full-event-hub 1.1.4__tar.gz

full_event_hub-1.1.4/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: full-event-hub
+Version: 1.1.4
+Summary: Zero-dependency Python client for the event-hub webhook fan-out service
+Author-email: Ravi Leal <ravi@example.com>
+License: MIT
+Project-URL: Homepage, https://github.com/ravileal/event-hub
+Project-URL: Repository, https://github.com/ravileal/event-hub
+Project-URL: Issues, https://github.com/ravileal/event-hub/issues
+Keywords: event-hub,webhooks,hmac,fan-out,events,sdk
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Provides-Extra: test
+
+# full-event-hub (Python client)
+
+Zero-dependency Python client for [event-hub](https://github.com/ravileal/event-hub) — a
+webhook fan-out service (ingest, fan-out to N subscribers, HMAC signing, retry/backoff,
+attempts, retention).
+
+Only the standard library is used (`urllib.request`, `json`, `hmac`, `hashlib`). The
+package version matches the hub/image version (`ghcr.io/ravileal/event-hub`); because
+they move together, the client sends the English `X-Idempotency` header that hubs
+since 1.1.0 read, while a hub older than 1.1.0 ignores it.
+
+## Install
+
+```bash
+pip install full-event-hub
+```
+
+## Publish an event
+
+```python
+from event_hub import EventHubClient
+
+hub = EventHubClient("http://127.0.0.1:18295")
+
+hub.create_topic("orders", description="order lifecycle")
+hub.create_subscriber("orders", "billing",
+                      url="http://localhost:9000/hook", secret="s3cr3t",
+                      max_attempts=3, backoff_ms=200)
+
+resp = hub.publish_event("orders", {"order_id": 1}, idempotency_key="order-1")
+print(resp.status, resp.body)  # 202 {'id': 1, 'deliveries_created': 1, 'duplicado': False}
+```
+
+`publish_event` sends the idempotency key as `X-Idempotency` (the header the hub
+reads since 1.1.0; it falls back to the legacy `X-Idempotencia`). Use
+`sign(secret, raw_body)` to sign the exact bytes you send.
+
+## Verify an incoming delivery
+
+event-hub signs every delivery with HMAC-SHA256 of the **raw** body using the
+subscriber secret. Pass the exact bytes received; re-serializing JSON breaks the HMAC.
+
+```python
+from event_hub import verify_delivery_signature
+
+# in your webhook receiver:
+valid = verify_delivery_signature(
+    secret, raw_body, request.headers["X-Event-Hub-Signature"]
+)
+```
+
+`verify_delivery_signature` returns `False` for a missing header, a wrong `sha256=`
+prefix, or a non-matching digest, and compares in constant time
+(`hmac.compare_digest`).
+
+## Notes
+
+- Idempotency header is **`X-Idempotency`** (English) since 1.1.0; the legacy
+  **`X-Idempotencia`** is still accepted for old producers but new code should not
+  send it.
+- Deliveries carry `X-Event-Hub-Event`, `X-Event-Hub-Attempt` and
+  `X-Event-Hub-Signature` (`sha256=<hex>`).
+
+MIT licensed.

full_event_hub-1.1.4/README.md

@@ -0,0 +1,64 @@
+# full-event-hub (Python client)
+
+Zero-dependency Python client for [event-hub](https://github.com/ravileal/event-hub) — a
+webhook fan-out service (ingest, fan-out to N subscribers, HMAC signing, retry/backoff,
+attempts, retention).
+
+Only the standard library is used (`urllib.request`, `json`, `hmac`, `hashlib`). The
+package version matches the hub/image version (`ghcr.io/ravileal/event-hub`); because
+they move together, the client sends the English `X-Idempotency` header that hubs
+since 1.1.0 read, while a hub older than 1.1.0 ignores it.
+
+## Install
+
+```bash
+pip install full-event-hub
+```
+
+## Publish an event
+
+```python
+from event_hub import EventHubClient
+
+hub = EventHubClient("http://127.0.0.1:18295")
+
+hub.create_topic("orders", description="order lifecycle")
+hub.create_subscriber("orders", "billing",
+                      url="http://localhost:9000/hook", secret="s3cr3t",
+                      max_attempts=3, backoff_ms=200)
+
+resp = hub.publish_event("orders", {"order_id": 1}, idempotency_key="order-1")
+print(resp.status, resp.body)  # 202 {'id': 1, 'deliveries_created': 1, 'duplicado': False}
+```
+
+`publish_event` sends the idempotency key as `X-Idempotency` (the header the hub
+reads since 1.1.0; it falls back to the legacy `X-Idempotencia`). Use
+`sign(secret, raw_body)` to sign the exact bytes you send.
+
+## Verify an incoming delivery
+
+event-hub signs every delivery with HMAC-SHA256 of the **raw** body using the
+subscriber secret. Pass the exact bytes received; re-serializing JSON breaks the HMAC.
+
+```python
+from event_hub import verify_delivery_signature
+
+# in your webhook receiver:
+valid = verify_delivery_signature(
+    secret, raw_body, request.headers["X-Event-Hub-Signature"]
+)
+```
+
+`verify_delivery_signature` returns `False` for a missing header, a wrong `sha256=`
+prefix, or a non-matching digest, and compares in constant time
+(`hmac.compare_digest`).
+
+## Notes
+
+- Idempotency header is **`X-Idempotency`** (English) since 1.1.0; the legacy
+  **`X-Idempotencia`** is still accepted for old producers but new code should not
+  send it.
+- Deliveries carry `X-Event-Hub-Event`, `X-Event-Hub-Attempt` and
+  `X-Event-Hub-Signature` (`sha256=<hex>`).
+
+MIT licensed.

full_event_hub-1.1.4/pyproject.toml

@@ -0,0 +1,46 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "full-event-hub"
+version = "1.1.4"
+description = "Zero-dependency Python client for the event-hub webhook fan-out service"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Ravi Leal", email = "ravi@example.com" }]
+keywords = ["event-hub", "webhooks", "hmac", "fan-out", "events", "sdk"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Topic :: Internet :: WWW/HTTP",
+]
+dependencies = []
+
+[project.optional-dependencies]
+# The suite uses only the stdlib (unittest), so no test dependency is required.
+# This extra exists so tooling can target an explicit test set without pulling
+# anything heavy; the runtime `dependencies` above stay empty.
+test = []
+
+[project.urls]
+Homepage = "https://github.com/ravileal/event-hub"
+Repository = "https://github.com/ravileal/event-hub"
+Issues = "https://github.com/ravileal/event-hub/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+event_hub = ["py.typed"]

full_event_hub-1.1.4/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

full_event_hub-1.1.4/src/event_hub/__init__.py

@@ -0,0 +1,37 @@
+"""event-hub — zero-dependency Python client.
+
+    from event_hub import EventHubClient, verify_delivery_signature
+
+    hub = EventHubClient("http://localhost:18295")
+    hub.create_topic("orders")
+    hub.create_subscriber("orders", "billing", url="http://localhost:9000/hook", secret="s3cr3t")
+    hub.publish_event("orders", {"id": 1}, idempotency_key="order-1")
+
+    # in your webhook receiver:
+    ok = verify_delivery_signature(secret, raw_body, request.headers["X-Event-Hub-Signature"])
+"""
+
+from .client import (
+    IDEMPOTENCY_HEADER,
+    LEGACY_IDEMPOTENCY_HEADER,
+    EventHubClient,
+    EventHubError,
+    HTTPError,
+    Response,
+)
+from .signature import SIGNATURE_PREFIX, sign, verify_delivery_signature
+
+__version__ = "0.0.0"
+
+__all__ = [
+    "EventHubClient",
+    "EventHubError",
+    "HTTPError",
+    "Response",
+    "IDEMPOTENCY_HEADER",
+    "LEGACY_IDEMPOTENCY_HEADER",
+    "SIGNATURE_PREFIX",
+    "sign",
+    "verify_delivery_signature",
+    "__version__",
+]

full_event_hub-1.1.4/src/event_hub/client.py

@@ -0,0 +1,266 @@
+"""Zero-dependency client for the event-hub HTTP API.
+
+Uses only the stdlib (``urllib.request`` + ``json``). Every method returns a
+:class:`Response` (``status``, ``headers``, ``body``, ``raw``) so callers can assert on
+exact status codes — the hub uses 201/202/200/404/401 meaningfully.
+
+The critical wire details baked into this client:
+
+* the idempotency header is **``X-Idempotency``** (English) since hub 1.1.0. The hub
+  still falls back to the legacy Portuguese ``X-Idempotencia`` for old producers, but
+  new code should always send the English name.
+* the ingest signature header is ``X-Signature`` and is only required when the hub runs
+  with ``--hmac-secret``.
+"""
+
+from __future__ import annotations
+
+import json as _json
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Dict, List, Optional
+
+__all__ = [
+    "EventHubError",
+    "HTTPError",
+    "Response",
+    "EventHubClient",
+    "IDEMPOTENCY_HEADER",
+    "LEGACY_IDEMPOTENCY_HEADER",
+]
+
+#: Inbound idempotency header the hub reads (English, since hub 1.1.0).
+IDEMPOTENCY_HEADER = "X-Idempotency"
+
+#: Legacy Portuguese alias, still accepted by the hub for old producers.
+#: Do not send it from new code.
+LEGACY_IDEMPOTENCY_HEADER = "X-Idempotencia"
+
+
+class EventHubError(Exception):
+    """Base error raised by the client (transport-level)."""
+
+
+class HTTPError(EventHubError):
+    """Raised by :meth:`Response.raise_for_status` on a >=400 response."""
+
+    def __init__(self, response: "Response") -> None:
+        self.response = response
+        detail = response.body if response.body is not None else response.raw
+        super().__init__("HTTP %s from event-hub: %r" % (response.status, detail))
+
+
+class Response:
+    """A parsed HTTP response from the hub."""
+
+    __slots__ = ("status", "headers", "body", "raw")
+
+    def __init__(self, status: int, headers: Dict[str, str], raw: bytes) -> None:
+        self.status = status
+        self.headers = headers
+        self.raw = raw
+        text = raw.decode("utf-8", errors="replace") if raw else ""
+        if text:
+            try:
+                self.body: Any = _json.loads(text)
+            except ValueError:
+                self.body = text
+        else:
+            self.body = None
+
+    @property
+    def ok(self) -> bool:
+        return 200 <= self.status < 300
+
+    def raise_for_status(self) -> "Response":
+        if not self.ok:
+            raise HTTPError(self)
+        return self
+
+    def __repr__(self) -> str:
+        return "<Response status=%s body=%r>" % (self.status, self.body)
+
+
+class EventHubClient:
+    """Client for an event-hub instance.
+
+    :param base_url: e.g. ``http://localhost:18295``.
+    :param timeout: per-request timeout in seconds.
+    """
+
+    def __init__(self, base_url: str = "http://localhost:18295", timeout: float = 10.0) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.timeout = timeout
+
+    # -- low level ---------------------------------------------------------
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        body: Optional[bytes] = None,
+        headers: Optional[Dict[str, str]] = None,
+        query: Optional[Dict[str, Any]] = None,
+    ) -> Response:
+        url = self.base_url + path
+        if query:
+            clean = {k: v for k, v in query.items() if v is not None}
+            if clean:
+                url += "?" + urllib.parse.urlencode(clean)
+        req = urllib.request.Request(url, data=body, method=method.upper())
+        for key, value in (headers or {}).items():
+            req.add_header(key, value)
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                return Response(resp.status, dict(resp.headers.items()), resp.read())
+        except urllib.error.HTTPError as exc:  # 4xx/5xx still carry a useful body
+            return Response(exc.code, dict(exc.headers.items()), exc.read())
+        except urllib.error.URLError as exc:
+            raise EventHubError("cannot reach event-hub at %s: %s" % (self.base_url, exc)) from exc
+
+    def _json_request(
+        self,
+        method: str,
+        path: str,
+        payload: Any = None,
+        *,
+        headers: Optional[Dict[str, str]] = None,
+        query: Optional[Dict[str, Any]] = None,
+    ) -> Response:
+        body = None
+        hdrs = dict(headers or {})
+        if payload is not None:
+            body = _json.dumps(payload).encode("utf-8")
+            hdrs.setdefault("Content-Type", "application/json")
+        return self.request(method, path, body=body, headers=hdrs, query=query)
+
+    # -- health / metrics --------------------------------------------------
+    def health(self) -> Response:
+        """``GET /health`` -> 200 ``{"ok":true,"version":...}``."""
+        return self.request("GET", "/health")
+
+    def metrics(self) -> Response:
+        """``GET /metrics`` -> 200 counters."""
+        return self.request("GET", "/metrics")
+
+    # -- topics ------------------------------------------------------------
+    def create_topic(self, name: str, description: Optional[str] = None) -> Response:
+        """``POST /topics`` -> 201 Topic."""
+        return self._json_request("POST", "/topics", {"name": name, "description": description})
+
+    def list_topics(self) -> Response:
+        """``GET /topics`` -> 200 Topic[]."""
+        return self.request("GET", "/topics")
+
+    # -- subscribers -------------------------------------------------------
+    def create_subscriber(
+        self,
+        topic: str,
+        name: str,
+        *,
+        url: Optional[str] = None,
+        secret: Optional[str] = None,
+        max_attempts: Optional[int] = None,
+        backoff_ms: Optional[int] = None,
+        kind: str = "webhook",
+        command: Optional[str] = None,
+        timeout_ms: Optional[int] = None,
+    ) -> Response:
+        """``POST /topics/{topic}/subscribers`` -> 201 subscriber.
+
+        ``url`` is mandatory for ``kind="webhook"``; ``command`` for ``kind="command"``.
+        """
+        payload: Dict[str, Any] = {"name": name, "kind": kind}
+        for key, value in (
+            ("url", url),
+            ("secret", secret),
+            ("max_attempts", max_attempts),
+            ("backoff_ms", backoff_ms),
+            ("command", command),
+            ("timeout_ms", timeout_ms),
+        ):
+            if value is not None:
+                payload[key] = value
+        return self._json_request(
+            "POST", "/topics/%s/subscribers" % urllib.parse.quote(topic, safe=""), payload
+        )
+
+    # -- events ------------------------------------------------------------
+    def publish_event(
+        self,
+        topic: str,
+        payload: Any,
+        *,
+        idempotency_key: Optional[str] = None,
+        signature: Optional[str] = None,
+        raw: Optional[bytes] = None,
+    ) -> Response:
+        """``POST /events/{topic}`` -> 202 (new) or 200 with ``duplicado=true``.
+
+        ``idempotency_key`` is sent as ``X-Idempotency`` (the header the hub reads
+        since 1.1.0; it falls back to the legacy ``X-Idempotencia``). ``signature``
+        (``sha256=<hex>``) is sent as ``X-Signature`` and is only enforced by hubs
+        started with ``--hmac-secret``. Pass ``raw`` to send exact bytes (e.g. to match
+        a pre-computed signature) instead of a JSON re-serialisation.
+        """
+        headers: Dict[str, str] = {}
+        if idempotency_key is not None:
+            headers[IDEMPOTENCY_HEADER] = idempotency_key
+        if signature is not None:
+            headers["X-Signature"] = signature
+        if raw is not None:
+            headers.setdefault("Content-Type", "application/json")
+            body = raw
+        else:
+            body = _json.dumps(payload).encode("utf-8")
+            headers.setdefault("Content-Type", "application/json")
+        return self.request(
+            "POST", "/events/%s" % urllib.parse.quote(topic, safe=""), body=body, headers=headers
+        )
+
+    # -- ingest ------------------------------------------------------------
+    def ingest(self, raw: bytes, *, origem: Optional[str] = None) -> Response:
+        """``POST /ingest?origem=`` with a raw body -> 202.
+
+        404 ``{"error":"routing disabled..."}`` when the hub runs without ``--routes``.
+        """
+        body = raw.encode("utf-8") if isinstance(raw, str) else raw
+        return self.request(
+            "POST", "/ingest", body=body, headers={"Content-Type": "application/json"},
+            query={"origem": origem},
+        )
+
+    # -- deliveries --------------------------------------------------------
+    def list_deliveries(
+        self,
+        *,
+        status: Optional[str] = None,
+        topic: Optional[str] = None,
+        limite: Optional[int] = None,
+    ) -> Response:
+        """``GET /deliveries?status=&topic=&limite=``."""
+        return self.request(
+            "GET", "/deliveries", query={"status": status, "topic": topic, "limite": limite}
+        )
+
+    def retry_delivery(self, delivery_id: int) -> Response:
+        """``POST /deliveries/{id}/retry``."""
+        return self.request("POST", "/deliveries/%s/retry" % delivery_id)
+
+    def retry_failures(self) -> Response:
+        """``POST /deliveries/retry-falhas``."""
+        return self.request("POST", "/deliveries/retry-falhas")
+
+    # -- observability -----------------------------------------------------
+    def list_proxied(self, *, source: Optional[str] = None, destination: Optional[str] = None,
+                     limite: Optional[int] = None) -> Response:
+        """``GET /proxied``."""
+        return self.request(
+            "GET", "/proxied",
+            query={"source": source, "destination": destination, "limite": limite},
+        )
+
+    def trace(self, **anchor: str) -> Response:
+        """``GET /trace`` — exactly one anchor (tvdb/tmdb/imdb/torrent/path)."""
+        return self.request("GET", "/trace", query=anchor)

full_event_hub-1.1.4/src/event_hub/signature.py

@@ -0,0 +1,53 @@
+"""HMAC-SHA256 signing helpers for event-hub.
+
+Two distinct signatures exist in event-hub:
+
+* **Ingest signature** (``X-Signature`` on ``POST /events/{topic}``): only used when the
+  hub is started with ``--hmac-secret``. Same algorithm/format as below.
+* **Delivery signature** (``X-Event-Hub-Signature`` on the HTTP request the hub makes to a
+  subscriber): HMAC-SHA256 of the *raw* request body with the subscriber's secret.
+
+Both use the same wire format: ``sha256=<hex lowercase digest>``.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+from typing import Union
+
+__all__ = ["SIGNATURE_PREFIX", "sign", "verify_delivery_signature"]
+
+SIGNATURE_PREFIX = "sha256="
+
+BytesLike = Union[bytes, bytearray, str]
+
+
+def _as_bytes(value: BytesLike) -> bytes:
+    if isinstance(value, str):
+        return value.encode("utf-8")
+    return bytes(value)
+
+
+def sign(secret: BytesLike, body: BytesLike) -> str:
+    """Return ``sha256=<hex>`` = HMAC-SHA256(secret, body)."""
+    digest = hmac.new(_as_bytes(secret), _as_bytes(body), hashlib.sha256).hexdigest()
+    return SIGNATURE_PREFIX + digest
+
+
+def verify_delivery_signature(secret: BytesLike, raw_body: BytesLike, header: str) -> bool:
+    """Constant-time verification of a delivery signature header.
+
+    ``header`` is the raw value of ``X-Event-Hub-Signature`` (e.g. ``"sha256=ab12..."``).
+    ``raw_body`` MUST be the exact bytes received on the wire — re-serialising JSON would
+    change whitespace/key order and break the HMAC.
+    """
+    if not header or not isinstance(header, str):
+        return False
+    if not header.startswith(SIGNATURE_PREFIX):
+        return False
+    provided = header[len(SIGNATURE_PREFIX) :]
+    expected = hmac.new(
+        _as_bytes(secret), _as_bytes(raw_body), hashlib.sha256
+    ).hexdigest()
+    return hmac.compare_digest(expected, provided)

full_event_hub-1.1.4/src/full_event_hub.egg-info/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: full-event-hub
+Version: 1.1.4
+Summary: Zero-dependency Python client for the event-hub webhook fan-out service
+Author-email: Ravi Leal <ravi@example.com>
+License: MIT
+Project-URL: Homepage, https://github.com/ravileal/event-hub
+Project-URL: Repository, https://github.com/ravileal/event-hub
+Project-URL: Issues, https://github.com/ravileal/event-hub/issues
+Keywords: event-hub,webhooks,hmac,fan-out,events,sdk
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Provides-Extra: test
+
+# full-event-hub (Python client)
+
+Zero-dependency Python client for [event-hub](https://github.com/ravileal/event-hub) — a
+webhook fan-out service (ingest, fan-out to N subscribers, HMAC signing, retry/backoff,
+attempts, retention).
+
+Only the standard library is used (`urllib.request`, `json`, `hmac`, `hashlib`). The
+package version matches the hub/image version (`ghcr.io/ravileal/event-hub`); because
+they move together, the client sends the English `X-Idempotency` header that hubs
+since 1.1.0 read, while a hub older than 1.1.0 ignores it.
+
+## Install
+
+```bash
+pip install full-event-hub
+```
+
+## Publish an event
+
+```python
+from event_hub import EventHubClient
+
+hub = EventHubClient("http://127.0.0.1:18295")
+
+hub.create_topic("orders", description="order lifecycle")
+hub.create_subscriber("orders", "billing",
+                      url="http://localhost:9000/hook", secret="s3cr3t",
+                      max_attempts=3, backoff_ms=200)
+
+resp = hub.publish_event("orders", {"order_id": 1}, idempotency_key="order-1")
+print(resp.status, resp.body)  # 202 {'id': 1, 'deliveries_created': 1, 'duplicado': False}
+```
+
+`publish_event` sends the idempotency key as `X-Idempotency` (the header the hub
+reads since 1.1.0; it falls back to the legacy `X-Idempotencia`). Use
+`sign(secret, raw_body)` to sign the exact bytes you send.
+
+## Verify an incoming delivery
+
+event-hub signs every delivery with HMAC-SHA256 of the **raw** body using the
+subscriber secret. Pass the exact bytes received; re-serializing JSON breaks the HMAC.
+
+```python
+from event_hub import verify_delivery_signature
+
+# in your webhook receiver:
+valid = verify_delivery_signature(
+    secret, raw_body, request.headers["X-Event-Hub-Signature"]
+)
+```
+
+`verify_delivery_signature` returns `False` for a missing header, a wrong `sha256=`
+prefix, or a non-matching digest, and compares in constant time
+(`hmac.compare_digest`).
+
+## Notes
+
+- Idempotency header is **`X-Idempotency`** (English) since 1.1.0; the legacy
+  **`X-Idempotencia`** is still accepted for old producers but new code should not
+  send it.
+- Deliveries carry `X-Event-Hub-Event`, `X-Event-Hub-Attempt` and
+  `X-Event-Hub-Signature` (`sha256=<hex>`).
+
+MIT licensed.

full_event_hub-1.1.4/src/full_event_hub.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/event_hub/__init__.py
+src/event_hub/client.py
+src/event_hub/py.typed
+src/event_hub/signature.py
+src/full_event_hub.egg-info/PKG-INFO
+src/full_event_hub.egg-info/SOURCES.txt
+src/full_event_hub.egg-info/dependency_links.txt
+src/full_event_hub.egg-info/requires.txt
+src/full_event_hub.egg-info/top_level.txt
+tests/test_signature.py

full_event_hub-1.1.4/src/full_event_hub.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

full_event_hub-1.1.4/src/full_event_hub.egg-info/requires.txt

@@ -0,0 +1,2 @@
+
+[test]

full_event_hub-1.1.4/src/full_event_hub.egg-info/top_level.txt

@@ -0,0 +1 @@
+event_hub

full_event_hub-1.1.4/tests/test_signature.py

@@ -0,0 +1,74 @@
+"""Offline unit tests for the signature helpers (stdlib unittest, no hub).
+
+Run from the repository root:
+
+    python -m unittest discover -s packages/python/tests -p 'test_*.py'
+
+The three expected values are the shared cross-language contract; the same
+strings live in tests/signature_vectors.rs (Rust reference) and
+packages/npm/test/signature.test.mjs. If the implementations drift apart,
+whichever one changed fails here.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "src"))
+
+from event_hub import sign, verify_delivery_signature  # noqa: E402
+
+SECRET = "shared-vector-secret"
+
+VECTORS = [
+    (
+        "simple JSON body",
+        '{"title":"hello","count":1}',
+        "sha256=1a7ee7637482254acf1a219fc564033b5824ee012bf857d4d6960fbdd7ea7f46",
+    ),
+    (
+        "non-ASCII UTF-8 body",
+        "olá, 世界 — café",
+        "sha256=c1d18fed87c1c08e3c6be675ac6b1bf3c7f329ef0c0ea9f520b804a413bcd1ad",
+    ),
+    (
+        "empty body",
+        "",
+        "sha256=092d0e58dcde35f9641e53be782cd12d4fdff4e6a515ec9556d66527513a6dfe",
+    ),
+]
+
+
+class SignatureVectorsTest(unittest.TestCase):
+    def test_sign_matches_vectors(self) -> None:
+        for name, body, expected in VECTORS:
+            with self.subTest(name=name):
+                self.assertEqual(sign(SECRET, body), expected)
+
+    def test_verify_accepts_vectors(self) -> None:
+        for name, body, expected in VECTORS:
+            with self.subTest(name=name):
+                self.assertTrue(verify_delivery_signature(SECRET, body, expected))
+
+
+class VerifyNegativeTest(unittest.TestCase):
+    def setUp(self) -> None:
+        _, self.body, self.expected = VECTORS[0]
+
+    def test_rejects_tampered_body(self) -> None:
+        self.assertFalse(verify_delivery_signature(SECRET, self.body + " ", self.expected))
+
+    def test_rejects_wrong_secret(self) -> None:
+        self.assertFalse(verify_delivery_signature("another-secret", self.body, self.expected))
+
+    def test_rejects_missing_prefix(self) -> None:
+        self.assertFalse(verify_delivery_signature(SECRET, self.body, self.expected[len("sha256="):]))
+
+    def test_rejects_non_hex_digest(self) -> None:
+        self.assertFalse(verify_delivery_signature(SECRET, self.body, "sha256=zzzz"))
+
+
+if __name__ == "__main__":
+    unittest.main()