refactor(no-ticket): share one v2 API client

[cloudsmith-iduffy]

Description

The CLI calls a few v2 API endpoints that the generated cloudsmith_api SDK does not cover. The HTTP code for those calls lived as private helpers in core/api/metadata.py. This PR moves it to core/api/v2.py, so the next v2 endpoint can use the same code without copying it. The metadata functions now call v2.get_client(), v2.request() and v2.response_json().

The v2 client now authenticates with the credential that resolve_credentials gives the command (opts.credential), through CredentialResult.auth_headers(). Before, it read the API key and the SSO Authorization header back from the SDK Configuration, and copied the precedence logic from initialise_api. An API key goes in X-Api-Key. A SAML access token goes in Authorization: Bearer. Each metadata function takes a credential keyword argument, and the metadata and push commands pass opts.credential. The host, proxy, SSL verification, user agent, --api-headers and retry settings still come from the Configuration that initialise_api sets.

The client also gets these changes:

• request_url() sends a request to an absolute URL, such as a Link: rel="next" pagination link. It refuses a URL on another scheme or host, so the API key or SSO token goes only to the configured API host.
• A redirect to another host does not get the API key. Requests already drops the Authorization header in that case, but it sends X-Api-Key on. create_requests_session() now builds an ApiKeySafeSession that drops that header under the same rule. The v1 SDK client, uploads, downloads and the v2 client all use it.
• Every v2 request attempt now has a 30-second timeout. Before, a v2 API that did not respond made the metadata commands wait without a limit. The CLI retries an attempt that times out, as --error-retry-max sets. With the default of 6 retries and the backoff, a stalled API holds a command for some minutes.
• A POST gets only the 30-second connect timeout, not a read timeout. The shared retry setup retries after a read timeout for every method, so a slow metadata add that the server accepts would be sent again and create a second entry.

The v1 SDK client does not get the timeout in this PR. Its calls need their own timeout values, so I will fix that separately.

When --api-headers sets an Authorization header and an API key also resolves, the v2 client now sends both headers. The v1 SDK client already does this.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

core/tests/test_v2.py covers the API key, the SAML access token, no credential, the origin check, the redirect for both credential types, the timeout, the user agent and extra headers, and the proxy and SSL verification settings. core/tests/test_rest.py covers the redirect rule for the shared session.

I tested metadata list against staging with the CLI's credential chain:

• CLOUDSMITH_NO_KEYRING=1 CLOUDSMITH_API_KEY=<service key> cloudsmith metadata list <workspace>/<repo>/<package> --api-host <staging host> returns 200.
• With a SAML session in the keyring and no API key, the same call returns 200 with Authorization: Bearer.
• With no credential, the v2 endpoint returns 401.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Redirects can expose API keys, and retries prevent the advertised 30-second overall timeout.

3 open findings

• API key leaks on cross-origin redirects · New
• Retries bypass the intended 30-second request timeout · New
• Missing required copyright comment · New

What changed in this PR

Introduces a shared client for unsupported v2 API endpoints and migrates metadata requests to it.

Changes:

• Adds shared v2 request, authentication, URL validation, and JSON helpers.
• Applies request timeouts and adds focused tests.
• Refactors metadata operations to use the shared client.

File	Description
cloudsmith_cli/​core/​api/​v2.py	Adds the shared v2 API client.
cloudsmith_cli/​core/​api/​metadata.py	Delegates metadata requests to the shared client.
cloudsmith_cli/​core/​tests/​test_v2.py	Tests origin validation and timeout propagation.
CHANGELOG.md	Documents timeout behavior.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tigh-latte]

Looks good! one non blocking q