aisot 0.1.0__tar.gz

aisot-0.1.0/PKG-INFO

@@ -0,0 +1,52 @@
+Metadata-Version: 2.4
+Name: aisot
+Version: 0.1.0
+Summary: Publisher SDK for aisourceoftruth.com, the public record of the AI agent economy.
+License: Apache-2.0
+Project-URL: Homepage, https://aisourceoftruth.com
+Project-URL: Source, https://github.com/sellingascode/aisourceoftruth/tree/main/packages/python
+Project-URL: Registry, https://aisourceoftruth.com/publish
+Keywords: provenance,verification,registry,ai,aisot
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+
+# aisot (Python SDK)
+
+Publisher SDK for [aisourceoftruth.com](https://aisourceoftruth.com), the
+neutral AI provenance and verification registry. Mirrors `@aisourceoftruth/sdk` (JS):
+every publisher publishes through the public front door; there is no private
+ingest path anywhere. The private key never leaves your process.
+
+```python
+from aisot import AisotClient, generate_key, sha256_hex
+
+public_jwk, private_jwk = generate_key()
+client = AisotClient(origin="https://aisourceoftruth.com")
+
+reg = client.register_publisher(
+    id="my-publisher", name="My Publisher",
+    public_jwk=public_jwk, private_jwk=private_jwk,
+)
+client.key_id = reg["key_id"]
+client.private_jwk = private_jwk
+client.authenticate(reg["client_id"], reg["client_secret"])
+
+record = client.provenance_record(
+    artifact_digest=sha256_hex(open("report.md", "rb").read()),
+    artifact_type="text/markdown", creator="my-publisher", model="gpt-x",
+)
+out = client.publish(record)
+print(out["url"])  # the permanent public record page
+
+# Verify-before-transact:
+result = client.verify_batch([out["digest"]])
+assert result["results"][0]["signature"]["valid"]
+```
+
+Signing is ES256 (ECDSA P-256, raw `r||s` signatures, matching the registry's
+WebCrypto verification) over the exact request bytes. Idempotency-Key headers
+are automatic; a retried call replays the original result.
+
+HTTP uses the standard library (`urllib`); the only dependency is
+`cryptography` for ES256.

aisot-0.1.0/README.md

@@ -0,0 +1,39 @@
+# aisot (Python SDK)
+
+Publisher SDK for [aisourceoftruth.com](https://aisourceoftruth.com), the
+neutral AI provenance and verification registry. Mirrors `@aisourceoftruth/sdk` (JS):
+every publisher publishes through the public front door; there is no private
+ingest path anywhere. The private key never leaves your process.
+
+```python
+from aisot import AisotClient, generate_key, sha256_hex
+
+public_jwk, private_jwk = generate_key()
+client = AisotClient(origin="https://aisourceoftruth.com")
+
+reg = client.register_publisher(
+    id="my-publisher", name="My Publisher",
+    public_jwk=public_jwk, private_jwk=private_jwk,
+)
+client.key_id = reg["key_id"]
+client.private_jwk = private_jwk
+client.authenticate(reg["client_id"], reg["client_secret"])
+
+record = client.provenance_record(
+    artifact_digest=sha256_hex(open("report.md", "rb").read()),
+    artifact_type="text/markdown", creator="my-publisher", model="gpt-x",
+)
+out = client.publish(record)
+print(out["url"])  # the permanent public record page
+
+# Verify-before-transact:
+result = client.verify_batch([out["digest"]])
+assert result["results"][0]["signature"]["valid"]
+```
+
+Signing is ES256 (ECDSA P-256, raw `r||s` signatures, matching the registry's
+WebCrypto verification) over the exact request bytes. Idempotency-Key headers
+are automatic; a retried call replays the original result.
+
+HTTP uses the standard library (`urllib`); the only dependency is
+`cryptography` for ES256.

