usesmileid 12.0.0__tar.gz

usesmileid-12.0.0/.github/auto-assign.yml

@@ -0,0 +1,3 @@
+# Configuration for kentaro-m/auto-assign-action (see workflows/auto-author-assign.yml).
+addReviewers: false
+addAssignees: author

usesmileid-12.0.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    open-pull-requests-limit: 0
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    open-pull-requests-limit: 5
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

usesmileid-12.0.0/.github/workflows/audit.yml

@@ -0,0 +1,42 @@
+name: Security Audit
+
+on:
+  pull_request:
+    paths:
+      - 'pyproject.toml'
+  workflow_dispatch:
+  schedule:
+    - cron: '0 9 * * *'
+
+jobs:
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install package
+        run: pip install -e .
+      - name: Run pip-audit
+        uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
+        with:
+          inputs: .
+      - name: Create issue on failure
+        if: failure() && github.event_name != 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          EXISTING=$(gh issue list --label "security-audit" --state open --json number --jq 'length' || echo "0")
+          if [ "${EXISTING:-0}" -gt 0 ]; then exit 0; fi
+          TITLE_DATE=$(date +%Y-%m-%d)
+          gh label create "security-audit" --color "D93F0B" --force 2>/dev/null || true
+          gh label create "priority:high" --color "B60205" --force 2>/dev/null || true
+          gh issue create \
+            --title "Security: Python dependency vulnerabilities detected (${TITLE_DATE})" \
+            --label "security-audit,priority:high" \
+            --body "The daily security audit has detected vulnerabilities. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."

usesmileid-12.0.0/.github/workflows/auto-author-assign.yml

@@ -0,0 +1,21 @@
+# Not present in the org's other core SDK repos (ruby / js); added here as a
+# standard community-health workflow, following the org's SHA-pinning convention.
+
+name: Auto Author Assign
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  # Adding assignees goes through the issues API; reviewers through pull-requests.
+  issues: write
+  pull-requests: write
+
+jobs:
+  assign-author:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: kentaro-m/auto-assign-action@0a2c53d3721e4c5cfcce6afd4014aecc337979f6 # v2.0.2
+        with:
+          configuration-path: .github/auto-assign.yml

usesmileid-12.0.0/.github/workflows/e2e.yml

@@ -0,0 +1,49 @@
+# Live end-to-end test against a real Smile ID environment. Runs on pushes to
+# main and nightly so live-API drift is caught outside the PR loop — fork PRs
+# get no secrets, so this never runs on pull_request.
+
+name: E2E Sandbox
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '23 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    if: github.repository == 'smileidentity/smileid-sdk-python'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install package
+        run: pip install -e ".[dev]"
+      - name: Run live sandbox E2E
+        env:
+          SMILE_PARTNER_ID: ${{ secrets.SMILE_PARTNER_ID }}
+          SMILE_API_KEY: ${{ secrets.SMILE_API_KEY }}
+          SMILE_BASE_URL: ${{ secrets.SMILE_E2E_BASE_URL }}
+        run: |
+          set -o pipefail
+          python -m pytest tests/test_e2e_sandbox.py -v -ra | tee pytest-output.txt
+          # A skip exits 0, so a passing pytest run alone doesn't prove the
+          # test executed against real creds. Fail the job unless the summary
+          # line shows exactly one passed test.
+          if ! grep -qE '(^| )1 passed( |$)' pytest-output.txt; then
+            echo "::error::E2E test did not report '1 passed' (skipped or failed) — check SMILE_PARTNER_ID/SMILE_API_KEY secrets."
+            exit 1
+          fi

usesmileid-12.0.0/.github/workflows/release.yml

@@ -0,0 +1,86 @@
+# Publishes usesmileid to PyPI when a `vX.Y.Z` tag is pushed. Uses PyPI
+# trusted publishing (OIDC) — no long-lived token stored in this repo.
+
+name: Release
+
+on:
+  push:
+    tags:
+      # vX.Y.Z plus any PEP 440 suffix (v1.2.3rc1, v1.2.3.post1). Keeps a
+      # stray tag like `vtest` from starting a publish job at all.
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+permissions:
+  contents: read
+
+# One publish at a time per tag, so a re-pushed tag can't race itself.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: github.repository == 'smileidentity/smileid-sdk-python'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Check tag matches package version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "::error::Tag v$TAG_VERSION does not match pyproject.toml version $PKG_VERSION"
+            exit 1
+          fi
+
+      - name: Install package
+        run: pip install -e ".[dev]"
+
+      - name: Test
+        run: pytest
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Type check
+        run: mypy usesmileid
+
+      - name: Build sdist and wheel
+        run: |
+          # Clear anything an earlier step left behind, so `twine check` and
+          # the publish below only ever see this build's artefacts.
+          rm -rf dist build
+          pip install build twine
+          python -m build
+          # Catches broken metadata or an unrenderable README before the
+          # upload, which PyPI will not let us replace.
+          twine check --strict dist/*
+
+      - name: Smoke-test built wheel
+        run: |
+          python -m venv /tmp/wheel-smoke
+          /tmp/wheel-smoke/bin/pip install "$(ls dist/*.whl)"
+          cd /tmp && /tmp/wheel-smoke/bin/python -c "import usesmileid"
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          skip-existing: true
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          if ! gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" \
+              --verify-tag --generate-notes
+          fi

usesmileid-12.0.0/.github/workflows/semgrep.yml

@@ -0,0 +1,146 @@
+name: Semgrep SAST
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  pull-requests: write
+
+jobs:
+  semgrep:
+    name: Semgrep Security Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    container:
+      image: semgrep/semgrep:1.157.0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
+
+      - name: Run Semgrep
+        continue-on-error: true
+        run: semgrep scan --config p/security-audit --sarif -o semgrep.sarif
+
+      - name: Upload SARIF to GitHub Security
+        if: always()
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        with:
+          sarif_file: semgrep.sarif
+
+      - name: Import results into DefectDojo
+        if: always()
+        continue-on-error: true
+        env:
+          DEFECTDOJO_URL: ${{ secrets.DEFECTDOJO_URL }}
+          DEFECTDOJO_API_TOKEN: ${{ secrets.DEFECTDOJO_API_TOKEN }}
+          REPO_NAME: ${{ github.event.repository.name }}
+          BRANCH_TAG: ${{ github.head_ref || github.ref_name }}
+        run: |
+          if [ ! -s semgrep.sarif ]; then
+            echo "No semgrep.sarif file found, skipping DefectDojo import"
+            exit 0
+          fi
+          curl -sS -f \
+            -H "Authorization: Token ${DEFECTDOJO_API_TOKEN}" \
+            -F "scan_type=SARIF" \
+            -F "file=@semgrep.sarif" \
+            -F "product_type_name=GitHub" \
+            -F "product_name=${REPO_NAME}" \
+            -F "engagement_name=CI" \
+            -F "auto_create_context=true" \
+            -F "close_old_findings=true" \
+            -F "deduplication_on_engagement=true" \
+            -F "commit_hash=${{ github.sha }}" \
+            -F "branch_tag=${BRANCH_TAG}" \
+            "${DEFECTDOJO_URL}/api/v2/reimport-scan/"
+
+      - name: Comment findings on PR
+        if: github.event_name == 'pull_request' && always()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          python3 << 'PYEOF'
+          import json, os, urllib.request
+
+          marker = "<!-- semgrep-results -->"
+          repo = os.environ.get("GITHUB_REPOSITORY", "")
+          pr = os.environ.get("PR_NUMBER", "")
+          token = os.environ.get("GH_TOKEN", "")
+          api = f"https://api.github.com/repos/{repo}/issues/{pr}/comments"
+          headers = {
+              "Authorization": f"Bearer {token}",
+              "Accept": "application/vnd.github+json",
+              "X-GitHub-Api-Version": "2022-11-28",
+          }
+
+          findings = []
+          try:
+              with open("semgrep.sarif") as f:
+                  sarif = json.load(f)
+              for run in sarif.get("runs", []):
+                  for result in run.get("results", []):
+                      rule_id = result.get("ruleId", "unknown")
+                      message = result.get("message", {}).get("text", "")
+                      level = result.get("level", "warning")
+                      for loc in result.get("locations", []):
+                          phys = loc.get("physicalLocation", {})
+                          path = phys.get("artifactLocation", {}).get("uri", "?")
+                          line = phys.get("region", {}).get("startLine", "?")
+                          findings.append({"rule": rule_id, "message": message,
+                                           "level": level, "file": path, "line": line})
+          except (FileNotFoundError, json.JSONDecodeError):
+              pass
+
+          if findings:
+              body = f"{marker}\n## 🔍 Semgrep Security Scan Results\n\n"
+              body += f"**{len(findings)} finding(s)** detected by "
+              body += "[`p/security-audit`](https://semgrep.dev/p/security-audit) ruleset.\n\n"
+              body += "| # | Severity | Rule | File | Line | Message |\n"
+              body += "|---|----------|------|------|------|---------|\n"
+              for i, f in enumerate(findings[:25], 1):
+                  rule = f["rule"].split(".")[-1] if "." in f["rule"] else f["rule"]
+                  msg = f["message"].replace("|", "\\|").replace("\n", " ")
+                  msg = (msg[:80] + "...") if len(msg) > 80 else msg
+                  body += f'| {i} | {f["level"].upper()} | `{rule}` '
+                  body += f'| `{f["file"]}` | {f["line"]} | {msg} |\n'
+              if len(findings) > 25:
+                  body += f"\n*... and {len(findings) - 25} more. "
+                  body += "See full results in workflow logs.*\n"
+              body += "\n> ⚠️ These findings are **non-blocking**. "
+              body += "Please review and address as appropriate.\n"
+          else:
+              body = f"{marker}\n## 🔍 Semgrep Security Scan Results\n\n"
+              body += "✅ No security findings detected by "
+              body += "[`p/security-audit`](https://semgrep.dev/p/security-audit) ruleset.\n"
+
+          existing_id = None
+          try:
+              req = urllib.request.Request(api, headers=headers)
+              resp = urllib.request.urlopen(req)
+              for c in json.loads(resp.read()):
+                  if marker in c.get("body", ""):
+                      existing_id = c["id"]
+                      break
+          except Exception:
+              pass
+
+          data = json.dumps({"body": body}).encode()
+          if existing_id:
+              url = f"https://api.github.com/repos/{repo}/issues/comments/{existing_id}"
+              req = urllib.request.Request(url, data=data, headers=headers, method="PATCH")
+          else:
+              req = urllib.request.Request(api, data=data, headers=headers, method="POST")
+
+          try:
+              urllib.request.urlopen(req)
+              action = "Updated" if existing_id else "Posted"
+              print(f"{action} comment with {len(findings)} finding(s)")
+          except Exception as e:
+              print(f"Warning: Could not comment on PR: {e}")
+          PYEOF

usesmileid-12.0.0/.github/workflows/stale.yml

@@ -0,0 +1,32 @@
+# Not present in the org's other core SDK repos (ruby / js); added here as a
+# standard community-health workflow, following the org's SHA-pinning convention.
+
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+    - cron: '0 1 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          days-before-stale: 60
+          days-before-close: 14
+          stale-issue-message: >-
+            This issue has been automatically marked as stale because it has had no
+            activity for 60 days. It will be closed in 14 days if no further activity occurs.
+          stale-pr-message: >-
+            This pull request has been automatically marked as stale because it has had no
+            activity for 60 days. It will be closed in 14 days if no further activity occurs.
+          stale-issue-label: stale
+          stale-pr-label: stale
+          exempt-issue-labels: pinned,security
+          exempt-pr-labels: pinned,security

