feat: Add bearer token authentication support #866
Conversation
Co-Authored-By: AJ Steers <[email protected]>
Original prompt from AJ Steers |
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. Testing This PyAirbyte VersionYou can test this version of PyAirbyte using the following: # Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1763010134-bearer-token-auth' pyairbyte --help
# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1763010134-bearer-token-auth'Helpful ResourcesPR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
Community SupportQuestions? Join the #pyairbyte channel in our Slack workspace. |
- Add bearer_token parameter to CloudWorkspace class as alternative to client credentials - Add validation to ensure only one auth method is used (client_id+secret OR bearer_token) - Add CLOUD_BEARER_TOKEN_ENV_VAR constant and resolve_cloud_bearer_token() function - Update get_airbyte_server_instance() to support bearer token authentication - Update _make_config_api_request() to use bearer token if provided - Add create_oauth_token() public method to CloudWorkspace - Update all api_util functions to accept optional bearer_token parameter - Update CloudWorkspace docstring with bearer token usage examples - Add type: ignore comments for optional client_id/client_secret parameters Co-Authored-By: AJ Steers <[email protected]>
📝 WalkthroughWalkthroughThis change adds optional bearer-token authentication alongside OAuth2 client credentials across Airbyte cloud utilities. Public API functions and CloudWorkspace now accept a Changes
Sequence Diagram(s)sequenceDiagram
actor User
participant CloudWorkspace
participant APIUtil as api_util
participant AirbyteAPI
rect rgb(240, 245, 250)
Note over User,CloudWorkspace: Initialization
User->>CloudWorkspace: instantiate (client_id/client_secret) OR (bearer_token)
activate CloudWorkspace
CloudWorkspace->>CloudWorkspace: validate exactly one auth method
CloudWorkspace->>CloudWorkspace: wrap provided secret(s) into SecretString
deactivate CloudWorkspace
end
rect rgb(235, 250, 235)
Note over CloudWorkspace,AirbyteAPI: API call flow
CloudWorkspace->>APIUtil: call API with (client_id, client_secret, bearer_token)
activate APIUtil
APIUtil->>APIUtil: if bearer_token provided -> use bearer_auth Security
alt bearer_token
APIUtil->>AirbyteAPI: init AirbyteAPI with bearer_auth (token supplied)
else no bearer_token
APIUtil->>APIUtil: fetch token via get_bearer_token(client_id, client_secret)
APIUtil->>AirbyteAPI: init AirbyteAPI with client_credentials Security (token obtained)
end
APIUtil->>AirbyteAPI: perform request
deactivate APIUtil
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
🔇 Additional comments (11)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
airbyte/cloud/connectors.py (1)
162-168: Bearer-token auth path breaks here
When a workspace is instantiated with onlybearer_token, bothclient_idandclient_secretstayNone, so this call reachesapi_util.check_connectorwith no usable credentials at all. The new bearer-token flow then 401s instead of succeeding. Could we threadbearer_token=self.workspace.bearer_token(as you did for the workspace methods) through this and the other connector API calls so the new auth mode actually works, wdyt?result = api_util.check_connector( workspace_id=self.workspace.workspace_id, connector_type=self.connector_type, actor_id=self.connector_id, api_root=self.workspace.api_root, client_id=self.workspace.client_id, # type: ignore[arg-type] client_secret=self.workspace.client_secret, # type: ignore[arg-type] + bearer_token=self.workspace.bearer_token, )airbyte/cloud/workspaces.py (1)
348-378: Bearer-token deletions 401
permanently_delete_sourceandpermanently_delete_destinationnever forwardself.bearer_token, so bearer-token-only workspaces can’t delete resources—they send neither client creds nor a token to the Config API. Could we addbearer_token=self.bearer_tokento theseapi_util.delete_*calls to keep the new auth mode consistent, wdyt?api_util.delete_source( source_id=source.connector_id if isinstance(source, CloudSource) else source, api_root=this.api_root, client_id=self.client_id, # type: ignore[arg-type] client_secret=self.client_secret, # type: ignore[arg-type] + bearer_token=self.bearer_token, ) ... api_util.delete_destination( destination_id=(destination if isinstance(destination, str) else destination.destination_id), api_root=self.api_root, client_id=self.client_id, # type: ignore[arg-type] client_secret=self.client_secret, # type: ignore[arg-type] + bearer_token=self.bearer_token, )airbyte/_util/api_util.py (1)
1389-1395: Don't drop bearer_token during safe-mode checksLine 1391: If callers supply only
bearer_token(withclient_id/client_secretunset), this safe-mode lookup hitsget_custom_yaml_source_definitionwithout any auth, soget_airbyte_server_instanceraisesPyAirbyteInputErrorand the delete path breaks for bearer-token users. Could we forward the provided bearer token here? wdyt?definition_info = get_custom_yaml_source_definition( workspace_id=workspace_id, definition_id=definition_id, api_root=api_root, client_id=client_id, client_secret=client_secret, + bearer_token=bearer_token, )
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
airbyte/_util/api_util.py(43 hunks)airbyte/cloud/auth.py(1 hunks)airbyte/cloud/connections.py(6 hunks)airbyte/cloud/connectors.py(12 hunks)airbyte/cloud/workspaces.py(16 hunks)airbyte/constants.py(1 hunks)
🧰 Additional context used
🧬 Code graph analysis (3)
airbyte/cloud/auth.py (2)
airbyte/secrets/base.py (1)
SecretString(38-143)airbyte/secrets/util.py (1)
try_get_secret(33-60)
airbyte/cloud/workspaces.py (3)
airbyte/secrets/base.py (1)
SecretString(38-143)airbyte/exceptions.py (1)
PyAirbyteInputError(201-210)airbyte/_util/api_util.py (1)
get_bearer_token(1041-1066)
airbyte/_util/api_util.py (3)
airbyte/secrets/base.py (1)
SecretString(38-143)airbyte/exceptions.py (1)
PyAirbyteInputError(201-210)airbyte/cloud/workspaces.py (1)
list_connections(466-492)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: Pytest (All, Python 3.10, Windows)
- GitHub Check: Pytest (All, Python 3.11, Ubuntu)
- GitHub Check: Pytest (No Creds)
- GitHub Check: Pytest (All, Python 3.11, Windows)
- GitHub Check: Pytest (Fast)
- GitHub Check: Pytest (All, Python 3.10, Ubuntu)
devin-ai-integration
bot
changed the title
…ules - Add bearer_token parameter to all api_util calls in connectors.py (13 calls) - Add bearer_token parameter to all api_util calls in connections.py (7 calls) - Add bearer_token parameter to all api_util calls in sync_results.py (6 calls) - Ensures bearer token authentication works throughout cloud integration Co-Authored-By: AJ Steers <[email protected]>
feat: Add bearer token authentication support (do not merge)
Summary
This PR adds support for bearer token authentication to PyAirbyte's Cloud integration as an alternative to OAuth2 client credentials flow.
Status: DRAFT - Implementation in progress
This is an early draft PR created to get visibility and early feedback. No code changes have been implemented yet.
Planned Changes:
bearer_tokenparameter toCloudWorkspaceclassAIRBYTE_CLOUD_BEARER_TOKEN)get_airbyte_server_instance()to support bearer token authentication_make_config_api_request()to use bearer token if providedcreate_oauth_token()method toCloudWorkspaceto generate and return bearer tokensReview & Testing Checklist for Human
create_oauth_token()methodNotes
Summary by CodeRabbit