authchallenge 0.2.0__py3-none-any.whl

authchallenge/__init__.py

@@ -0,0 +1,30 @@
+"""Parse and build HTTP authentication headers: challenges, credentials, Authentication-Info."""
+
+from __future__ import annotations
+
+from ._basic import decode_basic, encode_basic
+from ._build import build_auth_info, build_authorization, build_challenge
+from ._extvalue import decode_ext_value, encode_ext_value
+from ._helpers import build_bearer_challenge, select_challenge
+from ._model import AuthError, Challenge, Credentials
+from ._parse import parse_auth_info, parse_authorization, parse_challenges
+
+__version__ = "0.2.0"
+
+__all__ = [
+    "AuthError",
+    "Challenge",
+    "Credentials",
+    "build_auth_info",
+    "build_authorization",
+    "build_bearer_challenge",
+    "build_challenge",
+    "decode_basic",
+    "decode_ext_value",
+    "encode_basic",
+    "encode_ext_value",
+    "parse_auth_info",
+    "parse_authorization",
+    "parse_challenges",
+    "select_challenge",
+]

authchallenge/__main__.py

@@ -0,0 +1,9 @@
+"""Allow `python -m authchallenge`."""
+
+from __future__ import annotations
+
+import sys
+
+from ._cli import main
+
+sys.exit(main())

authchallenge/_basic.py

@@ -0,0 +1,81 @@
+"""Basic credentials (RFC 7617): user-pass encoding and decoding."""
+
+from __future__ import annotations
+
+import base64
+import binascii
+import codecs
+
+from ._grammar import is_token68
+from ._model import AuthError, Credentials
+
+
+def _has_control(text: str) -> bool:
+    # RFC 7617 refers to CTL of RFC 5234: the ASCII controls and DEL (see erratum 9174).
+    return any(ord(char) < 0x20 or ord(char) == 0x7F for char in text)
+
+
+def _codec(charset: str) -> str:
+    # RFC 7617 needs an encoding that maps US-ASCII to single octets: UTF-8 or ISO-8859-1.
+    try:
+        name = codecs.lookup(charset).name
+    except LookupError:
+        name = ""
+    if name not in ("utf-8", "iso8859-1"):
+        raise AuthError(f"unsupported Basic charset {charset!r}: use 'utf-8' or 'latin-1'")
+    return name
+
+
+def split_user_pass(token68: str, charset: str) -> tuple[str, str]:
+    """Decode a Basic token68 into (user-id, password), raising AuthError when malformed."""
+    if not is_token68(token68):
+        raise AuthError(f"invalid token68: {token68!r}")
+    try:
+        raw = base64.b64decode(token68, validate=True)
+    except (binascii.Error, ValueError) as error:
+        raise AuthError("Basic credentials are not valid base64") from error
+    try:
+        text = raw.decode(_codec(charset))
+    except UnicodeDecodeError as error:
+        raise AuthError(f"Basic credentials are not valid {charset}") from error
+    user_id, colon, password = text.partition(":")
+    if not colon:
+        raise AuthError("Basic credentials lack the ':' between user-id and password")
+    if _has_control(text):
+        raise AuthError("Basic user-id and password must not contain control characters")
+    return user_id, password
+
+
+def encode_basic(user_id: str, password: str, *, charset: str = "utf-8") -> str:
+    """Build `Basic <base64>` credentials for an Authorization header (RFC 7617).
+
+    The user-id may not contain a colon, and neither part may contain control characters.
+    UTF-8 is what a server asks for with `charset="UTF-8"`; pass "latin-1" for servers
+    that expect ISO-8859-1; other charsets raise AuthError. The text is encoded as
+    given, without Unicode normalisation.
+    """
+    if ":" in user_id:
+        raise AuthError("a Basic user-id cannot contain ':'")
+    if _has_control(user_id) or _has_control(password):
+        raise AuthError("Basic user-id and password must not contain control characters")
+    try:
+        raw = f"{user_id}:{password}".encode(_codec(charset))
+    except UnicodeEncodeError as error:
+        raise AuthError(f"the credentials cannot be encoded as {charset}") from error
+    return "Basic " + base64.b64encode(raw).decode("ascii")
+
+
+def decode_basic(credentials: str | Credentials, *, charset: str = "utf-8") -> tuple[str, str]:
+    """Return (user-id, password) from Basic credentials, raising AuthError if malformed.
+
+    Accepts the Authorization field value (`Basic QWxh...`) or a parsed `Credentials`.
+    The text after the first colon is the password, as RFC 7617 section 2 says.
+    """
+    if isinstance(credentials, str):
+        scheme, _, token68 = credentials.strip(" \t").replace("\t", " ").partition(" ")
+        token68 = token68.strip(" ")
+    else:
+        scheme, token68 = credentials.scheme, credentials.token68 or ""
+    if scheme.lower() != "basic":
+        raise AuthError(f"not Basic credentials: {scheme!r}")
+    return split_user_pass(token68, charset)

