ebicsclient 1.3.0__tar.gz → 1.3.2__tar.gz

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ebicsclient
-Version: 1.3.0
+Version: 1.3.2
 Summary: Pure-Python client for the EBICS 3.0 (H005) banking protocol
 Project-URL: Homepage, https://github.com/schulluk/ebicsclient
 Project-URL: Repository, https://github.com/schulluk/ebicsclient
@@ -189,6 +189,17 @@ transaction_id = client.upload(PAIN_001, pain001_bytes)
 The **certificate-based ("mit Zertifikaten")** profile is a constructor option — see
 [docs/11-certificate-profiles.md](docs/11-certificate-profiles.md).
 
+> ### ⚠️ Loading EBICS identifiers from a config file? Quote them.
+>
+> EBICS IDs **can** carry leading zeros (a real Partner ID may look like `00123456`), and
+> ISO message versions look like `"08"`. Unquoted in YAML/JSON/TOML these parse as **numbers** —
+> the wrong type *and* silently stripped of their zeros (PyYAML even reads all-octal-digit
+> values as octal). Since 1.3.1 the library rejects non-string values immediately with an
+> explanatory error, but the correct fix is always **quoting the value in your config**
+> (`partner_id: "00123456"`, `message_version: "08"`) — never wrapping the parsed number in
+> `str()`, which would keep the wrong, zero-stripped identifier and talk to the bank as the
+> wrong subscriber. The same applies to digits-only keyring passphrases.
+
 ## Documentation index
 
 | Doc | Contents |

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/README.md

@@ -71,6 +71,17 @@ transaction_id = client.upload(PAIN_001, pain001_bytes)
 The **certificate-based ("mit Zertifikaten")** profile is a constructor option — see
 [docs/11-certificate-profiles.md](docs/11-certificate-profiles.md).
 
+> ### ⚠️ Loading EBICS identifiers from a config file? Quote them.
+>
+> EBICS IDs **can** carry leading zeros (a real Partner ID may look like `00123456`), and
+> ISO message versions look like `"08"`. Unquoted in YAML/JSON/TOML these parse as **numbers** —
+> the wrong type *and* silently stripped of their zeros (PyYAML even reads all-octal-digit
+> values as octal). Since 1.3.1 the library rejects non-string values immediately with an
+> explanatory error, but the correct fix is always **quoting the value in your config**
+> (`partner_id: "00123456"`, `message_version: "08"`) — never wrapping the parsed number in
+> `str()`, which would keep the wrong, zero-stripped identifier and talk to the bank as the
+> wrong subscriber. The same applies to digits-only keyring passphrases.
+
 ## Documentation index
 
 | Doc | Contents |

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/docs/06-engineering-conventions.md

@@ -91,6 +91,14 @@ specific return code on `ReturnCodeError`).
 - **Gathering** those values from env vars / a vault / Django settings is the **consumer's** job, never the
   library's. Explicit config is auditable; silent environment reads are a surprise and a leakage footgun on a
   money-moving codebase.
+- **Validate at the public boundary, with errors that teach the fix.** Every caller-supplied value is
+  type-checked where it enters the library (dataclass `__post_init__`, first line of a public function) —
+  never allowed to drift into `lxml`/`cryptography` and die there as a cryptic C-extension error. Learned
+  from the field: EBICS identifiers **can** carry leading zeros (`"00123456"`) and versions look like `"08"`;
+  unquoted in a consumer's YAML/JSON config they arrive as *numbers* — wrong type **and** silently
+  zero-stripped. The error message must therefore say "quote the value in your configuration", because the
+  obvious caller "fix" (`str(...)`) would keep a wrong, zero-stripped identifier and address the wrong
+  subscriber. See the README's quoting warning and `tests/test_input_validation.py`.
 
 ## Security (banking client — non-negotiable)
 

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ebicsclient"
-version = "1.3.0"
+version = "1.3.2"
 description = "Pure-Python client for the EBICS 3.0 (H005) banking protocol"
 readme = "README.md"
 requires-python = ">=3.11"

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/certificates.py

@@ -91,8 +91,18 @@ class MappingCertificateProvider:
         Args:
             certificates: A mapping from each :class:`~ebicsclient.keys.CertificateUsage` to
                 the CA-issued certificate certifying that key.
+
+        Raises:
+            TypeError: a mapping value is not an ``x509.Certificate``.
         """
         self._certificates = dict(certificates)
+        for usage, certificate in self._certificates.items():
+            if not isinstance(certificate, x509.Certificate):
+                raise TypeError(
+                    f"The {usage} certificate must be an x509.Certificate, got "
+                    f"{type(certificate).__name__} — load PEM/DER bytes with "
+                    f"load_certificate()"
+                )
 
     def certificate(
         self, usage: CertificateUsage, private_key: rsa.RSAPrivateKey, subject_name: str
@@ -152,6 +162,12 @@ class TrustAnchorVerifier:
         self._anchors = list(trust_anchors)
         if not self._anchors:
             raise BankCertificateError("At least one trust anchor is required")
+        for anchor in self._anchors:
+            if not isinstance(anchor, x509.Certificate):
+                raise TypeError(
+                    f"Trust anchors must be x509.Certificate objects, got "
+                    f"{type(anchor).__name__} — load PEM/DER bytes with load_certificate()"
+                )
 
     def verify(self, certificate: x509.Certificate, usage: CertificateUsage) -> None:
         """Check the bank certificate's validity period and issuer against the anchors."""
@@ -176,11 +192,16 @@ def load_certificate(data: bytes) -> x509.Certificate:
         The parsed certificate.
 
     Raises:
-        CertificateError: the bytes are not a readable X.509 certificate.
+        CertificateError: the data is not bytes or not a readable X.509 certificate.
     """
+    if not isinstance(data, bytes | bytearray):
+        raise CertificateError(
+            f"Certificate data must be bytes, got {type(data).__name__} — read the "
+            f"certificate file in binary mode ('rb')"
+        )
     for loader in (x509.load_pem_x509_certificate, x509.load_der_x509_certificate):
         try:
-            return loader(data)
+            return loader(bytes(data))
         except ValueError:
             continue
     raise CertificateError("Data is not a readable PEM or DER X.509 certificate")

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/client.py

@@ -465,6 +465,14 @@ class Client:
             ReturnCodeError: the bank rejected the upload (e.g. a bad signature or order data).
             CryptoError: the order data could not be signed or encrypted.
         """
+        if not isinstance(order_data, bytes | bytearray):
+            # A str here would fail deep inside compression with an opaque error; and
+            # implicitly encoding it could silently alter the document. The caller owns
+            # the encoding: read the file in binary mode or encode it explicitly.
+            raise TypeError(
+                f"order_data must be bytes, got {type(order_data).__name__} — read the "
+                f"file in binary mode ('rb') or use .encode() on an XML string"
+            )
         bank_keys = self._require_bank_keys("Upload")
         logger.info("Upload: opening a %s/%s transaction", btf.service_name, btf.message_name)
         payload = h005.prepare_upload(self._user, self._keyring, bank_keys, order_data)

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/keys.py

@@ -43,6 +43,18 @@ _KEY_FIELDS = ("signature", "authentication", "encryption")
 _CERTIFICATE_VALIDITY_DAYS = 365 * 10
 
 
+def _require_passphrase(passphrase: object) -> None:
+    # A non-str passphrase (e.g. a numeric value from an unquoted config entry) would
+    # surface as an AttributeError deep in the serialisation layer; fail here instead.
+    if not isinstance(passphrase, str):
+        raise KeyringError(
+            f"passphrase must be a str, got {type(passphrase).__name__} — quote it in "
+            f"your configuration"
+        )
+    if not passphrase:
+        raise KeyringError("A non-empty passphrase is required to encrypt the keyring")
+
+
 def generate_keyring(key_size: int = _MINIMUM_KEY_SIZE) -> Keyring:
     """Generate a fresh set of the three EBICS RSA key pairs.
 
