Validate API version families and pin SDK auth flow rules - #158
Merged
sergioteula merged 1 commit intoSep 4, 2026
Conversation
A custom auth_endpoint used to make any version valid, so a version of a family out of the known ones was sent with the Cognito flow: form encoded body, its scope and the version in the Authorization header. Amazon rejects that without explaining why, which is worse than not accepting the version. The flow of a version is now taken from a map of families, which also decides the endpoint validation, and a version of a family that is not in it is rejected even with a custom endpoint. A new version of a known family keeps working with an endpoint, as it only changes where the token is asked for, and the error of an unsupported version says so. Both clients also build the Authorization header with the same helper, and the version rules bundled in the SDK, which the library never uses because it resolves the endpoint and the flow on its own, are pinned by tests so a bump of the SDK cannot leave both halves disagreeing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GvgJW17WQYEJgPRXye826b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR strengthens version validation by distinguishing between unsupported versions within known families (2.x, 3.x) and versions from completely unknown families (4.x+). It also centralizes auth flow logic to ensure the library and bundled SDK stay in sync.
Key Changes
Version family validation: The library now rejects versions from unknown families (e.g., 4.x) even when a custom
auth_endpointis provided, since the auth flow (scope, encoding, headers) for that family is unknown. Only versions from known families (2.x, 3.x) can be used with a custom endpoint.Centralized auth flow logic:
get_flow()function to determine the auth flow (Cognito or LWA) based on version familybuild_authorization_header()function to construct the version-appropriate Authorization header in one placeis_lwa()andget_scope()to use the newget_flow()functionAsyncAmazonCreatorsApi._build_authorization_header()to use the new centralized functionSDK parity tests: Added comprehensive test suite (
sdk_parity_test.py) that validates the library's version rules match those in the bundled SDK:Improved error messages: Version validation errors now clearly distinguish between:
auth_endpoint)Documentation updates: Updated docstrings and README to clarify that custom endpoints only work for known version families.
Implementation Details
FAMILY_FLOWSdictionary maps major version numbers to their auth flows, making it easy to validate new versions belong to a known familyhttps://claude.ai/code/session_01GvgJW17WQYEJgPRXye826b