PTHMINT-116: Add scoped credential resolver and client support

[zulquer]

This pull request introduces a new flexible credential resolution system to the MultiSafepay SDK, allowing API keys to be resolved dynamically based on authentication scope. The changes add the CredentialResolver protocol and a default ScopedCredentialResolver implementation, update the Client and Sdk classes to support this new mechanism, and extend tests to cover resolver-based authentication. This enables more advanced use cases, such as partner and group-based authentication, while maintaining backward compatibility.

The most important changes are:

Credential Resolution System:

• Added credential_resolver.py containing the CredentialResolver protocol, AuthScope dataclass, and the ScopedCredentialResolver implementation for resolving API keys by scope and group. This supports default, partner affiliate, and terminal group authentication scenarios.
• Updated Client to accept either an api_key or a credential_resolver (or both), and to resolve the API key per request using the new resolver logic. The client now supports an auth_scope parameter for each request method, and exposes constants for supported scopes. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

SDK and API Surface Updates:

• Updated the Sdk class to accept a credential_resolver and pass it to the Client, allowing SDK users to leverage the new credential resolution mechanism. [1] [2] [3]
• Exposed ScopedCredentialResolver from the package's __init__.py for easier imports.

Testing Enhancements:

• Added comprehensive unit tests for the new credential resolver logic, including tests for all HTTP methods, resolver preference, and error cases. Introduced test stubs for transport and responses to facilitate header inspection. [1] [2]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.82%. Comparing base (463b422) to head (ae1bded).

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #55      +/-   ##
==========================================
+ Coverage   90.94%   91.82%   +0.87%     
==========================================
  Files         147      148       +1     
  Lines        2607     2655      +48     
==========================================
+ Hits         2371     2438      +67     
+ Misses        236      217      -19     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds a scoped credential resolution mechanism to the MultiSafepay SDK so API keys can be resolved dynamically per request based on an authentication scope, while keeping existing API-key usage working.

Changes:

• Introduces CredentialResolver + ScopedCredentialResolver and an AuthScope payload to support default, partner-affiliate, and terminal-group authentication.
• Updates Client and Sdk to accept an optional credential resolver and to resolve the Authorization header per request (with optional auth_scope per request).
• Extends unit tests to cover resolver behavior and resolver-based SDK/client initialization and header wiring.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/multisafepay/unit/test_unit_sdk.py	Adds SDK tests for resolver-only initialization and resolver + transport header wiring.
tests/multisafepay/unit/client/test_unit_credential_resolver.py	New unit tests for ScopedCredentialResolver scope selection and error cases.
tests/multisafepay/unit/client/test_unit_client.py	Adds unit tests that Authorization headers are sent and that resolver-based auth is preferred.
src/multisafepay/sdk.py	Makes api_key optional when a resolver is provided and wires resolver into Client.
src/multisafepay/client/credential_resolver.py	New resolver protocol + default scoped resolver implementation.
src/multisafepay/client/client.py	Adds resolver support, per-request auth_scope, and API key resolution logic for Authorization header.
src/multisafepay/client/init.py	Exports ScopedCredentialResolver for from multisafepay.client import ScopedCredentialResolver.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.