feat(python): expose Permissions and remaining user auth methods by ethanlin01x · Pull Request #3727 · apache/iggy

ethanlin01x · 2026-07-21T15:58:19Z

Which issue does this PR address?

Rationale

The Python SDK could create users but not grant them access to anything: create_user hardcoded None for permissions, and update_permissions, change_password, and logout_user` were unexposed.

What changed?

Before, the Python SDK could create users but not grant them access to anything: create_user hardcoded None for permissions, and update_permissions, change_password, and logout_user were unexposed.
Now the Rust Permissions hierarchy is mirrored as PyO3 classes, create_user takes an optional permissions argument, UserInfoDetails exposes a permissions getter, and the three missing methods complete the UserClient surface, with the underlying Rust client handling the wire encoding.

Local Execution

Passed
Pre-commit hooks ran

AI Usage

Claude was used to help generate and review this PR and all the changes are checked by the human.

Mirror the Rust Permissions, GlobalPermissions, StreamPermissions, and TopicPermissions types as PyO3 classes so user permissions can be built and inspected from Python. Stream and topic dict keys are typed u32 to match the wire format, so out-of-range IDs fail at construction instead of being silently truncated. The client methods that consume these classes follow in the next commits.

create_user hardcoded None for permissions, so every user came out unprivileged and UserInfoDetails gave no way to inspect grants. Wire the Permissions argument through create_user and add the permissions getter so grants round-trip through get_user. The credential helpers shared by the user tests move to tests/utils.py for the new enforcement tests.

Permissions set at creation were frozen: there was no way to grant, replace, or revoke them afterwards. update_permissions is a full replacement and None clears the permissions entirely, matching the Rust client semantics.

Password rotation required deleting and recreating the user, losing its id and permissions. change_password verifies the current password server-side, and a user can rotate its own credentials without any admin permission.

Sessions could only be abandoned by dropping the connection, leaving the server-side session authenticated until the socket closed. logout_user ends the session explicitly; a later login_user on the same client starts a fresh one.

codecov · 2026-07-21T16:21:36Z

Codecov Report

❌ Patch coverage is 96.66667% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.38%. Comparing base (a5001d3) to head (47fcb74).
⚠️ Report is 8 commits behind head on master.

Files with missing lines	Patch %	Lines
foreign/python/src/permissions.rs	95.60%	8 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3727      +/-   ##
============================================
+ Coverage     74.34%   74.38%   +0.03%     
  Complexity      950      950              
============================================
  Files          1303     1304       +1     
  Lines        148712   148951     +239     
  Branches     124225   124225              
============================================
+ Hits         110562   110793     +231     
- Misses        34673    34681       +8     
  Partials       3477     3477

Components	Coverage Δ
Rust Core	`74.57% <ø> (ø)`
Java SDK	`62.64% <ø> (ø)`
C# SDK	`72.28% <ø> (ø)`
Python SDK	`93.08% <96.66%> (+0.81%)`	⬆️
PHP SDK	`84.52% <ø> (ø)`
Node SDK	`92.70% <ø> (ø)`
Go SDK	`43.08% <ø> (ø)`

Files with missing lines	Coverage Δ
foreign/python/src/client.rs	`99.21% <100.00%> (+0.06%)`	⬆️
foreign/python/src/lib.rs	`100.00% <100.00%> (ø)`
foreign/python/src/user.rs	`80.43% <100.00%> (+1.36%)`	⬆️
foreign/python/src/permissions.rs	`95.60% <95.60%> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ethanlin01x · 2026-07-21T16:23:56Z

/ready

slbotbm

first round

slbotbm · 2026-07-22T18:50:18Z

+    #[new]
+    #[pyo3(signature = (global_=None, streams=None))]
+    fn new(
+        #[gen_stub(override_type(type_repr = "GlobalPermissions | None"))] global_: Option<


Why global_? why not global?

global is a reserved keyword in Python.
The trailing underscore follows the PEP 8 convention for names that collide with keywords (like class_). An alternative would be global_permissions, but I kept global_ to mirror the Rust field name. Let me know if you'd prefer the longer name.

slbotbm · 2026-07-23T12:28:15Z

Let's remove the following tests:

test_all_global_permission_flags_set_together

test_all_stream_permission_flags_set_together

test_all_topic_permission_flags_set_together

they do not add much to the current test set.