@@ -182,8 +194,7 @@ def serialize_keyring(keyring: Keyring, passphrase: str) -> bytes:
     Raises:
         KeyringError: the passphrase is empty.
     """
-    if not passphrase:
-        raise KeyringError("A non-empty passphrase is required to encrypt the keyring")
+    _require_passphrase(passphrase)
     encryption = serialization.BestAvailableEncryption(passphrase.encode("utf-8"))
     encoded = {
         field: _private_key_to_pem(getattr(keyring, field), encryption) for field in _KEY_FIELDS
@@ -206,6 +217,7 @@ def deserialize_keyring(data: bytes, passphrase: str) -> Keyring:
         KeyringError: the data is malformed, of an unknown version, or the passphrase
             is wrong.
     """
+    _require_passphrase(passphrase)
     try:
         envelope = json.loads(data)
     except (json.JSONDecodeError, UnicodeDecodeError) as error:
@@ -224,30 +236,32 @@ def deserialize_keyring(data: bytes, passphrase: str) -> Keyring:
     return Keyring(**keys)
 
 
-def save_keyring(keyring: Keyring, path: Path, passphrase: str) -> None:
+def save_keyring(keyring: Keyring, path: str | Path, passphrase: str) -> None:
     """Write an encrypted keyring to a file (convenience over :func:`serialize_keyring`).
 
     Args:
         keyring: The key pairs to persist.
-        path: Destination file path; overwritten if it already exists.
+        path: Destination file path (a ``str`` or ``Path``); overwritten if it exists.
         passphrase: Secret used to encrypt the private keys. Never stored or logged.
 
     Raises:
-        KeyringError: the passphrase is empty, or the file could not be written.
+        KeyringError: the passphrase is empty or not a string, or the file could not be
+            written.
     """
     data = serialize_keyring(keyring, passphrase)
+    destination = Path(path)
     try:
-        path.write_bytes(data)
+        destination.write_bytes(data)
     except OSError as error:
-        raise KeyringError(f"Could not write keyring to {path}: {error}") from error
-    logger.info("Wrote encrypted keyring to %s", path)
+        raise KeyringError(f"Could not write keyring to {destination}: {error}") from error
+    logger.info("Wrote encrypted keyring to %s", destination)
 
 
-def load_keyring(path: Path, passphrase: str) -> Keyring:
+def load_keyring(path: str | Path, passphrase: str) -> Keyring:
     """Read and decrypt a keyring file (convenience over :func:`deserialize_keyring`).
 
     Args:
-        path: Path to the encrypted keyring file.
+        path: Path to the encrypted keyring file (a ``str`` or ``Path``).
         passphrase: Secret used when the keyring was saved.
 
     Returns:
@@ -255,12 +269,13 @@ def load_keyring(path: Path, passphrase: str) -> Keyring:
 
     Raises:
         KeyringError: the file is missing, malformed, of an unknown version, or the
-            passphrase is wrong.
+            passphrase is wrong or not a string.
     """
+    source = Path(path)
     try:
-        data = path.read_bytes()
+        data = source.read_bytes()
     except OSError as error:
-        raise KeyringError(f"Could not read keyring from {path}: {error}") from error
+        raise KeyringError(f"Could not read keyring from {source}: {error}") from error
     return deserialize_keyring(data, passphrase)
 
 

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/letter.py

@@ -68,7 +68,10 @@ def make_ini_letter(
 
     Raises:
         MissingDependencyError: PDF output was requested but the ``pdf`` extra is absent.
+        TypeError: ``branding`` is not a ``str``.
     """
+    if not isinstance(branding, str):
+        raise TypeError(f"branding must be a str, got {type(branding).__name__}")
     resolved = _resolve_format(output_format)
     when = created if created is not None else datetime.date.today()
     panels = _key_panels(keyring)

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/models.py

@@ -12,6 +12,27 @@ from enum import StrEnum
 from cryptography.hazmat.primitives.asymmetric import rsa
 
 
+def _require_identifier(field_name: str, value: object) -> None:
+    # EBICS identifiers can carry leading zeros (e.g. a Partner ID of "00123456").
+    # Loaded from an unquoted YAML/JSON/TOML config value they arrive as numbers — the wrong
+    # type AND silently stripped of their zeros (PyYAML even reads all-octal-digit values as
+    # octal). Failing here, with the fix in the message, beats a cryptic TypeError four
+    # frames deep in a crypto or XML library.
+    if not isinstance(value, str):
+        raise TypeError(
+            f"{field_name} must be a str, got {type(value).__name__} ({value!r}). EBICS "
+            f"identifiers can carry leading zeros — quote them in your configuration to "
+            f"keep both the type and the zeros."
+        )
+    if not value.strip():
+        raise ValueError(f"{field_name} must not be empty")
+
+
+def _require_optional_identifier(field_name: str, value: object) -> None:
+    if value is not None:
+        _require_identifier(field_name, value)
+
+
 @dataclass(frozen=True, slots=True)
 class Bank:
     """Connection details for a bank's EBICS endpoint.
@@ -19,11 +40,19 @@ class Bank:
     Attributes:
         host_id: The bank's EBICS Host ID.
         url: The bank's EBICS HTTPS endpoint.
+
+    Raises:
+        TypeError: a field is not a ``str`` (e.g. a numeric config value).
+        ValueError: a field is empty.
     """
 
