SK-3039:Fix missing roles & ctx in bearerToken. - #272

SK-3039: Fix missing roles/ctx in bearer tokens and harden request/config input validation

Problem

• roles and context set under credentials in add_vault_config() never reached the generated bearer token. VaultClient.get_bearer_token() read roles/ctx from the top-level config, but both are only accepted nested under credentials — top-level keys are rejected by validate_keys, so the lookup always resolved to None: no error, just a token with no ctx claim and no role: scope, on first generation and every auto-refresh.
• context was validated as str only, rejecting a dict/JSON object at build() even though the token-generation engine already supports it.
• Several request/config validators accepted the wrong Python type and either crashed with a raw, uncaught exception or silently produced wrong behaviour instead of raising a clean SkyflowError: dict tokens on insert, bare-string items in detokenize data, non-string elements in roles, non-list ids on delete, and non-string skyflow_id/table/column_name/file_name on update and file-upload.
• validate_update_connection_config dropped connection_id from validate_credentials, so credential errors on the update path lost config context that the add path already included.

Changes

Bearer token roles/ctx

• VaultClient.get_bearer_token() now builds token options from the resolved credentials dict instead of the top-level config, and calls the shared validate_token_options directly — so a directly-constructed VaultClient can no longer skip roles/context validation. Keys are omitted when unset rather than passed as None.
• Fixes both first generation and every auto-refresh, for path and credentials_string, config-level and common credentials, and connection configs.
• credentials.context now accepts a str or a dict. Dict keys are validated at config time (^[a-zA-Z0-9_]+$), so an invalid key fails at build() instead of on the first API call. Empty dict is rejected as an empty context, matching existing empty-string behaviour.
• Fixed swapped empty/invalid error messages for roles: a non-list now reports "Specify roles as an array" instead of "Specify at least one role".
• roles: [] now raises EMPTY_ROLES instead of silently producing an unscoped token. Each element of roles must now be a non-empty string, or validation raises — previously a non-string role was silently stringified into the OAuth scope.
• validate_update_connection_config now passes connection_id through to validate_credentials, so its error messages include the connection id like the add path already does.

Insert / detokenize type safety

• InsertRequest(tokens=...) with a non-list/non-dict-of-dicts value now raises INVALID_TYPE_OF_DATA_IN_INSERT instead of crashing in the diagnostic logging loop.
• DetokenizeRequest(data=...) with bare strings now always raises INVALID_TOKENS_LIST_VALUE, instead of only crashing when a string happened to contain "token" as a substring.

Delete / update / file-upload validation

• DeleteRequest(ids=...) with a non-list value now raises INVALID_IDS_TYPE.
• UpdateRequest and FileUploadRequest now type-check skyflow_id (new INVALID_SKYFLOW_ID_TYPE message), and FileUploadRequest type-checks table, column_name, and file_name, raising the existing corresponding error instead of crashing on .strip().

Behaviour change

roles: [] and non-string roles elements previously passed validation and produced an unscoped or corrupted token; both now raise. Everything else is either a crash fix or a message correction — the accept/reject boundary for already-valid input is unchanged.

roles and context remain optional; validation only runs when the key is present.

Tests

• tests/vault/client/test__client.py: string and dict context plus roles forwarded on the path and credentials-string flows; options omitted when unset; top-level config keys explicitly ignored; token_uri coexistence; refresh path verified directly and end-to-end through initialize_client_configuration().
• tests/utils/validations/test__validations.py: string/dict context accepted, empty dict, invalid ctx key, invalid types, config-scoped message variant, end-to-end validate_vault_config, the three roles cases plus non-string role elements, dict tokens on insert, bare-string detokenize data, non-list delete ids, non-string skyflow_id/table/column_name/file_name on update and file-upload, and connection_id included in validate_update_connection_config error messages.
• tests/client/test_skyflow.py: end-to-end builder().add_vault_config(...).build() asserting the options handed to the token engine.
• Removed the stale top-level roles/ctx from the client test fixture — that shape is rejected by real validation.