Authenticate CI via GitHub OIDC and surface clearer errors

Migrate CI credential handling to GitHub OIDC + AWS Secrets Manager,
mirroring dropbox-sdk-dotnet: credential-consuming jobs assume an AWS IAM
role and fetch the api-sdk-integration-test-creds and codecov-token
secrets, replacing long-lived GitHub secrets. Credential-gated jobs are
skipped on fork PRs, which cannot assume the role.

Also decode the global access error on HTTP 403 responses and stop
injecting the unused legacy user token, and authenticate the team
integration fixture with a refresh token instead of a static token.

Author: AndreyVMarkelov

.github/workflows/ci.yml

@@ -93,8 +93,13 @@ jobs:
           sphinx-build -b html docs build/html
 
   Integration:
+    # Skip on fork PRs: they cannot assume the OIDC role.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     continue-on-error: true
     runs-on: ${{ matrix.os }}
+    permissions:  # required for OIDC
+      id-token: write
+      contents: read
     strategy:
       fail-fast: false
       max-parallel: 1
@@ -126,19 +131,27 @@ jobs:
         run: |
           python -m pip install "$(python -c "import glob,sys; w=glob.glob('dist/*.whl'); assert w, f'No wheel built. dist contains: {glob.glob(\"dist/*\")}'; print(w[0])")"
 
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
+          aws-region: us-west-2
+
+      - name: Get integration credentials from AWS Secrets Manager
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            CREDS,api-sdk-integration-test-creds
+          parse-json-secrets: true
+
       - name: Run integration tests
         env:
-          LEGACY_USER_DROPBOX_TOKEN: ${{ secrets.LEGACY_USER_DROPBOX_TOKEN }}
-          LEGACY_USER_CLIENT_ID: ${{ secrets.LEGACY_USER_CLIENT_ID }}
-          LEGACY_USER_CLIENT_SECRET: ${{ secrets.LEGACY_USER_CLIENT_SECRET }}
-          LEGACY_USER_REFRESH_TOKEN: ${{ secrets.LEGACY_USER_REFRESH_TOKEN }}
-          SCOPED_USER_CLIENT_ID: ${{ secrets.SCOPED_USER_CLIENT_ID }}
-          SCOPED_USER_CLIENT_SECRET: ${{ secrets.SCOPED_USER_CLIENT_SECRET }}
-          SCOPED_USER_REFRESH_TOKEN: ${{ secrets.SCOPED_USER_REFRESH_TOKEN }}
-          SCOPED_TEAM_DROPBOX_TOKEN: ${{ secrets.SCOPED_TEAM_DROPBOX_TOKEN }}
-          SCOPED_TEAM_CLIENT_ID: ${{ secrets.SCOPED_TEAM_CLIENT_ID }}
-          SCOPED_TEAM_CLIENT_SECRET: ${{ secrets.SCOPED_TEAM_CLIENT_SECRET }}
-          SCOPED_TEAM_REFRESH_TOKEN: ${{ secrets.SCOPED_TEAM_REFRESH_TOKEN }}
-          DROPBOX_SHARED_LINK: ${{ secrets.DROPBOX_SHARED_LINK }}
+          SCOPED_USER_CLIENT_ID: ${{ env.CREDS_SCOPED_USER_CLIENT_ID }}
+          SCOPED_USER_CLIENT_SECRET: ${{ env.CREDS_SCOPED_USER_CLIENT_SECRET }}
+          SCOPED_USER_REFRESH_TOKEN: ${{ env.CREDS_SCOPED_USER_REFRESH_TOKEN }}
+          SCOPED_TEAM_CLIENT_ID: ${{ env.CREDS_SCOPED_TEAM_CLIENT_ID }}
+          SCOPED_TEAM_CLIENT_SECRET: ${{ env.CREDS_SCOPED_TEAM_CLIENT_SECRET }}
+          SCOPED_TEAM_REFRESH_TOKEN: ${{ env.CREDS_SCOPED_TEAM_REFRESH_TOKEN }}
+          DROPBOX_SHARED_LINK: ${{ env.CREDS_DROPBOX_SHARED_LINK }}
         run: |
           pytest -v test/integration/test_dropbox.py

.github/workflows/coverage.yml

@@ -10,6 +10,9 @@ on:
 jobs:
   Coverage:
     runs-on: ubuntu-latest
+    permissions:  # required for OIDC
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v7
       - name: Setup Python environment
@@ -32,14 +35,34 @@ jobs:
         run: |
           coverage run --rcfile=.coveragerc -m pytest test/unit/
           coverage xml
+      # Upload steps gated to same-repo runs: fork PRs cannot assume the role.
+      - name: Configure AWS credentials (OIDC)
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
+          aws-region: us-west-2
+      - name: Get Codecov token from AWS Secrets Manager
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            CODECOV_TOKEN,codecov-token-dropbox-sdk-python
+          parse-json-secrets: false
       - name: Publish Coverage
         uses: codecov/codecov-action@v7
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ env.CODECOV_TOKEN }}
           flags: unit
           fail_ci_if_error: true
   IntegrationCoverage:
+    # Skip on fork PRs: they cannot assume the OIDC role.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    permissions:  # required for OIDC
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v7
       - name: Setup Python environment
@@ -58,26 +81,33 @@ jobs:
           pip install -r requirements.txt
           pip install -r test/requirements.txt
           pip install .
-      - name: Generate Unit Test Coverage
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
+          aws-region: us-west-2
+      - name: Get integration credentials from AWS Secrets Manager
+        uses: aws-actions/aws-secretsmanager-get-secrets@v3
+        with:
+          secret-ids: |
+            CREDS,api-sdk-integration-test-creds
+            CODECOV_TOKEN,codecov-token-dropbox-sdk-python
+          parse-json-secrets: true
+      - name: Generate Coverage
         env:
-          LEGACY_USER_DROPBOX_TOKEN: ${{ secrets.LEGACY_USER_DROPBOX_TOKEN }}
-          LEGACY_USER_CLIENT_ID: ${{ secrets.LEGACY_USER_CLIENT_ID }}
-          LEGACY_USER_CLIENT_SECRET: ${{ secrets.LEGACY_USER_CLIENT_SECRET }}
-          LEGACY_USER_REFRESH_TOKEN: ${{ secrets.LEGACY_USER_REFRESH_TOKEN }}
-          SCOPED_USER_CLIENT_ID: ${{ secrets.SCOPED_USER_CLIENT_ID }}
-          SCOPED_USER_CLIENT_SECRET: ${{ secrets.SCOPED_USER_CLIENT_SECRET }}
-          SCOPED_USER_REFRESH_TOKEN: ${{ secrets.SCOPED_USER_REFRESH_TOKEN }}
-          SCOPED_TEAM_DROPBOX_TOKEN: ${{ secrets.SCOPED_TEAM_DROPBOX_TOKEN }}
-          SCOPED_TEAM_CLIENT_ID: ${{ secrets.SCOPED_TEAM_CLIENT_ID }}
-          SCOPED_TEAM_CLIENT_SECRET: ${{ secrets.SCOPED_TEAM_CLIENT_SECRET }}
-          SCOPED_TEAM_REFRESH_TOKEN: ${{ secrets.SCOPED_TEAM_REFRESH_TOKEN }}
-          DROPBOX_SHARED_LINK: ${{ secrets.DROPBOX_SHARED_LINK }}
+          SCOPED_USER_CLIENT_ID: ${{ env.CREDS_SCOPED_USER_CLIENT_ID }}
+          SCOPED_USER_CLIENT_SECRET: ${{ env.CREDS_SCOPED_USER_CLIENT_SECRET }}
+          SCOPED_USER_REFRESH_TOKEN: ${{ env.CREDS_SCOPED_USER_REFRESH_TOKEN }}
+          SCOPED_TEAM_CLIENT_ID: ${{ env.CREDS_SCOPED_TEAM_CLIENT_ID }}
+          SCOPED_TEAM_CLIENT_SECRET: ${{ env.CREDS_SCOPED_TEAM_CLIENT_SECRET }}
+          SCOPED_TEAM_REFRESH_TOKEN: ${{ env.CREDS_SCOPED_TEAM_REFRESH_TOKEN }}
+          DROPBOX_SHARED_LINK: ${{ env.CREDS_DROPBOX_SHARED_LINK }}
         run: |
           coverage run --rcfile=.coveragerc -m pytest test/integration/test_dropbox.py
           coverage xml
       - name: Publish Coverage
         uses: codecov/codecov-action@v7
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ env.CODECOV_TOKEN }}
           flags: integration
           fail_ci_if_error: true

dropbox/dropbox_client.py

@@ -20,6 +20,7 @@
 
 from datetime import datetime, timedelta
 from dropbox.auth import (
+    AccessError_validator,
     AuthError_validator,
     RateLimitError_validator,
 )
@@ -51,7 +52,7 @@
     pinned_session,
     DEFAULT_TIMEOUT
 )
-from stone.backends.python_rsrc import stone_serializers
+from stone.backends.python_rsrc import stone_serializers, stone_validators
 
