request to re-use a small amount of aiohttp code under MIT license

[cjw296]

Is your feature request related to a problem?

I'm working on a PR to improve the aiohttp support in pook.

@sarayourfriend has rightly pointed out that I'm using some Apache 2.0 code in a project with an MIT license.

Describe the solution you'd like

By email, Sara suggested that you folks might be able to offer pook that section of code under an MIT license.

Describe alternatives you've considered

Current suggestion is to keep the code in a separate file in the pook repo with a separate license, but that creates an awkward split and a bit more maintenance burden. (and, if we're splitting hairs, a small runtime cost for the extra functions calls...)

Related component

Client

Additional context

No response

Code of Conduct

• I agree to follow the aio-libs Code of Conduct

[webknjaz]

It's usually not possible to re-license other people's contributions without consent. You'd have to track down each person and get them to agree.

[Dreamsorcerer]

If the entire section of code you're talking about is this:

        auth = kw.get('auth')
        if (
            auth is None
            and session._default_auth
            and (
            not session._base_url or session._base_url_origin == full_url.origin()
        )
        ):
            auth = session._default_auth

        headers = session._prepare_headers(headers)

        aiohttp_req = session._request_class(
            method,
            full_url,
            params=original_params,
            headers=headers,
            skip_auto_headers=None,  # XXX
            data=data,
            cookies=None, # XXX
            auth=auth,
            version=session._version,
            compress=kw.get('compress'),
            chunked=kw.get('chunked'),
            expect100=kw.get('expect100', False),
            loop=session._loop,
            response_class=session._response_class,
            proxy=None,  # XXX
            proxy_auth=kw.get('proxy_auth'),
            timer=None,  # XXX,
            session=session,
            ssl=None,  # XXX,
            server_hostname=kw.get('server_hostname'),
            proxy_headers=None,  # XXX
            traces=None,  # XXX
            trust_env=session.trust_env,
        )

        self.set_headers(req, aiohttp_req.headers)

I'm not even sure that's enough to be copyrightable (if you asked someone without looking at the code to create code which created a new request object using the session's request class and set the headers with it, then you'd probably get identical code and it wouldn't be copyright infringement).

For what it's worth, for any copyright I have on that code, you can use it.

I'd also note that the auth block may be removed in future, as we may deprecate that parameter in favour of the new client middlewares.

Also, are you sure your functionality couldn't be implemented as a client middleware? It'd make your code simpler and far more robust while completely avoiding any copyright concerns.

[cjw296]

@webknjaz - for projects with a defined contributor agreement, such as cpython, the assignment done through that usually enables the project maintainers to relicense contributions as they wish. I don't know what the aiohttp contributor process looks like, but I would be surprised if any contributors would have issue with a contribution they've made being relicensed in the way I'm requesting.

But also, stepping back, as @Dreamsorcerer points out, this is a very small piece of code, and I'm looking purely to use it in a helper library for testing code written to use aiohttp, nothing more :-)

@Dreamsorcerer: Also, are you sure your functionality couldn't be implemented as a client middleware?

If there's a better way, I'd love to use it! I'm trying to get this test to pass, which is a real world situation I hit where I wanted to assert that auth passed to the ClientSession has the correct stuff in it, but pook's current interceptor doesn't exercise the code which actually does that (which is the bit I'm asking about licensing here).

Do you have any examples of the pattern you're referring to and any hints how I could apply them in the pook usecase?

[Dreamsorcerer]

Do you have any examples of the pattern you're referring to and any hints how I could apply them in the pook usecase?

We have a cookbook of middleware examples. At first glance, it looks like the entire interceptor could be written as a middleware.
The docs are here (with a link to the coobook): https://docs.aiohttp.org/en/stable/client_advanced.html#aiohttp-client-middleware

[webknjaz]

@cjw296 CLA is mostly used by big corps to make sure that they can do whatever with the contributed code. But mostly, this mechanism is hated in FOSS because it allows them to screw with the contributors and commercialize it without consent and dealing with IP. This why most projects don't do this. In Python, it's mostly just the PSF, I think but they do this due to legal obligations that are quite clear.

---

CLA aside, I can let you use whatever I contributed under MIT if I touched that snippet. I can't talk about anybody who contributed thinking that it'd be shipped under the current license.

That said, licensing might not apply as Sam mentioned — this snippet is small and I'm sure any clean-room reimplementation will reproduce it byte-to-byte. There's nothing significant or unique about it. INAL but I don't think it's a problem to copy basically two function calls (

aiohttp/aiohttp/client.py

Line 481 in 1569ad9

headers = self._prepare_headers(headers)

/

aiohttp/aiohttp/client.py

Lines 583 to 658 in 1569ad9

	if (
	auth is None
	and self._default_auth
	and (
	not self._base_url or self._base_url_origin == url.origin()
	)
	):
	auth = self._default_auth
	# Try netrc if auth is still None and trust_env is enabled.
	# Only check if NETRC environment variable is set to avoid
	# creating an expensive executor job unnecessarily.
	if (
	auth is None
	and self._trust_env
	and url.host is not None
	and os.environ.get("NETRC")
	):
	auth = await self._loop.run_in_executor(
	None, self._get_netrc_auth, url.host
	)
	# It would be confusing if we support explicit
	# Authorization header with auth argument
	if auth is not None and hdrs.AUTHORIZATION in headers:
	raise ValueError(
	"Cannot combine AUTHORIZATION header "
	"with AUTH argument or credentials "
	"encoded in URL"
	)
	all_cookies = self._cookie_jar.filter_cookies(url)
	if cookies is not None:
	tmp_cookie_jar = CookieJar(
	quote_cookie=self._cookie_jar.quote_cookie
	)
	tmp_cookie_jar.update_cookies(cookies)
	req_cookies = tmp_cookie_jar.filter_cookies(url)
	if req_cookies:
	all_cookies.load(req_cookies)
	proxy_: URL | None = None
	if proxy is not None:
	proxy_ = URL(proxy)
	elif self._trust_env:
	with suppress(LookupError):
	proxy_, proxy_auth = await asyncio.to_thread(
	get_env_proxy_for_url, url
	)
	req = self._request_class(
	method,
	url,
	params=params,
	headers=headers,
	skip_auto_headers=skip_headers,
	data=data,
	cookies=all_cookies,
	auth=auth,
	version=version,
	compress=compress,
	chunked=chunked,
	expect100=expect100,
	loop=self._loop,
	response_class=self._response_class,
	proxy=proxy_,
	proxy_auth=proxy_auth,
	timer=timer,
	session=self,
	ssl=ssl,
	server_hostname=server_hostname,
	proxy_headers=proxy_headers,
	traces=traces,
	trust_env=self.trust_env,
	)

).

What I'm worried about, though, is that you're relying on private APIs. That would be fragile and I'd like to echo Sam's suggestion to explore ways of using public APIs. If that's not possible, perhaps we could build some that would fit your use case.

[Dreamsorcerer]

I'll close this, as there's not actions for us. Feel free to ask further questions.

[sarayourfriend]

Hey folks, thanks for taking a look at this. In the end I was able to refactor pook's aiohttp integration to use middleware and avoid needing to hook into so many private methods and attributes. It's still reliant on patching ClientSession._request to inject a middleware to every request when pook is active, but otherwise pook now defers to the actual _request function for everything else, including building the request object.

[Dreamsorcerer]

It's still reliant on patching ClientSession._request to inject a middleware to every request when pook is active

An alternative would be to just put the middleware on the ClientSession and have the middleware check if pook is active in order to decide whether it should run its code or just fall through.

Either way, looks like a far more robust solution now.

[sarayourfriend]

An alternative would be to just put the middleware on the ClientSession and have the middleware check if pook is active in order to decide whether it should run its code or just fall through.

I'm not sure I follow. Would that rely on pook's users adding the middleware themselves? Or is there a mechanism to add a middleware to every request or ClientSession instance?

[Dreamsorcerer]

I'm not sure I follow. Would that rely on pook's users adding the middleware themselves? Or is there a mechanism to add a middleware to every request or ClientSession instance?

I guess if you need to inject it then it won't work.