authchallenge/_build.py

@@ -0,0 +1,100 @@
+"""Build challenge, credentials and Authentication-Info field values safely (RFC 9110)."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from ._grammar import is_field_text, is_token, is_token68, quote
+from ._model import AuthError
+from ._scan import Param
+from ._schemes import DIGEST_BARE, DIGEST_QUOTED, check
+
+
+def _must_quote(scheme: str, kind: str, name: str, value: str) -> bool:
+    key = scheme.lower()
+    if key == "digest" and name in DIGEST_BARE[kind]:
+        if not is_token(value):
+            raise AuthError(f"the Digest {name} parameter must be a token: {value!r}")
+        return False
+    if name == "realm" or key in ("basic", "bearer"):
+        return True
+    if key == "digest" and name in DIGEST_QUOTED[kind]:
+        return True
+    return not is_token(value)
+
+
+def _render_params(scheme: str, kind: str, params: Mapping[str, str]) -> tuple[str, list[Param]]:
+    rendered: list[str] = []
+    read: list[Param] = []
+    seen: set[str] = set()
+    for key, value in params.items():
+        if not isinstance(key, str) or not is_token(key):
+            raise AuthError(f"invalid auth-param name: {key!r}")
+        name = key.lower()
+        if name in seen:
+            raise AuthError(f"duplicate auth-param name: {key!r}")
+        if not isinstance(value, str) or not is_field_text(value):
+            raise AuthError(
+                f"the value of {key!r} may hold only tab, space and visible ASCII; "
+                "send other text as an RFC 8187 ext-value (see encode_ext_value)"
+            )
+        quoted = _must_quote(scheme, kind, name, value)
+        rendered.append(f"{key}={quote(value) if quoted else value}")
+        read.append(Param(name, value, quoted, 0))
+        seen.add(name)
+    return ", ".join(rendered), read
+
+
+def render(scheme: str, params: Mapping[str, str] | None, token68: str | None, kind: str) -> str:
+    """Render a challenge or credentials, refusing anything strict parsing would refuse."""
+    if not isinstance(scheme, str) or not is_token(scheme):
+        raise AuthError(f"invalid auth-scheme: {scheme!r}")
+    if token68 is not None and params:
+        raise AuthError("use either token68 or params, not both")
+    if token68 is not None:
+        if not isinstance(token68, str) or not is_token68(token68):
+            raise AuthError(f"invalid token68: {token68!r}")
+        check(scheme, kind, token68, [])
+        return f"{scheme} {token68}"
+    text, read = _render_params(scheme, kind, params or {})
+    check(scheme, kind, None, read)
+    return f"{scheme} {text}" if text else scheme
+
+
+def build_challenge(
+    scheme: str,
+    params: Mapping[str, str] | None = None,
+    token68: str | None = None,
+) -> str:
+    """Build one challenge for a WWW-Authenticate or Proxy-Authenticate field.
+
+    Values are quoted when they are not tokens and whenever the scheme's sender rules
+    say so (realm always, every Basic and Bearer param as their RFC examples do, the
+    Digest lists of RFC 7616). Raises
+    `AuthError` for invalid names or values and for what Basic, Bearer or Digest forbid,
+    so the result always passes `parse_challenges(..., strict=True)`.
+    """
+    return render(scheme, params, token68, "challenge")
+
+
+def build_authorization(
+    scheme: str,
+    params: Mapping[str, str] | None = None,
+    token68: str | None = None,
+) -> str:
+    """Build an Authorization or Proxy-Authorization field value, under the same rules."""
+    return render(scheme, params, token68, "credentials")
+
+
+def build_auth_info(params: Mapping[str, str], *, scheme: str | None = None) -> str:
+    """Build an Authentication-Info or Proxy-Authentication-Info field value.
+
+    Give the `scheme` of the request's credentials to apply its rules (Digest quotes
+    nextnonce, rspauth and cnonce, writes qop and nc bare, and checks nc).
+    """
+    text, read = _render_params(scheme or "", "info", params)
+    if not text:
+        raise AuthError("Authentication-Info needs at least one auth-param")
+    if scheme is not None:
+        check(scheme, "info", None, read)
+    return text

authchallenge/_cli.py

@@ -0,0 +1,94 @@
+"""Command line: print parsed authentication fields as JSON, or lint them with --strict."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from collections.abc import Sequence
+from typing import Any
+
+from ._model import AuthError, Challenge, Credentials
+from ._parse import parse_auth_info, parse_authorization, parse_challenges
+
+_KINDS = {
+    "www-authenticate": "challenges",
+    "proxy-authenticate": "challenges",
+    "authorization": "credentials",
+    "proxy-authorization": "credentials",
+    "authentication-info": "info",
+    "proxy-authentication-info": "info",
+}
+_FIELD_LINE = re.compile(r"([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*)")
+
+
+def _fields(text: str, default: str) -> list[tuple[str, str]]:
+    """Return (field name, value) pairs from a header dump, or one per plain line.
+
+    The first non-empty line decides: a status line or a `Name: value` line makes the
+    whole input a header dump, of which only the authentication fields are read.
+    """
+    lines = [line.rstrip("\r") for line in text.splitlines()]
+    first = next((line for line in lines if line.strip()), "")
+    dump = first.startswith("HTTP/") or _FIELD_LINE.fullmatch(first) is not None
+    if not dump:
+        return [(default, line.strip()) for line in lines if line.strip()]
+    pairs: list[tuple[str, str]] = []
+    for line in lines:
+        match = _FIELD_LINE.fullmatch(line)
+        if match is not None:
+            pairs.append((match.group(1), match.group(2)))
+        elif line[:1] in (" ", "\t") and pairs:
+            pairs[-1] = (pairs[-1][0], pairs[-1][1] + "\r\n" + line)
+    return [(name, value) for name, value in pairs if name.lower() in _KINDS]
+
+
+def _plain(found: Challenge | Credentials) -> dict[str, Any]:
+    return {"scheme": found.scheme, "token68": found.token68, "params": found.params}
+
+
+def _report(name: str, value: str, strict: bool) -> dict[str, Any]:
+    kind = _KINDS[name.lower()]
+    entry: dict[str, Any] = {"field": name}
+    try:
+        if kind == "challenges":
+            entry[kind] = [_plain(c) for c in parse_challenges(value, strict=strict)]
+        elif kind == "credentials":
+            entry[kind] = _plain(parse_authorization(value, strict=strict))
+        else:
+            entry[kind] = parse_auth_info(value, strict=strict)
+    except AuthError as error:
+        entry["error"] = str(error)
+    return entry
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    """Run the command line; return 0, or 1 when strict mode found a problem."""
+    parser = argparse.ArgumentParser(
+        prog="authchallenge",
+        description="Parse WWW-Authenticate, Authorization and Authentication-Info values. "
+        "Values come as arguments or one per stdin line; a header dump such as "
+        "`curl -sI` output is also read from stdin.",
+    )
+    parser.add_argument("values", nargs="*", help="field values (default: read stdin)")
+    group = parser.add_mutually_exclusive_group()
+    group.add_argument("--authorization", action="store_true", help="values are credentials")
+    group.add_argument("--info", action="store_true", help="values are Authentication-Info")
+    parser.add_argument("--strict", action="store_true", help="exit 1 on the first broken rule")
+    args = parser.parse_args(argv)
+    default = "WWW-Authenticate"
+    if args.authorization or args.info:
+        default = "Authorization" if args.authorization else "Authentication-Info"
+    if args.values:
+        fields = [(default, value) for value in args.values]
+    else:
+        fields = _fields(sys.stdin.read(), default)
+    if not fields:
+        parser.error("no field values given")
+    report = [_report(name, value, args.strict) for name, value in fields]
+    print(json.dumps(report, indent=2))
+    errors = [entry for entry in report if "error" in entry]
+    for entry in errors:
+        print(f"authchallenge: strict: {entry['field']}: {entry['error']}", file=sys.stderr)
+    return 1 if errors else 0

authchallenge/_extvalue.py

@@ -0,0 +1,42 @@
+"""RFC 8187 ext-value, the encoding of parameters such as Digest `username*`."""
+
+from __future__ import annotations
+
+import re
+from urllib.parse import quote, unquote_to_bytes
+
+from ._model import AuthError
+
+# attr-char of RFC 8187 section 3.2.1: token characters except "*", "'" and "%".
+_ATTR_CHAR = "!#$&+-.^_`|~"
+_EXT_VALUE = re.compile(
+    r"(?P<charset>[A-Za-z0-9!#$%&+\-^_`{}~]+)'(?P<language>[A-Za-z0-9-]*)'"
+    r"(?P<value>(?:%[0-9A-Fa-f]{2}|[A-Za-z0-9!#$&+\-.^_`|~])*)"
+)
+
+
+def encode_ext_value(text: str) -> str:
+    """Encode text as an RFC 8187 ext-value: `UTF-8''` and percent-encoded UTF-8."""
+    return "UTF-8''" + quote(text, safe=_ATTR_CHAR, encoding="utf-8")
+
+
+def decode_ext_value(value: str) -> str:
+    """Decode an RFC 8187 ext-value, raising AuthError when malformed or not UTF-8.
+
+    RFC 8187 makes UTF-8 the only charset producers may use; ISO-8859-1 is also read,
+    since RFC 5987 (which it replaces) allowed it. Control characters (C0, DEL, C1) in
+    the decoded text are refused, so a decoded name cannot carry a line break.
+    """
+    match = _EXT_VALUE.fullmatch(value)
+    if match is None:
+        raise AuthError(f"invalid ext-value: {value!r}")
+    charset = match.group("charset").lower()
+    if charset not in ("utf-8", "iso-8859-1"):
+        raise AuthError(f"unsupported ext-value charset: {match.group('charset')!r}")
+    try:
+        text = unquote_to_bytes(match.group("value")).decode(charset)
+    except UnicodeDecodeError as error:
+        raise AuthError(f"ext-value is not valid {charset}") from error
+    if any(ord(char) < 0x20 or 0x7F <= ord(char) < 0xA0 for char in text):
+        raise AuthError("ext-value decodes to control characters")
+    return text

authchallenge/_grammar.py

@@ -0,0 +1,63 @@
+"""Character classes and quoting of RFC 9110: token, token68, quoted-string, field text."""
+
+from __future__ import annotations
+
+import re
+
+# tchar of RFC 9110 section 5.6.2: auth-scheme and auth-param names are tokens.
+TCHAR = "!#$%&'*+-.^_`|~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+# token68 of RFC 9110 section 11.2, without its trailing "=" padding.
+TOKEN68_CHARS = "-._~+/0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+
+_TCHAR_CLASS = "[" + re.escape(TCHAR) + "]"
+TOKEN_RE = _TCHAR_CLASS + "+"
+TOKEN68_RE = "[" + re.escape(TOKEN68_CHARS) + "]+=*"
+QUOTED_RE = r'"(?:[^"\\]|\\.)*"'
+_TOKEN = re.compile(TOKEN_RE)
+_TOKEN68 = re.compile(TOKEN68_RE)
+_QUOTED_PAIR = re.compile(r"\\(.)", re.DOTALL)
+
+
+def is_token(value: str) -> bool:
+    """Whether the value is a non-empty RFC 9110 token."""
+    return _TOKEN.fullmatch(value) is not None
+
+
+def is_token68(value: str) -> bool:
+    """Whether the value is an RFC 9110 token68 (letters, digits, -._~+/ then padding)."""
+    return _TOKEN68.fullmatch(value) is not None
+
+
+def is_field_text(value: str) -> bool:
+    """Whether a sender may write the value: HTAB, SP and visible US-ASCII only.
+
+    RFC 9110 section 5.5 asks new fields to stay within VCHAR, SP and HTAB. Anything else,
+    CR and LF above all, would let a value break out of the header line.
+    """
+    return all(char == "\t" or " " <= char <= "~" for char in value)
+
+
+def bad_octet(value: str) -> int | None:
+    """Offset of the first character a field value cannot hold, or None.
+
+    Field values are octets: HTAB, SP, VCHAR and obs-text (0x80 to 0xFF). Controls, DEL
+    and code points above 0xFF are refused.
+    """
+    for index, char in enumerate(value):
+        code = ord(char)
+        if (code < 0x20 and char != "\t") or code == 0x7F or code > 0xFF:
+            return index
+    return None
+
+
+def quote(value: str) -> str:
+    """Wrap the value in a quoted-string, escaping only backslash and double quote."""
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"')
+    return f'"{escaped}"'
+
+
+def unquote(value: str) -> str:
+    """Strip the quotes of a quoted-string and resolve its quoted-pairs."""
+    if len(value) >= 2 and value[0] == '"' and value[-1] == '"':
+        return _QUOTED_PAIR.sub(r"\1", value[1:-1])
+    return value

