address review comments

- raise a clear ValueError when login_type is used but the backend cannot
  be resolved (the API rejects loginType without backend)
- cache the resolved default backend on the instance to avoid repeated
  tokens/verify calls
- update stale detail()/reset_password() docstrings for key-pair workspaces
- derive keypair_create_response mock from create_response
- add tests for non-snowflake default backend, verify caching and the
  unresolvable-backend error

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jirkasemmler

kbcstorage/workspaces.py

@@ -74,6 +74,7 @@ def __init__(self, root_url, token):
             token (:obj:`str`): A storage API key.
         """
         super().__init__(root_url, 'workspaces', token)
+        self._default_backend = None
 
     def list(self):
         """
@@ -91,8 +92,9 @@ def detail(self, workspace_id):
         """
         Retrieves information about a given workspace.
 
-        Note that the password to the workspace can only be retrieved when the
-        workspace is created.
+        Note that the workspace credentials (password or private key,
+        depending on the login type) are only available when the workspace
+        is created and cannot be retrieved later.
 
         Args:
             workspace_id (int or str): The id of the workspace.
@@ -138,6 +140,11 @@ def create(self, backend=None, timeout=None, login_type=None, public_key=None, r
         """
         private_key = None
         effective_backend = backend or self._get_default_backend()
+        if effective_backend is None and login_type is not None:
+            raise ValueError(
+                "Cannot resolve the project's default backend from the token; "
+                "pass backend explicitly when using login_type."
+            )
         if effective_backend == BACKEND_SNOWFLAKE:
             if login_type in (None, LOGIN_TYPE_DEFAULT):
                 login_type = LOGIN_TYPE_SNOWFLAKE_SERVICE_KEYPAIR
@@ -163,9 +170,14 @@ def create(self, backend=None, timeout=None, login_type=None, public_key=None, r
     def _get_default_backend(self):
         """
         Resolve the project's default backend from the token detail.
+
+        The value is cached on the instance - a project's default backend is
+        effectively immutable for the client's lifetime.
         """
-        token_info = Tokens(self.root_url, self.token).verify()
-        return (token_info.get('owner') or {}).get('defaultBackend')
+        if self._default_backend is None:
+            token_info = Tokens(self.root_url, self.token).verify()
+            self._default_backend = (token_info.get('owner') or {}).get('defaultBackend')
+        return self._default_backend
 
     def delete(self, workspace_id):
         """
@@ -187,6 +199,11 @@ def reset_password(self, workspace_id):
         """
         Generate a new password for the workspace.
 
+        Only supported for password-based login types (e.g. the deprecated
+        'snowflake-legacy-service'). For key-pair workspaces rotate the
+        credentials with set_public_key() using a freshly generated key pair
+        instead.
+
         Args:
             workspace_id (int or str): The id of the workspace for which the
                 password should be reset.

tests/mocks/test_workspaces.py

@@ -1,6 +1,7 @@
 """
 Asses basic functionality of the Workspace endpoint.
 """
+import copy
 import unittest
 from urllib.parse import parse_qs
 
@@ -179,6 +180,84 @@ def test_create_snowflake_explicit_legacy_login_type(self):
         assert 'publicKey' not in request_body
         assert created_detail['connection']['password'] == 'abc'
 
+    @responses.activate
+    def test_create_non_snowflake_default_backend_unchanged(self):
+        """
+        When the project default backend resolved from the token is not
+        snowflake, no login type, public key or backend is sent.
+        """
+        bigquery_verify_response = copy.deepcopy(verify_token_response)
+        bigquery_verify_response['owner']['defaultBackend'] = 'bigquery'
+        responses.add(
+            responses.Response(
+                method='GET',
+                url='https://connection.keboola.com/v2/storage/tokens/verify',
+                json=bigquery_verify_response
+            )
+        )
+        responses.add(
+            responses.Response(
+                method='POST',
+                url='https://connection.keboola.com/v2/storage/workspaces',
+                json=create_response
+            )
+        )
+        self.ws.create()
+        request_body = parse_qs(responses.calls[1].request.body)
+        assert 'backend' not in request_body
+        assert 'loginType' not in request_body
+        assert 'publicKey' not in request_body
+
+    @responses.activate
+    def test_create_caches_default_backend(self):
+        """
+        The default backend is resolved via the token verify call only once
+        per endpoint instance.
+        """
+        responses.add(
+            responses.Response(
+                method='GET',
+                url='https://connection.keboola.com/v2/storage/tokens/verify',
+                json=verify_token_response
+            )
+        )
+        responses.add(
+            responses.Response(
+                method='POST',
+                url='https://connection.keboola.com/v2/storage/workspaces',
+                json=keypair_create_response
+            )
+        )
+        responses.add(
+            responses.Response(
+                method='POST',
+                url='https://connection.keboola.com/v2/storage/workspaces',
+                json=keypair_create_response
+            )
+        )
+        self.ws.create()
+        self.ws.create()
+        verify_calls = [c for c in responses.calls if c.request.method == 'GET']
+        assert len(verify_calls) == 1
+
+    @responses.activate
+    def test_create_login_type_without_resolvable_backend_raises(self):
+        """
+        The API rejects loginType without an explicit backend, so the client
+        raises a clear error when the default backend cannot be resolved.
+        """
+        no_backend_verify_response = copy.deepcopy(verify_token_response)
+        del no_backend_verify_response['owner']['defaultBackend']
+        responses.add(
+            responses.Response(
+                method='GET',
+                url='https://connection.keboola.com/v2/storage/tokens/verify',
+                json=no_backend_verify_response
+            )
+        )
+        with self.assertRaises(ValueError):
+            self.ws.create(login_type='none')
+
     @responses.activate
     def test_create_non_snowflake_backend_unchanged(self):
         """

tests/mocks/workspace_responses.py

@@ -76,29 +76,11 @@
 }
 
 keypair_create_response = {
-    "id": 235,
-    "name": "boring_wozniak",
-    "type": "table",
-    "component": "wr-db",
-    "configurationId": "aws-1",
-    "created": "2016-05-17T11:11:20+0200",
+    **create_response,
     "connection": {
-        "backend": "snowflake",
-        "host": "keboola.snowflakecomputing.com",
-        "database": "keboola_123",
-        "schema": "boring_wozniak",
-        "warehouse": "SAPI_PROD",
-        "user": "xzy",
-        "loginType": "snowflake-service-keypair"
-    },
-    "creatorToken": {
-        "id": 234,
-        "description": "martin@keboola.com"
+        **{k: v for k, v in create_response["connection"].items() if k != "password"},
+        "loginType": "snowflake-service-keypair",
     },
-    "creatorUser": {
-        "id": 234,
-        "name": "Martin"
-    }
 }
 
 load_tables_response = {