icpc-api 0.2.0__tar.gz → 0.2.1__tar.gz

icpc_api-0.2.1/MANIFEST.in

@@ -0,0 +1,4 @@
+graft tests
+include uv.lock
+global-exclude *.py[cod]
+prune **/__pycache__

{icpc_api-0.2.0/icpc_api.egg-info → icpc_api-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: icpc-api
-Version: 0.2.0
+Version: 0.2.1
 Summary: Unofficial Python client and CLI for the icpc.global API
 Author-email: Nikita Sychev <root@nsychev.ru>
 License-Expression: MIT

{icpc_api-0.2.0 → icpc_api-0.2.1}/icpc/__init__.py

@@ -14,7 +14,7 @@ from icpc.errors import ApiError, AuthError, IcpcError, SearchError
 from icpc.facade.client import AsyncIcpc, Icpc, Include
 from icpc.facade.domain import ContestView, Member, Team
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 __all__ = [
     "ApiError",

{icpc_api-0.2.0 → icpc_api-0.2.1}/icpc/auth/store.py

@@ -1,26 +1,20 @@
 """On-disk credential store.
 
 Credentials live in ``~/.config/icpc/credentials.json`` (or under
-``$XDG_CONFIG_HOME``), mode 0600 in a 0700 directory, keyed by username so more
-than one account can be cached without a profile concept. One account is the
-default — the one most recently logged in — so having several cached is never
-ambiguous.
+``$XDG_CONFIG_HOME``), mode 0600 in a 0700 directory. On Windows, where there
+are no mode bits, the file inherits the ACL of the per-user config directory.
 
 The file holds the Cognito tokens and, optionally, the account password.
 
-**The password is stored base64-encoded, which is obfuscation and not encryption.**
-Anyone who can read the file can recover it in one step. It is stored at all
-because this Cognito app client rejects ``REFRESH_TOKEN_AUTH``: the id token dies
-after an hour and SRP needs the plaintext password to mint another, so an
-unattended job has no other way to carry on. The alternative in practice is
-``ICPC_PASSWORD=…`` on a command line, which additionally leaks into shell
-history and every child process.
+icpc.global Cognito rejects ``REFRESH_TOKEN_AUTH``, so the ID Token validity is
+one hour. To renew it unattended, we store the password in the plaintext.
 """
 
 from __future__ import annotations
 
 import base64
 import binascii
+import contextlib
 import json
 import os
 import tempfile
@@ -100,16 +94,17 @@ class CredentialStore:
         fd, tmp_name = tempfile.mkstemp(dir=self.path.parent, prefix=".credentials-")
         tmp = Path(tmp_name)
         try:
-            os.fchmod(fd, 0o600)
-            if default not in accounts:
-                default = None
-            payload = {"version": VERSION, "default": default, "accounts": accounts}
+            # We need to close the file before trying to clean it up.
             with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                _restrict(handle.fileno())
+                if default not in accounts:
+                    default = None
+                payload = {"version": VERSION, "default": default, "accounts": accounts}
                 json.dump(payload, handle, indent=2)
             # Write-then-rename, so a crash cannot leave a truncated file behind.
             tmp.replace(self.path)
         except BaseException:
-            tmp.unlink(missing_ok=True)
+            _discard(tmp)
             raise
 
     # ------------------------------------------------------------ accounts --
@@ -214,6 +209,28 @@ class CredentialStore:
         return sorted(accounts)
 
 
+def _restrict(fd: int) -> None:
+    """Make the open temp file readable by its owner only.
+
+    On Windows, there is no POSIX bits, so don't do anything there.
+    """
+    fchmod = getattr(os, "fchmod", None)
+    if fchmod is None:
+        return
+    try:
+        fchmod(fd, 0o600)
+    except (NotImplementedError, OSError):
+        # Windows implementation of `os.fchmod` has only read-only flag in 3.13.
+        if os.name == "posix":
+            raise
+
+
+def _discard(tmp: Path) -> None:
+    """Remove a half-written temp file, best effort."""
+    with contextlib.suppress(OSError):
+        tmp.unlink(missing_ok=True)
+
+
 def _decode(value: object) -> str | None:
     if not isinstance(value, str) or not value:
         return None

{icpc_api-0.2.0 → icpc_api-0.2.1/icpc_api.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: icpc-api
-Version: 0.2.0
+Version: 0.2.1
 Summary: Unofficial Python client and CLI for the icpc.global API
 Author-email: Nikita Sychev <root@nsychev.ru>
 License-Expression: MIT

{icpc_api-0.2.0 → icpc_api-0.2.1}/icpc_api.egg-info/SOURCES.txt

@@ -57,7 +57,6 @@ icpc_api.egg-info/entry_points.txt
 icpc_api.egg-info/requires.txt
 icpc_api.egg-info/top_level.txt
 tests/__init__.py
-tests/__pycache__/__init__.cpython-312.pyc
 tests/unit/__init__.py
 tests/unit/test_auth.py
 tests/unit/test_columns.py
@@ -70,17 +69,4 @@ tests/unit/test_srp.py
 tests/unit/test_surveys.py
 tests/unit/test_transport.py
 tests/unit/test_transport_parity.py
-tests/unit/test_typing.py
-tests/unit/__pycache__/__init__.cpython-312.pyc
-tests/unit/__pycache__/test_auth.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_columns.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_dsl.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_join.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_models.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_paging.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_reference.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_srp.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_surveys.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_transport.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_transport_parity.cpython-312-pytest-9.1.1.pyc
-tests/unit/__pycache__/test_typing.cpython-312-pytest-9.1.1.pyc
+tests/unit/test_typing.py

{icpc_api-0.2.0 → icpc_api-0.2.1}/tests/unit/test_auth.py

@@ -4,12 +4,15 @@ from __future__ import annotations
 
 import base64
 import json
+import os
 import time
+from pathlib import Path
 
 import httpx
 import pytest
 
 from icpc import errors
+from icpc.auth import store as store_module
 from icpc.auth.flows import CognitoAuth
 from icpc.auth.store import PASSWORD_KEY, CredentialStore
 from icpc.auth.tokens import TokenSet, decode_jwt_claims
@@ -24,6 +27,15 @@ def make_jwt(email: str, exp: float) -> str:
     return f"{part({'alg': 'RS256'})}.{part({'email': email, 'exp': exp})}.signature"
 
 
+def _raise(error: BaseException):
+    """A stand-in that fails, for the failure paths of the credential store."""
+
+    def fail(*_args: object, **_kwargs: object) -> None:
+        raise error
+
+    return fail
+
+
 def cognito(responses: list[dict], seen: list[dict] | None = None) -> CognitoAuth:
     queue = list(responses)
 
@@ -200,8 +212,9 @@ def test_store_round_trips_tokens_and_is_private(tmp_path):
     assert account.tokens == tokens
     assert account.password is None
     assert account.can_renew is False
-    # Credentials; the file must not be readable by anyone else.
-    assert (tmp_path / "credentials.json").stat().st_mode & 0o077 == 0
+    # Credentials; the file must not be readable by anyone else on UNIX.
+    if os.name == "posix":
+        assert (tmp_path / "credentials.json").stat().st_mode & 0o077 == 0
 
 
 def test_password_round_trips_and_enables_renewal(tmp_path):
@@ -307,6 +320,42 @@ def test_store_delete_removes_the_password_too(tmp_path):
     assert store.delete("u@example.com") is False
 
 
+def test_store_writes_on_a_platform_without_fchmod(tmp_path, monkeypatch):
+    # Windows has no POSIX permission bits, and no `os.fchmod` at all before
+    # 3.13. Saving credentials must not depend on either being there.
+    monkeypatch.delattr(os, "fchmod", raising=False)
+
+    store = CredentialStore(tmp_path / "credentials.json")
+    store.save_tokens(TokenSet(id_token="i", username="u@example.com"))
+    store.save_password("u@example.com", "password")
+
+    account = store.load("u@example.com")
+    assert account is not None
+    assert account.password == "password"
+
+
+def test_a_failed_write_leaves_no_temp_file_behind(tmp_path, monkeypatch):
+    store = CredentialStore(tmp_path / "credentials.json")
+    monkeypatch.setattr(store_module, "_restrict", _raise(RuntimeError("write failed")))
+
+    with pytest.raises(RuntimeError, match="write failed"):
+        store.save_tokens(TokenSet(id_token="i", username="u@example.com"))
+    assert list(tmp_path.iterdir()) == []
+
+
+def test_a_failed_write_reports_its_own_error_not_the_cleanup_failure(tmp_path, monkeypatch):
+    # On Windows we don't want to get "the process cannot access the file because it is being
+    # used by another process" instead of a real error.
+    store = CredentialStore(tmp_path / "credentials.json")
+    monkeypatch.setattr(store_module, "_restrict", _raise(RuntimeError("write failed")))
+    monkeypatch.setattr(
+        Path, "unlink", _raise(PermissionError(32, "The process cannot access the file"))
+    )
+
+    with pytest.raises(RuntimeError, match="write failed"):
+        store.save_tokens(TokenSet(id_token="i", username="u@example.com"))
+
+
 def test_missing_or_corrupt_store_is_not_an_error(tmp_path):
     assert CredentialStore(tmp_path / "absent.json").load() is None
     corrupt = tmp_path / "corrupt.json"

icpc_api-0.2.0/MANIFEST.in

@@ -1,2 +0,0 @@
-graft tests
-include uv.lock