krx-openapi 0.1.0__tar.gz → 0.2.0__tar.gz

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/.github/workflows/reusable-check.yml

@@ -1,6 +1,6 @@
 name: reusable check
 
-# The full check -- tests, lint, types, and the zero-dependency assertion -- factored
+# The full check -- tests, lint, types, and the runtime-dependency assertion -- factored
 # into one reusable job so both `check.yml` (on push / PR) and any release gate run
 # the *identical* thing.
 
@@ -42,20 +42,25 @@ jobs:
       - name: Types
         run: .venv/bin/mypy
 
-      - name: Confirm the package still has no runtime dependencies
-        # The zero-dependency claim is in the README and pyproject; a claim nothing
-        # checks quietly stops being true. Installed into a bare environment, the
-        # package must import with nothing else present.
+      - name: Confirm the only runtime dependency is credbox
+        # The transport is dependency-free (urllib) and the sole runtime dependency is
+        # credbox, the credential store; documented in the pyproject comment. A claim
+        # nothing checks quietly stops being true, so a stray extra runtime dependency
+        # creeping into `dependencies` is caught here, not in a user's env.
         run: |
           uv venv /tmp/bare --python ${{ matrix.python-version }}
           uv pip install --python /tmp/bare/bin/python .
           /tmp/bare/bin/python -c "
+          import re
           import importlib.metadata as md
           requires = md.requires('krx-openapi') or []
           runtime = [r for r in requires if 'extra ==' not in r]
-          assert not runtime, f'runtime dependencies appeared: {runtime}'
+          # Each requirement's bare name (before any version/marker/extra), PEP 503
+          # normalized; the runtime set must be exactly credbox.
+          names = sorted(re.split(r'[<>=!~;\[\s]', r, maxsplit=1)[0].replace('_', '-').lower() for r in runtime)
+          assert names == ['credbox'], f'unexpected runtime dependencies: {runtime}'
           import krx_openapi
-          print('krx_openapi', krx_openapi.__version__, 'imports with no third-party packages')
+          print('krx_openapi', krx_openapi.__version__, 'imports with only credbox present')
           "
           # The console script runs, and its top-level --version prints (not shoved
           # into a required subcommand).

krx_openapi-0.2.0/Makefile

@@ -0,0 +1,13 @@
+# Run the standard CI checks (test, lint, types) locally. Dev extras: uv pip install -e ".[dev]"
+.PHONY: check test lint types
+
+check: test lint types
+
+test:
+	pytest -q
+
+lint:
+	ruff check src tests
+
+types:
+	mypy

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: krx-openapi
-Version: 0.1.0
+Version: 0.2.0
 Summary: Read the Korea Exchange (KRX) Open API: indices, stocks, ETP, bonds, derivatives, commodities, ESG.
 Project-URL: Homepage, https://github.com/seokhoonj/krx-openapi
 Project-URL: Repository, https://github.com/seokhoonj/krx-openapi
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Office/Business :: Financial
 Requires-Python: >=3.11
+Requires-Dist: credbox>=0.4
 Provides-Extra: dev
 Requires-Dist: mypy>=1.11; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
@@ -175,6 +176,8 @@ krx fetch bond treasury 20200414
 
 ### 5.1 Claude Code
 
+Claude Code 채팅창에서 마켓플레이스를 추가하고 설치합니다:
+
 ```
 /plugin marketplace add seokhoonj/krx-openapi
 /plugin install krx@krx-openapi
@@ -185,6 +188,8 @@ krx fetch bond treasury 20200414
 
 ### 5.2 Codex
 
+터미널에서 마켓플레이스를 추가하고 설치합니다:
+
 ```
 codex plugin marketplace add seokhoonj/krx-openapi
 codex plugin add krx@krx-openapi
@@ -232,5 +237,5 @@ Claude Code는 바로 인식하고, Codex는 재시작해야 로딩됩니다.
 
 ## 8. 라이선스
 
-MIT. 이 패키지의 코드에 대한 라이선스이며, KRX 데이터 자체의 이용 조건은 위 KRX
+[MIT](LICENSE). 이 패키지의 코드에 대한 라이선스이며, KRX 데이터 자체의 이용 조건은 위 KRX
 이용약관을 따릅니다.

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/README.en.md

@@ -149,6 +149,8 @@ krx fetch bond treasury 20200414
 
 ### 5.1 Claude Code
 
+In the Claude Code chat, add the marketplace and install:
+
 ```
 /plugin marketplace add seokhoonj/krx-openapi
 /plugin install krx@krx-openapi
@@ -159,6 +161,8 @@ or call a skill directly — `/krx:list`, `/krx:fields index kospi`, `/krx:fetch
 
 ### 5.2 Codex
 
+In your terminal, add the marketplace and install:
+
 ```
 codex plugin marketplace add seokhoonj/krx-openapi
 codex plugin add krx@krx-openapi

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/README.md

@@ -147,6 +147,8 @@ krx fetch bond treasury 20200414
 
 ### 5.1 Claude Code
 
+Claude Code 채팅창에서 마켓플레이스를 추가하고 설치합니다:
+
 ```
 /plugin marketplace add seokhoonj/krx-openapi
 /plugin install krx@krx-openapi
@@ -157,6 +159,8 @@ krx fetch bond treasury 20200414
 
 ### 5.2 Codex
 
+터미널에서 마켓플레이스를 추가하고 설치합니다:
+
 ```
 codex plugin marketplace add seokhoonj/krx-openapi
 codex plugin add krx@krx-openapi
@@ -204,5 +208,5 @@ Claude Code는 바로 인식하고, Codex는 재시작해야 로딩됩니다.
 
 ## 8. 라이선스
 
-MIT. 이 패키지의 코드에 대한 라이선스이며, KRX 데이터 자체의 이용 조건은 위 KRX
+[MIT](LICENSE). 이 패키지의 코드에 대한 라이선스이며, KRX 데이터 자체의 이용 조건은 위 KRX
 이용약관을 따릅니다.

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/pyproject.toml

@@ -1,10 +1,13 @@
 [build-system]
-requires = ["hatchling"]
+# Cap <1.32: hatchling 1.32 emits Metadata-Version 2.5, which the twine bundled in the pinned
+# PyPI-publish action rejects (pypa/twine#1327). 2.4 is accepted by PyPI and that twine; the
+# 1.27 floor is PEP 639 (the SPDX license expression and license-files). Lift once twine updates.
+requires = ["hatchling>=1.27,<1.32"]
 build-backend = "hatchling.build"
 
 [project]
 name = "krx-openapi"
-version = "0.1.0"
+version = "0.2.0"
 description = "Read the Korea Exchange (KRX) Open API: indices, stocks, ETP, bonds, derivatives, commodities, ESG."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -24,12 +27,15 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Topic :: Office/Business :: Financial",
 ]
-# No runtime dependencies on purpose: urllib and json from the standard library
-# carry the whole client. A data client that never breaks on a third party's release
-# is worth more than any convenience they would add. Rows come back as ``list[dict]``,
-# which ``pandas.DataFrame`` / ``polars.DataFrame`` accept directly, so no DataFrame
-# library is bundled or wrapped.
-dependencies = []
+# The transport is dependency-free on purpose: urllib and json from the standard library
+# carry the whole client, and a data client that never breaks on a transport library's
+# release is worth more than any convenience one would add. Rows come back as
+# ``list[dict]``, which ``pandas.DataFrame`` / ``polars.DataFrame`` accept directly, so no
+# DataFrame library is bundled. The one runtime dependency is credbox, the shared
+# credential store the API key is read from.
+dependencies = [
+    "credbox>=0.4",
+]
 
 [project.optional-dependencies]
 dev = [

krx_openapi-0.2.0/src/krx_openapi/_config.py

@@ -0,0 +1,80 @@
+"""Resolve the KRX API key from the caller, the environment, or the config file.
+
+The key is looked up in a fixed order, so an explicit value always wins and a set
+environment variable beats a file on disk:
+
+1. the ``api_key`` passed to ``KRX(...)``
+2. the ``KRX_API_KEY`` environment variable
+3. ``"KRX_API_KEY"`` in ``$XDG_CONFIG_HOME/krx-openapi/credentials.json``
+   (``$XDG_CONFIG_HOME`` defaults to ``~/.config``)
+
+The resolution, the whitespace trimming, the permission handling (a group/other-readable
+file is warned about, not refused), and the storage backend are delegated to credbox. The
+store binding is not hardcoded: ``Credentials.for_app("krx-openapi")`` lets a host
+embedding krx-openapi redirect it via ``KRX_OPENAPI_STORE_APP`` / ``KRX_OPENAPI_NAMESPACE``;
+standalone it is exactly the flat ``~/.config/krx-openapi/credentials.json`` krx-openapi has
+always read. A file that is present but unreadable, not JSON, or not a JSON object is still
+an error rather than a silent skip.
+
+Once a key is found, it is still checked for characters it cannot send as an HTTP header
+here -- credbox trims surrounding whitespace but keeps an embedded newline/tab or a
+non-ASCII character, any of which would make an invalid header and let urllib echo part of
+the key while encoding it. That check is krx-openapi's own concern, not something the
+credential store knows about.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+
+from credbox import CredBoxError, Credentials
+
+from .errors import KRXConfigError
+
+_ENV_VAR = "KRX_API_KEY"
+_STORE_APP = "krx-openapi"
+
+
+def resolve_api_key(explicit: str | None) -> str:
+    """Return the first key found across the three sources, or raise if none exists."""
+    try:
+        found = _get_credentials().secret(_ENV_VAR, override=explicit)
+    except CredBoxError as err:
+        # credbox's message already names the store path + fault; don't prepend a static
+        # path (wrong under a KRX_OPENAPI_STORE_APP redirect). credbox detaches
+        # secret-bearing context, so chaining `from err` keeps the key out of any traceback.
+        raise KRXConfigError(f"could not read the credential store: {err}") from err
+    if found is None:
+        # Binding validated cleanly above (None, not error), so store_location() is safe
+        # and gives the real store (the host's under a redirect).
+        raise KRXConfigError(
+            f"no KRX API key: pass api_key=, set the {_ENV_VAR} environment "
+            f"variable, or put it in {_get_credentials().store_location()}"
+        )
+    key = found.reveal()
+    if any(not (0x20 <= ord(ch) < 0x7f) for ch in key):
+        # The key rides an HTTP header (AUTH_KEY). Any byte outside printable ASCII -- a
+        # stray newline/tab from a copy-paste, or a non-ASCII character -- makes an invalid
+        # header, and urllib raises *while encoding it*, echoing the offending character
+        # (part of the key). Reject it here, before it becomes a request, and never echo
+        # it. KRX keys are ASCII tokens, so no legitimate key is lost.
+        raise KRXConfigError(
+            "the KRX API key contains a character it cannot send as an HTTP header "
+            "(a stray newline, tab, or non-ASCII character?)")
+    return key
+
+
+@lru_cache(maxsize=1)
+def _get_credentials() -> Credentials:
+    """krx-openapi's credbox credential store, built on first use and cached.
+
+    Built via ``for_app`` (not the bare ``Credentials(...)``) so a host embedding
+    krx-openapi can redirect the binding with ``KRX_OPENAPI_STORE_APP`` /
+    ``KRX_OPENAPI_NAMESPACE`` before the first lookup. credbox re-resolves the store
+    *path* per call (honouring a later ``XDG_CONFIG_HOME``); the binding is read from the
+    environment once, when this facade is built. A malformed binding surfaces as
+    ``KRXConfigError`` on the first lookup that actually reaches the store -- an explicit
+    argument or ``KRX_API_KEY`` resolves first, so a bad binding with the env var set
+    never raises.
+    """
+    return Credentials.for_app(_STORE_APP)

{krx_openapi-0.1.0 → krx_openapi-0.2.0}/src/krx_openapi/session.py

@@ -2,8 +2,8 @@
 
 The session holds the API key and turns an endpoint + params into rows: a
 ``list[dict[str, str]]``, the vendor's ``OutBlock_*`` array passed through with its
-own field names. No third-party HTTP client -- ``urllib`` carries it, so the package
-has zero runtime dependencies.
+own field names. No third-party HTTP client -- ``urllib`` carries the transport; the
+credential store (credbox) the key is read from is the package's only runtime dependency.
 
 KRX answers with HTTP 200 even on failure and marks the failure with a non-empty
 ``respCode`` (+ ``respMsg``) in the JSON body; :meth:`fetch` applies that contract,

krx_openapi-0.2.0/tests/conftest.py

@@ -0,0 +1,18 @@
+"""Shared test fixtures for krx-openapi."""
+
+from __future__ import annotations
+
+import pytest
+
+from krx_openapi import _config
+
+
+@pytest.fixture(autouse=True)
+def _reset_credbox_binding(monkeypatch):
+    """Reset the cached credbox facade and the store-binding env vars around every test,
+    so a binding one test sets (or a dev's shell) cannot leak into another."""
+    monkeypatch.delenv("KRX_OPENAPI_STORE_APP", raising=False)
+    monkeypatch.delenv("KRX_OPENAPI_NAMESPACE", raising=False)
+    _config._get_credentials.cache_clear()
+    yield
+    _config._get_credentials.cache_clear()

krx_openapi-0.2.0/tests/test_config.py

@@ -0,0 +1,207 @@
+"""Config resolution -- explicit > env > file, the header-safety guard (printable ASCII)
+applied to whatever is found, and the secret-safety invariant that the key never rides
+along in an error message or its cause chain."""
+
+import json
+import os
+
+import pytest
+
+from krx_openapi._config import resolve_api_key
+from krx_openapi.errors import KRXConfigError
+
+VALID_API_KEY = "krx-service-key-0123456789"  # a well-formed KRX key (printable ASCII)
+
+
+def _point_config_at(tmp_path, monkeypatch):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("KRX_API_KEY", raising=False)
+    return tmp_path / "krx-openapi" / "credentials.json"
+
+
+def _write_credentials_file(path, contents):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(contents, encoding="utf-8")
+
+
+def _assert_secret_safe(error, secret):
+    seen = set()
+    pending = [error]
+    while pending:
+        current = pending.pop()
+        if current is None or id(current) in seen:
+            continue
+        seen.add(id(current))
+        assert secret not in str(current)
+        assert secret not in repr(current)
+        pending.extend([current.__cause__, current.__context__])
+
+
+def test_explicit_key_wins(tmp_path, monkeypatch):
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": "from-file"}))
+    monkeypatch.setenv("KRX_API_KEY", "from-env")
+    assert resolve_api_key("from-arg") == "from-arg"
+
+
+def test_env_beats_file(tmp_path, monkeypatch):
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": "from-file"}))
+    monkeypatch.setenv("KRX_API_KEY", "from-env")
+    assert resolve_api_key(None) == "from-env"
+
+
+def test_file_is_last_resort(tmp_path, monkeypatch):
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": "from-file"}))
+    assert resolve_api_key(None) == "from-file"
+
+
+def test_missing_everywhere_raises(tmp_path, monkeypatch):
+    _point_config_at(tmp_path, monkeypatch)  # no file written
+    with pytest.raises(KRXConfigError, match="no KRX API key"):
+        resolve_api_key(None)
+
+
+def test_blank_key_is_not_a_key(tmp_path, monkeypatch):
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": "   "}))
+    with pytest.raises(KRXConfigError, match="no KRX API key"):
+        resolve_api_key("   ")
+
+
+@pytest.mark.parametrize("blank_source", ["explicit", "environment"])
+def test_blank_higher_tier_falls_through_to_the_file(tmp_path, monkeypatch, blank_source):
+    # A blank explicit argument or env var is "absent" (credbox trims to empty), so
+    # resolution falls through to the file rather than returning empty.
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": VALID_API_KEY}))
+    explicit = None
+    if blank_source == "explicit":
+        explicit = "   "
+    else:
+        monkeypatch.setenv("KRX_API_KEY", "   ")
+
+    assert resolve_api_key(explicit) == VALID_API_KEY
+
+
+@pytest.mark.parametrize("contents", ["{not json", "[1, 2, 3]", json.dumps({"KRX_API_KEY": 1})])
+def test_malformed_credentials_file_is_rejected(tmp_path, monkeypatch, contents):
+    # Not-JSON, a non-object, or a non-string value all reach the caller as a config
+    # error rather than a silent skip -- credbox validates the store and its fault is
+    # translated to KRXConfigError.
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, contents)
+    with pytest.raises(KRXConfigError, match="could not read"):
+        resolve_api_key(None)
+
+
+def test_credentials_path_that_is_a_directory_is_rejected(tmp_path, monkeypatch):
+    # A present-but-unreadable store (here a directory at the file path) is an error,
+    # not a silent "no key here".
+    path = _point_config_at(tmp_path, monkeypatch)
+    path.mkdir(parents=True)
+    with pytest.raises(KRXConfigError, match="could not read"):
+        resolve_api_key(None)
+
+
+@pytest.mark.parametrize("source", ["explicit", "environment", "stored"])
+def test_key_is_trimmed_at_every_tier(tmp_path, monkeypatch, source):
+    # credbox strips surrounding whitespace at every tier (a pasted trailing newline no
+    # longer breaks auth); pinned so a future change cannot silently return padding.
+    path = _point_config_at(tmp_path, monkeypatch)
+    explicit = None
+    if source == "explicit":
+        explicit = "  " + VALID_API_KEY + "  "
+    elif source == "environment":
+        monkeypatch.setenv("KRX_API_KEY", "  " + VALID_API_KEY + "  ")
+    else:
+        _write_credentials_file(path, json.dumps({"KRX_API_KEY": "  " + VALID_API_KEY + "  "}))
+
+    assert resolve_api_key(explicit) == VALID_API_KEY
+
+
+@pytest.mark.parametrize("bad_key", ["prefix\nSECRETTAIL", "prefix한SECRETTAIL"])
+def test_key_outside_printable_ascii_raises_and_never_echoes_the_key(monkeypatch, bad_key):
+    # credbox trims surrounding whitespace but keeps an embedded newline or a non-ASCII
+    # character; either makes an invalid HTTP header and lets urllib echo the value (in
+    # whole or in part) while encoding it. Reject it as config, echoing nothing -- not in
+    # the message, not anywhere in the cause chain. (The non-ASCII case would otherwise
+    # leak one character + its offset through an uncaught UnicodeEncodeError in session.)
+    monkeypatch.delenv("KRX_API_KEY", raising=False)
+    with pytest.raises(KRXConfigError, match="cannot send as an HTTP header") as exc:
+        resolve_api_key(bad_key)
+    _assert_secret_safe(exc.value, "prefix")
+    _assert_secret_safe(exc.value, "SECRETTAIL")
+    _assert_secret_safe(exc.value, "한")
+
+
+def test_store_binding_redirects_to_a_host_namespace(tmp_path, monkeypatch):
+    # A host embedding krx-openapi redirects the store via KRX_OPENAPI_STORE_APP +
+    # KRX_OPENAPI_NAMESPACE, so krx-openapi's key lives in the host's store under a
+    # krx-openapi section.
+    _point_config_at(tmp_path, monkeypatch)
+    monkeypatch.setenv("KRX_OPENAPI_STORE_APP", "host")
+    monkeypatch.setenv("KRX_OPENAPI_NAMESPACE", "krx")
+    host = tmp_path / "host"
+    host.mkdir(parents=True)
+    (host / "credentials.json").write_text(
+        json.dumps({"krx": {"KRX_API_KEY": VALID_API_KEY}}), encoding="utf-8")
+
+    assert resolve_api_key(None) == VALID_API_KEY
+
+
+@pytest.mark.parametrize("source", ["explicit", "environment"])
+def test_higher_tier_wins_before_an_invalid_binding_is_validated(monkeypatch, source):
+    # An explicit argument or KRX_API_KEY resolves before the binding is validated
+    # (lazy), so a bad binding never raises when a higher tier supplies the key.
+    monkeypatch.delenv("KRX_API_KEY", raising=False)
+    monkeypatch.setenv("KRX_OPENAPI_STORE_APP", "../invalid")
+    explicit = None
+    if source == "explicit":
+        explicit = VALID_API_KEY
+    else:
+        monkeypatch.setenv("KRX_API_KEY", VALID_API_KEY)
+
+    assert resolve_api_key(explicit) == VALID_API_KEY
+
+
+def test_invalid_store_binding_raises_config_error(monkeypatch):
+    # A malformed binding surfaces as krx-openapi's KRXConfigError on first store touch.
+    monkeypatch.delenv("KRX_API_KEY", raising=False)
+    monkeypatch.setenv("KRX_OPENAPI_STORE_APP", "../invalid")
+    with pytest.raises(KRXConfigError, match="could not read"):
+        resolve_api_key(None)
+
+
+@pytest.mark.parametrize(
+    "contents",
+    [
+        lambda secret: secret.encode() + b"\xff",           # not valid UTF-8
+        lambda secret: (secret + "{").encode(),             # not valid JSON
+        lambda secret: json.dumps([secret]).encode(),       # a JSON array, not an object
+        lambda secret: json.dumps({"KRX_API_KEY": [secret]}).encode(),  # non-string value
+    ],
+)
+def test_malformed_store_detaches_secret_bearing_context(tmp_path, monkeypatch, contents):
+    # Whatever the fault, the key bytes must not ride along in the error, its repr, or
+    # the cause chain -- credbox detaches secret-bearing content and `from err` preserves
+    # that, the load-bearing secret-safety invariant.
+    secret = "krx-secret-value-abcdef"
+    path = _point_config_at(tmp_path, monkeypatch)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(contents(secret))
+    with pytest.raises(KRXConfigError, match="could not read") as caught:
+        resolve_api_key(None)
+    _assert_secret_safe(caught.value, secret)
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX permission bits required")
+def test_loose_permission_file_warns_and_still_reads(tmp_path, monkeypatch, capsys):
+    # A group/other-readable file is warned about (chmod 600 nudge), not refused.
+    path = _point_config_at(tmp_path, monkeypatch)
+    _write_credentials_file(path, json.dumps({"KRX_API_KEY": VALID_API_KEY}))
+    path.chmod(0o644)
+
+    assert resolve_api_key(None) == VALID_API_KEY
+    assert "chmod 600" in capsys.readouterr().err

krx_openapi-0.1.0/src/krx_openapi/_config.py

@@ -1,74 +0,0 @@
-"""Resolve the KRX API key from the caller, the environment, or the config file.
-
-The key is looked up in a fixed order, so an explicit value always wins and a set
-environment variable beats a file on disk:
-
-1. the ``api_key`` passed to ``KRX(...)``
-2. the ``KRX_API_KEY`` environment variable
-3. ``"KRX_API_KEY"`` in ``$XDG_CONFIG_HOME/krx-openapi/credentials.json``
-   (``$XDG_CONFIG_HOME`` defaults to ``~/.config``)
-
-The file is optional -- its absence just means "no key here." But a file that is
-present and unreadable, not JSON, or not a JSON object is an error, because a caller
-who wrote one meant it to be used and a silent skip would hide the mistake.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-
-from .errors import KRXConfigError
-
-_ENV_VAR = "KRX_API_KEY"
-_CONFIG_DIR = "krx-openapi"
-_CONFIG_FILE = "credentials.json"
-
-
-def resolve_api_key(explicit: str | None) -> str:
-    """Return the first key found across the three sources, or raise if none exists."""
-    key = (explicit or "").strip() or os.environ.get(_ENV_VAR, "").strip() or _key_from_file()
-    if not key:
-        raise KRXConfigError(
-            f"no KRX API key: pass api_key=, set the {_ENV_VAR} environment "
-            f"variable, or put it in {credentials_path()}"
-        )
-    if any(ord(ch) < 0x20 or ord(ch) == 0x7f for ch in key):
-        # A control character (a stray newline/tab, often from a copy-paste) would make
-        # an invalid HTTP header: urllib raises ValueError echoing the whole value -- the
-        # key. Reject it as a config error, before it becomes a request, and never echo it.
-        raise KRXConfigError(
-            "the KRX API key contains a control character (a stray newline or tab?)")
-    return key
-
-
-def credentials_path() -> Path:
-    """The path krx-openapi reads a stored key from (honoring ``$XDG_CONFIG_HOME``)."""
-    config_home = os.environ.get("XDG_CONFIG_HOME") or str(Path.home() / ".config")
-    return Path(config_home) / _CONFIG_DIR / _CONFIG_FILE
-
-
-def _key_from_file() -> str:
-    path = credentials_path()
-    try:
-        text = path.read_text(encoding="utf-8")
-    except FileNotFoundError:
-        return ""
-    except UnicodeDecodeError as err:
-        # A present file that is not UTF-8 is "unreadable" in the same sense as an
-        # OSError: the caller wrote it meaning it to be used, so surface it, not a
-        # raw decode error. (UnicodeDecodeError is a ValueError, not an OSError.)
-        raise KRXConfigError(f"{path} is not valid UTF-8: {err}") from err
-    except OSError as err:
-        raise KRXConfigError(f"could not read {path}: {err}") from err
-
-    try:
-        data = json.loads(text)
-    except json.JSONDecodeError as err:
-        raise KRXConfigError(f"{path} is not valid JSON: {err}") from err
-    if not isinstance(data, dict):
-        raise KRXConfigError(f"{path} must contain a JSON object")
-
-    key = data.get(_ENV_VAR)
-    return key.strip() if isinstance(key, str) else ""

krx_openapi-0.1.0/tests/test_config.py

@@ -1,101 +0,0 @@
-"""Config resolution -- explicit > env > file, and the failure modes."""
-
-import json
-from pathlib import Path
-
-import pytest
-
-from krx_openapi._config import credentials_path, resolve_api_key
-from krx_openapi.errors import KRXConfigError
-
-
-def _point_config_at(tmp_path, monkeypatch):
-    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
-    monkeypatch.delenv("KRX_API_KEY", raising=False)
-    return tmp_path / "krx-openapi" / "credentials.json"
-
-
-def _write(path, data):
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(data, encoding="utf-8")
-
-
-def test_explicit_key_wins(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, json.dumps({"KRX_API_KEY": "from-file"}))
-    monkeypatch.setenv("KRX_API_KEY", "from-env")
-    assert resolve_api_key("from-arg") == "from-arg"
-
-
-def test_env_beats_file(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, json.dumps({"KRX_API_KEY": "from-file"}))
-    monkeypatch.setenv("KRX_API_KEY", "from-env")
-    assert resolve_api_key(None) == "from-env"
-
-
-def test_file_is_last_resort(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, json.dumps({"KRX_API_KEY": "from-file"}))
-    assert resolve_api_key(None) == "from-file"
-
-
-def test_missing_everywhere_raises(tmp_path, monkeypatch):
-    _point_config_at(tmp_path, monkeypatch)  # no file written
-    with pytest.raises(KRXConfigError):
-        resolve_api_key(None)
-
-
-def test_whitespace_key_is_not_a_key(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, json.dumps({"KRX_API_KEY": "   "}))
-    with pytest.raises(KRXConfigError):
-        resolve_api_key("   ")
-
-
-def test_present_but_invalid_json_raises(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, "{not json")
-    with pytest.raises(KRXConfigError):
-        resolve_api_key(None)
-
-
-def test_non_object_json_raises(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, "[1, 2, 3]")
-    with pytest.raises(KRXConfigError):
-        resolve_api_key(None)
-
-
-def test_present_but_invalid_utf8_raises(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_bytes(b"\xff\xfe not utf-8")  # present but undecodable
-    with pytest.raises(KRXConfigError):
-        resolve_api_key(None)
-
-
-def test_key_with_control_char_raises_and_never_echoes_the_key():
-    # A stray newline inside the key would make an invalid HTTP header, and urllib's
-    # ValueError would echo the whole value. Reject it as config, without echoing it.
-    with pytest.raises(KRXConfigError) as exc:
-        resolve_api_key("prefix\nSECRETTAIL")
-    assert "SECRETTAIL" not in str(exc.value)
-    assert "prefix" not in str(exc.value)
-
-
-def test_present_but_unreadable_raises(tmp_path, monkeypatch):
-    path = _point_config_at(tmp_path, monkeypatch)
-    _write(path, json.dumps({"KRX_API_KEY": "x"}))
-
-    def boom(self, *args, **kwargs):
-        raise PermissionError("locked")
-
-    monkeypatch.setattr(Path, "read_text", boom)  # file exists but cannot be read
-    with pytest.raises(KRXConfigError):
-        resolve_api_key(None)
-
-
-def test_credentials_path_honors_xdg(tmp_path, monkeypatch):
-    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
-    assert credentials_path() == tmp_path / "krx-openapi" / "credentials.json"