feat: Implement OAuth2 for apps to connect to temporal #585
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nishantmunjal7
requested review from
AtMrun,
firecast and
inishchith
as code owners
|
📜 Docstring Coverage ReportRESULT: PASSED (minimum: 30.0%, actual: 72.6%) Detailed Coverage Report |
Contributor
There was a problem hiding this comment.
Pull Request Overview
The PR introduces OAuth2 authentication for Temporal along with automatic secret store discovery and caching to enhance security and ease of configuration. Key changes include:
- Implementation of the AuthManager for OAuth2 token management with credential discovery and caching.
- Enhancements to SecretStoreInput for automatic Dapr secret store component discovery with a 5-minute cache TTL.
- Integration of authentication within the Temporal client, injecting gRPC metadata when auth is enabled.
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/unit/clients/test_auth_manager.py | Adds comprehensive unit tests covering token retrieval, caching, fallback, and errors. |
| application_sdk/inputs/secretstore.py | Implements secret store component discovery with caching but uses logger without import. |
| application_sdk/constants.py | Introduces new authentication-related environment variables. |
| application_sdk/clients/temporal.py | Integrates OAuth2 token handling and injects authentication metadata into connection. |
| application_sdk/clients/auth.py | Implements OAuth2 token management with automatic token refresh and credential caching. |
Comments suppressed due to low confidence (1)
application_sdk/inputs/secretstore.py:143
- The 'logger' is used in the SecretStoreInput class without being defined or imported, which will cause a runtime error. Consider importing and initializing logger using a standard logging framework or get_logger() from your observability module.
logger.info("Discovering available secret store components via Dapr metadata...")
📦 Trivy Vulnerability Scan Results
Report Summary
Scan Result Details✅ No vulnerabilities found during the scan for |
📦 Trivy Secret Scan Results
Report Summary
Scan Result Details✅ No secrets found during the scan for |
|
🛠 Docs available at: https://k.atlan.dev/application-sdk/feat/apps-auth |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
nishantmunjal7
force-pushed
the
feat/apps-auth
branch
2 times, most recently
from
517ff88 to
ebeb6d3
Compare
nishantmunjal7
force-pushed
the
feat/apps-auth
branch
2 times, most recently
from
944e499 to
f7482d9
Compare
Collaborator
☂️ Python Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
|
🛠 Full Test Coverage Report: https://k.atlan.dev/coverage/application-sdk/pr/585 |
nishantmunjal7
force-pushed
the
feat/apps-auth
branch
from
b3635d1 to
9c583bd
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
5 tasks
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
firecast
requested changes
Jul 31, 2025
inishchith
changed the title
inishchith
reviewed
Aug 4, 2025
inishchith
reviewed
Aug 4, 2025
inishchith
reviewed
Aug 4, 2025
nishantmunjal7
commented
Aug 5, 2025
Member
|
moved to #634 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add robust authentication infrastructure with automatic credential discovery
and token management for secure Temporal server communication.
New Components
AuthManager
SecretStoreInput enhancements
TemporalWorkflowClient integration
Key Features
Configuration
Environment variables:
WORKFLOW_AUTH_ENABLED: Enable/disable authenticationWORKFLOW_AUTH_URL: OAuth2 token endpointWORKFLOW_AUTH_CLIENT_ID/SECRET: Fallback credentialsSecret store format:
atlan-deployment-secrets{app_name}_client_id,{app_name}_client_secretBreaking Changes
TemporalWorkflowClient.load()now handles authentication automaticallyaiohttpfor OAuth2 requestssecretstores.*type patternDocumentation
Copyleft License Compliance