Skip to content

authenticated connect without interaction: adds tiled.client.from_provider#1318

Open
prjemian wants to merge 4 commits into
mainfrom
1316-authenticated-connect-without-interaction
Open

authenticated connect without interaction: adds tiled.client.from_provider#1318
prjemian wants to merge 4 commits into
mainfrom
1316-authenticated-connect-without-interaction

Conversation

@prjemian

Copy link
Copy Markdown
Contributor

Addresses #1316. Adds tiled.client.from_provider(uri, provider,
username, password) which connects to a tiled server and authenticates
via an OAuth2 password grant without triggering the interactive login
flow. Validates that the provider uses internal (password-based) mode,
forwards node_path_parts and structure_clients to from_context(), and
sets has_external_auth to prevent double-authentication.

Co-authored-by: OpenCode (claudeopus46)
14 mock-based tests covering provider resolution, token handling,
has_external_auth flag, structure_clients/node_path_parts forwarding,
mode validation (internal, password, external), error propagation,
and first-match semantics. Adapted from tests provided in issue #1316.

Co-authored-by: OpenCode (claudeopus46)
@prjemian prjemian self-assigned this Mar 25, 2026
@prjemian prjemian added the enhancement New feature or request label Mar 25, 2026
Wrap long import lines in tests/test_client.py and tiled/client/__init__.py
for isort, and wrap long from_provider() calls for black (88-char limit).

Co-authored-by: OpenCode (claudeopus46)
Revert RuntimeError formatting to match black 23.10.1 used by
pre-commit in CI, which differs from black 26.x.

Co-authored-by: OpenCode (claudeopus46)
@prjemian

Copy link
Copy Markdown
Contributor Author

@danielballan, @DiamondJoseph : all tests pass, ready to review

@prjemian

prjemian commented Mar 25, 2026

Copy link
Copy Markdown
Contributor Author

Tested at APS with the NeXus example file:

In [1]: import yaml

In [2]: creds = yaml.safe_load(open(".test_creds.yml"))

In [3]: from tiled.client import from_provider

In [4]: client = from_provider("http://localhost:8020", "APS-DM-API", "jemian", creds["jemian"]["password"])

In [5]: client["dm/jemian-2602/data/NeXus/writer_1_3/Scan/data/counts"]
Out[5]: <ArrayClient shape=(31,) chunks=((31,)) dtype=int32>

@danielballan

Copy link
Copy Markdown
Member

The problem here is the password stored in a file on disk.

When the user enters the password into an interactive prompt, Tiled exchanges it for a pair of tokens and stores the tokens on disk. This is safer because:

  • The tokens are short-lived (minutes and days, respectively) so the attack window is limited.
  • The token only work on Tiled: unlike your password, they can't be used to access other systems like email.
  • The tokens are in a file fully managed by Tiled, with file permissions set like they are on a private SSH key.

Let's continue the conversation in #1316 or on a call if we can find a moment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Authenticated connect without interaction

2 participants