Skip to content

feat(rs-client)!: Rename TokenGenerator to SecretKey - #720

Closed
sentry-junior[bot] wants to merge 1 commit into
feat/rs-client-remove-token-generator-signfrom
feat/rs-client-rename-secret-key
Closed

sentry-junior[bot] wants to merge 1 commit into
feat/rs-client-remove-token-generator-signfrom
feat/rs-client-rename-secret-key

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Breaking change for the Rust client. Stacked on #716.

This applies the Python client's TokenGenerator → SecretKey rename from #544 to the Rust client, so both clients use the same name for the signing key. It's paired with #719, which removes the deprecated Python aliases.

User-facing changes:

  • TokenGenerator → SecretKey. The type that signs tokens is now named for what it holds: an EdDSA key plus the default expiry and permissions for the tokens it signs.
  • The old SecretKey { kid, secret_key } config struct is removed. SecretKey::new(kid, secret_key) takes the key ID and the PEM-encoded private key directly, like the Python SecretKey(kid, secret_key).
  • TokenProvider::Generator → TokenProvider::SecretKey.
  • The PermissionEscalation error message now says "secret key" instead of "token generator".

expiry_seconds, permissions, create_token, TokenRequest and ClientBuilder::token keep their names and behavior. Docs, the README, the e2e test helper (test_token_generator → test_secret_key) and stresstest are updated to match.

This may conflict in client.rs with #717, which removes Session::mint_token right next to get_token. The conflict is a trivial rebase.

Changelog Entry

  • (rs-client) Rename TokenGenerator to SecretKey, matching the Python client, and construct it with SecretKey::new(kid, secret_key)
    • Replace TokenGenerator::new(SecretKey { kid, secret_key }) with SecretKey::new(kid, &secret_key).
    • Replace TokenProvider::Generator with TokenProvider::SecretKey.

via @lcian.

--

View Junior Session [Sentry]

Co-Authored-By: Lorenzo Cian <17258265+lcian@users.noreply.github.com>
@codecov

codecov Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 70.00000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.85%. Comparing base (06b1587) to head (aac339b).

Files with missing lines Patch % Lines
clients/rust/src/auth.rs 66.66% 5 Missing ⚠️
stresstest/src/main.rs 0.00% 1 Missing ⚠️
Additional details and impacted files
@@                              Coverage Diff                               @@
##           feat/rs-client-remove-token-generator-sign     #720      +/-   ##
==============================================================================
+ Coverage                                       91.82%   91.85%   +0.02%     
==============================================================================
  Files                                             116      116              
  Lines                                           24062    24050      -12     
==============================================================================
- Hits                                            22096    22091       -5     
+ Misses                                           1966     1959       -7     
Components Coverage Δ
Rust Backend 94.87% <ø> (ø)
Rust Client 82.71% <72.22%> (+0.16%) ⬆️
Python Client 93.51% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

lcian added a commit that referenced this pull request Oct 22, 2026
**Breaking change** for the Python client.

Splits the Python client's auth type into two concepts, matching the
shape the Rust client already has:

- **`SecretKey(kid, secret_key)`**: only the signing identity. Signs
canonical forms for pre-signed URLs (`signature_for_canonical_form`) and
carries no token defaults.
- **`TokenGenerator(key, expiry_seconds=60, permissions=None)`**: the
token policy. Holds the default expiry and the permission ceiling, and
signs JWTs via `token_for_scope`. This is what you pass to
`Client(token=...)`.

Previously `SecretKey` held both the key and the token defaults
(`expiry_seconds`, `permissions`), and `TokenGenerator` /
`sign_for_scope` were aliases marked deprecated only in code comments.
Both aliases are removed.

Other changes:
- Adds a `Token = str` alias for static pre-signed JWTs; `TokenProvider`
is now `TokenGenerator | Token`. Both are exported from
`objectstore_client`.
- `Session.mint_token`, `object_url(token_validity=...)` and
`presigned_object_url` require a `TokenGenerator`; pre-signing uses
`generator.key`. The error message is now `no token generator configured
on this session`.
- README, docstrings and tests updated. `tests/test_auth.py` covers JWT
signing with the wrapped key, the permission ceiling, and canonical-form
signing (moved from `test_presign.py`).

Supersedes #713 and #719 (Python) and #720 (Rust rename), which are
closed. No Rust change is needed: `TokenGenerator::new(SecretKey { kid,
secret_key })` already separates the two.

**Downstream:** `getsentry/sentry` builds
`TokenGenerator(**signing_key_options)` from settings. The upgrade PR
needs to construct `TokenGenerator(SecretKey(kid, secret_key),
expiry_seconds=..., permissions=...)` instead.

### Changelog Entry

- (py-client) Split the signing key from the token policy:
`SecretKey(kid, secret_key)` now only holds the EdDSA key, and
`TokenGenerator(key, expiry_seconds=60, permissions=None)` wraps it with
the token defaults and is what you pass to `Client(token=...)`. The
deprecated `sign_for_scope()` alias is removed.
- Replace `SecretKey(kid, secret_key, expiry_seconds, permissions)` or
`TokenGenerator(kid, secret_key, ...)` with
`TokenGenerator(SecretKey(kid, secret_key), expiry_seconds,
permissions)`.
      ```python
      # Before
client = Client(url, token=SecretKey(kid, secret_key,
expiry_seconds=300))

      # After
      key = SecretKey(kid, secret_key)
client = Client(url, token=TokenGenerator(key, expiry_seconds=300))
      ```
    - Replace `.sign_for_scope(...)` with `.token_for_scope(...)`.

<!-- junior-request-attribution:start -->
via @lcian.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AC0C641CPPS8%3A1792662581.533099 -->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C641CPPS8%3A1792662581.533099)
[[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C641CPPS8%3A1792662581.533099/?project=4510944073809921)

<!-- junior-session-footer:end -->

---------

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Lorenzo Cian <17258265+lcian@users.noreply.github.com>
@jan-auer
jan-auer deleted the feat/rs-client-rename-secret-key branch November 4, 2026 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant