redfetch 1.4.3__tar.gz → 1.4.4__tar.gz

{redfetch-1.4.3 → redfetch-1.4.4}/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.4] - 2026-07-18
+
+### Fixed
+- A rejected OAuth token will no longer assume you're level 1.
+
 ## [1.4.3] - 2026-07-06
 
 ### Added

{redfetch-1.4.3 → redfetch-1.4.4}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: redfetch
-Version: 1.4.3
+Version: 1.4.4
 Summary: Download and publish EverQuest scripts and software using the RedGuides API
 Project-URL: Homepage, https://www.redguides.com
 Project-URL: Documentation, https://www.redguides.com/community/resources/redfetch.3177/
 Project-URL: Repository, https://github.com/RedGuides/redfetch
 Project-URL: Issues, https://github.com/RedGuides/redfetch/issues
 Project-URL: Changelog, https://github.com/RedGuides/redfetch/blob/main/CHANGELOG.md
-Project-URL: Source_archive, https://github.com/RedGuides/redfetch/archive/9161a88b101d6df6ce9a697736e3fcc57b1c3122.zip
+Project-URL: Source_archive, https://github.com/RedGuides/redfetch/archive/d7f95d7be3adeb113e9846081bae4f5764514b72.zip
 Author-email: Redbot <ask@redguides.com>
 License-Expression: GPL-3.0-or-later
 License-File: LICENSE

{redfetch-1.4.3 → redfetch-1.4.4}/src/redfetch/__about__.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.4.3'
-__version_tuple__ = version_tuple = (1, 4, 3)
+__version__ = version = '1.4.4'
+__version_tuple__ = version_tuple = (1, 4, 4)
 
 __commit_id__ = commit_id = None

{redfetch-1.4.3 → redfetch-1.4.4}/src/redfetch/auth.py

@@ -499,7 +499,7 @@ async def get_api_headers():
                 if access_token:
                     return {"Authorization": f"Bearer {access_token}"}
 
-            raise RuntimeError("OAuth token refresh failed. Please run `redfetch logout` and authorize again.")
+            raise RuntimeError("OAuth token refresh failed. Restart redfetch to authorize again.")
 
         raise RuntimeError("OAuth access token is expired and no refresh token is available. Please authorize again.")
 

{redfetch-1.4.3 → redfetch-1.4.4}/src/redfetch/download.py

@@ -104,7 +104,17 @@ async def download_file_async(
         if tmp_path is None:
             return False
 
-        os.replace(tmp_path, file_path)
+        try:
+            displaced = _swap_into_place(tmp_path, file_path)
+        except PermissionError:
+            _report_locked_target(file_path)
+            return False
+        except OSError as e:
+            print(f"Could not update {os.path.basename(file_path)}: {e}")
+            _remove_if_exists(tmp_path)
+            return False
+        if displaced:
+            print(f"Staged update for {os.path.basename(file_path)}; applies on next launch.")
         print(f"Downloaded file {file_path}")
         return True
     finally:

{redfetch-1.4.3 → redfetch-1.4.4}/src/redfetch/net.py

@@ -54,8 +54,17 @@ def clear_manifest_cache() -> None:
     reraise=True,
 )
 async def get_json(client: httpx.AsyncClient, url: str, params: Optional[Dict[str, Any]] = None) -> dict:
-    """GET JSON with retry on transient network errors."""
+    """GET JSON with retry on transient network errors and one rejected OAuth token."""
     response = await client.get(url, params=params, timeout=10.0)
+    if response.status_code == 401:
+        scheme, _, token = response.request.headers.get("Authorization", "").partition(" ")
+        if scheme.lower() == "bearer" and token:
+            # The server rejected a token our local expiry still trusts.
+            from redfetch import auth  # lazy: auth imports this module
+
+            auth.set_token_expiry("0")
+            client.headers.update(await auth.get_api_headers())
+            response = await client.get(url, params=params, timeout=10.0)
     response.raise_for_status()
     return response.json()
 

{redfetch-1.4.3 → redfetch-1.4.4}/src/redfetch/terminal_ui.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from itertools import cycle
 
 # third-party
+import httpx
 from dynaconf import ValidationError
 from textual_fspicker import SelectDirectory
 from rich.console import detect_legacy_windows
@@ -314,10 +315,12 @@ class FetchTab(ScrollableContainer):
         app: "Redfetch" = self.app  # type: ignore[assignment]
         if not app.username:
             return  # keep the compose default until identity resolves
-        if app.is_level_2:
+        if app.is_level_2 is True:
             greeting = f"[italic]Hail, [bold]{app.username}![/bold][/italic]"
-        else:
+        elif app.is_level_2 is False:
             greeting = f"Hey {app.username}, you're level 1 😞"
+        else:
+            greeting = f"Hey [bold]{app.username}[/bold]!"
         self.query_one("#welcome_label", Label).update(greeting)
 
     def _recompute(self) -> None:
@@ -911,13 +914,15 @@ class AccountTab(ScrollableContainer):
 
     def _refresh_account_state(self) -> None:
         app: "Redfetch" = self.app  # type: ignore[assignment]
-        self.query_one("#btn_ding", Button).display = not app.is_level_2
+        self.query_one("#btn_ding", Button).display = app.is_level_2 is not True
         if not app.username:
             return  # keep the "Loading..." compose default until the level check resolves
-        if app.is_level_2:
+        if app.is_level_2 is True:
             text = f"[italic][bold]{app.username}, thank you for being level 2[/bold][/italic] 💛"
-        else:
+        elif app.is_level_2 is False:
             text = f"Hey {app.username}, you're level 1 😞 some resources won't be downloaded."
+        else:
+            text = f"Hey {app.username}, we couldn't verify your account level."
         self.query_one("#account_label", Label).update(text)
 
     #
@@ -1023,7 +1028,7 @@ class Redfetch(App):
     current_env: reactive[str] = reactive(config.settings.ENV)
     # User account identity and permissions: set reactively by background workers, observed by AccountTab for live updates
     username: reactive[str] = reactive("")
-    is_level_2: reactive[bool] = reactive(False)
+    is_level_2: reactive[bool | None] = reactive(None)
     # Startup update check: None = unknown, int = resources to be fetched
     update_count: reactive[int | None] = reactive(None)
     # Transient post-sync flash on the Easy Update button
@@ -1919,7 +1924,11 @@ class Redfetch(App):
     @work
     async def load_startup_status(self):
         """Set the account level, the update badge, and print an update summary at startup."""
-        username = await auth.get_username()
+        try:
+            username = await auth.get_username()
+        except RuntimeError:
+            print("Couldn't verify your RedGuides account right now.")
+            return
 
         try:
             headers = await auth.get_api_headers()
@@ -1956,8 +1965,21 @@ class Redfetch(App):
         if os.environ.get("REDFETCH_CRASH_TEST") == "ding":
             raise RuntimeError("Intentional crash test from _check_ding_level_worker.")
 
-        headers = await auth.get_api_headers()
-        sync_info = await api.get_sync_info(headers)
+        try:
+            headers = await auth.get_api_headers()
+            sync_info = await api.get_sync_info(headers)
+        except RuntimeError as exc:
+            # Auth is unrecoverable this session (e.g. token refresh failed).
+            self.notify(str(exc), severity="error", timeout=10)
+            return
+        except (httpx.HTTPStatusError, httpx.RequestError):
+            self.notify(
+                "Couldn't check your account level right now.",
+                severity="error",
+                timeout=10,
+            )
+            return
+
         if sync_info.is_level_2:
             # User is now level 2! AccountTab + FetchTab react to the reactives below.
             self.username = self.username or await auth.get_username()

redfetch-1.4.4/tests/test_oauth_401_recovery.py

@@ -0,0 +1,94 @@
+"""Regression tests: a bearer 401 invalidates the local token expiry and retries once."""
+
+import asyncio
+from unittest.mock import AsyncMock, patch
+
+import httpx
+import pytest
+
+from redfetch import net
+
+
+def _run_get_json(handler, headers):
+    async def go():
+        transport = httpx.MockTransport(handler)
+        async with httpx.AsyncClient(headers=headers, transport=transport) as client:
+            return await net.get_json(client, "https://example.com/api/rgsync")
+    return asyncio.run(go())
+
+
+def test_bearer_401_invalidates_expiry_and_retries_with_fresh_headers():
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        if len(requests) == 1:
+            return httpx.Response(401, request=request)
+        return httpx.Response(200, json={"ok": True}, request=request)
+
+    fresh_headers = AsyncMock(return_value={"Authorization": "Bearer replacement"})
+    with (
+        patch("redfetch.auth.set_token_expiry") as set_expiry,
+        patch("redfetch.auth.get_api_headers", new=fresh_headers),
+    ):
+        result = _run_get_json(handler, {"Authorization": "Bearer rejected"})
+
+    assert result == {"ok": True}
+    assert [r.headers["Authorization"] for r in requests] == [
+        "Bearer rejected",
+        "Bearer replacement",
+    ]
+    # Zeroing the expiry is what routes get_api_headers() into its refresh path,
+    # and makes authorize() fall through to full auth on the next launch.
+    set_expiry.assert_called_once_with("0")
+
+
+def test_second_401_raises_without_further_retries():
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(401, request=request)
+
+    fresh_headers = AsyncMock(return_value={"Authorization": "Bearer replacement"})
+    with (
+        patch("redfetch.auth.set_token_expiry"),
+        patch("redfetch.auth.get_api_headers", new=fresh_headers),
+        pytest.raises(httpx.HTTPStatusError) as exc_info,
+    ):
+        _run_get_json(handler, {"Authorization": "Bearer rejected"})
+
+    assert exc_info.value.response.status_code == 401
+    assert len(requests) == 2
+
+
+def test_failed_refresh_propagates_runtime_error():
+    """When get_api_headers() can't refresh, its RuntimeError reaches the caller."""
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(401, request=request)
+
+    failed = AsyncMock(side_effect=RuntimeError("OAuth token refresh failed."))
+    with (
+        patch("redfetch.auth.set_token_expiry"),
+        patch("redfetch.auth.get_api_headers", new=failed),
+        pytest.raises(RuntimeError, match="refresh failed"),
+    ):
+        _run_get_json(handler, {"Authorization": "Bearer rejected"})
+
+
+def test_api_key_401_does_not_attempt_oauth_refresh():
+    requests: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        return httpx.Response(401, request=request)
+
+    fresh_headers = AsyncMock()
+    with (
+        patch("redfetch.auth.get_api_headers", new=fresh_headers),
+        pytest.raises(httpx.HTTPStatusError),
+    ):
+        _run_get_json(handler, {"XF-Api-Key": "invalid"})
+
+    assert len(requests) == 1
+    fresh_headers.assert_not_awaited()

{redfetch-1.4.3 → redfetch-1.4.4}/tests/test_staged_extraction.py

@@ -1,5 +1,6 @@
 """Tests for two-phase staged extraction: stage every member, then swap all in."""
 
+import asyncio
 import os
 import stat
 import sys
@@ -184,6 +185,54 @@ def test_readonly_target_updated_in_place(tmp_path, monkeypatch):
     assert not list(dest.rglob("*.rfold*"))
 
 
+def test_readonly_target_single_file_download(tmp_path, monkeypatch):
+    # non-zip downloads must share the staged-swap read-only handling
+    # simulate Windows semantics (replace onto RO dst fails) so posix CI pins this too
+    target = tmp_path / "zones.navmesh"
+    target.write_bytes(b"old")
+    os.chmod(target, stat.S_IREAD)
+
+    real_replace = os.replace
+
+    def readonly_replace(src, dst):
+        if os.path.exists(dst) and not os.access(dst, os.W_OK):
+            raise PermissionError("read-only destination")
+        return real_replace(src, dst)
+
+    monkeypatch.setattr(download.os, "replace", readonly_replace)
+
+    async def fake_stream(resp, file_path, hasher):
+        tmp = file_path + ".dl"
+        with open(tmp, "wb") as f:
+            f.write(b"new")
+        return tmp
+
+    monkeypatch.setattr(download, "_stream_to_tempfile", fake_stream)
+
+    class FakeResp:
+        headers = {}
+
+        def raise_for_status(self):
+            pass
+
+    class FakeStream:
+        async def __aenter__(self):
+            return FakeResp()
+
+        async def __aexit__(self, *exc):
+            return False
+
+    class FakeClient:
+        def stream(self, *args, **kwargs):
+            return FakeStream()
+
+    ok = asyncio.run(download.download_file_async(FakeClient(), "http://x", str(target)))
+
+    assert ok is True
+    assert target.read_bytes() == b"new"
+    assert not list(tmp_path.rglob("*.rfold*"))
+
+
 def test_remove_if_exists_clears_readonly(tmp_path, monkeypatch):
     # displaced .rfold files keep the read-only bit; sweep must still delete them.
     # simulate Windows semantics (unlink of RO file fails) so posix CI pins this too