python-homely 0.1.7__tar.gz → 0.1.9__tar.gz

{python_homely-0.1.7/src/python_homely.egg-info → python_homely-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.7
+Version: 0.1.9
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.7 → python_homely-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-homely"
-version = "0.1.7"
+version = "0.1.9"
 description = "Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere."
 readme = "README.md"
 requires-python = ">=3.12"

{python_homely-0.1.7 → python_homely-0.1.9}/src/homely/client.py

@@ -189,6 +189,7 @@ class HomelyClient:
             payload=payload,
             invalid_reason="invalid_refresh_token",
             action="Token refresh",
+            extra_headers={"X-Forwarded-For": "0.0.0.0"},
         )
 
     async def fetch_refresh_token(self, refresh_token: str) -> dict[str, Any] | None:
@@ -217,12 +218,15 @@ class HomelyClient:
         payload: dict[str, Any],
         invalid_reason: TokenFailureReason,
         action: str,
+        extra_headers: dict[str, str] | None = None,
     ) -> TokenEndpointResult:
         """Post to a token endpoint and return a detailed typed result."""
         url = f"{self._base_url}{endpoint}"
 
         try:
-            async with self._session.post(url, json=payload, timeout=self._timeout) as response:
+            async with self._session.post(
+                url, json=payload, headers=extra_headers, timeout=self._timeout
+            ) as response:
                 body_preview = await self._response_text_preview(response)
                 if response.status in (200, 201):
                     try:
@@ -442,10 +446,18 @@ class HomelyClient:
                         )
                         return None, response.status
                     return parsed, response.status
+                retry_after = response.headers.get("Retry-After")
+                try:
+                    body = await response.text()
+                except Exception:
+                    body = "<unreadable>"
                 _LOGGER.debug(
-                    "Location data fetch failed with status=%s location_id=%s",
+                    "Location data fetch failed with status=%s location_id=%s "
+                    "retry_after=%s body=%s",
                     response.status,
                     _log_identifier(location_id),
+                    retry_after,
+                    body[:500] if body else None,
                 )
                 return None, response.status
         except (aiohttp.ClientError, TimeoutError) as err:

{python_homely-0.1.7 → python_homely-0.1.9}/src/homely/websocket.py

@@ -89,12 +89,14 @@ class HomelyWebSocket:
         status_update_callback: Callable[[str, str | None], None] | None = None,
         context_id: str | None = None,
         entry_id: str | None = None,
+        partner_code: int | str | None = None,
     ) -> None:
         """Initialize WebSocket client."""
         self.context_id = context_id or entry_id
         self.entry_id = self.context_id
         self.location_id = location_id
         self.token = token
+        self.partner_code = partner_code
         self.on_data_update = on_data_update
         self.socket: Any | None = None
         self._is_closing = False
@@ -368,10 +370,13 @@ class HomelyWebSocket:
 
         self._set_status("Connecting")
         try:
+            # SECURITY: never enable the engineio logger. It logs the full
+            # connection URL, which carries the bearer token in the query
+            # string (?token=Bearer <access_token>), leaking it to HA logs.
             self.socket = socketio.AsyncClient(
                 reconnection=False,
                 logger=False,
-                engineio_logger=logging.getLogger("engineio.client"),
+                engineio_logger=False,
             )
 
             async def connect() -> None:
@@ -405,12 +410,16 @@ class HomelyWebSocket:
             self.socket.on("connect_error", connect_error)
 
             bearer_token = self._bearer_value(self.token)
-            query = urlencode(
-                {
-                    "locationId": str(self.location_id),
-                    "token": bearer_token,
-                }
-            )
+            query_params: dict[str, str] = {
+                "locationId": str(self.location_id),
+                "token": bearer_token,
+            }
+            # NOTE: do NOT send a "partner" query parameter. Homely's websocket
+            # server rejects it ("Partner <code> is not supported") and closes
+            # the connection immediately, causing a connect/disconnect loop.
+            # partner_code is accepted for API compatibility but intentionally
+            # unused here.
+            query = urlencode(query_params)
             url = f"{self.websocket_url}?{query}"
             _LOGGER.debug("WebSocket connecting %s to %s", self._ctx(), self.websocket_url)
             await asyncio.wait_for(

{python_homely-0.1.7 → python_homely-0.1.9/src/python_homely.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.7
+Version: 0.1.9
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.7 → python_homely-0.1.9}/tests/test_sdk.py

@@ -32,11 +32,13 @@ class _FakeResponse:
         json_data=None,
         text_data: str = "",
         json_exc: Exception | None = None,
+        headers: dict[str, str] | None = None,
     ) -> None:
         self.status = status
         self._json_data = json_data
         self._text_data = text_data
         self._json_exc = json_exc
+        self.headers = headers or {}
 
     async def __aenter__(self):
         return self
@@ -93,7 +95,7 @@ class _FakeAsyncCallable:
 async def test_sdk_exports_public_symbols():
     """The SDK should expose a clean public surface."""
     assert auth_header_value("token") == "Bearer token"
-    assert __version__ == "0.1.5"
+    assert __version__ == "0.1.9"
 
 
 async def test_authenticate_returns_typed_token():
@@ -497,6 +499,46 @@ async def test_websocket_connection_state_uses_engineio_transport_health():
     assert state.status_mismatch is False
 
 
+async def test_connect_keeps_engineio_logger_disabled(monkeypatch):
+    """SECURITY: the Engine.IO logger must stay off.
+
+    When enabled it logs the full connection URL, which carries the bearer
+    token in the query string (?token=Bearer <access_token>), leaking it to
+    the consuming application's logs.
+    """
+    import socketio
+
+    captured: dict[str, object] = {}
+    connect_args: dict[str, object] = {}
+
+    class _FakeSocket:
+        def __init__(self, **kwargs: object) -> None:
+            captured.update(kwargs)
+
+        def on(self, *args: object, **kwargs: object) -> None:
+            return None
+
+        async def connect(self, url: str, *args: object, **kwargs: object) -> None:
+            connect_args["url"] = url
+
+    # connect() does a local `import socketio`, so patch the real module.
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+
+    ws = HomelyWebSocket(
+        location_id="loc-1",
+        token="super-secret-token",
+        on_data_update=lambda _data: None,
+        partner_code=1275,
+    )
+    await ws.connect()
+
+    assert captured.get("engineio_logger") is False
+    assert captured.get("logger") is False
+    # Homely rejects a "partner" query parameter and closes the connection,
+    # so it must never be sent even when partner_code is set.
+    assert "partner" not in str(connect_args.get("url"))
+
+
 async def test_websocket_sync_token_only_reconnects_when_transport_is_down():
     """Token sync should not nudge healthy sockets, but should reconnect dead ones."""
     ws = HomelyWebSocket(