 PATH_ROOT_HEADER = 'Dropbox-API-Path-Root'
 HTTP_STATUS_INVALID_PATH_ROOT = 422
@@ -698,7 +699,28 @@ def raise_dropbox_error_for_resp(self, res):
                 else:
                     retry_after = None
             raise RateLimitError(request_id, err, retry_after)
-        elif res.status_code in (403, 404, 409):
+        elif res.status_code == 403:
+            # Access errors are global API errors rather than errors from the
+            # individual route. Decode strictly so a route-specific error that
+            # happens to use HTTP 403 can still be handled by the requester.
+            try:
+                body = res.json()
+                err = stone_serializers.json_compat_obj_decode(
+                    AccessError_validator, body['error'], strict=True)
+            except (ValueError, TypeError, KeyError,
+                    stone_validators.ValidationError):
+                return
+
+            user_message = body.get('user_message')
+            if isinstance(user_message, dict):
+                user_message_text = user_message.get('text')
+                user_message_locale = user_message.get('locale')
+            else:
+                user_message_text = None
+                user_message_locale = None
+            raise ApiError(request_id, err,
+                           user_message_text, user_message_locale)
+        elif res.status_code in (404, 409):
             # special case handled by requester
             return
         elif not (200 <= res.status_code <= 299):

test/integration/test_dropbox.py

@@ -114,9 +114,15 @@ def bad_secret_dbx_from_env(dbx_session):
 
 @pytest.fixture()
 def dbx_team_from_env(dbx_session):
-    team_oauth2_token = _value_from_env_or_die(
-        format_env_name(SCOPED_KEY, TEAM_KEY, ACCESS_TOKEN_KEY))
-    return DropboxTeam(team_oauth2_token, session=dbx_session)
+    refresh_token = _value_from_env_or_die(
+        format_env_name(SCOPED_KEY, TEAM_KEY, REFRESH_TOKEN_KEY))
+    app_key = _value_from_env_or_die(
+        format_env_name(SCOPED_KEY, TEAM_KEY, CLIENT_ID_KEY))
+    app_secret = _value_from_env_or_die(
+        format_env_name(SCOPED_KEY, TEAM_KEY, CLIENT_SECRET_KEY))
+    return DropboxTeam(oauth2_refresh_token=refresh_token,
+                       app_key=app_key, app_secret=app_secret,
+                       session=dbx_session)
 
 
 @pytest.fixture()

test/unit/test_dropbox_unit.py

@@ -15,7 +15,7 @@
 )
 from dropbox.content_hash import content_hash
 from dropbox.common import PathRoot
-from dropbox.exceptions import AuthError, BadInputError
+from dropbox.exceptions import ApiError, AuthError, BadInputError
 from dropbox.oauth import OAuth2FlowNoRedirectResult, DropboxOAuth2FlowNoRedirect
 from datetime import datetime, timedelta
 
@@ -509,6 +509,62 @@ def test_refresh_raises_after_exhausting_retries(self, server_error_session_inst
         # Initial attempt + 2 retries.
         assert server_error_session_instance.post.call_count == 3
 
+    def test_upload_decodes_global_access_error(self, mocker):
+        payload = {
+            'error': {
+                '.tag': 'invalid_account_type',
+                'invalid_account_type': {'.tag': 'feature'},
+            },
+            'error_summary': 'invalid_account_type/feature/',
+            'user_message': {
+                'text': 'Uploads are unavailable for this account.',
+                'locale': 'en',
+            },
+        }
+        response = mock.MagicMock(status_code=403)
+        response.headers = {
+            'content-type': 'application/json',
+            'x-dropbox-request-id': 'request-id',
+        }
+        response.json.return_value = payload
+        response.content = json.dumps(payload).encode('utf-8')
+        response.text = json.dumps(payload)
+        session_obj = create_session()
+        mocker.patch.object(session_obj, 'post', return_value=response)
+        dbx = Dropbox(oauth2_access_token=ACCESS_TOKEN, session=session_obj)
+
+        with pytest.raises(ApiError) as exc_info:
+            dbx.files_upload(b'test', '/test.txt')
+
+        assert exc_info.value.request_id == 'request-id'
+        assert exc_info.value.error.is_invalid_account_type()
+        assert exc_info.value.error.get_invalid_account_type().is_feature()
+        assert exc_info.value.user_message_text == \
+            'Uploads are unavailable for this account.'
+        assert exc_info.value.user_message_locale == 'en'
+
+    def test_upload_preserves_route_specific_403_error(self, mocker):
+        payload = {
+            'error': {'.tag': 'payload_too_large'},
+            'error_summary': 'payload_too_large/',
+        }
+        response = mock.MagicMock(status_code=403)
+        response.headers = {
+            'content-type': 'application/json',
+            'x-dropbox-request-id': 'request-id',
+        }
+        response.json.return_value = payload
+        response.content = json.dumps(payload).encode('utf-8')
+        response.text = json.dumps(payload)
+        session_obj = create_session()
+        mocker.patch.object(session_obj, 'post', return_value=response)
+        dbx = Dropbox(oauth2_access_token=ACCESS_TOKEN, session=session_obj)
+
+        with pytest.raises(ApiError) as exc_info:
+            dbx.files_upload(b'test', '/test.txt')
+
+        assert exc_info.value.error.is_payload_too_large()
+
 
 class TestAutoContentHash: