cexy 0.1.0.dev1__tar.gz → 0.1.0.dev3__tar.gz

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/CHANGELOG.md

@@ -3,7 +3,24 @@
 All notable changes to this project are documented here. The SDK stays at 0.x until API
 request signing (HMAC) ships; see "Versioning" in README.md.
 
-## 0.1.0.dev1 (unreleased)
+## 0.1.0.dev3 (unreleased)
+
+### Security
+- **Redirects are never followed**, including on a caller-supplied `http_client` created with
+  `follow_redirects=True`. Earlier versions set `follow_redirects=False` only on the client they
+  created themselves, so a caller's following client re-sent `X-API-Key` and `X-API-Secret` to a
+  redirect target (httpx strips only `Authorization`), and a 307/308 re-posted an order. A 3xx
+  was also treated as success. Every request now passes `follow_redirects=False`, and a 3xx
+  raises `CexyApiError` with code `UNEXPECTED_REDIRECT`, which is not retried. Upgrade from
+  0.1.0.dev2 or earlier if you pass your own `http_client`.
+
+## 0.1.0.dev2 (2026-09-27)
+
+- `JurisdictionBlockedError` (a `ForbiddenError` subclass) for `JURISDICTION_BLOCKED` / HTTP 451.
+- README: pre-releases install with `pip install --pre cexy` (the PyPI page for 0.1.0.dev1 still says `pip install cexy`, which does not install a pre-release).
+- `spec/errors.yaml` is now generated upstream from the spec's `ErrorCode` (same 44 codes).
+
+## 0.1.0.dev1 (2026-09-27)
 
 First published pre-release. 0.1.0.dev0 was tagged but never reached PyPI: the pinned publish
 action (v1.12.4, twine 6.1.0) rejected wheel metadata version 2.5. The publish action is now

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cexy
-Version: 0.1.0.dev1
+Version: 0.1.0.dev3
 Summary: Python SDK for the CEXY.io exchange REST and WebSocket API
 Project-URL: Homepage, https://cexy.io
 Project-URL: Source, https://github.com/cexyio/cexy-python
@@ -44,12 +44,13 @@ Typed Python client for the [CEXY.io](https://cexy.io) exchange REST and WebSock
 - Client-side rate limiting, cursor pagination
 - WebSocket client with heartbeat, reconnect and a self-syncing order book
 
-> Status: **0.1.0.dev1, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Status: **0.1.0.dev3, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Pre-releases need `--pre`: `pip install --pre cexy`.
 
 ## Install
 
 ```bash
-pip install cexy          # Python 3.9+
+pip install --pre cexy    # Python 3.9+ (--pre while releases are 0.1.0.devN)
 ```
 
 ## Quickstart: public market data
@@ -146,6 +147,7 @@ message.
 | `ValidationError` | 400, e.g. `VALIDATION_FAILED`, `PRECISION_EXCEEDED` (see `fields`) |
 | `AuthenticationError` | 401, e.g. `UNAUTHENTICATED`, `INVALID_CREDENTIALS` |
 | `ForbiddenError` | 403: `FORBIDDEN` (key lacks a scope), `API_KEY_NOT_ALLOWED` (session-only endpoint) |
+| `JurisdictionBlockedError` | 451: `JURISDICTION_BLOCKED` (not available in the caller's jurisdiction); a `ForbiddenError` subclass |
 | `NotFoundError` | 404 |
 | `ConflictError` | 409, e.g. `ALREADY_EXISTS`, `IDEMPOTENCY_KEY_CONFLICT` |
 | `UnprocessableError` | 422, e.g. `INSUFFICIENT_FUNDS`, `MARKET_UNAVAILABLE` |
@@ -283,6 +285,9 @@ client emits `auth_lost`; the socket stays open for public channels.
 - The SDK redacts keys from `repr()`, logs and exception messages, and never sends an
   `Authorization` header. If a server response echoes the key or secret, it is replaced
   with `***` in the exception's message, details, fields and request id.
+- The SDK **never follows HTTP redirects**, even on an `http_client` you created with
+  `follow_redirects=True`. A 3xx answer raises `CexyApiError` with code `UNEXPECTED_REDIRECT`
+  (not retried), so keys are never re-sent to another host and an order is never re-posted.
 - Connections use `https://` and `wss://` only. `allow_insecure=True` permits `http://` or
   `ws://` for a loopback host (localhost, 127.0.0.1, ::1) only, for local testing.
 - Report vulnerabilities as described in [SECURITY.md](SECURITY.md).

