Repository navigation
Don't require identityPool in cognito-config; fix Dependabot alerts - #22
Merged
Merged
Conversation
CognitoConfig is built with CognitoConfig(**response.json()) and declared identityPool as a required argument, although only the token pool is used (login). The Cognito identity pool is being retired server-side, and if the key ever leaves GET /authentication/cognito-config, login fails with a TypeError before it starts. CognitoConfig now takes region, userPool and tokenPool, and ignores identityPool and any other keys. Adds tests for both cases. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Raises the floors of the direct dependencies to their patched versions and updates only the affected packages in poetry.lock: - pyjwt ^2.15 (2.10.1 -> 2.15.1; 14 alerts, highest critical) - urllib3 2.3.0 -> 2.8.0 (8 alerts, high), via requests/botocore - requests ^2.33 (2.32.3 -> 2.34.2; 2 alerts) - setuptools 76.0.0 -> 84.2.1, idna 3.10 -> 3.20, pygments 2.19.1 -> 2.21.0 - dev: black ^26.3.1 (25.12.0 -> 26.10.1), pytest ^9.0.3 (8.4.2 -> 9.1.1) Also in the lock: the two numpy entries (1.26.0/1.26.4 by marker) merge into 1.26.4, and pathspec 0.12.1 -> 1.1.1 (black dependency). All 33 tests pass on Python 3.12. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jwagenaar
changed the title
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes: login no longer depends on
identityPoolin the cognito-config response, and the open Dependabot alerts are fixed.1. Don't require
identityPoolDirect mode builds its Cognito config with
CognitoConfig(**response.json())fromGET /authentication/cognito-config(direct/provider.py:28).CognitoConfig.__init__declaredidentityPoolas a required argument, but only the token pool is used, forinitiate_auth.identity_poolisn't read anywhere.The Cognito identity pool is being retired. It only served legacy uploads-bucket credentials to agents older than v2.0.0 (Pennsieve/upload-service-v2#117, Pennsieve/pennsieve-api#421). For now pennsieve-api keeps an empty
identityPoolin the response, so that clients up to this version can still log in. Once the key leaves the response, login with older versions fails withTypeError: __init__() missing 1 required positional argument: 'identityPool'.CognitoConfig(region, userPool, tokenPool, **_ignored):identityPooland any other extra keys are accepted and ignored. The unusedidentity_poolattribute is removed.tests/test_cognito_config.py: a response withoutidentityPool, and one withidentityPoolplus an unknown key.2. Dependabot alerts
pyproject.tomlfloors are raised to the patched versions, andpoetry update --lockupdated only the affected packages:^2.15)^2.33)^26.3.1)^9.0.3)Other changes in the lock:
numpyentries (1.26.0 and 1.26.4, by Python marker) merge into 1.26.4, still within^1.26.Formatting: CI lints with flake8, and reviewdog installs the latest black itself, so the black 26 upgrade doesn't change either.
Dependabot's own #11 (markdown-it-py 2.1.0 → 2.2.0) is stale: the lock already has markdown-it-py 3.0.0, so it can be closed.
Check
poetry check --lockpasses.poetry install --with devon Python 3.12, thenpytest: 33 passed (with jwt 2.15.1, urllib3 2.8.0, requests 2.34.2).After release
Once users are on this version, pennsieve-api can drop
identityPoolfrom the cognito-config response.🤖 Generated with Claude Code