selectwin 0.1.2__tar.gz → 0.1.3__tar.gz

{selectwin-0.1.2 → selectwin-0.1.3}/PKG-INFO

@@ -1,8 +1,8 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: selectwin
-Version: 0.1.2
+Version: 0.1.3
 Summary: Official Selectwin Python SDK — payments (card, PIX, boleto), subscriptions, webhooks.
-Project-URL: Homepage, https://docs.selectwin.io
+Project-URL: Homepage, https://selectwin.io/docs/sdk/python/overview
 Project-URL: Repository, https://github.com/selectwin/sdk-python
 Author-email: Selectwin <help@selectwin.io>
 License: MIT
@@ -14,7 +14,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Typing :: Typed
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Requires-Dist: attrs>=21.3.0
 Requires-Dist: httpx>=0.23
 Requires-Dist: python-dateutil>=2.8.0
@@ -132,6 +132,8 @@ spec) + a **hand-written DX shell**:
   `APIError`, `APIConnectionError`.
 - **Auto-retries** (429/5xx/network) with exponential backoff, honouring `Retry-After`.
 - **Idempotency** — an `X-Idempotency-Key` is added to every mutation (override per call).
+- **Safe paths** — a path parameter of `.` or `..` is refused before the request is built (it would reach another
+  endpoint); redirects are not followed.
 - **Timeouts** and one shared, pre-authenticated `httpx` client per SDK client.
 - **Auto-pagination** — sync (`for …`) and async (`async for …`) iterators, `.first()`,
   `.to_list(max=…)`, `.pages()`.

{selectwin-0.1.2 → selectwin-0.1.3}/README.md

@@ -105,6 +105,8 @@ spec) + a **hand-written DX shell**:
   `APIError`, `APIConnectionError`.
 - **Auto-retries** (429/5xx/network) with exponential backoff, honouring `Retry-After`.
 - **Idempotency** — an `X-Idempotency-Key` is added to every mutation (override per call).
+- **Safe paths** — a path parameter of `.` or `..` is refused before the request is built (it would reach another
+  endpoint); redirects are not followed.
 - **Timeouts** and one shared, pre-authenticated `httpx` client per SDK client.
 - **Auto-pagination** — sync (`for …`) and async (`async for …`) iterators, `.first()`,
   `.to_list(max=…)`, `.pages()`.

{selectwin-0.1.2 → selectwin-0.1.3}/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "hatchling.build"
 
 [project]
 name = "selectwin"
-version = "0.1.2"
+version = "0.1.3"
 description = "Official Selectwin Python SDK — payments (card, PIX, boleto), subscriptions, webhooks."
 readme = "README.md"
 license = { text = "MIT" }
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 authors = [{ name = "Selectwin", email = "help@selectwin.io" }]
 keywords = ["selectwin", "payments", "pix", "boleto", "subscriptions", "webhooks", "api", "sdk"]
 classifiers = [
@@ -34,7 +34,7 @@ dev = [
 ]
 
 [project.urls]
-Homepage = "https://docs.selectwin.io"
+Homepage = "https://selectwin.io/docs/sdk/python/overview"
 Repository = "https://github.com/selectwin/sdk-python"
 
 [tool.hatch.build.targets.wheel]

{selectwin-0.1.2 → selectwin-0.1.3}/src/selectwin/client.py

@@ -11,16 +11,25 @@ typed-error mapping apply everywhere.
 
 from __future__ import annotations
 
+from importlib.metadata import PackageNotFoundError
+from importlib.metadata import version as _dist_version
 from typing import Any, Optional
 
 import httpx
 
 from ._core.client import AuthenticatedClient
-from .http import build_httpx_args
+from .http import build_httpx_args, guard_dot_segments
 from .resources import NAMESPACES
 from .webhooks import construct_event
 
-SDK_VERSION = "0.1.0"
+try:
+    # Single source of truth: the installed package metadata (from pyproject.toml).
+    # Never hand-edit a version constant here — it only drifts. Falls back to a dev
+    # marker when running from source without an install.
+    SDK_VERSION = _dist_version("selectwin")
+except PackageNotFoundError:  # pragma: no cover - source checkout, not installed
+    SDK_VERSION = "0.0.0-dev"
+
 DEFAULT_BASE_URL = "https://api.selectwin.io"
 
