valentina-python-client 3.5.0__tar.gz → 3.5.1__tar.gz

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: valentina-python-client
-Version: 3.5.0
+Version: 3.5.1
 Summary: Async Python client library for the Valentina Noir API
 Author: Nate Landau
 Author-email: Nate Landau <github@natenate.org>

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/pyproject.toml

@@ -15,7 +15,7 @@ description = "Async Python client library for the Valentina Noir API"
 name = "valentina-python-client"
 readme = "README.md"
 requires-python = ">=3.13"
-version = "3.5.0"
+version = "3.5.1"
 
 [[project.authors]]
 name = "Nate Landau"

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/pyproject.toml.orig

@@ -17,7 +17,7 @@
     name = "valentina-python-client"
     readme = "README.md"
     requires-python = ">=3.13"
-    version = "3.5.0"
+    version = "3.5.1"
 
     [project.optional-dependencies]
         testing = ["polyfactory>=3.3.0"]

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/__init__.py

@@ -116,4 +116,4 @@ __all__ = (
     "users_service",
 )
 
-__version__ = "3.5.0"
+__version__ = "3.5.1"

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/client.py

@@ -200,6 +200,15 @@ class SyncVClient:
         """Check if the client has been closed."""
         return self._http.is_closed
 
+    def _set_api_key(self, api_key: str) -> None:
+        """Send a new API key on every later request from this client and its services.
+
+        Args:
+            api_key: The API key to authenticate with from now on.
+        """
+        self._config.api_key = api_key
+        self._http.headers[API_KEY_HEADER] = api_key
+
     @property
     def default_company_id(self) -> str | None:
         """Return the default company ID from config."""

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/base.py

@@ -91,21 +91,22 @@ class SyncBaseService:
     def _calculate_backoff_delay(self, attempt: int, retry_after: int | None) -> float:
         """Calculate the delay before the next retry attempt.
 
-        Uses exponential backoff with jitter: base_delay * (2 ** attempt) + random jitter.
-        If retry_after is provided from the RateLimit header, uses that as the base.
+        Wait the server's ``retry_after`` when it gives one, since the server knows
+        when capacity returns. Otherwise use exponential backoff:
+        ``retry_delay * 2 ** attempt``. Either way, add up to 25% random jitter so
+        clients that were limited together do not retry together.
 
         Args:
             attempt: The current attempt number (0-indexed).
-            retry_after: Seconds to wait from the RateLimit header, or None.
+            retry_after: Seconds to wait from the RateLimit or Retry-After header, or None.
 
         Returns:
             Number of seconds to wait before retrying.
         """
-        config = self._client._config
-        base_delay = config.retry_delay
         if retry_after is not None and retry_after > 0:
-            base_delay = max(base_delay, float(retry_after))
-        delay = base_delay * 2**attempt
+            delay = float(retry_after)
+        else:
+            delay = self._client._config.retry_delay * 2**attempt
         jitter = random.uniform(0, delay * 0.25)
         return delay + jitter
 

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/campaign_book_chapters.py

@@ -26,7 +26,11 @@ if TYPE_CHECKING:
 
 
 class SyncChaptersService(SyncBaseService):
-    """Service for managing campaign book chapters within a campaign book in the Valentina API."""
+    """Service for managing campaign book chapters within a campaign book in the Valentina API.
+
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+    """
 
     def __init__(
         self,
@@ -413,7 +417,7 @@ class SyncChaptersService(SyncBaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -450,7 +454,7 @@ class SyncChaptersService(SyncBaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different chapter.
             AuthorizationError: If you don't have appropriate access.
         """
         self._delete(

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/campaign_books.py

@@ -34,6 +34,9 @@ class SyncBooksService(SyncBaseService):
     Provides methods to create, retrieve, update, and delete campaign books,
     as well as access book notes and assets.
 
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+
     Example:
         >>> async with SyncVClient() as client:
         ...     books = client.books("company_id", "campaign_id")
@@ -477,7 +480,7 @@ class SyncBooksService(SyncBaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -514,7 +517,7 @@ class SyncBooksService(SyncBaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different book.
             AuthorizationError: If you don't have appropriate access.
         """
         self._delete(

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/campaigns.py

@@ -33,6 +33,9 @@ class SyncCampaignsService(SyncBaseService):
     Provides methods to create, retrieve, update, and delete campaigns,
     as well as access campaign statistics, assets, and notes.
 