Let us add the following tests:

User without manage_users cannot update another user’s permissions.

User with manage_users can update another user’s permissions.

Failed update leaves target permissions unchanged.

calling logout twice fails

Removed, 41497da

Added tests, 47fcb74

slbotbm · 2026-07-23T12:29:22Z

+    async def test_create_user_without_permissions_has_none(
+        self, iggy_client: IggyClient, unique_name
+    ):


test_create_user_without_permissions_has_none is valid but need not be a separate integration test. Add permissions is None assertions to existing test_create_and_get_user.

Fixed, da2c17f

ethanlin01x · 2026-07-23T15:56:44Z

/ready

ethanlin01x force-pushed the feat/python-permissions branch 2 times, most recently from 63a8908 to 84a9f3b Compare July 21, 2026 16:05

ethanlin01x added 5 commits July 22, 2026 00:09

feat(python): add update_permissions to IggyClient

1dd5c72

Permissions set at creation were frozen: there was no way to grant, replace, or revoke them afterwards. update_permissions is a full replacement and None clears the permissions entirely, matching the Rust client semantics.

feat(python): add change_password to IggyClient

9550732

Password rotation required deleting and recreating the user, losing its id and permissions. change_password verifies the current password server-side, and a user can rotate its own credentials without any admin permission.

feat(python): add logout_user to IggyClient

22bc32c

Sessions could only be abandoned by dropping the connection, leaving the server-side session authenticated until the socket closed. logout_user ends the session explicitly; a later login_user on the same client starts a fresh one.

ethanlin01x force-pushed the feat/python-permissions branch from 84a9f3b to 22bc32c Compare July 21, 2026 16:11

ethanlin01x marked this pull request as ready for review July 21, 2026 16:23

github-actions Bot added the S-waiting-on-review PR is waiting on a reviewer label Jul 21, 2026

slbotbm requested changes Jul 23, 2026

View reviewed changes

github-actions Bot added S-waiting-on-author PR is waiting on author response and removed S-waiting-on-review PR is waiting on a reviewer labels Jul 23, 2026

ethanlin01x added 3 commits July 23, 2026 23:49

test(python): drop redundant all-flags permission tests

41497da

test(python): move no-permissions check into test_create_and_get_user

da2c17f

test(python): cover permission update authorization and double logout

47fcb74

ethanlin01x requested a review from slbotbm July 23, 2026 15:56

github-actions Bot added S-waiting-on-review PR is waiting on a reviewer and removed S-waiting-on-author PR is waiting on author response labels Jul 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(python): expose Permissions and remaining user auth methods#3727

feat(python): expose Permissions and remaining user auth methods#3727
ethanlin01x wants to merge 8 commits into
apache:masterfrom
ethanlin01x:feat/python-permissions

ethanlin01x commented Jul 21, 2026

Uh oh!

codecov Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

ethanlin01x commented Jul 21, 2026

Uh oh!

slbotbm left a comment

Uh oh!

slbotbm Jul 22, 2026

Uh oh!

ethanlin01x Jul 23, 2026

Uh oh!

slbotbm Jul 23, 2026

Uh oh!

slbotbm Jul 23, 2026

Uh oh!

ethanlin01x Jul 23, 2026

Uh oh!

ethanlin01x Jul 23, 2026

Uh oh!

slbotbm Jul 23, 2026

Uh oh!

ethanlin01x Jul 23, 2026

Uh oh!

ethanlin01x commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ethanlin01x commented Jul 21, 2026

Which issue does this PR address?

Rationale

What changed?

Local Execution

AI Usage

Uh oh!

codecov Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ethanlin01x commented Jul 21, 2026

Uh oh!

slbotbm left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ethanlin01x commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Jul 21, 2026 •

edited

Loading