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/README.md

@@ -8,12 +8,13 @@ Typed Python client for the [CEXY.io](https://cexy.io) exchange REST and WebSock
 - Client-side rate limiting, cursor pagination
 - WebSocket client with heartbeat, reconnect and a self-syncing order book
 
-> Status: **0.1.0.dev1, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Status: **0.1.0.dev3, pre-release.** The API may change before 1.0 (see [Versioning](#versioning)).
+> Pre-releases need `--pre`: `pip install --pre cexy`.
 
 ## Install
 
 ```bash
-pip install cexy          # Python 3.9+
+pip install --pre cexy    # Python 3.9+ (--pre while releases are 0.1.0.devN)
 ```
 
 ## Quickstart: public market data
@@ -110,6 +111,7 @@ message.
 | `ValidationError` | 400, e.g. `VALIDATION_FAILED`, `PRECISION_EXCEEDED` (see `fields`) |
 | `AuthenticationError` | 401, e.g. `UNAUTHENTICATED`, `INVALID_CREDENTIALS` |
 | `ForbiddenError` | 403: `FORBIDDEN` (key lacks a scope), `API_KEY_NOT_ALLOWED` (session-only endpoint) |
+| `JurisdictionBlockedError` | 451: `JURISDICTION_BLOCKED` (not available in the caller's jurisdiction); a `ForbiddenError` subclass |
 | `NotFoundError` | 404 |
 | `ConflictError` | 409, e.g. `ALREADY_EXISTS`, `IDEMPOTENCY_KEY_CONFLICT` |
 | `UnprocessableError` | 422, e.g. `INSUFFICIENT_FUNDS`, `MARKET_UNAVAILABLE` |
@@ -247,6 +249,9 @@ client emits `auth_lost`; the socket stays open for public channels.
 - The SDK redacts keys from `repr()`, logs and exception messages, and never sends an
   `Authorization` header. If a server response echoes the key or secret, it is replaced
   with `***` in the exception's message, details, fields and request id.
+- The SDK **never follows HTTP redirects**, even on an `http_client` you created with
+  `follow_redirects=True`. A 3xx answer raises `CexyApiError` with code `UNEXPECTED_REDIRECT`
+  (not retried), so keys are never re-sent to another host and an order is never re-posted.
 - Connections use `https://` and `wss://` only. `allow_insecure=True` permits `http://` or
   `ws://` for a loopback host (localhost, 127.0.0.1, ::1) only, for local testing.
 - Report vulnerabilities as described in [SECURITY.md](SECURITY.md).

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/cexy/__init__.py

@@ -22,6 +22,7 @@ from cexy.errors import (
     ConfigurationError,
     ConflictError,
     ForbiddenError,
+    JurisdictionBlockedError,
     MissingCredentialsError,
     NotFoundError,
     RateLimitError,
@@ -44,6 +45,7 @@ __all__ = [
     "ConfigurationError",
     "ConflictError",
     "ForbiddenError",
+    "JurisdictionBlockedError",
     "HeaderKeyAuth",
     "MissingCredentialsError",
     "NotFoundError",

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/cexy/_async/transport.py

@@ -114,7 +114,12 @@ class AsyncTransport:
             if op.auth == "api_key" and self.auth is not None:
                 self.auth.apply(op.method, url, send_headers, content)
             try:
-                resp = await self.http.request(op.method, url, params=params, content=content, headers=send_headers)
+                # Never follow redirects, even on a caller-supplied client created with
+                # follow_redirects=True: httpx would re-send X-API-Key/X-API-Secret to the target
+                # (it strips only Authorization), and a 307/308 would re-POST an order.
+                resp = await self.http.request(
+                    op.method, url, params=params, content=content, headers=send_headers, follow_redirects=False
+                )
             except httpx.TransportError as exc:
                 ambiguous = not isinstance(exc, _NOT_SENT)
                 reason = redact_text(f"{type(exc).__name__}: {exc}", self._secrets())
@@ -132,6 +137,14 @@ class AsyncTransport:
             resp_headers = lower_headers(resp.headers)
             self.limiter.update_from_headers(resp_headers)
             logger.debug("cexy: %s %s -> %d (attempt %d)", op.method, op.path, resp.status_code, attempt)
+            if 300 <= resp.status_code < 400:
+                raise CexyApiError(
+                    "UNEXPECTED_REDIRECT",
+                    f"{op.method} {op.path}: the server answered with a redirect (HTTP {resp.status_code}); "
+                    "the SDK does not follow redirects. Check base_url.",
+                    status=resp.status_code,
+                    retryable=False,
+                )
             if resp.status_code < 400:
                 if raw:
                     return resp.content

