http2py 0.1.34__tar.gz → 0.1.35__tar.gz

{http2py-0.1.34 → http2py-0.1.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: http2py
-Version: 0.1.34
+Version: 0.1.35
 Summary: Tools to create python binders to http web services.
 Project-URL: Homepage, https://github.com/i2mint/http2py
 Project-URL: Repository, https://github.com/i2mint/http2py
@@ -17,7 +17,6 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Requires-Dist: cw<0.2,>=0.1.1
-Requires-Dist: dill
 Requires-Dist: glom
 Requires-Dist: i2
 Requires-Dist: importlib-resources

{http2py-0.1.34 → http2py-0.1.35}/http2py/client.py

@@ -10,9 +10,11 @@ from i2.errors import AuthorizationError
 
 from http2py.authentication import mk_auth, DFLT_CONFIG_FILENAME
 from http2py.py2request import (
+    DFLT_BINARY_DUMPS,
     mk_method_spec_from_openapi_method_spec,
     mk_request_function,
 )
+from http2py.decorators import check_loads
 from http2py.global_state import get_global_state
 
 
@@ -37,6 +39,9 @@ class HttpClient:
         session_state=None,
         base_url=None,
         verify_cert=True,
+        *,
+        binary_loads=None,
+        binary_dumps=DFLT_BINARY_DUMPS,
         **auth_kwargs,
     ):
         """
@@ -47,6 +52,13 @@ class HttpClient:
         :param session: A session for HTTP requests
         :param base_url: A base url to enforce if you don't want to take the base url from the OpenAPI spec
         :param verify_cert: If True, it verifies the SSL certificate validity for each https request.
+        :param binary_loads: How to decode binary (octet-stream) responses. By
+            default they are NOT unpickled (that would let the server run code on
+            this client) and raise ``BinaryResponseNotDecoded``; pass ``bytes``,
+            a decoder of your own, or ``http2py.decorators.unsafe_pickle_loads``
+            if the server is fully trusted.
+        :param binary_dumps: How to encode binary request bodies (default
+            ``pickle.dumps``).
 
         :Keyword Arguments:
             * *api_key*
@@ -56,6 +68,9 @@ class HttpClient:
 
         """
         self.verify_cert = verify_cert
+        check_loads(binary_loads)
+        self.binary_loads = binary_loads
+        self.binary_dumps = binary_dumps
         if url and not openapi_spec:
             openapi_spec = get(url, verify=self.verify_cert).json()
         self.openapi_spec = openapi_spec
@@ -125,7 +140,11 @@ class HttpClient:
             content_type=content_type,
         )
         func = mk_request_function(
-            method_spec, dispatch=self.handle_request, verify_cert=self.verify_cert
+            method_spec,
+            dispatch=self.handle_request,
+            verify_cert=self.verify_cert,
+            binary_loads=self.binary_loads,
+            binary_dumps=self.binary_dumps,
         )
         func.method_spec = method_spec
         func.content_type = content_type

http2py-0.1.35/http2py/decorators.py

@@ -0,0 +1,142 @@
+"""Response handling: map http status codes to exceptions, decode the payload.
+
+``handle_json_resp`` / ``handle_binary_resp`` / ``handle_raw_resp`` wrap an
+output transformation so it only ever sees a successful response of the
+expected content type.
+
+Binary (``application/octet-stream``) responses are never unpickled unless asked:
+unpickling runs code chosen by whoever produced the bytes, so a spoofed or
+compromised server could run code on the client. Pass ``loads=`` to
+``handle_binary_resp`` (or ``binary_loads=`` to ``mk_request_function`` /
+``HttpClient``): ``bytes`` for the raw content, a decoder of your own, or
+``unsafe_pickle_loads`` if (and only if) the server is fully trusted.
+
+>>> class Resp:
+...     status_code, content = 200, b'raw bytes'
+>>> handle_binary_resp(lambda x: x, loads=bytes)(Resp())
+b'raw bytes'
+>>> handle_binary_resp(lambda x: x)(Resp())  # doctest: +ELLIPSIS
+Traceback (most recent call last):
+  ...
+http2py.decorators.BinaryResponseNotDecoded: Got a binary response but no loads=... to decode it. ...
+"""
+
+import os
+import pickle
+import sys
+import warnings
+from collections.abc import Callable
+from functools import partial
+from typing import Any, Optional
+
+from i2.errors import (
+    AuthorizationError,
+    ForbiddenError,
+    InputError,
+    NotFoundError,
+    DuplicateRecordError,
+)
+
+from http2py.constants import BINARY_CONTENT_TYPE, JSON_CONTENT_TYPE, RAW_CONTENT_TYPE
+
+
+def _handle_error(resp):
+    if resp.status_code == 400:
+        if resp.reason == "AuthorizationError":
+            raise AuthorizationError(resp.text)
+        if resp.reason == "InputError":
+            raise InputError(resp.text)
+        if resp.reason == "DuplicateRecordError":
+            raise DuplicateRecordError(resp.text)
+    if resp.status_code == 403:
+        raise ForbiddenError(resp.text)
+    if resp.status_code == 404:
+        raise NotFoundError(resp.text)
+    raise RuntimeError(resp.text)
+
+
+class BinaryResponseNotDecoded(ValueError):
+    """A binary response arrived, but no ``loads`` was given to decode it."""
+
+
+def unsafe_pickle_loads(data: bytes) -> Any:
+    """Unpickle ``data``. UNSAFE on anything an untrusted server can send.
+
+    Unpickling runs code chosen by whoever produced the bytes, so use this only
+    when the server (and the network path to it) is fully trusted. It exists so
+    that opting into pickled responses is explicit and visible at the call site::
+
+        HttpClient(spec, binary_loads=unsafe_pickle_loads)
+    """
+    return pickle.loads(data)
+
+
+_PACKAGE_DIR = os.path.dirname(os.path.abspath(__file__)) + os.sep
+
+
+def _stacklevel_outside_package() -> int:
+    """The ``stacklevel`` (for a ``warn`` called by our caller) of the first frame
+    outside http2py, so a warning points at the user's line, however deep in
+    http2py it was raised; and repeated checks of one call collapse into one."""
+    frame, level = sys._getframe(1), 1
+    while frame is not None and frame.f_code.co_filename.startswith(_PACKAGE_DIR):
+        frame, level = frame.f_back, level + 1
+    return level
+
+
+def check_loads(loads) -> None:
+    """Validate a ``loads=`` / ``binary_loads=`` argument: ``None`` or a callable.
+
+    ``pickle.loads`` itself gets a warning suggesting ``unsafe_pickle_loads``.
+    That is advice, not a guard: any other callable (a ``partial`` of
+    ``pickle.loads``, ``dill.loads``, ...) is trusted as given.
+    """
+    if loads is None:
+        return
+    if not callable(loads):
+        raise TypeError(f"loads must be callable, got {loads!r}")
+    if loads is pickle.loads:
+        warnings.warn(
+            "loads=pickle.loads unpickles server data, which lets a spoofed or "
+            "compromised server run code on this client. Use "
+            "loads=unsafe_pickle_loads to make that choice explicit, and only if "
+            "the server is fully trusted.",
+            stacklevel=_stacklevel_outside_package(),
+        )
+
+
+def _handle_resp(func, content_type, *, loads: Optional[Callable[[bytes], Any]] = None):
+    check_loads(loads)
+
+    def output_trans(resp):
+        if resp.status_code == 200:
+            if content_type == JSON_CONTENT_TYPE:
+                output = resp.json()
+            elif content_type == BINARY_CONTENT_TYPE:
+                if loads is None:
+                    raise BinaryResponseNotDecoded(
+                        "Got a binary response but no loads=... to decode it. "
+                        "Binary responses are no longer unpickled by default, "
+                        "since unpickling lets the server run code on this "
+                        "client. Pass binary_loads=bytes for the raw content, a "
+                        "decoder of your own, or binary_loads=unsafe_pickle_loads "
+                        "(from http2py.decorators) if the server is fully trusted."
+                    )
+                output = loads(resp.content)
+            elif content_type == RAW_CONTENT_TYPE:
+                output = resp.text
+            else:
+                raise NotImplementedError(
+                    f"Response of type {content_type} is not supported yet."
+                )
+            return func(output)
+        else:
+            _handle_error(resp)
+
+    output_trans.content_type = content_type
+    return output_trans
+
+
+handle_json_resp = partial(_handle_resp, content_type=JSON_CONTENT_TYPE)
+handle_binary_resp = partial(_handle_resp, content_type=BINARY_CONTENT_TYPE)
+handle_raw_resp = partial(_handle_resp, content_type=RAW_CONTENT_TYPE)

{http2py-0.1.34 → http2py-0.1.35}/http2py/py2request.py

@@ -54,12 +54,19 @@ from http2py.constants import (
 )
 
 from http2py.util import I2mintModuleNotFoundErrorNiceMessage, is_jsonable
+from http2py.decorators import check_loads, handle_binary_resp
 from http2py.default_configs import (
     default_json_output_trans,
     default_text_output_trans,
-    default_binary_output_trans,
+    _default_output_trans,
 )
 
+# Binary request bodies are pickled by default. That is safe for this client (it
+# only serializes its own arguments), but a server must opt into unpickling them
+# (py2http's ``handle_binary_req(..., loads=unsafe_pickle_loads)``), so pass
+# ``binary_dumps=`` to match whatever decoder the server uses.
+DFLT_BINARY_DUMPS = pickle.dumps
+
 # TODO: Do we really need this anymore?
 with I2mintModuleNotFoundErrorNiceMessage():
     from i2.util import inject_method, imdict
@@ -130,7 +137,13 @@ def mk_param_spec_from_arg_schema(arg, required=False):
 # TODO: Deprecated output_trans in favor of egress, for consistency with other i2imint?
 # TODO: Use method_spec object that has more schema, signature, and validation.
 def mk_request_function(
-    method_spec, *, function_kind="method", dispatch=request, verify_cert=True
+    method_spec,
+    *,
+    function_kind="method",
+    dispatch=request,
+    verify_cert=True,
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ):
     """
     Makes function that will make http requests for you, on your own terms.
@@ -165,11 +178,19 @@ def mk_request_function(
         - 'wraps': A function whose signature we should use as the output's function's signature
 
     :param method_spec: Specification of how to convert arguments of the function that is being made to an http request.
+    :param binary_loads: How to decode a binary (octet-stream) response, when
+        ``method_spec`` has no ``output_trans``. ``None`` (the default) raises
+        ``BinaryResponseNotDecoded`` on such a response rather than unpickling
+        it; pass ``bytes`` for the raw content, a decoder of your own, or
+        ``http2py.decorators.unsafe_pickle_loads`` if the server is fully trusted.
+    :param binary_dumps: How to encode the arguments of a binary request body
+        (default ``pickle.dumps``; see ``DFLT_BINARY_DUMPS``).
     :return: A function.
         Note: I say "function", but the function is meant to be a method, so the function has a self as first argument.
         That argument is ignored.
 
     """
+    check_loads(binary_loads)
     if isinstance(method_spec, str):
         # If method_spec is a string, assume it's a url_template with a get method
         # like 'http://myapi.com/search?q={search_term}'
@@ -202,7 +223,7 @@ def mk_request_function(
         elif response_type == JSON_CONTENT_TYPE:
             output_trans = default_json_output_trans
         else:
-            output_trans = default_binary_output_trans
+            output_trans = handle_binary_resp(_default_output_trans, loads=binary_loads)
 
     wraps_func = method_spec.pop("wraps", None)
 
@@ -261,7 +282,7 @@ def mk_request_function(
                     )
                 _request_kwargs["data"] = json.dumps(json_kwargs)
             elif content_type == BINARY_CONTENT_TYPE:
-                _request_kwargs["data"] = pickle.dumps(kwargs)
+                _request_kwargs["data"] = binary_dumps(kwargs)
         elif content_type == FORM_CONTENT_TYPE:
             fields = json.dumps(json_kwargs).encode("utf-8")
             binaries = {k: (f"{k}.bin", v) for k, v in binary_kwargs.items()}
@@ -396,7 +417,15 @@ class Py2Request:
             self._inject_method(method_name, method_spec, method_func_from_method_spec)
 
     def _process_method_specs(self):
-        if self._dflt_method_func_from_method_spec == mk_request_function:  # TODO: WTF!
+        # (also when it is a functools.partial of it, e.g. with binary_loads=...)
+        if (
+            getattr(
+                self._dflt_method_func_from_method_spec,
+                "func",
+                self._dflt_method_func_from_method_spec,
+            )
+            is mk_request_function
+        ):  # TODO: WTF!
 
             def gen():
                 for method_name, method_spec in self._method_specs.items():
@@ -702,6 +731,8 @@ def mk_request_func_from_openapi_spec(
     content_type=JSON_CONTENT_TYPE,
     input_trans=None,
     output_trans=None,
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ):
     base_url = openapi_spec["servers"][0]["url"]
     if base_url.endswith("/"):
@@ -719,7 +750,12 @@ def mk_request_func_from_openapi_spec(
         output_trans=output_trans,
     )
 
-    func = mk_request_function(method_spec, function_kind="function")
+    func = mk_request_function(
+        method_spec,
+        function_kind="function",
+        binary_loads=binary_loads,
+        binary_dumps=binary_dumps,
+    )
     openapi_props = glom(
         spec, f"requestBody.content.{content_type}.schema.properties", default={}
     )
@@ -780,10 +816,13 @@ def openapi_to_py(
     path_to_func_name: Callable[[str, str], str] = default_path_to_func_name,
     servers: list | None = None,
     default_server_url: str = "http://localhost:8000",
+    binary_loads=None,
+    binary_dumps=DFLT_BINARY_DUMPS,
 ) -> dict[str, Callable]:
     """
     Given an OpenAPI spec dict, returns a dict mapping function names to request functions.
     The `servers` argument overrides or provides a default for the OpenAPI servers field.
+    `binary_loads` / `binary_dumps` are passed to `mk_request_function`.
     """
     # Patch the spec with servers if needed
     patched_spec = dict(openapi_spec)
@@ -799,7 +838,13 @@ def openapi_to_py(
     result = {}
     for method, uri in paths:
         func_name = path_to_func_name(method, uri)
-        func = mk_request_func_from_openapi_spec(uri, patched_spec, method=method)
+        func = mk_request_func_from_openapi_spec(
+            uri,
+            patched_spec,
+            method=method,
+            binary_loads=binary_loads,
+            binary_dumps=binary_dumps,
+        )
         result[func_name] = func
     return result
 

{http2py-0.1.34 → http2py-0.1.35}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "http2py"
-version = "0.1.34"
+version = "0.1.35"
 description = "Tools to create python binders to http web services."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -37,12 +37,6 @@ dependencies = [
     "cw>=0.1.1,<0.2",
     "PyYAML",
     "importlib_resources",
-    # TEMPORARY, not imported by http2py: ju/oas.py has an unconditional (and
-    # unused) `import dill` while not declaring dill, so a cold `pip install
-    # http2py` dies on `import ju`. Tracked upstream as i2mint/ju#6. Remove this
-    # line once a fixed ju is released -- tests/test_dependency_workarounds.py
-    # fails as soon as that happens, so it will not be forgotten.
-    "dill",
 ]
 
 [project.urls]

http2py-0.1.35/tests/test_binary_payloads.py

@@ -0,0 +1,189 @@
+"""Binary (octet-stream) responses are never unpickled unless explicitly asked."""
+
+import pickle
+
+import pytest
+
+from http2py import HttpClient, mk_request_function
+from http2py.constants import BINARY_CONTENT_TYPE, JSON_CONTENT_TYPE
+from http2py.decorators import (
+    BinaryResponseNotDecoded,
+    handle_binary_resp,
+    unsafe_pickle_loads,
+)
+
+_calls = []
+
+
+def _record(*args):
+    _calls.append(args)
+    return "ran"
+
+
+class _RunsCodeWhenUnpickled:
+    """Unpickling this calls ``_record``: a harmless stand-in for a payload."""
+
+    def __reduce__(self):
+        return (_record, ("unpickled",))
+
+
+EVIL = pickle.dumps(_RunsCodeWhenUnpickled())
+
+
+class _Resp:
+    status_code = 200
+    text = ""
+
+    def __init__(self, content):
+        self.content = content
+
+
+def _binary_spec(**extra):
+    return dict(
+        method="post",
+        url="http://test.invalid/f",
+        content_type=BINARY_CONTENT_TYPE,
+        response_type=BINARY_CONTENT_TYPE,
+        body_arg_names=["x"],
+        **extra,
+    )
+
+
+def _fake_dispatch(content, sent):
+    def dispatch(method, url, **request_kwargs):
+        sent.append(request_kwargs)
+        return _Resp(content)
+
+    return dispatch
+
+
+def test_binary_response_is_not_unpickled_by_default():
+    _calls.clear()
+    f = mk_request_function(
+        _binary_spec(), function_kind="function", dispatch=_fake_dispatch(EVIL, [])
+    )
+    with pytest.raises(BinaryResponseNotDecoded, match="unsafe_pickle_loads"):
+        f(x=1)
+    assert _calls == []
+
+
+def test_binary_loads_choices():
+    _calls.clear()
+    raw = mk_request_function(
+        _binary_spec(),
+        function_kind="function",
+        dispatch=_fake_dispatch(EVIL, []),
+        binary_loads=bytes,
+    )
+    assert raw(x=1) == EVIL and _calls == []
+
+    trusted = mk_request_function(
+        _binary_spec(),
+        function_kind="function",
+        dispatch=_fake_dispatch(pickle.dumps({"a": 1}), []),
+        binary_loads=unsafe_pickle_loads,
+    )
+    assert trusted(x=1) == {"a": 1}
+
+
+def test_bare_pickle_loads_warns_and_non_callable_is_rejected():
+    with pytest.warns(UserWarning, match="unsafe_pickle_loads"):
+        handle_binary_resp(lambda x: x, loads=pickle.loads)
+    with pytest.raises(TypeError):
+        handle_binary_resp(lambda x: x, loads="pickle")
+
+
+def test_binary_dumps_encodes_request_body():
+    sent = []
+    f = mk_request_function(
+        _binary_spec(),
+        function_kind="function",
+        dispatch=_fake_dispatch(b"ok", sent),
+        binary_loads=bytes,
+        binary_dumps=lambda kwargs: repr(sorted(kwargs.items())).encode(),
+    )
+    f(x=1)
+    assert sent[-1]["data"] == b"[('x', 1)]"
+
+    sent.clear()
+    mk_request_function(
+        _binary_spec(),
+        function_kind="function",
+        dispatch=_fake_dispatch(b"ok", sent),
+        binary_loads=bytes,
+    )(x=1)
+    assert pickle.loads(sent[-1]["data"]) == {"x": 1}  # default stays pickle
+
+
+def test_http_client_passes_binary_loads_through():
+    spec = {
+        "openapi": "3.0.3",
+        "info": {"title": "t", "version": "1"},
+        "servers": [{"url": "http://test.invalid"}],
+        "paths": {
+            "/f": {
+                "post": {
+                    "x-method_name": "f",
+                    "requestBody": {
+                        "content": {
+                            JSON_CONTENT_TYPE: {
+                                "schema": {
+                                    "type": "object",
+                                    "properties": {"x": {"type": "integer"}},
+                                }
+                            }
+                        }
+                    },
+                    "responses": {"200": {"content": {BINARY_CONTENT_TYPE: {}}}},
+                }
+            }
+        },
+    }
+
+    def client(**kwargs):
+        c = HttpClient(
+            spec, session_state={"session": object(), "refresh_inputs": {}}, **kwargs
+        )
+        c.handle_request = _fake_dispatch(EVIL, [])
+        c.register_method("http://test.invalid/f", "post", spec["paths"]["/f"]["post"])
+        return c
+
+    _calls.clear()
+    with pytest.raises(BinaryResponseNotDecoded):
+        client().f(x=1)
+    assert client(binary_loads=bytes).f(x=1) == EVIL
+    assert _calls == []
+
+
+def test_pickle_loads_warning_points_at_the_callers_line():
+    import warnings
+
+    with warnings.catch_warnings(record=True) as caught:
+        warnings.simplefilter("always")
+        mk_request_function(
+            _binary_spec(), function_kind="function", binary_loads=pickle.loads
+        )
+    assert caught and all(w.filename == __file__ for w in caught)
+
+
+def test_bad_binary_loads_is_rejected_even_without_binary_endpoints():
+    with pytest.raises(TypeError):
+        mk_request_function({"url": "http://test.invalid"}, binary_loads="x")
+
+
+def test_py2request_accepts_a_partial_of_mk_request_function():
+    from functools import partial
+
+    from http2py.py2request import Py2Request
+
+    sent = []
+    p = Py2Request(
+        {"get": "http://test.invalid/{x}"},
+        method_func_from_method_spec=partial(
+            mk_request_function,
+            dispatch=_fake_dispatch(b"raw", sent),
+            binary_loads=bytes,
+        ),
+    )
+    p.get(x=1)
+    assert sent

http2py-0.1.34/http2py/decorators.py

@@ -1,59 +0,0 @@
-"""Response handling: map http status codes to exceptions, decode the payload.
-
-``handle_json_resp`` / ``handle_binary_resp`` / ``handle_raw_resp`` wrap an
-output transformation so it only ever sees a successful response of the
-expected content type.
-"""
-
-from functools import partial
-from i2.errors import (
-    AuthorizationError,
-    ForbiddenError,
-    InputError,
-    NotFoundError,
-    DuplicateRecordError,
-)
-import pickle
-
-from http2py.constants import BINARY_CONTENT_TYPE, JSON_CONTENT_TYPE, RAW_CONTENT_TYPE
-
-
-def _handle_error(resp):
-    if resp.status_code == 400:
-        if resp.reason == "AuthorizationError":
-            raise AuthorizationError(resp.text)
-        if resp.reason == "InputError":
-            raise InputError(resp.text)
-        if resp.reason == "DuplicateRecordError":
-            raise DuplicateRecordError(resp.text)
-    if resp.status_code == 403:
-        raise ForbiddenError(resp.text)
-    if resp.status_code == 404:
-        raise NotFoundError(resp.text)
-    raise RuntimeError(resp.text)
-
-
-def _handle_resp(func, content_type):
-    def output_trans(resp):
-        if resp.status_code == 200:
-            if content_type == JSON_CONTENT_TYPE:
-                output = resp.json()
-            elif content_type == BINARY_CONTENT_TYPE:
-                output = pickle.loads(resp.content)
-            elif content_type == RAW_CONTENT_TYPE:
-                output = resp.text
-            else:
-                raise NotImplementedError(
-                    f"Response of type {content_type} is not supported yet."
-                )
-            return func(output)
-        else:
-            _handle_error(resp)
-
-    output_trans.content_type = content_type
-    return output_trans
-
-
-handle_json_resp = partial(_handle_resp, content_type=JSON_CONTENT_TYPE)
-handle_binary_resp = partial(_handle_resp, content_type=BINARY_CONTENT_TYPE)
-handle_raw_resp = partial(_handle_resp, content_type=RAW_CONTENT_TYPE)

http2py-0.1.34/tests/test_dependency_workarounds.py

@@ -1,85 +0,0 @@
-"""Tripwires for dependencies http2py declares but does not itself use.
-
-Right now there is exactly one: ``dill``. ``ju/oas.py`` imports it at module
-level while ``ju`` does not declare it, and ``ju/__init__.py`` imports ``ju.oas``
-eagerly -- so a cold ``pip install http2py`` dies on ``import ju`` with
-``ModuleNotFoundError: No module named 'dill'``. Declaring ``dill`` here is a
-workaround, tracked upstream as i2mint/ju#6.
-
-A workaround with no expiry becomes permanent, so the test below fails the
-moment upstream is fixed (either the import goes away or ``dill`` becomes a
-declared requirement of ``ju``). When it fails, drop ``dill`` from
-``[project].dependencies`` and delete this module.
-
-The check is deliberately static -- it reads ``ju``'s source and metadata rather
-than re-importing ``ju`` with ``dill`` hidden, so it cannot leave a half-imported
-package behind for the rest of the session.
-"""
-
-import ast
-import re
-import sys
-from importlib.metadata import PackageNotFoundError, requires
-from pathlib import Path
-
-import pytest
-
-
-def _ju_oas_source():
-    import ju.oas
-
-    return Path(ju.oas.__file__).read_text()
-
-
-def _module_level_imports(source):
-    """Top-level (non-nested) imported top-level module names."""
-    names = set()
-    for node in ast.parse(source).body:
-        if isinstance(node, ast.Import):
-            names.update(alias.name.split(".")[0] for alias in node.names)
-        elif isinstance(node, ast.ImportFrom) and node.level == 0 and node.module:
-            names.add(node.module.split(".")[0])
-    return names
-
-
-def _declared_requirement_names(distribution):
-    try:
-        reqs = requires(distribution) or []
-    except PackageNotFoundError:  # pragma: no cover - ju is a hard dependency
-        pytest.skip(f"{distribution} is not installed as a distribution")
-    return {re.split(r"[\s\[<>=!;(]", req, maxsplit=1)[0].lower() for req in reqs}
-
-
-def test_dill_workaround_is_still_needed():
-    """Fails once i2mint/ju#6 is released -- then remove the `dill` dependency."""
-    imports_dill = "dill" in _module_level_imports(_ju_oas_source())
-    ju_declares_dill = "dill" in _declared_requirement_names("ju")
-
-    assert imports_dill and not ju_declares_dill, (
-        "ju no longer needs http2py to carry `dill` for it "
-        f"(module-level import: {imports_dill}, declared by ju: {ju_declares_dill}). "
-        "Remove `dill` from [project].dependencies in pyproject.toml and delete "
-        "this module. See i2mint/ju#6."
-    )
-
-
-@pytest.mark.skipif(sys.version_info < (3, 11), reason="tomllib needs Python 3.11+")
-def test_dill_is_declared_while_the_workaround_stands():
-    """The workaround only works if the dependency is actually declared.
-
-    Read from pyproject.toml rather than installed metadata: an editable install
-    freezes its .dist-info at install time, so the metadata of a dev checkout
-    lags the file that CI actually builds from.
-    """
-    import tomllib
-
-    repo_root = Path(__file__).resolve().parent.parent
-    pyproject = tomllib.loads((repo_root / "pyproject.toml").read_text())
-    declared = {
-        re.split(r"[\s\[<>=!;(]", dep, maxsplit=1)[0].lower()
-        for dep in pyproject["project"]["dependencies"]
-    }
-    assert "dill" in declared, (
-        "http2py must declare `dill` while i2mint/ju#6 is open, otherwise a cold "
-        "`pip install http2py` fails at `import ju`."
-    )