runtilities 2.3.0.dev2__tar.gz → 3.0.0__tar.gz

{runtilities-2.3.0.dev2 → runtilities-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runtilities
-Version: 2.3.0.dev2
+Version: 3.0.0
 Summary: running related scripts
 Home-page: http://github.com/louking/running
 Author: Lou King

{runtilities-2.3.0.dev2 → runtilities-3.0.0}/running/runsignup.py

@@ -1,25 +1,3 @@
-###########################################################################################
-#   runsignup - access methods for runsignup.com
-#
-#   Date        Author      Reason
-#   ----        ------      ------
-#   12/31/17    Lou King    Create from runningahead.com
-#
-#   Copyright 2017 Lou King
-#
-#   Licensed under the Apache License, Version 2.0 (the "License");
-#   you may not use this file except in compliance with the License.
-#   You may obtain a copy of the License at
-#
-#       http://www.apache.org/licenses/LICENSE-2.0
-#
-#   Unless required by applicable law or agreed to in writing, software
-#   distributed under the License is distributed on an "AS IS" BASIS,
-#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#   See the License for the specific language governing permissions and
-#   limitations under the License.
-#
-###########################################################################################
 '''
 runsignup - access methods for runsignup.com
 ===================================================
@@ -37,7 +15,6 @@ from tempfile import NamedTemporaryFile
 # pypi
 from flask import current_app
 import requests
-from universalclient import Client as UniversalClient
 
 # github
 
@@ -52,10 +29,6 @@ names = NameDenormalizer()
 
 # use api.runsignup.com per https://info.runsignup.com/2025/08/06/upgrading-our-api-infrastructure-for-ai-api-runsignup-com/
 
-# login API (deprecated)
-login_url = 'https://api.runsignup.com/rest/login'
-logout_url = 'https://api.runsignup.com/rest/logout'
-
 # methods
 members_url = 'https://api.runsignup.com/rest/club/{club_id}/members'
 getrace_url = 'https://api.runsignup.com/rest/race/{race_id}'
@@ -74,21 +47,25 @@ class parameterError(Exception): pass
 thislogger = logging.getLogger("running.runsignup")
 
 ########################################################################
-class RunSignUp():
+class RunSignupBase():
     '''
-    access methods for RunSignUp.com
+    common session / authentication / low-level request handling for RunSignUp.com REST API clients
 
-    either key and secret OR email and password should be supplied
-    key and secret take precedence
+    key and secret should be supplied for authenticated access
+
+    per https://info.runsignup.com/2026/07/17/new-api-registration-requirements/, all API callers must
+    register (free) and supply the resulting token/secret on every call starting 2027-01-01; existing
+    api_key/api_secret credentials are unaffected and continue to be required alongside these
 
     :param key: key from runsignup (direct key, no OAuth)
     :param secret: secret from runsignup (direct secret, no OAuth)
-    :param email: email for use by Login API (deprecated)
-    :param password: password for use by Login API (deprecated)
+    :param api_reg_token: API caller registration token, sent as rsu_api_reg GET parameter
+    :param api_reg_secret: API caller registration secret, sent as X-RSU-API-REG-SECRET header
     :param debug: set to True for debug logging of http requests, default False
     '''
 
-    def __init__(self, userpriv=False, key=None, secret=None, email=None, password=None, debug=False):
+    def __init__(self, userpriv=False, key=None, secret=None,
+                 api_reg_token=None, api_reg_secret=None, debug=False):
         """
         initialize
         """
@@ -108,27 +85,20 @@ class RunSignUp():
             requests_log.setLevel(logging.NOTSET)
             requests_log.propagate = False
 
-        self.userpriv = False
-        if (not key and not email):
-            self.userpriv = True
+        self.userpriv = not key
         if (key and not secret) or (secret and not key):
             raise parameterError('key and secret must be supplied together')
-        if (email and not password) or (password and not email):
-            raise parameterError('email and password must be supplied together')
+        if (api_reg_token and not api_reg_secret) or (api_reg_secret and not api_reg_token):
+            raise parameterError('api_reg_token and api_reg_secret must be supplied together')
 
         self.key = key
         self.secret = secret
-        self.email = email
-        self.password = password
+        self.api_reg_token = api_reg_token
+        self.api_reg_secret = api_reg_secret
         self.debug = debug
         self.client_credentials = {}
 
-        if self.userpriv:
-            self.credentials_type = 'none'
-        elif key:
-            self.credentials_type = 'key'
-        else:
-            self.credentials_type = 'login'
+        self.credentials_type = 'none' if self.userpriv else 'key'
 
     def __enter__(self):
         self.open()
@@ -142,22 +112,18 @@ class RunSignUp():
         # set up session for multiple requests
         self.session = requests.Session()
 
+        # per https://info.runsignup.com/2026/07/17/new-api-registration-requirements/, registration
+        # secret is sent as a header, applies regardless of credentials_type
+        if self.api_reg_secret:
+            self.session.headers.update({'X-RSU-API-REG-SECRET': self.api_reg_secret})
+
         if not self.userpriv:
-            # key / secret supplied - this take precedence
-            if self.credentials_type == 'key':
-                self.client_credentials = {'api_key'    : self.key,
-                                        'api_secret' : self.secret}
-
-            # email / password supplied
-            else:     
-                # login to runsignup - note temporary keys will expire 1 hour after last API call
-                # see https://api.runsignup.com/API/login/POST
-                r = requests.post(login_url, params={'format' : 'json'}, data={'email' : self.email, 'password' : self.password})
-                resp = r.json()
-
-                self.credentials_type = 'login'
-                self.client_credentials = {'tmp_key'    : resp['tmp_key'],
-                                        'tmp_secret' : resp['tmp_secret']}
+            self.client_credentials = {'api_key'    : self.key,
+                                    'api_secret' : self.secret}
+
+        # registration token is sent as a GET parameter alongside whichever credentials were set above
+        if self.api_reg_token:
+            self.client_credentials['rsu_api_reg'] = self.api_reg_token
 
     def close(self):
         '''
@@ -166,7 +132,61 @@ class RunSignUp():
         self.client_credentials = {}
         self.session.close()
 
-        # TODO: should we also log out?
+    def _rsugetcsv(self, methodurl, **payload):
+        """
+        get method for runsignup access (csv format response)
+
+        :param methodurl: runsignup method url to call
+        :param contentfield: content field to retrieve from response
+        :param **payload: parameters for the method
+        """
+
+        thispayload = self.client_credentials.copy()
+        thispayload.update(payload)
+        thispayload.update({'format':'csv'})
+
+        resp = self.session.get(methodurl, params=thispayload)
+        if resp.status_code != 200:
+            raise accessError('HTTP response code={}, url={}'.format(resp.status_code,resp.url))
+
+        data = resp.text
+
+        # if 'error' in data:
+        #     raise accessError('RSU response code={}-{}, url={}'.format(data['error']['error_code'],data['error']['error_msg'],resp.url))
+
+        return data
+
+    def _rsuget(self, methodurl, **payload):
+        """
+        get method for runsignup access (json format response)
+
+        :param methodurl: runsignup method url to call
+        :param contentfield: content field to retrieve from response
+        :param **payload: parameters for the method
+        """
+
+        thispayload = self.client_credentials.copy()
+        thispayload.update(payload)
+        thispayload.update({'format':'json'})
+
+        resp = self.session.get(methodurl, params=thispayload)
+        if resp.status_code != 200:
+            raise accessError('HTTP response code={}, url={}'.format(resp.status_code,resp.url))
+
+        data = resp.json()
+
+        if 'error' in data:
+            raise accessError('RSU response code={}-{}, url={}'.format(data['error']['error_code'],data['error']['error_msg'],resp.url))
+
+        return data
+
+########################################################################
+class RunSignUp(RunSignupBase):
+    '''
+    access methods for RunSignUp.com
+
+    see :class:`RunSignupBase` for authentication / session parameters
+    '''
 
     def members(self, club_id, **kwargs):
         '''
@@ -371,56 +391,9 @@ class RunSignUp():
 
         return '\n'.join([header] + results)
 
-    def _rsugetcsv(self, methodurl, **payload):
-        """
-        get method for runsignup access (csv format response)
-        
-        :param methodurl: runsignup method url to call
-        :param contentfield: content field to retrieve from response
-        :param **payload: parameters for the method
-        """
-        
-        thispayload = self.client_credentials.copy()
-        thispayload.update(payload)
-        thispayload.update({'format':'csv'})
-
-        resp = self.session.get(methodurl, params=thispayload)
-        if resp.status_code != 200:
-            raise accessError('HTTP response code={}, url={}'.format(resp.status_code,resp.url))
-
-        data = resp.text
-
-        # if 'error' in data:
-        #     raise accessError('RSU response code={}-{}, url={}'.format(data['error']['error_code'],data['error']['error_msg'],resp.url))
-    
-        return data 
-
-    def _rsuget(self, methodurl, **payload):
-        """
-        get method for runsignup access (json format response)
-        
-        :param methodurl: runsignup method url to call
-        :param contentfield: content field to retrieve from response
-        :param **payload: parameters for the method
-        """
-        
-        thispayload = self.client_credentials.copy()
-        thispayload.update(payload)
-        thispayload.update({'format':'json'})
-
-        resp = self.session.get(methodurl, params=thispayload)
-        if resp.status_code != 200:
-            raise accessError('HTTP response code={}, url={}'.format(resp.status_code,resp.url))
-
-        data = resp.json()
-
-        if 'error' in data:
-            raise accessError('RSU response code={}-{}, url={}'.format(data['error']['error_code'],data['error']['error_msg'],resp.url))
-    
-        return data 
-        
 #----------------------------------------------------------------------
-def updatemembercache(club_id, membercachefilename, key=None, secret=None, email=None, password=None, debug=False):
+def updatemembercache(club_id, membercachefilename, key=None, secret=None,
+                       api_reg_token=None, api_reg_secret=None, debug=False):
     if debug:
         # set up debug logging
         thislogger.setLevel(logging.DEBUG)
@@ -431,7 +404,8 @@ def updatemembercache(club_id, membercachefilename, key=None, secret=None, email
         thislogger.propagate = True
 
     # set up access to RunSignUp
-    rsu = RunSignUp(key=key, secret=secret, email=email, password=password, debug=debug)
+    rsu = RunSignUp(key=key, secret=secret,
+                     api_reg_token=api_reg_token, api_reg_secret=api_reg_secret, debug=debug)
     rsu.open()
 
     # transform from RunSignUp to membercache format
@@ -608,7 +582,8 @@ def updatemembercache(club_id, membercachefilename, key=None, secret=None, email
     return rsumembers
 
 #----------------------------------------------------------------------
-def members2csv(club_id, key, secret, mapping, filepath=None, encoding=None):
+def members2csv(club_id, key, secret, mapping, filepath=None, encoding=None,
+                 api_reg_token=None, api_reg_secret=None):
     '''
     Access club_id through RunSignUp API to retrieve members. Return
     list of members as if csv file. Optionally save csv file.
@@ -619,11 +594,13 @@ def members2csv(club_id, key, secret, mapping, filepath=None, encoding=None):
     :param mapping: OrderedDict {'outfield1':'infield1', 'outfield2':outfunction(inrec), ...} or ['inoutfield1', 'inoutfield2', ...]
     :param normfile: (optional) pathname to save csv file
     :param encoding: (optional) encoding to use for file
+    :param api_reg_token: API caller registration token, sent as rsu_api_reg GET parameter
+    :param api_reg_secret: API caller registration secret, sent as X-RSU-API-REG-SECRET header
     :rtype: csv file records, as list
     '''
 
     # get the members from the RunSignUp API
-    with RunSignUp(key=key, secret=secret) as rsu:
+    with RunSignUp(key=key, secret=secret, api_reg_token=api_reg_token, api_reg_secret=api_reg_secret) as rsu:
         members = rsu.members(club_id)
 
     filerows = record2csv(members, mapping, filepath, encoding=encoding)
@@ -873,34 +850,3 @@ class ClubMemberships():
             for member in self.userid2mem
         )
 
-class RunSignupFluent(UniversalClient):
-    from rauth import OAuth2Service
-    
-    '''
-    Fluent interface to RunSignUp API -- see https://universal-client.readthedocs.io
-    '''
-    def __init__(self, key=None, secret=None, debug=False):
-        '''
-        initialize RunSignUp Fluent client
-
-        :param key: api key for RunSignUp
-        :param secret: api secret for RunSignUp
-        :param debug: debug flag
-        '''
-        # rsuservice = Oauth2Service(
-        #     name='runsignup',
-        #     authorize_url='https://www.runsignup.com/oauth2/authorize',
-        #     access_token_url='https://api.runsignup.com/oauth2/token',
-        #     client_id=key,
-        #     client_secret=secret,
-        # )
-
-        self._params = params = {'api_key'    : key,
-                                 'api_secret' : secret,
-                                 'format'     : 'json' }
-        
-        super().__init__(
-            url='https://api.runsignup.com/rest',
-            params=params,
-        )
-    

runtilities-3.0.0/running/runsignup_fluent.py

@@ -0,0 +1,36 @@
+'''
+runsignup_fluent - fluent access to runsignup.com
+===================================================
+'''
+
+# pypi
+from universalclient import Client as UniversalClient
+
+class RunSignupFluent(UniversalClient):
+
+    '''
+    Fluent interface to RunSignUp API -- see https://universal-client.readthedocs.io
+    '''
+    def __init__(self, key=None, secret=None, api_reg_token=None, api_reg_secret=None, debug=False):
+        '''
+        initialize RunSignUp Fluent client
+
+        :param key: api key for RunSignUp
+        :param secret: api secret for RunSignUp
+        :param api_reg_token: API caller registration token, sent as rsu_api_reg GET parameter -- see
+            https://info.runsignup.com/2026/07/17/new-api-registration-requirements/
+        :param api_reg_secret: API caller registration secret, sent as X-RSU-API-REG-SECRET header
+        :param debug: debug flag
+        '''
+
+        self._params = params = {'api_key'    : key,
+                                 'api_secret' : secret,
+                                 'format'     : 'json' }
+        if api_reg_token:
+            params['rsu_api_reg'] = api_reg_token
+
+        client_kwargs = {'url': 'https://api.runsignup.com/rest', 'params': params}
+        if api_reg_secret:
+            client_kwargs['headers'] = {'X-RSU-API-REG-SECRET': api_reg_secret}
+
+        super().__init__(**client_kwargs)

{runtilities-2.3.0.dev2 → runtilities-3.0.0}/running/version.py

@@ -1,2 +1,2 @@
 # this string is used for the version string in the documentation, as well as the egg
-__version__ = '2.3.0.dev2'
+__version__ = '3.0.0'

{runtilities-2.3.0.dev2 → runtilities-3.0.0}/runtilities.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runtilities
-Version: 2.3.0.dev2
+Version: 3.0.0
 Summary: running related scripts
 Home-page: http://github.com/louking/running
 Author: Lou King

{runtilities-2.3.0.dev2 → runtilities-3.0.0}/runtilities.egg-info/SOURCES.txt

@@ -22,6 +22,7 @@ running/runningaheadmembers.py
 running/runningaheadparticipants.py
 running/runningaheadresults.py
 running/runsignup.py
+running/runsignup_fluent.py
 running/strava.py
 running/textnormalize.py
 running/ultrasignup.py
@@ -37,4 +38,7 @@ runtilities.egg-info/dependency_links.txt
 runtilities.egg-info/entry_points.txt
 runtilities.egg-info/not-zip-safe
 runtilities.egg-info/requires.txt
-runtilities.egg-info/top_level.txt
+runtilities.egg-info/top_level.txt
+tests/test_runsignup.py
+tests/test_runsignup_fluent.py
+tests/test_runsignup_live.py

runtilities-3.0.0/tests/test_runsignup.py

@@ -0,0 +1,154 @@
+'''
+mocked (no network) tests for running.runsignup.RunSignupBase / RunSignUp
+
+covers the RunSignupBase/RunSignUp split and the api_reg_token/api_reg_secret
+wiring required per https://info.runsignup.com/2026/07/17/new-api-registration-requirements/
+'''
+
+from urllib.parse import urlparse, parse_qs
+
+import pytest
+import responses
+
+from running.runsignup import RunSignUp, accessError, parameterError
+
+KEY = 'testkey'
+SECRET = 'testsecret'
+REG_TOKEN = 'testregtoken'
+REG_SECRET = 'testregsecret'
+
+
+def _qs(url):
+    return parse_qs(urlparse(url).query)
+
+
+class TestInitValidation:
+    def test_key_without_secret(self):
+        with pytest.raises(parameterError):
+            RunSignUp(key=KEY)
+
+    def test_secret_without_key(self):
+        with pytest.raises(parameterError):
+            RunSignUp(secret=SECRET)
+
+    def test_api_reg_token_without_secret(self):
+        with pytest.raises(parameterError):
+            RunSignUp(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN)
+
+    def test_api_reg_secret_without_token(self):
+        with pytest.raises(parameterError):
+            RunSignUp(key=KEY, secret=SECRET, api_reg_secret=REG_SECRET)
+
+    def test_no_credentials_is_userpriv(self):
+        rsu = RunSignUp()
+        assert rsu.userpriv is True
+        assert rsu.credentials_type == 'none'
+
+    def test_key_secret_sets_credentials_type(self):
+        rsu = RunSignUp(key=KEY, secret=SECRET)
+        assert rsu.userpriv is False
+        assert rsu.credentials_type == 'key'
+
+
+class TestOpen:
+    def test_open_sets_api_key_secret_only(self):
+        with RunSignUp(key=KEY, secret=SECRET) as rsu:
+            assert rsu.client_credentials == {'api_key': KEY, 'api_secret': SECRET}
+            assert 'X-RSU-API-REG-SECRET' not in rsu.session.headers
+
+    def test_open_sets_api_reg_token_as_param_and_secret_as_header(self):
+        with RunSignUp(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN, api_reg_secret=REG_SECRET) as rsu:
+            assert rsu.client_credentials == {
+                'api_key': KEY, 'api_secret': SECRET, 'rsu_api_reg': REG_TOKEN,
+            }
+            assert rsu.session.headers['X-RSU-API-REG-SECRET'] == REG_SECRET
+
+    def test_open_userpriv_with_api_reg_only(self):
+        # public endpoint access, but still registered as an API caller
+        with RunSignUp(api_reg_token=REG_TOKEN, api_reg_secret=REG_SECRET) as rsu:
+            assert rsu.client_credentials == {'rsu_api_reg': REG_TOKEN}
+            assert rsu.session.headers['X-RSU-API-REG-SECRET'] == REG_SECRET
+
+
+class TestRsuget:
+    @responses.activate
+    def test_sends_credentials_and_reg_token_on_request(self):
+        race_id = 12345
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={'race': {'race_id': race_id, 'name': 'Test Race'}},
+            status=200,
+        )
+        with RunSignUp(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN, api_reg_secret=REG_SECRET) as rsu:
+            race = rsu.getrace(race_id)
+
+        assert race == {'race_id': race_id, 'name': 'Test Race'}
+        sent = responses.calls[0].request
+        assert sent.headers['X-RSU-API-REG-SECRET'] == REG_SECRET
+        params = _qs(sent.url)
+        assert params['api_key'] == [KEY]
+        assert params['api_secret'] == [SECRET]
+        assert params['rsu_api_reg'] == [REG_TOKEN]
+        assert params['format'] == ['json']
+
+    @responses.activate
+    def test_public_endpoint_sends_no_credentials(self):
+        race_id = 999
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={'race': {'race_id': race_id}},
+            status=200,
+        )
+        with RunSignUp() as rsu:
+            race = rsu.getrace(race_id)
+
+        assert race == {'race_id': race_id}
+        params = _qs(responses.calls[0].request.url)
+        assert 'api_key' not in params
+        assert 'rsu_api_reg' not in params
+        assert 'X-RSU-API-REG-SECRET' not in responses.calls[0].request.headers
+
+    @responses.activate
+    def test_error_response_raises_accesserror(self):
+        race_id = 1
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={'error': {'error_code': 100, 'error_msg': 'bad request'}},
+            status=200,
+        )
+        with RunSignUp() as rsu:
+            with pytest.raises(accessError):
+                rsu.getrace(race_id)
+
+    @responses.activate
+    def test_http_error_raises_accesserror(self):
+        race_id = 1
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={},
+            status=500,
+        )
+        with RunSignUp() as rsu:
+            with pytest.raises(accessError):
+                rsu.getrace(race_id)
+
+
+class TestMembersPagination:
+    @responses.activate
+    def test_paginates_until_short_page(self):
+        club_id = 42
+        url = f'https://api.runsignup.com/rest/club/{club_id}/members'
+        page1 = {'club_members': [{'user': {'user_id': i}} for i in range(100)]}
+        page2 = {'club_members': [{'user': {'user_id': 100}}]}
+        responses.add(responses.GET, url, json=page1, status=200)
+        responses.add(responses.GET, url, json=page2, status=200)
+
+        with RunSignUp(key=KEY, secret=SECRET) as rsu:
+            members = rsu.members(club_id)
+
+        assert len(members) == 101
+        assert len(responses.calls) == 2

runtilities-3.0.0/tests/test_runsignup_fluent.py

@@ -0,0 +1,80 @@
+'''
+mocked (no network) tests for running.runsignup_fluent.RunSignupFluent
+
+covers the api_reg_token/api_reg_secret wiring required per
+https://info.runsignup.com/2026/07/17/new-api-registration-requirements/
+'''
+
+from urllib.parse import urlparse, parse_qs
+
+import responses
+
+from running.runsignup_fluent import RunSignupFluent
+
+KEY = 'testkey'
+SECRET = 'testsecret'
+REG_TOKEN = 'testregtoken'
+REG_SECRET = 'testregsecret'
+
+
+def _qs(url):
+    return parse_qs(urlparse(url).query)
+
+
+class TestConstructorArgs:
+    def test_key_secret_only(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET)
+        args = rsu.getArgs()
+        assert args['params'] == {'api_key': KEY, 'api_secret': SECRET, 'format': 'json'}
+        assert 'headers' not in args
+
+    def test_api_reg_token_added_to_params(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN)
+        args = rsu.getArgs()
+        assert args['params']['rsu_api_reg'] == REG_TOKEN
+        assert 'headers' not in args
+
+    def test_api_reg_secret_added_as_header(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN, api_reg_secret=REG_SECRET)
+        args = rsu.getArgs()
+        assert args['headers'] == {'X-RSU-API-REG-SECRET': REG_SECRET}
+
+
+class TestRequestWiring:
+    @responses.activate
+    def test_get_sends_credentials_and_reg_token(self):
+        race_id = 12345
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={'race': {'race_id': race_id, 'name': 'Test Race'}},
+            status=200,
+        )
+        rsu = RunSignupFluent(key=KEY, secret=SECRET, api_reg_token=REG_TOKEN, api_reg_secret=REG_SECRET)
+        resp = rsu.race._(race_id).get()
+
+        assert resp.json() == {'race': {'race_id': race_id, 'name': 'Test Race'}}
+        sent = responses.calls[0].request
+        assert sent.headers['X-RSU-API-REG-SECRET'] == REG_SECRET
+        params = _qs(sent.url)
+        assert params['api_key'] == [KEY]
+        assert params['api_secret'] == [SECRET]
+        assert params['rsu_api_reg'] == [REG_TOKEN]
+        assert params['format'] == ['json']
+
+    @responses.activate
+    def test_get_without_api_reg_sends_no_header(self):
+        race_id = 999
+        responses.add(
+            responses.GET,
+            f'https://api.runsignup.com/rest/race/{race_id}',
+            json={'race': {'race_id': race_id}},
+            status=200,
+        )
+        rsu = RunSignupFluent(key=KEY, secret=SECRET)
+        rsu.race._(race_id).get()
+
+        sent = responses.calls[0].request
+        assert 'X-RSU-API-REG-SECRET' not in sent.headers
+        params = _qs(sent.url)
+        assert 'rsu_api_reg' not in params

runtilities-3.0.0/tests/test_runsignup_live.py

@@ -0,0 +1,117 @@
+'''
+opt-in live smoke tests against the real RunSignUp.com API
+
+these hit the network and are skipped by default. to run them, set environment
+variables and run:
+
+    pytest tests/test_runsignup_live.py -v
+
+RSU_TEST_RACE_ID (a real, public race_id on runsignup.com) is required for the
+public/unauthenticated tests. RSU_KEY / RSU_SECRET (and optionally
+RSU_API_REG_TOKEN / RSU_API_REG_SECRET, per
+https://info.runsignup.com/2026/07/17/new-api-registration-requirements/) enable
+the authenticated tests. RSU_TEST_CLUB_ID (a real club_id the RSU_KEY/RSU_SECRET
+account can administer) additionally enables the bad-credential rejection tests.
+'''
+
+import os
+
+import pytest
+
+from running.runsignup import RunSignUp, accessError
+from running.runsignup_fluent import RunSignupFluent
+
+RACE_ID = os.environ.get('RSU_TEST_RACE_ID')
+CLUB_ID = os.environ.get('RSU_TEST_CLUB_ID')
+KEY = os.environ.get('RSU_KEY')
+SECRET = os.environ.get('RSU_SECRET')
+API_REG_TOKEN = os.environ.get('RSU_API_REG_TOKEN')
+API_REG_SECRET = os.environ.get('RSU_API_REG_SECRET')
+
+needs_race_id = pytest.mark.skipif(not RACE_ID, reason='set RSU_TEST_RACE_ID to run live tests')
+needs_credentials = pytest.mark.skipif(
+    not (KEY and SECRET), reason='set RSU_KEY/RSU_SECRET to run authenticated live tests'
+)
+needs_api_reg = pytest.mark.skipif(
+    not (API_REG_TOKEN and API_REG_SECRET),
+    reason='set RSU_API_REG_TOKEN/RSU_API_REG_SECRET to run registered-caller live tests',
+)
+needs_club_id = pytest.mark.skipif(
+    not CLUB_ID, reason='set RSU_TEST_CLUB_ID to run bad-credential rejection live tests'
+)
+
+
+@needs_race_id
+class TestRunSignUpLive:
+    def test_getrace_public(self):
+        with RunSignUp() as rsu:
+            race = rsu.getrace(int(RACE_ID))
+        assert str(race['race_id']) == str(RACE_ID)
+
+    @needs_api_reg
+    def test_getrace_with_api_reg(self):
+        with RunSignUp(api_reg_token=API_REG_TOKEN, api_reg_secret=API_REG_SECRET) as rsu:
+            race = rsu.getrace(int(RACE_ID))
+        assert str(race['race_id']) == str(RACE_ID)
+
+    @needs_credentials
+    def test_getrace_authenticated(self):
+        with RunSignUp(key=KEY, secret=SECRET, api_reg_token=API_REG_TOKEN, api_reg_secret=API_REG_SECRET) as rsu:
+            race = rsu.getrace(int(RACE_ID))
+        assert str(race['race_id']) == str(RACE_ID)
+
+
+@needs_race_id
+class TestRunSignupFluentLive:
+    def test_get_race_public(self):
+        rsu = RunSignupFluent()
+        resp = rsu.race._(int(RACE_ID)).get()
+        assert resp.status_code == 200
+        assert str(resp.json()['race']['race_id']) == str(RACE_ID)
+
+    @needs_credentials
+    def test_get_race_authenticated(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET, api_reg_token=API_REG_TOKEN, api_reg_secret=API_REG_SECRET)
+        resp = rsu.race._(int(RACE_ID)).get()
+        assert resp.status_code == 200
+        assert str(resp.json()['race']['race_id']) == str(RACE_ID)
+
+
+@needs_credentials
+@needs_club_id
+class TestBadPasswordLive:
+    '''confirms a wrong secret (right key, wrong password) is actually rejected by the live API'''
+
+    def test_runsignup_wrong_secret_rejected(self):
+        with RunSignUp(key=KEY, secret=SECRET + '-wrong-for-testing') as rsu:
+            with pytest.raises(accessError):
+                rsu.members(int(CLUB_ID))
+
+    def test_runsignup_fluent_wrong_secret_rejected(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET + '-wrong-for-testing')
+        resp = rsu.club._(int(CLUB_ID)).members.get()
+        assert resp.status_code != 200 or 'error' in resp.json()
+
+
+@needs_credentials
+@needs_club_id
+class TestBadApiRegTokenLive:
+    '''
+    confirms that when an api_reg_token/api_reg_secret IS supplied, RunSignUp actually validates it
+    and rejects a wrong one -- distinct from omitting it entirely, which RunSignUp currently accepts
+    since registered-caller credentials aren't required until 2027-01-01 per
+    https://info.runsignup.com/2026/07/17/new-api-registration-requirements/. This test only tells you
+    whether a *provided* bad token/secret is checked, not whether one is required yet.
+    '''
+
+    def test_runsignup_wrong_api_reg_rejected(self):
+        with RunSignUp(key=KEY, secret=SECRET,
+                        api_reg_token='bad-token-for-testing', api_reg_secret='bad-secret-for-testing') as rsu:
+            with pytest.raises(accessError):
+                rsu.members(int(CLUB_ID))
+
+    def test_runsignup_fluent_wrong_api_reg_rejected(self):
+        rsu = RunSignupFluent(key=KEY, secret=SECRET,
+                               api_reg_token='bad-token-for-testing', api_reg_secret='bad-secret-for-testing')
+        resp = rsu.club._(int(CLUB_ID)).members.get()
+        assert resp.status_code != 200 or 'error' in resp.json()