internetdata 2.7.4__tar.gz → 2.8.0__tar.gz

{internetdata-2.7.4 → internetdata-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: internetdata
-Version: 2.7.4
+Version: 2.8.0
 Summary: Official Python client library for the InternetData API. Download and verify licensed IP datasets.
 Project-URL: Homepage, https://internetdata.io
 Project-URL: Documentation, https://docs.internetdata.io

{internetdata-2.7.4 → internetdata-2.8.0}/spec/openapi.yaml

@@ -12,7 +12,7 @@ info:
     email: support@internetdata.io
     url: https://internetdata.io
   termsOfService: https://internetdata.io/terms
-  version: 2026.10.15
+  version: 2026.10.16
 servers:
   - url: https://internetdata.io
 tags:
@@ -653,6 +653,56 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/OauthError'
+  /oauth/register:
+    post:
+      operationId: oauthRegister
+      tags:
+        - Authorization
+      summary: Register
+      description: |
+        RFC 7591 dynamic client registration, for a client that cannot use a
+        Client ID Metadata Document. Post your client's metadata as JSON, then
+        use the `client_id` in the answer at `/oauth/authorize` and
+        `/oauth/token`. Nothing is kept until a person approves your client, so
+        registering again costs nothing and leaves nothing to clean up.
+
+        Each redirect URI must be https on a public host name, or http on a
+        loopback address (`127.0.0.1`, `[::1]`, `localhost`), which then
+        matches on any port. A custom URI scheme is refused: use a loopback
+        redirect instead. So is a host on one of our own domains.
+
+        `client_name` is shown to the person as your client's own claim, with
+        where its redirect goes beside it. A name that renders blank, or mixes
+        Latin letters with Cyrillic or Greek ones, is shown as an unnamed
+        application.
+
+        The client is public whatever you ask for: `token_endpoint_auth_method`
+        comes back `none`, there is no client secret, and every authorization
+        proves itself with PKCE. It may be granted `apikeys.use` at most.
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ClientRegistrationRequest'
+      responses:
+        '201':
+          description: The client, as registered.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/ClientRegistration'
+        '400':
+          description: |
+            `invalid_redirect_uri` names the redirect URI refused and why, and
+            `invalid_client_metadata` anything else, such as a client that
+            does not use the authorization code flow. `slow_down` means this
+            address registered too many clients in the last minute.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OauthError'
   /oauth/authorize:
     get:
       operationId: oauthAuthorize
@@ -669,13 +719,18 @@ paths:
         with `token_endpoint_auth_method` `none` and your `redirect_uris`. An
         https redirect URI must be on the same origin as the `client_id`; a
         loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`)
-        matches on any port. Such a client is granted `apikeys.use` at most.
+        matches on any port. Such a client is granted `apikeys.use` at most. A
+        client registered at `/oauth/register` uses the `client_id` it was
+        given and one of the `redirect_uris` it registered.
 
         An unknown `client_id` or an unregistered `redirect_uri` is shown to the
-        USER and never redirected, because sending an error to an address we
-        have not verified belongs to you is how an open redirector works.
-        Everything else comes back to your `redirect_uri` with `error`, your
-        `state`, and `iss`.
+        person and never redirected, because sending an error to an address we
+        have not verified belongs to you is how an open redirector works. Any
+        other error in the request is shown to the person too: anyone can make a
+        client, so its `redirect_uri` is verified only as its own (RFC 9700
+        section 4.11.2). Only the person's answer comes back to your
+        `redirect_uri`: a `code`, or `error` `access_denied`, each with your
+        `state` and `iss`.
       security: []
       parameters:
         - name: client_id
@@ -731,9 +786,9 @@ paths:
             given that server.
       responses:
         '302':
-          description: A redirect to the consent screen, or back to your redirect_uri with an error.
+          description: A redirect to the consent screen.
         '400':
-          description: Shown to the user. An unverified redirect target is never sent an error.
+          description: Shown to the person. No error in the request is sent to your redirect_uri.
         '429':
           description: Shown to the user. Too many authorizations from one address.
   /oauth/token:
@@ -1485,6 +1540,9 @@ components:
         client_id_metadata_document_supported:
           type: boolean
           description: Any client may sign in with an https `client_id` serving its own metadata.
+        registration_endpoint:
+          type: string
+          description: RFC 7591 dynamic client registration, for a client that cannot serve its own metadata.
         token_endpoint_auth_methods_supported:
           type: array
           items:
@@ -1600,7 +1658,8 @@ components:
           type: string
           description: |
             Not part of OAuth, and only for our own clients: a client that signed
-            in with a Client ID Metadata Document never receives a key. The API
+            in with a Client ID Metadata Document or registered itself never
+            receives a key. The API
             key itself, so a device ends up holding an ordinary key. Returned by
             the device code and authorization code grants only, never by a
             refresh, and only alongside
@@ -1611,6 +1670,70 @@ components:
         - access_token
         - token_type
         - expires_in
+    ClientRegistrationRequest:
+      type: object
+      properties:
+        redirect_uris:
+          type: array
+          items:
+            type: string
+          description: One to ten, each matched exactly, apart from a loopback one's port.
+        client_name:
+          type: string
+          description: >-
+            Shown to the person as your client's own claim, marked unverified, beside where its
+            redirect goes.
+        grant_types:
+          type: array
+          items:
+            type: string
+          description: Must include `authorization_code` when given.
+        response_types:
+          type: array
+          items:
+            type: string
+          description: Must include `code` when given.
+        token_endpoint_auth_method:
+          type: string
+          description: Read as `none`, whatever is sent.
+      required:
+        - redirect_uris
+    ClientRegistration:
+      type: object
+      properties:
+        client_id:
+          type: string
+        client_id_issued_at:
+          type: integer
+          description: Unix seconds.
+        client_name:
+          type: string
+          description: As the person will see it.
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        grant_types:
+          type: array
+          items:
+            type: string
+          description: '`authorization_code` and `refresh_token`.'
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+          description: Always `none`.
+        scope:
+          type: string
+          description: 'The most this client may be granted: `apikeys.use`.'
+      required:
+        - client_id
+        - client_id_issued_at
+        - client_name
+        - redirect_uris
+        - token_endpoint_auth_method
     RevokeRequest:
       type: object
       properties:

{internetdata-2.7.4 → internetdata-2.8.0}/src/internetdata/__init__.py

@@ -39,7 +39,7 @@ from .models import (
     TokenResponse,
 )
 
-__version__ = "2.7.4"
+__version__ = "2.8.0"
 
 __all__ = [
     "DATABASE_FORMATS",

{internetdata-2.7.4 → internetdata-2.8.0}/src/internetdata/_generated/api/authorization/oauth_authorize.py

@@ -105,13 +105,18 @@ def sync_detailed(
     with `token_endpoint_auth_method` `none` and your `redirect_uris`. An
     https redirect URI must be on the same origin as the `client_id`; a
     loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`)
-    matches on any port. Such a client is granted `apikeys.use` at most.
+    matches on any port. Such a client is granted `apikeys.use` at most. A
+    client registered at `/oauth/register` uses the `client_id` it was
+    given and one of the `redirect_uris` it registered.
 
     An unknown `client_id` or an unregistered `redirect_uri` is shown to the
-    USER and never redirected, because sending an error to an address we
-    have not verified belongs to you is how an open redirector works.
-    Everything else comes back to your `redirect_uri` with `error`, your
-    `state`, and `iss`.
+    person and never redirected, because sending an error to an address we
+    have not verified belongs to you is how an open redirector works. Any
+    other error in the request is shown to the person too: anyone can make a
+    client, so its `redirect_uri` is verified only as its own (RFC 9700
+    section 4.11.2). Only the person's answer comes back to your
+    `redirect_uri`: a `code`, or `error` `access_denied`, each with your
+    `state` and `iss`.
 
     Args:
         client_id (str):
@@ -172,13 +177,18 @@ async def asyncio_detailed(
     with `token_endpoint_auth_method` `none` and your `redirect_uris`. An
     https redirect URI must be on the same origin as the `client_id`; a
     loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`)
-    matches on any port. Such a client is granted `apikeys.use` at most.
+    matches on any port. Such a client is granted `apikeys.use` at most. A
+    client registered at `/oauth/register` uses the `client_id` it was
+    given and one of the `redirect_uris` it registered.
 
     An unknown `client_id` or an unregistered `redirect_uri` is shown to the
-    USER and never redirected, because sending an error to an address we
-    have not verified belongs to you is how an open redirector works.
-    Everything else comes back to your `redirect_uri` with `error`, your
-    `state`, and `iss`.
+    person and never redirected, because sending an error to an address we
+    have not verified belongs to you is how an open redirector works. Any
+    other error in the request is shown to the person too: anyone can make a
+    client, so its `redirect_uri` is verified only as its own (RFC 9700
+    section 4.11.2). Only the person's answer comes back to your
+    `redirect_uri`: a `code`, or `error` `access_denied`, each with your
+    `state` and `iss`.
 
