easycontract 0.1.1__tar.gz → 0.1.4__tar.gz

{easycontract-0.1.1 → easycontract-0.1.4}/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 All notable changes to the `easycontract` Python SDK.
 
+## 0.1.4 (2026-10-20)
+
+**Features**
+
+- Projects (paid plans): `client.projects.list/create/get/update`. An
+  organization key sees everything; a project key only its project.
+  `project=` on `envelopes.create`, `envelopes.list`, `templates.create_envelope`
+  and `webhooks.create` (organization keys only). `client.whoami()` now returns
+  `project` (null = organization key) and `key`.
+- Webhooks: `client.webhooks.get`, `update` (url, event_types, is_active,
+  description) and `rotate_secret(grace_period_hours=24)`, which returns the
+  new `secret` once.
+
+**Fixes**
+
+- `easycontract.webhooks.verify_signature` accepts ANY `v1=` in the header
+  and `secret` may be a list: after a rotation, during the grace period,
+  deliveries carry `v1=<new>,v1=<old>`. 0.1.3 and earlier only checked the
+  last `v1` (the old secret), so they failed once you switched to the new one
+  before the grace period ended.
+
+## 0.1.3 (2026-10-20)
+
+**Features**
+
+- Cryptographic restrictions: `client.organization.update(seal_profile=
+  "hybrid" | "classic", acknowledge=True)` chooses how the platform seals
+  the certificate, the final PDFs and the evidence package (hybrid ECDSA +
+  ML-DSA-87, or ECDSA only). `client.organization.get()["cryptography"]`
+  shows the choice and what each option implies; every envelope reports the
+  profile frozen at send in `seal_profile`.
+- The evidence package (`client.envelopes.download_evidence(...)`) is now an ASiC-E
+  container (still a `.zip`) signed by the platform.
+
+## 0.1.2 (2026-10-19)
+
+**Features**
+
+- Machine-drafted template translations: `client.templates.autotranslate(
+  template_id, document_id, language, acknowledge=True)` queues a draft made
+  by the platform's translators and reviewed by a panel with quorum;
+  `client.templates.get_translation_job(job_id)` returns its progress,
+  `verdict` (`consensus`, `quorum`, `no_quorum`, `unreviewed`, `simulated`)
+  and the reviewers' notes with English back-translations. The result is
+  always a draft that a person approves in the panel.
+- The platform now has 16 languages (es, en, ca, gl, eu, ast, an, oc, pt, fr,
+  it, de, ru, zh-hans, ar, he) for `language` everywhere.
+
 ## 0.1.1 (2026-10-07)
 
 **Security (audit 2026-10-07)**

{easycontract-0.1.1 → easycontract-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: easycontract
-Version: 0.1.1
+Version: 0.1.4
 Summary: SDK oficial de Python para el API de easycontract (firma electrónica eIDAS)
 Project-URL: Documentation, https://easycontract.online/docs/api
 Author-email: Román Ramírez <roman@easycontract.online>

{easycontract-0.1.1 → easycontract-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "easycontract"
-version = "0.1.1"
+version = "0.1.4"
 description = "SDK oficial de Python para el API de easycontract (firma electrónica eIDAS)"
 readme = "README.md"
 requires-python = ">=3.10"

{easycontract-0.1.1 → easycontract-0.1.4}/src/easycontract/__init__.py

@@ -6,7 +6,7 @@ client = EasyContract(api_key="ec_test_...")
 envelope = client.envelopes.create(title="Contrato", retention_period_months=72)
 """
 
-__version__ = "0.1.1"
+__version__ = "0.1.4"
 
 from . import webhooks
 from .client import EasyContract

{easycontract-0.1.1 → easycontract-0.1.4}/src/easycontract/client.py

@@ -29,6 +29,7 @@ from .resources import (
     Invitations,
     Members,
     Organization,
+    Projects,
     Retention,
     Templates,
     Webhooks,
@@ -109,6 +110,7 @@ class EasyContract:
         self.retention = Retention(self)
         self.templates = Templates(self)
         self.webhooks = Webhooks(self)
+        self.projects = Projects(self)
         self.events = Events(self)
         self.organization = Organization(self)
         self.members = Members(self)

{easycontract-0.1.1 → easycontract-0.1.4}/src/easycontract/resources.py

@@ -135,6 +135,11 @@ OPERATIONS: dict[tuple[str, str], str] = {
         "DELETE",
         "/templates/{template_id}/documents/{document_id}/translations/{language}/",
     ): "client.templates.delete_translation",
+    (
+        "POST",
+        "/templates/{template_id}/documents/{document_id}/translations/{language}/autotranslate/",
+    ): "client.templates.autotranslate",
+    ("GET", "/translation-jobs/{job_id}/"): "client.templates.get_translation_job",
     ("POST", "/templates/{template_id}/preview/"): "client.templates.preview",
     ("POST", "/templates/{template_id}/duplicate/"): "client.templates.duplicate",
     ("POST", "/templates/{template_id}/roles/"): "client.templates.add_role",
@@ -143,7 +148,14 @@ OPERATIONS: dict[tuple[str, str], str] = {
     ("GET", "/events/"): "client.events.list",
     ("GET", "/webhooks/"): "client.webhooks.list",
     ("POST", "/webhooks/"): "client.webhooks.create",
+    ("GET", "/webhooks/{endpoint_id}/"): "client.webhooks.get",
+    ("PATCH", "/webhooks/{endpoint_id}/"): "client.webhooks.update",
     ("DELETE", "/webhooks/{endpoint_id}/"): "client.webhooks.delete",
+    ("POST", "/webhooks/{endpoint_id}/rotate-secret/"): "client.webhooks.rotate_secret",
+    ("GET", "/projects/"): "client.projects.list",
+    ("POST", "/projects/"): "client.projects.create",
+    ("GET", "/projects/{project_id}/"): "client.projects.get",
+    ("PATCH", "/projects/{project_id}/"): "client.projects.update",
     ("POST", "/webhooks/deliveries/{delivery_id}/redeliver/"): "client.webhooks.redeliver",
 }
 
@@ -198,9 +210,12 @@ class Envelopes(_Resource):
         biometrics: bool = False,
         document_type: str | None = None,
         kyc_images_retention: str | None = None,
+        project: str | None = None,
         idempotency_key: str | None = None,
     ) -> dict:
-        """`biometrics=True` offers signers the OPTIONAL stroke capture (only
+        """`project` (organization keys only): create inside that project; a
+        project key always creates in its own.
+        `biometrics=True` offers signers the OPTIONAL stroke capture (only
         effective when the organization enabled it: Enterprise + DPIA).
         `document_type` is a key of `client.retention.document_types()`.
         `kyc_images_retention`: "after_review" (default) or
@@ -220,17 +235,25 @@ class Envelopes(_Resource):
             body["document_type"] = document_type
         if kyc_images_retention:
             body["kyc_images_retention"] = kyc_images_retention
+        if project:
+            body["project"] = project
         return self._client.request(
             "POST", "/envelopes/", json=body, idempotency_key=idempotency_key
         )
 
     def list(
-        self, *, status: str | None = None, limit: int | None = None, cursor: str | None = None
+        self,
+        *,
+        status: str | None = None,
+        project: str | None = None,
+        limit: int | None = None,
+        cursor: str | None = None,
     ) -> dict:
         params = {
             k: v
             for k, v in {
                 "status": status,
+                "project": project,
                 "limit": limit,
                 "cursor": cursor,
             }.items()
@@ -402,7 +425,9 @@ class Envelopes(_Resource):
         include_biometrics: bool = False,
         include_identity_proofs: bool = False,
     ) -> bytes:
-        """The full evidence ZIP — what a tenant would take to court."""
+        """The full evidence ZIP — what a tenant would take to court. With the
+        platform seal on, it is an ASiC-E container signed by the platform
+        (manifest.json → `container` describes it)."""
         content = self._client.request(
             "GET",
             f"/envelopes/{_id(envelope_id)}/evidence/",
@@ -578,6 +603,34 @@ class Templates(_Resource):
             f"/templates/{_id(template_id)}/documents/{_id(document_id)}/translations/{_seg(language)}/",
         )
 
+    def autotranslate(
+        self,
+        template_id: str,
+        document_id: str,
+        language: str,
+        *,
+        acknowledge: bool,
+        overwrite: bool = False,
+        idempotency_key: str | None = None,
+    ) -> dict:
+        """Queue a MACHINE DRAFT of a language version: translators plus a
+        reviewer panel with quorum. Returns the job (202); poll
+        `get_translation_job`. `acknowledge=True` is required: the result is
+        a draft that a person reviews and approves in the panel. `overwrite`
+        replaces a translation that already has its own text."""
+        return self._client.request(
+            "POST",
+            f"/templates/{_id(template_id)}/documents/{_id(document_id)}/translations/{_seg(language)}/autotranslate/",
+            json={"acknowledge": acknowledge, "overwrite": overwrite},
+            idempotency_key=idempotency_key,
+        )
+
+    def get_translation_job(self, job_id: str) -> dict:
+        """Status of a machine translation: `verdict` (consensus, quorum,
+        no_quorum, unreviewed, simulated) and, when done, the reviewers'
+        `notes` with an English back-translation."""
+        return self._client.request("GET", f"/translation-jobs/{_id(job_id)}/")
+
     def download_docx(
         self, template_id: str, document_id: str, *, to: str | Path | None = None
     ) -> bytes:
@@ -714,6 +767,7 @@ class Templates(_Resource):
         language: str | None = None,
         kyc_images_retention: str | None = None,
         biometrics: bool = False,
+        project: str | None = None,
         idempotency_key: str | None = None,
     ) -> dict:
         """The one-call automation flow (§10.4): instantiate and optionally
@@ -736,6 +790,8 @@ class Templates(_Resource):
             body["biometrics"] = True
         if expires_in_days is not None:
             body["expires_in_days"] = expires_in_days
+        if project:
+            body["project"] = project
         return self._client.request(
             "POST",
             f"/templates/{_id(template_id)}/envelopes/",
@@ -746,19 +802,59 @@ class Templates(_Resource):
 
 class Webhooks(_Resource):
     def create(
-        self, *, url: str, event_types: list[str] | None = None, description: str = ""
+        self,
+        *,
+        url: str,
+        event_types: list[str] | None = None,
+        description: str = "",
+        project: str | None = None,
     ) -> dict:
-        """The response includes `secret` (whsec_…) ONCE — store it now."""
-        return self._client.request(
-            "POST",
-            "/webhooks/",
-            json={"url": url, "event_types": event_types or [], "description": description},
-        )
+        """The response includes `secret` (whsec_…) ONCE — store it now.
+        Mode = the key's. `project` (organization keys only): receive only
+        that project's events; a project key always registers for its own."""
+        body: dict = {"url": url, "event_types": event_types or [], "description": description}
+        if project:
+            body["project"] = project
+        return self._client.request("POST", "/webhooks/", json=body)
 
     def list(self, *, limit: int | None = None, cursor: str | None = None) -> dict:
         params = {k: v for k, v in {"limit": limit, "cursor": cursor}.items() if v}
         return self._client.request("GET", "/webhooks/", params=params)
 
+    def get(self, endpoint_id: str) -> dict:
+        return self._client.request("GET", f"/webhooks/{_id(endpoint_id)}/")
+
+    def update(
+        self,
+        endpoint_id: str,
+        *,
+        url: str | None = None,
+        event_types: list[str] | None = None,
+        is_active: bool | None = None,
+        description: str | None = None,
+    ) -> dict:
+        """Change only what you pass. Reactivating counts against the plan."""
+        body = {
+            k: v
+            for k, v in {
+                "url": url,
+                "event_types": event_types,
+                "is_active": is_active,
+                "description": description,
+            }.items()
+            if v is not None
+        }
+        return self._client.request("PATCH", f"/webhooks/{_id(endpoint_id)}/", json=body)
+
+    def rotate_secret(self, endpoint_id: str, *, grace_period_hours: int = 24) -> dict:
+        """New `secret` returned ONCE. For `grace_period_hours` (0-72) deliveries
+        carry both signatures: verify with [new, old] until you switch."""
+        return self._client.request(
+            "POST",
+            f"/webhooks/{_id(endpoint_id)}/rotate-secret/",
+            json={"grace_period_hours": grace_period_hours},
+        )
+
     def delete(self, endpoint_id: str) -> None:
         self._client.request("DELETE", f"/webhooks/{_id(endpoint_id)}/")
 
@@ -766,6 +862,69 @@ class Webhooks(_Resource):
         return self._client.request("POST", f"/webhooks/deliveries/{_id(delivery_id)}/redeliver/")
 
 
+class Projects(_Resource):
+    """Projects inside the organization (paid plans). An organization key
+    manages them all; a project key only reads its own."""
+
+    def list(
+        self,
+        *,
+        is_active: bool | None = None,
+        limit: int | None = None,
+        cursor: str | None = None,
+    ) -> dict:
+        params = {
+            k: v
+            for k, v in {
+                "is_active": None if is_active is None else str(is_active).lower(),
+                "limit": limit,
+                "cursor": cursor,
+            }.items()
+            if v is not None
+        }
+        return self._client.request("GET", "/projects/", params=params)
+
+    def create(
+        self,
+        *,
+        name: str,
+        description: str = "",
+        embed_allowed_origins: list[str] | None = None,
+        idempotency_key: str | None = None,
+    ) -> dict:
+        body: dict = {"name": name, "description": description}
+        if embed_allowed_origins is not None:
+            body["embed_allowed_origins"] = list(embed_allowed_origins)
+        return self._client.request(
+            "POST", "/projects/", json=body, idempotency_key=idempotency_key
+        )
+
+    def get(self, project_id: str) -> dict:
+        return self._client.request("GET", f"/projects/{_id(project_id)}/")
+
+    def update(
+        self,
+        project_id: str,
+        *,
+        name: str | None = None,
+        description: str | None = None,
+        is_active: bool | None = None,
+        embed_allowed_origins: list[str] | None = None,
+    ) -> dict:
+        """`is_active=False` archives: its keys and webhooks stop working."""
+        body = {
+            k: v
+            for k, v in {
+                "name": name,
+                "description": description,
+                "is_active": is_active,
+                "embed_allowed_origins": embed_allowed_origins,
+            }.items()
+            if v is not None
+        }
+        return self._client.request("PATCH", f"/projects/{_id(project_id)}/", json=body)
+
+
 class Events(_Resource):
     """The consultable event log — reconciliation source when a webhook is
     lost (poll `list` and compare against what you received)."""
@@ -875,15 +1034,27 @@ class Organization(_Resource):
         *,
         retention_policies: dict | None = None,
         embed_allowed_origins: list[str] | None = None,
+        seal_profile: str | None = None,
+        acknowledge: bool = False,
     ) -> dict:
         """Organization settings an API key may change: retention policy per
-        document type (months within the plan's range) and the web origins
-        allowed to embed the signer flow (the FULL list; [] disables it)."""
+        document type (months within the plan's range), the web origins
+        allowed to embed the signer flow (the FULL list; [] disables it) and
+        the cryptographic restrictions of the platform seal.
+
+        `seal_profile`: "hybrid" (ECDSA P-384 + ML-DSA-87, quantum resistant;
+        readers without ML-DSA show that signature as unknown) or "classic"
+        (ECDSA only, no warnings, not quantum resistant). Changing it needs
+        `acknowledge=True`: you confirm the trade-off described in
+        `get()["cryptography"]["options"]`. It applies to envelopes sent
+        afterwards."""
         body: dict = {}
         if retention_policies is not None:
             body["retention_policies"] = retention_policies
         if embed_allowed_origins is not None:
             body["embed_allowed_origins"] = list(embed_allowed_origins)
+        if seal_profile is not None:
+            body["cryptography"] = {"seal_profile": seal_profile, "acknowledge": acknowledge}
         return self._client.request("PATCH", "/organization/", json=body)
 
