hexdb 1.6.0__tar.gz → 2.0.0__tar.gz

{hexdb-1.6.0 → hexdb-2.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hexdb
-Version: 1.6.0
+Version: 2.0.0
 Summary: Client for HexDB, the hexagonal document database.
 Author: Dream In Hex
 License-Expression: Apache-2.0

{hexdb-1.6.0 → hexdb-2.0.0}/hexdb/__init__.py

@@ -26,7 +26,7 @@ import urllib.request
 from typing import Any, BinaryIO, Callable, Dict, Iterator, List, Optional, Sequence, Tuple, Union
 
 __all__ = ["HexDB", "HexDBError", "Tessellation", "Stream", "Files"]
-__version__ = "1.6.0"
+__version__ = "2.0.0"
 
 Json = Any
 Document = Dict[str, Any]
@@ -46,6 +46,22 @@ class HexDBError(Exception):
         return f"HexDBError({self.status}, {self.code!r}, {self.message!r})"
 
 
+class _SameOriginAuth(urllib.request.HTTPRedirectHandler):
+    """Follow redirects, but send the API key only to the server it was given for."""
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        new = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if new is not None and _origin(newurl) != _origin(req.full_url):
+            new.headers.pop("Authorization", None)
+            new.unredirected_hdrs.pop("Authorization", None)
+        return new
+
+
+def _origin(url: str) -> Tuple[str, str]:
+    parts = urllib.parse.urlsplit(url)
+    return (parts.scheme.lower(), parts.netloc.lower())
+
+
 def _quote(text: str) -> str:
     return urllib.parse.quote(text, safe="")
 
@@ -67,6 +83,10 @@ class HexDB:
         self.retries = retries
         self.timeout = timeout
         self._context = ssl.create_default_context(cafile=ca_file) if ca_file else None
+        handlers: List[Any] = [_SameOriginAuth()]
+        if self._context is not None:
+            handlers.append(urllib.request.HTTPSHandler(context=self._context))
+        self._opener = urllib.request.build_opener(*handlers)
 
     # -- transport ---------------------------------------------------------
 
@@ -84,7 +104,7 @@ class HexDB:
         while True:
             req = urllib.request.Request(self.base + path, data=data, method=method, headers=headers)
             try:
-                with urllib.request.urlopen(req, timeout=timeout or self.timeout, context=self._context) as response:
+                with self._opener.open(req, timeout=timeout or self.timeout) as response:
                     if response.status == 204:
                         return None
                     text = response.read().decode("utf-8")
@@ -115,7 +135,7 @@ class HexDB:
             headers["Authorization"] = f"Bearer {self.token}"
         req = urllib.request.Request(self.base + path, data=data, method=method, headers=headers)
         try:
-            response = urllib.request.urlopen(req, timeout=timeout or self.timeout, context=self._context)
+            response = self._opener.open(req, timeout=timeout or self.timeout)
         except urllib.error.HTTPError as e:
             text = e.read().decode("utf-8", "replace")
             e.close()

{hexdb-1.6.0 → hexdb-2.0.0}/hexdb.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hexdb
-Version: 1.6.0
+Version: 2.0.0
 Summary: Client for HexDB, the hexagonal document database.
 Author: Dream In Hex
 License-Expression: Apache-2.0

{hexdb-1.6.0 → hexdb-2.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "hexdb"
-version = "1.6.0"
+version = "2.0.0"
 description = "Client for HexDB, the hexagonal document database."
 readme = "README.md"
 requires-python = ">=3.9"

{hexdb-1.6.0 → hexdb-2.0.0}/tests/test_client.py

@@ -146,3 +146,64 @@ class ClientTest(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class RedirectTests(unittest.TestCase):
+    """The API key isn't sent to another server on a redirect."""
+
+    def test_api_key_stays_with_its_server(self):
+        import http.server
+        import threading
+
+        seen = {}
+
+        def server(handler):
+            httpd = http.server.HTTPServer(("127.0.0.1", 0), handler)
+            threading.Thread(target=httpd.serve_forever, daemon=True).start()
+            return httpd
+
+        class Other(http.server.BaseHTTPRequestHandler):
+            def do_GET(self):
+                seen["other"] = self.headers.get("Authorization")
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.end_headers()
+                self.wfile.write(b"{}")
+
+            def log_message(self, *args):
+                pass
+
+        other = server(Other)
+        target = "http://127.0.0.1:%d/landing" % other.server_address[1]
+
+        class First(http.server.BaseHTTPRequestHandler):
+            def do_GET(self):
+                seen.setdefault("first", self.headers.get("Authorization"))
+                if self.path == "/same":
+                    self.send_response(302)
+                    self.send_header("Location", "/landing")
+                elif self.path == "/landing":
+                    seen["same"] = self.headers.get("Authorization")
+                    self.send_response(200)
+                    self.send_header("Content-Type", "application/json")
+                    self.end_headers()
+                    self.wfile.write(b"{}")
+                    return
+                else:
+                    self.send_response(302)
+                    self.send_header("Location", target)
+                self.end_headers()
+
+            def log_message(self, *args):
+                pass
+
+        first = server(First)
+        client = HexDB("http://127.0.0.1:%d" % first.server_address[1], "hxk_secret")
+        client.request("GET", "/same")
+        self.assertEqual(seen["same"], "Bearer hxk_secret", "kept on the same server")
+        client.request("GET", "/elsewhere")
+        self.assertEqual(seen["first"], "Bearer hxk_secret")
+        self.assertIsNone(seen["other"], "dropped for another server")
+        first.shutdown()
+        other.shutdown()
+