     Args:
         client_id (str):

internetdata-2.8.0/src/internetdata/_generated/api/authorization/oauth_register.py

@@ -0,0 +1,246 @@
+from http import HTTPStatus
+from typing import Any
+
+import httpx
+
+from ... import errors
+from ...client import AuthenticatedClient, Client
+from ...models.client_registration import ClientRegistration
+from ...models.client_registration_request import ClientRegistrationRequest
+from ...models.oauth_error import OauthError
+from ...types import Response
+
+
+def _get_kwargs(
+    *,
+    body: ClientRegistrationRequest,
+) -> dict[str, Any]:
+    headers: dict[str, Any] = {}
+
+    _kwargs: dict[str, Any] = {
+        "method": "post",
+        "url": "/oauth/register",
+    }
+
+    _kwargs["json"] = body.to_dict()
+
+    headers["Content-Type"] = "application/json"
+
+    _kwargs["headers"] = headers
+    return _kwargs
+
+
+def _parse_response(
+    *, client: AuthenticatedClient | Client, response: httpx.Response
+) -> ClientRegistration | OauthError | None:
+    if response.status_code == 201:
+        response_201 = ClientRegistration.from_dict(response.json())
+
+        return response_201
+
+    if response.status_code == 400:
+        response_400 = OauthError.from_dict(response.json())
+
+        return response_400
+
+    if client.raise_on_unexpected_status:
+        raise errors.UnexpectedStatus(response.status_code, response.content)
+    else:
+        return None
+
+
+def _build_response(
+    *, client: AuthenticatedClient | Client, response: httpx.Response
+) -> Response[ClientRegistration | OauthError]:
+    return Response(
+        status_code=HTTPStatus(response.status_code),
+        content=response.content,
+        headers=response.headers,
+        parsed=_parse_response(client=client, response=response),
+    )
+
+
+def sync_detailed(
+    *,
+    client: AuthenticatedClient | Client,
+    body: ClientRegistrationRequest,
+) -> Response[ClientRegistration | OauthError]:
+    """Register
+
+     RFC 7591 dynamic client registration, for a client that cannot use a
+    Client ID Metadata Document. Post your client's metadata as JSON, then
+    use the `client_id` in the answer at `/oauth/authorize` and
+    `/oauth/token`. Nothing is kept until a person approves your client, so
+    registering again costs nothing and leaves nothing to clean up.
+
+    Each redirect URI must be https on a public host name, or http on a
+    loopback address (`127.0.0.1`, `[::1]`, `localhost`), which then
+    matches on any port. A custom URI scheme is refused: use a loopback
+    redirect instead. So is a host on one of our own domains.
+
+    `client_name` is shown to the person as your client's own claim, with
+    where its redirect goes beside it. A name that renders blank, or mixes
+    Latin letters with Cyrillic or Greek ones, is shown as an unnamed
+    application.
+
+    The client is public whatever you ask for: `token_endpoint_auth_method`
+    comes back `none`, there is no client secret, and every authorization
+    proves itself with PKCE. It may be granted `apikeys.use` at most.
+
+    Args:
+        body (ClientRegistrationRequest):
+
+    Raises:
+        errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+        httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+    Returns:
+        Response[ClientRegistration | OauthError]
+    """
+
+    kwargs = _get_kwargs(
+        body=body,
+    )
+
+    response = client.get_httpx_client().request(
+        **kwargs,
+    )
+
+    return _build_response(client=client, response=response)
+
+
+def sync(
+    *,
+    client: AuthenticatedClient | Client,
+    body: ClientRegistrationRequest,
+) -> ClientRegistration | OauthError | None:
+    """Register
+
+     RFC 7591 dynamic client registration, for a client that cannot use a
+    Client ID Metadata Document. Post your client's metadata as JSON, then
+    use the `client_id` in the answer at `/oauth/authorize` and
+    `/oauth/token`. Nothing is kept until a person approves your client, so
+    registering again costs nothing and leaves nothing to clean up.
+
+    Each redirect URI must be https on a public host name, or http on a
+    loopback address (`127.0.0.1`, `[::1]`, `localhost`), which then
+    matches on any port. A custom URI scheme is refused: use a loopback
+    redirect instead. So is a host on one of our own domains.
+
+    `client_name` is shown to the person as your client's own claim, with
+    where its redirect goes beside it. A name that renders blank, or mixes
+    Latin letters with Cyrillic or Greek ones, is shown as an unnamed
+    application.
+
+    The client is public whatever you ask for: `token_endpoint_auth_method`
+    comes back `none`, there is no client secret, and every authorization
+    proves itself with PKCE. It may be granted `apikeys.use` at most.
+
+    Args:
+        body (ClientRegistrationRequest):
+
+    Raises:
+        errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+        httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+    Returns:
+        ClientRegistration | OauthError
+    """
+
+    return sync_detailed(
+        client=client,
+        body=body,
+    ).parsed
+
+
+async def asyncio_detailed(
+    *,
+    client: AuthenticatedClient | Client,
+    body: ClientRegistrationRequest,
+) -> Response[ClientRegistration | OauthError]:
+    """Register
+
+     RFC 7591 dynamic client registration, for a client that cannot use a
+    Client ID Metadata Document. Post your client's metadata as JSON, then
+    use the `client_id` in the answer at `/oauth/authorize` and
+    `/oauth/token`. Nothing is kept until a person approves your client, so
+    registering again costs nothing and leaves nothing to clean up.
+
+    Each redirect URI must be https on a public host name, or http on a
+    loopback address (`127.0.0.1`, `[::1]`, `localhost`), which then
+    matches on any port. A custom URI scheme is refused: use a loopback
+    redirect instead. So is a host on one of our own domains.
+
+    `client_name` is shown to the person as your client's own claim, with
+    where its redirect goes beside it. A name that renders blank, or mixes
+    Latin letters with Cyrillic or Greek ones, is shown as an unnamed
+    application.
+
+    The client is public whatever you ask for: `token_endpoint_auth_method`
+    comes back `none`, there is no client secret, and every authorization
+    proves itself with PKCE. It may be granted `apikeys.use` at most.
+
+    Args:
+        body (ClientRegistrationRequest):
+
+    Raises:
+        errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+        httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+    Returns:
+        Response[ClientRegistration | OauthError]
+    """
+
+    kwargs = _get_kwargs(
+        body=body,
+    )
+
+    response = await client.get_async_httpx_client().request(**kwargs)
+
+    return _build_response(client=client, response=response)
+
+
+async def asyncio(
+    *,
+    client: AuthenticatedClient | Client,
+    body: ClientRegistrationRequest,
+) -> ClientRegistration | OauthError | None:
+    """Register
+
+     RFC 7591 dynamic client registration, for a client that cannot use a
+    Client ID Metadata Document. Post your client's metadata as JSON, then
+    use the `client_id` in the answer at `/oauth/authorize` and
+    `/oauth/token`. Nothing is kept until a person approves your client, so
+    registering again costs nothing and leaves nothing to clean up.
+
+    Each redirect URI must be https on a public host name, or http on a
+    loopback address (`127.0.0.1`, `[::1]`, `localhost`), which then
+    matches on any port. A custom URI scheme is refused: use a loopback
+    redirect instead. So is a host on one of our own domains.
+
+    `client_name` is shown to the person as your client's own claim, with
+    where its redirect goes beside it. A name that renders blank, or mixes
+    Latin letters with Cyrillic or Greek ones, is shown as an unnamed
+    application.
+
+    The client is public whatever you ask for: `token_endpoint_auth_method`
+    comes back `none`, there is no client secret, and every authorization
+    proves itself with PKCE. It may be granted `apikeys.use` at most.
+
+    Args:
+        body (ClientRegistrationRequest):
+
+    Raises:
+        errors.UnexpectedStatus: If the server returns an undocumented status code and Client.raise_on_unexpected_status is True.
+        httpx.TimeoutException: If the request takes longer than Client.timeout.
+
+    Returns:
+        ClientRegistration | OauthError
+    """
+
+    return (
+        await asyncio_detailed(
+            client=client,
+            body=body,
+        )
+    ).parsed

{internetdata-2.7.4 → internetdata-2.8.0}/src/internetdata/_generated/models/__init__.py

@@ -10,6 +10,8 @@ from .account_revealed_apikey import AccountRevealedApikey
 from .account_user import AccountUser
 from .apikey_detail import ApikeyDetail
 from .apikey_list import ApikeyList
+from .client_registration import ClientRegistration
+from .client_registration_request import ClientRegistrationRequest
 from .database import Database
 from .database_checksum_v2_response_200 import DatabaseChecksumV2Response200
 from .database_format import DatabaseFormat
@@ -56,6 +58,8 @@ __all__ = (
     "AccountUser",
     "ApikeyDetail",
     "ApikeyList",
+    "ClientRegistration",
+    "ClientRegistrationRequest",
     "Database",
     "DatabaseChecksumV2Response200",
     "DatabaseFormat",

internetdata-2.8.0/src/internetdata/_generated/models/client_registration.py

@@ -0,0 +1,126 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, Self, TypeVar, cast
+
+from attrs import define as _attrs_define
+from attrs import field as _attrs_field
+
+from ..types import UNSET, Unset
+
+T = TypeVar("T", bound="ClientRegistration")
+
+
+@_attrs_define
+class ClientRegistration:
+    """
+    Attributes:
+        client_id (str):
+        client_id_issued_at (int): Unix seconds.
+        client_name (str): As the person will see it.
+        redirect_uris (list[str]):
+        token_endpoint_auth_method (str): Always `none`.
+        grant_types (list[str] | Unset): `authorization_code` and `refresh_token`.
+        response_types (list[str] | Unset):
+        scope (str | Unset): The most this client may be granted: `apikeys.use`.
+    """
+
+    client_id: str
+    client_id_issued_at: int
+    client_name: str
+    redirect_uris: list[str]
+    token_endpoint_auth_method: str
+    grant_types: list[str] | Unset = UNSET
+    response_types: list[str] | Unset = UNSET
+    scope: str | Unset = UNSET
+    additional_properties: dict[str, Any] = _attrs_field(init=False, factory=dict)
+
+    def to_dict(self) -> dict[str, Any]:
+        client_id = self.client_id
+
+        client_id_issued_at = self.client_id_issued_at
+
+        client_name = self.client_name
+
+        redirect_uris = self.redirect_uris
+
+        token_endpoint_auth_method = self.token_endpoint_auth_method
+
+        grant_types: list[str] | Unset = UNSET
+        if not isinstance(self.grant_types, Unset):
+            grant_types = self.grant_types
+
+        response_types: list[str] | Unset = UNSET
+        if not isinstance(self.response_types, Unset):
+            response_types = self.response_types
+
+        scope = self.scope
+
+        field_dict: dict[str, Any] = {}
+        field_dict.update(self.additional_properties)
+        field_dict.update(
+            {
+                "client_id": client_id,
+                "client_id_issued_at": client_id_issued_at,
+                "client_name": client_name,
+                "redirect_uris": redirect_uris,
+                "token_endpoint_auth_method": token_endpoint_auth_method,
+            }
+        )
+        if grant_types is not UNSET:
+            field_dict["grant_types"] = grant_types
+        if response_types is not UNSET:
+            field_dict["response_types"] = response_types
+        if scope is not UNSET:
+            field_dict["scope"] = scope
+
+        return field_dict
+
+    @classmethod
+    def from_dict(cls, src_dict: Mapping[str, Any]) -> Self:
+        d = dict(src_dict)
+        client_id = d.pop("client_id")
+
+        client_id_issued_at = d.pop("client_id_issued_at")
+
+        client_name = d.pop("client_name")
+
+        redirect_uris = cast(list[str], d.pop("redirect_uris"))
+
+        token_endpoint_auth_method = d.pop("token_endpoint_auth_method")
+
+        grant_types = cast(list[str], d.pop("grant_types", UNSET))
+
+        response_types = cast(list[str], d.pop("response_types", UNSET))
+
+        scope = d.pop("scope", UNSET)
+
+        client_registration = cls(
+            client_id=client_id,
+            client_id_issued_at=client_id_issued_at,
+            client_name=client_name,
+            redirect_uris=redirect_uris,
+            token_endpoint_auth_method=token_endpoint_auth_method,
+            grant_types=grant_types,
+            response_types=response_types,
+            scope=scope,
+        )
+
+        client_registration.additional_properties = d
+        return client_registration
+
+    @property
+    def additional_keys(self) -> list[str]:
+        return list(self.additional_properties.keys())
+
+    def __getitem__(self, key: str) -> Any:
+        return self.additional_properties[key]
+
+    def __setitem__(self, key: str, value: Any) -> None:
+        self.additional_properties[key] = value
+
+    def __delitem__(self, key: str) -> None:
+        del self.additional_properties[key]
+
+    def __contains__(self, key: str) -> bool:
+        return key in self.additional_properties