feat: AICORE_SERVICE_KEY parsing extended + Authentication refactor

packages/core/PYPIDESCRIPTION.md

@@ -86,12 +86,25 @@ There are different options to persist the client credentials
 (in this order of precedence): 
  - in code via keyword arguments (see above),
  - environment variables,
+ - from the `AICORE_SERVICE_KEY` environment variable, if set,
  - profile configuration file.
  - from VCAP_SERVICES environment variable, if exists
 
 A **profile** is a json file residing in a config directory, 
 which can be set via environment variable `AICORE_HOME` (the default being `~/.aicore/config.json`).
 
+`AICORE_SERVICE_KEY` can hold the full JSON service key downloaded from your subaccount's AI Core
+service instance (the same content as a service binding's `credentials` object), for example:
+
+```json
+{
+  "clientid": "* * * ",
+  "clientsecret": "* * * ",
+  "url": "https://* * * .authentication.sap.hana.ondemand.com",
+  "serviceurls": {"AI_API_URL": "https://api.ai.* * *.cfapps.sap.hana.ondemand.com"}
+}
+```
+
 The command `aicore configure --help` shows the options for generating a profile.
 
 With profile names one can switch easily between profiles e.g., for different (sub)accounts.

packages/core/ai_core_sdk/credentials.py

@@ -175,7 +175,7 @@ def init_conf(profile: str = None):
     return config
 
 
-def _extract_credentials(source: Source, credential_values: List[CredentialsValue], exclude: List[str] = None) \
+def extract_credentials(source: Source, credential_values: List[CredentialsValue], exclude: List[str] = None) \
         -> Dict[str, str]:
     """Extract all credentials from a source."""
     exclude = exclude or []
@@ -188,10 +188,10 @@ def _extract_credentials(source: Source, credential_values: List[CredentialsValu
     return credentials
 
 
-def _resolve_credentials(sources: List[Source], credential_values: List[CredentialsValue]) -> Dict[str, str]:
+def resolve_credentials(sources: List[Source], credential_values: List[CredentialsValue]) -> Dict[str, str]:
     """Extract credentials from the first source that has any defined."""
     for source in sources:
-        if credentials := _extract_credentials(source, exclude=['resource_group'], credential_values=credential_values):
+        if credentials := extract_credentials(source, exclude=['resource_group'], credential_values=credential_values):
             logger.debug(f"Using credentials from: {source.name}")
             return credentials
     raise ValueError("No credentials found in any source")
@@ -309,7 +309,7 @@ def fetch_credentials(profile: str = None, credential_values: List[CredentialsVa
                lambda cv, vcap_service = _load_vcap_service_key(): _str_or_none(vcap_service.get(cv.vcap_key, None) if vcap_service and cv.vcap_key else None)),
     ]
 
-    credentials = _resolve_credentials(sources, credential_values)
+    credentials = resolve_credentials(sources, credential_values)
 
     # Use cert_url as auth_url if present (VCAP provides cert_url for certificate auth)
     if 'cert_url' in credentials:

packages/gen/README_sphynx.md

@@ -45,6 +45,7 @@ In the table below, you can see which models and vendor specific langchain packa
 There are different ways to configure the SAP AI Core access (listed in order of precedence):
 
 - environment variables
+- from the `AICORE_SERVICE_KEY` environment variable, if set
 - (profile) configuration file
 - from VCAP_SERVICES environment variable, if it exists
 
@@ -72,6 +73,21 @@ as an alternative to client secret.
 - `AICORE_CERT_STR`: This is the content of the X.509 certificate as a string
 - `AICORE_KEY_STR`: This is the content of the X.509 key as a string
 
+### Service key
+
+Instead of setting the individual `AICORE_*` environment variables above, you can set `AICORE_SERVICE_KEY`
+to the full JSON service key downloaded from your subaccount's AI Core service instance (the same content
+as a service binding's `credentials` object), for example:
+
+```json
+{
+  "clientid": "* * * ",
+  "clientsecret": "* * * ",
+  "url": "https://* * * .authentication.sap.hana.ondemand.com",
+  "serviceurls": {"AI_API_URL": "https://api.ai.* * *.cfapps.sap.hana.ondemand.com"}
+}
+```
+
 ### Configuration files
 
 By default, the configuration file is located at `~/.aicore/config.json`. You can change the directory where the config file is located by setting the `AICORE_HOME` environment variable.

packages/gen/docs/gen_ai_hub/README.md

@@ -19,6 +19,9 @@ as an alternative to client secret.
 - `AICORE_CERT_STR`: This is the content of the X.509 certificate as a string
 - `AICORE_KEY_STR`: This is the content of the X.509 key as a string
 
+Instead of setting the individual parameters above, you can set `AICORE_SERVICE_KEY` to the full JSON
+service key retrieved in step 2 (the same content as a service binding's `credentials` object).
+
 The values can be set as environment variables are through config files. For most cases we recommend to used config files.
 The config files should be placed in AI Core home folder. Which can be set using the env var `AICORE_HOME`, it is set to 
 `~/.aicore`, by default.