authchallenge 0.2.0__tar.gz

authchallenge-0.2.0/.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

authchallenge-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+build/
+dist/
+*.egg-info/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Third-party reference files, fetched locally by scripts/fetch_upstream.py; only the manifest is tracked.
+tests/upstream/*
+!tests/upstream/MANIFEST.json

authchallenge-0.2.0/CHANGELOG.md

@@ -0,0 +1,50 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.0] - unreleased
+
+### Security
+
+- Builders refuse values with CR, LF, NUL, DEL or any character outside tab, space and
+  visible ASCII, so a value can no longer inject a header line.
+
+### Added
+
+- `strict=True` on every parser: the RFC 9110 grammar (obsolete line folding, controls,
+  unterminated quoted-strings, trailing text, params outside a challenge, a tab after the
+  scheme, duplicate names, realm as a token) and the Basic, Bearer and Digest rules raise
+  `AuthError` with the reason and offset.
+- `parse_auth_info` and `build_auth_info` for Authentication-Info and
+  Proxy-Authentication-Info.
+- `encode_basic` and `decode_basic` (RFC 7617), `build_bearer_challenge` (RFC 6750),
+  `encode_ext_value` and `decode_ext_value` (RFC 8187), `select_challenge`.
+- `parse_challenges` accepts several field lines.
+- The `authchallenge` command and `python -m authchallenge`: JSON output, `--strict` lint.
+
+### Changed
+
+- Of two params with the same name the first wins (it was the last).
+- Obsolete line folding is read as a space instead of yielding nothing.
+- A token68 challenge never collects params that follow it.
+- Builders quote `realm` always, every Basic and Bearer param, and the Digest params RFC
+  7616 lists; Digest `stale`, `algorithm`, `qop` (credentials) and `nc` are written bare.
+- Tolerant parsing reads a bare line break (not obsolete folding) as the end of a field
+  line, and drops a token value cut short by a stray character instead of truncating it.
+- `decode_ext_value` refuses text that decodes to control characters; `encode_basic` and
+  `decode_basic` accept only UTF-8 and ISO-8859-1.
+- Builders refuse names that differ only in case and whatever strict parsing refuses,
+  including a Basic challenge without realm and incomplete Digest params.
+
+## [0.1.0]
+
+- Parse WWW-Authenticate and Proxy-Authenticate headers into a list of challenges, with
+  multi-challenge comma disambiguation, token68 and quoted auth-params (RFC 7235).
+- Parse Authorization and Proxy-Authorization credentials into a scheme with token68 or
+  auth-params.
+- Build challenge and credentials strings back, quoting values only when required.
+- Typed, zero dependencies, `py.typed`.

authchallenge-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Thanks for taking the time. This project keeps a small, predictable shape.
+
+## Setup
+
+```
+pip install -r requirements-dev.txt
+```
+
+## Before you open a pull request
+
+- Keep public API in `src/authchallenge/__init__.py`; internals live in `_`-prefixed modules.
+- Add a test for the behaviour you change. Tests inject time, disk and network; they
+  never touch the real thing.
+- Run `scripts/check.ps1` (format, lint, types, tests) and make sure it passes.
+- One logical change per commit, imperative subject line.
+
+Open an issue first if the change is large or shifts the public API.

authchallenge-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Javier Lianes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

