authforge-sdk 1.2.0__tar.gz → 1.2.1__tar.gz

{authforge_sdk-1.2.0/authforge_sdk.egg-info → authforge_sdk-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: authforge-sdk
-Version: 1.2.0
+Version: 1.2.1
 Summary: Official Python SDK for AuthForge — credit-based license key authentication with Ed25519-verified responses.
 Author: AuthForge
 License: MIT
@@ -110,7 +110,7 @@ client = AuthForgeClient(
 | Parameter | Type | Default | Description |
 |---|---|---|---|
 | `app_id` | str | required | Your application ID from the AuthForge dashboard |
-| `app_secret` | str | required | Your application secret from the AuthForge dashboard |
+| `app_secret` | str | required for online APIs; `None` / `""` for `login_from_file` only | Your application secret from the AuthForge dashboard. Do not ship it in air-gapped binaries. |
 | `public_key` | `str \| Sequence[str]` | required | App Ed25519 public key(s) (base64) from dashboard. Pass one key, a list of keys, or a comma-separated string to trust multiple keys during rotation (see [Key rotation](#key-rotation)). |
 | `heartbeat_mode` | `str \| None` | `None` | Deprecated shim (see [Migrating from heartbeat_mode](#migrating-from-heartbeat_mode)). Use `online_heartbeat` instead. |
 | `heartbeat_interval` | int | `900` | Seconds between background checks (minimum `10`; default 15 min). Applies to both grace period checks and online check-ins. |
@@ -159,7 +159,7 @@ Tune `ttl_seconds` to set the grace period duration (server default 24h, clamped
 
 ## Offline license files (`.authforge`)
 
-For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins.
+For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins. Pass `app_secret=None` (or `""`) so the air-gapped binary does not contain the App Secret.
 
 | | Grace period (default) | Offline license file |
 | --- | --- | --- |
@@ -174,7 +174,7 @@ from authforge import AuthForgeClient
 
 client = AuthForgeClient(
     app_id="YOUR_APP_ID",
-    app_secret="YOUR_APP_SECRET",  # unused for offline files but still required by the constructor
+    app_secret=None,  # login_from_file does not use the App Secret; do not ship it in air-gapped builds
     public_key="YOUR_PUBLIC_KEY",
     on_failure=lambda reason, exc: print(reason, exc),
 )

{authforge_sdk-1.2.0 → authforge_sdk-1.2.1}/README.md

@@ -82,7 +82,7 @@ client = AuthForgeClient(
 | Parameter | Type | Default | Description |
 |---|---|---|---|
 | `app_id` | str | required | Your application ID from the AuthForge dashboard |
-| `app_secret` | str | required | Your application secret from the AuthForge dashboard |
+| `app_secret` | str | required for online APIs; `None` / `""` for `login_from_file` only | Your application secret from the AuthForge dashboard. Do not ship it in air-gapped binaries. |
 | `public_key` | `str \| Sequence[str]` | required | App Ed25519 public key(s) (base64) from dashboard. Pass one key, a list of keys, or a comma-separated string to trust multiple keys during rotation (see [Key rotation](#key-rotation)). |
 | `heartbeat_mode` | `str \| None` | `None` | Deprecated shim (see [Migrating from heartbeat_mode](#migrating-from-heartbeat_mode)). Use `online_heartbeat` instead. |
 | `heartbeat_interval` | int | `900` | Seconds between background checks (minimum `10`; default 15 min). Applies to both grace period checks and online check-ins. |
@@ -131,7 +131,7 @@ Tune `ttl_seconds` to set the grace period duration (server default 24h, clamped
 
 ## Offline license files (`.authforge`)
 
-For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins.
+For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins. Pass `app_secret=None` (or `""`) so the air-gapped binary does not contain the App Secret.
 
 | | Grace period (default) | Offline license file |
 | --- | --- | --- |
@@ -146,7 +146,7 @@ from authforge import AuthForgeClient
 
 client = AuthForgeClient(
     app_id="YOUR_APP_ID",
-    app_secret="YOUR_APP_SECRET",  # unused for offline files but still required by the constructor
+    app_secret=None,  # login_from_file does not use the App Secret; do not ship it in air-gapped builds
     public_key="YOUR_PUBLIC_KEY",
     on_failure=lambda reason, exc: print(reason, exc),
 )