aisot-0.1.0/aisot/__init__.py

@@ -0,0 +1,270 @@
+# aisot - the Python publisher SDK for aisourceoftruth.com.
+#
+# Mirrors @aisourceoftruth/sdk (JS): every publisher publishes through the public front
+# door; there is no private ingest path anywhere. The private key never leaves
+# the caller's process. HTTP is stdlib urllib; the only dependency is
+# `cryptography` for ES256 (ECDSA P-256), signing raw r||s to match the
+# registry's WebCrypto verification.
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json as _json
+import urllib.error
+import urllib.request
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional
+
+__all__ = ["AisotClient", "AisotError", "generate_key", "sha256_hex"]
+
+__version__ = "0.1.0"
+
+
+def _b64url_encode(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64url_decode(s: str) -> bytes:
+    pad = "=" * (-len(s) % 4)
+    return base64.urlsafe_b64decode(s + pad)
+
+
+def sha256_hex(data) -> str:
+    """sha256 as lowercase hex. Digest addressing uses this everywhere."""
+    if isinstance(data, str):
+        data = data.encode("utf-8")
+    return hashlib.sha256(data).hexdigest()
+
+
+def generate_key():
+    """Generate an ES256 (ECDSA P-256) keypair as JWK dicts.
+
+    Returns (public_jwk, private_jwk). The private JWK stays with the caller
+    and is never sent to the registry.
+    """
+    from cryptography.hazmat.primitives.asymmetric import ec
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    numbers = key.private_numbers()
+    pub = numbers.public_numbers
+    x = pub.x.to_bytes(32, "big")
+    y = pub.y.to_bytes(32, "big")
+    d = numbers.private_value.to_bytes(32, "big")
+    public_jwk = {"kty": "EC", "crv": "P-256", "x": _b64url_encode(x), "y": _b64url_encode(y)}
+    private_jwk = dict(public_jwk, d=_b64url_encode(d))
+    return public_jwk, private_jwk
+
+
+def sign_es256(private_jwk: Dict[str, str], data: bytes) -> str:
+    """ES256 detached signature over exact bytes, raw r||s, base64url."""
+    from cryptography.hazmat.primitives import hashes
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
+
+    d = int.from_bytes(_b64url_decode(private_jwk["d"]), "big")
+    key = ec.derive_private_key(d, ec.SECP256R1())
+    der = key.sign(data, ec.ECDSA(hashes.SHA256()))
+    r, s = decode_dss_signature(der)
+    return _b64url_encode(r.to_bytes(32, "big") + s.to_bytes(32, "big"))
+
+
+def verify_es256(public_jwk: Dict[str, str], data: bytes, signature_b64url: str) -> bool:
+    """Verify a raw r||s ES256 signature against a public JWK."""
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives import hashes
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature
+
+    raw = _b64url_decode(signature_b64url)
+    if len(raw) != 64:
+        return False
+    r = int.from_bytes(raw[:32], "big")
+    s = int.from_bytes(raw[32:], "big")
+    x = int.from_bytes(_b64url_decode(public_jwk["x"]), "big")
+    y = int.from_bytes(_b64url_decode(public_jwk["y"]), "big")
+    pub = ec.EllipticCurvePublicNumbers(x, y, ec.SECP256R1()).public_key()
+    try:
+        pub.verify(encode_dss_signature(r, s), data, ec.ECDSA(hashes.SHA256()))
+        return True
+    except InvalidSignature:
+        return False
+
+
+class AisotError(Exception):
+    """A typed registry error: carries .status and the error body dict."""
+
+    def __init__(self, status: int, body: Dict[str, Any]):
+        super().__init__(body.get("message") or f"HTTP {status}")
+        self.status = status
+        self.body = body
+        self.code = body.get("code")
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+class AisotClient:
+    """The publisher client. `transport` is injectable for tests: a callable
+    (url, method, headers, body_bytes) -> (status, body_text)."""
+
+    def __init__(self, origin: str = "https://aisourceoftruth.com", token: Optional[str] = None,
+                 key_id: Optional[str] = None, private_jwk: Optional[Dict[str, str]] = None,
+                 transport=None):
+        self.origin = origin.rstrip("/")
+        self.token = token
+        self.key_id = key_id
+        self.private_jwk = private_jwk
+        self._transport = transport or self._urllib_transport
+
+    @staticmethod
+    def _urllib_transport(url: str, method: str, headers: Dict[str, str], body: Optional[bytes]):
+        req = urllib.request.Request(url, data=body, method=method, headers=headers)
+        try:
+            with urllib.request.urlopen(req) as res:
+                return res.status, res.read().decode("utf-8")
+        except urllib.error.HTTPError as e:
+            return e.code, e.read().decode("utf-8")
+
+    def _json(self, path: str, method: str = "GET", headers: Optional[Dict[str, str]] = None,
+              body: Optional[bytes] = None) -> Dict[str, Any]:
+        status, text = self._transport(f"{self.origin}{path}", method, headers or {}, body)
+        try:
+            parsed = _json.loads(text)
+        except ValueError:
+            parsed = {"raw": text}
+        if status >= 400:
+            raise AisotError(status, parsed)
+        return parsed
+
+    # -- registration + auth ------------------------------------------------
+
+    def register_publisher(self, id: str, name: str, public_jwk: Dict[str, str],
+                           private_jwk: Optional[Dict[str, str]] = None, klass: Optional[str] = None,
+                           domain: Optional[str] = None, idempotency_key: Optional[str] = None) -> Dict[str, Any]:
+        """Register identity + public key. Proof-of-possession: the body is
+        signed with the private half of the key being registered."""
+        signing = private_jwk or self.private_jwk
+        if not signing:
+            raise ValueError("register_publisher needs private_jwk (proof-of-possession of the key being registered)")
+        payload: Dict[str, Any] = {"id": id, "name": name, "public_jwk": public_jwk}
+        if klass:
+            payload["class"] = klass
+        if domain:
+            payload["domain"] = domain
+        body = _json.dumps(payload, separators=(",", ":")).encode("utf-8")
+        return self._json("/v1/publishers", "POST", {
+            "content-type": "application/json",
+            "x-aisot-signature": sign_es256(signing, body),
+            "idempotency-key": idempotency_key or f"py-reg-{sha256_hex(body)}",
+        }, body)
+
+    def authenticate(self, client_id: str, client_secret: str, scope: Optional[str] = None) -> Dict[str, Any]:
+        payload: Dict[str, Any] = {"grant_type": "client_credentials", "client_id": client_id, "client_secret": client_secret}
+        if scope:
+            payload["scope"] = scope
+        out = self._json("/oauth/token", "POST", {"content-type": "application/json"},
+                         _json.dumps(payload).encode("utf-8"))
+        self.token = out["access_token"]
+        return out
+
+    # -- records ------------------------------------------------------------
+
+    def provenance_record(self, artifact_digest: str, creator: str, model: str,
+                          artifact_type: str = "text/markdown", version: str = "1",
+                          inputs: Optional[List[str]] = None, lineage: Optional[List[str]] = None) -> Dict[str, Any]:
+        record: Dict[str, Any] = {
+            "profile": "provenance",
+            "artifact": {"digest": artifact_digest, "type": artifact_type, "version": version},
+            "creator": creator,
+            "model": model,
+            "created_at": _now_iso(),
+        }
+        if inputs:
+            record["inputs"] = inputs
+        if lineage:
+            record["lineage"] = lineage
+        return record
+
+    def publish(self, record: Dict[str, Any], idempotency_key: Optional[str] = None) -> Dict[str, Any]:
+        """Build, sign, and POST a record. Digest, signature, and body are all
+        over the SAME bytes (content-addressed)."""
+        if not self.token:
+            raise ValueError("no token: call authenticate() first")
+        if not self.private_jwk or not self.key_id:
+            raise ValueError("no signing key: set private_jwk + key_id")
+        body = _json.dumps(record, separators=(",", ":")).encode("utf-8")
+        digest = sha256_hex(body)
+        return self._json("/v1/records", "POST", {
+            "authorization": f"Bearer {self.token}",
+            "content-type": "application/vnd.aisot.record+json",
+            "idempotency-key": idempotency_key or f"py-{digest}",
+            "x-aisot-key-id": self.key_id,
+            "x-aisot-signature": sign_es256(self.private_jwk, body),
+            "x-aisot-digest": digest,
+        }, body)
+
+    # -- verification -------------------------------------------------------
+
+    def verify(self, digest: str) -> Dict[str, Any]:
+        """Resolve a record and locally re-verify its signature against the
+        public key directory (verify-before-transact, no trust in transport)."""
+        record = self._json(f"/r/{digest}", "GET", {"accept": "application/json"})
+        raw_status, raw_text = self._transport(f"{self.origin}/r/{digest}?format=json&raw=1", "GET",
+                                               {"accept": "application/vnd.aisot.record+json"}, None)
+        registry = record.get("registry", {}) if isinstance(record, dict) else {}
+        key_id = registry.get("key_id")
+        sig = registry.get("signature")
+        verified = False
+        if raw_status == 200 and key_id and sig:
+            keys = self._json(f"/v1/keys/{key_id.split('#')[0]}", "GET", {"accept": "application/json"})
+            jwk = next((_json.loads(k["public_jwk"]) if isinstance(k.get("public_jwk"), str) else k.get("public_jwk")
+                        for k in keys.get("keys", []) if k.get("key_id") == key_id), None)
+            if jwk:
+                verified = verify_es256(jwk, raw_text.encode("utf-8"), sig)
+        return {"record": record, "signature_verifies": verified}
+
+    def verify_batch(self, digests: List[str]) -> Dict[str, Any]:
+        return self._json("/v1/verify-batch", "POST", {"content-type": "application/json"},
+                          _json.dumps({"digests": digests}).encode("utf-8"))
+
+    # -- payback + publisher appends -----------------------------------------
+
+    def _signed_append(self, path: str, payload: Dict[str, Any]) -> Dict[str, Any]:
+        if not self.token:
+            raise ValueError("no token: call authenticate() first")
+        if not self.private_jwk or not self.key_id:
+            raise ValueError("no signing key: set private_jwk + key_id")
+        body = _json.dumps(payload, separators=(",", ":")).encode("utf-8")
+        return self._json(path, "POST", {
+            "authorization": f"Bearer {self.token}",
+            "content-type": "application/json",
+            "idempotency-key": f"py-{sha256_hex(body)}",
+            "x-aisot-key-id": self.key_id,
+            "x-aisot-signature": sign_es256(self.private_jwk, body),
+        }, body)
+
+    def publish_source_claim(self, source_id: str, method: str, proof: str) -> Dict[str, Any]:
+        return self._signed_append("/v1/source-claims", {"source_id": source_id, "method": method, "proof": proof})
+
+    def verify_source_claim(self, source_id: str) -> Dict[str, Any]:
+        return self._signed_append("/v1/source-claims/verify", {"source_id": source_id})
+
+    def publish_terms(self, source_id: str, license_id: str) -> Dict[str, Any]:
+        return self._signed_append("/v1/terms", {"source_id": source_id, "license_id": license_id})
+
+    def publish_erratum(self, record_digest: str, correction: str, claim_id: Optional[str] = None) -> Dict[str, Any]:
+        payload: Dict[str, Any] = {"record_digest": record_digest, "correction": correction}
+        if claim_id:
+            payload["claim_id"] = claim_id
+        return self._signed_append("/v1/errata", payload)
+
+    def verify_domain(self) -> Dict[str, Any]:
+        if not self.token:
+            raise ValueError("no token: call authenticate() first")
+        return self._json("/v1/publishers/verify-domain", "POST", {
+            "authorization": f"Bearer {self.token}",
+            "content-type": "application/json",
+            "idempotency-key": f"py-vd-{sha256_hex(self.token)}",
+        }, b"{}")

aisot-0.1.0/aisot.egg-info/PKG-INFO

@@ -0,0 +1,52 @@
+Metadata-Version: 2.4
+Name: aisot
+Version: 0.1.0
+Summary: Publisher SDK for aisourceoftruth.com, the public record of the AI agent economy.
+License: Apache-2.0
+Project-URL: Homepage, https://aisourceoftruth.com
+Project-URL: Source, https://github.com/sellingascode/aisourceoftruth/tree/main/packages/python
+Project-URL: Registry, https://aisourceoftruth.com/publish
+Keywords: provenance,verification,registry,ai,aisot
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+
+# aisot (Python SDK)
+
+Publisher SDK for [aisourceoftruth.com](https://aisourceoftruth.com), the
+neutral AI provenance and verification registry. Mirrors `@aisourceoftruth/sdk` (JS):
+every publisher publishes through the public front door; there is no private
+ingest path anywhere. The private key never leaves your process.
+
+```python
+from aisot import AisotClient, generate_key, sha256_hex
+
+public_jwk, private_jwk = generate_key()
+client = AisotClient(origin="https://aisourceoftruth.com")
+
+reg = client.register_publisher(
+    id="my-publisher", name="My Publisher",
+    public_jwk=public_jwk, private_jwk=private_jwk,
+)
+client.key_id = reg["key_id"]
+client.private_jwk = private_jwk
+client.authenticate(reg["client_id"], reg["client_secret"])
+
+record = client.provenance_record(
+    artifact_digest=sha256_hex(open("report.md", "rb").read()),
+    artifact_type="text/markdown", creator="my-publisher", model="gpt-x",
+)
+out = client.publish(record)
+print(out["url"])  # the permanent public record page
+
+# Verify-before-transact:
+result = client.verify_batch([out["digest"]])
+assert result["results"][0]["signature"]["valid"]
+```
+
+Signing is ES256 (ECDSA P-256, raw `r||s` signatures, matching the registry's
+WebCrypto verification) over the exact request bytes. Idempotency-Key headers
+are automatic; a retried call replays the original result.
+
+HTTP uses the standard library (`urllib`); the only dependency is
+`cryptography` for ES256.

aisot-0.1.0/aisot.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+README.md
+pyproject.toml
+aisot/__init__.py
+aisot.egg-info/PKG-INFO
+aisot.egg-info/SOURCES.txt
+aisot.egg-info/dependency_links.txt
+aisot.egg-info/requires.txt
+aisot.egg-info/top_level.txt
+tests/test_client.py

aisot-0.1.0/aisot.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

aisot-0.1.0/aisot.egg-info/requires.txt

@@ -0,0 +1 @@
+cryptography>=42

aisot-0.1.0/aisot.egg-info/top_level.txt

@@ -0,0 +1 @@
+aisot

aisot-0.1.0/pyproject.toml

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "aisot"
+version = "0.1.0"
+description = "Publisher SDK for aisourceoftruth.com, the public record of the AI agent economy."
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.9"
+dependencies = ["cryptography>=42"]
+keywords = ["provenance", "verification", "registry", "ai", "aisot"]
+
+[project.urls]
+Homepage = "https://aisourceoftruth.com"
+Source = "https://github.com/sellingascode/aisourceoftruth/tree/main/packages/python"
+Registry = "https://aisourceoftruth.com/publish"
+
+[tool.setuptools.packages.find]
+include = ["aisot*"]

aisot-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

aisot-0.1.0/tests/test_client.py

@@ -0,0 +1,101 @@
+# Unit tests for the aisot Python SDK. No network: a fake transport captures
+# requests; crypto tests use the real `cryptography` primitives and skip
+# cleanly when the dependency is not installed.
+import json
+import unittest
+
+try:
+    import cryptography  # noqa: F401
+    HAVE_CRYPTO = True
+except ImportError:  # pragma: no cover
+    HAVE_CRYPTO = False
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+from aisot import AisotClient, AisotError, sha256_hex  # noqa: E402
+
+
+class FakeTransport:
+    def __init__(self, responses):
+        self.responses = list(responses)
+        self.calls = []
+
+    def __call__(self, url, method, headers, body):
+        self.calls.append({"url": url, "method": method, "headers": dict(headers), "body": body})
+        status, payload = self.responses.pop(0)
+        return status, json.dumps(payload)
+
+
+class TestDigest(unittest.TestCase):
+    def test_sha256_hex_matches_known_vector(self):
+        self.assertEqual(sha256_hex(b""), "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
+        self.assertEqual(sha256_hex("abc"), sha256_hex(b"abc"))
+
+
+@unittest.skipUnless(HAVE_CRYPTO, "cryptography not installed")
+class TestCrypto(unittest.TestCase):
+    def test_sign_verify_roundtrip_raw_rs(self):
+        from aisot import generate_key, sign_es256, verify_es256
+
+        public_jwk, private_jwk = generate_key()
+        self.assertEqual(public_jwk["kty"], "EC")
+        self.assertEqual(public_jwk["crv"], "P-256")
+        self.assertNotIn("d", public_jwk)
+        data = b'{"profile":"provenance"}'
+        sig = sign_es256(private_jwk, data)
+        self.assertTrue(verify_es256(public_jwk, data, sig))
+        self.assertFalse(verify_es256(public_jwk, b"tampered", sig))
+
+    def test_registration_is_signed_and_idempotent(self):
+        from aisot import generate_key, verify_es256
+
+        public_jwk, private_jwk = generate_key()
+        t = FakeTransport([(201, {"publisher_id": "p", "key_id": "p#1", "client_id": "c", "client_secret": "s"})])
+        client = AisotClient(origin="https://reg.example", transport=t)
+        client.register_publisher(id="p", name="P", public_jwk=public_jwk, private_jwk=private_jwk)
+        call = t.calls[0]
+        self.assertEqual(call["url"], "https://reg.example/v1/publishers")
+        self.assertIn("idempotency-key", call["headers"])
+        # Proof-of-possession signature verifies over the exact body bytes.
+        self.assertTrue(verify_es256(public_jwk, call["body"], call["headers"]["x-aisot-signature"]))
+
+    def test_publish_signs_exact_bytes_and_declares_digest(self):
+        from aisot import generate_key, verify_es256
+
+        public_jwk, private_jwk = generate_key()
+        t = FakeTransport([(201, {"digest": "x", "url": "https://reg.example/r/x"})])
+        client = AisotClient(origin="https://reg.example", token="tok", key_id="p#1", private_jwk=private_jwk, transport=t)
+        record = client.provenance_record(artifact_digest="ab" * 32, creator="p", model="m")
+        client.publish(record)
+        call = t.calls[0]
+        self.assertEqual(call["headers"]["x-aisot-digest"], sha256_hex(call["body"]))
+        self.assertTrue(verify_es256(public_jwk, call["body"], call["headers"]["x-aisot-signature"]))
+        self.assertEqual(call["headers"]["idempotency-key"], f"py-{sha256_hex(call['body'])}")
+
+
+class TestClientBehavior(unittest.TestCase):
+    def test_typed_errors_raise_with_code(self):
+        t = FakeTransport([(429, {"code": "rate_limited", "message": "slow down"})])
+        client = AisotClient(origin="https://reg.example", transport=t)
+        with self.assertRaises(AisotError) as ctx:
+            client.verify_batch(["a" * 64])
+        self.assertEqual(ctx.exception.status, 429)
+        self.assertEqual(ctx.exception.code, "rate_limited")
+
+    def test_publish_requires_credentials(self):
+        client = AisotClient(transport=FakeTransport([]))
+        with self.assertRaises(ValueError):
+            client.publish({"profile": "provenance"})
+
+    def test_authenticate_stores_token(self):
+        t = FakeTransport([(200, {"access_token": "tok123", "expires_in": 3600, "scope": "publish:provenance"})])
+        client = AisotClient(origin="https://reg.example", transport=t)
+        client.authenticate("cid", "csk")
+        self.assertEqual(client.token, "tok123")
+
+
+if __name__ == "__main__":
+    unittest.main()