authchallenge-0.2.0/PKG-INFO

@@ -0,0 +1,210 @@
+Metadata-Version: 2.5
+Name: authchallenge
+Version: 0.2.0
+Summary: Parse, validate and safely build HTTP WWW-Authenticate, Authorization and Authentication-Info headers per RFC 9110, typed and zero-dependency
+Project-URL: Homepage, https://lianes8studio.com
+Project-URL: Repository, https://github.com/JaviLianes8/authchallenge
+Project-URL: Issues, https://github.com/JaviLianes8/authchallenge/issues
+Project-URL: Changelog, https://github.com/JaviLianes8/authchallenge/blob/main/CHANGELOG.md
+Project-URL: LinkedIn, https://www.linkedin.com/in/jlianes/
+Project-URL: Funding, https://buymeacoffee.com/jlianesglrs
+Author-email: Javier Lianes <javier@lianes8studio.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: authentication,authentication-info,authorization,basic,bearer,digest,http,proxy-authenticate,rfc6750,rfc7235,rfc7616,rfc7617,rfc9110,www-authenticate
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Requires-Dist: twine; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# authchallenge
+
+Parse and build HTTP authentication headers: `WWW-Authenticate`, `Proxy-Authenticate`,
+`Authorization`, `Proxy-Authorization` and `Authentication-Info`, per RFC 9110 with the
+rules of Basic (RFC 7617), Digest (RFC 7616) and Bearer (RFC 6750). Typed, zero
+dependencies.
+
+## Install
+
+```
+pip install authchallenge
+```
+
+## Usage
+
+Parse the challenges a server offers. One comma separates both the params of a challenge
+and the challenges themselves; the parser tells them apart, keeps a token68 apart from
+params, and accepts several field lines:
+
+```python
+from authchallenge import parse_challenges, select_challenge
+
+offered = parse_challenges(
+    ['Basic realm="simple", Newauth realm="apps", type=1', "Negotiate a87421bff012e83c=="]
+)
+for challenge in offered:
+    print(challenge)
+print(select_challenge(offered, "negotiate", "basic").token68)
+# Challenge(scheme='Basic', token68=None, params={'realm': 'simple'})
+# Challenge(scheme='Newauth', token68=None, params={'realm': 'apps', 'type': '1'})
+# Challenge(scheme='Negotiate', token68='a87421bff012e83c==', params={})
+# a87421bff012e83c==
+```
+
+Parsing is tolerant by default: malformed parts are skipped, obsolete line folding reads
+as a space, and of two params with the same name the first wins. With `strict=True`
+anything the RFCs forbid raises `AuthError` with the reason:
+
+```python
+from authchallenge import AuthError, parse_challenges
+
+print(parse_challenges('Basic realm="a", realm="b"'))
+for header in ('Basic, realm="a"', "Basic realm=a", 'Basic realm="a" extra', "Bearer"):
+    try:
+        parse_challenges(header, strict=True)
+    except AuthError as error:
+        print(error)
+# [Challenge(scheme='Basic', token68=None, params={'realm': 'a'})]
+# auth-param 'realm' outside a challenge at offset 7
+# the realm parameter must be a quoted-string, in the challenge at offset 0
+# unexpected text after the value of 'realm' at offset 16
+# a Bearer challenge needs at least one auth-param, in the challenge at offset 0
+```
+
+Build headers safely. Values may hold only tab, space and visible ASCII, so a CR LF can
+never split the header. Quoting follows the sender rules: realm always, every Basic and
+Bearer param, and the Digest lists of RFC 7616. Whatever the builder returns passes the
+strict parser:
+
+```python
+from authchallenge import AuthError, build_bearer_challenge, build_challenge
+
+digest = {"realm": "api", "qop": "auth", "nonce": "7ypf", "algorithm": "SHA-256"}
+print(build_challenge("Digest", digest))
+print(build_bearer_challenge(realm="example", error="invalid_token", scope=["read", "write"]))
+try:
+    build_challenge("Basic", {"realm": "a\r\nSet-Cookie: x=1"})
+except AuthError as error:
+    print(error)
+# Digest realm="api", qop="auth", nonce="7ypf", algorithm=SHA-256
+# Bearer realm="example", scope="read write", error="invalid_token"
+# the value of 'realm' may hold only tab, space and visible ASCII; send other text as an RFC 8187 ext-value (see encode_ext_value)
+```
+
+Credentials, with helpers for Basic and for the RFC 8187 `username*` of Digest. The
+vectors come from RFC 7617 sections 2 and 2.1 (https://www.rfc-editor.org/rfc/rfc7617)
+and RFC 7616 section 3.9.2 (https://www.rfc-editor.org/rfc/rfc7616):
+
+```python
+from authchallenge import decode_basic, decode_ext_value, encode_basic, parse_authorization
+
+print(encode_basic("Aladdin", "open sesame"))
+print(decode_basic("Basic dGVzdDoxMjPCow=="))
+creds = parse_authorization("Digest username*=UTF-8''J%C3%A4s%C3%B8n%20Doe, realm=\"api\"")
+print(creds.scheme, decode_ext_value(creds.params["username*"]))
+# Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
+# ('test', '123£')
+# Digest Jäsøn Doe
+```
+
+Authentication-Info, the list of params a server sends after a successful login:
+
+```python
+from authchallenge import build_auth_info, parse_auth_info
+
+info = {
+    "nextnonce": "47364c23",
+    "qop": "auth",
+    "rspauth": "6629fae4",
+    "cnonce": "0a4f",
+    "nc": "00000001",
+}
+print(build_auth_info(info, scheme="Digest"))
+print(parse_auth_info("qop=auth, NC=00000001, nc=2"))
+# nextnonce="47364c23", qop=auth, rspauth="6629fae4", cnonce="0a4f", nc=00000001
+# {'qop': 'auth', 'nc': '00000001'}
+```
+
+## Command line
+
+```
+curl -sI https://example.com/private | authchallenge
+authchallenge --strict 'Basic realm=foo'
+authchallenge --authorization 'Bearer mF_9.B5f-4.1JqM'
+```
+
+Values come as arguments or one per stdin line; a header dump on stdin is read for the
+authentication fields only (the first non-empty line decides which). The output is JSON.
+`--strict` reports the first broken rule of each value on stderr and exits 1.
+
+## API
+
+| Name | Purpose |
+| --- | --- |
+| `parse_challenges(value, *, strict=False)` | WWW-Authenticate / Proxy-Authenticate, one value or several lines, to a list of `Challenge` |
+| `parse_authorization(value, *, strict=False)` | Authorization / Proxy-Authorization to `Credentials` |
+| `parse_auth_info(value, *, strict=False, scheme=None)` | Authentication-Info to a dict |
+| `build_challenge(scheme, params=None, token68=None)` | One challenge, quoted and checked |
+| `build_authorization(scheme, params=None, token68=None)` | Credentials, quoted and checked |
+| `build_auth_info(params, *, scheme=None)` | Authentication-Info |
+| `build_bearer_challenge(*, realm, scope, error, error_description, error_uri)` | A Bearer challenge per RFC 6750 |
+| `encode_basic(user_id, password, *, charset="utf-8")` | `Basic <base64>` per RFC 7617 |
+| `decode_basic(credentials, *, charset="utf-8")` | `(user_id, password)` |
+| `encode_ext_value(text)` / `decode_ext_value(value)` | RFC 8187 ext-values such as `username*` |
+| `select_challenge(challenges, *schemes)` | The first challenge of the most preferred scheme |
+| `Challenge`, `Credentials` | Frozen results: `scheme`, `token68`, `params` (names lower-cased) |
+| `AuthError` | A `ValueError` raised by builders and strict parsing |
+
+Strict mode and the builders check the grammar of RFC 9110 section 11 and these scheme
+rules: Basic needs a realm and allows only `charset="UTF-8"`, and its credentials must
+decode to `user-id:password`; Bearer needs at least one param, limits the characters of
+scope, error, error_description and error_uri, and its credentials are a token68; Digest
+quotes and leaves bare the params RFC 7616 lists, needs realm, nonce and qop in challenges
+and the response params in credentials, writes `nc` as 8 hex digits, and takes one of
+`username` and `username*`. Other schemes get the generic rules only.
+
+## Why
+
+Authentication headers are deceptively hard: one comma separates both the params within a
+challenge and the challenges from each other, token68 and auth-params look alike, the
+field may be repeated, and each scheme adds quoting rules of its own. The existing options
+fall short: `authparser` pulls in `pyparsing`, `www-authenticate` has been unmaintained
+since 2015 and only parses, and the newer `wwwauth` parses WWW-Authenticate alone. This
+library parses and builds all five fields, validates them on request, refuses header
+injection when building, and ships typed with no dependencies.
+
+## Testing against the specifications
+
+`python scripts/fetch_upstream.py` downloads the RFCs and the greenbytes WWW-Authenticate
+test cases listed in `tests/upstream/MANIFEST.json`, checking each against its sha256.
+The suite then reads character sets, quoting lists and examples from them and runs every
+test case in both modes; without them those tests skip.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