{authforge_sdk-1.2.0 → authforge_sdk-1.2.1}/authforge.py

@@ -360,7 +360,7 @@ class AuthForgeClient:
     def __init__(
         self,
         app_id: str,
-        app_secret: str,
+        app_secret: Optional[str],
         public_key: PublicKeyArg,
         heartbeat_mode: Optional[str] = None,
         heartbeat_interval: int = 900,
@@ -374,8 +374,12 @@ class AuthForgeClient:
     ) -> None:
         if not app_id or not isinstance(app_id, str):
             raise ValueError("app_id must be a non-empty string")
-        if not app_secret or not isinstance(app_secret, str):
-            raise ValueError("app_secret must be a non-empty string")
+        # Empty/None is valid for offline-only clients (login_from_file).
+        # Online APIs (login, validate_license, self_ban) still require a secret.
+        if app_secret is None:
+            app_secret = ""
+        elif not isinstance(app_secret, str):
+            raise ValueError("app_secret must be a string or None")
         public_key_list = self._normalize_public_key_list(public_key)
         if not public_key_list:
             raise ValueError(
@@ -558,9 +562,16 @@ class AuthForgeClient:
             except Exception:
                 pass
 
+    def _require_app_secret(self) -> None:
+        if not self.app_secret:
+            raise ValueError(
+                "app_secret is required for online APIs; omit it only when using login_from_file"
+            )
+
     def login(self, license_key: str) -> bool:
         if not license_key or not isinstance(license_key, str):
             raise ValueError("license_key must be a non-empty string")
+        self._require_app_secret()
 
         try:
             self._validate_and_store(license_key)
@@ -575,6 +586,7 @@ class AuthForgeClient:
         session state or starting the heartbeat thread."""
         if not license_key or not isinstance(license_key, str):
             raise ValueError("license_key must be a non-empty string")
+        self._require_app_secret()
         try:
             body: Dict[str, Any] = {
                 "appId": self.app_id,
@@ -661,6 +673,7 @@ class AuthForgeClient:
         resolved_license = explicit_license or current_license
         if not resolved_license:
             raise ValueError("missing_license_key")
+        self._require_app_secret()
 
         body = {
             "appId": self.app_id,

{authforge_sdk-1.2.0 → authforge_sdk-1.2.1/authforge_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: authforge-sdk
-Version: 1.2.0
+Version: 1.2.1
 Summary: Official Python SDK for AuthForge — credit-based license key authentication with Ed25519-verified responses.
 Author: AuthForge
 License: MIT
@@ -110,7 +110,7 @@ client = AuthForgeClient(
 | Parameter | Type | Default | Description |
 |---|---|---|---|
 | `app_id` | str | required | Your application ID from the AuthForge dashboard |
-| `app_secret` | str | required | Your application secret from the AuthForge dashboard |
+| `app_secret` | str | required for online APIs; `None` / `""` for `login_from_file` only | Your application secret from the AuthForge dashboard. Do not ship it in air-gapped binaries. |
 | `public_key` | `str \| Sequence[str]` | required | App Ed25519 public key(s) (base64) from dashboard. Pass one key, a list of keys, or a comma-separated string to trust multiple keys during rotation (see [Key rotation](#key-rotation)). |
 | `heartbeat_mode` | `str \| None` | `None` | Deprecated shim (see [Migrating from heartbeat_mode](#migrating-from-heartbeat_mode)). Use `online_heartbeat` instead. |
 | `heartbeat_interval` | int | `900` | Seconds between background checks (minimum `10`; default 15 min). Applies to both grace period checks and online check-ins. |
@@ -159,7 +159,7 @@ Tune `ttl_seconds` to set the grace period duration (server default 24h, clamped
 
 ## Offline license files (`.authforge`)
 
-For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins.
+For machines that never connect to the internet, the operator mints a **signed offline license file** in the AuthForge dashboard (License page -> *Mint .authforge file*) or via `POST /v1/licenses/{licenseKey}/offline-files`. The file is a standalone Ed25519-signed document; the SDK verifies it with **only** your app public key and the machine HWID. It never contacts AuthForge and never starts online check-ins. Pass `app_secret=None` (or `""`) so the air-gapped binary does not contain the App Secret.
 
 | | Grace period (default) | Offline license file |
 | --- | --- | --- |
@@ -174,7 +174,7 @@ from authforge import AuthForgeClient
 
 client = AuthForgeClient(
     app_id="YOUR_APP_ID",
-    app_secret="YOUR_APP_SECRET",  # unused for offline files but still required by the constructor
+    app_secret=None,  # login_from_file does not use the App Secret; do not ship it in air-gapped builds
     public_key="YOUR_PUBLIC_KEY",
     on_failure=lambda reason, exc: print(reason, exc),
 )

{authforge_sdk-1.2.0 → authforge_sdk-1.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "authforge-sdk"
-version = "1.2.0"
+version = "1.2.1"
 description = "Official Python SDK for AuthForge — credit-based license key authentication with Ed25519-verified responses."
 readme = "README.md"
 requires-python = ">=3.9"