touchque-authenticator 4.2.0__py3-none-any.whl

touchque/resources/auth.py

@@ -0,0 +1,65 @@
+from typing import Dict, Any
+from urllib.parse import quote
+from ..http_client import HttpClient
+
+class Auth:
+    def __init__(self, http: HttpClient):
+        self._http = http
+
+    def generate_secret(self, external_username: str) -> Dict[str, Any]:
+        """Generate a new setup secret for a user."""
+        return self._http.post('/auth/generate-secret', {
+            'externalUsername': external_username
+        })
+
+
+
+
+
+    def reset_secret(self, external_username: str) -> Dict[str, Any]:
+        """Reset (regenerate) a user's secret."""
+        return self._http.post('/auth/secret/reset', {
+            'externalUsername': external_username
+        })
+
+    def validate_secret(self, secret: str) -> Dict[str, Any]:
+        """Validate a setup secret code."""
+        return self._http.post('/auth/secret/validate', {
+            'secret': secret
+        })
+
+    def get_user(self, external_username: str) -> Dict[str, Any]:
+        """
+        Look up a user's link status without sending a push. Useful while
+        polling during enrollment: ``used`` flips true and ``deviceId`` is set
+        once the mobile app scans the setup secret.
+
+        Returns ``{ externalUsername, deviceId, used, frozen, createdAt, expireAt, device }``.
+        Raises ``TouchQueAPIException`` (404) if the user is unknown.
+
+        ``device`` is the linked phone's posture for device trust, or ``None`` before a
+        phone is linked. It is self-reported by the TouchQue app::
+
+            {
+              "platform": "ios" | "android" | None,
+              "model": str | None,             # e.g. "iPhone15,3"
+              "osVersion": str | None,         # e.g. "18.1"
+              "securityPatch": str | None,     # Android "YYYY-MM-DD", None on iOS
+              "appVersion": str | None,
+              "screenLock": bool | None,
+              "biometrics": "face" | "touch" | "fingerprint" | "iris" | "none" | None,
+              "jailbroken": bool,              # jailbroken or rooted, by the app's checks
+              "compromised": bool,             # jailbroken/rooted or tampered (sticky for a cool-down)
+              "hardwareKey": bool,             # approvals are signed by a Secure Enclave / Keystore key
+              "attestation": "apple-appattest" | "android-key" | None,
+              "signed": bool,                  # the latest report was signed by the hardware key
+              "reportedAt": str | None,        # ISO date-time of the latest report
+              "lastSeenAt": str | None,
+              "linkedAt": str | None,
+              "state": "healthy" | "at_risk" | "compromised" | "unknown",
+              "issues": [str],                 # jailbroken, tampered, integrity_failed, no_report,
+                                               # stale_report, no_screen_lock, keys_lost,
+                                               # no_hardware_key, debugger, developer_mode
+            }
+        """
+        return self._http.get(f"/users/{quote(external_username, safe='')}")

touchque/resources/device_risk.py

@@ -0,0 +1,174 @@
+"""Device risk (a paid add-on, off until your workspace turns it on): a visitor
+ID for every browser on your sign-up, password-reset, sign-in or approval page.
+
+The page identifies with ``@touchque/web`` (``deviceRisk.identify({ siteKey,
+purpose })`` gives ``{ visitorId, requestId, confidence }``) and sends you the
+requestId. Never trust the page's copy: read the identification here
+(``get_event``) or check it for an account (``check``). TouchQue keeps keyed
+hashes only, with a key of your workspace alone, and its risk engine decides.
+
+Every signal only ever asks for more: ``stepUp`` means an extra check on this
+page (an emailed code, a passkey, a number-matched approval), never a refusal.
+For sign-ins, pass the requestId to ``login.request`` / ``risk.check`` as
+``device_risk_request_id`` instead. Collect it only on these pages and name it
+in your privacy notice.
