keyrunes-python-sdk 0.3.1__tar.gz → 0.4.0__tar.gz

{keyrunes_python_sdk-0.3.1 → keyrunes_python_sdk-0.4.0}/CHANGELOG.md

@@ -5,6 +5,59 @@ Todas as mudanças notáveis neste projeto serão documentadas neste arquivo.
 O formato é baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.0.0/),
 e este projeto adere ao [Semantic Versioning](https://semver.org/lang/pt-BR/).
 
+## [0.4.0] - 2026-09-15
+
+### Added
+
+- `KeyrunesClient.change_password(current_password, new_password)`, wrapping
+  `POST /api/user/change-password`. The server has served this endpoint all
+  along; the SDK exposed `login`, `refresh_token`, `register_user` and the group
+  queries, and not this one. Anyone who needed it built the HTTP call by hand —
+  which is what happened downstream, after first concluding from the SDK's
+  surface that the operation did not exist at all.
+
+  Three details the endpoint carries, and each one bites if read wrong:
+
+  - it lives at `/api/user/change-password`, **not** `/api/change-password` —
+    the router registers the first, and the handler behind the second is dead
+    code marked `#[allow(dead_code)]`, so pointing at it answers 404;
+  - it answers errors as **plain text** (`e.to_string()`), not JSON, and with
+    status **400** rather than 401 — so this client raises `NetworkError`, the
+    same class it already uses for every non-401/403/404 status, and preserves
+    the server's own wording, because "invalid current password" and "password
+    too short" call for opposite fixes;
+  - changing the password clears the account's `first_login` flag server-side,
+    which is what `requires_password_change` reports at login. There is no
+    second call to make.
+
+  Without a token the client refuses before sending: the server decides whose
+  password it is from the token, and nothing in the body chooses that.
+
+### Fixed
+
+- A malformed `groups` field in a server response no longer crashes the client.
+  `get_current_user` and `check_user` called `list(data["groups"])` on whatever
+  came back; a JSON `true`, a number, or `null` raised `TypeError: 'bool' object
+  is not iterable` out of the SDK, from a line that reads like a safe coercion.
+  Anything that is not a JSON array is now read as no groups. Found by the fuzz
+  suite, and it predates this release — `git stash` confirmed it on the previous
+  tag.
+
+### Security
+
+- `pyjwt` 2.10.1 → 2.14.0 and `idna` 3.11 → 3.19 in the lockfile. Both are
+  runtime dependencies (`idna` arrives through `httpx`), and OSV reports known
+  advisories against the pinned versions — nine for `pyjwt`, four of them high.
+  The declared constraint was already `^2.9.0`, so this is a lockfile refresh
+  with no API change; the 194 tests pass unchanged.
+
+### Removed
+
+- `towncrier` left the dev dependencies. It was declared and never configured:
+  no `[tool.towncrier]` section, no `newsfragments/` directory, and this
+  changelog was written by hand. A tool nobody runs still gets installed,
+  resolved, and audited on every environment build.
+
 ## [0.3.1] - 2026-09-04
 
 ### Fixed

{keyrunes_python_sdk-0.3.1 → keyrunes_python_sdk-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keyrunes-python-sdk
-Version: 0.3.1
+Version: 0.4.0
 Summary: Python SDK for Keyrunes Authorization System
 License: AGPL
 License-File: LICENSE

{keyrunes_python_sdk-0.3.1 → keyrunes_python_sdk-0.4.0}/keyrunes_sdk/__init__.py

@@ -1,6 +1,6 @@
 """Keyrunes SDK - Python client for Keyrunes Authorization System."""
 
-__version__ = "0.3.1"
+__version__ = "0.4.0"
 
 from keyrunes_sdk.client import KeyrunesClient
 from keyrunes_sdk.config import (

{keyrunes_python_sdk-0.3.1 → keyrunes_python_sdk-0.4.0}/keyrunes_sdk/client.py

@@ -35,6 +35,13 @@ ENDPOINT_ME = "/api/me"
 #: Exchanges a still-valid token for a fresh one.
 ENDPOINT_REFRESH_TOKEN = "/api/refresh-token"
 
+#: Changes the password of whoever the bearer token identifies.
+#:
+#: ``/api/user/change-password``, and not ``/api/change-password``: the router
+#: registers the first, and the handler behind the second is dead code marked
+#: ``#[allow(dead_code)]``. Pointing at it answers 404.
+ENDPOINT_CHANGE_PASSWORD = "/api/user/change-password"
+
 
 class KeyrunesClient:
     """
@@ -175,7 +182,14 @@ class KeyrunesClient:
         )
         normalized["username"] = data.get("username", "")
         normalized["email"] = data.get("email", "")
-        normalized["groups"] = data.get("groups", []) or []
+        # `or []` trata nulo e vazio, e **não** trata o resto: com
+        # ``{"groups": true}`` o valor sobrevivia como ``True``, e o
+        # ``"admins" in groups`` logo abaixo estourava ``TypeError`` — o cliente
+        # caía em vez de conter uma resposta malformada. Achado pelo fuzzer.
+        raw_groups = data.get("groups")
+        normalized["groups"] = (
+            list(raw_groups) if isinstance(raw_groups, list) else []
+        )
         normalized["attributes"] = data.get("attributes", {})
         normalized["is_active"] = data.get("is_active", True)
         groups = normalized["groups"]
@@ -627,6 +641,49 @@ class KeyrunesClient:
         self.set_token(refreshed.access_token)
         return refreshed
 
+    def change_password(self, current_password: str, new_password: str) -> None:
+        """
+        Change the password of whoever the current token identifies.
+
+        The server also clears the account's ``first_login`` flag, which is
+        what ``requires_password_change`` reports at login: changing the
+        password here puts that warning away without a second call.
+
+        Nothing in the body says whose password it is — the token does. A body
+        that chose would make "change my password" mean "change anyone's".
+
+        Args:
+            current_password: The password being replaced. The server checks
+                it before accepting the change.
+            new_password: The new password. The server requires at least 8
+                characters and answers 400 when it is shorter.
+
+        Raises:
+            InvalidTokenError: If the client has no token set
+            NetworkError: If the server refuses — wrong current password, or a
+                new password it will not accept. The server answers **400** for
+                both, which this client maps to ``NetworkError`` like any
+                other non-401/403/404 status. The server's wording survives,
+                because "invalid current password" and "password too short" call
+                for opposite fixes.
+
+        Example:
+            >>> client = KeyrunesClient("https://keyrunes.example.com")
+            >>> client.set_token("eyJhbGciOiJIUzI1NiIs...")
+            >>> client.change_password("old-secret", "a-longer-new-secret")
+        """
+        if not self._token:
+            raise InvalidTokenError("No token available to change a password.")
+
+        self._make_request(
+            "POST",
+            ENDPOINT_CHANGE_PASSWORD,
+            data={
+                "current_password": current_password,
+                "new_password": new_password,
+            },
+        )
+
     def clear_token(self) -> None:
         """
         Clear authentication token.

{keyrunes_python_sdk-0.3.1 → keyrunes_python_sdk-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "keyrunes-python-sdk"
-version = "0.3.1"
+version = "0.4.0"
 description = "Python SDK for Keyrunes Authorization System"
 authors = ["keyrunes <contact@singularjourney.host>"]
 maintainers = ["jonatasoli <contact@jonatasoli.dev>"]
@@ -47,7 +47,6 @@ isort = "^5.12.0"
 flake8 = "^6.1.0"
 mypy = "^1.5.0"
 taskipy = "^1.12.0"
-towncrier = "^25.8.0"
 pre-commit = "^4.5.1"
 safety = "^3.7.0"
 hypothesis = "^6.0"