intigin 1.0.0__tar.gz

intigin-1.0.0/PKG-INFO

@@ -0,0 +1,73 @@
+Metadata-Version: 2.4
+Name: intigin
+Version: 1.0.0
+Summary: Intigin dynamic-backend adapter — thin in-app WSGI middleware for view-source protection.
+Author: Intigin
+Project-URL: Homepage, https://intigin.com
+Project-URL: Documentation, https://intigin.com/docs
+Keywords: intigin,wsgi,middleware,view-source,protection,flask,django
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Middleware
+Classifier: Topic :: Security
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+
+# intigin
+
+Thin in-app **WSGI adapter** for [Intigin](https://intigin.com) dynamic-backend protection. It wraps
+your app so the same Intigin bundle that protects static sites also protects your server-rendered pages —
+view-source shows only a loader shell, and the real HTML is reconstructed client-side.
+
+The adapter does almost nothing: the browser bundle does the heavy lifting. On a page navigation it
+returns a **clean loader shell** (no payload, no cookie); when the bundle asks for the page (a same-URL
+fetch carrying an `X-Intigin-Payload` header) it encodes the finished HTML into the frozen wire format
+and returns it. The bundle at `https://{host}/{token}.js` decodes and reconstructs the page, then
+reveals, polls, and hot-swaps live like a static Intigin page — no backend round-trip on updates.
+
+## Install
+
+```bash
+pip install intigin
+```
+
+## Use
+
+Wrap your WSGI callable with a scoped Gateway API key (dashboard → **Settings → Gateway API**). The
+adapter resolves your public bundle token from the key once at boot, so no token is hardcoded:
+
+```python
+from intigin import Intigin
+
+app.wsgi_app = Intigin(app.wsgi_app, api_key="iga_...", host="intigin.com")   # recommended
+```
+
+Flask uses `app.wsgi_app`; Django wraps `application` in `wsgi.py`. A raw 32-hex `token="..."` is also
+accepted for a zero-config demo.
+
+## Behavior
+
+- **Cookieless.** The payload rides the bundle's marker fetch (the browser's own session), so nothing
+  payload-related appears in the source and no cookie is set — cookie blockers don't affect it.
+- **Non-HTML passes through** untouched; only top-level HTML navigations are wrapped.
+- **Fail-closed.** A bad/missing key or any wrap error disables the adapter (serves your app
+  unprotected, logged to stderr) or returns a self-contained restricted page — never the raw HTML for a
+  failed encode.
+- **Kill-switch.** `INTIGIN_ADAPTER_MODE=wrap|passthrough|off` (env). `passthrough`/`off` removes the
+  adapter from the path.
+
+## Conformance
+
+```bash
+python -m intigin --selftest
+```
+
+Verifies the frozen wire format — `base64("IGP1" + FLAGS + BODY)`, `BODY = xor(deflate(utf8(html)),
+sha256(token))` — against the browser bundle's decoder.
+
+> **Concealment, not encryption.** The scramble key is derived from the public bundle token, so this
+> defeats view-source and naive scrapers, not cryptanalysis. Object-level authorization stays in your
+> own routes.

intigin-1.0.0/README.md

@@ -0,0 +1,55 @@
+# intigin
+
+Thin in-app **WSGI adapter** for [Intigin](https://intigin.com) dynamic-backend protection. It wraps
+your app so the same Intigin bundle that protects static sites also protects your server-rendered pages —
+view-source shows only a loader shell, and the real HTML is reconstructed client-side.
+
+The adapter does almost nothing: the browser bundle does the heavy lifting. On a page navigation it
+returns a **clean loader shell** (no payload, no cookie); when the bundle asks for the page (a same-URL
+fetch carrying an `X-Intigin-Payload` header) it encodes the finished HTML into the frozen wire format
+and returns it. The bundle at `https://{host}/{token}.js` decodes and reconstructs the page, then
+reveals, polls, and hot-swaps live like a static Intigin page — no backend round-trip on updates.
+
+## Install
+
+```bash
+pip install intigin
+```
+
+## Use
+
+Wrap your WSGI callable with a scoped Gateway API key (dashboard → **Settings → Gateway API**). The
+adapter resolves your public bundle token from the key once at boot, so no token is hardcoded:
+
+```python
+from intigin import Intigin
+
+app.wsgi_app = Intigin(app.wsgi_app, api_key="iga_...", host="intigin.com")   # recommended
+```
+
+Flask uses `app.wsgi_app`; Django wraps `application` in `wsgi.py`. A raw 32-hex `token="..."` is also
+accepted for a zero-config demo.
+
+## Behavior
+
+- **Cookieless.** The payload rides the bundle's marker fetch (the browser's own session), so nothing
+  payload-related appears in the source and no cookie is set — cookie blockers don't affect it.
+- **Non-HTML passes through** untouched; only top-level HTML navigations are wrapped.
+- **Fail-closed.** A bad/missing key or any wrap error disables the adapter (serves your app
+  unprotected, logged to stderr) or returns a self-contained restricted page — never the raw HTML for a
+  failed encode.
+- **Kill-switch.** `INTIGIN_ADAPTER_MODE=wrap|passthrough|off` (env). `passthrough`/`off` removes the
+  adapter from the path.
+
+## Conformance
+
+```bash
+python -m intigin --selftest
+```
+
+Verifies the frozen wire format — `base64("IGP1" + FLAGS + BODY)`, `BODY = xor(deflate(utf8(html)),
+sha256(token))` — against the browser bundle's decoder.
+
+> **Concealment, not encryption.** The scramble key is derived from the public bundle token, so this
+> defeats view-source and naive scrapers, not cryptanalysis. Object-level authorization stays in your
+> own routes.

intigin-1.0.0/intigin/__init__.py

@@ -0,0 +1,176 @@
+"""
+Intigin WSGI adapter — dynamic backend protection (in-app, runs lite).
+
+Thin intercept-and-wrap. The browser bundle does all the heavy lifting; the adapter only:
+  - returns a CLEAN loader shell for page navigations (view-source is just the loader — no payload,
+    no cookie, nothing to leak), and
+  - hands the bundle the encoded page when it asks for it: the bundle re-fetches the SAME url with an
+    `X-Intigin-Payload` header; the response carries the browser's own session (per-user correct),
+    cookieless, and never appears in the source.
+
+The bundle at https://{host}/{token}.js decodes the wire and reconstructs the page, then reveals +
+polls + hot-swaps live exactly like a static Intigin page — no backend round-trip on updates.
+
+Wire: base64("IGP1" + FLAGS + BODY), BODY = xor(deflate(utf8(html)), sha256(token)),
+compress-before-scramble, FLAGS = 0x01 DEFLATE | 0x02 SCRAMBLE.
+
+Install:
+    pip install intigin
+
+    from intigin import Intigin
+    app.wsgi_app = Intigin(app.wsgi_app, api_key="iga_...", host="intigin.com")   # recommended
+    app.wsgi_app = Intigin(app.wsgi_app, token="...32hex...", host="intigin.com") # zero-config demo
+
+Fail-closed. Non-HTML passes through. Kill-switch: INTIGIN_ADAPTER_MODE = wrap | passthrough | off.
+"""
+import hashlib
+import json
+import os
+import urllib.request
+import zlib
+from base64 import b64encode
+
+__version__ = "1.0.0"
+__all__ = ["Intigin", "encode_payload", "shell", "RESTRICTED_HTML"]
+
+MAGIC = b"IGP1"
+FLAG_DEFLATE = 0x01
+FLAG_SCRAMBLE = 0x02
+PAYLOAD_HEADER_ENV = "HTTP_X_INTIGIN_PAYLOAD"
+ASSET_EXT = (".js", ".css", ".png", ".jpg", ".jpeg", ".gif", ".svg", ".ico", ".webp", ".woff",
+             ".woff2", ".ttf", ".map", ".json", ".xml", ".txt", ".pdf", ".mp4", ".webm", ".wasm")
+
+
+def _key(token):
+    return hashlib.sha256(token.encode("ascii")).digest()
+
+
+def _xor(data, key):
+    klen = len(key)
+    return bytes(b ^ key[i % klen] for i, b in enumerate(data))
+
+
+def encode_payload(html, token, compress=True):
+    body = html.encode("utf-8") if isinstance(html, str) else html
+    flags = 0
+    if compress:
+        body = zlib.compress(body, 9)
+        flags |= FLAG_DEFLATE
+    body = _xor(body, _key(token))
+    flags |= FLAG_SCRAMBLE
+    return b64encode(MAGIC + bytes([flags]) + body).decode("ascii")
+
+
+def shell(host, token):
+    """The clean loader — the ENTIRE view-source of a protected page."""
+    return (
+        "<!DOCTYPE html>\n"
+        '<html lang="en">\n'
+        "<!-- BEGIN Intigin -->\n"
+        '<script src="https://{host}/{token}.js" defer></script>\n'
+        '<noscript><meta http-equiv="refresh" content="0;url=about:blank"></noscript>\n'
+        "<!-- END Intigin -->\n"
+        "</html>"
+    ).format(host=host, token=token).encode("utf-8")
+
+
+RESTRICTED_HTML = (
+    '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Protected</title></head>'
+    '<body style="margin:0;background:#0a0e14;color:#7dd3fc;font:600 15px/1.5 system-ui,sans-serif;'
+    'display:flex;align-items:center;justify-content:center;height:100vh">'
+    "<div>Protected content is temporarily unavailable.</div></body></html>"
+).encode("utf-8")
+
+
+def _get(headers, name):
+    nl = name.lower()
+    return next((v for (k, v) in headers if k.lower() == nl), None)
+
+
+def _mode():
+    m = os.environ.get("INTIGIN_ADAPTER_MODE", "wrap").lower().strip()
+    return m if m in ("wrap", "passthrough", "off") else "wrap"
+
+
+def _resolve_token(api_key, host):
+    """Resolve the embed's PUBLIC script token from a scoped iga_ key (chained-scoped-key auth)."""
+    req = urllib.request.Request("https://%s/api/v1/account/state" % host,
+                                 headers={"Authorization": "Bearer " + api_key})
+    with urllib.request.urlopen(req, timeout=10) as r:
+        tok = (json.load(r).get("script_token") or "").strip().lower()
+    if len(tok) != 32:
+        raise ValueError("account/state returned no script_token")
+    return "".join(c for c in tok if c in "0123456789abcdef")
+
+
+class Intigin:
+    def __init__(self, app, token=None, api_key=None, host="intigin.com"):
+        self.app = app
+        self.host = host.rstrip("/")
+        self.ok = True
+        try:
+            if api_key:
+                self.token = _resolve_token(api_key, self.host)
+            elif token:
+                self.token = "".join(c for c in token.lower() if c in "0123456789abcdef")
+                if len(self.token) != 32:
+                    raise ValueError("token must be 32 hex chars")
+            else:
+                raise ValueError("provide api_key='iga_...' (recommended) or token='...32hex...'")
+        except Exception as e:
+            import sys
+            sys.stderr.write("[Intigin] adapter disabled: %s\n" % e)
+            self.token, self.ok = None, False
+
+    def _invoke(self, environ):
+        cap, chunks = {}, []
+
+        def start(status, headers, exc_info=None):
+            cap["status"], cap["headers"] = status, headers
+            return chunks.append
+
+        it = self.app(environ, start)
+        try:
+            for c in it:
+                if c:
+                    chunks.append(c)
+        finally:
+            if hasattr(it, "close"):
+                it.close()
+        return b"".join(chunks), cap.get("status", "200 OK"), cap.get("headers", [])
+
+    def __call__(self, environ, start_response):
+        if not self.ok or _mode() == "off":
+            return self.app(environ, start_response)
+        method = environ.get("REQUEST_METHOD", "GET")
+        path = environ.get("PATH_INFO", "/")
+        accept = environ.get("HTTP_ACCEPT", "")
+
+        # 1) The bundle asking for the encoded page.
+        if environ.get(PAYLOAD_HEADER_ENV) and _mode() == "wrap":
+            try:
+                body, status, headers = self._invoke(environ)
+                if "text/html" in (_get(headers, "Content-Type") or "").lower() and body:
+                    wire = encode_payload(body.decode("utf-8", "replace"), self.token).encode("ascii")
+                    start_response("200 OK", [("Content-Type", "application/octet-stream"),
+                                              ("Content-Length", str(len(wire))), ("Cache-Control", "no-store")])
+                    return [wire]
+                start_response(status, headers)  # non-HTML -> raw (bundle recovers)
+                return [body]
+            except Exception:
+                start_response("200 OK", [("Content-Type", "text/html; charset=utf-8"),
+                                          ("Content-Length", str(len(RESTRICTED_HTML))), ("Cache-Control", "no-store")])
+                return [RESTRICTED_HTML]
+
+        # 2) Page navigation -> clean shell, no render.
+        if (_mode() == "wrap" and method == "GET" and "text/html" in accept.lower()
+                and not path.lower().endswith(ASSET_EXT)):
+            s = shell(self.host, self.token)
+            start_response("200 OK", [("Content-Type", "text/html; charset=utf-8"),
+                                      ("Content-Length", str(len(s))), ("Cache-Control", "no-store")])
+            return [s]
+
+        # 3) Everything else (assets, POST, non-HTML) -> passthrough.
+        body, status, headers = self._invoke(environ)
+        start_response(status, headers)
+        return [body]

intigin-1.0.0/intigin/__main__.py

@@ -0,0 +1,41 @@
+"""Conformance self-test: `python -m intigin --selftest` (also runs with no args).
+
+Verifies the frozen golden vector and a compressed round-trip against the wire format the browser
+bundle decodes, and that the loader shell carries no payload. Exits non-zero on any mismatch.
+"""
+import base64
+import sys
+import zlib
+
+from intigin import MAGIC, encode_payload, shell, _key, _xor
+
+GOLDEN_TOKEN = "0123456789abcdef0123456789abcdef"
+GOLDEN_HTML = "<!DOCTYPE html><html><head><title>Golden</title></head><body><h1>Vector</h1></body></html>"
+GOLDEN_B64 = ("SUdQMQICkPkM2hOyJmy4jRKhrt6lr+V85xF8P/mlk+QXJAjDlVuP+iz1I44Y"
+              "FbeRD7iuhaf7vnnuTiRpoKaYvlJuXd/IAOfYIO0omUoG8NRY8O2C9qPoL7cAKCPxqMk=")
+
+
+def main():
+    ok = True
+
+    good = encode_payload(GOLDEN_HTML, GOLDEN_TOKEN, compress=False) == GOLDEN_B64
+    ok = ok and good
+    print(("PASS" if good else "FAIL") + "  golden vector (uncompressed frame is byte-stable)")
+
+    frame = base64.b64decode(encode_payload(GOLDEN_HTML, GOLDEN_TOKEN, compress=True))
+    rt = frame[:4] == MAGIC and zlib.decompress(_xor(frame[5:], _key(GOLDEN_TOKEN))).decode("utf-8") == GOLDEN_HTML
+    ok = ok and rt
+    print(("PASS" if rt else "FAIL") + "  compressed round-trip decodes to the original HTML")
+
+    src = shell("intigin.com", GOLDEN_TOKEN)
+    clean = b"data-ig-payload" not in src and b"IGP1" not in src
+    ok = ok and clean
+    print(("PASS" if clean else "FAIL") + "  clean loader shell carries no payload")
+
+    print("\n" + ("ALL PASS" if ok else "FAILURES"))
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    # `--selftest` is accepted for symmetry with the docs; the module self-tests unconditionally.
+    sys.exit(main())

intigin-1.0.0/intigin.egg-info/PKG-INFO

@@ -0,0 +1,73 @@
+Metadata-Version: 2.4
+Name: intigin
+Version: 1.0.0
+Summary: Intigin dynamic-backend adapter — thin in-app WSGI middleware for view-source protection.
+Author: Intigin
+Project-URL: Homepage, https://intigin.com
+Project-URL: Documentation, https://intigin.com/docs
+Keywords: intigin,wsgi,middleware,view-source,protection,flask,django
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP :: WSGI :: Middleware
+Classifier: Topic :: Security
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+
+# intigin
+
+Thin in-app **WSGI adapter** for [Intigin](https://intigin.com) dynamic-backend protection. It wraps
+your app so the same Intigin bundle that protects static sites also protects your server-rendered pages —
+view-source shows only a loader shell, and the real HTML is reconstructed client-side.
+
+The adapter does almost nothing: the browser bundle does the heavy lifting. On a page navigation it
+returns a **clean loader shell** (no payload, no cookie); when the bundle asks for the page (a same-URL
+fetch carrying an `X-Intigin-Payload` header) it encodes the finished HTML into the frozen wire format
+and returns it. The bundle at `https://{host}/{token}.js` decodes and reconstructs the page, then
+reveals, polls, and hot-swaps live like a static Intigin page — no backend round-trip on updates.
+
+## Install
+
+```bash
+pip install intigin
+```
+
+## Use
+
+Wrap your WSGI callable with a scoped Gateway API key (dashboard → **Settings → Gateway API**). The
+adapter resolves your public bundle token from the key once at boot, so no token is hardcoded:
+
+```python
+from intigin import Intigin
+
+app.wsgi_app = Intigin(app.wsgi_app, api_key="iga_...", host="intigin.com")   # recommended
+```
+
+Flask uses `app.wsgi_app`; Django wraps `application` in `wsgi.py`. A raw 32-hex `token="..."` is also
+accepted for a zero-config demo.
+
+## Behavior
+
+- **Cookieless.** The payload rides the bundle's marker fetch (the browser's own session), so nothing
+  payload-related appears in the source and no cookie is set — cookie blockers don't affect it.
+- **Non-HTML passes through** untouched; only top-level HTML navigations are wrapped.
+- **Fail-closed.** A bad/missing key or any wrap error disables the adapter (serves your app
+  unprotected, logged to stderr) or returns a self-contained restricted page — never the raw HTML for a
+  failed encode.
+- **Kill-switch.** `INTIGIN_ADAPTER_MODE=wrap|passthrough|off` (env). `passthrough`/`off` removes the
+  adapter from the path.
+
+## Conformance
+
+```bash
+python -m intigin --selftest
+```
+
+Verifies the frozen wire format — `base64("IGP1" + FLAGS + BODY)`, `BODY = xor(deflate(utf8(html)),
+sha256(token))` — against the browser bundle's decoder.
+
+> **Concealment, not encryption.** The scramble key is derived from the public bundle token, so this
+> defeats view-source and naive scrapers, not cryptanalysis. Object-level authorization stays in your
+> own routes.

intigin-1.0.0/intigin.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+README.md
+pyproject.toml
+intigin/__init__.py
+intigin/__main__.py
+intigin.egg-info/PKG-INFO
+intigin.egg-info/SOURCES.txt
+intigin.egg-info/dependency_links.txt
+intigin.egg-info/top_level.txt

intigin-1.0.0/intigin.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

intigin-1.0.0/intigin.egg-info/top_level.txt

@@ -0,0 +1 @@
+intigin

intigin-1.0.0/pyproject.toml

@@ -0,0 +1,28 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "intigin"
+version = "1.0.0"
+description = "Intigin dynamic-backend adapter — thin in-app WSGI middleware for view-source protection."
+readme = "README.md"
+requires-python = ">=3.7"
+authors = [{ name = "Intigin" }]
+keywords = ["intigin", "wsgi", "middleware", "view-source", "protection", "flask", "django"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "License :: Other/Proprietary License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Topic :: Internet :: WWW/HTTP :: WSGI :: Middleware",
+    "Topic :: Security",
+]
+
+[project.urls]
+Homepage = "https://intigin.com"
+Documentation = "https://intigin.com/docs"
+
+[tool.setuptools]
+packages = ["intigin"]

intigin-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+