signinwithethereum 5.0.0__py3-none-any.whl

signinwithethereum-5.0.0.dist-info/METADATA

@@ -0,0 +1,122 @@
+Metadata-Version: 2.4
+Name: signinwithethereum
+Version: 5.0.0
+Summary: A Python implementation of Sign in with Ethereum (EIP-4361).
+Project-URL: Homepage, https://siwe.xyz
+Project-URL: Repository, https://github.com/signinwithethereum/siwe-py
+Project-URL: EIP, https://github.com/ethereum/EIPs/blob/master/EIPS/eip-4361.md
+Author-email: Jalil Wahdatehagh <jalil@ethfollow.xyz>, "Spruce Systems, Inc." <hello@spruceid.com>, Payton Garland <payton.r.g@gmail.com>
+License-Expression: MIT OR Apache-2.0
+License-File: LICENSE-APACHE
+License-File: LICENSE-MIT
+Keywords: EIP-4361,SIWE,Sign in with Ethereum
+Requires-Python: <4.0,>=3.10
+Requires-Dist: abnf<3,>=2.2
+Requires-Dist: eth-account<0.14,>=0.13.1
+Requires-Dist: eth-utils>=2.2.0
+Requires-Dist: pydantic-core<3,>=2
+Requires-Dist: pydantic<3,>=2.7
+Requires-Dist: typing-extensions<5,>=4
+Requires-Dist: web3<8,>=7.3.0
+Description-Content-Type: text/markdown
+
+# Sign in with Ethereum
+
+This package provides a Python implementation of EIP-4361: Sign in With Ethereum.
+
+## Installation
+
+SIWE can be easily installed in any Python project with pip:
+
+```bash
+pip install signinwithethereum
+```
+
+The distribution is published as `signinwithethereum`, but the import name remains `siwe`:
+
+```python
+from siwe import SiweMessage
+```
+
+## Usage
+
+SIWE provides a `SiweMessage` class which implements EIP-4361.
+
+### Parsing a SIWE Message
+
+Parsing is done by initializing a `SiweMessage` object with an EIP-4361 formatted string:
+
+```python
+from siwe import SiweMessage
+message = SiweMessage.from_message(message=eip_4361_string)
+```
+
+Or to initialize a `SiweMessage` as a `pydantic.BaseModel` right away:
+
+```python
+message = SiweMessage(domain="login.xyz", address="0x1234...", ...)
+```
+
+### Verifying and Authenticating a SIWE Message
+
+Verification and authentication is performed via EIP-191, using the `address` field of the `SiweMessage` as the expected signer. The validate method checks message structural integrity, signature address validity, and time-based validity attributes.
+
+```python
+try:
+    message.verify(signature="0x...")
+    # You can also specify other checks (e.g. the nonce or domain expected).
+except siwe.VerificationError:
+    # Invalid
+```
+
+### Serialization of a SIWE Message
+
+`SiweMessage` instances can also be serialized as their EIP-4361 string representations via the `prepare_message` method:
+
+```python
+print(message.prepare_message())
+```
+
+## Example
+
+Parsing and verifying a `SiweMessage` is easy:
+
+```python
+try:
+    message = SiweMessage.from_message(eip_4361_string)
+    message.verify(signature, nonce="abcdef", domain="example.com")
+except ValueError:
+    # Invalid message format
+    print("Authentication attempt rejected.")
+except siwe.ExpiredMessage:
+    print("Authentication attempt rejected.")
+except siwe.DomainMismatch:
+    print("Authentication attempt rejected.")
+except siwe.NonceMismatch:
+    print("Authentication attempt rejected.")
+except siwe.InvalidSignature:
+    print("Authentication attempt rejected.")
+
+# Message has been verified. Authentication complete. Continue with authorization/other.
+```
+
+## Testing
+
+```bash
+git submodule update --init
+uv sync
+uv run pytest
+```
+
+## See Also
+
+- [Sign in with Ethereum: TypeScript](https://github.com/signinwithethereum/siwe)
+- [SIWE website: siwe.xyz](https://siwe.xyz)
+- [EIP-4361 Specification Draft](https://eips.ethereum.org/EIPS/eip-4361)
+- [EIP-191 Specification](https://eips.ethereum.org/EIPS/eip-191)
+
+## Disclaimer
+
+Our Python library for Sign in with Ethereum has not yet undergone a formal
+security audit. We welcome continued feedback on the usability, architecture,
+and security of this implementation.

signinwithethereum-5.0.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+siwe/__init__.py,sha256=l7ZRqcHQXcWqbUJUHumm7SHOt3NqrcK9vAKMeIqB3UU,435
+siwe/defs.py,sha256=wH7W-OVGQSgcTjSNYbGWER-TAq09e6jWEKeBevcOsXM,1209
+siwe/parsed.py,sha256=VXUhklj5MCYZY1KKNakDYCXF3rFEWrbWUHZ2NTKW2mI,2626
+siwe/siwe.py,sha256=F09eukEHD8tiaQJKzntidXUYH15IIicynvj_hN4NF3Y,22419
+siwe/grammars/__init__.py,sha256=w3i2cTy4zVDr58VSGrxkuzVY1DzoEFt60ZQtJNSkIfE,24
+siwe/grammars/eip4361.py,sha256=XcRtoGidsPLFvI3Dks_mVci6VOndBPcEN293T7S__mU,1854
+siwe/grammars/rfc3339.py,sha256=EwK6EMOff5KGIDSD7-DiXe6KNTjR_iHNcWsZ7gViO6Q,949
+siwe/grammars/rfc5234.py,sha256=BJ9EOy5Wl4L2psxheJ0uOEG9LzQ3z4ZHPpU3R5YZ20g,510
+signinwithethereum-5.0.0.dist-info/METADATA,sha256=170eVT0yNckN-SCzi2ONyyElL4fVWLXA52jS64mamqU,3661
+signinwithethereum-5.0.0.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+signinwithethereum-5.0.0.dist-info/licenses/LICENSE-APACHE,sha256=Cn59LpMtrlU-8kjQ-NmfrCfZpWs5_MPJT-nlC5PwipQ,11385
+signinwithethereum-5.0.0.dist-info/licenses/LICENSE-MIT,sha256=nkBJgLCQh_LQSiUmlc7zoBsOW_gfzZxQilNPNytiWD0,1093
+signinwithethereum-5.0.0.dist-info/RECORD,,

signinwithethereum-5.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

signinwithethereum-5.0.0.dist-info/licenses/LICENSE-APACHE

@@ -0,0 +1,202 @@
+                                Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright (c) 2021 Spruce Systems, Inc.
+   Copyright (c) 2026 EthID.org
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

signinwithethereum-5.0.0.dist-info/licenses/LICENSE-MIT

@@ -0,0 +1,26 @@
+Copyright (c) 2021 Spruce Systems, Inc.
+Copyright (c) 2026 EthID.org
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

siwe/__init__.py

@@ -0,0 +1,21 @@
+"""Library for EIP-4361 Sign in with Ethereum."""
+
+# flake8: noqa: F401
+from .siwe import (
+    EIP6492_MAGIC_SUFFIX,
+    ChainIdMismatch,
+    DomainMismatch,
+    ExpiredMessage,
+    InvalidSignature,
+    ISO8601Datetime,
+    MalformedSession,
+    NonceMismatch,
+    NotYetValidMessage,
+    RequestIdMismatch,
+    SchemeMismatch,
+    SiweMessage,
+    UriMismatch,
+    VerificationError,
+    generate_nonce,
+    is_eip6492_signature,
+)

siwe/defs.py

@@ -0,0 +1,25 @@
+"""Regexes for the various fields."""
+
+SCHEME = "((?P<scheme>([a-zA-Z][a-zA-Z0-9\\+\\-\\.]*))://)?"
+DOMAIN = "(?P<domain>([^/?#]+)) wants you to sign in with your Ethereum account:\\n"
+ADDRESS = "(?P<address>0x[a-zA-Z0-9]{40})\\n\\n"
+STATEMENT = "((?P<statement>[^\\n]*)\\n)?\\n"
+URI = "(([^ :/?#]+):)?(//([^ /?#]*))?([^ ?#]*)(\\?([^ #]*))?(#(.*))?"
+URI_LINE = f"URI: (?P<uri>{URI}?)\\n"
+VERSION = "Version: (?P<version>1)\\n"
+CHAIN_ID = "Chain ID: (?P<chainId>[0-9]+)\\n"
+NONCE = "Nonce: (?P<nonce>[a-zA-Z0-9]{8,})\\n"
+DATETIME = (
+    "([0-9]+)-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])[Tt]"
+    "([01][0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9]|60)(.[0-9]+)?"
+    "(([Zz])|([+|-]([01][0-9]|2[0-3]):[0-5][0-9]))"
+)
+ISSUED_AT = f"Issued At: (?P<issuedAt>{DATETIME})"
+EXPIRATION_TIME = f"(\\nExpiration Time: (?P<expirationTime>{DATETIME}))?"
+NOT_BEFORE = f"(\\nNot Before: (?P<notBefore>{DATETIME}))?"
+REQUEST_ID = "(\\nRequest ID: (?P<requestId>[-._~!$&'()*+,;=:@%a-zA-Z0-9]*))?"
+RESOURCES = f"(\\nResources:(?P<resources>(\\n- {URI})*))?"
+REGEX_MESSAGE = (
+    f"^{SCHEME}{DOMAIN}{ADDRESS}{STATEMENT}{URI_LINE}{VERSION}{CHAIN_ID}{NONCE}"
+    f"{ISSUED_AT}{EXPIRATION_TIME}{NOT_BEFORE}{REQUEST_ID}{RESOURCES}$"
+)

siwe/grammars/__init__.py

@@ -0,0 +1 @@
+"""ABNF definitions."""

siwe/grammars/eip4361.py

@@ -0,0 +1,54 @@
+"""Top-level ABNF definition."""
+
+from typing import ClassVar, List
+
+from abnf.grammars import rfc3986
+from abnf.grammars.misc import load_grammar_rules
+from abnf.parser import Rule as _Rule
+
+from . import rfc3339, rfc5234
+
+
+@load_grammar_rules(
+    [
+        # RFC 3986
+        ("URI", rfc3986.Rule("URI")),
+        ("authority", rfc3986.Rule("authority")),
+        ("scheme", rfc3986.Rule("scheme")),
+        ("reserved", rfc3986.Rule("reserved")),
+        ("unreserved", rfc3986.Rule("unreserved")),
+        ("reserved", rfc3986.Rule("reserved")),
+        ("pchar", rfc3986.Rule("pchar")),
+        # RFC 5234
+        ("LF", rfc5234.Rule("LF")),
+        ("HEXDIG", rfc5234.Rule("HEXDIG")),
+        ("ALPHA", rfc5234.Rule("ALPHA")),
+        ("DIGIT", rfc5234.Rule("DIGIT")),
+        # RFC 3339
+        ("date-time", rfc3339.Rule("date-time")),
+    ]
+)
+class Rule(_Rule):
+    """Rules from EIP-4361."""
+
+    grammar: ClassVar[List] = [
+        'sign-in-with-ethereum = [ scheme "://" ] domain %s" wants you to sign in with '
+        'your Ethereum account:" LF address LF LF [ statement LF ] LF %s"URI: " uri LF '
+        '%s"Version: " version LF %s"Chain ID: " chain-id LF %s"Nonce: " nonce LF %s"'
+        'Issued At: " issued-at [ LF %s"Expiration Time: " expiration-time ] [ LF %s"'
+        'Not Before: " not-before ] [ LF %s"Request ID: " request-id ] [ LF %s"'
+        'Resources:" resources ]',
+        "domain = authority",
+        'address = "0x" 40HEXDIG',
+        'statement = *( reserved / unreserved / " " )',
+        "uri = URI",
+        'version = "1"',
+        "nonce = 8*( ALPHA / DIGIT )",
+        "issued-at = date-time",
+        "expiration-time = date-time",
+        "not-before = date-time",
+        "request-id = *pchar",
+        "chain-id = 1*DIGIT",
+        "resources = *( LF resource )",
+        'resource = "- " URI',
+    ]

siwe/grammars/rfc3339.py

@@ -0,0 +1,34 @@
+"""Date ABNF definition."""
+
+from typing import ClassVar, List
+
+from abnf.grammars.misc import load_grammar_rules
+from abnf.parser import Rule as _Rule
+
+from . import rfc5234
+
+
+@load_grammar_rules(
+    [
+        # RFC 5234
+        ("DIGIT", rfc5234.Rule("DIGIT")),
+    ]
+)
+class Rule(_Rule):
+    """Rules from RFC 3339."""
+
+    grammar: ClassVar[List] = [
+        "date-fullyear = 4DIGIT",
+        "date-month = 2DIGIT",
+        "date-mday = 2DIGIT",
+        "time-hour = 2DIGIT",
+        "time-minute = 2DIGIT",
+        "time-second = 2DIGIT",
+        'time-secfrac = "." 1*DIGIT',
+        'time-numoffset = ( "+" / "-" ) time-hour ":" time-minute',
+        'time-offset = "Z" / time-numoffset',
+        'partial-time = time-hour ":" time-minute ":" time-second [ time-secfrac ]',
+        'full-date = date-fullyear "-" date-month "-" date-mday',
+        "full-time = partial-time time-offset",
+        'date-time = full-date "T" full-time',
+    ]

siwe/grammars/rfc5234.py

@@ -0,0 +1,20 @@
+"""Primitive ABNF definition."""
+
+from typing import ClassVar, List
+
+from abnf.grammars.misc import load_grammar_rules
+from abnf.parser import Rule as _Rule
+
+
+@load_grammar_rules()
+class Rule(_Rule):
+    """Rules from RFC 5234."""
+
+    grammar: ClassVar[List] = [
+        "ALPHA          =  %x41-5A / %x61-7A   ; A-Z / a-z",
+        "LF             =  %x0A \
+        ; linefeed",
+        "DIGIT          =  %x30-39 \
+        ; 0-9",
+        'HEXDIG         =  DIGIT / "A" / "B" / "C" / "D" / "E" / "F"',
+    ]

siwe/parsed.py

@@ -0,0 +1,78 @@
+"""SIWE message parsers."""
+
+import re
+
+import abnf
+
+from .defs import REGEX_MESSAGE
+from .grammars import eip4361
+
+
+class RegExpParsedMessage:
+    """Regex parsed SIWE message."""
+
+    def __init__(self, message: str):
+        """Parse a SIWE message."""
+        expr = re.compile(REGEX_MESSAGE)
+        match = re.match(REGEX_MESSAGE, message)
+
+        if not match:
+            raise ValueError("Message did not match the regular expression.")
+
+        self.scheme = match.group(expr.groupindex["scheme"])
+        self.domain = match.group(expr.groupindex["domain"])
+        self.address = match.group(expr.groupindex["address"])
+        self.statement = match.group(expr.groupindex["statement"])
+        self.uri = match.group(expr.groupindex["uri"])
+        self.version = match.group(expr.groupindex["version"])
+        self.nonce = match.group(expr.groupindex["nonce"])
+        self.chain_id = match.group(expr.groupindex["chainId"])
+        self.issued_at = match.group(expr.groupindex["issuedAt"])
+        self.expiration_time = match.group(expr.groupindex["expirationTime"])
+        self.not_before = match.group(expr.groupindex["notBefore"])
+        self.request_id = match.group(expr.groupindex["requestId"])
+        self.resources = match.group(expr.groupindex["resources"])
+        if self.resources is None:
+            pass
+        elif self.resources:
+            self.resources = self.resources.split("\n- ")[1:]
+        else:
+            self.resources = []
+
+
+class ABNFParsedMessage:
+    """ABNF parsed SIWE message."""
+
+    def __init__(self, message: str):
+        """Parse a SIWE message."""
+        parser = eip4361.Rule("sign-in-with-ethereum")
+        try:
+            node = parser.parse_all(message)
+        except abnf.ParseError as e:
+            raise ValueError from e
+
+        for child in node.children:
+            if child.name in [
+                "scheme",
+                "domain",
+                "address",
+                "statement",
+                "uri",
+                "version",
+                "nonce",
+                "chain-id",
+                "issued-at",
+                "expiration-time",
+                "not-before",
+                "request-id",
+                "resources",
+            ]:
+                setattr(self, child.name.replace("-", "_"), child.value)
+
+            if child.name == "resources":
+                resources = []
+                for resource in child.children:
+                    resources.extend(
+                        [r.value for r in resource.children if r.name == "uri"]
+                    )
+                self.resources = resources

siwe/siwe.py

@@ -0,0 +1,545 @@
+"""Main module for SIWE messages construction and validation."""
+
+import secrets
+import string
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Iterable, List, Optional
+
+import abnf
+from abnf.grammars import rfc3986
+from eth_account.messages import SignableMessage, _hash_eip191_message, encode_defunct
+from pydantic import (
+    BaseModel,
+    BeforeValidator,
+    Field,
+    NonNegativeInt,
+    field_validator,
+    model_validator,
+)
+from pydantic_core import core_schema
+from typing_extensions import Annotated
+from web3 import HTTPProvider, Web3
+from web3.exceptions import BadFunctionCallOutput, ContractLogicError, Web3RPCError
+
+from .grammars import eip4361
+from .parsed import ABNFParsedMessage, RegExpParsedMessage
+
+EIP1271_CONTRACT_ABI = [
+    {
+        "inputs": [
+            {"internalType": "bytes32", "name": "_message", "type": "bytes32"},
+            {"internalType": "bytes", "name": "_signature", "type": "bytes"},
+        ],
+        "name": "isValidSignature",
+        "outputs": [{"internalType": "bytes4", "name": "", "type": "bytes4"}],
+        "stateMutability": "view",
+        "type": "function",
+    }
+]
+EIP1271_MAGICVALUE = "1626ba7e"
+
+# 32-byte magic suffix appended to EIP-6492 wrapped signatures
+EIP6492_MAGIC_SUFFIX = (
+    "6492649264926492649264926492649264926492649264926492649264926492"
+)
+
+# Deployment bytecode for the off-chain universal signature validator.
+# Used via eth_call (no actual deployment) to verify EOA, ERC-1271,
+# and EIP-6492 signatures in a single call.
+# Source: EIP-6492 reference implementation
+EIP6492_VALIDATOR_BYTECODE = "0x608060405234801561001057600080fd5b5060405161069438038061069483398101604081905261002f9161051e565b600061003c848484610048565b9050806000526001601ff35b60007f64926492649264926492649264926492649264926492649264926492649264926100748361040c565b036101e7576000606080848060200190518101906100929190610577565b60405192955090935091506000906001600160a01b038516906100b69085906105dd565b6000604051808303816000865af19150503d80600081146100f3576040519150601f19603f3d011682016040523d82523d6000602084013e6100f8565b606091505b50509050876001600160a01b03163b60000361016057806101605760405162461bcd60e51b815260206004820152601e60248201527f5369676e617475726556616c696461746f723a206465706c6f796d656e74000060448201526064015b60405180910390fd5b604051630b135d3f60e11b808252906001600160a01b038a1690631626ba7e90610190908b9087906004016105f9565b602060405180830381865afa1580156101ad573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906101d19190610633565b6001600160e01b03191614945050505050610405565b6001600160a01b0384163b1561027a57604051630b135d3f60e11b808252906001600160a01b03861690631626ba7e9061022790879087906004016105f9565b602060405180830381865afa158015610244573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906102689190610633565b6001600160e01b031916149050610405565b81516041146102df5760405162461bcd60e51b815260206004820152603a602482015260008051602061067483398151915260448201527f3a20696e76616c6964207369676e6174757265206c656e6774680000000000006064820152608401610157565b6102e7610425565b5060208201516040808401518451859392600091859190811061030c5761030c61065d565b016020015160f81c9050601b811480159061032b57508060ff16601c14155b1561038c5760405162461bcd60e51b815260206004820152603b602482015260008051602061067483398151915260448201527f3a20696e76616c6964207369676e617475726520762076616c756500000000006064820152608401610157565b60408051600081526020810180835289905260ff83169181019190915260608101849052608081018390526001600160a01b0389169060019060a0016020604051602081039080840390855afa1580156103ea573d6000803e3d6000fd5b505050602060405103516001600160a01b0316149450505050505b9392505050565b600060208251101561041d57600080fd5b508051015190565b60405180606001604052806003906020820280368337509192915050565b6001600160a01b038116811461045857600080fd5b50565b634e487b7160e01b600052604160045260246000fd5b60005b8381101561048c578181015183820152602001610474565b50506000910152565b600082601f8301126104a657600080fd5b81516001600160401b038111156104bf576104bf61045b565b604051601f8201601f19908116603f011681016001600160401b03811182821017156104ed576104ed61045b565b60405281815283820160200185101561050557600080fd5b610516826020830160208701610471565b949350505050565b60008060006060848603121561053357600080fd5b835161053e81610443565b6020850151604086015191945092506001600160401b0381111561056157600080fd5b61056d86828701610495565b9150509250925092565b60008060006060848603121561058c57600080fd5b835161059781610443565b60208501519093506001600160401b038111156105b357600080fd5b6105bf86828701610495565b604086015190935090506001600160401b0381111561056157600080fd5b600082516105ef818460208701610471565b9190910192915050565b828152604060208201526000825180604084015261061e816060850160208701610471565b601f01601f1916919091016060019392505050565b60006020828403121561064557600080fd5b81516001600160e01b03198116811461040557600080fd5b634e487b7160e01b600052603260045260246000fdfe5369676e617475726556616c696461746f72237265636f7665725369676e6572"  # noqa: E501
+
+
+def is_eip6492_signature(signature: str) -> bool:
+    """Check if a hex-encoded signature ends with the EIP-6492 magic suffix."""
+    if not isinstance(signature, str):
+        return False
+    sig = signature[2:] if signature.startswith("0x") else signature
+    return len(sig) >= 64 and sig.endswith(EIP6492_MAGIC_SUFFIX)
+
+
+_ALPHANUMERICS = string.ascii_letters + string.digits
+
+
+def generate_nonce() -> str:
+    """Generate a cryptographically sound nonce."""
+    return "".join(secrets.choice(_ALPHANUMERICS) for _ in range(17))
+
+
+class VerificationError(Exception):
+    """Top-level validation and verification exception."""
+
+    pass
+
+
+class InvalidSignature(VerificationError):
+    """The signature does not match the message."""
+
+    pass
+
+
+class ExpiredMessage(VerificationError):
+    """The message is not valid any more."""
+
+    pass
+
+
+class NotYetValidMessage(VerificationError):
+    """The message is not yet valid."""
+
+    pass
+
+
+class SchemeMismatch(VerificationError):
+    """The message does not contain the expected scheme."""
+
+    pass
+
+
+class DomainMismatch(VerificationError):
+    """The message does not contain the expected domain."""
+
+    pass
+
+
+class NonceMismatch(VerificationError):
+    """The message does not contain the expected nonce."""
+
+    pass
+
+
+class UriMismatch(VerificationError):
+    """The message does not contain the expected URI."""
+
+    pass
+
+
+class ChainIdMismatch(VerificationError):
+    """The message does not contain the expected chain ID."""
+
+    pass
+
+
+class RequestIdMismatch(VerificationError):
+    """The message does not contain the expected request ID."""
+
+    pass
+
+
+class MalformedSession(VerificationError):
+    """A message could not be constructed as it is missing certain fields."""
+
+    def __init__(self, missing_fields: Iterable[str]):
+        """Construct the exception with the missing fields."""
+        self.missing_fields = missing_fields
+
+
+class VersionEnum(str, Enum):
+    """EIP-4361 versions."""
+
+    one = "1"
+
+    def __str__(self):
+        """EIP-4361 representation of the enum field."""
+        return self.value
+
+
+def _validate_rfc3986_uri(value: str) -> str:
+    """Validate a URI string per RFC 3986."""
+    try:
+        rfc3986.Rule("URI").parse_all(value)
+    except abnf.ParseError as err:
+        raise ValueError(f"Invalid URI: {value}") from err
+    return value
+
+
+def _validate_eip4361_rule(rule_name: str, value: str) -> str:
+    """Validate a string against an EIP-4361 ABNF rule."""
+    try:
+        eip4361.Rule(rule_name).parse_all(value)
+    except abnf.ParseError as err:
+        raise ValueError(f"Invalid {rule_name}: {value}") from err
+    return value
+
+
+AnyUrlStr = Annotated[str, BeforeValidator(_validate_rfc3986_uri)]
+
+
+def datetime_from_iso8601_string(val: str) -> datetime:
+    """Convert an ISO-8601 Datetime string into a valid datetime object."""
+    _validate_eip4361_rule("issued-at", val)
+    return datetime.fromisoformat(val.replace(".000Z", "Z").replace("Z", "+00:00"))
+
+
+# NOTE: Do not override the original string, but ensure we do timestamp validation
+class ISO8601Datetime(str):
+    """A special field class used to denote ISO-8601 Datetime strings."""
+
+    def __init__(self, val: str):
+        """Validate ISO-8601 string."""
+        # NOTE: `self` is already this class, we are just running our validation here
+        datetime_from_iso8601_string(val)
+
+    @classmethod
+    def __get_pydantic_core_schema__(cls, source, handler):
+        """Create valid pydantic schema object for this type."""
+        return core_schema.no_info_after_validator_function(
+            cls, core_schema.str_schema()
+        )
+
+    @classmethod
+    def from_datetime(
+        cls, dt: datetime, timespec: str = "milliseconds"
+    ) -> "ISO8601Datetime":
+        """Create an ISO-8601 formatted string from a datetime object."""
+        # NOTE: Only a useful classmethod for creating these objects
+        return ISO8601Datetime(
+            dt.astimezone(tz=timezone.utc)
+            .isoformat(timespec=timespec)
+            .replace("+00:00", "Z")
+        )
+
+    @property
+    def _datetime(self) -> datetime:
+        return datetime_from_iso8601_string(self)
+
+
+def utc_now() -> datetime:
+    """Get the current datetime as UTC timezone."""
+    return datetime.now(tz=timezone.utc)
+
+
+class SiweMessage(BaseModel):
+    """A Sign-in with Ethereum (EIP-4361) message."""
+
+    scheme: Optional[str] = Field(None, pattern=r"^[a-zA-Z][a-zA-Z0-9+\-.]*$")
+    """RFC 3986 URI scheme for the authority that is requesting the signing."""
+    domain: str = Field(pattern=r"^[^\s/?#]+$")
+    """RFC 4501 dns authority that is requesting the signing."""
+    address: str
+    """Ethereum address performing the signing conformant to capitalization encoded
+    checksum specified in EIP-55 where applicable.
+    """
+    uri: AnyUrlStr
+    """RFC 3986 URI referring to the resource that is the subject of the signing."""
+    version: VersionEnum
+    """Current version of the message."""
+    chain_id: NonNegativeInt
+    """EIP-155 Chain ID to which the session is bound, and the network where Contract
+    Accounts must be resolved.
+    """
+    issued_at: ISO8601Datetime
+    """ISO 8601 datetime string of the current time."""
+    nonce: str = Field(min_length=8, pattern="^[a-zA-Z0-9]+$")
+    """Randomized token used to prevent replay attacks, at least 8 alphanumeric
+    characters. Use generate_nonce() to generate a secure nonce and store it for
+    verification later.
+    """
+    statement: Optional[str] = None
+    """Human-readable ASCII assertion that the user will sign, and it must not contain
+    `\n`.
+    """
+    expiration_time: Optional[ISO8601Datetime] = None
+    """ISO 8601 datetime string that, if present, indicates when the signed
+    authentication message is no longer valid.
+    """
+    not_before: Optional[ISO8601Datetime] = None
+    """ISO 8601 datetime string that, if present, indicates when the signed
+    authentication message will become valid.
+    """
+    request_id: Optional[str] = None
+    """System-specific identifier that may be used to uniquely refer to the sign-in
+    request.
+    """
+    resources: Optional[List[AnyUrlStr]] = None
+    """List of information or references to information the user wishes to have resolved
+    as part of authentication by the relying party. They are expressed as RFC 3986 URIs
+    separated by `\n- `.
+    """
+    warnings: List[str] = Field(default_factory=list, exclude=True)
+    """Non-fatal warnings from validation (e.g. unchecksummed address)."""
+
+    @field_validator("address")
+    @classmethod
+    def validate_address(cls, v: str) -> str:
+        """Validate the address is well-formed hex with a correct EIP-55 checksum.
+
+        All-lowercase and all-uppercase addresses are accepted (they are valid
+        but unchecksummed — a warning is added by the model validator).  Mixed-
+        case addresses must pass the EIP-55 checksum or they are rejected.
+        """
+        if len(v) != 42 or not v.startswith("0x"):
+            raise ValueError(f"Invalid Ethereum address format: {v}")
+        hex_part = v[2:]
+        if not all(c in "0123456789abcdefABCDEF" for c in hex_part):
+            raise ValueError(f"Invalid Ethereum address: non-hex characters: {v}")
+        if (
+            hex_part != hex_part.lower()
+            and hex_part != hex_part.upper()
+            and not Web3.is_checksum_address(v)
+        ):
+            raise ValueError("invalid EIP-55 address")
+        return v
+
+    @field_validator("statement")
+    @classmethod
+    def validate_statement(cls, v: Optional[str]) -> Optional[str]:
+        """Validate statement using the EIP-4361 grammar."""
+        if v is not None:
+            _validate_eip4361_rule("statement", v)
+        return v
+
+    @field_validator("request_id")
+    @classmethod
+    def validate_request_id(cls, v: Optional[str]) -> Optional[str]:
+        """Validate request ID using the EIP-4361 grammar."""
+        if v is not None:
+            _validate_eip4361_rule("request-id", v)
+        return v
+
+    @model_validator(mode="after")
+    def _check_address_warnings(self) -> "SiweMessage":
+        """Add a warning when the address is not EIP-55 checksummed."""
+        hex_part = self.address[2:]
+        if (
+            hex_part == hex_part.lower() or hex_part == hex_part.upper()
+        ) and not Web3.is_checksum_address(self.address):
+            self.warnings.append(
+                f"Address is not EIP-55 checksummed: {self.address}"
+            )
+        return self
+
+    @classmethod
+    def from_message(cls, message: str, abnf: bool = True) -> "SiweMessage":
+        """Parse a message in its EIP-4361 format."""
+        if abnf:
+            parsed_message = ABNFParsedMessage(message=message)
+        else:
+            parsed_message = RegExpParsedMessage(message=message)
+
+        # TODO There is some redundancy in the checks when deserialising a message.
+        return cls(**parsed_message.__dict__)
+
+    def prepare_message(self) -> str:
+        """Serialize to the EIP-4361 format for signing.
+
+        It can then be passed to an EIP-191 signing function.
+
+        :return: EIP-4361 formatted message, ready for EIP-191 signing.
+        """
+        header = f"{self.domain} wants you to sign in with your Ethereum account:"
+        if self.scheme:
+            header = f"{self.scheme}://{header}"
+
+        uri_field = f"URI: {self.uri}"
+
+        prefix = "\n".join([header, self.address])
+
+        version_field = f"Version: {self.version}"
+
+        chain_field = f"Chain ID: {self.chain_id}"
+
+        nonce_field = f"Nonce: {self.nonce}"
+
+        suffix_array = [uri_field, version_field, chain_field, nonce_field]
+
+        issued_at_field = f"Issued At: {self.issued_at}"
+        suffix_array.append(issued_at_field)
+
+        if self.expiration_time:
+            expiration_time_field = f"Expiration Time: {self.expiration_time}"
+            suffix_array.append(expiration_time_field)
+
+        if self.not_before:
+            not_before_field = f"Not Before: {self.not_before}"
+            suffix_array.append(not_before_field)
+
+        if self.request_id is not None:
+            request_id_field = f"Request ID: {self.request_id}"
+            suffix_array.append(request_id_field)
+
+        if self.resources is not None:
+            resources_field = "\n".join(
+                ["Resources:"] + [f"- {resource}" for resource in self.resources]
+            )
+            suffix_array.append(resources_field)
+
+        suffix = "\n".join(suffix_array)
+
+        if self.statement is not None:
+            prefix = "\n\n".join([prefix, self.statement])
+        else:
+            prefix += "\n"
+
+        return "\n\n".join([prefix, suffix])
+
+    def verify(
+        self,
+        signature: Optional[str],
+        *,
+        scheme: Optional[str] = None,
+        domain: Optional[str] = None,
+        nonce: Optional[str] = None,
+        uri: Optional[str] = None,
+        chain_id: Optional[int] = None,
+        request_id: Optional[str] = None,
+        timestamp: Optional[datetime] = None,
+        provider: Optional[HTTPProvider] = None,
+        strict: bool = False,
+    ) -> None:
+        """Verify the validity of the message and its signature.
+
+        :param signature: Signature to check against the current message.
+        :param scheme: Scheme expected to be in the current message.
+        :param domain: Domain expected to be in the current message.
+        :param nonce: Nonce expected to be in the current message.
+        :param uri: URI expected to be in the current message.
+        :param chain_id: Chain ID expected to be in the current message.
+        :param request_id: Request ID expected to be in the current message.
+        :param timestamp: Timestamp used to verify the expiry date and other dates
+        fields. Uses the current time by default.
+        :param provider: A Web3 provider able to perform a contract check. This is
+        required if support for Smart Contract Wallets that implement EIP-1271 or
+        EIP-6492 is needed.
+        :param strict: When True, requires uri and chain_id parameters to be provided.
+        :return: None if the message is valid and raises an exception otherwise
+        """
+        if strict:
+            if uri is None:
+                raise VerificationError("Strict mode requires uri parameter")
+            if chain_id is None:
+                raise VerificationError("Strict mode requires chain_id parameter")
+            if domain is None:
+                raise VerificationError("Strict mode requires domain parameter")
+
+        message = encode_defunct(text=self.prepare_message())
+        w3 = Web3(provider=provider)
+
+        if scheme is not None and self.scheme != scheme:
+            raise SchemeMismatch()
+        if domain is not None and self.domain != domain:
+            raise DomainMismatch()
+        if nonce is not None and self.nonce != nonce:
+            raise NonceMismatch()
+        if uri is not None and str(self.uri) != uri:
+            raise UriMismatch()
+        if chain_id is not None and self.chain_id != chain_id:
+            raise ChainIdMismatch()
+        if request_id is not None and self.request_id != request_id:
+            raise RequestIdMismatch()
+
+        if timestamp is None:
+            verification_time = utc_now()
+        else:
+            verification_time = timestamp
+            if verification_time.tzinfo is None:
+                verification_time = verification_time.replace(tzinfo=timezone.utc)
+        if (
+            self.expiration_time is not None
+            and verification_time >= self.expiration_time._datetime
+        ):
+            raise ExpiredMessage()
+        if (
+            self.not_before is not None
+            and verification_time < self.not_before._datetime
+        ):
+            raise NotYetValidMessage()
+
+        try:
+            address = w3.eth.account.recover_message(message, signature=signature)
+        except Exception:
+            # Any exception from recover_message (wrong length, bad hex, bad
+            # v/r/s, wrong type, None, etc.) means the signature cannot be
+            # validated as an EOA signature — fall through to EIP-1271/6492.
+            address = None
+
+        if (address is None or address.lower() != self.address.lower()) and (
+            provider is None
+            or not check_contract_wallet_signature(
+                address=self.address,
+                message=message,
+                signature=signature,
+                chain_id=self.chain_id,
+                w3=w3,
+            )
+        ):
+            raise InvalidSignature()
+
+
+def check_contract_wallet_signature(
+    address: str,
+    message: SignableMessage,
+    signature: str,
+    chain_id: int,
+    w3: Web3,
+) -> bool:
+    """Verify a signature via EIP-1271 or EIP-6492.
+
+    :param address: The address of the contract
+    :param message: The EIP-4361 formatted message
+    :param signature: The EIP-1271 or EIP-6492 signature
+    :param chain_id: The chain ID from the SIWE message
+    :param w3: A Web3 provider able to perform a contract check.
+    :return: True if the signature is valid per EIP-1271/EIP-6492.
+    """
+    try:
+        provider_chain_id = w3.eth.chain_id
+    except Web3RPCError:
+        raise InvalidSignature(
+            "Unable to verify contract wallet signature: RPC error"
+        ) from None
+    if provider_chain_id != chain_id:
+        raise ChainIdMismatch(
+            f"Provider chain ID {provider_chain_id} does not match "
+            f"message chain ID {chain_id}"
+        )
+
+    hash_ = _hash_eip191_message(message)
+
+    if is_eip6492_signature(signature):
+        return _check_eip6492_signature(address, hash_, signature, w3)
+
+    return _check_eip1271_signature(address, hash_, signature, w3)
+
+
+def _check_eip6492_signature(
+    address: str, hash_: bytes, signature: str, w3: Web3
+) -> bool:
+    """Verify an EIP-6492 signature using the universal validator bytecode."""
+    try:
+        raw = signature[2:] if signature.startswith("0x") else signature
+        sig_bytes = bytes.fromhex(raw)
+    except (AttributeError, TypeError, ValueError):
+        return False
+    encoded = w3.codec.encode(
+        ["address", "bytes32", "bytes"],
+        [Web3.to_checksum_address(address), hash_, sig_bytes],
+    )
+    data = bytes.fromhex(EIP6492_VALIDATOR_BYTECODE[2:]) + encoded
+    try:
+        result = w3.eth.call({"data": "0x" + data.hex()})
+        return result[-1:] == b"\x01"
+    except (BadFunctionCallOutput, ContractLogicError, Web3RPCError):
+        return False
+
+
+def _check_eip1271_signature(
+    address: str, hash_: bytes, signature: str, w3: Web3
+) -> bool:
+    """Verify an EIP-1271 signature via isValidSignature contract call."""
+    try:
+        # For message hashes stored on-chain for Safe wallets, the signatures
+        # are always "0x" and should be passed in as-is.
+        raw = signature[2:] if signature.startswith("0x") else signature
+        sig_bytes = signature if signature == "0x" else bytes.fromhex(raw)
+    except (AttributeError, TypeError, ValueError):
+        return False
+    contract = w3.eth.contract(
+        address=Web3.to_checksum_address(address), abi=EIP1271_CONTRACT_ABI
+    )
+    try:
+        response = contract.caller.isValidSignature(hash_, sig_bytes)
+        return response.hex() == EIP1271_MAGICVALUE
+    except (BadFunctionCallOutput, ContractLogicError, Web3RPCError):
+        return False