+
+With the script tag (device.js), the form arrives with ``touchque_request_id``::
+
+    r = tq.device_risk.check(request.form.get('touchque_request_id'), event='sign_in', external_username=email)
+
+Pass it as it came. Missing, empty, made up or expired, it is still a verdict
+(``report``: ``missing``, ``unknown``, ``expired``; the signal
+``device_identification_missing``), never an exception: a page without the
+tag, or with it blocked, only gets the visitor a step-up.
+"""
+import re
+from typing import Any, Dict, Optional
+
+from ..exceptions import TouchQueConfigException
+from ..http_client import HttpClient
+
+#: The pages a device report may come from.
+DEVICE_RISK_EVENTS = ('sign_in', 'sign_up', 'password_reset', 'approval')
+#: What the page had sent: ``ok``, ``replayed``, or no usable identification.
+DEVICE_RISK_REPORTS = ('ok', 'replayed', 'missing', 'unknown', 'expired', 'invalid')
+
+_REQUEST_ID = re.compile(r'^dre_[A-Za-z0-9_-]{22}$')
+
+
+def parse_device_risk_check(raw: Any) -> Dict[str, Any]:
+    """Reads a ``POST /device-risk/check`` answer, failing toward asking:
+    ``stepUp`` is True unless it says exactly False; junk signals are dropped."""
+    body = raw if isinstance(raw, dict) else {}
+    signals = []
+    for s in body.get('signals') or []:
+        if isinstance(s, dict) and isinstance(s.get('code'), str):
+            item = {
+                'code': s['code'],
+                'text': s['text'] if isinstance(s.get('text'), str) else '',
+                'strength': s['strength'] if s.get('strength') in ('passkey', 'none') else 'number_match',
+            }
+            if isinstance(s.get('enforced'), bool):
+                item['enforced'] = s['enforced']
+            if isinstance(s.get('evidence'), dict):
+                item['evidence'] = s['evidence']
+            signals.append(item)
+    out = {
+        'report': body.get('report') if body.get('report') in DEVICE_RISK_REPORTS else 'invalid',
+        'requestId': body.get('requestId') if isinstance(body.get('requestId'), str) else None,
+        'visitorId': body.get('visitorId') if isinstance(body.get('visitorId'), str) else None,
+        'confidence': body.get('confidence') if isinstance(body.get('confidence'), (int, float)) and not isinstance(body.get('confidence'), bool) else None,
+        'visitor': body.get('visitor') if isinstance(body.get('visitor'), dict) else None,
+        'counts': body.get('counts') if isinstance(body.get('counts'), dict) else None,
+        # The address (never coordinates), the visitor's counts, one answer to "a bot?" (detected | suspected | not_detected).
+        'network': body.get('network') if isinstance(body.get('network'), dict) else None,
+        'velocity': body.get('velocity') if isinstance(body.get('velocity'), dict) else None,
+        'bot': body.get('bot') if isinstance(body.get('bot'), dict) else None,
+        'signals': signals,
+        'stepUp': body.get('stepUp') is not False,
+        'wouldStepUp': body.get('wouldStepUp') is True,
+        'requires': body.get('requires') if body.get('requires') in ('number_match', 'passkey') else 'none',
+        'mode': 'enforce' if body.get('mode') == 'enforce' else 'shadow',
+        # The engine's state for this check; 'unavailable' when the risk engine could not be reached and the verdict is a safe default.
+        'engine': body.get('engine') if isinstance(body.get('engine'), str) else None,
+    }
+    if isinstance(body.get('caseCode'), str):
+        out['caseCode'] = body['caseCode']
+    return out
+
+
+class DeviceRisk:
+    def __init__(self, http: HttpClient):
+        self._http = http
+
+    def check(
+        self,
+        request_id: Any = None,
+        event: str = 'sign_in',
+        external_username: Optional[str] = None,
+        client_ip: Optional[str] = None,
+        device_risk: Optional[str] = None,
+    ) -> Dict[str, Any]:
+        """Checks the page's identification for an account: binds it (one
+        account per identification, 15 minutes) and asks the risk engine. Pass
+        the form field as it came: None, empty or made up is still a verdict
+        (``report``: ``missing``, ``unknown``), never an exception. 409
+        ``device_risk_off`` until your workspace turns Device risk on.
+
+        :param request_id: the ``touchque_request_id`` form field (the script tag), or ``deviceRisk.identify()``'s requestId.
+        :param event: ``sign_in``, ``sign_up``, ``password_reset`` or ``approval``.
+        :param external_username: the account the page is for, when there is one.
+        :param client_ip: the end user's address (default: where the browser identified from).
+        :param device_risk: instead of request_id, the page's report (``deviceRisk.collect()``).
+
+        Example::
+
+            r = tq.device_risk.check(request.form.get('touchque_request_id'), event='sign_up', external_username=email, client_ip=ip)
+            if r['stepUp']:
+                ask_for_email_code()   # never refuse on it alone
+        """
+        if event not in DEVICE_RISK_EVENTS:
+            raise TouchQueConfigException(f"device_risk.check() event must be one of {', '.join(DEVICE_RISK_EVENTS)}")
+        payload: Dict[str, Any] = {}
+        if isinstance(request_id, str) and request_id:
+            payload['requestId'] = request_id[:64]
+        elif isinstance(device_risk, str) and device_risk:
+            payload['deviceRisk'] = device_risk
+        payload['event'] = event
+        if external_username:
+            payload['externalUsername'] = external_username
+        if client_ip:
+            payload['clientIp'] = client_ip
+        return parse_device_risk_check(self._http.post('/device-risk/check', payload))
+
+    def search_events(self, from_: Optional[str] = None, to: Optional[str] = None, signal: Optional[str] = None,
+                      step_up: Optional[bool] = None, kind: Optional[str] = None, origin: Optional[str] = None,
+                      ip: Optional[str] = None, account: Optional[str] = None, visitor_id: Optional[str] = None,
+                      request_id: Optional[str] = None, cursor: Optional[str] = None, limit: Optional[int] = None) -> Dict[str, Any]:
+        """Your workspace's identifications, newest first, one page at a time:
+        a date range (``from_``/``to``: ``YYYY-MM-DD`` or ISO times; 7 days by
+        default, at most 90, within your retention) and any of the filters.
+        ``ip`` is an address or a CIDR range and is never returned. Pass
+        ``nextCursor`` back as ``cursor`` until it is ``None``; do not page by
+        moving the dates. A search that would read too much is a 422
+        ``search_too_broad``: narrow the range or add a filter.
+
+        Returns ``{ events, nextCursor, from, to }``.
+
+        Example::
+
+            cursor = None
+            while True:
+                page = tq.device_risk.search_events(signal='device_tampered', cursor=cursor)
+                for e in page['events']:
+                    print(e['at'], e['visitorId'], e['caseCode'])
+                cursor = page['nextCursor']
+                if not cursor:
+                    break
+        """
+        if limit is not None and (not isinstance(limit, int) or isinstance(limit, bool) or not 1 <= limit <= 100):
+            raise TouchQueConfigException('device_risk.search_events() limit must be 1 to 100')
+        params: Dict[str, Any] = {}
+        for key, value in (('from', from_), ('to', to), ('signal', signal), ('kind', kind), ('origin', origin), ('ip', ip),
+                           ('account', account), ('visitorId', visitor_id), ('requestId', request_id), ('cursor', cursor)):
+            if isinstance(value, str) and value:
+                params[key] = value
+        if isinstance(step_up, bool):
+            params['stepUp'] = 'true' if step_up else 'false'
+        if limit is not None:
+            params['limit'] = limit
+        raw = self._http.get('/device-risk/events', params) or {}
+        cursor_out = raw.get('nextCursor')
+        return {
+            'events': raw.get('events') if isinstance(raw.get('events'), list) else [],
+            'nextCursor': cursor_out if isinstance(cursor_out, str) and cursor_out else None,
+            'from': raw.get('from') or '',
+            'to': raw.get('to') or '',
+        }
+
+    def get_event(self, request_id: str) -> Dict[str, Any]:
+        """The trusted identification behind a request_id: the visitor, how sure,
+        what the page showed, the risk engine's verdict. Read-only."""
+        if not isinstance(request_id, str) or not _REQUEST_ID.match(request_id):
+            raise TouchQueConfigException('device_risk.get_event() needs a request_id (dre_...)')
+        return self._http.get(f'/device-risk/events/{request_id}')

touchque/resources/identity.py

@@ -0,0 +1,268 @@
+"""TouchQue Login Management API (``client.identity``): your customers'
+accounts, roles, business-customer organizations, apps, APIs, connections and
+the tenant itself, from your server with your workspace key.
+
+    found = client.identity.users.list(q="ayse")
+    client.identity.users.block(user_id, reason="chargeback")
+    job = client.identity.imports.start(users=[{"email": e, "passwordHash": "$2b$10$..."}])
+    client.identity.imports.wait(job["id"])
+"""
+
+import time
+from typing import Any, Dict, List, Optional
+from urllib.parse import quote
+
+from ..http_client import HttpClient
+
+
+def _id(value: str) -> str:
+    return quote(str(value), safe='')
+
+
+def _clean(d: Dict[str, Any]) -> Dict[str, Any]:
+    return {k: v for k, v in d.items() if v is not None}
+
+
+class IdentityUsers:
+    def __init__(self, http: HttpClient):
+        self._http = http
+
+    def list(self, q: Optional[str] = None, blocked: Optional[bool] = None, email_verified: Optional[bool] = None,
+             connection: Optional[str] = None, organization: Optional[str] = None, limit: Optional[int] = None,
+             cursor: Optional[str] = None) -> Dict[str, Any]:
+        return self._http.get('/identity/users', _clean({
+            'q': q, 'blocked': blocked, 'emailVerified': email_verified, 'connection': connection,
+            'organization': organization, 'limit': limit, 'cursor': cursor,
+        }))
+
+    def get(self, user_id: str) -> Dict[str, Any]:
+        return self._http.get(f'/identity/users/{_id(user_id)}')
+
+    def create(self, email: str, **fields: Any) -> Dict[str, Any]:
+        """fields: password, passwordHash (bcrypt/argon2), customPasswordHash, emailVerified,
+        name, givenName, familyName, phone, locale, userMetadata, appMetadata, sendVerificationEmail."""
+        return self._http.post('/identity/users', {'email': email, **fields})
+
+    def update(self, user_id: str, **changes: Any) -> Dict[str, Any]:
+        """Metadata is merged; a key set to None is removed."""
+        return self._http.patch(f'/identity/users/{_id(user_id)}', changes)
+
+    def delete(self, user_id: str) -> Dict[str, Any]:
+        """Erasure (KVKK/GDPR): the account and every workspace row that names it."""
+        return self._http.delete(f'/identity/users/{_id(user_id)}')
+
+    def block(self, user_id: str, reason: Optional[str] = None) -> Dict[str, Any]:
+        return self._http.post(f'/identity/users/{_id(user_id)}/block', _clean({'reason': reason}))
+
+    def unblock(self, user_id: str) -> Dict[str, Any]:
+        return self._http.post(f'/identity/users/{_id(user_id)}/unblock', {})
+
+    def export(self, user_id: str) -> Dict[str, Any]:
+        """Everything about the person (KVKK/GDPR access request); never hashes."""
+        return self._http.get(f'/identity/users/{_id(user_id)}/export')
+
+    def sessions(self, user_id: str) -> Dict[str, Any]:
+        return self._http.get(f'/identity/users/{_id(user_id)}/sessions')
+
+    def end_session(self, user_id: str, session_id: str) -> Dict[str, Any]:
+        """Signs the person out of one session (the others stay)."""
+        return self._http.delete(f'/identity/users/{_id(user_id)}/sessions/{_id(session_id)}')
+
+    def sign_out_everywhere(self, user_id: str) -> Dict[str, Any]:
+        return self._http.delete(f'/identity/users/{_id(user_id)}/sessions')
+
+    def reset_mfa(self, user_id: str) -> Dict[str, Any]:
+        """Removes passkeys, unlinks the TouchQue app, turns email codes off, signs out everywhere."""
+        return self._http.delete(f'/identity/users/{_id(user_id)}/mfa')
+
+    def connected_accounts(self, user_id: str) -> Dict[str, Any]:
+        """Accounts at providers whose tokens the vault keeps for the user (connections with tokenVault on)."""
+        return self._http.get(f'/identity/users/{_id(user_id)}/connected-accounts')
+
+    def disconnect_account(self, user_id: str, account_id: str) -> Dict[str, Any]:
+        """Deletes the stored tokens: apps stop using the account for the user; signing in with it stays."""
+        return self._http.delete(f'/identity/users/{_id(user_id)}/connected-accounts/{_id(account_id)}')
+
+    def unlink_identity(self, user_id: str, identity_id: str, force: bool = False) -> Dict[str, Any]:
+        return self._http.delete(f'/identity/users/{_id(user_id)}/identities/{_id(identity_id)}' + ('?force=true' if force else ''))
+
+    def send_verification_email(self, user_id: str, return_to: Optional[str] = None) -> Dict[str, Any]:
+        return self._http.post(f'/identity/users/{_id(user_id)}/verification-email', _clean({'returnTo': return_to}))
+
+    def password_reset(self, user_id: str, send_email: bool = True, ttl_sec: Optional[int] = None) -> Dict[str, Any]:
+        """send_email=False: the link comes back for you to deliver."""
+        return self._http.post(f'/identity/users/{_id(user_id)}/password-reset', _clean({'sendEmail': send_email, 'ttlSec': ttl_sec}))
+
+    def roles(self, user_id: str) -> Dict[str, Any]:
+        return self._http.get(f'/identity/users/{_id(user_id)}/roles')
+
+    def add_roles(self, user_id: str, role_ids: List[str], organization_id: Optional[str] = None) -> Dict[str, Any]:
+        return self._http.post(f'/identity/users/{_id(user_id)}/roles', _clean({'roleIds': role_ids, 'organizationId': organization_id}))
+
+    def remove_role(self, user_id: str, role_id: str, organization_id: Optional[str] = None) -> Dict[str, Any]:
+        query = f'?organizationId={_id(organization_id)}' if organization_id else ''
+        return self._http.delete(f'/identity/users/{_id(user_id)}/roles/{_id(role_id)}{query}')
+
+    def logs(self, user_id: str, limit: Optional[int] = None) -> Dict[str, Any]:
+        return self._http.get(f'/identity/users/{_id(user_id)}/logs', _clean({'limit': limit}))
+
+
+class IdentityJobs:
+    def __init__(self, http: HttpClient, kind: str):
+        self._http = http
+        self._kind = kind
+
+    def start(self, users: Optional[List[Dict[str, Any]]] = None, upsert: Optional[bool] = None, format: Optional[str] = None) -> Dict[str, Any]:
+        """imports: users (and upsert); exports: format 'csv' or 'json'."""
+        return self._http.post(f'/identity/users-{self._kind}', _clean({'users': users, 'upsert': upsert, 'format': format}))
+
+    def get(self, job_id: str) -> Dict[str, Any]:
+        return self._http.get(f'/identity/users-{self._kind}/{_id(job_id)}')
+
+    def file(self, job_id: str) -> str:
+        """Exports: the finished file (CSV or JSON lines), as text."""
+        return self._http.get_text(f'/identity/users-{self._kind}/{_id(job_id)}/file')
+
+    def wait(self, job_id: str, interval: float = 1.0, timeout: float = 600.0) -> Dict[str, Any]:
+        end = time.time() + timeout
+        while True:
+            job = self.get(job_id)
+            if job.get('status') != 'running' or time.time() > end:
+                return job
+            time.sleep(interval)
+
+
+class _Crud:
+    def __init__(self, http: HttpClient, base: str, list_key: str):
+        self._http = http
+        self._base = base
+        self._list_key = list_key
+
+    def list(self, **params: Any) -> List[Dict[str, Any]]:
+        return self._http.get(self._base, _clean(params) or None).get(self._list_key, [])
+
+    def get(self, item_id: str) -> Dict[str, Any]:
+        return self._http.get(f'{self._base}/{_id(item_id)}')
+
+    def create(self, **body: Any) -> Dict[str, Any]:
+        return self._http.post(self._base, body)
+
+    def update(self, item_id: str, **body: Any) -> Dict[str, Any]:
+        return self._http.patch(f'{self._base}/{_id(item_id)}', body)
+
+    def delete(self, item_id: str) -> Dict[str, Any]:
+        return self._http.delete(f'{self._base}/{_id(item_id)}')
+
+
+class IdentityOrganizations(_Crud):
+    def __init__(self, http: HttpClient):
+        super().__init__(http, '/identity/organizations', 'organizations')
+
+    def members(self, org_id: str) -> Dict[str, Any]:
+        return self._http.get(f'{self._base}/{_id(org_id)}/members')
+
+    def add_members(self, org_id: str, user_ids: List[str]) -> Dict[str, Any]:
+        return self._http.post(f'{self._base}/{_id(org_id)}/members', {'userIds': user_ids})
+
+    def remove_member(self, org_id: str, user_id: str) -> Dict[str, Any]:
+        return self._http.delete(f'{self._base}/{_id(org_id)}/members/{_id(user_id)}')
+
+    def set_connections(self, org_id: str, connections: List[Dict[str, Any]]) -> Dict[str, Any]:
+        return self._http.put(f'{self._base}/{_id(org_id)}/connections', {'connections': connections})
+
+    def invitations(self, org_id: str) -> Dict[str, Any]:
+        return self._http.get(f'{self._base}/{_id(org_id)}/invitations')
+
+    def invite(self, org_id: str, email: str, client_id: str, role_ids: Optional[List[str]] = None,
+               inviter_name: Optional[str] = None, send_email: Optional[bool] = None) -> Dict[str, Any]:
+        """The link opens the app's sign-in route (initiateLoginUri) with organization and invitation."""
+        return self._http.post(f'{self._base}/{_id(org_id)}/invitations', _clean({
+            'email': email, 'clientId': client_id, 'roleIds': role_ids, 'inviterName': inviter_name, 'sendEmail': send_email,
+        }))
+
+    def revoke_invitation(self, org_id: str, invitation_id: str) -> Dict[str, Any]:
+        return self._http.delete(f'{self._base}/{_id(org_id)}/invitations/{_id(invitation_id)}')
+
+
+class IdentityClients(_Crud):
+    def __init__(self, http: HttpClient):
+        super().__init__(http, '/identity/clients', 'clients')
+
+    def rotate_secret(self, client_id: str) -> Dict[str, Any]:
+        """The new secret is in the answer, this once."""
+        return self._http.post(f'{self._base}/{_id(client_id)}/rotate-secret', {})
+
+
+class Identity:
+    def __init__(self, http: HttpClient):
+        self._http = http
+        self.users = IdentityUsers(http)
+        self.imports = IdentityJobs(http, 'imports')
+        self.exports = IdentityJobs(http, 'exports')
+        self.roles = _Crud(http, '/identity/roles', 'roles')
+        self.organizations = IdentityOrganizations(http)
+        self.clients = IdentityClients(http)
+        self.apis = _Crud(http, '/identity/apis', 'apis')
+        self.connections = _Crud(http, '/identity/connections', 'connections')
+        self.custom_domains = _Crud(http, '/identity/custom-domains', 'domains')
+
+    def get_tenant(self) -> Dict[str, Any]:
+        return self._http.get('/identity/tenant')
+
+    def update_tenant(self, **body: Any) -> Dict[str, Any]:
+        """Turns TouchQue Login on (slug, displayName) or changes its settings."""
+        return self._http.put('/identity/tenant', body)
+
+    def rotate_signing_key(self) -> Dict[str, Any]:
+        return self._http.post('/identity/tenant/signing-keys/rotate', {})
+
+    def set_approver_app_name(self, name: Optional[str]) -> Dict[str, Any]:
+        """The phone app the hosted pages tell customers to approve on ("Approve on the Acme app").
+
+        None: your brand name when the Mobile SDK is set up, else TouchQue (``approverApp`` in the tenant shows which).
+        """
+        return self._http.put('/identity/tenant', {'branding': {'approverAppName': name}})
+
+    def set_custom_domain_only(self, on: bool) -> Dict[str, Any]:
+        """Serve sign-in only on the primary custom domain: {slug}.login.touchque.com redirects page loads there and
+        refuses other calls. Turning it on needs a verified primary domain with a working certificate."""
+        return self._http.put('/identity/tenant', {'customDomainOnly': on})
+
+    def check_domain_certificate(self, domain_id: str) -> Dict[str, Any]:
+        """Checks a verified custom domain's certificate at the sign-in edge now (``certificate``: pending | active | error)."""
+        return self._http.post(f'/identity/custom-domains/{_id(domain_id)}/check-certificate', {})
+
+    def outbox(self, to: Optional[str] = None, limit: Optional[int] = None) -> Dict[str, Any]:
+        """The delivery log. Message text only in the local dev inbox."""
+        return self._http.get('/identity/outbox', _clean({'to': to, 'limit': limit}))
+
+    def get_attack_protection(self) -> Dict[str, Any]:
+        """Wrong passwords, suspicious addresses, bot challenge, breached passwords, new-browser notices, the risk engine."""
+        return self._http.get('/identity/attack-protection')
+
+    def set_attack_protection(self, **settings: Any) -> Dict[str, Any]:
+        """Partial; the bot challenge's secret is write-only."""
+        return self._http.put('/identity/attack-protection', settings)
+
+    def attack_events(self, limit: Optional[int] = None) -> Dict[str, Any]:
+        """What attack protection caught lately."""
+        return self._http.get('/identity/attack-protection/events', _clean({'limit': limit}))
+
+    def get_delivery(self) -> Dict[str, Any]:
+        """The email and SMS providers; secrets never come back (secretsSet)."""
+        return self._http.get('/identity/delivery')
+
+    def set_delivery(self, channel: str, **provider: Any) -> Dict[str, Any]:
+        """Your own provider: email smtp, ses, postmark, sendgrid; sms twilio, netgsm.
+        provider='postmark', from_='login@acme.com', serverToken=... (from_ is sent as "from").
+        A secret left out keeps its stored value."""
+        body = {('from' if k == 'from_' else k): v for k, v in provider.items()}
+        return self._http.put(f'/identity/delivery/{_id(channel)}', body)
+
+    def remove_delivery(self, channel: str) -> Dict[str, Any]:
+        """Back to TouchQue's transport."""
+        return self._http.delete(f'/identity/delivery/{_id(channel)}')
+
+    def test_delivery(self, channel: str, to: str) -> Dict[str, Any]:
+        """One test message through the provider in use."""
+        return self._http.post(f'/identity/delivery/{_id(channel)}/test', {'to': to})