htl-verify 1.0.0__tar.gz

htl_verify-1.0.0/PKG-INFO

@@ -0,0 +1,49 @@
+Metadata-Version: 2.4
+Name: htl-verify
+Version: 1.0.0
+Summary: Verify X-Trust signed human-presence headers. Standard library only.
+Author-email: Dieng <diengamine.htl@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/htl-syterme/htl-core
+Project-URL: Repository, https://github.com/htl-syterme/htl-core
+Project-URL: Spec, https://github.com/htl-syterme/htl-core/blob/main/SPEC.md
+Keywords: trust,human-proof,anti-bot,x-trust,llm,ai-infrastructure
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# htl-verify
+
+Verify X-Trust signed human-presence headers in Python. Standard library only.
+
+## Install
+
+    pip install htl-verify
+
+## Use
+
+    from htl_verify import verify, Untrusted
+
+    try:
+        claims = verify(header, key=secret_bytes)
+        score = claims["score"]
+        if score >= 0.5:
+            pass  # annotated as likely-human
+    except Untrusted:
+        pass  # treat as unverified; never blocks by default
+
+## What it is not
+
+Not a CAPTCHA, not identity, not bot authentication. The score is a signal,
+not a proof. A determined client can raise its own score; that is a property
+of any client-side signal and is documented in the project SPEC.
+
+## Wire format
+
+    X-Trust: v1.<payload_b64url>.<sig_b64url>
+
+Payload JSON: `{sub, score, iat, exp, nonce?}`. HMAC-SHA256 over the
+base64url payload. TTL 120s. Score 0..1.

htl_verify-1.0.0/README.md

@@ -0,0 +1,32 @@
+# htl-verify
+
+Verify X-Trust signed human-presence headers in Python. Standard library only.
+
+## Install
+
+    pip install htl-verify
+
+## Use
+
+    from htl_verify import verify, Untrusted
+
+    try:
+        claims = verify(header, key=secret_bytes)
+        score = claims["score"]
+        if score >= 0.5:
+            pass  # annotated as likely-human
+    except Untrusted:
+        pass  # treat as unverified; never blocks by default
+
+## What it is not
+
+Not a CAPTCHA, not identity, not bot authentication. The score is a signal,
+not a proof. A determined client can raise its own score; that is a property
+of any client-side signal and is documented in the project SPEC.
+
+## Wire format
+
+    X-Trust: v1.<payload_b64url>.<sig_b64url>
+
+Payload JSON: `{sub, score, iat, exp, nonce?}`. HMAC-SHA256 over the
+base64url payload. TTL 120s. Score 0..1.

htl_verify-1.0.0/htl_verify/__init__.py

@@ -0,0 +1,67 @@
+"""htl-verify - X-Trust header verifier. Standard library only, zero dependencies."""
+import base64
+import hashlib
+import hmac
+import json
+import time
+from typing import Any
+
+__version__ = "1.0.0"
+__all__ = ["verify", "Untrusted"]
+
+
+class Untrusted(Exception):
+    """Raised when an X-Trust header fails verification."""
+
+
+def _b64d(s: str) -> bytes:
+    pad = "=" * (-len(s) % 4)
+    return base64.urlsafe_b64decode(s + pad)
+
+
+def verify(
+    header: str,
+    key: bytes,
+    *,
+    now: float | None = None,
+    max_age: int = 120,
+) -> dict[str, Any]:
+    """
+    Verify an X-Trust header and return its claims.
+
+    Raises Untrusted on any failure. Never returns a payload whose
+    signature has not been verified first.
+    """
+    if not header:
+        raise Untrusted("empty header")
+    parts = header.split(".")
+    if len(parts) != 3:
+        raise Untrusted("malformed")
+    version, payload_b64, sig_b64 = parts
+    if version != "v1":
+        raise Untrusted(f"unsupported version: {version}")
+
+    payload = _b64d(payload_b64)
+    expected = hmac.new(key, payload_b64.encode("ascii"), hashlib.sha256).digest()
+    provided = _b64d(sig_b64)
+    if not hmac.compare_digest(expected, provided):
+        raise Untrusted("bad signature")
+
+    claims = json.loads(payload)  # only trusted bytes reach the parser
+
+    score = claims.get("score")
+    if not isinstance(score, (int, float)) or score < 0 or score > 1:
+        raise Untrusted("invalid score")
+
+    iat = claims.get("iat")
+    exp = claims.get("exp")
+    if not isinstance(iat, (int, float)) or not isinstance(exp, (int, float)):
+        raise Untrusted("invalid timestamps")
+
+    n = now if now is not None else time.time()
+    if n > exp:
+        raise Untrusted("expired")
+    if n - iat > max_age:
+        raise Untrusted("stale")
+
+    return claims

htl_verify-1.0.0/htl_verify.egg-info/PKG-INFO

@@ -0,0 +1,49 @@
+Metadata-Version: 2.4
+Name: htl-verify
+Version: 1.0.0
+Summary: Verify X-Trust signed human-presence headers. Standard library only.
+Author-email: Dieng <diengamine.htl@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/htl-syterme/htl-core
+Project-URL: Repository, https://github.com/htl-syterme/htl-core
+Project-URL: Spec, https://github.com/htl-syterme/htl-core/blob/main/SPEC.md
+Keywords: trust,human-proof,anti-bot,x-trust,llm,ai-infrastructure
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# htl-verify
+
+Verify X-Trust signed human-presence headers in Python. Standard library only.
+
+## Install
+
+    pip install htl-verify
+
+## Use
+
+    from htl_verify import verify, Untrusted
+
+    try:
+        claims = verify(header, key=secret_bytes)
+        score = claims["score"]
+        if score >= 0.5:
+            pass  # annotated as likely-human
+    except Untrusted:
+        pass  # treat as unverified; never blocks by default
+
+## What it is not
+
+Not a CAPTCHA, not identity, not bot authentication. The score is a signal,
+not a proof. A determined client can raise its own score; that is a property
+of any client-side signal and is documented in the project SPEC.
+
+## Wire format
+
+    X-Trust: v1.<payload_b64url>.<sig_b64url>
+
+Payload JSON: `{sub, score, iat, exp, nonce?}`. HMAC-SHA256 over the
+base64url payload. TTL 120s. Score 0..1.

htl_verify-1.0.0/htl_verify.egg-info/SOURCES.txt

@@ -0,0 +1,7 @@
+README.md
+pyproject.toml
+htl_verify/__init__.py
+htl_verify.egg-info/PKG-INFO
+htl_verify.egg-info/SOURCES.txt
+htl_verify.egg-info/dependency_links.txt
+htl_verify.egg-info/top_level.txt

htl_verify-1.0.0/htl_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

htl_verify-1.0.0/htl_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+htl_verify

htl_verify-1.0.0/pyproject.toml

@@ -0,0 +1,24 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "htl-verify"
+version = "1.0.0"
+description = "Verify X-Trust signed human-presence headers. Standard library only."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [{ name = "Dieng", email = "diengamine.htl@gmail.com" }]
+keywords = ["trust", "human-proof", "anti-bot", "x-trust", "llm", "ai-infrastructure"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+    "Topic :: Internet :: WWW/HTTP :: HTTP Servers",
+    "Topic :: Security",
+]
+
+[project.urls]
+Homepage = "https://github.com/htl-syterme/htl-core"
+Repository = "https://github.com/htl-syterme/htl-core"
+Spec = "https://github.com/htl-syterme/htl-core/blob/main/SPEC.md"

htl_verify-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+