python-netgear-switch-library 0.0.post353__tar.gz → 0.0.post354__tar.gz

{python_netgear_switch_library-0.0.post353 → python_netgear_switch_library-0.0.post354}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-netgear-switch-library
-Version: 0.0.post353
+Version: 0.0.post354
 Summary: Python library and CLI to query and control Netgear switches over SNMP, NSDP and HTTP.
 Author-email: Tim Ansell <me@mith.ro>
 License-Expression: Apache-2.0

{python_netgear_switch_library-0.0.post353 → python_netgear_switch_library-0.0.post354}/docs/superpowers/specs/2026-08-02-snmp-surface-findings.md

@@ -305,3 +305,37 @@ inference, and each needs its own live check before it is recorded as fact.
 2. `create_vlan` needs an XUI implementation for the FASTPATH dialects.
 3. Until it exists, the oracle must report HTTP `create_vlan` unsupported on
    those models rather than claiming it works.
+
+
+### Follow-up: no FASTPATH page carries the token, and the tests cannot see it
+
+Probing every write page on the live gsm7252ps:
+
+| Page | `hash` present |
+|---|---|
+| `/vlanStatus.html` | no |
+| `/poeInterfaceConfiguration.html` | no |
+| `/portPvidConfiguration.html` | no |
+| `/switching/dot1q/vlan_port_cfg.html` | no |
+| `/portsConfiguration.html` | no |
+
+So the token is absent from the **whole XE FASTPATH dialect**, not just the VLAN
+page, and every `_csrf`-scraping write is affected on those models — not only
+`create_vlan`.
+
+The mock is now faithful: `virtual/web.py` emits the token only for the Plus
+dialects that really have it, and driving HTTP `create_vlan` against the fake
+reproduces the live failure on gsm7252ps while still succeeding on gs305ep.
+
+**`tests/test_capabilities.py` stayed green through that change, and it was
+right to.** Its `_refused()` counts only `UnsupportedCapabilityError` and
+`NotImplementedError` as a refusal; anything else "means the backend ACCEPTED
+the operation and tried, which is exactly what Support.SUPPORTED claims". An
+`HttpUnexpectedPageError` is therefore success by that definition. The test
+verifies **dispatch**, not **outcome** — by design — so it can never catch a
+write that reaches the right backend and then fails there.
+
+That is a gap in the safety net, not a bug in the test. Catching this class
+needs a different check: drive each write against the mock and assert the state
+actually changed. Recorded here so the next person does not assume a green
+capability suite means the writes work.

{python_netgear_switch_library-0.0.post353 → python_netgear_switch_library-0.0.post354}/src/netgear_switch/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.post353'
-__version_tuple__ = version_tuple = (0, 0, 'post353')
+__version__ = version = '0.0.post354'
+__version_tuple__ = version_tuple = (0, 0, 'post354')
 
 __commit_id__ = commit_id = None

{python_netgear_switch_library-0.0.post353 → python_netgear_switch_library-0.0.post354}/src/netgear_switch/virtual/web.py

@@ -39,8 +39,40 @@ def _hash_input() -> str:
     return f'<input type="hidden" name="hash" value="{_HASH}">'
 
 
+def _has_csrf_hash(spec: HttpModelSpec) -> bool:
+    """Whether this model's real web UI carries an ``<input name="hash">``.
+
+    ONLY the Plus ``.cgi`` dialects do. MEASURED 2026-08-02: a live capture of
+    the FASTPATH ``vlanStatus.html`` on gsm7252ps (10.1.5.22, committed as
+    ``tests/fixtures/http/gsm7252ps_vlan_status_live.html``) carries no ``hash``
+    input anywhere -- only ``applet_port``, ``applet_unit``, ``dbgopt`` and the
+    XUI cell hiddens.
+
+    This mock used to emit the token on EVERY page regardless of dialect, and
+    that is how ``HttpWriter.create_vlan`` -- which scrapes the token and is
+    written for the Plus form -- passed here while failing on real FASTPATH
+    hardware with "no CSRF 'hash' token on page before write". The mock and the
+    writer agreed with each other while both disagreed with the device, which
+    is exactly the failure principle 5 exists to prevent. Emitting it only
+    where the hardware does makes the mock refuse the same write the switch
+    refuses.
+    """
+    from ..protocols.http.endpoints import HtmlDialect
+
+    return spec.html_dialect in {HtmlDialect.STANDARD, HtmlDialect.GS105PE}
+
+
 def render_page(
     state: VirtualSwitchState, spec: HttpModelSpec, path: str, form: dict[str, str]
+) -> str:
+    html = _render_page_body(state, spec, path, form)
+    if not _has_csrf_hash(spec):
+        html = html.replace(_hash_input(), "")
+    return html
+
+
+def _render_page_body(
+    state: VirtualSwitchState, spec: HttpModelSpec, path: str, form: dict[str, str]
 ) -> str:
     if path == spec.dashboard_path:
         return _render_dashboard(state)