openentity 0.5.2__tar.gz → 0.5.4__tar.gz

{openentity-0.5.2 → openentity-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.5.2
+Version: 0.5.4
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev

{openentity-0.5.2 → openentity-0.5.4}/openentity/__init__.py

@@ -5,4 +5,4 @@ from .httpsig import HttpSigError, sign_request, verify_request  # noqa: F401
 from .identity import Identity  # noqa: F401
 from .report import TrustReport, trust  # noqa: F401
 
-__version__ = "0.5.2"
+__version__ = "0.5.4"

{openentity-0.5.2 → openentity-0.5.4}/openentity/cli.py

@@ -718,6 +718,11 @@ def _document(args):
         return {"draft": True}, "draft saved. Publish with: openentity document push"
     if sub != "push":
         raise _usage("document edit|set <field> <value>|push")
+    return _push_draft(e)
+
+
+def _push_draft(e):
+    """Sign the draft as seq+1 and PUT it."""
     d = _draft(e)
     if d == _strip(e.doc):
         return {"pushed": False}, "nothing to push"
@@ -850,7 +855,14 @@ def _alias(args):
     d = _draft(e)  # keep the next document version consistent with what the registry now verifies
     d["aliases"] = [x for x in d.get("aliases", []) if x.get("value") != a["value"]] + [a]
     _write_json(e.dir / "draft.json", d)
-    return {"alias": a, "result": res}, f"alias {a['value']} accepted{' (not yet verified)' if (res or {}).get('verified') is False else ''}. Add it to your signed document with: openentity document push"
+    # Spec 3.4: an alias counts only once the entity's signed document lists it, so publish the document now. The registry
+    # rate-limits document versions to one a minute; when that refuses, the alias stays unclaimed until `document push`.
+    accepted = f"alias {a['value']} accepted{' (not yet verified)' if (res or {}).get('verified') is False else ''}"
+    try:
+        pushed, text = _push_draft(e)
+    except (CliError, client.RegistryError, urllib.error.URLError, TimeoutError) as err:
+        return {"alias": a, "result": res, "document": None}, f"{accepted}, but it counts only once your signed document lists it: {err}. Retry with: openentity document push"
+    return {"alias": a, "result": res, "document": pushed}, f"{accepted}; {text}"
 
 
 # ---- record ----
@@ -1056,7 +1068,7 @@ def _verify(args):
         checks = _checks_of(client._request(t))
     else:
         try:
-            checks = _checks_of(json.loads(pathlib.Path(t).read_text()))
+            checks = _checks_of(core.parse_json(pathlib.Path(t).read_text()))
         except (OSError, ValueError) as e:
             raise _usage(f"cannot read {t}: {e}")
     return _report(t, checks)
@@ -1066,7 +1078,7 @@ def _verify_presentation(args):
     if not args.audience or not args.nonce:
         raise _usage("verify-presentation <file> --audience <this verifier's origin or DID> --nonce <the nonce you issued>")
     try:
-        p = json.loads(pathlib.Path(args.file).read_text())
+        p = core.parse_json(pathlib.Path(args.file).read_text())
     except (OSError, ValueError) as e:
         raise _usage(f"cannot read {args.file}: {e}")
     r = core.verify_presentation(p, args.audience, args.nonce, resolver=_resolver)

{openentity-0.5.2 → openentity-0.5.4}/openentity/core.py

@@ -79,6 +79,27 @@ def _num(x) -> str:
     return ("-" if x < 0 else "") + r
 
 
+def parse_json(text: str):
+    """Spec 4.3: JSON with no duplicate keys (json.loads keeps the last one silently)."""
+    def pairs(items):
+        keys = [k for k, _ in items]
+        if len(keys) != len(set(keys)):
+            raise ValueError(f"duplicate key {next(k for k in keys if keys.count(k) > 1)!r}")
+        return dict(items)
+    return json.loads(text, object_pairs_hook=pairs)
+
+
+def bad_number(v):
+    """Spec 4.3: integers or decimal fractions with at most 6 decimal places. The first offender, else None."""
+    if isinstance(v, float):
+        return None if math.isfinite(v) and float(f"{v:.6f}") == v else v
+    if isinstance(v, dict):
+        v = v.values()
+    if isinstance(v, (list, tuple, type({}.values()))):
+        return next((b for b in map(bad_number, v) if b is not None), None)
+    return None
+
+
 def canonicalize(v) -> str:
     if v is None or isinstance(v, bool):
         return json.dumps(v)

{openentity-0.5.2 → openentity-0.5.4}/openentity/identity.py

@@ -37,8 +37,13 @@ def _keychain_set(seed_hex: str) -> bool:
     return False
 
 
+def home() -> pathlib.Path:
+    """OPENENTITY_HOME, else ~/.openentity: where the key file and integrations' state live."""
+    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser()
+
+
 def _file() -> pathlib.Path:
-    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser() / "identity.key"
+    return home() / "identity.key"
 
 
 class Identity:
@@ -54,10 +59,17 @@ class Identity:
         return self.kp.seed
 
     @classmethod
-    def load_or_create(cls) -> "Identity":
+    def load(cls) -> "Identity | None":
+        """The existing identity, or None. Never creates one."""
         for source, read in (("keychain", _keychain_get), ("file", lambda: _file().read_text().strip() if _file().exists() else None)):
             if h := read():
                 return cls(bytes.fromhex(h), source)
+        return None
+
+    @classmethod
+    def load_or_create(cls) -> "Identity":
+        if found := cls.load():
+            return found
         seed = os.urandom(32)
         if _keychain_set(seed.hex()):
             return cls(seed, "keychain")

{openentity-0.5.2 → openentity-0.5.4}/openentity/schema.py

@@ -24,5 +24,7 @@ def validate(type_: str, obj) -> list[str]:
         return [str(e)]
     if n > _MAX.get(type_, 64 * 1024):
         return [f"{type_} is {n} bytes, max {_MAX.get(type_, 64 * 1024)}"]
+    if (n := core.bad_number(obj)) is not None:
+        return [f"number {n} has more than 6 decimal places"]
     v = Draft202012Validator({"$ref": f"{BUNDLE_ID}#/$defs/{type_}"}, registry=_REGISTRY)
     return [f"/{'/'.join(map(str, e.absolute_path))}: {e.message}" for e in v.iter_errors(obj)]

{openentity-0.5.2 → openentity-0.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.5.2"
+version = "0.5.4"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

{openentity-0.5.2 → openentity-0.5.4}/tests/test_cli.py

@@ -116,8 +116,10 @@ def test_alias_domain_platform_and_erc8004(url, home, capsys):
     for bad in (("platform", "nocolon"), ("erc8004", "x"), ("bogus", "x")):
         assert run(capsys, "alias", "add", *bad, *reg)[0] == 1
     assert run(capsys, "alias", "bogus", "domain", "x", *reg)[0] == 1
-    draft = json.loads((home / KP.did / "draft.json").read_text())
-    assert [x["type"] for x in draft["aliases"]] == ["domain", "platform", "erc8004"]
+    # Spec 3.4: each alias is published in the signed document at once, since an unlisted alias counts for nothing.
+    doc = json.loads((home / KP.did / "entity.json").read_text())
+    assert [x["type"] for x in doc["aliases"]] == ["domain", "platform", "erc8004"] and doc["seq"] == 4
+    assert not (home / KP.did / "draft.json").exists()
     assert len(posts(f"/v1/entities/{KP.did}/aliases")) == 3
 
 
@@ -146,6 +148,16 @@ def test_verify_reports_a_schema_check_like_the_npm_cli(capsys, tmp_path):
     assert code == 3 and out["checks"][0]["name"] == "EntityDocument schema" and not out["checks"][0]["ok"]
 
