authentication for Arrow Flight.

BearerClientMiddleware 

BearerClientMiddleware(token)

Bases: ClientMiddleware

Attaches the authorization: Bearer <token> header.

Source code in arrakis/auth.py 
39
40
41
def __init__(self, token: str):
    super().__init__()
    self._token = token

BearerClientMiddlewareFactory 

BearerClientMiddlewareFactory(token)

Bases: ClientMiddlewareFactory

Injects a Bearer token into every outgoing Flight call.

Source code in arrakis/auth.py 
28
29
30
def __init__(self, token: str):
    super().__init__()
    self._token = token

build_auth_middleware 

build_auth_middleware(token)

Build the middleware list for a Flight client connection.

Parameters:

Name Type Description Default
token str or None

Bearer token string. When None, an empty list is returned so that unauthenticated connections work unchanged.

 required

Returns:

Type Description
list[ClientMiddlewareFactory]
Source code in arrakis/auth.py 
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
def build_auth_middleware(
    token: str | None,
) -> list[flight.ClientMiddlewareFactory]:
    """Build the middleware list for a Flight client connection.

    Parameters
    ----------
    token : str or None
        Bearer token string.  When *None*, an empty list is returned
        so that unauthenticated connections work unchanged.

    Returns
    -------
    list[flight.ClientMiddlewareFactory]

    """
    if token is None:
        return []
    return [BearerClientMiddlewareFactory(token)]

resolve_token 

resolve_token(token, url, scope=READ_SCOPE)

Resolve a token parameter to a JWT string.

Parameters:

Name Type Description Default
token str, bool, or None

None: auto-discover via igwn-auth-utils, fall back to unauthenticated if nothing found. True: auto-discover, raise if not found. False: explicitly unauthenticated. str: use as the raw JWT directly.

 required
url str

Flight server URL, used to derive the token audience.

 required
scope str

Required SciToken scope for discovery filtering.

 READ_SCOPE

Returns:

Type Description
str or None

The raw JWT string, or None if unauthenticated.

Raises:

Type Description
IgwnAuthError

If token is True and no valid token can be found.
Source code in arrakis/auth.py 
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
def resolve_token(
    token: str | bool | None,  # noqa: FBT001
    url: str,
    scope: str = READ_SCOPE,
) -> str | None:
    """Resolve a token parameter to a JWT string.

    Parameters
    ----------
    token : str, bool, or None
        ``None``: auto-discover via igwn-auth-utils, fall back to
        unauthenticated if nothing found.
        ``True``: auto-discover, raise if not found.
        ``False``: explicitly unauthenticated.
        ``str``: use as the raw JWT directly.
    url : str
        Flight server URL, used to derive the token audience.
    scope : str
        Required SciToken scope for discovery filtering.

    Returns
    -------
    str or None
        The raw JWT string, or None if unauthenticated.

    Raises
    ------
    IgwnAuthError
        If *token* is ``True`` and no valid token can be found.

    """
    if token is False:
        return None
    if isinstance(token, str):
        return token
    # token is None or True — attempt discovery
    try:
        audience = _audience_from_url(url)
        scitoken = find_token(audience, scope)
        header = token_authorization_header(scitoken)
        return header.removeprefix("Bearer ")
    except IgwnAuthError:
        if token is True:
            raise
        return None