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+
     Example:
         >>> async with SyncVClient() as client:
         ...     campaigns = client.campaigns("company_id")
@@ -308,7 +311,7 @@ class SyncCampaignsService(SyncBaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different campaign.
             AuthorizationError: If you don't have appropriate access.
         """
         self._delete(
@@ -327,7 +330,7 @@ class SyncCampaignsService(SyncBaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/characters.py

@@ -495,7 +495,7 @@ class SyncCharactersService(SyncBaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different character.
             AuthorizationError: If you don't have appropriate access.
         """
         self._delete(
@@ -514,7 +514,7 @@ class SyncCharactersService(SyncBaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/developers.py

@@ -64,8 +64,10 @@ class SyncDeveloperService(SyncBaseService):
     def regenerate_api_key(self) -> MeDeveloperWithApiKey:
         """Generate a new API key for the current developer.
 
-        The current key will be immediately invalidated and all cached
-        authentication data will be cleared.
+        The API invalidates the current key at once, so this client switches to
+        the new key for every later request, including those from services it
+        already created. Other clients that still hold the old key get
+        ``AuthenticationError`` until they are given the new one.
 
         **Be certain to save the API key from the response. It will not be displayed again.**
 
@@ -76,4 +78,6 @@ class SyncDeveloperService(SyncBaseService):
             AuthenticationError: If the current API key is invalid.
         """
         response = self._post(Endpoints.DEVELOPER_ME_NEW_KEY)
-        return MeDeveloperWithApiKey.model_validate(response.json())
+        developer = MeDeveloperWithApiKey.model_validate(response.json())
+        self._client._set_api_key(developer.api_key)
+        return developer

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/identity.py

@@ -18,7 +18,10 @@ class SyncIdentityService(SyncBaseService):
     ID token for apple/google, an OAuth access token for discord/github). The
     API verifies the credential with the provider and resolves the user in
     order: match by provider ID, auto-link by provider-verified email, or
-    create a new UNAPPROVED user.
+    create a new UNAPPROVED user. Auto-link never replaces an identity: when
+    the email's user already holds a different identity from the same
+    provider, a new user is created instead. OIDC ID tokens must carry
+    ``exp`` and ``iat`` claims.
 
     This service does not require an acting user (no On-Behalf-Of header).
     Authentication is via developer API key only.
@@ -50,7 +53,9 @@ class SyncIdentityService(SyncBaseService):
         The returned ``resolution`` field reports which path the API took:
         ``matched`` (an existing user holds this provider identity), ``linked``
         (the identity was auto-linked onto an existing user by provider-verified
-        email), or ``created`` (a new UNAPPROVED user was registered).
+        email), or ``created`` (a new UNAPPROVED user was registered). An email
+        match whose user already holds a different identity from the same
+        provider resolves to ``created``, not ``linked``.
 
         Args:
             request: A UserIdentifyDTO model, OR pass fields as keyword arguments.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/_sync/services/users.py

@@ -547,8 +547,9 @@ class SyncUsersService(SyncBaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
-            AuthorizationError: If you don't have appropriate access.
+            NotFoundError: If the asset does not exist or belongs to a different user.
+            AuthorizationError: If the acting user is neither ``user_id`` nor a
+                company admin.
         """
         self._delete(
             self._format_endpoint(Endpoints.USER_ASSET, user_id=user_id, asset_id=asset_id)
@@ -564,7 +565,7 @@ class SyncUsersService(SyncBaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -580,7 +581,8 @@ class SyncUsersService(SyncBaseService):
 
         Raises:
             NotFoundError: If the user does not exist.
-            AuthorizationError: If you don't have appropriate access.
+            AuthorizationError: If the acting user is neither ``user_id`` nor a
+                company admin.
             ValidationError: If the file is invalid or exceeds size limits.
         """
         if content_type is None:
@@ -596,10 +598,10 @@ class SyncUsersService(SyncBaseService):
     ) -> User:
         """Upload a custom avatar for a user, replacing any existing one.
 
