deezer-python-gql 0.17.1__tar.gz → 0.17.2__tar.gz

{deezer_python_gql-0.17.1/deezer_python_gql.egg-info → deezer_python_gql-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deezer-python-gql
-Version: 0.17.1
+Version: 0.17.2
 Summary: Async typed Python client for Deezer's Pipe GraphQL API.
 Author-email: Julian Daberkow <jdaberkow@users.noreply.github.com>
 License: Apache-2.0
@@ -13,15 +13,16 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiohttp>=3.13.5
 Requires-Dist: pydantic>=2.0.0
+Requires-Dist: yarl>=1.22.0
 Provides-Extra: test
-Requires-Dist: codespell==2.4.2; extra == "test"
-Requires-Dist: mypy==2.1.0; extra == "test"
-Requires-Dist: pre-commit==4.6.0; extra == "test"
+Requires-Dist: codespell==2.4.3; extra == "test"
+Requires-Dist: mypy==2.3.1; extra == "test"
+Requires-Dist: pre-commit==4.6.2; extra == "test"
 Requires-Dist: pre-commit-hooks==6.0.0; extra == "test"
 Requires-Dist: pytest==9.1.1; extra == "test"
 Requires-Dist: pytest-asyncio==1.4.0; extra == "test"
 Requires-Dist: pytest-cov==7.1.0; extra == "test"
-Requires-Dist: ruff==0.15.20; extra == "test"
+Requires-Dist: ruff==0.16.5; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ariadne-codegen[subscriptions]; extra == "dev"
 Dynamic: license-file
@@ -47,6 +48,7 @@ import asyncio
 
 from deezer_python_gql import DeezerGQLClient
 
+
 async def main():
     client = DeezerGQLClient(arl="YOUR_ARL_COOKIE")
 
@@ -74,6 +76,7 @@ async def main():
     results = await client.search(query="Daft Punk")
     print(len(results.tracks.edges), "tracks found")
 
+
 asyncio.run(main())
 ```
 
@@ -252,6 +255,10 @@ The Pipe API uses short-lived JWTs obtained from an ARL cookie. The base client
 handles token acquisition and refresh automatically — you only need to supply a
 valid ARL value.
 
+An external `aiohttp.ClientSession` may be shared by clients for different Deezer
+accounts. Each client keeps Deezer's response cookies locally and masks cookies from
+the shared session jar, so authentication state cannot cross between those accounts.
+
 If the ARL is rejected (bad or expired), the client raises
 `GraphQLClientAuthError` — catch it to prompt for a new ARL instead of retrying.
 Transient server errors raise `GraphQLClientHttpError` instead.

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/README.md

@@ -19,6 +19,7 @@ import asyncio
 
 from deezer_python_gql import DeezerGQLClient
 
+
 async def main():
     client = DeezerGQLClient(arl="YOUR_ARL_COOKIE")
 
@@ -46,6 +47,7 @@ async def main():
     results = await client.search(query="Daft Punk")
     print(len(results.tracks.edges), "tracks found")
 
+
 asyncio.run(main())
 ```
 
@@ -224,6 +226,10 @@ The Pipe API uses short-lived JWTs obtained from an ARL cookie. The base client
 handles token acquisition and refresh automatically — you only need to supply a
 valid ARL value.
 
+An external `aiohttp.ClientSession` may be shared by clients for different Deezer
+accounts. Each client keeps Deezer's response cookies locally and masks cookies from
+the shared session jar, so authentication state cannot cross between those accounts.
+
 If the ARL is rejected (bad or expired), the client raises
 `GraphQLClientAuthError` — catch it to prompt for a new ARL instead of retrying.
 Transient server errors raise `GraphQLClientHttpError` instead.

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/deezer_python_gql/base_client.py

@@ -8,9 +8,13 @@ import logging
 import time
 from base64 import urlsafe_b64decode
 from dataclasses import dataclass
-from typing import Any, ClassVar, Self, cast
+from typing import TYPE_CHECKING, Any, ClassVar, Self, cast
 
 from aiohttp import ClientSession, ClientTimeout
+from yarl import URL
+
+if TYPE_CHECKING:
+    from aiohttp import ClientResponse
 
 logger = logging.getLogger(__name__)
 
@@ -137,6 +141,9 @@ class DeezerBaseClient:
         self._arl = arl
         self._session = session
         self._owns_session = session is None
+        # An external session may be shared by clients for different Deezer accounts.
+        # Keep Deezer's response cookies per client instead of trusting that shared jar.
+        self._cookies: dict[str, str] = {}
         self._jwt: str | None = None
         self._jwt_expires_at: float = 0
         self._jwt_lock = asyncio.Lock()
@@ -167,6 +174,21 @@ class DeezerBaseClient:
         """Exit the async context manager, closing internal resources."""
         await self.close()
 
+    def _request_cookies(self, url: str, *, include_arl: bool = False) -> dict[str, str]:
+        """Return account-local cookies while neutralizing a shared session's jar."""
+        session = self._get_session()
+        blanked = dict.fromkeys(session.cookie_jar.filter_cookies(URL(url)), "")
+        cookies = blanked | self._cookies
+        if include_arl:
+            cookies["arl"] = self._arl
+        return cookies
+
+    def _store_cookies(self, response: ClientResponse) -> None:
+        """Remember response cookies for this client instead of relying on the session jar."""
+        self._cookies.update(
+            {name: morsel.value for name, morsel in response.cookies.items() if name != "arl"}
+        )
+
     async def execute(
         self,
         query: str,
@@ -189,6 +211,8 @@ class DeezerBaseClient:
         headers["Authorization"] = f"Bearer {jwt}"
         headers["Content-Type"] = "application/json"
         kwargs.setdefault("timeout", ClientTimeout(total=self.REQUEST_TIMEOUT_SECONDS))
+        request_cookies = self._request_cookies(self.url)
+        request_cookies.update(kwargs.pop("cookies", None) or {})
 
         payload: dict[str, Any] = {"query": query}
         if operation_name:
@@ -203,7 +227,14 @@ class DeezerBaseClient:
             }
 
         session = self._get_session()
-        async with session.post(self.url, json=payload, headers=headers, **kwargs) as resp:
+        async with session.post(
+            self.url,
+            json=payload,
+            headers=headers,
+            cookies=request_cookies,
+            **kwargs,
+        ) as resp:
+            self._store_cookies(resp)
             body = await resp.read()
             gql_response = GQLResponse(
                 status=resp.status,
@@ -321,9 +352,10 @@ class DeezerBaseClient:
             async with session.post(
                 self.AUTH_URL,
                 params=params,
-                cookies={"arl": self._arl},
+                cookies=self._request_cookies(self.AUTH_URL, include_arl=True),
                 timeout=ClientTimeout(total=10),
             ) as resp:
+                self._store_cookies(resp)
                 status = resp.status
                 is_success = resp.ok
                 # Response body is text/plain containing JSON

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/deezer_python_gql/generated/base_client.py

@@ -10,9 +10,13 @@ import logging
 import time
 from base64 import urlsafe_b64decode
 from dataclasses import dataclass
-from typing import Any, ClassVar, Self, cast
+from typing import TYPE_CHECKING, Any, ClassVar, Self, cast
 
 from aiohttp import ClientSession, ClientTimeout
+from yarl import URL
+
+if TYPE_CHECKING:
+    from aiohttp import ClientResponse
 
 logger = logging.getLogger(__name__)
 
@@ -139,6 +143,9 @@ class DeezerBaseClient:
         self._arl = arl
         self._session = session
         self._owns_session = session is None
+        # An external session may be shared by clients for different Deezer accounts.
+        # Keep Deezer's response cookies per client instead of trusting that shared jar.
+        self._cookies: dict[str, str] = {}
         self._jwt: str | None = None
         self._jwt_expires_at: float = 0
         self._jwt_lock = asyncio.Lock()
@@ -169,6 +176,21 @@ class DeezerBaseClient:
         """Exit the async context manager, closing internal resources."""
         await self.close()
 
+    def _request_cookies(self, url: str, *, include_arl: bool = False) -> dict[str, str]:
+        """Return account-local cookies while neutralizing a shared session's jar."""
+        session = self._get_session()
+        blanked = dict.fromkeys(session.cookie_jar.filter_cookies(URL(url)), "")
+        cookies = blanked | self._cookies
+        if include_arl:
+            cookies["arl"] = self._arl
+        return cookies
+
+    def _store_cookies(self, response: ClientResponse) -> None:
+        """Remember response cookies for this client instead of relying on the session jar."""
+        self._cookies.update(
+            {name: morsel.value for name, morsel in response.cookies.items() if name != "arl"}
+        )
+
     async def execute(
         self,
         query: str,
@@ -191,6 +213,8 @@ class DeezerBaseClient:
         headers["Authorization"] = f"Bearer {jwt}"
         headers["Content-Type"] = "application/json"
         kwargs.setdefault("timeout", ClientTimeout(total=self.REQUEST_TIMEOUT_SECONDS))
+        request_cookies = self._request_cookies(self.url)
+        request_cookies.update(kwargs.pop("cookies", None) or {})
 
         payload: dict[str, Any] = {"query": query}
         if operation_name:
@@ -205,7 +229,14 @@ class DeezerBaseClient:
             }
 
         session = self._get_session()
-        async with session.post(self.url, json=payload, headers=headers, **kwargs) as resp:
+        async with session.post(
+            self.url,
+            json=payload,
+            headers=headers,
+            cookies=request_cookies,
+            **kwargs,
+        ) as resp:
+            self._store_cookies(resp)
             body = await resp.read()
             gql_response = GQLResponse(
                 status=resp.status,
@@ -323,9 +354,10 @@ class DeezerBaseClient:
             async with session.post(
                 self.AUTH_URL,
                 params=params,
-                cookies={"arl": self._arl},
+                cookies=self._request_cookies(self.AUTH_URL, include_arl=True),
                 timeout=ClientTimeout(total=10),
             ) as resp:
+                self._store_cookies(resp)
                 status = resp.status
                 is_success = resp.ok
                 # Response body is text/plain containing JSON

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2/deezer_python_gql.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deezer-python-gql
-Version: 0.17.1
+Version: 0.17.2
 Summary: Async typed Python client for Deezer's Pipe GraphQL API.
 Author-email: Julian Daberkow <jdaberkow@users.noreply.github.com>
 License: Apache-2.0
@@ -13,15 +13,16 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiohttp>=3.13.5
 Requires-Dist: pydantic>=2.0.0
+Requires-Dist: yarl>=1.22.0
 Provides-Extra: test
-Requires-Dist: codespell==2.4.2; extra == "test"
-Requires-Dist: mypy==2.1.0; extra == "test"
-Requires-Dist: pre-commit==4.6.0; extra == "test"
+Requires-Dist: codespell==2.4.3; extra == "test"
+Requires-Dist: mypy==2.3.1; extra == "test"
+Requires-Dist: pre-commit==4.6.2; extra == "test"
 Requires-Dist: pre-commit-hooks==6.0.0; extra == "test"
 Requires-Dist: pytest==9.1.1; extra == "test"
 Requires-Dist: pytest-asyncio==1.4.0; extra == "test"
 Requires-Dist: pytest-cov==7.1.0; extra == "test"
-Requires-Dist: ruff==0.15.20; extra == "test"
+Requires-Dist: ruff==0.16.5; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ariadne-codegen[subscriptions]; extra == "dev"
 Dynamic: license-file
@@ -47,6 +48,7 @@ import asyncio
 
 from deezer_python_gql import DeezerGQLClient
 
+
 async def main():
     client = DeezerGQLClient(arl="YOUR_ARL_COOKIE")
 
@@ -74,6 +76,7 @@ async def main():
     results = await client.search(query="Daft Punk")
     print(len(results.tracks.edges), "tracks found")
 
+
 asyncio.run(main())
 ```
 
@@ -252,6 +255,10 @@ The Pipe API uses short-lived JWTs obtained from an ARL cookie. The base client
 handles token acquisition and refresh automatically — you only need to supply a
 valid ARL value.
 
+An external `aiohttp.ClientSession` may be shared by clients for different Deezer
+accounts. Each client keeps Deezer's response cookies locally and masks cookies from
+the shared session jar, so authentication state cannot cross between those accounts.
+
 If the ARL is rejected (bad or expired), the client raises
 `GraphQLClientAuthError` — catch it to prompt for a new ARL instead of retrying.
 Transient server errors raise `GraphQLClientHttpError` instead.

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/deezer_python_gql.egg-info/requires.txt

@@ -1,15 +1,16 @@
 aiohttp>=3.13.5
 pydantic>=2.0.0
+yarl>=1.22.0
 
 [dev]
 ariadne-codegen[subscriptions]
 
 [test]
-codespell==2.4.2
-mypy==2.1.0
-pre-commit==4.6.0
+codespell==2.4.3
+mypy==2.3.1
+pre-commit==4.6.2
 pre-commit-hooks==6.0.0
 pytest==9.1.1
 pytest-asyncio==1.4.0
 pytest-cov==7.1.0
-ruff==0.15.20
+ruff==0.16.5

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "deezer-python-gql"
-version = "0.17.1"
+version = "0.17.2"
 description = "Async typed Python client for Deezer's Pipe GraphQL API."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -15,6 +15,7 @@ classifiers = [
 dependencies = [
     "aiohttp>=3.13.5",
     "pydantic>=2.0.0",
+    "yarl>=1.22.0",
 ]
 
 [project.license]
@@ -22,14 +23,14 @@ text = "Apache-2.0"
 
 [project.optional-dependencies]
 test = [
-    "codespell==2.4.2",
-    "mypy==2.1.0",
-    "pre-commit==4.6.0",
+    "codespell==2.4.3",
+    "mypy==2.3.1",
+    "pre-commit==4.6.2",
     "pre-commit-hooks==6.0.0",
     "pytest==9.1.1",
     "pytest-asyncio==1.4.0",
     "pytest-cov==7.1.0",
-    "ruff==0.15.20",
+    "ruff==0.16.5",
 ]
 dev = [
     "ariadne-codegen[subscriptions]",
@@ -99,6 +100,7 @@ ignore = [
     "TD004",
     "TRY003",
     "COM812",
+    "CPY001",
     "ISC001",
 ]
 select = [

{deezer_python_gql-0.17.1 → deezer_python_gql-0.17.2}/tests/test_client.py

@@ -13,11 +13,14 @@ import asyncio
 import base64
 import json
 import time
+from http.cookies import SimpleCookie
 from pathlib import Path
-from typing import Any
+from typing import Any, Self, cast
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
+from aiohttp import ClientSession, CookieJar
+from yarl import URL
 
 from deezer_python_gql import DeezerGQLClient
 from deezer_python_gql.base_client import (
@@ -124,7 +127,7 @@ def _load_fixture(name: str) -> dict[str, Any]:
     return result
 
 
-def _make_jwt(exp: float | None = None) -> str:
+def _make_jwt(exp: float | None = None, subject: str | None = None) -> str:
     """
     Build a fake JWT with a configurable expiration timestamp.
 
@@ -133,13 +136,10 @@ def _make_jwt(exp: float | None = None) -> str:
     if exp is None:
         exp = time.time() + 360  # 6 min, matching Deezer's real TTL
     header = base64.urlsafe_b64encode(b'{"alg":"ES256"}').rstrip(b"=").decode()
-    payload = (
-        base64.urlsafe_b64encode(
-            json.dumps({"exp": exp}).encode(),
-        )
-        .rstrip(b"=")
-        .decode()
-    )
+    payload_data: dict[str, float | str] = {"exp": exp}
+    if subject is not None:
+        payload_data["sub"] = subject
+    payload = base64.urlsafe_b64encode(json.dumps(payload_data).encode()).rstrip(b"=").decode()
     return f"{header}.{payload}.fake_signature"
 
 
@@ -156,6 +156,7 @@ def _mock_post_context_manager(response_body: bytes, status: int = 200) -> Async
     mock_resp.read = AsyncMock(return_value=response_body)
     mock_resp.text = AsyncMock(return_value=response_body.decode())
     mock_resp.raise_for_status = MagicMock()
+    mock_resp.cookies = SimpleCookie()
 
     cm = AsyncMock()
     cm.__aenter__ = AsyncMock(return_value=mock_resp)
@@ -171,6 +172,86 @@ def _mock_auth_cm(jwt: str | None = None) -> AsyncMock:
     return _mock_post_context_manager(body)
 
 
+class _FakeCookieResponse:
+    """Small aiohttp response stand-in for the shared-cookie regression test."""
+
+    def __init__(
+        self,
+        body: bytes,
+        response_cookies: SimpleCookie | None = None,
+    ) -> None:
+        self.status = 200
+        self.ok = True
+        self._body = body
+        self.cookies = response_cookies or SimpleCookie()
+
+    async def __aenter__(self) -> Self:
+        return self
+
+    async def __aexit__(self, *args: object) -> None:
+        return None
+
