http2py 0.1.33__tar.gz → 0.1.35__tar.gz

{http2py-0.1.33 → http2py-0.1.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: http2py
-Version: 0.1.33
+Version: 0.1.35
 Summary: Tools to create python binders to http web services.
 Project-URL: Homepage, https://github.com/i2mint/http2py
 Project-URL: Repository, https://github.com/i2mint/http2py
@@ -16,8 +16,7 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
-Requires-Dist: argh
-Requires-Dist: dill
+Requires-Dist: cw<0.2,>=0.1.1
 Requires-Dist: glom
 Requires-Dist: i2
 Requires-Dist: importlib-resources
@@ -28,6 +27,7 @@ Provides-Extra: dev
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
 Requires-Dist: ruff>=0.1.0; extra == 'dev'
+Requires-Dist: setuptools; extra == 'dev'
 Description-Content-Type: text/markdown
 
 **Note: A new, lighterweight, more modern replacement: [ho](https://github.com/i2mint/ho)**

http2py-0.1.35/conftest.py

@@ -0,0 +1,18 @@
+"""Pytest configuration for the http2py repository.
+
+``http2py/tests`` stands up a real ``py2http`` web service, so it depends on a
+test-only package that is not one of http2py's declared dependencies. Under
+``--doctest-modules`` an unimportable module is not a single failing test: it
+aborts collection for the whole session. So that directory is excluded here.
+
+CI excludes the same path via ``[tool.wads.ci.testing].exclude_paths`` in
+pyproject.toml, which the wads ``run-tests-uv`` action turns into ``--ignore``
+flags. Repeating it here is what makes a bare ``pytest`` (no flags, e.g. a local
+run or an editor's test runner) behave the same way as CI.
+``tests/test_ci_collection_contract.py`` asserts the two lists stay in
+agreement, so they cannot drift apart silently.
+"""
+
+collect_ignore = [
+    "http2py/tests",
+]

{http2py-0.1.33 → http2py-0.1.35}/http2py/api_pkg_maker.py

@@ -3,21 +3,32 @@
 Given a spec (or the URL of one), :func:`mk_api_pkg` writes a small source
 distribution whose functions are bound to the service's routes.
 
-Note: this module imports ``setuptools.sandbox``, which modern setuptools no
-longer provides, so importing it raises ``ImportError``. It is kept in place
-pending a decision (rewrite or remove) and is excluded from test collection;
-see the repo-root ``conftest.py``.
+The sdist is built by running ``setup.py sdist`` in a subprocess. This module
+used to call ``setuptools.sandbox.run_setup``, which modern setuptools no longer
+ships -- so merely *importing* it raised ``ImportError`` and the
+``api-pkg-maker`` console script could not start at all (i2mint/http2py#14).
+The subprocess is also better behaved: ``sandbox.run_setup`` needed the process
+to ``os.chdir`` into the build directory and never came back.
+
+``setuptools`` is still needed to *run* :func:`mk_api_pkg`, but it is
+deliberately NOT a declared dependency of http2py: it is needed by this one
+function, not by ``import http2py``, and a virtualenv created by ``uv`` does not
+ship it. :func:`_check_build_backend` turns its absence into an actionable
+message instead of a subprocess exit code.
 """
 
-import argh
 import os
 import shutil
+import subprocess
+import sys
 import tempfile
 from http2py.client import HttpClient
 from datetime import datetime, timezone
-from setuptools import sandbox
 
-OUTPUT_DIR = os.path.join(os.environ["HOME"], "http2py", "api_pkgs")
+#: Where built packages are written. ``expanduser`` rather than
+#: ``os.environ["HOME"]``: the latter is a module-import-time ``KeyError`` on
+#: Windows, which would take the whole package down with it.
+OUTPUT_DIR = os.path.join(os.path.expanduser("~"), "http2py", "api_pkgs")
 
 INIT_FILE_TPL = """from .funcs import {funcs}
 """
@@ -111,6 +122,8 @@ def mk_api_pkg(
         with open(filepath, "w") as file:
             print(content, file=file)
 