authchallenge/_helpers.py

@@ -0,0 +1,53 @@
+"""Conveniences on top of the codec: Bearer challenges and challenge selection."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+from ._build import build_challenge
+from ._model import AuthError, Challenge
+
+
+def build_bearer_challenge(
+    *,
+    realm: str | None = None,
+    scope: str | Iterable[str] | None = None,
+    error: str | None = None,
+    error_description: str | None = None,
+    error_uri: str | None = None,
+) -> str:
+    """Build a Bearer challenge (RFC 6750 section 3) with its attributes quoted.
+
+    `scope` is a space-delimited string or an iterable of scope tokens. Each attribute is
+    checked against the character set RFC 6750 allows; `error` is usually one of
+    invalid_request, invalid_token or insufficient_scope (section 3.1). At least one
+    attribute is required.
+    """
+    if scope is not None and not isinstance(scope, str):
+        tokens = list(scope)
+        if not tokens or not all(isinstance(t, str) and t and " " not in t for t in tokens):
+            raise AuthError("scope tokens are non-empty strings without spaces")
+        scope = " ".join(tokens)
+    attributes = {
+        "realm": realm,
+        "scope": scope,
+        "error": error,
+        "error_description": error_description,
+        "error_uri": error_uri,
+    }
+    params = {name: value for name, value in attributes.items() if value is not None}
+    return build_challenge("Bearer", params)
+
+
+def select_challenge(challenges: Iterable[Challenge], *schemes: str) -> Challenge | None:
+    """Return the first challenge of the most preferred scheme, or None.
+
+    `schemes` lists the schemes the caller supports, best first; they are compared
+    case-insensitively, as RFC 9110 section 11.1 requires.
+    """
+    offered = list(challenges)
+    for wanted in schemes:
+        for challenge in offered:
+            if challenge.scheme.lower() == wanted.lower():
+                return challenge
+    return None

authchallenge/_model.py

@@ -0,0 +1,31 @@
+"""Typed result objects for parsed challenges and credentials."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+class AuthError(ValueError):
+    """Raised when a header cannot be built, or fails strict parsing, with the reason."""
+
+
+@dataclass(frozen=True)
+class Challenge:
+    """One authentication challenge: a scheme with either a token68 or auth-params.
+
+    The scheme keeps the case it was written in (compare it case-insensitively); param
+    names are lower-cased, and values have their quoting removed.
+    """
+
+    scheme: str
+    token68: str | None = None
+    params: dict[str, str] = field(default_factory=dict)
+
+
+@dataclass(frozen=True)
+class Credentials:
+    """Authorization credentials: a scheme with either a token68 or auth-params."""
+
+    scheme: str
+    token68: str | None = None
+    params: dict[str, str] = field(default_factory=dict)

authchallenge/_parse.py

@@ -0,0 +1,167 @@
+"""Parse WWW-Authenticate, Authorization and Authentication-Info field values (RFC 9110)."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Iterable
+from dataclasses import dataclass, field
+from typing import TypeVar
+
+from ._model import AuthError, Challenge, Credentials
+from ._scan import Item, Param, classify, fail, prepare, split
+from ._schemes import check
+
+_T = TypeVar("_T")
+
+
+@dataclass
+class _Draft:
+    scheme: str
+    offset: int
+    token68: str | None
+    open: bool
+    params: dict[str, Param] = field(default_factory=dict)
+
+    def values(self) -> dict[str, str]:
+        return {name: param.value for name, param in self.params.items()}
+
+
+def _items(value: str, strict: bool) -> list[list[Item]]:
+    """Items of each line. Strict mode refuses line breaks; tolerant mode reads a bare one
+    (not obs-fold) as the end of a field line, so the next line keeps its challenges."""
+    text = prepare(value, strict)
+    lines = [text] if strict else text.replace("\r\n", "\n").split("\n")
+    result: list[list[Item]] = []
+    for line in lines:
+        parts, open_quote = split(line)
+        if strict and open_quote is not None:
+            raise fail("unterminated quoted-string", open_quote)
+        items = [classify(offset, raw, strict) for offset, raw in parts]
+        if strict:
+            for item in items:
+                if item.error:
+                    raise fail(item.error, item.error_at)
+        result.append(items)
+    return result
+
+
+def _add(params: dict[str, Param], param: Param, strict: bool) -> None:
+    if param.name in params:
+        if strict:
+            raise fail(f"duplicate auth-param {param.name!r}", param.offset)
+        return  # the first one wins, as most user agents do
+    params[param.name] = param
+
+
+def _step(drafts: list[_Draft], start: int, item: Item, strict: bool) -> None:
+    if item.kind == "challenge":
+        drafts.append(_Draft(item.scheme, item.offset, item.token68, item.open))
+        if item.param is not None:
+            _add(drafts[-1].params, item.param, strict)
+    elif item.kind == "param" and item.param is not None:
+        current = drafts[-1] if len(drafts) > start else None
+        if current is None or current.token68 is not None or not current.open:
+            if strict:
+                raise fail(f"auth-param {item.param.name!r} outside a challenge", item.offset)
+            if current is None or current.token68 is not None:
+                return
+        current.open = True
+        _add(current.params, item.param, strict)
+
+
+def _drafts(value: str, strict: bool) -> list[_Draft]:
+    drafts: list[_Draft] = []
+    for line in _items(value, strict):
+        start = len(drafts)  # a challenge never continues on the next line
+        for item in line:
+            _step(drafts, start, item, strict)
+    return drafts
+
+
+def _checked(draft: _Draft, kind: str, strict: bool) -> _Draft:
+    if strict:
+        try:
+            check(draft.scheme, kind, draft.token68, list(draft.params.values()))
+        except AuthError as error:
+            raise AuthError(f"{error}, in the {kind} at offset {draft.offset}") from None
+    return draft
+
+
+def _each_line(value: str | Iterable[str], read: Callable[[str], _T]) -> list[_T]:
+    lines = [value] if isinstance(value, str) else list(value)
+    results: list[_T] = []
+    for number, line in enumerate(lines, 1):
+        try:
+            results.append(read(line))
+        except AuthError as error:
+            if len(lines) == 1:
+                raise
+            raise AuthError(f"{error} (field line {number})") from None
+    return results
+
+
+def parse_challenges(value: str | Iterable[str], *, strict: bool = False) -> list[Challenge]:
+    """Parse WWW-Authenticate or Proxy-Authenticate field values into their challenges.
+
+    Pass one field value or an iterable of them (the field may occur several times).
+    By default parsing is tolerant: malformed parts are skipped and the first of two
+    params with the same name wins. With `strict=True` anything RFC 9110, RFC 7617,
+    RFC 7616 or RFC 6750 forbids raises `AuthError` with the reason and offset.
+    """
+
+    def read(line: str) -> list[Challenge]:
+        drafts = [_checked(d, "challenge", strict) for d in _drafts(line, strict)]
+        return [Challenge(d.scheme, d.token68, d.values()) for d in drafts]
+
+    challenges = [c for found in _each_line(value, read) for c in found]
+    if strict and not challenges:
+        raise AuthError("the field holds no challenge")
+    return challenges
+
+
+def parse_authorization(value: str, *, strict: bool = False) -> Credentials:
+    """Parse an Authorization or Proxy-Authorization field value.
+
+    Tolerant mode returns the first credentials found, or `Credentials("")` if none.
+    Strict mode raises `AuthError` unless the value is exactly one valid credentials.
+    """
+    drafts = _drafts(value, strict)
+    if strict:
+        if not drafts or value.strip(" \t")[: len(drafts[0].scheme)] != drafts[0].scheme:
+            raise AuthError("the field must start with an auth-scheme")
+        if len(drafts) > 1:
+            raise fail("only one credentials is allowed", drafts[1].offset)
+        token68 = drafts[0].token68
+        if token68 is not None and not value.rstrip(" \t").endswith(token68):
+            raise AuthError("nothing may follow the token68 of credentials")
+    if not drafts:
+        return Credentials("")
+    draft = _checked(drafts[0], "credentials", strict)
+    return Credentials(draft.scheme, draft.token68, draft.values())
+
+
+def parse_auth_info(
+    value: str | Iterable[str], *, strict: bool = False, scheme: str | None = None
+) -> dict[str, str]:
+    """Parse Authentication-Info or Proxy-Authentication-Info, a list of auth-params.
+
+    Names are lower-cased and the first of two equal names wins. Strict mode refuses
+    anything but auth-params and, given the `scheme` of the request's credentials,
+    applies its rules (Digest: quoting, `nc`, and rspauth, cnonce and nc with qop).
+    """
+    params: dict[str, Param] = {}
+
+    def read(line: str) -> None:
+        for items in _items(line, strict):
+            for item in items:
+                if item.kind == "param" and item.param is not None:
+                    _add(params, item.param, strict)
+                elif item.kind != "empty" and strict:
+                    raise fail("expected an auth-param", item.offset)
+
+    _each_line(value, read)
+    if strict and scheme is not None:
+        try:
+            check(scheme, "info", None, list(params.values()))
+        except AuthError as error:
+            raise AuthError(f"{error}, in the {scheme} Authentication-Info") from None
+    return {name: param.value for name, param in params.items()}

