feat(application): read shared runs via --share-token - #688
Merged
Conversation
dima-aignostics
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
4 times, most recently
from
June 22, 2026 11:36
b524be7 to
9510e92
Compare
dima-aignostics
force-pushed
the
feat/PYSDK-132-add-run-sharing-to-python-sdk
branch
6 times, most recently
from
June 23, 2026 21:15
6ae872e to
0bc4980
Compare
Base automatically changed from
feat/PYSDK-132-add-run-sharing-to-python-sdk
to
main
June 29, 2026 08:04
dima-aignostics
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
3 times, most recently
from
June 30, 2026 14:04
5ab4c44 to
23c6793
Compare
Codecov Report❌ Patch coverage is
|
dima-aignostics
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
from
June 30, 2026 15:38
23c6793 to
c3c99ef
Compare
dima-aignostics
changed the title
dima-aignostics
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
from
July 1, 2026 11:23
01154f0 to
8bad631
Compare
|
olivermeyer
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
2 times, most recently
from
August 5, 2026 08:55
d8936d0 to
b2023b8
Compare
olivermeyer
added a commit
that referenced
this pull request
Aug 5, 2026
Address code-review findings on PR #688: - Fix two _service.py docstrings that wrongly described share-token access as "without OAuth"/"unauthenticated"; share tokens elevate an already OAuth-authenticated user's access. - Rewrite the three forbidden CLI tests to raise ForbiddenException from the real source (run.details()/run.results()) instead of application_run, which wraps all exceptions into RuntimeError in production. - Normalize an empty --share-token to None at the application_run choke point so a blank value falls back to the normal authenticated read; add service tests for both branches. - Make share_token_access_denied_message a pure builder and move the warning log to the four CLI call sites (command-query separation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
olivermeyer
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
from
August 6, 2026 08:32
48c83d8 to
65027bb
Compare
olivermeyer
changed the title
arne-aignx
approved these changes
Aug 6, 2026
arne-aignx
left a comment
arne-aignx
left a comment
Collaborator
There was a problem hiding this comment.
LGTM. I added two smaller nits
| raise RuntimeError(message) | ||
|
|
||
|
|
||
| def share_token_access_denied_message(run_id: str, share_token: str | None) -> str: |
Collaborator
There was a problem hiding this comment.
nit: run_access_denied_message might be a better wording here.
I was a bit confused reading through the initial code wondering "Why do we provide a share_token related error message, when a 403 is returned by the API and no share token was provided
| if self._share_token is not None: | ||
| # Percent-encode the secret so reserved characters (& # = space) cannot | ||
| # corrupt the URL or inject extra query parameters. | ||
| endpoint_url += f"?{urlencode({'share_token': self._share_token})}" |
Collaborator
There was a problem hiding this comment.
nit: Alternatively, self._share_token could also be forwarded to _fetch_redirect_url as an argument, and we let requests.get handle the URL construction from the provided query paramters
olivermeyer
enabled auto-merge (squash)
August 6, 2026 09:45
…DK-145) Recipients holding a share token secret can now describe a run without OAuth login by passing --share-token <secret> to `application run describe`. The token is used directly as the Bearer token for platform API requests. - Adds `--share-token` option to `run describe`; when set, creates a `Client(token_provider=…)` bypassing OAuth, with `hide_platform_queue_position=True` - Catches `UnauthorizedException` and `ForbiddenException` when using a share token and surfaces a clear "Access denied" message with exit code 1 - Adds 5 integration tests covering success (text + JSON), not-found, unauthorized, and forbidden paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a --share-token option to `application run describe / dump-metadata / dump-item-metadata / result download` (PYSDK-145), granting an authenticated user access to a run that has been shared with them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Address code-review findings on PR #688: - Fix two _service.py docstrings that wrongly described share-token access as "without OAuth"/"unauthenticated"; share tokens elevate an already OAuth-authenticated user's access. - Rewrite the three forbidden CLI tests to raise ForbiddenException from the real source (run.details()/run.results()) instead of application_run, which wraps all exceptions into RuntimeError in production. - Normalize an empty --share-token to None at the application_run choke point so a blank value falls back to the normal authenticated read; add service tests for both branches. - Make share_token_access_denied_message a pure builder and move the warning log to the four CLI call sites (command-query separation). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
olivermeyer
force-pushed
the
feat/PYSDK-145-read-run-with-share-token
branch
from
August 6, 2026 11:02
99f4bc6 to
cd81e88
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Enable an authenticated user who holds a share-token secret to read an application run shared with them via the CLI (PYSDK-145, UC2 token-based sharing). OAuth login remains required — the share token is additive, elevating the authenticated user's access to a run they could not otherwise read. Follow-up to PYSDK-132; design per ADR-PAPI-0004 (token forwarded as a
share_tokenquery parameter alongside the OAuth Bearer).How?
Add an optional
--share-tokenoption torun describe,run dump-metadata,run dump-item-metadata, andrun result download, threading it throughServiceintoRun/Artifactwhere it is forwarded URL-encoded as theshare_tokenquery parameter on the run, items, and artifact-file requests, and folded into the operation-cache key so share-token reads stay isolated from authenticated reads of the same run. A 403 propagates unchanged through the download path (rather than being wrapped intoRuntimeError) so the CLI surfaces a token-omitting "access denied" message and exits 1; omitting the flag is a pure no-op passthrough.