sealedwebtoken 1.0.0__tar.gz

sealedwebtoken-1.0.0/.gitignore

@@ -0,0 +1,230 @@
+# Logs
+
+logs
+_.log
+npm-debug.log_
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+.pnpm-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+
+report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
+
+# Runtime data
+
+pids
+_.pid
+_.seed
+\*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+
+lib-cov
+
+# Coverage directory used by tools like istanbul
+
+coverage
+\*.lcov
+
+# nyc test coverage
+
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+
+bower_components
+
+# node-waf configuration
+
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+
+build/Release
+
+# Dependency directories
+
+node_modules/
+jspm_packages/
+
+# Snowpack dependency directory (https://snowpack.dev/)
+
+web_modules/
+
+# TypeScript cache
+
+\*.tsbuildinfo
+
+# Optional npm cache directory
+
+.npm
+
+# Optional eslint cache
+
+.eslintcache
+
+# Optional stylelint cache
+
+.stylelintcache
+
+# Microbundle cache
+
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+
+.node_repl_history
+
+# Output of 'npm pack'
+
+\*.tgz
+
+# Yarn Integrity file
+
+.yarn-integrity
+
+# parcel-bundler cache (https://parceljs.org/)
+
+.cache
+.parcel-cache
+
+# Next.js build output
+
+.next
+out
+
+# Nuxt.js build / generate output
+
+.nuxt
+dist
+
+# Gatsby files
+
+.cache/
+
+# Comment in the public line in if your project uses Gatsby and not Next.js
+
+# https://nextjs.org/blog/next-9-1#public-directory-support
+
+# public
+
+# vuepress build output
+
+.vuepress/dist
+
+# vuepress v2.x temp and cache directory
+
+.temp
+.cache
+
+# Docusaurus cache and generated files
+
+.docusaurus
+
+# Serverless directories
+
+.serverless/
+
+# FuseBox cache
+
+.fusebox/
+
+# DynamoDB Local files
+
+.dynamodb/
+
+# TernJS port file
+
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+
+.vscode-test
+
+# yarn v2
+
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.\*
+
+# wrangler project
+
+.dev.vars*
+!.dev.vars.example
+.env*
+!.env.example
+.wrangler/
+
+# Python SDK / Standards
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+test_env/

sealedwebtoken-1.0.0/PKG-INFO

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: sealedwebtoken
+Version: 1.0.0
+Summary: Official Python SDK for Odysii Sealed Web Tokens (SWT)
+Project-URL: Homepage, https://swt.odysii.in
+Project-URL: Repository, https://github.com/snskar125/swt
+Author: snskar125
+License: ISC
+Keywords: authentication,jwt,sealed-web-tokens,swt,tokens
+Classifier: License :: OSI Approved :: ISC License (ISCL)
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Provides-Extra: async
+Requires-Dist: aiohttp>=3.9; extra == 'async'
+Description-Content-Type: text/markdown
+
+# sealedwebtoken
+
+The official Python SDK for Odysii Sealed Web Tokens (SWT).
+
+## Installation
+
+```bash
+# Sync client only (zero dependencies)
+pip install sealedwebtoken
+
+# With async support (installs aiohttp)
+pip install sealedwebtoken[async]
+```
+
+## Usage
+
+### Sync
+
+```python
+import time
+import swt
+
+secret = "your-super-secret-key"
+payload = {"user_id": 123, "role": "admin"}
+
+# 1. Sign a token (expiresAt is required, max 31 days)
+expires_at = int(time.time()) + 3600  # 1 hour from now
+resp = swt.sign(payload, secret=secret, expires_at=expires_at)
+print("Token:", resp.token)
+print("Expires at:", resp.expires_at)
+
+# 2. Verify a token
+v = swt.verify(resp.token, secret=secret)
+if v.valid:
+    print("Payload:", v.payload)
+
+# 3. Revoke a token
+swt.revoke(resp.token, secret=secret)
+print("Token revoked")
+```
+
+### Async
+
+```python
+import asyncio, time
+import swt
+
+async def main():
+    client = swt.AsyncSWTClient()
+    expires_at = int(time.time()) + 3600
+
+    resp = await client.sign({"user_id": 42}, secret="mysecret123", expires_at=expires_at)
+    print("Token:", resp.token)
+
+    v = await client.verify(resp.token, secret="mysecret123")
+    if v.valid:
+        print("Payload:", v.payload)
+
+    await client.revoke(resp.token, secret="mysecret123")
+    print("Token revoked")
+
+asyncio.run(main())
+```
+
+### Using the class-based client
+
+```python
+import swt
+
+# Create a reusable client
+client = swt.SWTClient()
+resp = client.sign({"user_id": 1}, secret="mysecret123", expires_at=...)
+```
+
+## API Reference
+
+### `swt.sign(payload, *, secret, expires_at) → SignResponse`
+
+- `payload` — `dict` to embed in the token (max 512 bytes serialised)
+- `secret` — string, min 8 characters
+- `expires_at` — Unix timestamp in seconds, **required**, max 31 days from now
+
+### `swt.verify(token, *, secret=None) → VerifyResponse`
+
+- `token` — the SWT token string
+- `secret` — optional; if provided, validates the secret matches
+
+### `swt.revoke(token, *, secret) → RevokeResponse`
+
+- `token` — the SWT token string to revoke
+- `secret` — the secret used when signing

sealedwebtoken-1.0.0/README.md

@@ -0,0 +1,91 @@
+# sealedwebtoken
+
+The official Python SDK for Odysii Sealed Web Tokens (SWT).
+
+## Installation
+
+```bash
+# Sync client only (zero dependencies)
+pip install sealedwebtoken
+
+# With async support (installs aiohttp)
+pip install sealedwebtoken[async]
+```
+
+## Usage
+
+### Sync
+
+```python
+import time
+import swt
+
+secret = "your-super-secret-key"
+payload = {"user_id": 123, "role": "admin"}
+
+# 1. Sign a token (expiresAt is required, max 31 days)
+expires_at = int(time.time()) + 3600  # 1 hour from now
+resp = swt.sign(payload, secret=secret, expires_at=expires_at)
+print("Token:", resp.token)
+print("Expires at:", resp.expires_at)
+
+# 2. Verify a token
+v = swt.verify(resp.token, secret=secret)
+if v.valid:
+    print("Payload:", v.payload)
+
+# 3. Revoke a token
+swt.revoke(resp.token, secret=secret)
+print("Token revoked")
+```
+
+### Async
+
+```python
+import asyncio, time
+import swt
+
+async def main():
+    client = swt.AsyncSWTClient()
+    expires_at = int(time.time()) + 3600
+
+    resp = await client.sign({"user_id": 42}, secret="mysecret123", expires_at=expires_at)
+    print("Token:", resp.token)
+
+    v = await client.verify(resp.token, secret="mysecret123")
+    if v.valid:
+        print("Payload:", v.payload)
+
+    await client.revoke(resp.token, secret="mysecret123")
+    print("Token revoked")
+
+asyncio.run(main())
+```
+
+### Using the class-based client
+
+```python
+import swt
+
+# Create a reusable client
+client = swt.SWTClient()
+resp = client.sign({"user_id": 1}, secret="mysecret123", expires_at=...)
+```
+
+## API Reference
+
+### `swt.sign(payload, *, secret, expires_at) → SignResponse`
+
+- `payload` — `dict` to embed in the token (max 512 bytes serialised)
+- `secret` — string, min 8 characters
+- `expires_at` — Unix timestamp in seconds, **required**, max 31 days from now
+
+### `swt.verify(token, *, secret=None) → VerifyResponse`
+
+- `token` — the SWT token string
+- `secret` — optional; if provided, validates the secret matches
+
+### `swt.revoke(token, *, secret) → RevokeResponse`
+
+- `token` — the SWT token string to revoke
+- `secret` — the secret used when signing

sealedwebtoken-1.0.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "sealedwebtoken"
+version = "1.0.0"
+description = "Official Python SDK for Odysii Sealed Web Tokens (SWT)"
+readme = "README.md"
+license = { text = "ISC" }
+authors = [{ name = "snskar125" }]
+keywords = ["swt", "sealed-web-tokens", "jwt", "authentication", "tokens"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: ISC License (ISCL)",
+    "Operating System :: OS Independent",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Security",
+]
+requires-python = ">=3.9"
+
+# Zero required dependencies — sync client uses stdlib urllib only
+dependencies = []
+
+[project.optional-dependencies]
+# Install aiohttp to use AsyncSWTClient
+async = ["aiohttp>=3.9"]
+
+[project.urls]
+Homepage = "https://swt.odysii.in"
+Repository = "https://github.com/snskar125/swt"
+
+[tool.hatch.build.targets.wheel]
+packages = ["swt"]

sealedwebtoken-1.0.0/swt/__init__.py

@@ -0,0 +1,345 @@
+"""
+swt — Official Python SDK for Odysii Sealed Web Tokens (SWT).
+
+Provides both a synchronous client (SWTClient) and an async client
+(AsyncSWTClient) that mirror the Node.js SDK's sign/verify/revoke API.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from typing import Any
+
+# ─────────────────────────────────────────────────────────────────────────────
+# RESPONSE TYPES
+# ─────────────────────────────────────────────────────────────────────────────
+
+@dataclass
+class SignResponse:
+    """Returned by sign() on success."""
+
+    token: str
+    """The issued SWT token string."""
+
+    expires_at: int
+    """Unix timestamp (seconds) when the token expires."""
+
+
+@dataclass
+class VerifyResponse:
+    """Returned by verify() on success."""
+
+    valid: bool
+    """True if the token is valid, not expired, and not revoked."""
+
+    payload: dict[str, Any] | None = None
+    """The caller-supplied payload embedded in the token. None if invalid."""
+
+    expires_at: int | None = None
+    """Unix timestamp when the token expires. None if invalid."""
+
+
+@dataclass
+class RevokeResponse:
+    """Returned by revoke() on success."""
+
+    success: bool
+    """True if the token was revoked (or was already revoked)."""
+
+    message: str | None = None
+    """Optional human-readable status message."""
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# EXCEPTIONS
+# ─────────────────────────────────────────────────────────────────────────────
+
+class SWTError(Exception):
+    """Raised when the SWT API returns an error response."""
+
+    def __init__(self, message: str, status_code: int | None = None) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# CONSTANTS
+# ─────────────────────────────────────────────────────────────────────────────
+
+_API_URL = "https://api.swt.odysii.in"
+
+# ─────────────────────────────────────────────────────────────────────────────
+# SYNC CLIENT
+# ─────────────────────────────────────────────────────────────────────────────
+
+class SWTClient:
+    """
+    Synchronous SWT client using urllib (zero dependencies).
+
+    Example::
+
+        import swt
+
+        client = swt.SWTClient()
+
+        # Sign
+        import time
+        expires_at = int(time.time()) + 3600  # 1 hour from now
+        resp = client.sign({"user_id": 42}, secret="mysecret123", expires_at=expires_at)
+        print(resp.token)
+
+        # Verify
+        v = client.verify(resp.token, secret="mysecret123")
+        if v.valid:
+            print(v.payload)
+
+        # Revoke
+        client.revoke(resp.token, secret="mysecret123")
+    """
+
+    def __init__(self, base_url: str = _API_URL) -> None:
+        self._base_url = base_url.rstrip("/")
+
+    def _post(self, path: str, body: dict[str, Any]) -> dict[str, Any]:
+        """Make a synchronous POST request using urllib (no third-party deps)."""
+        import urllib.request
+        import urllib.error
+
+        data = json.dumps(body).encode("utf-8")
+        req = urllib.request.Request(
+            f"{self._base_url}{path}",
+            data=data,
+            headers={
+                "Content-Type": "application/json",
+                "User-Agent": "odysii-swt-python/1.0.0",
+            },
+            method="POST",
+        )
+
+        try:
+            with urllib.request.urlopen(req) as resp:
+                return json.loads(resp.read().decode("utf-8"))
+        except urllib.error.HTTPError as exc:
+            # Read the error body for the API error message
+            try:
+                error_body = json.loads(exc.read().decode("utf-8"))
+                msg = error_body.get("error", f"HTTP {exc.code}")
+            except Exception:
+                msg = f"HTTP {exc.code}"
+            raise SWTError(msg, status_code=exc.code) from exc
+
+    def sign(
+        self,
+        payload: dict[str, Any],
+        *,
+        secret: str,
+        expires_at: int,
+    ) -> SignResponse:
+        """
+        Issue a new SWT token.
+
+        :param payload:    Arbitrary dict to embed in the token (max 512 bytes serialised).
+        :param secret:     Secret used for signing (min 8 characters).
+        :param expires_at: Required Unix timestamp (seconds) for expiry. Max 31 days from now.
+        :raises SWTError:  If the API returns an error.
+        """
+        data = self._post("/v1/sign", {
+            "secret": secret,
+            "payload": payload,
+            "expiresAt": expires_at,
+        })
+        return SignResponse(token=data["token"], expires_at=data["expiresAt"])
+
+    def verify(
+        self,
+        token: str,
+        *,
+        secret: str | None = None,
+    ) -> VerifyResponse:
+        """
+        Verify a SWT token.
+
+        :param token:     The token string to verify.
+        :param secret:    Optional — if provided, also validates the secret matches.
+        :raises SWTError: If the API returns a non-auth error.
+        """
+        body: dict[str, Any] = {"token": token}
+        if secret is not None:
+            body["secret"] = secret
+
+        data = self._post("/v1/verify", body)
+        return VerifyResponse(
+            valid=data.get("valid", False),
+            payload=data.get("payload"),
+            expires_at=data.get("expiresAt"),
+        )
+
+    def revoke(self, token: str, *, secret: str) -> RevokeResponse:
+        """
+        Revoke a SWT token.
+
+        :param token:     The token string to revoke.
+        :param secret:    The secret that was used to sign the token.
+        :raises SWTError: If the API returns an error.
+        """
+        data = self._post("/v1/revoke", {"token": token, "secret": secret})
+        return RevokeResponse(success=data.get("success", False), message=data.get("message"))
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# ASYNC CLIENT
+# ─────────────────────────────────────────────────────────────────────────────
+
+class AsyncSWTClient:
+    """
+    Asynchronous SWT client using aiohttp.
+
+    Requires ``aiohttp`` to be installed::
+
+        pip install swt[async]
+
+    Example::
+
+        import asyncio, time
+        import swt
+
+        async def main():
+            client = swt.AsyncSWTClient()
+            expires_at = int(time.time()) + 3600
+
+            resp = await client.sign({"user_id": 42}, secret="mysecret123", expires_at=expires_at)
+            print(resp.token)
+
+            v = await client.verify(resp.token, secret="mysecret123")
+            if v.valid:
+                print(v.payload)
+
+            await client.revoke(resp.token, secret="mysecret123")
+
+        asyncio.run(main())
+    """
+
+    def __init__(self, base_url: str = _API_URL) -> None:
+        self._base_url = base_url.rstrip("/")
+
+    async def _post(self, path: str, body: dict[str, Any]) -> dict[str, Any]:
+        """Make an async POST request using aiohttp."""
+        try:
+            import aiohttp
+        except ImportError as exc:
+            raise ImportError(
+                "AsyncSWTClient requires aiohttp. Install it with: pip install swt[async]"
+            ) from exc
+
+        async with aiohttp.ClientSession() as session:
+            async with session.post(
+                f"{self._base_url}{path}",
+                json=body,
+                headers={
+                    "Content-Type": "application/json",
+                    "User-Agent": "odysii-swt-python/1.0.0",
+                },
+            ) as resp:
+                data = await resp.json()
+                if not resp.ok:
+                    msg = data.get("error", f"HTTP {resp.status}") if isinstance(data, dict) else f"HTTP {resp.status}"
+                    raise SWTError(msg, status_code=resp.status)
+                return data
+
+    async def sign(
+        self,
+        payload: dict[str, Any],
+        *,
+        secret: str,
+        expires_at: int,
+    ) -> SignResponse:
+        """
+        Issue a new SWT token (async).
+
+        :param payload:    Arbitrary dict to embed in the token (max 512 bytes serialised).
+        :param secret:     Secret used for signing (min 8 characters).
+        :param expires_at: Required Unix timestamp (seconds) for expiry. Max 31 days from now.
+        :raises SWTError:  If the API returns an error.
+        """
+        data = await self._post("/v1/sign", {
+            "secret": secret,
+            "payload": payload,
+            "expiresAt": expires_at,
+        })
+        return SignResponse(token=data["token"], expires_at=data["expiresAt"])
+
+    async def verify(
+        self,
+        token: str,
+        *,
+        secret: str | None = None,
+    ) -> VerifyResponse:
+        """
+        Verify a SWT token (async).
+
+        :param token:     The token string to verify.
+        :param secret:    Optional — if provided, also validates the secret matches.
+        :raises SWTError: If the API returns a non-auth error.
+        """
+        body: dict[str, Any] = {"token": token}
+        if secret is not None:
+            body["secret"] = secret
+
+        data = await self._post("/v1/verify", body)
+        return VerifyResponse(
+            valid=data.get("valid", False),
+            payload=data.get("payload"),
+            expires_at=data.get("expiresAt"),
+        )
+
+    async def revoke(self, token: str, *, secret: str) -> RevokeResponse:
+        """
+        Revoke a SWT token (async).
+
+        :param token:     The token string to revoke.
+        :param secret:    The secret that was used to sign the token.
+        :raises SWTError: If the API returns an error.
+        """
+        data = await self._post("/v1/revoke", {"token": token, "secret": secret})
+        return RevokeResponse(success=data.get("success", False), message=data.get("message"))
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# MODULE-LEVEL CONVENIENCE (mirrors Node.js SDK's functional API)
+# ─────────────────────────────────────────────────────────────────────────────
+
+_default_client = SWTClient()
+
+
+def sign(
+    payload: dict[str, Any],
+    *,
+    secret: str,
+    expires_at: int,
+) -> SignResponse:
+    """Module-level sign() — uses a shared default SWTClient."""
+    return _default_client.sign(payload, secret=secret, expires_at=expires_at)
+
+
+def verify(token: str, *, secret: str | None = None) -> VerifyResponse:
+    """Module-level verify() — uses a shared default SWTClient."""
+    return _default_client.verify(token, secret=secret)
+
+
+def revoke(token: str, *, secret: str) -> RevokeResponse:
+    """Module-level revoke() — uses a shared default SWTClient."""
+    return _default_client.revoke(token, secret=secret)
+
+
+__all__ = [
+    "SWTClient",
+    "AsyncSWTClient",
+    "SignResponse",
+    "VerifyResponse",
+    "RevokeResponse",
+    "SWTError",
+    "sign",
+    "verify",
+    "revoke",
+]

sealedwebtoken-1.0.0/test.py

@@ -0,0 +1,142 @@
+"""
+Test suite for the Python SWT SDK.
+Runs against the live API — requires network access.
+"""
+
+import sys
+import time
+
+# (Removed sys.path so we test the actual installed pip package)
+
+import swt
+
+# ─── Config ───────────────────────────────────────────────────────────────────
+
+SECRET = "test-secret-swt-2026"
+PAYLOAD = {"userId": "py-test-001", "role": "tester"}
+EXPIRES_AT = int(time.time()) + 3600  # 1 hour from now
+
+PASS = "\033[92m✓\033[0m"
+FAIL = "\033[91m✗\033[0m"
+
+def check(label: str, condition: bool, detail: str = "") -> None:
+    status = PASS if condition else FAIL
+    print(f"  {status}  {label}" + (f" — {detail}" if detail else ""))
+    if not condition:
+        sys.exit(1)
+
+# ─── Tests ────────────────────────────────────────────────────────────────────
+
+print("\n🔐 SWT Python SDK — Live API Test\n")
+
+# 1. SIGN
+print("1. sign()")
+try:
+    resp = swt.sign(PAYLOAD, secret=SECRET, expires_at=EXPIRES_AT)
+    check("returns a token string", isinstance(resp.token, str) and resp.token.startswith("swt_"))
+    check("token has correct format (swt_<jti>.<blob>)", resp.token.count(".") == 1)
+    check("returns expiresAt as int", isinstance(resp.expires_at, int))
+    check("expiresAt matches what we sent", resp.expires_at == EXPIRES_AT)
+    TOKEN = resp.token
+    print(f"     token: {TOKEN[:60]}...")
+except swt.SWTError as e:
+    check("sign() succeeded", False, str(e))
+
+print()
+
+# 2. VERIFY — valid token
+print("2. verify() — valid token")
+try:
+    v = swt.verify(TOKEN, secret=SECRET)
+    check("valid is True", v.valid is True)
+    check("payload matches", v.payload == PAYLOAD)
+    check("expiresAt is returned", v.expires_at == EXPIRES_AT)
+except swt.SWTError as e:
+    check("verify() succeeded", False, str(e))
+
+print()
+
+# 3. VERIFY — wrong secret
+print("3. verify() — wrong secret")
+try:
+    v = swt.verify(TOKEN, secret="wrong-secret-123")
+    check("valid is False for wrong secret", v.valid is False)
+except swt.SWTError:
+    # API may return 401 which throws SWTError — also acceptable
+    check("rejected with wrong secret", True, "raised SWTError")
+
+print()
+
+# 4. VERIFY — no secret (token-only check)
+print("4. verify() — no secret (token only)")
+try:
+    v = swt.verify(TOKEN)
+    check("valid is True without secret", v.valid is True)
+    check("payload is present", v.payload is not None)
+except swt.SWTError as e:
+    check("verify() without secret succeeded", False, str(e))
+
+print()
+
+# 5. VERIFY — malformed token
+print("5. verify() — malformed token")
+try:
+    v = swt.verify("not-a-real-token", secret=SECRET)
+    check("valid is False for malformed token", v.valid is False)
+except swt.SWTError:
+    check("rejected malformed token", True, "raised SWTError")
+
+print()
+
+# 6. REVOKE
+print("6. revoke()")
+try:
+    r = swt.revoke(TOKEN, secret=SECRET)
+    check("success is True", r.success is True)
+except swt.SWTError as e:
+    check("revoke() succeeded", False, str(e))
+
+print()
+
+# 7. VERIFY — after revocation
+print("7. verify() — after revocation")
+try:
+    v = swt.verify(TOKEN, secret=SECRET)
+    check("valid is False after revoke", v.valid is False)
+except swt.SWTError:
+    check("rejected revoked token", True, "raised SWTError")
+
+print()
+
+# 8. REVOKE — wrong secret
+print("8. revoke() — wrong secret")
+resp2 = swt.sign({"test": "revoke-auth"}, secret=SECRET, expires_at=int(time.time()) + 3600)
+try:
+    swt.revoke(resp2.token, secret="wrong-secret-123")
+    check("should have rejected", False, "expected SWTError but didn't get one")
+except swt.SWTError as e:
+    check("rejected revoke with wrong secret", True, f"SWTError: {e}")
+
+print()
+
+# 9. SIGN — expired expiresAt
+print("9. sign() — expiresAt in the past")
+try:
+    swt.sign(PAYLOAD, secret=SECRET, expires_at=int(time.time()) - 100)
+    check("should have rejected past expiresAt", False, "expected SWTError")
+except swt.SWTError as e:
+    check("rejected past expiresAt", True, f"SWTError: {e}")
+
+print()
+
+# 10. SIGN — expiresAt beyond 31 days
+print("10. sign() — expiresAt > 31 days")
+try:
+    far_future = int(time.time()) + (32 * 24 * 60 * 60)
+    swt.sign(PAYLOAD, secret=SECRET, expires_at=far_future)
+    check("should have rejected >31 day TTL", False, "expected SWTError")
+except swt.SWTError as e:
+    check("rejected >31 day TTL", True, f"SWTError: {e}")
+
+print()
+print("✅  All tests passed\n")