+    async def read(self) -> bytes:
+        return self._body
+
+    async def text(self) -> str:
+        return self._body.decode()
+
+
+class _FakeSharedSession:
+    """Model Deezer preferring an existing refresh cookie over a new ARL."""
+
+    def __init__(self) -> None:
+        self.cookie_jar = CookieJar()
+        self._arl_accounts = {"arl-a": "1001", "arl-b": "2002"}
+        self._refresh_accounts = {"refresh-a": "1001", "refresh-b": "2002"}
+        self._account_refresh = {value: key for key, value in self._refresh_accounts.items()}
+        self._account_cookies = {
+            account: {
+                "refresh-token": refresh,
+                "sid": f"sid-{account}",
+                "dzr_uniq_id": f"unique-{account}",
+                "_abck": f"abck-{account}",
+                "bm_sz": f"bm-{account}",
+            }
+            for account, refresh in self._account_refresh.items()
+        }
+        self._account_jwt = {
+            account: _make_jwt(subject=account) for account in self._arl_accounts.values()
+        }
+        self._jwt_account = {jwt: account for account, jwt in self._account_jwt.items()}
+        self.requests: list[tuple[str, dict[str, str]]] = []
+
+    def post(self, url: str, **kwargs: Any) -> _FakeCookieResponse:
+        """Resolve the request identity and update the shared response-cookie jar."""
+        request_cookies = {
+            name: morsel.value for name, morsel in self.cookie_jar.filter_cookies(URL(url)).items()
+        }
+        request_cookies.update(kwargs.get("cookies") or {})
+        self.requests.append((url, request_cookies))
+
+        if url == DeezerBaseClient.AUTH_URL:
+            if refresh := request_cookies.get("refresh-token"):
+                account = self._refresh_accounts[refresh]
+            else:
+                account = self._arl_accounts[request_cookies["arl"]]
+            response_cookies = SimpleCookie()
+            for name, value in self._account_cookies[account].items():
+                response_cookies[name] = value
+                response_cookies[name]["domain"] = ".deezer.com"
+                response_cookies[name]["path"] = "/"
+            self.cookie_jar.update_cookies(response_cookies, response_url=URL(url))
+            return _FakeCookieResponse(
+                json.dumps({"jwt": self._account_jwt[account]}).encode(),
+                response_cookies,
+            )
+
+        authorization = cast("dict[str, str]", kwargs["headers"])["Authorization"]
+        jwt = authorization.removeprefix("Bearer ")
+        account = self._jwt_account[jwt]
+        return _FakeCookieResponse(json.dumps({"data": {"me": {"id": account}}}).encode())
+
+
 # ---------------------------------------------------------------------------
 # 1. Client setup
 # ---------------------------------------------------------------------------
@@ -413,6 +494,40 @@ async def test_auth_sends_arl_cookie_to_correct_domain() -> None:
     assert auth_call.kwargs["cookies"] == {"arl": "my_secret_arl"}
 
 
+@pytest.mark.parametrize(("first_arl", "second_arl"), [("arl-a", "arl-b"), ("arl-b", "arl-a")])
+@pytest.mark.asyncio
+async def test_shared_session_keeps_account_cookies_isolated(
+    first_arl: str, second_arl: str
+) -> None:
+    """Verify a shared jar cannot make the first authenticated account win."""
+    session = _FakeSharedSession()
+    expected = session._arl_accounts  # noqa: SLF001
+    first = DeezerGQLClient(arl=first_arl, session=cast("ClientSession", session))
+    second = DeezerGQLClient(arl=second_arl, session=cast("ClientSession", session))
+
+    first_me = await first.get_me()
+    second_me = await second.get_me()
+
+    assert first_me is not None
+    assert second_me is not None
+    assert first_me.id == expected[first_arl]
+    assert second_me.id == expected[second_arl]
+
+    auth_requests = [cookies for url, cookies in session.requests if url == first.AUTH_URL]
+    pipe_requests = [cookies for url, cookies in session.requests if url == first.url]
+    assert auth_requests == [
+        {"arl": first_arl},
+        {
+            **dict.fromkeys(session._account_cookies[first_me.id], ""),  # noqa: SLF001
+            "arl": second_arl,
+        },
+    ]
+    assert pipe_requests == [
+        session._account_cookies[first_me.id],  # noqa: SLF001
+        session._account_cookies[second_me.id],  # noqa: SLF001
+    ]
+
+
 @pytest.mark.asyncio
 async def test_auth_parses_text_plain_response() -> None:
     """Verify the client handles auth.deezer.com's text/plain JSON response."""