Rework default scopes

Author: daviewales

obstore/python/obstore/auth/azure.py

@@ -12,6 +12,8 @@
 import azure.identity.aio
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable
+
     from obstore.store import AzureCredential
 
     AzureCredentialUnionType = (
@@ -55,6 +57,8 @@
         | azure.identity.aio.WorkloadIdentityCredential
     )
 
+DEFAULT_SCOPES = ("https://storage.azure.com/.default",)
+
 
 class AzureCredentialProvider:
     """A CredentialProvider for [AzureStore][obstore.store.AzureStore] that uses [`azure.identity`][].
@@ -80,7 +84,7 @@ class AzureCredentialProvider:
     def __init__(
         self,
         credential: AzureCredentialUnionType | None = None,
-        scopes: list[str] | None = None,
+        scopes: Iterable[str] = DEFAULT_SCOPES,
         tenant_id: str | None = None,
     ) -> None:
         """Create a new AzureCredentialProvider.
@@ -90,18 +94,15 @@ def __init__(
                 in which case [`azure.identity.DefaultAzureCredential`][] will be
                 called to find default credentials.
             scopes: Scopes required by the access token. If not specified,
-                ["https://storage.azure.com/.default"] will be used by default.
+                ("https://storage.azure.com/.default",) will be used by default.
             tenant_id: Optionally specify the Azure Tenant ID which will be passed to
                 the credential's `get_token` method.
 
         [`azure.identity.DefaultAzureCredential`]: https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.defaultazurecredential
 
         """
         self.credential = credential or azure.identity.DefaultAzureCredential()
-
-        # Use the Azure Storage scope by default
-        self.scopes = scopes or ["https://storage.azure.com/.default"]
-
+        self.scopes = scopes
         self.tenant_id = tenant_id
 
         # Token cache
@@ -152,7 +153,7 @@ class AzureAsyncCredentialProvider:
     def __init__(
         self,
         credential: AzureAsyncCredentialUnionType | None = None,
-        scopes: list[str] | None = None,
+        scopes: Iterable[str] = DEFAULT_SCOPES,
         tenant_id: str | None = None,
     ) -> None:
         """Create a new AzureAsyncCredentialProvider.
@@ -162,18 +163,15 @@ def __init__(
                 in which case [`azure.identity.aio.DefaultAzureCredential`][] will be
                 called to find default credentials.
             scopes: Scopes required by the access token. If not specified,
-                ["https://storage.azure.com/.default"] will be used by default.
+                ("https://storage.azure.com/.default",) will be used by default.
             tenant_id: Optionally specify the Azure Tenant ID which will be passed to
                 the credential's `get_token` method.
 
         [`azure.identity.aio.DefaultAzureCredential`]: https://learn.microsoft.com/en-us/python/api/azure-identity/azure.identity.aio.defaultazurecredential
 
         """
         self.credential = credential or azure.identity.aio.DefaultAzureCredential()
-
-        # Use the Azure Storage scope by default
-        self.scopes = scopes or ["https://storage.azure.com/.default"]
-
+        self.scopes = scopes
         self.tenant_id = tenant_id
 
         # Token cache