 

{easycontract-0.1.1 → easycontract-0.1.4}/src/easycontract/webhooks.py

@@ -5,12 +5,16 @@ easycontract signs every delivery with
     X-EasyContract-Signature: t=<unix>,v1=<hex>
 
 where v1 = HMAC-SHA256(secret, f"{t}.{body}"). Verify with your endpoint's
-whsec_… secret (shown once at creation):
+whsec_… secret (shown once at creation or rotation):
 
     event = easycontract.webhooks.verify_signature(
         payload=request.body, header=request.headers["X-EasyContract-Signature"],
         secret=WEBHOOK_SECRET,
     )
+
+After a secret rotation, during the grace period, the header carries one v1
+per valid secret (`t=…,v1=<new>,v1=<old>`): the delivery is valid if ANY v1
+matches. `secret` may also be a list (e.g. [new, old]) while you switch.
 """
 
 from __future__ import annotations
@@ -29,7 +33,7 @@ def verify_signature(
     *,
     payload: bytes | str,
     header: str,
-    secret: bytes | str,
+    secret: bytes | str | list | tuple,
     tolerance: int | None = DEFAULT_TOLERANCE_SECONDS,
 ) -> dict:
     """Verify a delivery and return the parsed event. Raises
@@ -51,20 +55,34 @@ def verify_signature(
         body = payload.encode("utf-8")
     else:
         raise SignatureVerificationError("payload must be bytes or str")
-    secret_bytes = secret if isinstance(secret, (bytes, bytearray)) else str(secret).encode("utf-8")
+    secrets = list(secret) if isinstance(secret, (list, tuple)) else [secret]
+    if not secrets:
+        raise SignatureVerificationError("no secret given")
+    secret_keys = [
+        s if isinstance(s, (bytes, bytearray)) else str(s).encode("utf-8") for s in secrets
+    ]
 
     try:
-        parts = dict(part.split("=", 1) for part in header.split(","))
-        timestamp = int(parts["t"])
-        signature = parts["v1"]
+        pairs = [part.split("=", 1) for part in header.split(",")]
+        timestamps = [value for key, value in pairs if key.strip() == "t"]
+        signatures = [value.strip() for key, value in pairs if key.strip() == "v1"]
+        if len(timestamps) != 1 or not signatures:
+            raise KeyError("t/v1")
+        timestamp = int(timestamps[0])
     except (ValueError, KeyError) as exc:
         raise SignatureVerificationError("malformed signature header") from exc
 
     if tolerance is not None and abs(time.time() - timestamp) > tolerance:
         raise SignatureVerificationError("timestamp outside tolerance (possible replay)")
 
-    expected = hmac.new(secret_bytes, b"%d." % timestamp + body, hashlib.sha256).hexdigest()
-    if not hmac.compare_digest(expected.encode(), signature.encode()):
+    signed = b"%d." % timestamp + body
+    matched = False
+    for key in secret_keys:
+        expected = hmac.new(key, signed, hashlib.sha256).hexdigest().encode()
+        for signature in signatures:
+            # no early exit: constant work whatever matches
+            matched |= hmac.compare_digest(expected, signature.encode())
+    if not matched:
         raise SignatureVerificationError("signature mismatch")
     try:
         return json.loads(body.decode("utf-8"))