usesmileid-12.0.0/.github/workflows/test.yml

@@ -0,0 +1,41 @@
+# This workflow installs dependencies and runs tests, lint, and type checks
+# across a matrix of supported Python versions.
+
+name: Python CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.8', '3.12']
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install package
+        run: pip install -e ".[dev]"
+      - name: Test
+        run: pytest
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.12'
+      - name: Install package
+        run: pip install -e ".[dev]"
+      - name: Lint
+        run: ruff check .
+      - name: Type check
+        run: mypy usesmileid

usesmileid-12.0.0/.gitignore

@@ -0,0 +1,33 @@
+# Byte-compiled / optimised files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+dist/
+build/
+*.egg-info/
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Test / lint / type-check caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.tox/
+.coverage
+.coverage.*
+htmlcov/
+
+# Environment files
+.env
+.env.*
+
+# Editor / OS
+.vscode/
+.idea/
+.DS_Store

usesmileid-12.0.0/AGENTS.md

@@ -0,0 +1,30 @@
+# Agent notes
+
+This repository holds Smile ID's V3 server-side SDK for Python (PyPI package and importable module are both `usesmileid`).
+
+## Source of truth
+
+The API surface (endpoints, request and response shapes) is defined by the OpenAPI specs at [smileidentity/api-reference](https://github.com/smileidentity/api-reference). Treat that repository as authoritative when generating or reviewing client code — do not invent endpoints or fields that aren't described there.
+
+## Layout
+
+- `usesmileid/generated/` — generator-owned code, produced from the OpenAPI specs. Do not hand-edit files here once the generator is wired up.
+- `usesmileid/client/` — hand-written client code (configuration, auth, transport).
+- `usesmileid/errors/` — hand-written error types.
+- `usesmileid/helpers/` — hand-written convenience helpers.
+
+Auth token lifecycle, transport, retries, serialization and errors are hand-written and must survive a future generator run; only `usesmileid/generated/` may be regenerated.
+
+All tests are offline (respx mocks) except `tests/test_e2e_sandbox.py`, which reads `SMILE_PARTNER_ID` and `SMILE_API_KEY` from the environment and skips when they are unset. It targets the sandbox unless `SMILE_BASE_URL` is set.
+
+## Running tests
+
+```bash
+python -m pytest
+```
+
+Lint with `ruff check .` and type-check with `mypy usesmileid`.
+
+## Org-wide conventions
+
+Org-wide agent conventions for Smile ID repositories live at [smileidentity/agents](https://github.com/smileidentity/agents) (private repository, internal contributors only).

usesmileid-12.0.0/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Security
+
+- `base_url` must now be an absolute https URL with no query or fragment,
+  validated at construction. There is deliberately no insecure override.
+- `default_callback_url` and per-request `callback_url` values must be https;
+  invalid values raise `ValidationError` before any request is sent.
+- `job_id` and `user_id` path parameters are URL-encoded as single path
+  segments before interpolation.
+- Multipart part filenames and content types are sanitized against header
+  injection (CR, LF, quotes).
+
+### Changed
+
+- Added `smileid.errors.UnexpectedResponseError`, raised when a success (2xx)
+  response body is not a JSON object, with `status_code`, `raw_body` and
+  `request_id` populated.
+
+- Renamed the PyPI package from `smile-identity-core` to `smileid`, matching
+  the importable module.
+- Set the version to 12.0.0, aligning the server SDKs with the V12 mobile
+  SDKs.
+
+### Added
+
+- Initial implementation of the V3 SDK: all 14 public operations under
+  `client.<resource>.<verb>`, plus `flag_fraud` / `clear_fraud` wrappers.
+- Automatic token management: fetch, thread-safe cache to expiry, one
+  refresh-and-retry on 401.
+- Typed error hierarchy under `smileid.errors`.
+- Retry policy for idempotent operations with `Retry-After` support.
+- `verifications.wait_until_complete` polling helper, `Consent` builder and
+  client-side validation for user details and fraud reports.

usesmileid-12.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Smile Identity Limited
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.