Repository navigation
Confirm: class endpoints now require obj_owner (breaking default from #22) #28
Description
Decision recorded, already acted on (reversible): class endpoints now require obj_owner.
#22 is fixed following the convention set in #18: a safe default plus a named opt-in. A handler whose endpoint is a class must now say who owns the objects clients create:
obj_owner=<callable(request) -> owner>: objects are bound to their creator, and another owner's id is simply not found. Each owner has a quota (obj_quota), so one client cannot evict another's objects.obj_owner=shared_objects: the old behaviour, where any client holding the id may use the object. This is now an explicit opt-in.
Without either, building the service raises a ValueError that names both options. This breaks existing class-endpoint handlers. No package in the fleet uses one, and the py2http tests were migrated with obj_owner=shared_objects. It will still reach PyPI users of class endpoints on the next release.
Recommendation: keep it. The alternative is to default to shared_objects with a logged warning, which is not a breaking change but leaves capability-only access as the silent default. That is a one-line change in _class_endpoint_dispatcher if you prefer it. Close this issue to accept the change, or comment to flip it.
Activity
thorwhalen commentedon Oct 13, 2026
Extended by #31 (fix for #30): instance endpoints (an object exposed through
attr_names) now needobj_ownertoo. That is either a(request) -> ownerhook, which refuses requests it does not identify, orobj_owner=shared_objects. Module endpoints are unchanged. The same recommendation holds: keep it.Correction to the issue text: the fleet does use these endpoints. addaix/raglab_app has a class endpoint (
web_services/prompt_pilote.py) and two instance endpoints (store_access.pyandprompt_templates_dde.py, both exposing writes). A migration issue is filed there.