python-homely 0.1.8__tar.gz → 0.1.10__tar.gz

{python_homely-0.1.8/src/python_homely.egg-info → python_homely-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.8
+Version: 0.1.10
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.8 → python_homely-0.1.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-homely"
-version = "0.1.8"
+version = "0.1.10"
 description = "Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere."
 readme = "README.md"
 requires-python = ">=3.12"

{python_homely-0.1.8 → python_homely-0.1.10}/src/homely/websocket.py

@@ -101,6 +101,7 @@ class HomelyWebSocket:
         self.socket: Any | None = None
         self._is_closing = False
         self._cleaning_up_socket = False
+        self._connect_lock = asyncio.Lock()
         self._reconnect_task: asyncio.Task[None] | None = None
         self._reconnect_interval = self._reconnect_interval_for_attempt(1)
         self._reconnect_warn_every = 12
@@ -337,6 +338,11 @@ class HomelyWebSocket:
 
     async def connect(self, from_reconnect_loop: bool = False) -> bool:
         """Connect to websocket server."""
+        async with self._connect_lock:
+            return await self._connect_unlocked(from_reconnect_loop)
+
+    async def _connect_unlocked(self, from_reconnect_loop: bool) -> bool:
+        """Run one connection attempt at a time, including socket cleanup."""
         if self._is_closing:
             _LOGGER.debug("Skipping websocket connect during shutdown %s", self._ctx())
             return False
@@ -370,10 +376,13 @@ class HomelyWebSocket:
 
         self._set_status("Connecting")
         try:
+            # SECURITY: never enable the engineio logger. It logs the full
+            # connection URL, which carries the bearer token in the query
+            # string (?token=Bearer <access_token>), leaking it to HA logs.
             self.socket = socketio.AsyncClient(
                 reconnection=False,
                 logger=False,
-                engineio_logger=logging.getLogger("engineio.client"),
+                engineio_logger=False,
             )
 
             async def connect() -> None:
@@ -407,12 +416,19 @@ class HomelyWebSocket:
             self.socket.on("connect_error", connect_error)
 
             bearer_token = self._bearer_value(self.token)
+            # The token MUST be in the query string: Homely's server replies
+            # {"message":"Invalid JWT"} and disconnects if it is sent only via the
+            # Authorization header (verified live). It is therefore unavoidable in
+            # the URL, which is why the Engine.IO logger must stay off (it would
+            # log this URL with the token).
+            # NOTE: do NOT send a "partner" query parameter. Homely rejects it
+            # ("Partner <code> is not supported") and closes the connection,
+            # causing a connect/disconnect loop. partner_code is accepted for API
+            # compatibility but intentionally unused here.
             query_params: dict[str, str] = {
                 "locationId": str(self.location_id),
                 "token": bearer_token,
             }
-            if self.partner_code is not None:
-                query_params["partner"] = str(self.partner_code)
             query = urlencode(query_params)
             url = f"{self.websocket_url}?{query}"
             _LOGGER.debug("WebSocket connecting %s to %s", self._ctx(), self.websocket_url)

{python_homely-0.1.8 → python_homely-0.1.10/src/python_homely.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.8
+Version: 0.1.10
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.8 → python_homely-0.1.10}/tests/test_sdk.py

@@ -1,6 +1,7 @@
 """Tests for the public python-homely SDK package."""
 from __future__ import annotations
 
+import asyncio
 from types import SimpleNamespace
 
 import aiohttp
@@ -95,7 +96,7 @@ class _FakeAsyncCallable:
 async def test_sdk_exports_public_symbols():
     """The SDK should expose a clean public surface."""
     assert auth_header_value("token") == "Bearer token"
-    assert __version__ == "0.1.8"
+    assert __version__ == "0.1.10"
 
 
 async def test_authenticate_returns_typed_token():
@@ -499,6 +500,185 @@ async def test_websocket_connection_state_uses_engineio_transport_health():
     assert state.status_mismatch is False
 
 
+async def test_connect_keeps_engineio_logger_disabled(monkeypatch):
+    """SECURITY: the Engine.IO logger must stay off.
+
+    When enabled it logs the full connection URL, which carries the bearer
+    token in the query string (?token=Bearer <access_token>), leaking it to
+    the consuming application's logs.
+    """
+    import socketio
+
+    captured: dict[str, object] = {}
+    connect_args: dict[str, object] = {}
+
+    class _FakeSocket:
+        def __init__(self, **kwargs: object) -> None:
+            captured.update(kwargs)
+
+        def on(self, *args: object, **kwargs: object) -> None:
+            return None
+
+        async def connect(self, url: str, *args: object, **kwargs: object) -> None:
+            connect_args["url"] = url
+
+    # connect() does a local `import socketio`, so patch the real module.
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+
+    ws = HomelyWebSocket(
+        location_id="loc-1",
+        token="super-secret-token",
+        on_data_update=lambda _data: None,
+        partner_code=1275,
+    )
+    await ws.connect()
+
+    assert captured.get("engineio_logger") is False
+    assert captured.get("logger") is False
+    # Homely rejects a "partner" query parameter and closes the connection,
+    # so it must never be sent even when partner_code is set.
+    assert "partner" not in str(connect_args.get("url"))
+
+
+async def test_concurrent_websocket_connects_keep_the_first_attempt(monkeypatch):
+    """A reconnect request must not tear down a connection still in progress."""
+    import socketio
+
+    first_started = asyncio.Event()
+    finish_connect = asyncio.Event()
+    sockets = []
+
+    class _FakeSocket:
+        def __init__(self, **_kwargs: object) -> None:
+            self.connected = False
+            self.disconnected = False
+            self.handlers = {}
+            sockets.append(self)
+
+        def on(self, event: str, handler: object) -> None:
+            self.handlers[event] = handler
+
+        async def connect(self, *_args: object, **_kwargs: object) -> None:
+            first_started.set()
+            await finish_connect.wait()
+            if self.disconnected:
+                raise ConnectionError("Connection error")
+            self.connected = True
+            await self.handlers["connect"]()
+
+        async def disconnect(self) -> None:
+            self.disconnected = True
+            self.connected = False
+
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+    ws = HomelyWebSocket(
+        location_id="loc-1", token="token", on_data_update=lambda _data: None
+    )
+
+    first = asyncio.create_task(ws.connect())
+    await asyncio.wait_for(first_started.wait(), timeout=1)
+    ws.request_reconnect("poll detected disconnected websocket")
+    await asyncio.sleep(0)
+    finish_connect.set()
+
+    assert await first is True
+    await asyncio.sleep(0)
+    assert len(sockets) == 1
+    assert sockets[0].disconnected is False
+
+
+async def test_cancelling_waiting_connect_does_not_cancel_active_connect(monkeypatch):
+    """A cancelled reconnect must leave the original attempt undisturbed."""
+    import socketio
+
+    first_started = asyncio.Event()
+    finish_connect = asyncio.Event()
+    sockets = []
+
+    class _FakeSocket:
+        def __init__(self, **_kwargs: object) -> None:
+            self.connected = False
+            self.disconnected = False
+            sockets.append(self)
+
+        def on(self, *_args: object, **_kwargs: object) -> None:
+            pass
+
+        async def connect(self, *_args: object, **_kwargs: object) -> None:
+            first_started.set()
+            await finish_connect.wait()
+            if self.disconnected:
+                raise ConnectionError("Connection error")
+            self.connected = True
+
+        async def disconnect(self) -> None:
+            self.disconnected = True
+            self.connected = False
+
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+    ws = HomelyWebSocket(
+        location_id="loc-1", token="token", on_data_update=lambda _data: None
+    )
+    monkeypatch.setattr(ws, "_start_reconnect_loop", lambda _reason=None: None)
+
+    first = asyncio.create_task(ws.connect())
+    await asyncio.wait_for(first_started.wait(), timeout=1)
+    waiting = asyncio.create_task(ws.connect(from_reconnect_loop=True))
+    await asyncio.sleep(0)
+    waiting.cancel()
+    with pytest.raises(asyncio.CancelledError):
+        await waiting
+    finish_connect.set()
+
+    assert await first is True
+    assert len(sockets) == 1
+    assert sockets[0].disconnected is False
+
+
+async def test_reconnect_waiting_for_failed_initial_connect_can_recover(monkeypatch):
+    """Serializing attempts must not suppress a needed retry."""
+    import socketio
+
+    first_started = asyncio.Event()
+    finish_first = asyncio.Event()
+    reconnected = asyncio.Event()
+    sockets = []
+
+    class _FakeSocket:
+        def __init__(self, **_kwargs: object) -> None:
+            self.connected = False
+            sockets.append(self)
+
+        def on(self, *_args: object, **_kwargs: object) -> None:
+            pass
+
+        async def connect(self, *_args: object, **_kwargs: object) -> None:
+            if self is sockets[0]:
+                first_started.set()
+                await finish_first.wait()
+                raise ConnectionError("Connection error")
+            self.connected = True
+            reconnected.set()
+
+        async def disconnect(self) -> None:
+            self.connected = False
+
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+    ws = HomelyWebSocket(
+        location_id="loc-1", token="token", on_data_update=lambda _data: None
+    )
+
+    first = asyncio.create_task(ws.connect())
+    await asyncio.wait_for(first_started.wait(), timeout=1)
+    ws.request_reconnect("poll detected disconnected websocket")
+    finish_first.set()
+
+    assert await first is False
+    await asyncio.wait_for(reconnected.wait(), timeout=1)
+    assert ws.is_connected() is True
+    assert len(sockets) == 2
+
+
 async def test_websocket_sync_token_only_reconnects_when_transport_is_down():
     """Token sync should not nudge healthy sockets, but should reconnect dead ones."""
     ws = HomelyWebSocket(