-        Accepts PNG, JPEG, WEBP, or GIF (first frame) up to 5 MB. The server
-        normalizes the image to a 512x512 WebP and it overrides any
-        identity-provider-derived avatar. Requires the ``On-Behalf-Of`` header
-        (permitted for the user themselves or an admin).
+        Accepts PNG, JPEG, WEBP, or GIF (first frame) up to 5 MB and 24
+        megapixels. The server normalizes the image to a 512x512 WebP and it
+        overrides any identity-provider-derived avatar. Requires the
+        ``On-Behalf-Of`` header (permitted for the user themselves or an admin).
 
         Args:
             user_id: The ID of the user to set the avatar for.
@@ -667,7 +669,7 @@ class SyncUsersService(SyncBaseService):
         Args:
             user_id: The ID of the user to award XP to.
             campaign_id: The ID of the campaign to add XP for.
-            amount: The amount of XP to add.
+            amount: The amount of XP to add. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -692,7 +694,7 @@ class SyncUsersService(SyncBaseService):
         Args:
             user_id: The ID of the user to remove XP from.
             campaign_id: The ID of the campaign to remove XP for.
-            amount: The amount of XP to remove.
+            amount: The amount of XP to remove. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -719,7 +721,7 @@ class SyncUsersService(SyncBaseService):
         Args:
             user_id: The ID of the user to award cool points to.
             campaign_id: The ID of the campaign to add cool points for.
-            amount: The amount of cool points to add.
+            amount: The amount of cool points to add. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -969,7 +971,8 @@ class SyncUsersService(SyncBaseService):
             The Quickroll object with full details.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have access to the company.
         """
         response = self._get(
@@ -1029,7 +1032,8 @@ class SyncUsersService(SyncBaseService):
             The updated Quickroll object.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have appropriate access.
             RequestValidationError: If the input parameters fail client-side validation.
             ValidationError: If the request data is invalid.
@@ -1053,7 +1057,8 @@ class SyncUsersService(SyncBaseService):
             quickroll_id: The ID of the quickroll to delete.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have appropriate access.
         """
         self._delete(

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/client.py

@@ -212,6 +212,15 @@ class VClient:
         """Check if the client has been closed."""
         return self._http.is_closed
 
+    def _set_api_key(self, api_key: str) -> None:
+        """Send a new API key on every later request from this client and its services.
+
+        Args:
+            api_key: The API key to authenticate with from now on.
+        """
+        self._config.api_key = api_key
+        self._http.headers[API_KEY_HEADER] = api_key
+
     @property
     def default_company_id(self) -> str | None:
         """Return the default company ID from config."""

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/models/users.py

@@ -311,7 +311,7 @@ class _ExperienceAddRemove(BaseModel):
     Used to construct the JSON payload for XP/CP modifications.
     """
 
-    amount: int
+    amount: int = Field(ge=1)
     campaign_id: str
 
 

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/base.py

@@ -91,25 +91,22 @@ class BaseService:
     def _calculate_backoff_delay(self, attempt: int, retry_after: int | None) -> float:
         """Calculate the delay before the next retry attempt.
 
-        Uses exponential backoff with jitter: base_delay * (2 ** attempt) + random jitter.
-        If retry_after is provided from the RateLimit header, uses that as the base.
+        Wait the server's ``retry_after`` when it gives one, since the server knows
+        when capacity returns. Otherwise use exponential backoff:
+        ``retry_delay * 2 ** attempt``. Either way, add up to 25% random jitter so
+        clients that were limited together do not retry together.
 
         Args:
             attempt: The current attempt number (0-indexed).
-            retry_after: Seconds to wait from the RateLimit header, or None.
+            retry_after: Seconds to wait from the RateLimit or Retry-After header, or None.
 
         Returns:
             Number of seconds to wait before retrying.
         """
-        config = self._client._config  # noqa: SLF001
-        base_delay = config.retry_delay
-
-        # Use retry_after if provided, otherwise use configured base delay
         if retry_after is not None and retry_after > 0:
-            base_delay = max(base_delay, float(retry_after))
-
-        # Exponential backoff: base * 2^attempt
-        delay = base_delay * (2**attempt)
+            delay = float(retry_after)
+        else:
+            delay = self._client._config.retry_delay * (2**attempt)  # noqa: SLF001
 
         # Add jitter (up to 25% of the delay)
         jitter = random.uniform(0, delay * 0.25)

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/campaign_book_chapters.py

@@ -25,7 +25,11 @@ if TYPE_CHECKING:
 
 
 class ChaptersService(BaseService):
-    """Service for managing campaign book chapters within a campaign book in the Valentina API."""
+    """Service for managing campaign book chapters within a campaign book in the Valentina API.
+
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+    """
 
     def __init__(
         self,
@@ -493,7 +497,7 @@ class ChaptersService(BaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -535,7 +539,7 @@ class ChaptersService(BaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different chapter.
             AuthorizationError: If you don't have appropriate access.
         """
         await self._delete(

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/campaign_books.py

@@ -33,6 +33,9 @@ class BooksService(BaseService):
     Provides methods to create, retrieve, update, and delete campaign books,
     as well as access book notes and assets.
 
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+
     Example:
         >>> async with VClient() as client:
         ...     books = client.books("company_id", "campaign_id")
@@ -569,7 +572,7 @@ class BooksService(BaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -611,7 +614,7 @@ class BooksService(BaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different book.
             AuthorizationError: If you don't have appropriate access.
         """
         await self._delete(

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/campaigns.py

@@ -32,6 +32,9 @@ class CampaignsService(BaseService):
     Provides methods to create, retrieve, update, and delete campaigns,
     as well as access campaign statistics, assets, and notes.
 
+    Requests return 403 (``AuthorizationError``) when the ``on_behalf_of`` user is
+    UNAPPROVED or DEACTIVATED.
+
     Example:
         >>> async with VClient() as client:
         ...     campaigns = client.campaigns("company_id")
@@ -371,7 +374,7 @@ class CampaignsService(BaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different campaign.
             AuthorizationError: If you don't have appropriate access.
         """
         await self._delete(
@@ -394,7 +397,7 @@ class CampaignsService(BaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/characters.py

@@ -550,7 +550,7 @@ class CharactersService(BaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
+            NotFoundError: If the asset does not exist or belongs to a different character.
             AuthorizationError: If you don't have appropriate access.
         """
         await self._delete(
@@ -573,7 +573,7 @@ class CharactersService(BaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/developers.py

@@ -71,8 +71,10 @@ class DeveloperService(BaseService):
     async def regenerate_api_key(self) -> MeDeveloperWithApiKey:
         """Generate a new API key for the current developer.
 
-        The current key will be immediately invalidated and all cached
-        authentication data will be cleared.
+        The API invalidates the current key at once, so this client switches to
+        the new key for every later request, including those from services it
+        already created. Other clients that still hold the old key get
+        ``AuthenticationError`` until they are given the new one.
 
         **Be certain to save the API key from the response. It will not be displayed again.**
 
@@ -83,4 +85,6 @@ class DeveloperService(BaseService):
             AuthenticationError: If the current API key is invalid.
         """
         response = await self._post(Endpoints.DEVELOPER_ME_NEW_KEY)
-        return MeDeveloperWithApiKey.model_validate(response.json())
+        developer = MeDeveloperWithApiKey.model_validate(response.json())
+        self._client._set_api_key(developer.api_key)  # noqa: SLF001
+        return developer

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/identity.py

@@ -17,7 +17,10 @@ class IdentityService(BaseService):
     ID token for apple/google, an OAuth access token for discord/github). The
     API verifies the credential with the provider and resolves the user in
     order: match by provider ID, auto-link by provider-verified email, or
-    create a new UNAPPROVED user.
+    create a new UNAPPROVED user. Auto-link never replaces an identity: when
+    the email's user already holds a different identity from the same
+    provider, a new user is created instead. OIDC ID tokens must carry
+    ``exp`` and ``iat`` claims.
 
     This service does not require an acting user (no On-Behalf-Of header).
     Authentication is via developer API key only.
@@ -53,7 +56,9 @@ class IdentityService(BaseService):
         The returned ``resolution`` field reports which path the API took:
         ``matched`` (an existing user holds this provider identity), ``linked``
         (the identity was auto-linked onto an existing user by provider-verified
-        email), or ``created`` (a new UNAPPROVED user was registered).
+        email), or ``created`` (a new UNAPPROVED user was registered). An email
+        match whose user already holds a different identity from the same
+        provider resolves to ``created``, not ``linked``.
 
