keyrunes-python-sdk 0.1.0__tar.gz → 0.2.0__tar.gz

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/CHANGELOG.md

@@ -5,6 +5,52 @@ Todas as mudanças notáveis neste projeto serão documentadas neste arquivo.
 O formato é baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.0.0/),
 e este projeto adere ao [Semantic Versioning](https://semver.org/lang/pt-BR/).
 
+## [0.2.0] - 2026-09-03
+
+### Added
+
+- Property-based test suite (`tests/test_property_based.py`, 24 tests) built on
+  Hypothesis, covering base URL normalization, `_normalize_user` id precedence
+  and `is_admin` derivation, JWT claim parsing, request URL construction, HTTP
+  status to exception mapping, and model validation bounds.
+- Input fuzzing ("spider") suite (`tests/test_fuzz.py`, 19 tests) that crawls the
+  public surface with hostile payloads and asserts that only `KeyrunesError` and
+  pydantic `ValidationError` ever escape, and that nothing panics or leaks a raw
+  `ValueError`/`TypeError`.
+- Request contract suite (`tests/test_request_contract.py`, 33 tests) that mocks
+  only the httpx transport, so the method, URL, headers and JSON body actually
+  put on the wire are asserted for every endpoint.
+- Hypothesis profiles in `tests/conftest.py` (`fast`, `dev`, `ci`) selected via
+  the `HYPOTHESIS_PROFILE` environment variable. `fast` is derandomized and
+  database-free so mutation runs judge every mutant against identical examples.
+- `[tool.mutmut]` configuration in `pyproject.toml` for mutation testing.
+- `hypothesis` added as a development dependency.
+
+### Fixed
+
+- A 2xx response carrying a non-JSON body raised a raw `ValueError` out of
+  `KeyrunesClient._make_request`. It is now wrapped in `NetworkError`, so the
+  documented exception contract holds for malformed responses.
+
+### Changed
+
+- Extracted the duplicated "build a `User` from JWT claims" block into
+  `KeyrunesClient._user_from_token_claims()`.
+
+### Removed
+
+- Unreachable `except UserNotFoundError` fallbacks in `get_user`,
+  `get_current_user` and `has_group`. Each re-tested a condition that had
+  already forced an early return, so a 404 from the server was being swallowed
+  instead of propagated.
+
+### Testing
+
+- Test count raised from 83 to 159.
+- Mutation score (mutmut) raised from 44% (294/669 mutants killed) to 72%
+  (387/537). The remaining survivors are predominantly equivalent mutants that
+  only alter error message prose.
+
 ## [0.1.0] - 2025-12-03
 
 ### Adicionado

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/PKG-INFO

@@ -1,8 +1,9 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: keyrunes-python-sdk
-Version: 0.1.0
+Version: 0.2.0
 Summary: Python SDK for Keyrunes Authorization System
 License: AGPL
+License-File: LICENSE
 Keywords: keyrunes,authorization,rbac,abac,security,authentication,permissions
 Author: keyrunes
 Author-email: contact@singularjourney.host
@@ -17,12 +18,13 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.10
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
 Requires-Dist: httpx (>=0.28.1,<0.29.0)
+Requires-Dist: mutmut (>=3.7.0,<4.0.0)
 Requires-Dist: pydantic[email] (>=2.0.0,<3.0.0)
 Requires-Dist: pyjwt (>=2.9.0,<3.0.0)
 Project-URL: Documentation, https://github.com/jonatasoli/keyrunes-python-sdk#readme
@@ -33,11 +35,12 @@ Description-Content-Type: text/markdown
 # Keyrunes SDK Python Client
 
 [![Tests](https://github.com/Keyrunes/keyrunes-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/Keyrunes/keyrunes-python-sdk/actions/workflows/ci.yml)
-[![Coverage](https://codecov.io/gh/Keyrunes/keyrunes-python-sdk/branch/main/graph/badge.svg)](https://codecov.io/gh/Keyrunes/keyrunes-python-sdk)
 [![Python](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
+
 Python SDK for integration with the [Keyrunes Authorization System](https://github.com/Keyrunes/keyrunes), a modern high-performance authorization system built in Rust.
+[Pypi](https://pypi.org/project/keyrunes-python-sdk/)
 
 ## Features
 

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/README.md

@@ -1,11 +1,12 @@
 # Keyrunes SDK Python Client
 
 [![Tests](https://github.com/Keyrunes/keyrunes-python-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/Keyrunes/keyrunes-python-sdk/actions/workflows/ci.yml)
-[![Coverage](https://codecov.io/gh/Keyrunes/keyrunes-python-sdk/branch/main/graph/badge.svg)](https://codecov.io/gh/Keyrunes/keyrunes-python-sdk)
 [![Python](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
+
 Python SDK for integration with the [Keyrunes Authorization System](https://github.com/Keyrunes/keyrunes), a modern high-performance authorization system built in Rust.
+[Pypi](https://pypi.org/project/keyrunes-python-sdk/)
 
 ## Features
 

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/keyrunes_sdk/__init__.py

@@ -1,6 +1,6 @@
 """Keyrunes SDK - Python client for Keyrunes Authorization System."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 from keyrunes_sdk.client import KeyrunesClient
 from keyrunes_sdk.config import (

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/keyrunes_sdk/client.py

@@ -137,7 +137,12 @@ class KeyrunesClient:
                     )
                 raise NetworkError(f"Request failed: {error_msg}")
 
-            result: Dict[str, Any] = response.json()
+            try:
+                result: Dict[str, Any] = response.json()
+            except (ValueError, TypeError) as e:
+                raise NetworkError(
+                    f"Malformed JSON in response from {url}: {str(e)}"
+                )
             return result
 
         except httpx.RequestError as e:
@@ -167,6 +172,21 @@ class KeyrunesClient:
         )
         return User(**normalized)
 
+    def _user_from_token_claims(self) -> User:
+        """Build a :class:`User` out of the claims carried by the JWT.
+
+        Only called once ``self._token_data`` is known to be populated.
+        """
+        token_data = self._token_data or {}
+        return self._normalize_user(
+            {
+                "id": str(token_data.get("sub", "")),
+                "username": token_data.get("username", ""),
+                "email": token_data.get("email", ""),
+                "groups": token_data.get("groups", []),
+            }
+        )
+
     def _parse_token_response(self, payload: Dict[str, Any]) -> Token:
         """
         Accept both legacy and current API token responses.
@@ -409,13 +429,8 @@ class KeyrunesClient:
             check = GroupCheck(**response)
             return check.has_access
         except UserNotFoundError:
-            if token_user_id and str(user_id) == token_user_id:
-                groups = (
-                    self._token_data.get("groups", [])
-                    if self._token_data
-                    else []
-                )
-                return group_id in groups
+            # The self-lookup above already returned for the authenticated
+            # user, so reaching here always means a genuine miss.
             raise GroupNotFoundError(
                 f"Group '{group_id}' not found or user not in group"
             )
@@ -448,33 +463,12 @@ class KeyrunesClient:
         )
 
         if token_user_id and str(user_id) == token_user_id and self._token_data:
-            token_data = self._token_data
-            user_data = {
-                "id": str(token_data.get("sub", "")),
-                "username": token_data.get("username", ""),
-                "email": token_data.get("email", ""),
-                "groups": token_data.get("groups", []),
-            }
-            return self._normalize_user(user_data)
+            return self._user_from_token_claims()
 
-        try:
-            response = self._make_request("GET", f"/api/users/{user_id}")
-            return self._normalize_user(response)
-        except UserNotFoundError:
-            if (
-                token_user_id
-                and str(user_id) == token_user_id
-                and self._token_data
-            ):
-                token_data = self._token_data
-                user_data = {
-                    "id": str(token_data.get("sub", "")),
-                    "username": token_data.get("username", ""),
-                    "email": token_data.get("email", ""),
-                    "groups": token_data.get("groups", []),
-                }
-                return self._normalize_user(user_data)
-            raise
+        # The claims shortcut above already handled the authenticated user, so
+        # a 404 here is always a genuine miss and is propagated as such.
+        response = self._make_request("GET", f"/api/users/{user_id}")
+        return self._normalize_user(response)
 
     def get_current_user(self) -> User:
         """
@@ -496,29 +490,12 @@ class KeyrunesClient:
             raise AuthenticationError("Not authenticated. Please login first.")
 
         if self._token_data:
-            token_data = self._token_data
-            user_data = {
-                "id": str(token_data.get("sub", "")),
-                "username": token_data.get("username", ""),
-                "email": token_data.get("email", ""),
-                "groups": token_data.get("groups", []),
-            }
-            return self._normalize_user(user_data)
+            return self._user_from_token_claims()
 
-        try:
-            response = self._make_request("GET", "/api/users/me")
-            return self._normalize_user(response)
-        except UserNotFoundError:
-            if self._token_data:
-                token_data = self._token_data
-                user_data = {
-                    "id": str(token_data.get("sub", "")),
-                    "username": token_data.get("username", ""),
-                    "email": token_data.get("email", ""),
-                    "groups": token_data.get("groups", []),
-                }
-                return self._normalize_user(user_data)
-            raise
+        # The claims shortcut above already handled every case where the token
+        # could answer, so a 404 here is a genuine miss and is propagated.
+        response = self._make_request("GET", "/api/users/me")
+        return self._normalize_user(response)
 
     def get_user_groups(self, user_id: Optional[str] = None) -> List[str]:
         """

{keyrunes_python_sdk-0.1.0 → keyrunes_python_sdk-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "keyrunes-python-sdk"
-version = "0.1.0"
+version = "0.2.0"
 description = "Python SDK for Keyrunes Authorization System"
 authors = ["keyrunes <contact@singularjourney.host>"]
 maintainers = ["jonatasoli <contact@jonatasoli.dev>"]
@@ -33,6 +33,7 @@ python = ">=3.10.1,<4.0"
 pydantic = {extras = ["email"], version = "^2.0.0"}
 pyjwt = "^2.9.0"
 httpx = "^0.28.1"
+mutmut = "^3.7.0"
 
 [tool.poetry.group.dev.dependencies]
 pytest = "^7.4.0"
@@ -48,6 +49,7 @@ taskipy = "^1.12.0"
 towncrier = "^25.8.0"
 pre-commit = "^4.5.1"
 safety = "^3.7.0"
+hypothesis = "^6.0"
 
 [build-system]
 requires = ["poetry-core>=1.0.0"]
@@ -66,6 +68,17 @@ addopts = [
     "-v",
 ]
 
+[tool.mutmut]
+# Mutation testing. Only the library is mutated; the test suite is the oracle.
+source_paths = ["keyrunes_sdk"]
+do_not_mutate = [
+    "keyrunes_sdk/__init__.py",
+]
+# The project-wide addopts turn on coverage, which roughly doubles the runtime
+# of every one of the hundreds of per-mutant test runs.
+pytest_add_cli_args = ["--no-cov", "-p", "no:cacheprovider", "-x", "-q"]
+pytest_add_cli_args_test_selection = ["tests/"]
+
 [tool.black]
 line-length = 80
 target-version = ['py312']