Repository navigation
feat(rs-client)!: Rename TokenGenerator to SecretKey - #720
Closed
sentry-junior[bot] wants to merge 1 commit into
Closed
sentry-junior[bot] wants to merge 1 commit into
sentry-junior[bot] wants to merge 1 commit into
Conversation
Co-Authored-By: Lorenzo Cian <17258265+lcian@users.noreply.github.com>
This was referenced Oct 22, 2026
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## feat/rs-client-remove-token-generator-sign #720 +/- ##
==============================================================================
+ Coverage 91.82% 91.85% +0.02%
==============================================================================
Files 116 116
Lines 24062 24050 -12
==============================================================================
- Hits 22096 22091 -5
+ Misses 1966 1959 -7
☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
lcian
added a commit
that referenced
this pull request
Oct 22, 2026
**Breaking change** for the Python client. Splits the Python client's auth type into two concepts, matching the shape the Rust client already has: - **`SecretKey(kid, secret_key)`**: only the signing identity. Signs canonical forms for pre-signed URLs (`signature_for_canonical_form`) and carries no token defaults. - **`TokenGenerator(key, expiry_seconds=60, permissions=None)`**: the token policy. Holds the default expiry and the permission ceiling, and signs JWTs via `token_for_scope`. This is what you pass to `Client(token=...)`. Previously `SecretKey` held both the key and the token defaults (`expiry_seconds`, `permissions`), and `TokenGenerator` / `sign_for_scope` were aliases marked deprecated only in code comments. Both aliases are removed. Other changes: - Adds a `Token = str` alias for static pre-signed JWTs; `TokenProvider` is now `TokenGenerator | Token`. Both are exported from `objectstore_client`. - `Session.mint_token`, `object_url(token_validity=...)` and `presigned_object_url` require a `TokenGenerator`; pre-signing uses `generator.key`. The error message is now `no token generator configured on this session`. - README, docstrings and tests updated. `tests/test_auth.py` covers JWT signing with the wrapped key, the permission ceiling, and canonical-form signing (moved from `test_presign.py`). Supersedes #713 and #719 (Python) and #720 (Rust rename), which are closed. No Rust change is needed: `TokenGenerator::new(SecretKey { kid, secret_key })` already separates the two. **Downstream:** `getsentry/sentry` builds `TokenGenerator(**signing_key_options)` from settings. The upgrade PR needs to construct `TokenGenerator(SecretKey(kid, secret_key), expiry_seconds=..., permissions=...)` instead. ### Changelog Entry - (py-client) Split the signing key from the token policy: `SecretKey(kid, secret_key)` now only holds the EdDSA key, and `TokenGenerator(key, expiry_seconds=60, permissions=None)` wraps it with the token defaults and is what you pass to `Client(token=...)`. The deprecated `sign_for_scope()` alias is removed. - Replace `SecretKey(kid, secret_key, expiry_seconds, permissions)` or `TokenGenerator(kid, secret_key, ...)` with `TokenGenerator(SecretKey(kid, secret_key), expiry_seconds, permissions)`. ```python # Before client = Client(url, token=SecretKey(kid, secret_key, expiry_seconds=300)) # After key = SecretKey(kid, secret_key) client = Client(url, token=TokenGenerator(key, expiry_seconds=300)) ``` - Replace `.sign_for_scope(...)` with `.token_for_scope(...)`. <!-- junior-request-attribution:start --> via @lcian. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AC0C641CPPS8%3A1792662581.533099 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AC0C641CPPS8%3A1792662581.533099) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AC0C641CPPS8%3A1792662581.533099/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Lorenzo Cian <17258265+lcian@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Breaking change for the Rust client. Stacked on #716.
This applies the Python client's
TokenGenerator→SecretKeyrename from #544 to the Rust client, so both clients use the same name for the signing key. It's paired with #719, which removes the deprecated Python aliases.User-facing changes:
TokenGenerator→SecretKey. The type that signs tokens is now named for what it holds: an EdDSA key plus the default expiry and permissions for the tokens it signs.SecretKey { kid, secret_key }config struct is removed.SecretKey::new(kid, secret_key)takes the key ID and the PEM-encoded private key directly, like the PythonSecretKey(kid, secret_key).TokenProvider::Generator→TokenProvider::SecretKey.PermissionEscalationerror message now says "secret key" instead of "token generator".expiry_seconds,permissions,create_token,TokenRequestandClientBuilder::tokenkeep their names and behavior. Docs, the README, the e2e test helper (test_token_generator→test_secret_key) and stresstest are updated to match.This may conflict in
client.rswith #717, which removesSession::mint_tokenright next toget_token. The conflict is a trivial rebase.Changelog Entry
TokenGeneratortoSecretKey, matching the Python client, and construct it withSecretKey::new(kid, secret_key)TokenGenerator::new(SecretKey { kid, secret_key })withSecretKey::new(kid, &secret_key).TokenProvider::GeneratorwithTokenProvider::SecretKey.via @lcian.
--
View Junior Session [Sentry]