python(feat): let download_file forward extra headers to rest_client.get#677
Merged
Conversation
Presigned S3-style URLs bind their signature to a specific Host authority. Callers that route the request through a container- internal alias (e.g. accessing local minio at `s3:9090` from inside a pyworker container while the URL was signed against the browser- facing `localhost:9090`) need to override the outbound `Host` header so the SigV4 check still validates. Today the only way is to bypass `download_file` entirely and reimplement streaming + auth stripping on top of a raw `requests.get`. Add an optional `extra_headers` kwarg that merges on top of the internal `Authorization: None` strip. Absent callers get identical behavior. When present, callers can override Host, add a Range, supply a proxy-scoped Authorization, etc. without giving up the SDK's rest session or the streamed chunk loop. Tests cover: (a) default behavior unchanged, (b) merged headers forwarded verbatim, and (c) caller-supplied Authorization wins over the strip when explicitly set (documented as a "default, not invariant" property). Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Python docs preview: https://sift-stack.github.io/sift/python/pr-677/ Deployed from |
alexluck-sift
previously approved these changes
Jul 9, 2026
ian-sift
enabled auto-merge (squash)
July 9, 2026 23:25
alexluck-sift
self-requested a review
July 10, 2026 00:22
alexluck-sift
approved these changes
Jul 10, 2026
alexluck-sift
pushed a commit
that referenced
this pull request
Jul 11, 2026
Bump version to 0.19.0 and update the changelog for the PRs merged since v0.18.0: ABAC attributes (#646), get_data cache improvements (#650), pytest docstring cleaning (#658), ULog data imports (#663), access control API grouping (#666), report templates (#672), download_file extra headers (#677), and the get_data pagination fix plus progress bars (#678). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y5U49rrpvQm5bPbvEjR4xr
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Presigned S3-style URLs bind their signature to a specific
Hostauthority. Callers that route the request through a container-internal alias — e.g. accessing local minio ats3:9090from inside a docker container while the URL was signed against the browser-facinglocalhost:9090— need to override the outboundHostheader so the SigV4 check still validates. Today the only way is to bypassdownload_fileentirely and reimplement streaming + auth stripping on top of a raw `requests.get`.Add an optional
extra_headerskwarg that merges on top of the internalAuthorization: Nonestrip:extra_headersdefaults toNone).Host, add aRange, supply a proxy-scopedAuthorization, etc. without giving up the SDK's rest session or the streamed 4 MiB chunk loop.Motivation
This is being landed to let the sift-stack/azimuth canvas file-attachment download path collapse its "local-dev loopback" and "production" branches into a single
download_file(...)call. Right now that codebase carries a full parallel implementation (streamedrequests.get+.part-file crash-safe rename) solely to inject oneHostheader.Test plan
pytest lib/sift_client/_tests/_internal/util/test_file.py— 3 passed:test_no_extra_headers_strips_only_authorization— default behavior unchangedtest_extra_headers_are_forwarded— merged headers reachrest_client.gettest_extra_headers_can_override_authorization_strip— caller-supplied Authorization wins (documented as "default, not invariant")Downstream
Azimuth follow-up (blocked on this landing + a
0.19.xrelease, or on Sift's private packages gateway picking it up under the current version).Made with Cursor