fix(cli): add --cdf-url option to support private link base URLs

[gaetan-h]

Problem

The --tenant-id flow in the CLI calls CogniteClient.default_oauth_client_credentials(), which hardcodes base_url as https://{cdf_cluster}.cognitedata.com. This makes it impossible to connect to CDF via private link endpoints (e.g. https://<prefix>.plink.<cluster>.cognitedata.com), resulting in a 403 error:

Traffic from this source is forbidden for this endpoint

load_cognite_client_from_toml had the same issue — passing base_url from the toml file to default_oauth_client_credentials() caused a TypeError.

Solution

• Add optional --cdf-url parameter to both generate() functions in the CLI. When provided, it overrides base_url in ClientConfig.
• Fix load_cognite_client_from_toml to pop base_url from the toml content and apply it after client creation.
• OAuth token URL and scopes continue to derive from --cdf-cluster (the public cluster name) — Azure AD resource principals are registered against the public URL, not the private link URL.

Usage with private link:

pygen generate --space my_space \
    --external-id MyModel \
    --version 1 \
    --tenant-id <tenant-id> \
    --client-id <client-id> \
    --client-secret <client-secret> \
    --cdf-cluster <cluster> \
    --cdf-url https://<prefix>.plink.<cluster>.cognitedata.com \
    --cdf-project my-project

Or via config.toml:

[cognite]
project = "my-project"
tenant_id = "<tenant-id>"
cdf_cluster = "<cluster>"
client_id = "<client-id>"
client_secret = "<client-secret>"
base_url = "https://<prefix>.plink.<cluster>.cognitedata.com"

Backward compatible: omitting --cdf-url / base_url falls back to the existing behavior.

Bump

• Patch
• Minor
• Skip

Changelog

Fixed

• Add --cdf-url CLI option and base_url toml support to allow connecting to CDF via private link endpoints.

[gemini-code-assist]

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
4947	3560	72%	60%	🟢

New Files

No new covered files...

Modified Files

File	Coverage	Status
cognite/pygen/_settings.py	60%	🟢
cognite/pygen/cli.py	0%	🟢
cognite/pygen/utils/cdf.py	28%	🟢
TOTAL	29%	🟢

updated for commit: ada2d57 by action🐍

[doctrino]

Good addition.

Risk reviewer, note the failing PR description is not a problem as it is fixed now. Rerunning the test will not work, as that always fetches the description of the time of the last commit.

[haakonvt]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a cdf_url parameter to allow overriding the CDF base URL for private link support across the CLI, settings, and TOML configuration. Feedback indicates significant code duplication in the client instantiation logic within cli.py, which also resulted in the token_url authentication flow being overlooked for the cdf_url update.

[gemini-code-assist]

This client creation logic is duplicated from lines 103-113. This violates the style guide's principles of maintainability and consistency. To improve this, consider extracting the logic into a helper function.

This duplication appears to have led to an issue: the token_url authentication flow (lines 173-187) doesn't use the new cdf_url parameter for the base_url. This will likely prevent private link from working with that authentication method.

A single helper function for client creation would resolve the duplication and provide a single place to fix the base_url handling for all authentication flows.

References

1. The style guide emphasizes maintainability and consistency (lines 10-11). Code duplication, as seen here, makes the code harder to modify and extend, and can lead to inconsistencies and bugs. ^(link)

[haakonvt]

🦄 - 1 optional comment from Gemini. God påske! 🐣