         Args:
             request: A UserIdentifyDTO model, OR pass fields as keyword arguments.

{valentina_python_client-3.5.0 → valentina_python_client-3.5.1}/src/vclient/services/users.py

@@ -642,8 +642,9 @@ class UsersService(BaseService):
             asset_id: The ID of the asset to delete.
 
         Raises:
-            NotFoundError: If the asset does not exist.
-            AuthorizationError: If you don't have appropriate access.
+            NotFoundError: If the asset does not exist or belongs to a different user.
+            AuthorizationError: If the acting user is neither ``user_id`` nor a
+                company admin.
         """
         await self._delete(
             self._format_endpoint(Endpoints.USER_ASSET, user_id=user_id, asset_id=asset_id)
@@ -663,7 +664,7 @@ class UsersService(BaseService):
         Only image files are accepted: PNG, JPEG, GIF, and WEBP. Any other
         upload (documents, audio, video, archives, SVG, or a non-image payload
         mislabeled as an image) is rejected with 400 Bad Request, as are
-        oversized images that trip the decompression-bomb guard. The stored
+        images over 24 megapixels (width x height). The stored
         ``mime_type`` is detected from the file's bytes; the ``content_type``
         argument is ignored server-side and cannot change or bypass the stored
         type. Uploaded assets therefore always have ``asset_type == "image"``.
@@ -679,7 +680,8 @@ class UsersService(BaseService):
 
         Raises:
             NotFoundError: If the user does not exist.
-            AuthorizationError: If you don't have appropriate access.
+            AuthorizationError: If the acting user is neither ``user_id`` nor a
+                company admin.
             ValidationError: If the file is invalid or exceeds size limits.
         """
         if content_type is None:
@@ -702,10 +704,10 @@ class UsersService(BaseService):
     ) -> User:
         """Upload a custom avatar for a user, replacing any existing one.
 
-        Accepts PNG, JPEG, WEBP, or GIF (first frame) up to 5 MB. The server
-        normalizes the image to a 512x512 WebP and it overrides any
-        identity-provider-derived avatar. Requires the ``On-Behalf-Of`` header
-        (permitted for the user themselves or an admin).
+        Accepts PNG, JPEG, WEBP, or GIF (first frame) up to 5 MB and 24
+        megapixels. The server normalizes the image to a 512x512 WebP and it
+        overrides any identity-provider-derived avatar. Requires the
+        ``On-Behalf-Of`` header (permitted for the user themselves or an admin).
 
         Args:
             user_id: The ID of the user to set the avatar for.
@@ -787,7 +789,7 @@ class UsersService(BaseService):
         Args:
             user_id: The ID of the user to award XP to.
             campaign_id: The ID of the campaign to add XP for.
-            amount: The amount of XP to add.
+            amount: The amount of XP to add. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -821,7 +823,7 @@ class UsersService(BaseService):
         Args:
             user_id: The ID of the user to remove XP from.
             campaign_id: The ID of the campaign to remove XP for.
-            amount: The amount of XP to remove.
+            amount: The amount of XP to remove. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -857,7 +859,7 @@ class UsersService(BaseService):
         Args:
             user_id: The ID of the user to award cool points to.
             campaign_id: The ID of the campaign to add cool points for.
-            amount: The amount of cool points to add.
+            amount: The amount of cool points to add. Must be at least 1.
 
         Returns:
             Updated CampaignExperience object.
@@ -1164,7 +1166,8 @@ class UsersService(BaseService):
             The Quickroll object with full details.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have access to the company.
         """
         response = await self._get(
@@ -1231,7 +1234,8 @@ class UsersService(BaseService):
             The updated Quickroll object.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have appropriate access.
             RequestValidationError: If the input parameters fail client-side validation.
             ValidationError: If the request data is invalid.
@@ -1259,7 +1263,8 @@ class UsersService(BaseService):
             quickroll_id: The ID of the quickroll to delete.
 
         Raises:
-            NotFoundError: If the quickroll does not exist.
+            NotFoundError: If the quickroll does not exist or does not belong to
+                ``user_id``.
             AuthorizationError: If you don't have appropriate access.
         """
         await self._delete(