python-swidget 1.4.17__tar.gz → 1.4.18__tar.gz

{python_swidget-1.4.17 → python_swidget-1.4.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: python-swidget
-Version: 1.4.17
+Version: 1.4.18
 Summary: Python API for Swidget smart devices
 Home-page: https://github.com/swidget/python-swidget
 License: GPL-3.0-or-later

{python_swidget-1.4.17 → python_swidget-1.4.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "python-swidget"
-version = "1.4.17"
+version = "1.4.18"
 description = "Python API for Swidget smart devices"
 license = "GPL-3.0-or-later"
 authors = ["Swidget"]

{python_swidget-1.4.17 → python_swidget-1.4.18}/swidget/discovery.py

@@ -59,10 +59,19 @@ devices = dict()
 async def detect_secure(host: str, timeout: float = DETECT_TIMEOUT_SEC) -> bool:
     """Determine whether a Swidget device requires HTTPS+auth.
 
-    Probes ``/api/v1/summary`` over HTTPS first (no credentials). A 403
-    response means the firmware enforces auth — the device is in secure
-    mode. If HTTPS is unreachable, falls back to HTTP; a 200 there means
-    the device is in plaintext mode.
+    Probes ``/api/v1/summary`` over HTTP first; a 200 means the device
+    is in plaintext mode. Secure-mode firmware running on the same port
+    answers 403 ("TLS required") instead, so anything non-200 falls
+    through to the HTTPS probe.
+
+    On HTTPS, both 401 and 403 indicate secure mode:
+    - **401 "Authorization Missing"** — no token in the request (our
+      probe doesn't carry one).
+    - **403 "Forbidden"** — token rejected ("Incorrect Token") or the
+      device's secret key has never been provisioned ("Key not set").
+
+    Both states mean "secure mode is enforced, prompt the caller for
+    credentials", so we collapse them into a single True return.
 
     :param host: Hostname or IP of the device.
     :param timeout: Per-request timeout in seconds. Defaults are generous
@@ -83,10 +92,12 @@ async def detect_secure(host: str, timeout: float = DETECT_TIMEOUT_SEC) -> bool:
         except (ClientError, asyncio.TimeoutError):
             pass
 
-        # Fall back to HTTPS. A 403 means the firmware is enforcing auth.
+        # Fall back to HTTPS. 401 ("Authorization Missing") and 403
+        # ("Forbidden" — wrong token, or key not set) both mean the
+        # firmware is in secure mode; the caller now needs credentials.
         try:
             async with session.get(f"https://{host}/api/v1/summary") as resp:
-                if resp.status == 403:
+                if resp.status in (401, 403):
                     return True
         except (ClientError, asyncio.TimeoutError):
             pass