authchallenge/_scan.py

@@ -0,0 +1,133 @@
+"""Split a field value into list elements and classify each one (RFC 9110 sections 5.6, 11)."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from ._grammar import QUOTED_RE, TOKEN_RE, bad_octet, is_token68, unquote
+from ._model import AuthError
+
+_PARAM = re.compile(rf"({TOKEN_RE})[ \t]*=[ \t]*({QUOTED_RE}|{TOKEN_RE})", re.DOTALL)
+_SCHEME = re.compile(TOKEN_RE)
+# obs-fold of RFC 9112 section 5.2: a line break followed by whitespace. The OWS before
+# the break stays in place; matching it too would make long runs of spaces quadratic.
+_OBS_FOLD = re.compile(r"\r?\n[ \t]+")
+
+
+@dataclass(frozen=True)
+class Param:
+    """One auth-param as read: lower-cased name, unquoted value, how it was written."""
+
+    name: str
+    value: str
+    quoted: bool
+    offset: int
+
+
+@dataclass
+class Item:
+    """One list element: empty, an auth-param, the start of a challenge, or junk."""
+
+    offset: int
+    kind: str
+    scheme: str = ""
+    token68: str | None = None
+    param: Param | None = None
+    open: bool = False
+    error: str = ""
+    error_at: int = 0
+
+
+def fail(reason: str, offset: int) -> AuthError:
+    """Build the error strict parsing raises, pointing at the offending offset."""
+    return AuthError(f"{reason} at offset {offset}")
+
+
+def prepare(value: str, strict: bool) -> str:
+    """Unfold obs-fold and, in strict mode, refuse it and any character a field cannot hold."""
+    if strict:
+        fold = _OBS_FOLD.search(value)
+        if fold is not None:
+            raise fail("obsolete line folding", fold.start())
+        bad = bad_octet(value)
+        if bad is not None:
+            raise fail(f"character {value[bad]!r} is not allowed in a field value", bad)
+        return value
+    return _OBS_FOLD.sub(" ", value)
+
+
+def split(text: str) -> tuple[list[tuple[int, str]], int | None]:
+    """Split on commas outside quoted-strings; also return where an open quote started."""
+    parts: list[tuple[int, str]] = []
+    start = 0
+    quote_at: int | None = None
+    escaped = False
+    for index, char in enumerate(text):
+        if escaped:
+            escaped = False
+        elif quote_at is not None and char == "\\":
+            escaped = True
+        elif char == '"':
+            quote_at = index if quote_at is None else None
+        elif char == "," and quote_at is None:
+            parts.append((start, text[start:index]))
+            start = index + 1
+    parts.append((start, text[start:]))
+    return parts, quote_at
+
+
+def _param(match: re.Match[str], offset: int) -> Param:
+    raw = match.group(2)
+    return Param(match.group(1).lower(), unquote(raw), raw.startswith('"'), offset)
+
+
+def _read_param(item: Item, text: str, offset: int) -> bool:
+    """Fill item.param from text; record junk after the value. False if no param starts."""
+    match = _PARAM.match(text)
+    if match is None:
+        return False
+    param = _param(match, offset)
+    item.param = param
+    rest = text[match.end() :]
+    if rest:
+        item.error = f"unexpected text after the value of {param.name!r}"
+        item.error_at = offset + len(text) - len(rest.lstrip(" \t"))
+        if not param.quoted and rest[0] not in " \t":
+            item.param = None  # a token cut short by a stray character is not the value
+    return True
+
+
+def classify(offset: int, raw: str, strict: bool) -> Item:
+    """Classify one list element; malformed elements carry an error for strict mode."""
+    text = raw.strip(" \t")
+    at = offset + len(raw) - len(raw.lstrip(" \t"))
+    item = Item(at, "empty")
+    if not text:
+        return item
+    if _read_param(item, text, at):
+        item.kind = "param"
+        return item
+    scheme = _SCHEME.match(text)
+    after = text[scheme.end() :] if scheme else ""
+    if scheme is None or after.lstrip(" \t").startswith("="):
+        item.kind, item.error, item.error_at = "junk", "expected an auth-scheme or auth-param", at
+        return item
+    item.kind, item.scheme = "challenge", scheme.group()
+    gap = raw.lstrip(" \t")[scheme.end() :]
+    rest = after.lstrip(" \t")
+    space = gap[: len(gap) - len(gap.lstrip(" \t"))]
+    item.open = space != "" and (" " in space if strict else True)
+    if space == "" and after:
+        item.error, item.error_at = "expected a space after the auth-scheme", at + scheme.end()
+        return item
+    if not rest:
+        return item
+    rest_at = at + len(text) - len(rest)
+    if is_token68(rest):
+        item.token68 = rest
+    elif not _read_param(item, rest, rest_at):
+        item.error, item.error_at = "expected a token68 or an auth-param", rest_at
+    if "\t" in space:
+        item.error, item.error_at = "the auth-scheme must be followed by spaces", at + scheme.end()
+    return item

authchallenge/_schemes.py

@@ -0,0 +1,121 @@
+"""Rules of the registered schemes: Basic (RFC 7617), Bearer (RFC 6750), Digest (RFC 7616)."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Sequence
+
+from ._basic import split_user_pass
+from ._extvalue import decode_ext_value
+from ._model import AuthError
+from ._scan import Param
+
+# RFC 7616 sections 3.3, 3.4 and 3.5: values a sender must quote, and values it must not.
+DIGEST_QUOTED = {
+    "challenge": frozenset({"realm", "domain", "nonce", "opaque", "qop"}),
+    "credentials": frozenset({"username", "realm", "nonce", "uri", "response", "cnonce", "opaque"}),
+    "info": frozenset({"nextnonce", "rspauth", "cnonce"}),
+}
+DIGEST_BARE = {
+    "challenge": frozenset({"stale", "algorithm"}),
+    "credentials": frozenset({"algorithm", "qop", "nc"}),
+    "info": frozenset({"qop", "nc"}),
+}
+# RFC 6750 section 3: scope tokens, error and error_description, error_uri.
+_SCOPE_TOKEN = re.compile(r"[\x21\x23-\x5b\x5d-\x7e]+")
+_NQSCHAR = re.compile(r"[\x20\x21\x23-\x5b\x5d-\x7e]*")
+_URI_CHARS = re.compile(r"[\x21\x23-\x5b\x5d-\x7e]*")
+_NC = re.compile(r"[0-9A-Fa-f]{8}")
+
+
+def _values(params: Sequence[Param]) -> dict[str, Param]:
+    return {param.name: param for param in params}
+
+
+def _require(scheme: str, found: dict[str, Param], names: Sequence[str]) -> None:
+    for name in names:
+        if name not in found:
+            raise AuthError(f"{scheme} needs the {name!r} parameter")
+
+
+def _basic(kind: str, token68: str | None, found: dict[str, Param]) -> None:
+    if kind == "credentials":
+        if token68 is None:
+            raise AuthError("Basic credentials are a token68")
+        split_user_pass(token68, "latin-1")
+        return
+    _require("Basic", found, ["realm"])
+    charset = found.get("charset")
+    if charset is not None and charset.value.lower() != "utf-8":
+        raise AuthError("the Basic charset parameter only allows 'UTF-8'")
+
+
+def _bearer(kind: str, token68: str | None, found: dict[str, Param]) -> None:
+    if kind == "credentials":
+        if token68 is None:
+            raise AuthError("Bearer credentials are a b64token")
+        return
+    if not found:
+        raise AuthError("a Bearer challenge needs at least one auth-param")
+    scope = found.get("scope")
+    if scope is not None and not all(_SCOPE_TOKEN.fullmatch(s) for s in scope.value.split(" ")):
+        raise AuthError("the Bearer scope holds a character RFC 6750 does not allow")
+    for name, pattern in (("error", _NQSCHAR), ("error_description", _NQSCHAR)):
+        if name in found and not pattern.fullmatch(found[name].value):
+            raise AuthError(f"the Bearer {name} holds a character RFC 6750 does not allow")
+    if "error_uri" in found and not _URI_CHARS.fullmatch(found["error_uri"].value):
+        raise AuthError("the Bearer error_uri holds a character RFC 6750 does not allow")
+
+
+def _flag(found: dict[str, Param], name: str) -> None:
+    if name in found and found[name].value.lower() not in ("true", "false"):
+        raise AuthError(f"the Digest {name} parameter is 'true' or 'false'")
+
+
+def _digest(kind: str, token68: str | None, found: dict[str, Param]) -> None:
+    if token68 is not None:
+        raise AuthError("Digest uses auth-params, not a token68")
+    for name, param in found.items():
+        if name in DIGEST_QUOTED[kind] and not param.quoted:
+            raise AuthError(f"the Digest {name} parameter must be a quoted-string")
+        if name in DIGEST_BARE[kind] and param.quoted:
+            raise AuthError(f"the Digest {name} parameter must not be quoted")
+    if "nc" in found and not _NC.fullmatch(found["nc"].value):
+        raise AuthError("the Digest nc parameter is exactly 8 hexadecimal digits")
+    charset = found.get("charset")
+    if charset is not None and charset.value.lower() != "utf-8":
+        raise AuthError("the Digest charset parameter only allows 'UTF-8'")
+    _flag(found, "stale")
+    _flag(found, "userhash")
+    if kind == "challenge":
+        # The response of section 3.4.1 is computed from realm and nonce; qop is a MUST.
+        _require("Digest", found, ["realm", "nonce", "qop"])
+    elif kind == "credentials":
+        _digest_credentials(found)
+    elif "qop" in found:
+        _require("Digest", found, ["rspauth", "cnonce", "nc"])
+
+
+def _digest_credentials(found: dict[str, Param]) -> None:
+    if ("username" in found) == ("username*" in found):
+        raise AuthError("Digest credentials carry exactly one of username and username*")
+    if "username*" in found:
+        if found["username*"].quoted:
+            raise AuthError("the Digest username* parameter is an ext-value, not quoted")
+        decode_ext_value(found["username*"].value)
+    _require("Digest", found, ["realm", "nonce", "uri", "response", "cnonce", "nc"])
+
+
+def check(scheme: str, kind: str, token68: str | None, params: Sequence[Param]) -> None:
+    """Raise AuthError if a challenge, credentials or Authentication-Info breaks a rule.
+
+    `kind` is "challenge", "credentials" or "info". Rules of RFC 9110 apply to every
+    scheme; Basic, Bearer and Digest add their own. Unknown schemes only get the former.
+    """
+    found = _values(params)
+    realm = found.get("realm")
+    if kind == "challenge" and realm is not None and not realm.quoted:
+        raise AuthError("the realm parameter must be a quoted-string")
+    rules = {"basic": _basic, "bearer": _bearer, "digest": _digest}.get(scheme.lower())
+    if rules is not None and (kind != "info" or rules is _digest):
+        rules(kind, token68, found)

authchallenge-0.2.0.dist-info/METADATA

@@ -0,0 +1,210 @@
+Metadata-Version: 2.5
+Name: authchallenge
+Version: 0.2.0
+Summary: Parse, validate and safely build HTTP WWW-Authenticate, Authorization and Authentication-Info headers per RFC 9110, typed and zero-dependency
+Project-URL: Homepage, https://lianes8studio.com
+Project-URL: Repository, https://github.com/JaviLianes8/authchallenge
+Project-URL: Issues, https://github.com/JaviLianes8/authchallenge/issues
+Project-URL: Changelog, https://github.com/JaviLianes8/authchallenge/blob/main/CHANGELOG.md
+Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
+Project-URL: Funding, https://buymeacoffee.com/jlianesglrs
+Author-email: Javier Lianes <javier@lianes8studio.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: authentication,authentication-info,authorization,basic,bearer,digest,http,proxy-authenticate,rfc6750,rfc7235,rfc7616,rfc7617,rfc9110,www-authenticate
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# authchallenge
+
+Parse and build HTTP authentication headers: `WWW-Authenticate`, `Proxy-Authenticate`,
+`Authorization`, `Proxy-Authorization` and `Authentication-Info`, per RFC 9110 with the
+rules of Basic (RFC 7617), Digest (RFC 7616) and Bearer (RFC 6750). Typed, zero
+dependencies.
+
+## Install
+
+```
+pip install authchallenge
+```
+
+## Usage
+
+Parse the challenges a server offers. One comma separates both the params of a challenge
+and the challenges themselves; the parser tells them apart, keeps a token68 apart from
+params, and accepts several field lines:
+
+```python
+from authchallenge import parse_challenges, select_challenge
+
+offered = parse_challenges(
+    ['Basic realm="simple", Newauth realm="apps", type=1', "Negotiate a87421bff012e83c=="]
+)
+for challenge in offered:
+    print(challenge)
+print(select_challenge(offered, "negotiate", "basic").token68)
+# Challenge(scheme='Basic', token68=None, params={'realm': 'simple'})
+# Challenge(scheme='Newauth', token68=None, params={'realm': 'apps', 'type': '1'})
+# Challenge(scheme='Negotiate', token68='a87421bff012e83c==', params={})
+# a87421bff012e83c==
+```
+
+Parsing is tolerant by default: malformed parts are skipped, obsolete line folding reads
+as a space, and of two params with the same name the first wins. With `strict=True`
+anything the RFCs forbid raises `AuthError` with the reason:
+
+```python
+from authchallenge import AuthError, parse_challenges
+
+print(parse_challenges('Basic realm="a", realm="b"'))
+for header in ('Basic, realm="a"', "Basic realm=a", 'Basic realm="a" extra', "Bearer"):
+    try:
+        parse_challenges(header, strict=True)
+    except AuthError as error:
+        print(error)
+# [Challenge(scheme='Basic', token68=None, params={'realm': 'a'})]
+# auth-param 'realm' outside a challenge at offset 7
+# the realm parameter must be a quoted-string, in the challenge at offset 0
+# unexpected text after the value of 'realm' at offset 16
+# a Bearer challenge needs at least one auth-param, in the challenge at offset 0
+```
+
+Build headers safely. Values may hold only tab, space and visible ASCII, so a CR LF can
+never split the header. Quoting follows the sender rules: realm always, every Basic and
+Bearer param, and the Digest lists of RFC 7616. Whatever the builder returns passes the
+strict parser:
+
+```python
+from authchallenge import AuthError, build_bearer_challenge, build_challenge
+
+digest = {"realm": "api", "qop": "auth", "nonce": "7ypf", "algorithm": "SHA-256"}
+print(build_challenge("Digest", digest))
+print(build_bearer_challenge(realm="example", error="invalid_token", scope=["read", "write"]))
+try:
+    build_challenge("Basic", {"realm": "a\r\nSet-Cookie: x=1"})
+except AuthError as error:
+    print(error)
+# Digest realm="api", qop="auth", nonce="7ypf", algorithm=SHA-256
+# Bearer realm="example", scope="read write", error="invalid_token"
+# the value of 'realm' may hold only tab, space and visible ASCII; send other text as an RFC 8187 ext-value (see encode_ext_value)
+```
+
+Credentials, with helpers for Basic and for the RFC 8187 `username*` of Digest. The
+vectors come from RFC 7617 sections 2 and 2.1 (https://www.rfc-editor.org/rfc/rfc7617)
+and RFC 7616 section 3.9.2 (https://www.rfc-editor.org/rfc/rfc7616):
+
+```python
+from authchallenge import decode_basic, decode_ext_value, encode_basic, parse_authorization
+
+print(encode_basic("Aladdin", "open sesame"))
+print(decode_basic("Basic dGVzdDoxMjPCow=="))
+creds = parse_authorization("Digest username*=UTF-8''J%C3%A4s%C3%B8n%20Doe, realm=\"api\"")
+print(creds.scheme, decode_ext_value(creds.params["username*"]))
+# Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
+# ('test', '123£')
+# Digest Jäsøn Doe
+```
+
+Authentication-Info, the list of params a server sends after a successful login:
+
+```python
+from authchallenge import build_auth_info, parse_auth_info
+
+info = {
+    "nextnonce": "47364c23",
+    "qop": "auth",
+    "rspauth": "6629fae4",
+    "cnonce": "0a4f",
+    "nc": "00000001",
+}
+print(build_auth_info(info, scheme="Digest"))
+print(parse_auth_info("qop=auth, NC=00000001, nc=2"))
+# nextnonce="47364c23", qop=auth, rspauth="6629fae4", cnonce="0a4f", nc=00000001
+# {'qop': 'auth', 'nc': '00000001'}
+```
+
+## Command line
+
+```
+curl -sI https://example.com/private | authchallenge
+authchallenge --strict 'Basic realm=foo'
+authchallenge --authorization 'Bearer mF_9.B5f-4.1JqM'
+```
+
+Values come as arguments or one per stdin line; a header dump on stdin is read for the
+authentication fields only (the first non-empty line decides which). The output is JSON.
+`--strict` reports the first broken rule of each value on stderr and exits 1.
+
+## API
+
+| Name | Purpose |
+| --- | --- |
+| `parse_challenges(value, *, strict=False)` | WWW-Authenticate / Proxy-Authenticate, one value or several lines, to a list of `Challenge` |
+| `parse_authorization(value, *, strict=False)` | Authorization / Proxy-Authorization to `Credentials` |
+| `parse_auth_info(value, *, strict=False, scheme=None)` | Authentication-Info to a dict |
+| `build_challenge(scheme, params=None, token68=None)` | One challenge, quoted and checked |
+| `build_authorization(scheme, params=None, token68=None)` | Credentials, quoted and checked |
+| `build_auth_info(params, *, scheme=None)` | Authentication-Info |
+| `build_bearer_challenge(*, realm, scope, error, error_description, error_uri)` | A Bearer challenge per RFC 6750 |
+| `encode_basic(user_id, password, *, charset="utf-8")` | `Basic <base64>` per RFC 7617 |
+| `decode_basic(credentials, *, charset="utf-8")` | `(user_id, password)` |
+| `encode_ext_value(text)` / `decode_ext_value(value)` | RFC 8187 ext-values such as `username*` |
+| `select_challenge(challenges, *schemes)` | The first challenge of the most preferred scheme |
+| `Challenge`, `Credentials` | Frozen results: `scheme`, `token68`, `params` (names lower-cased) |
+| `AuthError` | A `ValueError` raised by builders and strict parsing |
+
+Strict mode and the builders check the grammar of RFC 9110 section 11 and these scheme
+rules: Basic needs a realm and allows only `charset="UTF-8"`, and its credentials must
+decode to `user-id:password`; Bearer needs at least one param, limits the characters of
+scope, error, error_description and error_uri, and its credentials are a token68; Digest
+quotes and leaves bare the params RFC 7616 lists, needs realm, nonce and qop in challenges
+and the response params in credentials, writes `nc` as 8 hex digits, and takes one of
+`username` and `username*`. Other schemes get the generic rules only.
+
+## Why
+
+Authentication headers are deceptively hard: one comma separates both the params within a
+challenge and the challenges from each other, token68 and auth-params look alike, the
+field may be repeated, and each scheme adds quoting rules of its own. The existing options
+fall short: `authparser` pulls in `pyparsing`, `www-authenticate` has been unmaintained
+since 2015 and only parses, and the newer `wwwauth` parses WWW-Authenticate alone. This
+library parses and builds all five fields, validates them on request, refuses header
+injection when building, and ships typed with no dependencies.
+
+## Testing against the specifications
+
+`python scripts/fetch_upstream.py` downloads the RFCs and the greenbytes WWW-Authenticate
+test cases listed in `tests/upstream/MANIFEST.json`, checking each against its sha256.
+The suite then reads character sets, quoting lists and examples from them and runs every
+test case in both modes; without them those tests skip.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