 
+def test_verify_refuses_a_file_with_a_duplicate_key(capsys, tmp_path):
+    """Spec 4.3: json.loads would keep the last duplicate and verify a different object than the one signed."""
+    f = tmp_path / "dup.json"
+    f.write_text('{"spec": "openentity/1.0", "name": "A", "name": "B"}')
+    code, _, err = run(capsys, "verify", str(f))
+    assert code == 1 and "duplicate key" in err
+    code, _, err = run(capsys, "verify-presentation", str(f), "--audience", "a", "--nonce", "n")
+    assert code == 1 and "duplicate key" in err
+
+
 def test_log_audit_checks_the_registry_document_with_the_key_its_spec_publishes(url, capsys):
     """The registry's DID names openentity.org, but a registry elsewhere signs with its /v1/spec key (guard: no lookup of did:web:openentity.org)."""
     Stub.leaves = [{"type": "Declaration", "eid": "did:web:openentity.org", "object_sha256": "00" * 32, "received_at": core.now()}]
@@ -286,3 +298,60 @@ def test_verify_checks_continuity_link_proofs(capsys, tmp_path):
     assert code == 0 and len(out["checks"]) == 3  # schema + the two link proofs
     f.write_text(json.dumps({**body["link"], "basis": "migration"}))
     assert run(capsys, "verify", str(f))[0] == 3
+
+
+@pytest.fixture
+def real_registry():
+    """The real registry app (in-memory PGlite), not the stub. Skipped when the workspace is not installed."""
+    import shutil
+    import socket
+    import subprocess
+    import time
+    import urllib.request
+    from pathlib import Path
+
+    root = Path(__file__).resolve().parents[3]
+    if not shutil.which("pnpm") or not (root / "registry/node_modules").exists():
+        pytest.skip("registry workspace not installed")
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        port = s.getsockname()[1]
+    p = subprocess.Popen(["pnpm", "--filter", "@openentity/registry", "local", str(port)], cwd=root, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    base = f"http://127.0.0.1:{port}"
+    try:
+        for _ in range(120):
+            try:
+                urllib.request.urlopen(base + "/v1/spec", timeout=1)
+                break
+            except OSError:
+                time.sleep(0.5)
+        else:
+            pytest.fail("local registry did not start")
+        yield base
+    finally:
+        p.terminate()
+        p.wait(10)
+
+
+@pytest.mark.parametrize("cmd", ["rotate", "migrate"])
+def test_rotate_or_migrate_then_withdraw_against_the_real_registry(real_registry, tmp_path, monkeypatch, capsys, cmd):
+    """Spec 9.3: the successor inherits the Declaration, so its key can withdraw it; the predecessor stays active."""
+    import urllib.request
+
+    monkeypatch.setenv("OPENENTITY_HOME", str(tmp_path))
+    monkeypatch.delenv("OPENENTITY_REGISTRY", raising=False)
+    monkeypatch.delenv("OPENENTITY_EID", raising=False)
+    reg = ["--registry", real_registry]
+
+    def get(eid):
+        return json.loads(urllib.request.urlopen(f"{real_registry}/v1/entities/{eid}").read())
+
+    code, a = j(capsys, "adopt", "--name", "Py Withdraw", "--agree", *reg)
+    assert code == 0
+    code, out = j(capsys, cmd, *reg)
+    assert code == 0
+    new = out["successor"]
+    assert get(new)["declaration_inherited_from"] == a["eid"]
+    code, out = j(capsys, "withdraw", "--force", *reg)
+    assert code == 0 and out["withdrawn"] is True
+    assert get(new)["withdrawn"] is True and get(a["eid"])["withdrawn"] is False

{openentity-0.5.2 → openentity-0.5.4}/tests/test_core.py

@@ -7,7 +7,7 @@ from pathlib import Path
 
 import pytest
 
-from openentity import cli, core
+from openentity import __version__, cli, core
 
 ROOT = Path(__file__).resolve().parents[3]
 VECTORS = ROOT / "test-vectors"
@@ -198,7 +198,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
 def test_cli_version(capsys):
     with pytest.raises(SystemExit) as e:
         cli.main(["--version"])
-    assert e.value.code == 0 and "0.5.2" in capsys.readouterr().out
+    assert e.value.code == 0 and __version__ in capsys.readouterr().out
 
 
 # ---- shared vectors, checked with the independent verifier's own logic ----
@@ -269,3 +269,18 @@ def test_rotation_vector_is_reproduced_byte_for_byte():
     link = want["link"]
     assert [core.verify_object({**link, "proof": p})[1] for p in link["proofs"]] == [a.did, b.did]
     assert core.verify_object(want["document"]) == (True, b.did)
+
+
+# ---- spec 4.3: no duplicate keys, at most 6 decimal places ----
+def test_parse_json_rejects_duplicate_keys():
+    assert core.parse_json('{"a":1,"b":{"a":2},"c":[{"a":1},{"a":2}]}')["b"] == {"a": 2}
+    for bad in ('{"a":1,"a":2}', '{"x":{"k":1,"\\u006b":2}}', '[{"a":1,"b":{"c":1,"c":1}}]'):
+        with pytest.raises(ValueError, match="duplicate key"):
+            core.parse_json(bad)
+
+
+def test_validate_rejects_more_than_six_decimal_places():
+    from openentity import schema
+    att = json.loads((VECTORS / "attestation.json").read_text())["object"]
+    assert not any("decimal" in e for e in schema.validate("Attestation", {**att, "confidence": 0.123456}))
+    assert any("6 decimal places" in e for e in schema.validate("Attestation", {**att, "confidence": 0.1234567}))

{openentity-0.5.2 → openentity-0.5.4}/tests/test_identity.py

@@ -45,3 +45,15 @@ def test_keychain_failure_falls_back_to_file(monkeypatch):
     monkeypatch.delenv("OPENENTITY_KEYCHAIN")
     monkeypatch.setattr(identity, "_run", lambda argv, stdin=None: None)  # no `security`, no `secret-tool`
     assert Identity.load_or_create().source == "file"
+
+
+def test_load_never_creates_a_key(home):
+    """Read-only callers (a trust gate) must not mint an identity as a side effect."""
+    assert Identity.load() is None
+    assert not (home / "identity.key").exists()
+    a = Identity.load_or_create()
+    assert Identity.load().did == a.did
+
+
+def test_home_follows_openentity_home(home):
+    assert identity.home() == home

{openentity-0.5.2 → openentity-0.5.4}/uv.lock

@@ -699,7 +699,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.5.2"
+version = "0.5.4"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },