Skip to content

Add authentication support to execute_sparql_query - #1030

Merged
LeMyst merged 2 commits into
masterfrom
sparql-auth
Sep 19, 2026
Merged

LeMyst merged 2 commits into
masterfrom
sparql-auth

Conversation

@LeMyst

@LeMyst LeMyst commented Sep 19, 2026

Copy link
Copy Markdown
Owner

Summary

Allow wbi_helpers.execute_sparql_query() to query a SPARQL endpoint that sits behind authentication.

  • New auth parameter: a (username, password) tuple for HTTP Basic auth, or any requests.auth.AuthBase instance.
  • New headers parameter: extra HTTP headers merged over the defaults (e.g. {'Authorization': 'Bearer <token>'}).
  • New wbi_config['SPARQL_AUTH'] key (default None), used when auth is not passed. The fast run mode picks it up without any change.
execute_sparql_query(query, auth=('user', 'password'))
execute_sparql_query(query, headers={'Authorization': 'Bearer <token>'})
wbi_config['SPARQL_AUTH'] = ('user', 'password')  # global, also used by fast run

Related changes in wbi_backoff

  • The retry log handler printed every keyword argument of the retried function, which would have leaked credentials. The auth, headers and login kwargs are now masked as ***.
  • HTTP 401/403 now gives up immediately instead of being retried with the same credentials. This applies to every @wbi_backoff() decorated function.

Test plan

  • New unit tests: Basic auth, auth taken from config, no auth by default, extra headers (defaults kept), no retry on 401/403, credentials not logged
  • Full offline suite: 260 passed, 2 skipped
  • mypy: no issues

🤖 Generated with Claude Code

Allow querying a SPARQL endpoint behind authentication:
- new `auth` parameter (a (username, password) tuple for HTTP Basic auth
  or any requests.auth.AuthBase), defaulting to config['SPARQL_AUTH'] so
  the fast run mode can use it without code changes
- new `headers` parameter to send extra HTTP headers (e.g. a Bearer token)

wbi_backoff no longer logs the `auth`, `headers` and `login` keyword
arguments in clear on retries, and gives up immediately on HTTP 401/403
instead of retrying with the same credentials.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Comment thread test/test_wbi_backoff.py Fixed
CodeQL flagged `'https://example.org' in caplog.text` as an incomplete URL
substring sanitization. Use a non-URL keyword argument instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@LeMyst
LeMyst merged commit f02658c into master Sep 19, 2026
15 checks passed
@LeMyst
LeMyst deleted the sparql-auth branch September 19, 2026 12:24
LeMyst added a commit that referenced this pull request Sep 19, 2026
The SPARQL query is sent in the POST body (data=), not as URL parameters,
so name the dict accordingly. The functional fix (data= instead of params=,
no bogus multipart Content-Type) already landed in master via #1030.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
LeMyst added a commit that referenced this pull request Sep 19, 2026
The SPARQL query is sent in the POST body (data=), not as URL parameters,
so name the dict accordingly. The functional fix (data= instead of params=,
no bogus multipart Content-Type) already landed in master via #1030.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants