mailsocket 0.1.2__tar.gz → 0.1.3__tar.gz

{mailsocket-0.1.2 → mailsocket-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mailsocket
-Version: 0.1.2
+Version: 0.1.3
 Summary: Official Python client for the mailsocket REST API — one line to wait for an OTP.
 Author: mailsocket
 License-Expression: MIT
@@ -116,5 +116,11 @@ cd python
 python -m pytest -q
 ```
 
-Tests are fully offline — they monkeypatch `urllib.request.urlopen` with a
-scripted responder, so nothing touches the live API.
+Tests make no external or live-API requests. Most monkeypatch
+`urllib.request.urlopen` with a scripted responder, and a few start a real local
+`http.server` on `127.0.0.1` to check actual request behaviour, e.g. that an
+invalid id never reaches the network.
+
+## Changelog
+
+- **0.1.3** — `_seg` now rejects an empty id or a bare `.`/`..` id with a `MailsocketError` (`code="invalid_id"`) before any request is made, matching the TypeScript SDK's contract.

{mailsocket-0.1.2 → mailsocket-0.1.3}/README.md

@@ -90,5 +90,11 @@ cd python
 python -m pytest -q
 ```
 
-Tests are fully offline — they monkeypatch `urllib.request.urlopen` with a
-scripted responder, so nothing touches the live API.
+Tests make no external or live-API requests. Most monkeypatch
+`urllib.request.urlopen` with a scripted responder, and a few start a real local
+`http.server` on `127.0.0.1` to check actual request behaviour, e.g. that an
+invalid id never reaches the network.
+
+## Changelog
+
+- **0.1.3** — `_seg` now rejects an empty id or a bare `.`/`..` id with a `MailsocketError` (`code="invalid_id"`) before any request is made, matching the TypeScript SDK's contract.

{mailsocket-0.1.2 → mailsocket-0.1.3}/mailsocket/__init__.py

@@ -3,7 +3,7 @@
 from .client import Client, Page, WaitResult
 from .errors import AuthError, MailsocketError, NotFound, RateLimited, WaitTimeout
 
-__version__ = "0.1.2"
+__version__ = "0.1.3"
 
 __all__ = [
     "Client",

{mailsocket-0.1.2 → mailsocket-0.1.3}/mailsocket/client.py

@@ -32,13 +32,19 @@ def _sleep(seconds: float) -> None:
 def _seg(value) -> str:
     """Percent-encode an id as ONE path segment (``/``, ``?``, ``#``, ``..`` safe).
 
-    ``quote`` leaves ``.`` alone (unreserved), so a bare ``.``/``..`` segment
-    is additionally encoded as ``%2E`` so no proxy can treat it as traversal.
+    An empty id and the bare dot segments ``.`` / ``..`` are rejected with a
+    :class:`MailsocketError` before any request is made (same contract as the
+    TypeScript SDK's ``seg``): urllib's request machinery would otherwise let
+    them collapse into a different path than the caller intended. No real id
+    is ever one of these.
     """
-    encoded = urllib.parse.quote(str(value), safe="")
-    if encoded in (".", ".."):
-        encoded = encoded.replace(".", "%2E")
-    return encoded
+    raw = str(value)
+    if raw in ("", ".", ".."):
+        raise MailsocketError(
+            f"Invalid id {raw!r}: ids must be non-empty and not \".\" or \"..\".",
+            code="invalid_id",
+        )
+    return urllib.parse.quote(raw, safe="")
 
 
 class Page:
@@ -282,7 +288,7 @@ class Client:
             url += "?" + urllib.parse.urlencode(params, doseq=True)
         headers = {
             "Accept": "application/json",
-            "User-Agent": "mailsocket-python/0.1.2",
+            "User-Agent": "mailsocket-python/0.1.3",
         }
         headers.update(self._extra_headers)
         # Set last so nothing in extra_headers can ever replace it.

{mailsocket-0.1.2 → mailsocket-0.1.3}/mailsocket.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mailsocket
-Version: 0.1.2
+Version: 0.1.3
 Summary: Official Python client for the mailsocket REST API — one line to wait for an OTP.
 Author: mailsocket
 License-Expression: MIT
@@ -116,5 +116,11 @@ cd python
 python -m pytest -q
 ```
 
-Tests are fully offline — they monkeypatch `urllib.request.urlopen` with a
-scripted responder, so nothing touches the live API.
+Tests make no external or live-API requests. Most monkeypatch
+`urllib.request.urlopen` with a scripted responder, and a few start a real local
+`http.server` on `127.0.0.1` to check actual request behaviour, e.g. that an
+invalid id never reaches the network.
+
+## Changelog
+
+- **0.1.3** — `_seg` now rejects an empty id or a bare `.`/`..` id with a `MailsocketError` (`code="invalid_id"`) before any request is made, matching the TypeScript SDK's contract.

{mailsocket-0.1.2 → mailsocket-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mailsocket"
-version = "0.1.2"
+version = "0.1.3"
 description = "Official Python client for the mailsocket REST API — one line to wait for an OTP."
 readme = "README.md"
 requires-python = ">=3.9"

{mailsocket-0.1.2 → mailsocket-0.1.3}/tests/test_client.py

@@ -203,8 +203,6 @@ HOSTILE_IDS = [
     ("in?x=1", "in%3Fx%3D1"),
     ("in#frag", "in%23frag"),
     ("../../admin", "..%2F..%2Fadmin"),
-    ("..", "%2E%2E"),
-    (".", "%2E"),
     ("a/b", "a%2Fb"),
     ("sp ce&%", "sp%20ce%26%25"),
 ]
@@ -437,18 +435,88 @@ def test_error_types_are_mailsocket_subclasses():
     assert issubclass(WaitTimeout, MailsocketError)
 
 
+# -- F2: _seg rejects "" / "." / ".." before any request (parity with TS) -----
+
+
+def test_seg_rejects_empty_and_dot_segments():
+    for raw in ("", ".", ".."):
+        with pytest.raises(MailsocketError) as exc_info:
+            mailsocket.client._seg(raw)
+        assert exc_info.value.code == "invalid_id"
+
+
+INVALID_IDS = ["", ".", ".."]
+
+
+@pytest.mark.parametrize("raw", INVALID_IDS)
+def test_invalid_id_rejected_before_any_request_hits_real_server(raw):
+    """Nothing reaches the network: a real local http.server never sees a request."""
+    import http.server
+    import threading
+
+    seen = []
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def _record(self):
+            seen.append(self.path)
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.end_headers()
+            self.wfile.write(json.dumps({"data": {"id": "x"}}).encode())
+
+        def do_GET(self):
+            self._record()
+
+        def do_DELETE(self):
+            self._record()
+
+        def do_POST(self):
+            self._record()
+
+        def log_message(self, format, *args):
+            pass  # keep test output clean
+
+    server = http.server.HTTPServer(("127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        base_url = f"http://127.0.0.1:{server.server_port}/api/v1"
+        client = Client("ms_live_test1234567890", base_url=base_url)
+
+        calls = [
+            lambda: client.get_inbox(raw),
+            lambda: client.delete_inbox(raw),
+            lambda: client.list_messages(raw),
+            lambda: client.get_latest(raw),
+            lambda: client.get_message(raw),
+            lambda: client.wait_for_otp(raw, timeout=5),
+            lambda: client.wait_for_link(raw, timeout=5),
+            lambda: client.wait(raw, timeout=5),
+        ]
+        for call in calls:
+            with pytest.raises(MailsocketError) as exc_info:
+                call()
+            assert exc_info.value.code == "invalid_id"
+            assert not isinstance(exc_info.value, WaitTimeout)
+
+        assert seen == []  # nothing ever reached the network
+    finally:
+        server.shutdown()
+        thread.join(timeout=5)
+
+
 def test_version_exported():
     assert hasattr(mailsocket, "__version__")
 
 
 def test_metadata_consistency_across_files():
-    """0.1.2 must match everywhere: pyproject, __version__, user agent."""
+    """0.1.3 must match everywhere: pyproject, __version__, user agent."""
     import re
     import tomllib
     from pathlib import Path
 
     root = Path(__file__).resolve().parents[1]
-    expected = "0.1.2"
+    expected = "0.1.3"
 
     pyproject = tomllib.loads((root / "pyproject.toml").read_text())
     assert pyproject["project"]["version"] == expected