authchallenge-0.2.0.dist-info/RECORD

@@ -0,0 +1,18 @@
+authchallenge/__init__.py,sha256=rxhRgWuwOWwZ8xdxMs7XWCJSDhLwBHdhcc7fJgZcjj0,885
+authchallenge/__main__.py,sha256=1Ln9_v2TGiVS93LGcC6LWJ3_zt9Zsm5PNyhwdXf6mZo,129
+authchallenge/_basic.py,sha256=wPBLwDB_H7AdKWAFd82aIp2kdcl4i_yQWDZNMozAw7U,3428
+authchallenge/_build.py,sha256=dsC62hTKgAj-If_Fo3Ti28_fNHkm6l_FCg57K_U5gLU,4084
+authchallenge/_cli.py,sha256=JqgFbAgqIpaNWUeOWb3AGRhx5X35jjgz2ylWqKCu2y0,3975
+authchallenge/_extvalue.py,sha256=36-psFIdYsSzU9gzKsUm86CQkaRXzqdoTMvwGgy-e7U,1716
+authchallenge/_grammar.py,sha256=bEleh-5eqbeRITiCV3ZgIZBDmq4NkIjCdQYijQgforg,2310
+authchallenge/_helpers.py,sha256=VlVQm4mL3noSaoMGn6cgk93bQCYKirXfv_OJawm1W1o,1954
+authchallenge/_model.py,sha256=OsYC7RbfIqz5bT2HcrvhYXd1O8Iel0KxcEfD3q0Q2hQ,893
+authchallenge/_parse.py,sha256=ewuX7pWsgEFveMkR5Azh1foq-pPbWq09yInH2NFA_k4,6731
+authchallenge/_scan.py,sha256=uHZ-txOok6IAW-Dkp8ZdU7c3eAyGdor4Uni8LYI71fU,4726
+authchallenge/_schemes.py,sha256=ilk7KRCEfa2Tf2Yz_26uvwWktJq1zULEdX7lgyqAKoQ,5503
+authchallenge/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+authchallenge-0.2.0.dist-info/METADATA,sha256=u3LBgslH0x4ptvzSKFmg5gWJs7RpJdSStcKAHBFLQBQ,9450
+authchallenge-0.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+authchallenge-0.2.0.dist-info/entry_points.txt,sha256=qS6NcrbIz-4fElHE1SuSxnPTRd_aeCBZLjNLODShMOg,58
+authchallenge-0.2.0.dist-info/licenses/LICENSE,sha256=wirD5nCA2aQa5UusK_1YHLBogI3CGcw23xAnulp3L_U,1091
+authchallenge-0.2.0.dist-info/RECORD,,

authchallenge-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

authchallenge-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+authchallenge = authchallenge._cli:main

authchallenge-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.