[kvlonge]

sl.http jobs can now use the OAuth2 resource-owner password grant.

• sl.oauth2_password(token_url, *, scope=None, client_auth="basic") posts grant_type=password with the connection's username and password. It sends client_id and client_secret too when the connection has them, as basic auth or as form fields, the same as the existing OAuth2 kinds.
• Renewal works like the existing kinds: the token is cached, renewed before it expires, and renewed once after a 401. When the token response includes a refresh_token, later renewals use it. When it doesn't, or the server refuses it, the password grant runs again. A transient failure (5xx/429) while refreshing is retried, and the password is not resent; if it persists, the run exits 75.
• The password is redacted like the other secrets: raw, percent-encoded, form-encoded and JSON-escaped. A token-endpoint JSON error body is re-serialised before it is shown, so a password the server echoes back with its own escaping is still hidden.
• Wrong credentials fail with exit 1 and retryable: false in --json.
• Existing OAuth2 kinds send the same token form as before. A test asserts that only the password grant sends username and password.

Docs: sources/python.mdx (auth table and OAuth2 section) and configuration.mdx, marked as coming in 0.36.0.

Tests: new cases in packages/sqlload/tests/test_http_jobs.py against a stub token server:

• the first grant;
• renewal before expiry;
• a 401 followed by a new token, with the rotated refresh token;
• falling back to the password when the refresh token is refused;
• a token endpoint that is down once (with retries, and without retries giving exit 75);
• a wrong password in --json, with the echoed password redacted.

All 65 http job tests pass, and make check is clean. Mutation checks: removing the fallback, or the JSON re-serialisation, fails the matching test.

[cloudflare-workers-and-pages]

Deploying sqlload with    Cloudflare Pages

Latest commit:	2718e07
Status:	✅  Deploy successful!
Preview URL:	https://da7201c1.sqlload.pages.dev
Branch Preview URL:	https://feat-http-password-grant.sqlload.pages.dev

View logs