signinwithethereum 5.0.0__tar.gz → 5.0.2__tar.gz

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: signinwithethereum
-Version: 5.0.0
+Version: 5.0.2
 Summary: A Python implementation of Sign in with Ethereum (EIP-4361).
 Project-URL: Homepage, https://siwe.xyz
 Project-URL: Repository, https://github.com/signinwithethereum/siwe-py
@@ -22,7 +22,7 @@ Description-Content-Type: text/markdown
 
 # Sign in with Ethereum
 
-This package provides a Python implementation of EIP-4361: Sign in With Ethereum.
+This package provides a Python implementation of EIP-4361: Sign in with Ethereum.
 
 ## Installation
 
@@ -32,7 +32,7 @@ SIWE can be easily installed in any Python project with pip:
 pip install signinwithethereum
 ```
 
-The distribution is published as `signinwithethereum`, but the import name remains `siwe`:
+The distribution is published as `signinwithethereum`; the import name is `siwe`:
 
 ```python
 from siwe import SiweMessage
@@ -59,16 +59,60 @@ message = SiweMessage(domain="login.xyz", address="0x1234...", ...)
 
 ### Verifying and Authenticating a SIWE Message
 
-Verification and authentication is performed via EIP-191, using the `address` field of the `SiweMessage` as the expected signer. The validate method checks message structural integrity, signature address validity, and time-based validity attributes.
+Verification and authentication is performed via EIP-191, using the `address` field of the `SiweMessage` as the expected signer. The `verify` method checks message structural integrity, signature address validity, and time-based validity attributes.
+
+Replay protection relies on a **single-use nonce** that your server issues, stores alongside the pending session, passes to `verify`, and consumes on success. Always pass the `nonce` you issued — a signature verified without a nonce check can be replayed.
 
 ```python
 try:
-    message.verify(signature="0x...")
-    # You can also specify other checks (e.g. the nonce or domain expected).
+    message.verify(
+        signature="0x...",
+        domain="example.com",
+        nonce=expected_nonce,  # the nonce your server issued for this session
+        uri="https://example.com/login",
+        chain_id=1,
+        strict=True,
+    )
+    # Consume the nonce now so it cannot be replayed.
 except siwe.VerificationError:
     # Invalid
 ```
 
+Passing `strict=True` enforces that `domain`, `uri`, `chain_id`, and `nonce` are all supplied. Prefer it for authentication flows.
+
+### Smart-contract wallet signatures (EIP-1271 / EIP-6492)
+
+For signatures produced by contract wallets (Safe, Argent, etc.) rather than
+externally owned accounts, pass a `web3` provider to `verify`. The
+authentication arguments (`strict`, `domain`, `nonce`, `uri`, `chain_id`) still
+apply — the provider only changes how the signature itself is verified:
+
+```python
+from web3 import HTTPProvider
+
+message.verify(
+    signature="0x...",
+    domain="example.com",
+    nonce=expected_nonce,
+    uri="https://example.com/login",
+    chain_id=1,
+    strict=True,
+    provider=HTTPProvider("https://mainnet.infura.io/v3/..."),
+)
+```
+
+EOA recovery is tried first; if it fails, the signature is checked on-chain via
+`isValidSignature(bytes32,bytes)` per EIP-1271. Signatures carrying the EIP-6492
+magic suffix are handed to the universal off-chain validator bytecode via
+`eth_call`, which covers counterfactual (undeployed) wallets as well as
+already-deployed ones. The provider's chain id is checked against the message's
+`chain_id` before any on-chain call.
+
+Note: this is verification only. EIP-6492 allows a verifier to optionally
+submit the factory transaction after a successful check to finalize on-chain
+deployment ("side-effectful" verification). This library does not do that — if
+you need the wallet actually deployed, submit the factory call yourself.
+
 ### Serialization of a SIWE Message
 
 `SiweMessage` instances can also be serialized as their EIP-4361 string representations via the `prepare_message` method:
@@ -84,7 +128,14 @@ Parsing and verifying a `SiweMessage` is easy:
 ```python
 try:
     message = SiweMessage.from_message(eip_4361_string)
-    message.verify(signature, nonce="abcdef", domain="example.com")
+    message.verify(
+        signature,
+        domain="example.com",
+        nonce=expected_nonce,
+        uri="https://example.com/login",
+        chain_id=1,
+        strict=True,
+    )
 except ValueError:
     # Invalid message format
     print("Authentication attempt rejected.")
@@ -97,7 +148,7 @@ except siwe.NonceMismatch:
 except siwe.InvalidSignature:
     print("Authentication attempt rejected.")
 
-# Message has been verified. Authentication complete. Continue with authorization/other.
+# Message has been verified. Invalidate the stored nonce, then continue with authorization/other.
 ```
 