authchallenge-0.2.0/README.md

@@ -0,0 +1,172 @@
+# authchallenge
+
+Parse and build HTTP authentication headers: `WWW-Authenticate`, `Proxy-Authenticate`,
+`Authorization`, `Proxy-Authorization` and `Authentication-Info`, per RFC 9110 with the
+rules of Basic (RFC 7617), Digest (RFC 7616) and Bearer (RFC 6750). Typed, zero
+dependencies.
+
+## Install
+
+```
+pip install authchallenge
+```
+
+## Usage
+
+Parse the challenges a server offers. One comma separates both the params of a challenge
+and the challenges themselves; the parser tells them apart, keeps a token68 apart from
+params, and accepts several field lines:
+
+```python
+from authchallenge import parse_challenges, select_challenge
+
+offered = parse_challenges(
+    ['Basic realm="simple", Newauth realm="apps", type=1', "Negotiate a87421bff012e83c=="]
+)
+for challenge in offered:
+    print(challenge)
+print(select_challenge(offered, "negotiate", "basic").token68)
+# Challenge(scheme='Basic', token68=None, params={'realm': 'simple'})
+# Challenge(scheme='Newauth', token68=None, params={'realm': 'apps', 'type': '1'})
+# Challenge(scheme='Negotiate', token68='a87421bff012e83c==', params={})
+# a87421bff012e83c==
+```
+
+Parsing is tolerant by default: malformed parts are skipped, obsolete line folding reads
+as a space, and of two params with the same name the first wins. With `strict=True`
+anything the RFCs forbid raises `AuthError` with the reason:
+
+```python
+from authchallenge import AuthError, parse_challenges
+
+print(parse_challenges('Basic realm="a", realm="b"'))
+for header in ('Basic, realm="a"', "Basic realm=a", 'Basic realm="a" extra', "Bearer"):
+    try:
+        parse_challenges(header, strict=True)
+    except AuthError as error:
+        print(error)
+# [Challenge(scheme='Basic', token68=None, params={'realm': 'a'})]
+# auth-param 'realm' outside a challenge at offset 7
+# the realm parameter must be a quoted-string, in the challenge at offset 0
+# unexpected text after the value of 'realm' at offset 16
+# a Bearer challenge needs at least one auth-param, in the challenge at offset 0
+```
+
+Build headers safely. Values may hold only tab, space and visible ASCII, so a CR LF can
+never split the header. Quoting follows the sender rules: realm always, every Basic and
+Bearer param, and the Digest lists of RFC 7616. Whatever the builder returns passes the
+strict parser:
+
+```python
+from authchallenge import AuthError, build_bearer_challenge, build_challenge
+
+digest = {"realm": "api", "qop": "auth", "nonce": "7ypf", "algorithm": "SHA-256"}
+print(build_challenge("Digest", digest))
+print(build_bearer_challenge(realm="example", error="invalid_token", scope=["read", "write"]))
+try:
+    build_challenge("Basic", {"realm": "a\r\nSet-Cookie: x=1"})
+except AuthError as error:
+    print(error)
+# Digest realm="api", qop="auth", nonce="7ypf", algorithm=SHA-256
+# Bearer realm="example", scope="read write", error="invalid_token"
+# the value of 'realm' may hold only tab, space and visible ASCII; send other text as an RFC 8187 ext-value (see encode_ext_value)
+```
+
+Credentials, with helpers for Basic and for the RFC 8187 `username*` of Digest. The
+vectors come from RFC 7617 sections 2 and 2.1 (https://www.rfc-editor.org/rfc/rfc7617)
+and RFC 7616 section 3.9.2 (https://www.rfc-editor.org/rfc/rfc7616):
+
+```python
+from authchallenge import decode_basic, decode_ext_value, encode_basic, parse_authorization
+
+print(encode_basic("Aladdin", "open sesame"))
+print(decode_basic("Basic dGVzdDoxMjPCow=="))
+creds = parse_authorization("Digest username*=UTF-8''J%C3%A4s%C3%B8n%20Doe, realm=\"api\"")
+print(creds.scheme, decode_ext_value(creds.params["username*"]))
+# Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
+# ('test', '123£')
+# Digest Jäsøn Doe
+```
+
+Authentication-Info, the list of params a server sends after a successful login:
+
+```python
+from authchallenge import build_auth_info, parse_auth_info
+
+info = {
+    "nextnonce": "47364c23",
+    "qop": "auth",
+    "rspauth": "6629fae4",
+    "cnonce": "0a4f",
+    "nc": "00000001",
+}
+print(build_auth_info(info, scheme="Digest"))
+print(parse_auth_info("qop=auth, NC=00000001, nc=2"))
+# nextnonce="47364c23", qop=auth, rspauth="6629fae4", cnonce="0a4f", nc=00000001
+# {'qop': 'auth', 'nc': '00000001'}
+```
+
+## Command line
+
+```
+curl -sI https://example.com/private | authchallenge
+authchallenge --strict 'Basic realm=foo'
+authchallenge --authorization 'Bearer mF_9.B5f-4.1JqM'
+```
+
+Values come as arguments or one per stdin line; a header dump on stdin is read for the
+authentication fields only (the first non-empty line decides which). The output is JSON.
+`--strict` reports the first broken rule of each value on stderr and exits 1.
+
+## API
+
+| Name | Purpose |
+| --- | --- |
+| `parse_challenges(value, *, strict=False)` | WWW-Authenticate / Proxy-Authenticate, one value or several lines, to a list of `Challenge` |
+| `parse_authorization(value, *, strict=False)` | Authorization / Proxy-Authorization to `Credentials` |
+| `parse_auth_info(value, *, strict=False, scheme=None)` | Authentication-Info to a dict |
+| `build_challenge(scheme, params=None, token68=None)` | One challenge, quoted and checked |
+| `build_authorization(scheme, params=None, token68=None)` | Credentials, quoted and checked |
+| `build_auth_info(params, *, scheme=None)` | Authentication-Info |
+| `build_bearer_challenge(*, realm, scope, error, error_description, error_uri)` | A Bearer challenge per RFC 6750 |
+| `encode_basic(user_id, password, *, charset="utf-8")` | `Basic <base64>` per RFC 7617 |
+| `decode_basic(credentials, *, charset="utf-8")` | `(user_id, password)` |
+| `encode_ext_value(text)` / `decode_ext_value(value)` | RFC 8187 ext-values such as `username*` |
+| `select_challenge(challenges, *schemes)` | The first challenge of the most preferred scheme |
+| `Challenge`, `Credentials` | Frozen results: `scheme`, `token68`, `params` (names lower-cased) |
+| `AuthError` | A `ValueError` raised by builders and strict parsing |
+
+Strict mode and the builders check the grammar of RFC 9110 section 11 and these scheme
+rules: Basic needs a realm and allows only `charset="UTF-8"`, and its credentials must
+decode to `user-id:password`; Bearer needs at least one param, limits the characters of
+scope, error, error_description and error_uri, and its credentials are a token68; Digest
+quotes and leaves bare the params RFC 7616 lists, needs realm, nonce and qop in challenges
+and the response params in credentials, writes `nc` as 8 hex digits, and takes one of
+`username` and `username*`. Other schemes get the generic rules only.
+
+## Why
+
+Authentication headers are deceptively hard: one comma separates both the params within a
+challenge and the challenges from each other, token68 and auth-params look alike, the
+field may be repeated, and each scheme adds quoting rules of its own. The existing options
+fall short: `authparser` pulls in `pyparsing`, `www-authenticate` has been unmaintained
+since 2015 and only parses, and the newer `wwwauth` parses WWW-Authenticate alone. This
+library parses and builds all five fields, validates them on request, refuses header
+injection when building, and ships typed with no dependencies.
+
+## Testing against the specifications
+
+`python scripts/fetch_upstream.py` downloads the RFCs and the greenbytes WWW-Authenticate
+test cases listed in `tests/upstream/MANIFEST.json`, checking each against its sha256.
+The suite then reads character sets, quoting lists and examples from them and runs every
+test case in both modes; without them those tests skip.
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+## Links
+
+- Website: https://lianes8studio.com
+- GitHub: https://github.com/JaviLianes8
+- LinkedIn: https://www.linkedin.com/in/jlianes/