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/cexy/_sync/transport.py

@@ -116,7 +116,12 @@ class SyncTransport:
             if op.auth == "api_key" and self.auth is not None:
                 self.auth.apply(op.method, url, send_headers, content)
             try:
-                resp = self.http.request(op.method, url, params=params, content=content, headers=send_headers)
+                # Never follow redirects, even on a caller-supplied client created with
+                # follow_redirects=True: httpx would re-send X-API-Key/X-API-Secret to the target
+                # (it strips only Authorization), and a 307/308 would re-POST an order.
+                resp = self.http.request(
+                    op.method, url, params=params, content=content, headers=send_headers, follow_redirects=False
+                )
             except httpx.TransportError as exc:
                 ambiguous = not isinstance(exc, _NOT_SENT)
                 reason = redact_text(f"{type(exc).__name__}: {exc}", self._secrets())
@@ -134,6 +139,14 @@ class SyncTransport:
             resp_headers = lower_headers(resp.headers)
             self.limiter.update_from_headers(resp_headers)
             logger.debug("cexy: %s %s -> %d (attempt %d)", op.method, op.path, resp.status_code, attempt)
+            if 300 <= resp.status_code < 400:
+                raise CexyApiError(
+                    "UNEXPECTED_REDIRECT",
+                    f"{op.method} {op.path}: the server answered with a redirect (HTTP {resp.status_code}); "
+                    "the SDK does not follow redirects. Check base_url.",
+                    status=resp.status_code,
+                    retryable=False,
+                )
             if resp.status_code < 400:
                 if raw:
                     return resp.content

cexy-0.1.0.dev3/cexy/_version.py

@@ -0,0 +1 @@
+__version__ = "0.1.0.dev3"

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/cexy/errors.py

@@ -81,6 +81,13 @@ class ForbiddenError(CexyApiError):
     (``API_KEY_NOT_ALLOWED``), or the account/region is restricted."""
 
 
+class JurisdictionBlockedError(ForbiddenError):
+    """451: the service is not available in the caller's jurisdiction (``JURISDICTION_BLOCKED``).
+
+    A subclass of :class:`ForbiddenError`, so existing ``except ForbiddenError`` handlers still
+    catch it; catch it directly to show a dedicated message. Retrying will not help."""
+
+
 class ValidationError(CexyApiError):
     """400: the request failed validation. ``fields`` maps field names to problems."""
 
@@ -139,8 +146,8 @@ for _cls, _codes in {
         "ACCOUNT_ON_HOLD",
         "EMAIL_NOT_VERIFIED",
         "REGION_BLOCKED",
-        "JURISDICTION_BLOCKED",  # HTTP 451
     ),
+    JurisdictionBlockedError: ("JURISDICTION_BLOCKED",),
     NotFoundError: ("NOT_FOUND",),
     ConflictError: (
         "ALREADY_EXISTS",
@@ -170,7 +177,7 @@ _BY_STATUS: Dict[int, Type[CexyApiError]] = {
     400: ValidationError,
     401: AuthenticationError,
     403: ForbiddenError,
-    451: ForbiddenError,  # unavailable for legal reasons (JURISDICTION_BLOCKED)
+    451: JurisdictionBlockedError,  # unavailable for legal reasons
     404: NotFoundError,
     409: ConflictError,
     422: UnprocessableError,

{cexy-0.1.0.dev1 → cexy-0.1.0.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cexy"
-version = "0.1.0.dev1"
+version = "0.1.0.dev3"
 description = "Python SDK for the CEXY.io exchange REST and WebSocket API"
 readme = "README.md"
 license = "MIT"

cexy-0.1.0.dev1/cexy/_version.py

@@ -1 +0,0 @@
-__version__ = "0.1.0.dev1"