+    _check_build_backend()
+
     tempdir = tempfile.mkdtemp()
     try:
         api = HttpClient(openapi_spec=openapi_spec, url=openapi_url)
@@ -148,8 +161,20 @@ def mk_api_pkg(
             filepath=os.path.join(tempdir, f"setup.cfg"), content=setup_cfg_content
         )
         create_file(filepath=os.path.join(tempdir, f"setup.py"), content=SETUP_PY)
-        os.chdir(tempdir)
-        sandbox.run_setup("setup.py", ["sdist"])
+        build = subprocess.run(
+            [sys.executable, "setup.py", "sdist"],
+            cwd=tempdir,
+            capture_output=True,
+            text=True,
+        )
+        if build.returncode != 0:
+            # check=True would raise a CalledProcessError carrying only the exit
+            # status, discarding the captured output that says what went wrong.
+            raise RuntimeError(
+                f"`setup.py sdist` failed (exit {build.returncode}) while building "
+                f"{pkg_name!r}.\n--- stdout ---\n{build.stdout}"
+                f"\n--- stderr ---\n{build.stderr}"
+            )
         pkg_filename = f"{pkg_name}-{pkg_version}.tar.gz"
         if not os.path.exists(OUTPUT_DIR):
             os.makedirs(OUTPUT_DIR)
@@ -161,9 +186,34 @@ def mk_api_pkg(
         shutil.rmtree(tempdir)
 
 
+def _check_build_backend():
+    """Fail early and legibly when the interpreter cannot build an sdist.
+
+    ``setup.py sdist`` needs setuptools in the *subprocess's* interpreter, which
+    is this one. Environments created by ``uv`` (and ``python -m venv
+    --without-pip``) do not have it. Without this check the user sees a bare
+    ``CalledProcessError`` with an exit status and no cause.
+    """
+    import importlib.util
+
+    if importlib.util.find_spec("setuptools") is None:
+        raise RuntimeError(
+            "mk_api_pkg builds a source distribution with `setup.py sdist`, "
+            f"which needs setuptools in {sys.executable}. Install it with: "
+            f"{sys.executable} -m pip install setuptools"
+        )
+
+
 def main():
-    argh.dispatch_command(mk_api_pkg)
+    """Entry point for the ``api-pkg-maker`` console script; returns the exit code.
+
+    ``cw.dispatch`` returns the code rather than exiting, and
+    ``[project.scripts]`` wraps this in ``sys.exit(main())``.
+    """
+    import cw
+
+    return cw.dispatch(mk_api_pkg)
 
 
 if __name__ == "__main__":
-    main()
+    raise SystemExit(main())

{http2py-0.1.33 → http2py-0.1.35}/http2py/cli_maker.py

@@ -1,10 +1,14 @@
 """Turn an http-bound python object into a command line interface.
 
 Signatures are first made argparse-friendly (:func:`mk_argparse_friendly`),
-then dispatched with ``argh`` by :func:`mk_cli` / :func:`dispatch_cli`.
+then turned into a parser by :func:`mk_cli` and run by :func:`dispatch_cli`.
+
+The parser is built by ``cw``. Its ``BY_NAME_IF_KWONLY`` naming is what
+reproduces the grammar this module has always produced -- see
+:data:`CLI_CONVENTION`.
 """
 
-import argh
+import dataclasses
 from functools import wraps
 from glom import glom
 from inspect import signature
@@ -15,11 +19,30 @@ import requests
 from collections.abc import Callable, Iterable
 import yaml
 
+import cw
+
 from i2.io_trans import JSONAnnotAndDfltIoTrans
 from i2.signatures import set_signature_of_func, Sig, KO
 from http2py import HttpClient
 from http2py.authentication import mk_auth, DFLT_CONFIG_FILENAME
 
+#: How the command line is derived from a signature.
+#:
+#: Every function :func:`register_cli_method` builds has KEYWORD-ONLY parameters
+#: only (plus ``*args``/``**kwargs`` on a no-argument route), because
+#: :func:`Sig.merge_with_sig` is called with ``kind=KO``. For that shape,
+#: ``BY_NAME_IF_KWONLY`` is what reproduces the grammar this module produced
+#: under argh: every parameter is an option, required exactly when it has no
+#: default -- ``get-thing -u UID -p PID [-l LIMIT]``.
+#:
+#: cw's ``ARGH`` default (``BY_NAME_IF_HAS_DEFAULT``) would NOT: it turns a
+#: keyword-only parameter with no default into a *positional*, so every required
+#: API argument would silently change spelling. That is not a cw bug -- it
+#: faithfully reproduces argh's *explicit* ``BY_NAME_IF_HAS_DEFAULT`` policy.
+#: This module never selected a policy, and argh's no-policy legacy mode is the
+#: one that matches ``BY_NAME_IF_KWONLY`` here.
+CLI_CONVENTION = dataclasses.replace(cw.ARGH, naming=cw.BY_NAME_IF_KWONLY)
+
 
 def mk_sig_argparse_friendly(sig):
     """Modifies a signature to change all leading underscores in param names
@@ -109,15 +132,20 @@ def mk_cli(
         for methodname, method in client_details.__dict__.items()
         if getattr(method, "method_spec", None)
     ]
-    parser = argh.ArghParser()
-    parser.add_commands(cli_methods)
-    return parser
+    return cw.mk_parser(cli_methods, convention=CLI_CONVENTION)
 
 
 def dispatch_cli(*args, **kwargs):
-    """Makes a CLI parser with mk_cli and then dispatches it (see documentation of mk_cli)"""
-    parser = mk_cli(*args, **kwargs)
-    parser.dispatch()
+    """Makes a CLI parser with mk_cli and then runs it (see documentation of mk_cli)
+
+    Returns ``None`` when the command ran, and raises ``SystemExit(2)`` on a
+    command-line error -- the same two outcomes the previous argh-based
+    implementation produced. ``cw.run`` *returns* the exit code rather than
+    exiting, so the non-zero case is re-raised here.
+    """
+    code = cw.run(mk_cli(*args, **kwargs))
+    if code:
+        raise SystemExit(code)
 
 
 set_signature_of_func(dispatch_cli, signature(mk_cli))

{http2py-0.1.33 → http2py-0.1.35}/http2py/client.py

@@ -10,9 +10,11 @@ from i2.errors import AuthorizationError
 
 from http2py.authentication import mk_auth, DFLT_CONFIG_FILENAME
 from http2py.py2request import (
+    DFLT_BINARY_DUMPS,
     mk_method_spec_from_openapi_method_spec,
     mk_request_function,
 )
+from http2py.decorators import check_loads
 from http2py.global_state import get_global_state
 
 
@@ -37,6 +39,9 @@ class HttpClient:
         session_state=None,
         base_url=None,
         verify_cert=True,
+        *,
+        binary_loads=None,
+        binary_dumps=DFLT_BINARY_DUMPS,
         **auth_kwargs,
     ):
         """
@@ -47,6 +52,13 @@ class HttpClient:
         :param session: A session for HTTP requests
         :param base_url: A base url to enforce if you don't want to take the base url from the OpenAPI spec
         :param verify_cert: If True, it verifies the SSL certificate validity for each https request.
+        :param binary_loads: How to decode binary (octet-stream) responses. By
+            default they are NOT unpickled (that would let the server run code on
+            this client) and raise ``BinaryResponseNotDecoded``; pass ``bytes``,
+            a decoder of your own, or ``http2py.decorators.unsafe_pickle_loads``
+            if the server is fully trusted.
+        :param binary_dumps: How to encode binary request bodies (default
+            ``pickle.dumps``).
 
         :Keyword Arguments:
             * *api_key*
@@ -56,6 +68,9 @@ class HttpClient:
 
         """
         self.verify_cert = verify_cert
+        check_loads(binary_loads)
+        self.binary_loads = binary_loads
+        self.binary_dumps = binary_dumps
         if url and not openapi_spec:
             openapi_spec = get(url, verify=self.verify_cert).json()
         self.openapi_spec = openapi_spec
@@ -125,7 +140,11 @@ class HttpClient:
             content_type=content_type,
         )
         func = mk_request_function(
-            method_spec, dispatch=self.handle_request, verify_cert=self.verify_cert
+            method_spec,
+            dispatch=self.handle_request,
+            verify_cert=self.verify_cert,
+            binary_loads=self.binary_loads,
+            binary_dumps=self.binary_dumps,
         )
         func.method_spec = method_spec
         func.content_type = content_type

http2py-0.1.35/http2py/decorators.py

@@ -0,0 +1,142 @@
+"""Response handling: map http status codes to exceptions, decode the payload.
+
+``handle_json_resp`` / ``handle_binary_resp`` / ``handle_raw_resp`` wrap an
+output transformation so it only ever sees a successful response of the
+expected content type.
+
+Binary (``application/octet-stream``) responses are never unpickled unless asked:
+unpickling runs code chosen by whoever produced the bytes, so a spoofed or
+compromised server could run code on the client. Pass ``loads=`` to
+``handle_binary_resp`` (or ``binary_loads=`` to ``mk_request_function`` /
+``HttpClient``): ``bytes`` for the raw content, a decoder of your own, or
+``unsafe_pickle_loads`` if (and only if) the server is fully trusted.
+
+>>> class Resp:
+...     status_code, content = 200, b'raw bytes'
+>>> handle_binary_resp(lambda x: x, loads=bytes)(Resp())
+b'raw bytes'
+>>> handle_binary_resp(lambda x: x)(Resp())  # doctest: +ELLIPSIS
+Traceback (most recent call last):
+  ...
+http2py.decorators.BinaryResponseNotDecoded: Got a binary response but no loads=... to decode it. ...
+"""
+
+import os
+import pickle
+import sys
+import warnings
+from collections.abc import Callable
+from functools import partial
+from typing import Any, Optional
+
+from i2.errors import (
+    AuthorizationError,
+    ForbiddenError,
+    InputError,
+    NotFoundError,
+    DuplicateRecordError,
+)
+
+from http2py.constants import BINARY_CONTENT_TYPE, JSON_CONTENT_TYPE, RAW_CONTENT_TYPE
+
+
+def _handle_error(resp):
+    if resp.status_code == 400:
+        if resp.reason == "AuthorizationError":
+            raise AuthorizationError(resp.text)
+        if resp.reason == "InputError":
+            raise InputError(resp.text)
+        if resp.reason == "DuplicateRecordError":
+            raise DuplicateRecordError(resp.text)
+    if resp.status_code == 403:
+        raise ForbiddenError(resp.text)
+    if resp.status_code == 404:
+        raise NotFoundError(resp.text)
+    raise RuntimeError(resp.text)
+
+
+class BinaryResponseNotDecoded(ValueError):
+    """A binary response arrived, but no ``loads`` was given to decode it."""
+
+
+def unsafe_pickle_loads(data: bytes) -> Any:
+    """Unpickle ``data``. UNSAFE on anything an untrusted server can send.
+
+    Unpickling runs code chosen by whoever produced the bytes, so use this only
+    when the server (and the network path to it) is fully trusted. It exists so
+    that opting into pickled responses is explicit and visible at the call site::
+
+        HttpClient(spec, binary_loads=unsafe_pickle_loads)
+    """
+    return pickle.loads(data)
+
+
+_PACKAGE_DIR = os.path.dirname(os.path.abspath(__file__)) + os.sep
+
+
+def _stacklevel_outside_package() -> int:
+    """The ``stacklevel`` (for a ``warn`` called by our caller) of the first frame
+    outside http2py, so a warning points at the user's line, however deep in
+    http2py it was raised; and repeated checks of one call collapse into one."""
+    frame, level = sys._getframe(1), 1
+    while frame is not None and frame.f_code.co_filename.startswith(_PACKAGE_DIR):
+        frame, level = frame.f_back, level + 1
+    return level
+
+
+def check_loads(loads) -> None:
+    """Validate a ``loads=`` / ``binary_loads=`` argument: ``None`` or a callable.
+
+    ``pickle.loads`` itself gets a warning suggesting ``unsafe_pickle_loads``.
+    That is advice, not a guard: any other callable (a ``partial`` of
+    ``pickle.loads``, ``dill.loads``, ...) is trusted as given.
+    """
+    if loads is None:
+        return
+    if not callable(loads):
+        raise TypeError(f"loads must be callable, got {loads!r}")
+    if loads is pickle.loads:
+        warnings.warn(
+            "loads=pickle.loads unpickles server data, which lets a spoofed or "
+            "compromised server run code on this client. Use "
+            "loads=unsafe_pickle_loads to make that choice explicit, and only if "
+            "the server is fully trusted.",
+            stacklevel=_stacklevel_outside_package(),
+        )
+
+
+def _handle_resp(func, content_type, *, loads: Optional[Callable[[bytes], Any]] = None):
+    check_loads(loads)
+
+    def output_trans(resp):
+        if resp.status_code == 200:
+            if content_type == JSON_CONTENT_TYPE:
+                output = resp.json()
+            elif content_type == BINARY_CONTENT_TYPE:
+                if loads is None:
+                    raise BinaryResponseNotDecoded(
+                        "Got a binary response but no loads=... to decode it. "
+                        "Binary responses are no longer unpickled by default, "
+                        "since unpickling lets the server run code on this "
+                        "client. Pass binary_loads=bytes for the raw content, a "
+                        "decoder of your own, or binary_loads=unsafe_pickle_loads "
+                        "(from http2py.decorators) if the server is fully trusted."
+                    )
+                output = loads(resp.content)
+            elif content_type == RAW_CONTENT_TYPE:
+                output = resp.text
+            else:
+                raise NotImplementedError(
+                    f"Response of type {content_type} is not supported yet."
+                )
+            return func(output)
+        else:
+            _handle_error(resp)
+
+    output_trans.content_type = content_type
+    return output_trans
+
+
+handle_json_resp = partial(_handle_resp, content_type=JSON_CONTENT_TYPE)
+handle_binary_resp = partial(_handle_resp, content_type=BINARY_CONTENT_TYPE)
+handle_raw_resp = partial(_handle_resp, content_type=RAW_CONTENT_TYPE)

{http2py-0.1.33 → http2py-0.1.35}/http2py/example_cli.py

@@ -1,6 +1,6 @@
 """A tiny worked example of the CLI-making tools, used by the docs and by hand."""
 
-import argh
+import cw
 from collections.abc import Iterable
 
 from http2py.cli_maker import mk_argparse_friendly
@@ -13,6 +13,11 @@ def myfun(a: int, b: Iterable[int]):
 
 
 if __name__ == "__main__":
-    parser = argh.ArghParser()
-    parser.add_commands([mk_argparse_friendly(AnnotAndDfltIoTrans()(myfun))])
-    parser.dispatch()
+    from http2py.cli_maker import CLI_CONVENTION
+
+    raise SystemExit(
+        cw.dispatch(
+            [mk_argparse_friendly(AnnotAndDfltIoTrans()(myfun))],
+            convention=CLI_CONVENTION,
+        )
+    )

{http2py-0.1.33 → http2py-0.1.35}/http2py/py2request.py

@@ -54,12 +54,19 @@ from http2py.constants import (
 )
 
 from http2py.util import I2mintModuleNotFoundErrorNiceMessage, is_jsonable
+from http2py.decorators import check_loads, handle_binary_resp
 from http2py.default_configs import (
     default_json_output_trans,
     default_text_output_trans,
-    default_binary_output_trans,
+    _default_output_trans,
 )
 
+# Binary request bodies are pickled by default. That is safe for this client (it
+# only serializes its own arguments), but a server must opt into unpickling them
+# (py2http's ``handle_binary_req(..., loads=unsafe_pickle_loads)``), so pass
+# ``binary_dumps=`` to match whatever decoder the server uses.
+DFLT_BINARY_DUMPS = pickle.dumps
+
 # TODO: Do we really need this anymore?
 with I2mintModuleNotFoundErrorNiceMessage():
     from i2.util import inject_method, imdict
@@ -130,7 +137,13 @@ def mk_param_spec_from_arg_schema(arg, required=False):
 # TODO: Deprecated output_trans in favor of egress, for consistency with other i2imint?
 # TODO: Use method_spec object that has more schema, signature, and validation.
 def mk_request_function(
-    method_spec, *, function_kind="method", dispatch=request, verify_cert=True
+    method_spec,
+    *,
+    function_kind="method",
+    dispatch=request,
+    verify_cert=True,
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ):
     """
     Makes function that will make http requests for you, on your own terms.
@@ -165,11 +178,19 @@ def mk_request_function(
         - 'wraps': A function whose signature we should use as the output's function's signature
 
     :param method_spec: Specification of how to convert arguments of the function that is being made to an http request.
+    :param binary_loads: How to decode a binary (octet-stream) response, when
+        ``method_spec`` has no ``output_trans``. ``None`` (the default) raises
+        ``BinaryResponseNotDecoded`` on such a response rather than unpickling
+        it; pass ``bytes`` for the raw content, a decoder of your own, or
+        ``http2py.decorators.unsafe_pickle_loads`` if the server is fully trusted.
+    :param binary_dumps: How to encode the arguments of a binary request body
+        (default ``pickle.dumps``; see ``DFLT_BINARY_DUMPS``).
     :return: A function.
         Note: I say "function", but the function is meant to be a method, so the function has a self as first argument.
         That argument is ignored.
 
     """
+    check_loads(binary_loads)
     if isinstance(method_spec, str):
         # If method_spec is a string, assume it's a url_template with a get method
         # like 'http://myapi.com/search?q={search_term}'
@@ -202,7 +223,7 @@ def mk_request_function(
         elif response_type == JSON_CONTENT_TYPE:
             output_trans = default_json_output_trans
         else:
-            output_trans = default_binary_output_trans
+            output_trans = handle_binary_resp(_default_output_trans, loads=binary_loads)
 
     wraps_func = method_spec.pop("wraps", None)
 
@@ -261,7 +282,7 @@ def mk_request_function(
                     )
                 _request_kwargs["data"] = json.dumps(json_kwargs)
             elif content_type == BINARY_CONTENT_TYPE:
-                _request_kwargs["data"] = pickle.dumps(kwargs)
+                _request_kwargs["data"] = binary_dumps(kwargs)
         elif content_type == FORM_CONTENT_TYPE:
             fields = json.dumps(json_kwargs).encode("utf-8")
             binaries = {k: (f"{k}.bin", v) for k, v in binary_kwargs.items()}
@@ -396,7 +417,15 @@ class Py2Request:
             self._inject_method(method_name, method_spec, method_func_from_method_spec)
 
     def _process_method_specs(self):
-        if self._dflt_method_func_from_method_spec == mk_request_function:  # TODO: WTF!
+        # (also when it is a functools.partial of it, e.g. with binary_loads=...)
+        if (
+            getattr(
+                self._dflt_method_func_from_method_spec,
+                "func",
+                self._dflt_method_func_from_method_spec,
+            )
+            is mk_request_function
+        ):  # TODO: WTF!
 
             def gen():
                 for method_name, method_spec in self._method_specs.items():
@@ -702,6 +731,8 @@ def mk_request_func_from_openapi_spec(
     content_type=JSON_CONTENT_TYPE,
     input_trans=None,
     output_trans=None,
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ):
     base_url = openapi_spec["servers"][0]["url"]
     if base_url.endswith("/"):
@@ -719,7 +750,12 @@ def mk_request_func_from_openapi_spec(
         output_trans=output_trans,
     )
 
-    func = mk_request_function(method_spec, function_kind="function")
+    func = mk_request_function(
+        method_spec,
+        function_kind="function",
+        binary_loads=binary_loads,
+        binary_dumps=binary_dumps,
+    )
     openapi_props = glom(
         spec, f"requestBody.content.{content_type}.schema.properties", default={}
     )
@@ -780,10 +816,13 @@ def openapi_to_py(
     path_to_func_name: Callable[[str, str], str] = default_path_to_func_name,
     servers: list | None = None,
     default_server_url: str = "http://localhost:8000",
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ) -> dict[str, Callable]:
     """
     Given an OpenAPI spec dict, returns a dict mapping function names to request functions.
     The `servers` argument overrides or provides a default for the OpenAPI servers field.
+    `binary_loads` / `binary_dumps` are passed to `mk_request_function`.
     """
     # Patch the spec with servers if needed
     patched_spec = dict(openapi_spec)
@@ -799,7 +838,13 @@ def openapi_to_py(
     result = {}
     for method, uri in paths:
         func_name = path_to_func_name(method, uri)
-        func = mk_request_func_from_openapi_spec(uri, patched_spec, method=method)
+        func = mk_request_func_from_openapi_spec(
+            uri,
+            patched_spec,
+            method=method,
+            binary_loads=binary_loads,
+            binary_dumps=binary_dumps,
+        )
         result[func_name] = func
     return result
 

{http2py-0.1.33 → http2py-0.1.35}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "http2py"
-version = "0.1.33"
+version = "0.1.35"
 description = "Tools to create python binders to http web services."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -34,15 +34,9 @@ dependencies = [
     "i2",
     "ju",
     "requests",
-    "argh",
+    "cw>=0.1.1,<0.2",
     "PyYAML",
     "importlib_resources",
-    # TEMPORARY, not imported by http2py: ju/oas.py has an unconditional (and
-    # unused) `import dill` while not declaring dill, so a cold `pip install
-    # http2py` dies on `import ju`. Tracked upstream as i2mint/ju#6. Remove this
-    # line once a fixed ju is released -- tests/test_dependency_workarounds.py
-    # fails as soon as that happens, so it will not be forgotten.
-    "dill",
 ]
 
 [project.urls]
@@ -57,6 +51,11 @@ dev = [
     "pytest>=7.0",
     "pytest-cov>=4.0",
     "ruff>=0.1.0",
+    # Not a runtime dependency of the package: `mk_api_pkg` shells out to
+    # `setup.py sdist`, so setuptools is needed to exercise it. A uv-created
+    # venv does not ship setuptools, so without this the end-to-end
+    # api_pkg_maker test would silently skip in CI.
+    "setuptools",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -160,15 +159,16 @@ coverage_threshold = 0
 coverage_report_format = [
     "term",
 ]
-# `http2py.api_pkg_maker` imports `setuptools.sandbox`, which modern setuptools
-# no longer ships, so the module raises ImportError on import and would abort
-# the whole collection. Whether to rewrite it or drop it is still open on
-# issue #14; excluding it from collection is the reversible middle course.
-# The same two paths are repeated in the repo-root conftest.py so that a bare
-# `pytest` behaves like CI -- tests/test_ci_collection_contract.py keeps the
-# two lists in agreement.
+# `http2py/tests` stands up a real py2http web service, so it needs a test-only
+# dependency that CI does not install. Excluding it from collection is what keeps
+# `pytest --doctest-modules` from aborting the session on the import.
+# (`http2py/api_pkg_maker.py` used to be excluded here too, because
+# `setuptools.sandbox` no longer exists and the module was unimportable. It is
+# fixed and collected again -- see issue #14.)
+# This path is repeated in the repo-root conftest.py so that a bare `pytest`
+# behaves like CI -- tests/test_ci_collection_contract.py keeps the two lists
+# in agreement.
 exclude_paths = [
-    "http2py/api_pkg_maker.py",
     "http2py/tests",
 ]
 test_on_windows = false

http2py-0.1.35/tests/cli_goldens/mk_cli.json

@@ -0,0 +1,10 @@
+{
+ "recorded_from": "argh 0.31.3 via ArghParser().add_commands(...) with NO explicit name-mapping policy -- argh's legacy mode, which is what http2py.cli_maker.mk_cli used before the cw migration",
+ "note": "Normalised usage lines only: CPython rewrites --help bodies between versions and CI spans 3.10 and 3.12.",
+ "usages": {
+  "__top__": "usage: PROG [-h] {get-thing,make,plain} ...",
+  "get-thing": "usage: PROG get-thing [-h] -u UID -p PID [-v VERBOSE] [-l LIMIT] [-a API_KEY] [-c CONFIG]",
+  "make": "usage: PROG make [-h] -n NAME [--count COUNT] [-f FLAG] [-a API_KEY] [--config CONFIG]",
+  "plain": "usage: PROG plain [-h] [-a API_KEY] [-c CONFIG] [args ...]"
+ }
+}