python-homely 0.1.8__tar.gz → 0.1.9__tar.gz

{python_homely-0.1.8/src/python_homely.egg-info → python_homely-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.8
+Version: 0.1.9
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.8 → python_homely-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-homely"
-version = "0.1.8"
+version = "0.1.9"
 description = "Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere."
 readme = "README.md"
 requires-python = ">=3.12"

{python_homely-0.1.8 → python_homely-0.1.9}/src/homely/websocket.py

@@ -370,10 +370,13 @@ class HomelyWebSocket:
 
         self._set_status("Connecting")
         try:
+            # SECURITY: never enable the engineio logger. It logs the full
+            # connection URL, which carries the bearer token in the query
+            # string (?token=Bearer <access_token>), leaking it to HA logs.
             self.socket = socketio.AsyncClient(
                 reconnection=False,
                 logger=False,
-                engineio_logger=logging.getLogger("engineio.client"),
+                engineio_logger=False,
             )
 
             async def connect() -> None:
@@ -411,8 +414,11 @@ class HomelyWebSocket:
                 "locationId": str(self.location_id),
                 "token": bearer_token,
             }
-            if self.partner_code is not None:
-                query_params["partner"] = str(self.partner_code)
+            # NOTE: do NOT send a "partner" query parameter. Homely's websocket
+            # server rejects it ("Partner <code> is not supported") and closes
+            # the connection immediately, causing a connect/disconnect loop.
+            # partner_code is accepted for API compatibility but intentionally
+            # unused here.
             query = urlencode(query_params)
             url = f"{self.websocket_url}?{query}"
             _LOGGER.debug("WebSocket connecting %s to %s", self._ctx(), self.websocket_url)

{python_homely-0.1.8 → python_homely-0.1.9/src/python_homely.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-homely
-Version: 0.1.8
+Version: 0.1.9
 Summary: Async Python client for the Homely cloud API, built for Home Assistant but usable anywhere.
 Author: Ludvik Blichfeldt Rød
 License-Expression: MIT

{python_homely-0.1.8 → python_homely-0.1.9}/tests/test_sdk.py

@@ -95,7 +95,7 @@ class _FakeAsyncCallable:
 async def test_sdk_exports_public_symbols():
     """The SDK should expose a clean public surface."""
     assert auth_header_value("token") == "Bearer token"
-    assert __version__ == "0.1.8"
+    assert __version__ == "0.1.9"
 
 
 async def test_authenticate_returns_typed_token():
@@ -499,6 +499,46 @@ async def test_websocket_connection_state_uses_engineio_transport_health():
     assert state.status_mismatch is False
 
 
+async def test_connect_keeps_engineio_logger_disabled(monkeypatch):
+    """SECURITY: the Engine.IO logger must stay off.
+
+    When enabled it logs the full connection URL, which carries the bearer
+    token in the query string (?token=Bearer <access_token>), leaking it to
+    the consuming application's logs.
+    """
+    import socketio
+
+    captured: dict[str, object] = {}
+    connect_args: dict[str, object] = {}
+
+    class _FakeSocket:
+        def __init__(self, **kwargs: object) -> None:
+            captured.update(kwargs)
+
+        def on(self, *args: object, **kwargs: object) -> None:
+            return None
+
+        async def connect(self, url: str, *args: object, **kwargs: object) -> None:
+            connect_args["url"] = url
+
+    # connect() does a local `import socketio`, so patch the real module.
+    monkeypatch.setattr(socketio, "AsyncClient", _FakeSocket)
+
+    ws = HomelyWebSocket(
+        location_id="loc-1",
+        token="super-secret-token",
+        on_data_update=lambda _data: None,
+        partner_code=1275,
+    )
+    await ws.connect()
+
+    assert captured.get("engineio_logger") is False
+    assert captured.get("logger") is False
+    # Homely rejects a "partner" query parameter and closes the connection,
+    # so it must never be sent even when partner_code is set.
+    assert "partner" not in str(connect_args.get("url"))
+
+
 async def test_websocket_sync_token_only_reconnects_when_transport_is_down():
     """Token sync should not nudge healthy sockets, but should reconnect dead ones."""
     ws = HomelyWebSocket(