 
@@ -36,7 +45,7 @@ def _build_client(
 ) -> AuthenticatedClient:
     if not api_key:
         raise ValueError("Selectwin: an API key is required (sk_test_… or sk_live_…).")
-    return AuthenticatedClient(
+    client = AuthenticatedClient(
         base_url=base_url,
         token=api_key,
         auth_header_name="selectkey",  # Selectwin auth header…
@@ -47,6 +56,9 @@ def _build_client(
         raise_on_unexpected_status=False,  # errors are raised by the response hook
         httpx_args=build_httpx_args(is_async=is_async, max_retries=max_retries, verify_ssl=verify_ssl),
     )
+    # Built now (no I/O) so the dot-segment guard sits on the one httpx client every call goes through.
+    guard_dot_segments(client.get_async_httpx_client() if is_async else client.get_httpx_client())
+    return client
 
 
 class _BaseClient:

{selectwin-0.1.2 → selectwin-0.1.3}/src/selectwin/http.py

@@ -11,13 +11,14 @@ from __future__ import annotations
 
 import asyncio
 import random
+import re
 import time
 import uuid
 from typing import Any, Dict, Optional
 
 import httpx
 
-from .errors import APIConnectionError, error_from_status
+from .errors import APIConnectionError, ValidationError, error_from_status
 
 MUTATING = {"POST", "PUT", "PATCH", "DELETE"}
 # Retry only where a retry can plausibly help. NOT 409 (idempotency conflict).
@@ -138,6 +139,37 @@ async def _async_response_hook(response: httpx.Response) -> None:
         _raise_typed(response)
 
 
+_DOT_SEGMENT = re.compile(r"^(?:\.|%2e){1,2}$", re.IGNORECASE)
+
+
+def has_dot_segment(url: str) -> bool:
+    """Does this URL (or relative path) carry a ``.`` or ``..`` path segment? Checked on the raw string."""
+    path = re.sub(r"^[a-z][a-z0-9+.-]*://[^/?#]*", "", url, flags=re.IGNORECASE)
+    path = re.split(r"[?#]", path, maxsplit=1)[0]
+    return any(_DOT_SEGMENT.match(segment) for segment in path.split("/"))
+
+
+def guard_dot_segments(client: Any) -> Any:
+    """Refuse a ``.``/``..`` path segment before httpx builds the request (security sweep 31, S-1).
+
+    The generated core quotes each ID with ``quote(..., safe="")``, which leaves dots alone, and httpx RESOLVES dot
+    segments while building the request: ``variants.delete("prd_1", "..")`` left as DELETE /v1/products/prd_1 —
+    another operation, with the key. A hook or transport only ever sees the resolved URL, so the check wraps
+    ``build_request`` itself, where the generated core's relative path is still raw. No Selectwin ID is ``.``/``..``.
+    """
+    build = client.build_request
+
+    def build_request(method: str, url: Any, *args: Any, **kwargs: Any) -> httpx.Request:
+        if isinstance(url, str) and has_dot_segment(url):
+            raise ValidationError(
+                'Selectwin: a path parameter cannot be "." or ".." (the request would reach another endpoint).'
+            )
+        return build(method, url, *args, **kwargs)
+
+    client.build_request = build_request
+    return client
+
+
 def build_httpx_args(
     *,
     is_async: bool,

{selectwin-0.1.2 → selectwin-0.1.3}/src/selectwin/webhooks.py

@@ -108,14 +108,18 @@ def construct_event(
     if signature_v1:
         parsed = _parse_v1(signature_v1)
         t, v1 = parsed.get("t"), parsed.get("v1")
-        if t and v1:
-            expected_v1 = _hmac_hex(secret, f"{t}.".encode("utf-8") + body)
-            if not hmac.compare_digest(v1, expected_v1):
-                raise SignatureVerificationError("Webhook v1 signature verification failed")
-            if tolerance is not None:
-                clock = now() if callable(now) else time.time()
-                if abs(int(clock) - int(t)) > tolerance:
-                    raise SignatureVerificationError("Webhook timestamp is outside the tolerance window")
+        # A v1 header present but not parseable into both t and v1 is malformed/tampered — reject it,
+        # never silently fall back to having only checked the legacy sha256= scheme (that's what the
+        # Node SDK and the WooCommerce plugin already do).
+        if not t or not v1:
+            raise SignatureVerificationError("Webhook v1 signature header is malformed")
+        expected_v1 = _hmac_hex(secret, f"{t}.".encode("utf-8") + body)
+        if not hmac.compare_digest(v1, expected_v1):
+            raise SignatureVerificationError("Webhook v1 signature verification failed")
+        if tolerance is not None:
+            clock = now() if callable(now) else time.time()
+            if abs(int(clock) - int(t)) > tolerance:
+                raise SignatureVerificationError("Webhook timestamp is outside the tolerance window")
 
     try:
         parsed_body = json.loads(body.decode("utf-8"))