webex-message-handler 0.5.0__tar.gz → 0.6.1__tar.gz

{webex_message_handler-0.5.0 → webex_message_handler-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webex-message-handler
-Version: 0.5.0
+Version: 0.6.1
 Summary: Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK
 Project-URL: Homepage, https://github.com/3rg0n/webex-message-handler
 Project-URL: Repository, https://github.com/3rg0n/webex-message-handler

{webex_message_handler-0.5.0 → webex_message_handler-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "webex-message-handler"
-version = "0.5.0"
+version = "0.6.1"
 description = "Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK"
 readme = "README.md"
 license = "MIT"

{webex_message_handler-0.5.0 → webex_message_handler-0.6.1}/src/webex_message_handler/handler.py

@@ -56,8 +56,8 @@ def extract_person_uuid(person_id: str) -> str:
             uuid = decoded.rsplit("/", 1)[-1]
             if uuid:
                 return uuid
-    except Exception:
-        # Not base64 — treat as raw UUID
+    except (ValueError, UnicodeDecodeError):
+        # Not base64 or invalid UTF-8 — treat as raw UUID
         pass
     return person_id
 
@@ -151,6 +151,7 @@ class WebexMessageHandler:
             session = aiohttp.ClientSession(
                 connector=connector,
                 connector_owner=connector is None,
+                trust_env=True,
             )
             try:
                 response = await session.request(
@@ -189,7 +190,7 @@ class WebexMessageHandler:
         """Create WebSocket adapter using native aiohttp."""
         async def ws_factory(url: str) -> InjectedWebSocket:
             session = aiohttp.ClientSession(connector=connector)
-            ws = await session.ws_connect(url)
+            ws = await session.ws_connect(url, max_msg_size=1 * 1024 * 1024)  # 1MB
 
             # Attach session for cleanup
             ws._session = session  # type: ignore[attr-defined]
@@ -238,7 +239,12 @@ class WebexMessageHandler:
             try:
                 result = callback(*args)
                 if asyncio.iscoroutine(result):
-                    asyncio.ensure_future(result)
+                    task = asyncio.ensure_future(result)
+                    task.add_done_callback(
+                        lambda t, ev=event: self._logger.error(
+                            f"Error in async {ev} listener: {t.exception()}"
+                        ) if not t.cancelled() and t.exception() else None
+                    )
             except Exception as exc:
                 self._logger.error(f"Error in {event} listener: {exc}")
 

{webex_message_handler-0.5.0 → webex_message_handler-0.6.1}/src/webex_message_handler/kms_client.py

@@ -165,6 +165,14 @@ class KmsClient:
             else:
                 remote_ecdh_key = jwk.JWK(**json.loads(remote_jwk_data))
 
+            # Validate remote key type and curve
+            key_type = remote_ecdh_key.get("kty")
+            key_curve = remote_ecdh_key.get("crv")
+            if key_type != "EC" or key_curve != "P-256":
+                raise KmsError(
+                    f"Invalid remote key type: kty={key_type}, crv={key_curve}"
+                )
+
             # Get the remote key URI for use as kid on the derived key
             remote_key_uri = (
                 response_data.get("body", {}).get("key", {}).get("uri")
@@ -289,6 +297,9 @@ class KmsClient:
             ),
         )
 
+        if len(self._pending_requests) >= 100:
+            self._logger.warning("KMS pending requests queue is large (%d), possible leak", len(self._pending_requests))
+
         self._pending_requests[request_id] = _PendingRequest(future=future, timeout_handle=timeout_handle)
 
         # POST the request
@@ -404,7 +415,8 @@ def _derive_ecdh_shared_key(local_key: jwk.JWK, remote_key: jwk.JWK, *, kid: str
         x_int = int.from_bytes(x_bytes, "big")
         y_int = int.from_bytes(y_bytes, "big")
         remote_crypto_key = EllipticCurvePublicNumbers(x_int, y_int, SECP256R1()).public_key()
-    except Exception:
+    except (KeyError, ValueError, TypeError):
+        # Failed to parse JWK or convert coordinates — will be caught below
         pass
 
     if remote_crypto_key is None:

{webex_message_handler-0.5.0 → webex_message_handler-0.6.1}/src/webex_message_handler/mercury_socket.py

@@ -49,6 +49,7 @@ class MercurySocket:
         self._should_reconnect = True
         self._reconnect_attempts = 0
         self._pending_pong_id: str | None = None
+        self._reconnecting = False
 
         self._ping_task: asyncio.Task[None] | None = None
         self._read_task: asyncio.Task[None] | None = None
@@ -111,7 +112,8 @@ class MercurySocket:
 
         # Start read loop in background
         async def _read_loop() -> None:
-            assert self._ws is not None
+            if self._ws is None:
+                raise RuntimeError("WebSocket not initialized before starting read loop")
             try:
                 async for msg in self._ws:
                     if msg.type == aiohttp.WSMsgType.TEXT:
@@ -214,7 +216,8 @@ class MercurySocket:
         self._logger.warning(f"Pong timeout for ping {self._pending_pong_id}, reconnecting")
         self._pending_pong_id = None
         await self._close_websocket()
-        await self._reconnect()
+        if not self._reconnecting:
+            await self._reconnect()
 
     def _handle_message(self, message: dict[str, Any]) -> None:
         try:
@@ -289,37 +292,43 @@ class MercurySocket:
             self._emit("disconnected", "manual")
 
     async def _reconnect(self) -> None:
-        if not self._should_reconnect:
+        if self._reconnecting:
             return
+        self._reconnecting = True
+        try:
+            if not self._should_reconnect:
+                return
 
-        if self._reconnect_attempts >= self._max_reconnect_attempts:
-            self._logger.error(f"Max reconnection attempts ({self._max_reconnect_attempts}) exceeded")
-            self._should_reconnect = False
-            self._emit("disconnected", "max-attempts-exceeded")
-            return
+            if self._reconnect_attempts >= self._max_reconnect_attempts:
+                self._logger.error(f"Max reconnection attempts ({self._max_reconnect_attempts}) exceeded")
+                self._should_reconnect = False
+                self._emit("disconnected", "max-attempts-exceeded")
+                return
 
-        self._reconnect_attempts += 1
-        delay = min(1.0 * math.pow(2, self._reconnect_attempts - 1), self._reconnect_backoff_max)
+            self._reconnect_attempts += 1
+            delay = min(1.0 * math.pow(2, self._reconnect_attempts - 1), self._reconnect_backoff_max)
 
-        self._logger.info(
-            f"Reconnecting (attempt {self._reconnect_attempts}/{self._max_reconnect_attempts}) in {delay}s"
-        )
-        self._emit("reconnecting", self._reconnect_attempts)
+            self._logger.info(
+                f"Reconnecting (attempt {self._reconnect_attempts}/{self._max_reconnect_attempts}) in {delay}s"
+            )
+            self._emit("reconnecting", self._reconnect_attempts)
 
-        await asyncio.sleep(delay)
+            await asyncio.sleep(delay)
 
-        if not self._should_reconnect:
-            return
+            if not self._should_reconnect:
+                return
 
-        try:
-            await self._connect_internal()
-            self._logger.info("Successfully reconnected to Mercury")
-            self._reconnect_attempts = 0
-            self._emit("connected")
-        except Exception as exc:
-            self._logger.error(f"Reconnection failed: {exc}")
-            if self._should_reconnect:
-                await self._reconnect()
+            try:
+                await self._connect_internal()
+                self._logger.info("Successfully reconnected to Mercury")
+                self._reconnect_attempts = 0
+                self._emit("connected")
+            except Exception as exc:
+                self._logger.error(f"Reconnection failed: {exc}")
+                if self._should_reconnect:
+                    await self._reconnect()
+        finally:
+            self._reconnecting = False
 
     def _stop_ping_loop(self) -> None:
         if self._ping_task and not self._ping_task.done():
@@ -331,8 +340,14 @@ class MercurySocket:
         self._pending_pong_id = None
 
     async def _close_websocket(self) -> None:
-        if self._ws and not self._ws.closed:
-            await self._ws.close(code=1000)
+        if self._ws is not None:
+            # Close attached session if present (native mode)
+            session = getattr(self._ws, '_session', None)
+            if session and not session.closed:
+                await session.close()
+            if not self._ws.closed:
+                await self._ws.close(code=1000)
+            self._ws = None
 
     async def _cleanup_ws(self) -> None:
         self._stop_ping_loop()

webex_message_handler-0.6.1/test-proxy.py

@@ -0,0 +1,79 @@
+"""Proxy validation test via mitmproxy.
+
+Run with: WEBEX_BOT_TOKEN=... python test-proxy.py
+Requires mitmproxy running on localhost:8080.
+"""
+
+import asyncio
+import os
+import ssl
+import sys
+
+import aiohttp
+from aiohttp import TCPConnector
+
+# Add src to path for local development
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "src"))
+
+from webex_message_handler import WebexMessageHandler, WebexMessageHandlerConfig, console_logger
+
+
+async def main() -> None:
+    token = os.environ.get("WEBEX_BOT_TOKEN")
+    if not token:
+        print("Error: WEBEX_BOT_TOKEN environment variable not set")
+        sys.exit(1)
+
+    proxy_url = os.environ.get("HTTPS_PROXY", "http://localhost:8080")
+    # Set HTTPS_PROXY so aiohttp's trust_env picks it up
+    os.environ["HTTPS_PROXY"] = proxy_url
+    os.environ["HTTP_PROXY"] = proxy_url
+
+    print(f"\n=== Webex Proxy Test (Python) ===")
+    print(f"Using proxy: {proxy_url}\n")
+
+    # Create aiohttp connector with disabled SSL verification for mitmproxy
+    ssl_ctx = ssl.create_default_context()
+    ssl_ctx.check_hostname = False
+    ssl_ctx.verify_mode = ssl.CERT_NONE
+
+    connector = TCPConnector(ssl=ssl_ctx)
+
+    config = WebexMessageHandlerConfig(
+        token=token,
+        connector=connector,
+        logger=console_logger,
+    )
+
+    handler = WebexMessageHandler(config)
+
+    connected_event = asyncio.Event()
+
+    @handler.on("connected")
+    def on_connected() -> None:
+        print("\nSUCCESS: Connected through proxy!")
+        print("   - Device registered")
+        print("   - Mercury WebSocket connected")
+        print("   - KMS initialized")
+        connected_event.set()
+
+    @handler.on("error")
+    def on_error(err: Exception) -> None:
+        print(f"\nERROR: {err}")
+        sys.exit(1)
+
+    print("Connecting to Webex through proxy...")
+    try:
+        await handler.connect()
+        await asyncio.sleep(3)
+        print("\nProxy validation complete - disconnecting...\n")
+        await handler.disconnect()
+        await connector.close()
+        print("SUCCESS: Python proxy test passed")
+    except Exception as e:
+        print(f"FAILED: {e}")
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())