Allow disabling automatic API token rotation - #466
Merged
Conversation
Add enable_token_rotation to Groundlight/TokenManager so proxies like Edge Endpoint can forward a caller's token without minting or revoking against that identity's rotation chain. Defaults to True to preserve existing behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Silence PLR0913 on the new constructor args, drop the unreachable refresh guard and redundant _available flag, defer cache/lock setup until rotation is enabled, and cover close() plus ExperimentalApi forwarding. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the behavioral description of enable_token_rotation without naming Edge Endpoint or other call-site examples. Co-authored-by: Cursor <cursoragent@cursor.com>
When enable_token_rotation is False, skip creating TokenManager entirely so the configured token is used as-is. TokenManager stays a pure rotation collaborator with no disabled mode. Co-authored-by: Cursor <cursoragent@cursor.com>
Constructor forwarding for the subclass follows the existing pattern and is already covered by the Groundlight client test. Co-authored-by: Cursor <cursoragent@cursor.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Background
Follow-up to #445 before cutting
0.31.0.The
edge-endpointcontainer on Edge Endpoint buildsGroundlight(api_token=request x-api-token)for sync cloud calls. With rotation enabled it would mint/revoke against tokens that are owned by the client application. This could result in a token being revoked while the client is still using it.Disabling rotation here leaves ownership of the token's rotation with the application client.
Summary
enable_token_rotation(defaultTrue) toGroundlightandExperimentalApi.False,Groundlightskips constructingTokenManagerand uses the configured token as-is (no by-snippet lookup, on-disk cache, mint/revoke, or background refresh thread).TokenManageritself is unchanged from feat: automatically rotate SDK API tokens #445: it always owns a rotation chain when constructed.Test plan
poetry run pytest test/unit/test_token_manager.py test/unit/test_token_refresh_client.pyenable_token_rotation=Truestill rotates whentoken_ttlis setenable_token_rotation=False; keep rotation on for device-token containers with sharedGROUNDLIGHT_TOKEN_DIR