python-daynest 0.1.10__tar.gz → 0.1.12__tar.gz

python_daynest-0.1.12/.python-version

@@ -0,0 +1 @@
+3.14

python_daynest-0.1.12/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.5
+Name: python-daynest
+Version: 0.1.12
+Summary: Python client library for the Daynest API
+License: MIT
+Requires-Python: >=3.14
+Requires-Dist: aiohttp>=3.14.5

{python_daynest-0.1.10 → python_daynest-0.1.12}/pyproject.toml

@@ -1,19 +1,19 @@
 [project]
 name = "python-daynest"
-version = "0.1.10"
+version = "0.1.12"
 description = "Python client library for the Daynest API"
-requires-python = ">=3.12"
+requires-python = ">=3.14"
 license = { text = "MIT" }
 dependencies = [
-    "aiohttp>=3.9",
+    "aiohttp>=3.14.5",
 ]
 
 [dependency-groups]
 dev = [
-    "pytest==9.1.1",
-    "pytest-asyncio==1.4.0",
-    "ruff==0.15.22",
-    "pyright==1.1.411",
+    "pytest==9.2.0",
+    "pytest-asyncio==1.4.1.post1",
+    "ruff==0.17.4",
+    "pyright==1.1.414",
 ]
 
 [build-system]
@@ -25,13 +25,18 @@ packages = ["src/daynest"]
 
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
 testpaths = ["tests"]
 markers = ["unit: fast, isolated unit tests"]
 
 [tool.pyright]
 include = ["src"]
-pythonVersion = "3.12"
+pythonVersion = "3.14"
 typeCheckingMode = "standard"
 
+[tool.ruff]
+target-version = "py314"
+line-length = 120
+
 [tool.ruff.lint]
 per-file-ignores = { "__init__.py" = ["F401"] }

{python_daynest-0.1.10 → python_daynest-0.1.12}/src/daynest/client.py

@@ -2,17 +2,17 @@
 
 from __future__ import annotations
 
-import logging
-import json
-import inspect
 import asyncio
 import copy
+import inspect
+import json
+import logging
 import time
 import weakref
 from collections.abc import Awaitable, Callable, Mapping
 from datetime import date, timedelta
-from typing import Any, TypeVar
-from urllib.parse import urlencode, urljoin
+from typing import Any, Self, TypeVar
+from urllib.parse import urlencode, urljoin, urlsplit
 
 import aiohttp
 
@@ -46,6 +46,29 @@ logger = logging.getLogger(__name__)
 ModelT = TypeVar("ModelT")
 
 
+def _checked_oidc_url(value: object) -> str:
+    """Validate a plain HTTPS endpoint, allowing HTTP only on loopback."""
+    if not isinstance(value, str):
+        raise TypeError("Sign-in endpoints must be URLs")
+    if any(character.isspace() or ord(character) < 32 or ord(character) == 127 for character in value):
+        raise ValueError("Sign-in endpoints must not contain whitespace or controls")
+    url = urlsplit(value)
+    # Accessing port also rejects malformed and out-of-range port numbers.
+    _ = url.port
+    if (
+        url.scheme not in {"https", "http"}
+        or (url.scheme == "http" and url.hostname not in {"localhost", "127.0.0.1", "::1"})
+        or not url.hostname
+        or url.username is not None
+        or url.password is not None
+        or "?" in value
+        or "#" in value
+        or "\\" in value
+    ):
+        raise ValueError("Sign-in endpoints must be plain HTTPS URLs")
+    return value
+
+
 class DaynestClient:
     """Async HTTP client for the Daynest API.
 
@@ -98,7 +121,7 @@ class DaynestClient:
         self._enable_sse = enable_sse
         self._background_tasks: set[asyncio.Task[Any]] = set()
 
-    async def __aenter__(self) -> DaynestClient:
+    async def __aenter__(self) -> Self:
         self._context_depth += 1
         if self._owned_session and self._session is None:
             self._session = aiohttp.ClientSession()
@@ -162,16 +185,16 @@ class DaynestClient:
                     body = await response.json(content_type=None)
                     if not isinstance(body, Mapping):
                         msg = "Token endpoint response was not a JSON object"
-                        raise ValueError(msg)
+                        raise TypeError(msg)
                     token = body.get("access_token")
                     if not isinstance(token, str) or not token:
                         msg = "Token endpoint returned no access_token"
                         raise ValueError(msg)
                     try:
                         expires_in = int(body.get("expires_in", 300))
-                    except (TypeError, ValueError):
+                    except TypeError, ValueError:
                         expires_in = 300
-                except ValueError as err:
+                except (TypeError, ValueError) as err:
                     msg = f"Token endpoint returned malformed payload: {err}"
                     raise DaynestAuthError(msg) from err
                 self._cached_token = token
@@ -204,22 +227,24 @@ class DaynestClient:
 
         Returns (authorization_url, token_url) or None if the backend is
         unreachable or the response is malformed. Does not require authentication.
+        Endpoints must use HTTPS (HTTP is allowed on loopback for development)
+        and share one host and port. Discovery redirects are never followed.
         """
         url = urljoin(f"{base_url.strip().rstrip('/')}/", "api/auth/oidc-config")
         owned = session is None
         if owned:
             session = aiohttp.ClientSession()
         try:
-            async with session.get(url, timeout=REQUEST_TIMEOUT) as resp:
+            async with session.get(url, timeout=REQUEST_TIMEOUT, allow_redirects=False) as resp:
                 if resp.status == 200:
                     data = await resp.json(content_type=None)
                     if isinstance(data, dict):
-                        auth_url = data.get("authorization_url")
-                        token_url = data.get("token_url")
-                        if isinstance(auth_url, str) and isinstance(token_url, str):
+                        auth_url = _checked_oidc_url(data.get("authorization_url"))
+                        token_url = _checked_oidc_url(data.get("token_url"))
+                        if urlsplit(auth_url).netloc.lower() == urlsplit(token_url).netloc.lower():
                             return auth_url, token_url
-        except Exception:  # noqa: BLE001
-            pass
+        except Exception:
+            logger.debug("Failed to fetch OIDC discovery config from %s", url, exc_info=True)
         finally:
             if owned:
                 await session.close()
@@ -443,8 +468,7 @@ class DaynestClient:
         return [
             item
             for item in payload
-            if item.get("module_key") == "shopping_list"
-            and str(item.get("linked_ref", "")) == str(shopping_list_id)
+            if item.get("module_key") == "shopping_list" and str(item.get("linked_ref", "")) == str(shopping_list_id)
         ]
 
     async def async_create_shopping_item(
@@ -523,7 +547,9 @@ class DaynestClient:
 
     async def async_list_routine_templates(self) -> list[RoutineTemplate]:
         """List routine templates."""
-        payload = await self._cached_call("async_list_routine_templates", lambda: self._request_list("/api/templates/routines"))
+        payload = await self._cached_call(
+            "async_list_routine_templates", lambda: self._request_list("/api/templates/routines")
+        )
         return [RoutineTemplate.from_dict(item) for item in payload]
 
     async def async_create_routine_template(
@@ -651,7 +677,9 @@ class DaynestClient:
 
     async def async_export_calendar_ics(self) -> bytes:
         """Export calendar iCalendar bytes."""
-        return await self._cached_call("async_export_calendar_ics", lambda: self._request_bytes("/api/calendar/export.ics"))
+        return await self._cached_call(
+            "async_export_calendar_ics", lambda: self._request_bytes("/api/calendar/export.ics")
+        )
 
     async def async_listen(
         self,
@@ -697,7 +725,7 @@ class DaynestClient:
                                     payload = {}
                                 try:
                                     await callback(event_name, payload)
-                                except Exception:  # noqa: BLE001
+                                except Exception:
                                     logger.exception(
                                         "SSE callback failed for event %s with payload %r",
                                         event_name,
@@ -732,6 +760,7 @@ class DaynestClient:
         callback: Callable[[dict[str, Any]], Awaitable[None]],
     ) -> Callable[[], None]:
         """Subscribe to today SSE updates and return an unsubscribe callable."""
+
         async def _today_callback(event_name: str, payload: dict[str, Any]) -> None:
             if event_name == "today_updated":
                 await callback(payload)

{python_daynest-0.1.10 → python_daynest-0.1.12}/src/daynest/models.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 from datetime import date, datetime, time
-from typing import Any, Generic, TypeVar
+from typing import Any
 from uuid import UUID
 
 from daynest.exceptions import DaynestMalformedResponseError
@@ -67,11 +67,8 @@ class DaynestDashboard:
         return cls(payload=payload)
 
 
-ModelT = TypeVar("ModelT")
-
-
 @dataclass(slots=True, frozen=True)
-class DaynestApiResponse(Generic[ModelT]):
+class DaynestApiResponse[ModelT]:
     """Typed response wrapper carrying contract metadata."""
 
     data: ModelT
@@ -343,8 +340,12 @@ class CalendarEvent:
             item_id=int(_require(payload, "item_id", context="calendar event")),
             title=str(_require(payload, "title", context="calendar event")),
             status=str(payload.get("status", "")),
-            scheduled_at=_parse_datetime(scheduled_at_raw, field="scheduled_at") if scheduled_at_raw is not None else None,
-            scheduled_date=_parse_date(scheduled_date_raw, field="scheduled_date") if scheduled_date_raw is not None else None,
+            scheduled_at=_parse_datetime(scheduled_at_raw, field="scheduled_at")
+            if scheduled_at_raw is not None
+            else None,
+            scheduled_date=_parse_date(scheduled_date_raw, field="scheduled_date")
+            if scheduled_date_raw is not None
+            else None,
             detail=payload.get("detail") if isinstance(payload.get("detail"), str) else None,
             module_key=payload.get("module_key") if isinstance(payload.get("module_key"), str) else None,
             recurrence_hint=payload.get("recurrence_hint") if isinstance(payload.get("recurrence_hint"), str) else None,
@@ -396,7 +397,7 @@ class CalendarDay:
             raise DaynestMalformedResponseError(msg)
         return cls(
             date=_parse_date(_require(payload, "date", context="calendar month day"), field="date"),
-            items=tuple(),
+            items=(),
             total=int(payload.get("total", 0)),
             routines=int(payload.get("routines", 0)),
             chores=int(payload.get("chores", 0)),

{python_daynest-0.1.10 → python_daynest-0.1.12}/tests/test_client.py

@@ -16,7 +16,17 @@ from daynest.exceptions import (
     DaynestServerUnavailableError,
     DaynestTimeoutError,
 )
-from daynest.models import CalendarDay, CalendarEvent, ChoreTemplate, DaynestDashboard, DaynestSummary, MealPlan, MealSlot, PlannedItem, RoutineTemplate
+from daynest.models import (
+    CalendarDay,
+    CalendarEvent,
+    ChoreTemplate,
+    DaynestDashboard,
+    DaynestSummary,
+    MealPlan,
+    MealSlot,
+    PlannedItem,
+    RoutineTemplate,
+)
 
 VALID_SUMMARY_PAYLOAD = {
     "sensor_daynest_chores_due": 2,
@@ -551,7 +561,9 @@ class TestDaynestClientWriteMethods:
         session.post = MagicMock(return_value=response)
         client = DaynestClient(base_url="https://api.example", integration_key="key", session=session)
 
-        result = await client.async_create_planned_item(title="Plan dinner", planned_for="2026-01-15", notes="With rice")
+        result = await client.async_create_planned_item(
+            title="Plan dinner", planned_for="2026-01-15", notes="With rice"
+        )
 
         call_kwargs = session.post.call_args[1]
         assert call_kwargs["json"] == {
@@ -777,11 +789,20 @@ class TestDaynestClientTypedMethods:
     async def test_calendar_day_month_and_export_methods(self) -> None:
         month_response = _make_mock_response(
             200,
-            {"year": 2026, "month": 1, "days": [{"date": "2026-01-01", "total": 1, "routines": 0, "chores": 1, "medications": 0, "planned": 0}]},
+            {
+                "year": 2026,
+                "month": 1,
+                "days": [
+                    {"date": "2026-01-01", "total": 1, "routines": 0, "chores": 1, "medications": 0, "planned": 0}
+                ],
+            },
         )
         day_response = _make_mock_response(
             200,
-            {"date": "2026-01-01", "items": [{"item_type": "chore", "item_id": 1, "title": "Clean", "status": "pending"}]},
+            {
+                "date": "2026-01-01",
+                "items": [{"item_type": "chore", "item_id": 1, "title": "Clean", "status": "pending"}],
+            },
         )
         ics_response = _make_mock_response(200, {})
         ics_response.read = AsyncMock(return_value=b"BEGIN:VCALENDAR")
@@ -857,8 +878,9 @@ class TestDaynestClientCacheAndSSE:
             def __aiter__(self):
                 async def _gen():
                     yield b"event: ping\n"
-                    yield b"data: {\"alive\": true}\n"
+                    yield b'data: {"alive": true}\n'
                     yield b"\n"
+
                 return _gen()
 
         response = _make_mock_response(200, {})
@@ -886,10 +908,11 @@ class TestDaynestClientCacheAndSSE:
                 async def _gen():
                     for line in self._lines:
                         yield line
+
                 return _gen()
 
         response = _make_mock_response(200, {})
-        response.content = _Stream([b"event: today_updated\n", b"data: {\"ping\": true}\n", b"\n"])
+        response.content = _Stream([b"event: today_updated\n", b'data: {"ping": true}\n', b"\n"])
         session = MagicMock(spec=aiohttp.ClientSession)
         session.get = MagicMock(return_value=response)
         callback_called = asyncio.Event()
@@ -1102,3 +1125,65 @@ class TestDaynestClientShoppingLists:
         await client.async_delete_shopping_item(1)
 
         assert session.delete.call_args.args[0] == "https://api.daynest.example/api/planned-items/1"
+
+
+class TestOidcDiscovery:
+    @pytest.mark.parametrize("origin", ["https://auth.example", "http://localhost:8080", "http://[::1]:8080"])
+    async def test_valid_endpoints(self, origin: str) -> None:
+        auth, token = f"{origin}/auth", f"{origin}/token"
+        session = MagicMock(spec=aiohttp.ClientSession)
+        session.get.return_value = _make_mock_response(200, {"authorization_url": auth, "token_url": token})
+        assert await DaynestClient.async_fetch_oidc_config("https://api.example/", session=session) == (auth, token)
+        session.get.assert_called_once_with(
+            "https://api.example/api/auth/oidc-config", timeout=aiohttp.ClientTimeout(total=10), allow_redirects=False
+        )
+        session.close.assert_not_called()
+
+    @pytest.mark.parametrize("field", ["authorization_url", "token_url"])
+    @pytest.mark.parametrize(
+        "value",
+        [
+            None,
+            42,
+            "",
+            "/auth",
+            "//auth.example/auth",
+            "javascript:alert(1)",
+            "http://auth.example/auth",
+            "https://evil.example/auth",
+            "https://user:pw@auth.example/auth",
+            "https://@auth.example/auth",
+            "https://auth.example/auth?next=evil",
+            "https://auth.example/auth#fragment",
+            "https://auth.example/auth?",
+            "https://auth.example/auth#",
+            "https://auth.example:444/auth",
+            "https://auth.example:bad/auth",
+            "https://auth.example:99999/auth",
+            "https://[invalid/auth",
+            " https://auth.example/auth",
+            "https://auth.example/au\nth",
+            "https://auth.example/\\evil",
+            "http://127.1/auth",
+            "http://2130706433/auth",
+        ],
+    )
+    async def test_rejects_unsafe_endpoints(self, field: str, value: object) -> None:
+        payload = {"authorization_url": "https://auth.example/auth", "token_url": "https://auth.example/token"}
+        session = MagicMock(spec=aiohttp.ClientSession)
+        session.get.return_value = _make_mock_response(200, {**payload, field: value})
+        assert await DaynestClient.async_fetch_oidc_config("https://api.example", session=session) is None
+
+    @pytest.mark.parametrize("status, payload", [(302, {}), (404, {}), (200, []), (200, {})])
+    async def test_unusable_response(self, status: int, payload: object) -> None:
+        session = MagicMock(spec=aiohttp.ClientSession)
+        session.get.return_value = _make_mock_response(status, payload)
+        assert await DaynestClient.async_fetch_oidc_config("https://api.example", session=session) is None
+        assert session.get.call_args.kwargs["allow_redirects"] is False
+
+    async def test_owned_session_closed_on_failure(self, monkeypatch: pytest.MonkeyPatch) -> None:
+        session = MagicMock(spec=aiohttp.ClientSession)
+        session.get.side_effect = aiohttp.ClientConnectionError()
+        monkeypatch.setattr(aiohttp, "ClientSession", lambda: session)
+        assert await DaynestClient.async_fetch_oidc_config("https://api.example") is None
+        session.close.assert_awaited_once()