allowly 0.2.0__tar.gz → 0.3.0__tar.gz

{allowly-0.2.0 → allowly-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: allowly
-Version: 0.2.0
+Version: 0.3.0
 Summary: Python SDK for the Allowly API
 Project-URL: Repository, https://github.com/Allowly-AI/allowly-sdk-python
 License: MIT
@@ -8,7 +8,7 @@ License-File: LICENSE
 Requires-Python: >=3.10
 Requires-Dist: httpx>=0.27.0
 Provides-Extra: dev
-Requires-Dist: allowly-receipt-format<4.0.0,>=3.0.0; extra == 'dev'
+Requires-Dist: allowly-receipt-format<5.0.0,>=4.0.0; extra == 'dev'
 Requires-Dist: cryptography>=42; extra == 'dev'
 Requires-Dist: fastmcp<3,>=2.9; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
@@ -17,7 +17,7 @@ Requires-Dist: respx>=0.21; extra == 'dev'
 Provides-Extra: fastmcp
 Requires-Dist: fastmcp<3,>=2.9; extra == 'fastmcp'
 Provides-Extra: verifier
-Requires-Dist: allowly-receipt-format<4.0.0,>=3.0.0; extra == 'verifier'
+Requires-Dist: allowly-receipt-format<5.0.0,>=4.0.0; extra == 'verifier'
 Description-Content-Type: text/markdown
 
 # Allowly Python SDK
@@ -112,9 +112,14 @@ integration examples honest and makes SDK gaps visible early.
 ## Offline receipt verification
 
 Install `allowly[verifier]` to verify signed receipts locally. The extra uses
-`allowly-receipt-format>=3.0.0,<4.0.0`, which verifies receipt wire format 3 (the package major equals the wire format). `alg` and
+`allowly-receipt-format>=4.0.0,<5.0.0`, which verifies receipt wire format 4 (the package major equals the wire format). `alg` and
 `key_id` are signed top-level fields, and `signature` is the base64url string.
 
+Wire format 4 also supports daily `receipt.checkpoint` commitments. For an
+untrusted receipt bundle, pass caller-trusted key fingerprints to
+`verify_receipt`; a fingerprint copied from that same bundle is not a trust
+anchor.
+
 Key-document fetching requires HTTPS by default. For the documented local
 Caddy endpoint only, pass `dangerously_allow_insecure_base_url=True` and its
 `edge_token` to `fetch_keys_doc`, matching the client options above.

{allowly-0.2.0 → allowly-0.3.0}/README.md

@@ -90,9 +90,14 @@ integration examples honest and makes SDK gaps visible early.
 ## Offline receipt verification
 
 Install `allowly[verifier]` to verify signed receipts locally. The extra uses
-`allowly-receipt-format>=3.0.0,<4.0.0`, which verifies receipt wire format 3 (the package major equals the wire format). `alg` and
+`allowly-receipt-format>=4.0.0,<5.0.0`, which verifies receipt wire format 4 (the package major equals the wire format). `alg` and
 `key_id` are signed top-level fields, and `signature` is the base64url string.
 
+Wire format 4 also supports daily `receipt.checkpoint` commitments. For an
+untrusted receipt bundle, pass caller-trusted key fingerprints to
+`verify_receipt`; a fingerprint copied from that same bundle is not a trust
+anchor.
+
 Key-document fetching requires HTTPS by default. For the documented local
 Caddy endpoint only, pass `dangerously_allow_insecure_base_url=True` and its
 `edge_token` to `fetch_keys_doc`, matching the client options above.

{allowly-0.2.0 → allowly-0.3.0}/allowly/verify.py

@@ -21,7 +21,7 @@ from typing import Any
 from urllib.parse import quote, urlparse
 
 # Offline verification is powered by the published reference verifier,
-# allowly-receipt-format 3.x (import path allowly_receipt_format). It ships as an
+# allowly-receipt-format 4.x (import path allowly_receipt_format). It ships as an
 # optional extra so the core SDK stays dependency-light:
 #     pip install 'allowly[verifier]'
 def _import_verifier():
@@ -35,7 +35,7 @@ def _import_verifier():
         return verify_receipt, load_keys_from_json, VerificationError, PublicKey
     except ImportError as exc:
         raise ImportError(
-            "Receipt verification requires allowly-receipt-format>=3.0.0. "
+            "Receipt verification requires allowly-receipt-format>=4.0.0. "
             "Install the verifier extra: pip install 'allowly[verifier]'"
         ) from exc
 
@@ -52,6 +52,7 @@ def verify_receipt(
     public_keys: list[PublicKey],
     *,
     expected_workspace_id: str,
+    trusted_key_fingerprints: set[str] | frozenset[str] | None = None,
     now: datetime | None = None,
 ) -> None:
     _verify_receipt(
@@ -59,6 +60,7 @@ def verify_receipt(
         public_keys,
         now=now,
         expected_workspace_id=expected_workspace_id,
+        trusted_key_fingerprints=trusted_key_fingerprints,
     )
 
 

{allowly-0.2.0 → allowly-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "allowly"
-version = "0.2.0"
+version = "0.3.0"
 description = "Python SDK for the Allowly API"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -21,10 +21,10 @@ fastmcp = [
     "fastmcp>=2.9,<3",
 ]
 verifier = [
-    "allowly-receipt-format>=3.0.0,<4.0.0",
+    "allowly-receipt-format>=4.0.0,<5.0.0",
 ]
 dev = [
-    "allowly-receipt-format>=3.0.0,<4.0.0",
+    "allowly-receipt-format>=4.0.0,<5.0.0",
     "cryptography>=42",
     "fastmcp>=2.9,<3",
     "pytest>=8.0",

{allowly-0.2.0 → allowly-0.3.0}/tests/test_client.py

@@ -59,7 +59,7 @@ def _authorization_payload(**overrides) -> dict:
 
 
 SIGNED_RECEIPT = {
-    "schema_version": "3",
+    "schema_version": "4",
     "receipt_id": "rcp_abc",
     "decision": "allow",
     "alg": "Ed25519",
@@ -1434,7 +1434,7 @@ async def test_receipts_get_pending(client):
 @pytest.mark.asyncio
 async def test_receipts_get_signed(client):
     signed = {
-        "schema_version": "3", "receipt_id": "rcp_abc", "decision": "allow",
+        "schema_version": "4", "receipt_id": "rcp_abc", "decision": "allow",
         "alg": "Ed25519", "key_id": "k", "signature": "sig",
     }
     respx.get(f"{BASE}/v1/receipts/rcp_abc").mock(return_value=httpx.Response(200, json={
@@ -1677,7 +1677,7 @@ async def test_fetch_signed_default_timeout_covers_one_signer_tick(client, monke
 
     monkeypatch.setattr("allowly.client.asyncio.sleep", fake_sleep)
 
-    signed = {"schema_version": "3", "receipt_id": "rcp_abc"}
+    signed = {"schema_version": "4", "receipt_id": "rcp_abc"}
 
     async def fake_get(receipt_id):
         if fake_now >= 61.0:

{allowly-0.2.0 → allowly-0.3.0}/tests/test_verify.py

@@ -1,9 +1,12 @@
 from __future__ import annotations
 
+import base64
 import hashlib
 
 import httpx
 import pytest
+from allowly_receipt_format import canonicalize
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from allowly.verify import (
     VerificationError,
@@ -27,21 +30,30 @@ VALID_DOC = {
     ],
 }
 
-V2_DOC = {
+def _b64u(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).rstrip(b"=").decode()
+
+
+_TEST_PRIVATE_KEY = Ed25519PrivateKey.from_private_bytes(bytes(32))
+_TEST_PUBLIC_KEY = _TEST_PRIVATE_KEY.public_key().public_bytes_raw()
+
+
+V4_DOC = {
     "workspace_id": "ws_test",
     "keys": [
         {
             "key_id": "test-key/v1",
             "alg": "Ed25519",
-            "public_key": "O2onvM62pC1io6jQKm8Nc2UyFXcd4kOmOsBIoYtZ2ik",
+            "public_key": _b64u(_TEST_PUBLIC_KEY),
+            "public_key_fingerprint": f"sha256:{hashlib.sha256(_TEST_PUBLIC_KEY).hexdigest()}",
             "active_from": "2026-01-01T00:00:00.000Z",
             "active_until": None,
         }
     ],
 }
 
-V2_RECEIPT = {
-    "schema_version": "3",
+V4_RECEIPT = {
+    "schema_version": "4",
     "receipt_id": "rcp_01HXZMINIMAL0000000000000",
     "workspace_id": "ws_test",
     "issued_at": "2026-04-21T14:32:17.482Z",
@@ -56,8 +68,8 @@ V2_RECEIPT = {
     "engine_version": "2026-04-17.1",
     "alg": "Ed25519",
     "key_id": "test-key/v1",
-    "signature": "O98ntdo49t38E6a2M-19qjaC-2TzTw8tYqOn-fsUAYzfyf0dWTx9uje9NQlkvCl-fP68o_ATkBSW3mpyguoODQ",
 }
+V4_RECEIPT["signature"] = _b64u(_TEST_PRIVATE_KEY.sign(canonicalize(V4_RECEIPT)))
 
 
 @pytest.fixture(autouse=True)
@@ -206,14 +218,26 @@ def test_verify_receipt_requires_and_forwards_workspace_binding(monkeypatch):
         seen.update(kwargs)
 
     monkeypatch.setattr("allowly.verify._verify_receipt", verifier)
-    verify_receipt({}, [], expected_workspace_id="ws_1")
+    trusted = {"sha256:" + "0" * 64}
+    verify_receipt(
+        {},
+        [],
+        expected_workspace_id="ws_1",
+        trusted_key_fingerprints=trusted,
+    )
     assert seen["expected_workspace_id"] == "ws_1"
+    assert seen["trusted_key_fingerprints"] == trusted
 
 
-def test_verify_v2_receipt_with_signed_algorithm_and_key_id():
-    keys = load_keys_from_json(V2_DOC)
+def test_verify_v4_receipt_with_signed_algorithm_and_key_id():
+    keys = load_keys_from_json(V4_DOC)
 
-    verify_receipt(V2_RECEIPT, keys, expected_workspace_id="ws_test")
+    verify_receipt(
+        V4_RECEIPT,
+        keys,
+        expected_workspace_id="ws_test",
+        trusted_key_fingerprints={V4_DOC["keys"][0]["public_key_fingerprint"]},
+    )
 
 
 def test_fetch_keys_doc_encodes_workspace_id():

{allowly-0.2.0 → allowly-0.3.0}/uv.lock

@@ -4,7 +4,7 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "allowly"
-version = "0.2.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -28,8 +28,8 @@ verifier = [
 
 [package.metadata]
 requires-dist = [
-    { name = "allowly-receipt-format", marker = "extra == 'dev'", specifier = ">=3.0.0,<4.0.0" },
-    { name = "allowly-receipt-format", marker = "extra == 'verifier'", specifier = ">=3.0.0,<4.0.0" },
+    { name = "allowly-receipt-format", marker = "extra == 'dev'", specifier = ">=4.0.0,<5.0.0" },
+    { name = "allowly-receipt-format", marker = "extra == 'verifier'", specifier = ">=4.0.0,<5.0.0" },
     { name = "cryptography", marker = "extra == 'dev'", specifier = ">=42" },
     { name = "fastmcp", marker = "extra == 'dev'", specifier = ">=2.9,<3" },
     { name = "fastmcp", marker = "extra == 'fastmcp'", specifier = ">=2.9,<3" },
@@ -42,14 +42,14 @@ provides-extras = ["fastmcp", "verifier", "dev"]
 
 [[package]]
 name = "allowly-receipt-format"
-version = "3.0.0"
+version = "4.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/0c/5a/fb1023f3c4419ea07d130db2f13122305ba9027e8d65d17da9db0654ea03/allowly_receipt_format-3.0.0.tar.gz", hash = "sha256:f34519f78d00e094e5c1763ff745db50e7701a3c5eb878745a7a63ea8a579bad", size = 13249, upload-time = "2026-07-23T02:57:31.751Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/86/4d/cd30ade1b597ee0ee1bdbfea33fd6f77c294999f4cc42504152690df13e2/allowly_receipt_format-4.0.0.tar.gz", hash = "sha256:27cd96a06edea1a23c340d9015ef1c0434b6dc1d4b2d7b56653d18b3991d6eec", size = 18059, upload-time = "2026-08-02T07:14:52.971Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f5/e5/3637697a384c6adbe38729b3b31ae8629635938a8e361c0ce7d87fb9c16f/allowly_receipt_format-3.0.0-py3-none-any.whl", hash = "sha256:98456d2abb2993069f52d9b1b06e7e9f64ebab53e6332cd7cf429e5eb73e6b28", size = 12676, upload-time = "2026-07-23T02:57:30.495Z" },
+    { url = "https://files.pythonhosted.org/packages/60/d9/45545ccdda5810e31d907bb5d26d5c4953864425a79b94708b61fccd23fe/allowly_receipt_format-4.0.0-py3-none-any.whl", hash = "sha256:18a038b9ffe9be25c63bd2f39b1f26fffbebb89e43622de9d2b479b06ea14b93", size = 16630, upload-time = "2026-08-02T07:14:51.615Z" },
 ]
 
 [[package]]