 ## Testing

signinwithethereum-5.0.2/README.md

@@ -0,0 +1,151 @@
+# Sign in with Ethereum
+
+This package provides a Python implementation of EIP-4361: Sign in with Ethereum.
+
+## Installation
+
+SIWE can be easily installed in any Python project with pip:
+
+```bash
+pip install signinwithethereum
+```
+
+The distribution is published as `signinwithethereum`; the import name is `siwe`:
+
+```python
+from siwe import SiweMessage
+```
+
+## Usage
+
+SIWE provides a `SiweMessage` class which implements EIP-4361.
+
+### Parsing a SIWE Message
+
+Parsing is done by initializing a `SiweMessage` object with an EIP-4361 formatted string:
+
+```python
+from siwe import SiweMessage
+message = SiweMessage.from_message(message=eip_4361_string)
+```
+
+Or to initialize a `SiweMessage` as a `pydantic.BaseModel` right away:
+
+```python
+message = SiweMessage(domain="login.xyz", address="0x1234...", ...)
+```
+
+### Verifying and Authenticating a SIWE Message
+
+Verification and authentication is performed via EIP-191, using the `address` field of the `SiweMessage` as the expected signer. The `verify` method checks message structural integrity, signature address validity, and time-based validity attributes.
+
+Replay protection relies on a **single-use nonce** that your server issues, stores alongside the pending session, passes to `verify`, and consumes on success. Always pass the `nonce` you issued — a signature verified without a nonce check can be replayed.
+
+```python
+try:
+    message.verify(
+        signature="0x...",
+        domain="example.com",
+        nonce=expected_nonce,  # the nonce your server issued for this session
+        uri="https://example.com/login",
+        chain_id=1,
+        strict=True,
+    )
+    # Consume the nonce now so it cannot be replayed.
+except siwe.VerificationError:
+    # Invalid
+```
+
+Passing `strict=True` enforces that `domain`, `uri`, `chain_id`, and `nonce` are all supplied. Prefer it for authentication flows.
+
+### Smart-contract wallet signatures (EIP-1271 / EIP-6492)
+
+For signatures produced by contract wallets (Safe, Argent, etc.) rather than
+externally owned accounts, pass a `web3` provider to `verify`. The
+authentication arguments (`strict`, `domain`, `nonce`, `uri`, `chain_id`) still
+apply — the provider only changes how the signature itself is verified:
+
+```python
+from web3 import HTTPProvider
+
+message.verify(
+    signature="0x...",
+    domain="example.com",
+    nonce=expected_nonce,
+    uri="https://example.com/login",
+    chain_id=1,
+    strict=True,
+    provider=HTTPProvider("https://mainnet.infura.io/v3/..."),
+)
+```
+
+EOA recovery is tried first; if it fails, the signature is checked on-chain via
+`isValidSignature(bytes32,bytes)` per EIP-1271. Signatures carrying the EIP-6492
+magic suffix are handed to the universal off-chain validator bytecode via
+`eth_call`, which covers counterfactual (undeployed) wallets as well as
+already-deployed ones. The provider's chain id is checked against the message's
+`chain_id` before any on-chain call.
+
+Note: this is verification only. EIP-6492 allows a verifier to optionally
+submit the factory transaction after a successful check to finalize on-chain
+deployment ("side-effectful" verification). This library does not do that — if
+you need the wallet actually deployed, submit the factory call yourself.
+
+### Serialization of a SIWE Message
+
+`SiweMessage` instances can also be serialized as their EIP-4361 string representations via the `prepare_message` method:
+
+```python
+print(message.prepare_message())
+```
+
+## Example
+
+Parsing and verifying a `SiweMessage` is easy:
+
+```python
+try:
+    message = SiweMessage.from_message(eip_4361_string)
+    message.verify(
+        signature,
+        domain="example.com",
+        nonce=expected_nonce,
+        uri="https://example.com/login",
+        chain_id=1,
+        strict=True,
+    )
+except ValueError:
+    # Invalid message format
+    print("Authentication attempt rejected.")
+except siwe.ExpiredMessage:
+    print("Authentication attempt rejected.")
+except siwe.DomainMismatch:
+    print("Authentication attempt rejected.")
+except siwe.NonceMismatch:
+    print("Authentication attempt rejected.")
+except siwe.InvalidSignature:
+    print("Authentication attempt rejected.")
+
+# Message has been verified. Invalidate the stored nonce, then continue with authorization/other.
+```
+
+## Testing
+
+```bash
+git submodule update --init
+uv sync
+uv run pytest
+```
+
+## See Also
+
+- [Sign in with Ethereum: TypeScript](https://github.com/signinwithethereum/siwe)
+- [SIWE website: siwe.xyz](https://siwe.xyz)
+- [EIP-4361 Specification Draft](https://eips.ethereum.org/EIPS/eip-4361)
+- [EIP-191 Specification](https://eips.ethereum.org/EIPS/eip-191)
+
+## Disclaimer
+
+Our Python library for Sign in with Ethereum has not yet undergone a formal
+security audit. We welcome continued feedback on the usability, architecture,
+and security of this implementation.

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "signinwithethereum"
-version = "5.0.0"
+version = "5.0.2"
 description = "A Python implementation of Sign in with Ethereum (EIP-4361)."
 license = "MIT OR Apache-2.0"
 authors = [

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/siwe/grammars/eip4361.py

@@ -6,7 +6,7 @@ from abnf.grammars import rfc3986
 from abnf.grammars.misc import load_grammar_rules
 from abnf.parser import Rule as _Rule
 
-from . import rfc3339, rfc5234
+from . import rfc3339
 
 
 @load_grammar_rules(
@@ -17,13 +17,7 @@ from . import rfc3339, rfc5234
         ("scheme", rfc3986.Rule("scheme")),
         ("reserved", rfc3986.Rule("reserved")),
         ("unreserved", rfc3986.Rule("unreserved")),
-        ("reserved", rfc3986.Rule("reserved")),
         ("pchar", rfc3986.Rule("pchar")),
-        # RFC 5234
-        ("LF", rfc5234.Rule("LF")),
-        ("HEXDIG", rfc5234.Rule("HEXDIG")),
-        ("ALPHA", rfc5234.Rule("ALPHA")),
-        ("DIGIT", rfc5234.Rule("DIGIT")),
         # RFC 3339
         ("date-time", rfc3339.Rule("date-time")),
     ]
@@ -41,7 +35,6 @@ class Rule(_Rule):
         "domain = authority",
         'address = "0x" 40HEXDIG',
         'statement = *( reserved / unreserved / " " )',
-        "uri = URI",
         'version = "1"',
         "nonce = 8*( ALPHA / DIGIT )",
         "issued-at = date-time",

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/siwe/grammars/rfc3339.py

@@ -5,15 +5,8 @@ from typing import ClassVar, List
 from abnf.grammars.misc import load_grammar_rules
 from abnf.parser import Rule as _Rule
 
-from . import rfc5234
 
-
-@load_grammar_rules(
-    [
-        # RFC 5234
-        ("DIGIT", rfc5234.Rule("DIGIT")),
-    ]
-)
+@load_grammar_rules()
 class Rule(_Rule):
     """Rules from RFC 3339."""
 

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/siwe/siwe.py

@@ -402,16 +402,21 @@ class SiweMessage(BaseModel):
         :param provider: A Web3 provider able to perform a contract check. This is
         required if support for Smart Contract Wallets that implement EIP-1271 or
         EIP-6492 is needed.
-        :param strict: When True, requires uri and chain_id parameters to be provided.
+        :param strict: When True, requires domain, uri, chain_id, and nonce
+        parameters to be provided. The nonce must be a single-use value issued by
+        the relying party and consumed on successful verification — reusing the
+        same nonce across sessions defeats replay protection.
         :return: None if the message is valid and raises an exception otherwise
         """
         if strict:
+            if domain is None:
+                raise VerificationError("Strict mode requires domain parameter")
             if uri is None:
                 raise VerificationError("Strict mode requires uri parameter")
             if chain_id is None:
                 raise VerificationError("Strict mode requires chain_id parameter")
-            if domain is None:
-                raise VerificationError("Strict mode requires domain parameter")
+            if nonce is None:
+                raise VerificationError("Strict mode requires nonce parameter")
 
         message = encode_defunct(text=self.prepare_message())
         w3 = Web3(provider=provider)

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/tests/test_siwe.py

@@ -1,5 +1,7 @@
 import json
 import os
+import subprocess
+import sys
 
 import abnf
 import pytest
@@ -367,7 +369,46 @@ class TestFieldValidation:
     def test_strict_mode_requires_domain(self):
         m = SiweMessage(**self.base)
         with pytest.raises(VerificationError):
-            m.verify("0x" + "00" * 65, uri="https://ex.com", chain_id=1, strict=True)
+            m.verify(
+                "0x" + "00" * 65,
+                uri="https://ex.com",
+                chain_id=1,
+                nonce="12345678",
+                strict=True,
+            )
+
+    def test_strict_mode_requires_uri(self):
+        m = SiweMessage(**self.base)
+        with pytest.raises(VerificationError):
+            m.verify(
+                "0x" + "00" * 65,
+                domain="ex.com",
+                chain_id=1,
+                nonce="12345678",
+                strict=True,
+            )
+
+    def test_strict_mode_requires_chain_id(self):
+        m = SiweMessage(**self.base)
+        with pytest.raises(VerificationError):
+            m.verify(
+                "0x" + "00" * 65,
+                domain="ex.com",
+                uri="https://ex.com",
+                nonce="12345678",
+                strict=True,
+            )
+
+    def test_strict_mode_requires_nonce(self):
+        m = SiweMessage(**self.base)
+        with pytest.raises(VerificationError):
+            m.verify(
+                "0x" + "00" * 65,
+                domain="ex.com",
+                uri="https://ex.com",
+                chain_id=1,
+                strict=True,
+            )
 
 
 def _get_abnf_rule(rule_name):
@@ -502,3 +543,16 @@ class TestValidSpecification:
         siwe_message = SiweMessage.from_message(message=test["msg"], abnf=abnf_mode)
         for key, value in test["items"].items():
             assert getattr(siwe_message, key) == value
+
+
+def test_grammar_loads_without_grammar_warnings():
+    # Grammars load once per process at import, so check in a fresh interpreter.
+    code = (
+        "import warnings, abnf\n"
+        "warnings.simplefilter('error', getattr(abnf, 'GrammarWarning', UserWarning))\n"
+        "import siwe.grammars.eip4361\n"
+    )
+    result = subprocess.run(
+        [sys.executable, "-c", code], capture_output=True, text=True
+    )
+    assert result.returncode == 0, result.stderr

{signinwithethereum-5.0.0 → signinwithethereum-5.0.2}/uv.lock

@@ -4,11 +4,11 @@ requires-python = ">=3.10, <4.0"
 
 [[package]]
 name = "abnf"
-version = "2.4.1"
+version = "2.9.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e2/ad/65071d3abe27e29347e8e4cd9ba3f8c5df096ac486d4afb7ab17b29f36ad/abnf-2.4.1.tar.gz", hash = "sha256:cde0674eabdf782c0bd3a8abae625f42c80650d65be5bfd76939ba9efc3c8122", size = 322627, upload-time = "2025-12-01T00:35:36.292Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/78/55/5514e564539e23a4948795695d5f25c184f0e02ac18695db1c8d5e6f3d05/abnf-2.9.0.tar.gz", hash = "sha256:45af3643da2281e34b03fba467bdeb09797f5552d140907a578c2d8ec10fcdd5", size = 1088572, upload-time = "2026-08-27T11:12:45.963Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e0/2e/815384e25cdade147af784ad5a0f71fe10602c5e0a1d35a9c9040a72248b/abnf-2.4.1-py3-none-any.whl", hash = "sha256:c9918b6aa9fe93c531ab245d99b47fc2ccf56407e005a598b279f384397d1df1", size = 50039, upload-time = "2025-12-01T00:35:35.118Z" },
+    { url = "https://files.pythonhosted.org/packages/43/4c/cb77419f4dd5e6086550a05f4bce9eb521c80a2b877215065331c2b476b7/abnf-2.9.0-py3-none-any.whl", hash = "sha256:8592e174c05cc6010f5250f2292b832993f92e2ae136d7618368ee89d649435e", size = 78100, upload-time = "2026-08-27T11:12:44.185Z" },
 ]
 
 [[package]]
@@ -774,7 +774,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -1633,7 +1633,7 @@ wheels = [
 
 [[package]]
 name = "signinwithethereum"
-version = "5.0.0"
+version = "5.0.1"
 source = { editable = "." }
 dependencies = [
     { name = "abnf" },

signinwithethereum-5.0.0/README.md

@@ -1,100 +0,0 @@
-# Sign in with Ethereum
-
-This package provides a Python implementation of EIP-4361: Sign in With Ethereum.
-
-## Installation
-
-SIWE can be easily installed in any Python project with pip:
-
-```bash
-pip install signinwithethereum
-```
-
-The distribution is published as `signinwithethereum`, but the import name remains `siwe`:
-
-```python
-from siwe import SiweMessage
-```
-
-## Usage
-
-SIWE provides a `SiweMessage` class which implements EIP-4361.
-
-### Parsing a SIWE Message
-
-Parsing is done by initializing a `SiweMessage` object with an EIP-4361 formatted string:
-
-```python
-from siwe import SiweMessage
-message = SiweMessage.from_message(message=eip_4361_string)
-```
-
-Or to initialize a `SiweMessage` as a `pydantic.BaseModel` right away:
-
-```python
-message = SiweMessage(domain="login.xyz", address="0x1234...", ...)
-```
-
-### Verifying and Authenticating a SIWE Message
-
-Verification and authentication is performed via EIP-191, using the `address` field of the `SiweMessage` as the expected signer. The validate method checks message structural integrity, signature address validity, and time-based validity attributes.
-
-```python
-try:
-    message.verify(signature="0x...")
-    # You can also specify other checks (e.g. the nonce or domain expected).
-except siwe.VerificationError:
-    # Invalid
-```
-
-### Serialization of a SIWE Message
-
-`SiweMessage` instances can also be serialized as their EIP-4361 string representations via the `prepare_message` method:
-
-```python
-print(message.prepare_message())
-```
-
-## Example
-
-Parsing and verifying a `SiweMessage` is easy:
-
-```python
-try:
-    message = SiweMessage.from_message(eip_4361_string)
-    message.verify(signature, nonce="abcdef", domain="example.com")
-except ValueError:
-    # Invalid message format
-    print("Authentication attempt rejected.")
-except siwe.ExpiredMessage:
-    print("Authentication attempt rejected.")
-except siwe.DomainMismatch:
-    print("Authentication attempt rejected.")
-except siwe.NonceMismatch:
-    print("Authentication attempt rejected.")
-except siwe.InvalidSignature:
-    print("Authentication attempt rejected.")
-
-# Message has been verified. Authentication complete. Continue with authorization/other.
-```
-
-## Testing
-
-```bash
-git submodule update --init
-uv sync
-uv run pytest
-```
-
-## See Also
-
-- [Sign in with Ethereum: TypeScript](https://github.com/signinwithethereum/siwe)
-- [SIWE website: siwe.xyz](https://siwe.xyz)
-- [EIP-4361 Specification Draft](https://eips.ethereum.org/EIPS/eip-4361)
-- [EIP-191 Specification](https://eips.ethereum.org/EIPS/eip-191)
-
-## Disclaimer
-
-Our Python library for Sign in with Ethereum has not yet undergone a formal
-security audit. We welcome continued feedback on the usability, architecture,
-and security of this implementation.

signinwithethereum-5.0.0/siwe/grammars/rfc5234.py

@@ -1,20 +0,0 @@
-"""Primitive ABNF definition."""
-
-from typing import ClassVar, List
-
-from abnf.grammars.misc import load_grammar_rules
-from abnf.parser import Rule as _Rule
-
-
-@load_grammar_rules()
-class Rule(_Rule):
-    """Rules from RFC 5234."""
-
-    grammar: ClassVar[List] = [
-        "ALPHA          =  %x41-5A / %x61-7A   ; A-Z / a-z",
-        "LF             =  %x0A \
-        ; linefeed",
-        "DIGIT          =  %x30-39 \
-        ; 0-9",
-        'HEXDIG         =  DIGIT / "A" / "B" / "C" / "D" / "E" / "F"',
-    ]

signinwithethereum-5.0.0/test-vectors/.git

@@ -1 +0,0 @@
-gitdir: ../.git/modules/test-vectors