authchallenge-0.2.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "authchallenge"
+version = "0.2.0"
+description = "Parse, validate and safely build HTTP WWW-Authenticate, Authorization and Authentication-Info headers per RFC 9110, typed and zero-dependency"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Javier Lianes", email = "javier@lianes8studio.com" }]
+keywords = ["http", "authentication", "www-authenticate", "authorization", "proxy-authenticate", "authentication-info", "basic", "digest", "bearer", "rfc9110", "rfc7235", "rfc7617", "rfc7616", "rfc6750"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Operating System :: OS Independent",
+    "Environment :: Console",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.optional-dependencies]
+dev = ["ruff", "mypy", "pytest", "build", "twine"]
+
+[project.scripts]
+authchallenge = "authchallenge._cli:main"
+
+[project.urls]
+Homepage = "https://lianes8studio.com"
+Repository = "https://github.com/JaviLianes8/authchallenge"
+Issues = "https://github.com/JaviLianes8/authchallenge/issues"
+Changelog = "https://github.com/JaviLianes8/authchallenge/blob/main/CHANGELOG.md"
+LinkedIn = "https://www.linkedin.com/in/jlianes/"
+Funding = "https://buymeacoffee.com/jlianesglrs"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/authchallenge"]
+
+[tool.hatch.build.targets.sdist]
+# Third-party reference files are fetched locally and never shipped; only their manifest is.
+exclude = [
+    ".github",
+    "IMPROVEMENTS-round*.md",
+    "tests/upstream/*.txt",
+    "tests/upstream/*.html",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM", "RUF"]
+
+[tool.mypy]
+python_version = "3.10"
+strict = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+addopts = "-q"

authchallenge-0.2.0/requirements-dev.txt

@@ -0,0 +1,3 @@
+# Development dependencies: the package in editable mode plus its dev extras
+# (ruff, mypy, pytest, build, twine). Install with:  pip install -r requirements-dev.txt
+-e .[dev]

authchallenge-0.2.0/scripts/check.ps1

@@ -0,0 +1,17 @@
+# Local quality gate. Run before every commit. No CI runs in the cloud.
+# $ErrorActionPreference does NOT stop on a native command's non-zero exit, so each tool's
+# exit code is checked explicitly: a red gate must fail, never pass silently.
+$ErrorActionPreference = "Stop"
+
+function Invoke-Step($label, [scriptblock]$cmd) {
+    Write-Host "== $label =="
+    & $cmd
+    if ($LASTEXITCODE -ne 0) { Write-Host "FAILED: $label (exit $LASTEXITCODE)"; exit $LASTEXITCODE }
+}
+
+Invoke-Step "ruff format" { ruff format --check . }
+Invoke-Step "ruff lint"   { ruff check . }
+Invoke-Step "mypy"        { mypy --strict src tests }
+Invoke-Step "pytest"      { pytest }
+Write-Host "gate green"
+Write-Host "Reference files: python scripts/fetch_upstream.py; wheel test: AUTHCHALLENGE_E2E=1 pytest tests/test_e2e_wheel.py"

authchallenge-0.2.0/scripts/fetch_upstream.py

@@ -0,0 +1,39 @@
+"""Fetch the third-party test files listed in tests/upstream/MANIFEST.json.
+
+The files are not part of the repository. Their tests skip until this script has fetched
+them; each download is checked against the size and sha256 in the manifest.
+
+    python scripts/fetch_upstream.py
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+FOLDER = Path(__file__).resolve().parents[1] / "tests" / "upstream"
+
+
+def main() -> int:
+    manifest = json.loads((FOLDER / "MANIFEST.json").read_text(encoding="utf-8"))
+    failed = 0
+    for name, entry in manifest.items():
+        with urllib.request.urlopen(entry["url"], timeout=60) as response:
+            body = response.read()
+        digest = hashlib.sha256(body).hexdigest()
+        if len(body) != entry["size"] or digest != entry["sha256"]:
+            print(f"{name}: got {len(body)} bytes, sha256 {digest}; manifest differs")
+            failed += 1
+            continue
+        target = FOLDER / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(body)
+        print(f"{name}: ok")
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

authchallenge-0.2.0/scripts/release.ps1

@@ -0,0 +1,28 @@
+# Build and upload to PyPI. Run scripts/check.ps1 first.
+# The name must not already exist on PyPI; the token is read from a secret store, never git.
+$ErrorActionPreference = "Stop"
+
+# Works on both Windows PowerShell 5.1 and pwsh 7 (generic catch, no PS7-only types).
+$taken = $true
+try {
+    Invoke-WebRequest -UseBasicParsing "https://pypi.org/pypi/authchallenge/json" | Out-Null
+} catch {
+    if ($_.Exception.Response.StatusCode.value__ -eq 404) { $taken = $false } else { throw }
+}
+if ($taken) { throw "The name 'authchallenge' already exists on PyPI. Choose another before publishing." }
+
+$token = $env:PYPI_TOKEN
+if (-not $token -and (Test-Path "C:\secrets\pypi-token.txt")) {
+    $token = (Get-Content "C:\secrets\pypi-token.txt" -Raw).Trim()
+}
+if (-not $token) {
+    throw "No PyPI token. Set `$env:PYPI_TOKEN or save it to C:\secrets\pypi-token.txt (never commit it)."
+}
+
+Remove-Item -Recurse -Force dist -ErrorAction SilentlyContinue
+python -m build
+python -m twine check dist/*
+
+$env:TWINE_USERNAME = "__token__"
+$env:TWINE_PASSWORD = $token
+try { python -m twine upload dist/* } finally { Remove-Item Env:\TWINE_PASSWORD -ErrorAction SilentlyContinue }