agentpayments-python 0.1.1__tar.gz → 0.1.2__tar.gz

{agentpayments_python-0.1.1 → agentpayments_python-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentpayments-python
-Version: 0.1.1
+Version: 0.1.2
 Summary: AgentPayments gate for Python web frameworks — charge AI agents USDC on Solana before they can access your API
 License: MIT
 Project-URL: Homepage, https://github.com/adambrzosko/AgentPayments

{agentpayments_python-0.1.1 → agentpayments_python-0.1.2}/agentpayments_python/detection.py

@@ -18,10 +18,18 @@ _BOT_UA_RE = _re.compile(r"bot|crawl|spider|slurp|mediapartners|adsbot", _re.IGN
 
 
 def is_browser_from_headers(headers: dict) -> bool:
-    # Primary signal: Fetch metadata headers (Chrome 76+, Firefox 90+).
-    if headers.get("sec-fetch-mode") or headers.get("sec-fetch-dest"):
+    # Primary signal: Fetch metadata headers, but only the values set exclusively for
+    # top-level navigations. These values are not reachable through the fetch()/XHR
+    # APIs, so this doesn't just check for *presence* of the header: Node's built-in
+    # fetch() (undici) unconditionally sends `sec-fetch-mode: cors` on every outgoing
+    # request (not overridable, it's a forbidden header), which previously
+    # misclassified fetch()-based agents as browsers and served them the HTML
+    # challenge instead of the 402 JSON they need to read to pay.
+    if headers.get("sec-fetch-mode") == "navigate" or headers.get("sec-fetch-dest") == "document":
         return True
-    # Fallback: UA heuristic for older browsers that don't send Sec-Fetch-*.
+    # Fallback: UA heuristic for older browsers that don't send Sec-Fetch-*, and for
+    # real in-page browser fetch()/XHR calls (Sec-Fetch-Mode: cors) which still carry
+    # a genuine browser User-Agent.
     ua = headers.get("user-agent") or headers.get("User-Agent") or ""
     if ua and not _BOT_UA_RE.search(ua) and _BROWSER_UA_RE.search(ua):
         return True

{agentpayments_python-0.1.1 → agentpayments_python-0.1.2}/agentpayments_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentpayments-python
-Version: 0.1.1
+Version: 0.1.2
 Summary: AgentPayments gate for Python web frameworks — charge AI agents USDC on Solana before they can access your API
 License: MIT
 Project-URL: Homepage, https://github.com/adambrzosko/AgentPayments

{agentpayments_python-0.1.1 → agentpayments_python-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agentpayments-python"
-version = "0.1.1"
+version = "0.1.2"
 description = "AgentPayments gate for Python web frameworks — charge AI agents USDC on Solana before they can access your API"
 readme = "README.md"
 license = { text = "MIT" }

{agentpayments_python-0.1.1 → agentpayments_python-0.1.2}/tests/test_core.py

@@ -340,6 +340,25 @@ class TestBrowserDetection:
     def test_no_ua_not_browser(self):
         assert not is_browser_from_headers({"accept": "text/html"})
 
+    def test_real_browser_navigation_is_browser(self):
+        # Shape of a real top-level browser navigation: Sec-Fetch-Mode: navigate and
+        # Sec-Fetch-Dest: document alongside a genuine browser UA.
+        assert is_browser_from_headers({
+            "sec-fetch-mode": "navigate",
+            "sec-fetch-dest": "document",
+            "user-agent": self.CHROME_UA,
+        })
+
+    def test_fetch_based_agent_not_browser(self):
+        # Node's built-in fetch() (undici) unconditionally sends sec-fetch-mode: cors
+        # on every request but never sets Sec-Fetch-Dest. Combined with a non-browser
+        # UA, this must NOT be classified as a browser or the agent never sees the
+        # 402 JSON it needs to read to pay.
+        assert not is_browser_from_headers({
+            "sec-fetch-mode": "cors",
+            "user-agent": "my-agent/1.0",
+        })
+
 
 class TestPublicPath:
     def test_robots_txt(self):