     host_id: str
     url: str
 
+    def __post_init__(self) -> None:
+        _require_identifier("host_id", self.host_id)
+        _require_identifier("url", self.url)
+
 
 @dataclass(frozen=True, slots=True)
 class User:
@@ -32,11 +61,20 @@ class User:
     Attributes:
         partner_id: The customer (Partner) ID.
         user_id: The subscriber (User) ID.
+
+    Raises:
+        TypeError: an ID is not a ``str`` — commonly an unquoted, zero-leading ID in a
+            YAML/JSON config parsed as a number (which also silently drops the zeros).
+        ValueError: an ID is empty.
     """
 
     partner_id: str
     user_id: str
 
+    def __post_init__(self) -> None:
+        _require_identifier("partner_id", self.partner_id)
+        _require_identifier("user_id", self.user_id)
+
 
 @dataclass(frozen=True, slots=True)
 class Keyring:
@@ -56,6 +94,18 @@ class Keyring:
     authentication: rsa.RSAPrivateKey
     encryption: rsa.RSAPrivateKey
 
+    def __post_init__(self) -> None:
+        for field_name, value in (
+            ("signature", self.signature),
+            ("authentication", self.authentication),
+            ("encryption", self.encryption),
+        ):
+            if not isinstance(value, rsa.RSAPrivateKey):
+                raise TypeError(
+                    f"{field_name} must be an RSA private key, got {type(value).__name__} — "
+                    f"generate keys with generate_keyring() or load them with load_keyring()"
+                )
+
 
 @dataclass(frozen=True, slots=True)
 class BankKeys:
@@ -73,6 +123,16 @@ class BankKeys:
     authentication: rsa.RSAPublicKey
     encryption: rsa.RSAPublicKey
 
+    def __post_init__(self) -> None:
+        for field_name, value in (
+            ("authentication", self.authentication),
+            ("encryption", self.encryption),
+        ):
+            if not isinstance(value, rsa.RSAPublicKey):
+                raise TypeError(
+                    f"{field_name} must be an RSA public key, got {type(value).__name__}"
+                )
+
 
 @dataclass(frozen=True, slots=True)
 class BankKeyHashes:
@@ -90,6 +150,22 @@ class BankKeyHashes:
     authentication: bytes
     encryption: bytes
 
+    def __post_init__(self) -> None:
+        for field_name, value in (
+            ("authentication", self.authentication),
+            ("encryption", self.encryption),
+        ):
+            if not isinstance(value, bytes):
+                raise TypeError(
+                    f"{field_name} must be the raw 32-byte SHA-256 digest as bytes, got "
+                    f"{type(value).__name__} — for a published hex hash use "
+                    f'bytes.fromhex(hash_text.replace(" ", ""))'
+                )
+            if len(value) != 32:
+                raise ValueError(
+                    f"{field_name} must be exactly 32 bytes (SHA-256), got {len(value)}"
+                )
+
 
 class InitializationState(StrEnum):
     """The outcome of submitting subscriber keys with INI or HIA.
@@ -127,6 +203,16 @@ class BusinessTransactionFormat:
     container: str | None = None
     service_option: str | None = None
 
+    def __post_init__(self) -> None:
+        # message_version is the classic trap: an unquoted "08" in YAML/JSON config arrives
+        # as the int 8 — wrong type and a silently different version on the wire.
+        _require_identifier("service_name", self.service_name)
+        _require_identifier("message_name", self.message_name)
+        _require_optional_identifier("scope", self.scope)
+        _require_optional_identifier("message_version", self.message_version)
+        _require_optional_identifier("container", self.container)
+        _require_optional_identifier("service_option", self.service_option)
+
 
 #: The Swiss camt.053.001.08 account-statement download (end-of-period, ZIP container).
 #: Matches the ZKB ``Z53`` order type verbatim (``EOP / CH / camt.053 / 08 / ZIP``); see

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/src/ebicsclient/transport.py

@@ -49,6 +49,10 @@ class Transport:
         Raises:
             TransportError: the URL is not an HTTPS URL.
         """
+        if not isinstance(url, str):
+            raise TransportError(
+                f"EBICS endpoint URL must be a str, got {type(url).__name__} ({url!r})"
+            )
         if not url.lower().startswith("https://"):
             raise TransportError(f"EBICS endpoint must be an https:// URL, got {url!r}")
         self._url = url

ebicsclient-1.3.2/tests/test_input_validation.py

@@ -0,0 +1,178 @@
+"""Tests for input validation at the library's public boundaries.
+
+The bug class under test: a caller-supplied value of the wrong type (typically a numeric
+value from an unquoted YAML/JSON config entry) slipping deep into a C extension and
+surfacing as a cryptic error — as happened live with a numeric ``user_id`` reaching
+``x509.NameAttribute`` (``TypeError: value argument must be a str``). Every boundary must
+fail immediately, with a message that teaches the fix. EBICS identifiers with leading
+zeros (``"00123456"``) also *lose their zeros* when parsed as numbers, so the messages
+point at quoting the config value, never at wrapping it in ``str()``.
+"""
+
+from pathlib import Path
+
+import pytest
+
+from ebicsclient import (
+    Bank,
+    BankKeyHashes,
+    BankKeys,
+    BusinessTransactionFormat,
+    Client,
+    Keyring,
+    MappingCertificateProvider,
+    TrustAnchorVerifier,
+    User,
+    generate_keyring,
+    load_certificate,
+    load_keyring,
+    save_keyring,
+)
+from ebicsclient.errors import CertificateError, KeyringError, TransportError
+from ebicsclient.keys import CertificateUsage
+from ebicsclient.models import PAIN_001
+from ebicsclient.transport import Transport
+
+
+@pytest.fixture(scope="module")
+def keyring() -> Keyring:
+    return generate_keyring()
+
+
+def test_user_rejects_a_numeric_id_with_a_teaching_message() -> None:
+    # The exact bug report: ZKB IDs like "00123456" unquoted in config arrive as ints.
+    with pytest.raises(TypeError) as caught:
+        User(partner_id="00123456", user_id=123456)  # type: ignore[arg-type]
+    message = str(caught.value)
+    assert "user_id must be a str" in message
+    assert "int" in message
+    assert "quote" in message  # the fix, not just the failure
+
+
+def test_user_rejects_an_empty_id() -> None:
+    with pytest.raises(ValueError):
+        User(partner_id="PARTNER1", user_id="  ")
+
+
+def test_bank_rejects_a_non_string_host_id() -> None:
+    with pytest.raises(TypeError) as caught:
+        Bank(host_id=12345, url="https://example.com/ebicsweb")  # type: ignore[arg-type]
+    assert "host_id must be a str" in str(caught.value)
+
+
+def test_business_transaction_format_rejects_a_numeric_message_version() -> None:
+    # The classic YAML trap: an unquoted "08" arrives as the int 8 — wrong type AND a
+    # silently different version.
+    with pytest.raises(TypeError) as caught:
+        BusinessTransactionFormat(
+            service_name="EOP",
+            message_name="camt.053",
+            message_version=8,  # type: ignore[arg-type]
+        )
+    assert "message_version must be a str" in str(caught.value)
+
+
+def test_keyring_rejects_non_key_values() -> None:
+    with pytest.raises(TypeError) as caught:
+        Keyring(signature="not-a-key", authentication="x", encryption="y")  # type: ignore[arg-type]
+    assert "signature must be an RSA private key" in str(caught.value)
+
+
+def test_bank_keys_reject_private_keys() -> None:
+    keys = generate_keyring()
+    with pytest.raises(TypeError):
+        BankKeys(authentication=keys.authentication, encryption=keys.encryption)  # type: ignore[arg-type]
+
+
+def test_bank_key_hashes_reject_a_hex_string() -> None:
+    digest = b"\x00" * 32
+    with pytest.raises(TypeError) as caught:
+        BankKeyHashes(authentication="18 72 B2 39", encryption=digest)  # type: ignore[arg-type]
+    assert "bytes.fromhex" in str(caught.value)  # the message teaches the conversion
+
+
+def test_bank_key_hashes_reject_a_wrong_length() -> None:
+    with pytest.raises(ValueError):
+        BankKeyHashes(authentication=b"\x00" * 32, encryption=b"\x00" * 20)
+
+
+def test_save_and_load_keyring_accept_a_str_path(tmp_path: Path, keyring: Keyring) -> None:
+    # The README quickstart passes a plain string path — it must work.
+    path = str(tmp_path / "keyring.json")
+    save_keyring(keyring, path, "passphrase")
+    loaded = load_keyring(path, "passphrase")
+    assert loaded.signature.public_key().public_numbers() == (
+        keyring.signature.public_key().public_numbers()
+    )
+
+
+def test_serialize_keyring_rejects_a_non_string_passphrase(
+    tmp_path: Path, keyring: Keyring
+) -> None:
+    with pytest.raises(KeyringError) as caught:
+        save_keyring(keyring, tmp_path / "keyring.json", 123456)  # type: ignore[arg-type]
+    assert "passphrase must be a str" in str(caught.value)
+
+
+def test_load_keyring_rejects_a_non_string_passphrase(tmp_path: Path, keyring: Keyring) -> None:
+    path = tmp_path / "keyring.json"
+    save_keyring(keyring, path, "passphrase")
+    with pytest.raises(KeyringError):
+        load_keyring(path, 123456)  # type: ignore[arg-type]
+
+
+def test_upload_rejects_a_string_document(keyring: Keyring) -> None:
+    client = Client(
+        Bank(host_id="HOST", url="https://example.com/ebicsweb"),
+        User(partner_id="PARTNER1", user_id="USER1"),
+        keyring,
+    )
+    with pytest.raises(TypeError) as caught:
+        client.upload(PAIN_001, "<Document/>")  # type: ignore[arg-type]
+    message = str(caught.value)
+    assert "order_data must be bytes" in message
+    assert "'rb'" in message  # the fix is in the message
+
+
+def test_transport_rejects_a_non_string_url() -> None:
+    with pytest.raises(TransportError) as caught:
+        Transport(12345)  # type: ignore[arg-type]
+    assert "must be a str" in str(caught.value)
+
+
+def test_make_ini_letter_rejects_a_non_string_branding(keyring: Keyring) -> None:
+    client = Client(
+        Bank(host_id="HOST", url="https://example.com/ebicsweb"),
+        User(partner_id="PARTNER1", user_id="USER1"),
+        keyring,
+    )
+    with pytest.raises(TypeError) as caught:
+        client.make_ini_letter(branding=42)  # type: ignore[arg-type]
+    assert "branding must be a str" in str(caught.value)
+
+
+def test_load_certificate_rejects_a_pem_string() -> None:
+    with pytest.raises(CertificateError) as caught:
+        load_certificate("-----BEGIN CERTIFICATE-----")  # type: ignore[arg-type]
+    assert "'rb'" in str(caught.value)
+
+
+def test_trust_anchor_verifier_rejects_non_certificate_anchors() -> None:
+    with pytest.raises(TypeError) as caught:
+        TrustAnchorVerifier(["not-a-certificate"])  # type: ignore[list-item]
+    assert "load_certificate()" in str(caught.value)
+
+
+def test_mapping_certificate_provider_rejects_non_certificate_values() -> None:
+    with pytest.raises(TypeError) as caught:
+        MappingCertificateProvider({CertificateUsage.SIGNATURE: b"DER bytes"})  # type: ignore[dict-item]
+    assert "load_certificate()" in str(caught.value)
+
+
+def test_the_original_bug_now_fails_at_construction_not_in_cryptography() -> None:
+    # Regression for the live report: with a numeric user_id the failure must happen at
+    # User(...) with our message — never reach x509.NameAttribute inside cryptography.
+    with pytest.raises(TypeError) as caught:
+        User(partner_id=123456, user_id=123456)  # type: ignore[arg-type]
+    assert "value argument must be a str" not in str(caught.value)
+    assert "leading zeros" in str(caught.value)

{ebicsclient-1.3.0 → ebicsclient-1.3.2}/uv.lock

@@ -281,7 +281,7 @@ wheels = [
 
 [[package]]
 name = "ebicsclient"
-version = "1.3.0"
+version = "1.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },