webex-message-handler 0.6.11__tar.gz → 0.6.13__tar.gz

{webex_message_handler-0.6.11 → webex_message_handler-0.6.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webex-message-handler
-Version: 0.6.11
+Version: 0.6.13
 Summary: Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK
 Project-URL: Homepage, https://github.com/3rg0n/webex-message-handler
 Project-URL: Repository, https://github.com/3rg0n/webex-message-handler
@@ -19,11 +19,10 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Communications :: Chat
 Requires-Python: >=3.10
-Requires-Dist: aiohttp>=3.13.4
-Requires-Dist: cryptography>=46.0.7
+Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: cryptography>=48.0.1
 Requires-Dist: jwcrypto>=1.5.7
 Provides-Extra: dev
-Requires-Dist: aioresponses>=0.7; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
 Requires-Dist: pytest>=7; extra == 'dev'
@@ -34,6 +33,8 @@ Description-Content-Type: text/markdown
 
 Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages — no Webex SDK required.
 
+📖 **[Documentation & overview →](https://3rg0n.github.io/webex-message-handler/)**
+
 Python port of the [TypeScript webex-message-handler](https://github.com/ecopelan/webex-message-handler).
 
 ## Why?

{webex_message_handler-0.6.11 → webex_message_handler-0.6.13}/README.md

@@ -2,6 +2,8 @@
 
 Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages — no Webex SDK required.
 
+📖 **[Documentation & overview →](https://3rg0n.github.io/webex-message-handler/)**
+
 Python port of the [TypeScript webex-message-handler](https://github.com/ecopelan/webex-message-handler).
 
 ## Why?

{webex_message_handler-0.6.11 → webex_message_handler-0.6.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "webex-message-handler"
-version = "0.6.11"
+version = "0.6.13"
 description = "Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK"
 readme = "README.md"
 license = "MIT"
@@ -26,8 +26,8 @@ classifiers = [
     "Framework :: AsyncIO",
 ]
 dependencies = [
-    "aiohttp>=3.13.4",
-    "cryptography>=46.0.7",
+    "aiohttp>=3.14.1",
+    "cryptography>=48.0.1",
     "jwcrypto>=1.5.7",
 ]
 
@@ -57,7 +57,6 @@ strict = true
 dev = [
     "pytest>=7",
     "pytest-asyncio>=0.23",
-    "aioresponses>=0.7",
     "ruff>=0.4",
     "mypy>=1.10",
 ]

{webex_message_handler-0.6.11 → webex_message_handler-0.6.13}/src/webex_message_handler/device_manager.py

@@ -37,13 +37,48 @@ class DeviceManager:
         self._device_url: str | None = None
 
     async def register(self, token: str) -> DeviceRegistration:
-        """Register a new device with WDM."""
+        """Register a new device with WDM.
+
+        To avoid leaking a new device on every Connect() (which eventually trips the
+        Webex per-user device cap → HTTP 403), it first lists existing devices and
+        reuses/refreshes one matching this client's name+deviceType. Only when no
+        reusable device exists does it POST a new one. If registration fails because
+        the account already has excessive registrations, it reaps this client's own
+        devices and retries once.
+        """
         self._logger.debug("Registering device with WDM")
 
+        # Reuse-before-register: if a device of ours already exists, refresh it.
+        existing_url = await self._find_reusable_device(token)
+        if existing_url:
+            self._device_url = existing_url
+            try:
+                reg = await self.refresh(token)
+                self._logger.info("Reused existing WDM device registration")
+                return reg
+            except Exception:
+                # Refresh failed (device stale/deleted server-side) — fall through to
+                # create a fresh one.
+                self._device_url = None
+
         try:
+            reg = await self._create_device(token)
+        except DeviceRegistrationError as exc:
+            if self._is_excessive_registrations_error(exc):
+                msg = "Excessive device registrations detected — reaping this client's devices and retrying"
+                self._logger.warning(msg)
+                await self._reap_own_devices(token)
+                return await self._create_device(token)
+            raise
+        return reg
+
+    async def _create_device(self, token: str) -> DeviceRegistration:
+        """Perform the raw POST /devices registration."""
+        try:
+            create_url = f"{WDM_API_BASE}?includeUpstreamServices=all"
             response = await self._http_do(
                 FetchRequest(
-                    url=WDM_API_BASE,
+                    url=create_url,
                     method="POST",
                     headers={
                         "Authorization": f"Bearer {token}",
@@ -73,6 +108,83 @@ class DeviceManager:
             self._logger.error(f"Device registration error: {exc}")
             raise DeviceRegistrationError("Failed to register device") from exc
 
+    async def _find_reusable_device(self, token: str) -> str | None:
+        """List existing WDM devices and return the URL of one matching this
+        client's name+deviceType, or None if none/on any error (in which case the
+        caller falls back to creating a new device — best-effort, never fatal).
+        """
+        try:
+            devices = await self._list_devices(token)
+            for device in devices:
+                device_data: dict[str, Any] = device if isinstance(device, dict) else device.__dict__
+                if (
+                    device_data.get("name") == _DEVICE_BODY["name"]
+                    and device_data.get("deviceType") == _DEVICE_BODY["deviceType"]
+                    and device_data.get("url")
+                ):
+                    return device_data["url"]
+        except Exception as exc:
+            self._logger.debug(f"Could not list existing devices (will create new): {exc}")
+        return None
+
+    async def _reap_own_devices(self, token: str) -> None:
+        """Best-effort deletes all WDM devices matching this client's
+        name+deviceType, to recover from the per-user device cap. Never fatal.
+        """
+        try:
+            devices = await self._list_devices(token)
+            reaped = 0
+            for device in devices:
+                device_data: dict[str, Any] = device if isinstance(device, dict) else device.__dict__
+                if (
+                    device_data.get("name") != _DEVICE_BODY["name"]
+                    or device_data.get("deviceType") != _DEVICE_BODY["deviceType"]
+                    or not device_data.get("url")
+                ):
+                    continue
+                try:
+                    resp = await self._http_do(
+                        FetchRequest(
+                            url=device_data["url"],
+                            method="DELETE",
+                            headers={"Authorization": f"Bearer {token}"},
+                        )
+                    )
+                    if resp.ok or resp.status == 404:
+                        reaped += 1
+                except Exception as exc:
+                    self._logger.debug(f"Failed to reap device {device_data.get('url')}: {exc}")
+            self._logger.info(f"Reaped {reaped} stale WDM device(s)")
+        except Exception as exc:
+            self._logger.warning(f"Could not list devices to reap: {exc}")
+
+    async def _list_devices(self, token: str) -> list[Any]:
+        """Fetches the account's current WDM device registrations."""
+        response = await self._http_do(
+            FetchRequest(
+                url=WDM_API_BASE,
+                method="GET",
+                headers={"Authorization": f"Bearer {token}"},
+            )
+        )
+
+        if response.status == 401:
+            raise AuthError("Unauthorized to list devices")
+
+        if not response.ok:
+            raise DeviceRegistrationError(
+                f"Failed to list devices: {response.status}",
+                response.status,
+            )
+
+        data = await response.json()
+        return data.get("devices", [])
+
+    @staticmethod
+    def _is_excessive_registrations_error(error: Exception) -> bool:
+        """Report whether error is the WDM per-user device cap rejection (HTTP 403)."""
+        return isinstance(error, DeviceRegistrationError) and error.status_code == 403
+
     async def refresh(self, token: str) -> DeviceRegistration:
         """Refresh an existing device registration."""
         if not self._device_url:

{webex_message_handler-0.6.11 → webex_message_handler-0.6.13}/src/webex_message_handler/mention_parser.py

@@ -14,9 +14,12 @@ class ParsedMentions:
     mentioned_groups: list[str] = field(default_factory=list)
 
 
-_MENTION_RE = re.compile(
-    r'<spark-mention[^>]*data-object-type="([^"]*)"[^>]*>', re.IGNORECASE
-)
+# Match the whole opening tag with a single bounded ``[^>]*`` (linear), then
+# pull attributes out of the captured tag. A prior form used two ``[^>]*``
+# around the attribute, which is a polynomial-ReDoS risk under Python's
+# backtracking ``re`` engine on crafted ``<spark-mention…`` input.
+_MENTION_RE = re.compile(r"<spark-mention[^>]*>", re.IGNORECASE)
+_OBJECT_TYPE_RE = re.compile(r'data-object-type="([^"]*)"', re.IGNORECASE)
 _PERSON_ID_RE = re.compile(r'data-object-id="([^"]*)"', re.IGNORECASE)
 _GROUP_TYPE_RE = re.compile(r'data-group-type="([^"]*)"', re.IGNORECASE)
 
@@ -41,7 +44,8 @@ def parse_mentions(html: str | None) -> ParsedMentions:
 
     for match in _MENTION_RE.finditer(html):
         tag = match.group(0)
-        object_type = match.group(1)
+        type_match = _OBJECT_TYPE_RE.search(tag)
+        object_type = type_match.group(1) if type_match else ""
 
         if object_type == "person":
             id_match = _PERSON_ID_RE.search(tag)

webex_message_handler-0.6.13/tests/conftest.py

@@ -0,0 +1,89 @@
+"""Pytest configuration and fixtures."""
+
+import json as _json
+
+import aiohttp
+
+from webex_message_handler.types import FetchRequest, FetchResponse
+
+
+class MockHttpResponse:
+    """A canned FetchResponse for the injected http_do adapter."""
+
+    def __init__(self, status: int = 200, payload=None, *, exc: Exception | None = None):
+        self.status = status
+        self.ok = 200 <= status < 300
+        self._payload = payload
+        self._exc = exc
+
+    async def json(self):
+        return self._payload
+
+    async def text(self):
+        return _json.dumps(self._payload) if self._payload is not None else ""
+
+
+class MockHttpDo:
+    """Mocks HTTP at the injected ``http_do`` seam instead of patching aiohttp.
+
+    Register canned responses keyed by ``(METHOD, url)``; the adapter pops them
+    in registration order so repeated calls to the same endpoint can return
+    different responses. A registered ``Exception`` is raised to simulate a
+    network failure (mirroring the handler's try/except path).
+    """
+
+    def __init__(self):
+        self._routes: dict[tuple[str, str], list] = {}
+        self.calls: list[FetchRequest] = []
+
+    def add(self, method: str, url: str, *, status: int = 200, payload=None, exc: Exception | None = None):
+        self._routes.setdefault((method.upper(), url), []).append(
+            MockHttpResponse(status=status, payload=payload, exc=exc)
+        )
+        return self
+
+    async def __call__(self, request: FetchRequest) -> FetchResponse:
+        self.calls.append(request)
+        key = (request.method.upper(), request.url)
+        queue = self._routes.get(key)
+        if not queue:
+            raise AssertionError(f"unexpected request: {request.method} {request.url}")
+        response = queue.pop(0) if len(queue) > 1 else queue[0]
+        if response._exc is not None:
+            raise response._exc
+        return response  # type: ignore[return-value]
+
+
+async def create_test_http_do(connector: aiohttp.BaseConnector | None = None):
+    """Create a test HTTP adapter for use in tests."""
+    async def http_do(request: FetchRequest) -> FetchResponse:
+        async with (
+            aiohttp.ClientSession(connector=connector) as session,
+            session.request(
+                request.method,
+                request.url,
+                headers=request.headers,
+                data=request.body,
+            ) as response,
+        ):
+                # Eagerly read the response body before the context closes
+                body_bytes = await response.read()
+                status = response.status
+                ok = 200 <= status < 300
+
+                class TestFetchResponse:
+                    def __init__(self):
+                        self.status = status
+                        self.ok = ok
+                        self._body = body_bytes
+
+                    async def json(self):
+                        import json
+                        return json.loads(self._body.decode('utf-8'))
+
+                    async def text(self):
+                        return self._body.decode('utf-8')
+
+                return TestFetchResponse()  # type: ignore[return-value]
+
+    return http_do

webex_message_handler-0.6.13/tests/test_device_manager.py

@@ -0,0 +1,275 @@
+"""Tests for DeviceManager."""
+
+import pytest
+
+from tests.conftest import MockHttpDo
+from webex_message_handler.device_manager import WDM_API_BASE, DeviceManager
+from webex_message_handler.errors import AuthError, DeviceRegistrationError
+
+MOCK_TOKEN = "test-token"
+MOCK_DEVICE_URL = "https://wdm-a.wbx2.com/wdm/api/v1/devices/test-device-id"
+MOCK_WS_URL = "wss://mercury.example.com/socket"
+MOCK_USER_ID = "user-123"
+
+MOCK_WDM_RESPONSE = {
+    "webSocketUrl": MOCK_WS_URL,
+    "url": MOCK_DEVICE_URL,
+    "userId": MOCK_USER_ID,
+    "services": {
+        "encryptionServiceUrl": "https://encryption.example.com",
+        "messenger": "https://messenger.example.com",
+    },
+}
+
+
+class TestRegister:
+    async def test_successful_registration(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert result.web_socket_url == MOCK_WS_URL
+        assert result.device_url == MOCK_DEVICE_URL
+        assert result.user_id == MOCK_USER_ID
+        assert result.encryption_service_url == "https://encryption.example.com"
+        assert result.services["messenger"] == "https://messenger.example.com"
+
+    async def test_auth_error_on_401(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", status=401)  # create fails with 401
+        )
+        dm = DeviceManager(http_do=http_do)
+        with pytest.raises(AuthError):
+            await dm.register(MOCK_TOKEN)
+
+    async def test_device_registration_error_on_non_2xx(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", status=400)  # create fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        with pytest.raises(DeviceRegistrationError, match="Failed to register device"):
+            await dm.register(MOCK_TOKEN)
+
+    async def test_device_registration_error_on_network_failure(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add(
+                "POST",
+                f"{WDM_API_BASE}?includeUpstreamServices=all",
+                exc=ConnectionError("Network error"),
+            )  # create fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        with pytest.raises(DeviceRegistrationError):
+            await dm.register(MOCK_TOKEN)
+
+
+class TestRefresh:
+    async def test_successful_refresh(self):
+        refreshed = {**MOCK_WDM_RESPONSE, "webSocketUrl": "wss://mercury-new.example.com/socket"}
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("PUT", MOCK_DEVICE_URL, payload=refreshed)  # refresh
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        result = await dm.refresh(MOCK_TOKEN)
+
+        assert result.web_socket_url == "wss://mercury-new.example.com/socket"
+
+    async def test_error_if_not_registered(self):
+        http_do = MockHttpDo()
+        dm = DeviceManager(http_do=http_do)
+        with pytest.raises(DeviceRegistrationError, match="Device not registered"):
+            await dm.refresh(MOCK_TOKEN)
+
+    async def test_auth_error_on_401_during_refresh(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("PUT", MOCK_DEVICE_URL, status=401)  # refresh fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        with pytest.raises(AuthError):
+            await dm.refresh(MOCK_TOKEN)
+
+    async def test_device_registration_error_on_refresh_failure(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("PUT", MOCK_DEVICE_URL, status=500)  # refresh fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        with pytest.raises(DeviceRegistrationError):
+            await dm.refresh(MOCK_TOKEN)
+
+
+class TestUnregister:
+    async def test_successful_unregister(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("DELETE", MOCK_DEVICE_URL, status=204)  # unregister
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        await dm.unregister(MOCK_TOKEN)
+
+    async def test_error_if_not_registered(self):
+        http_do = MockHttpDo()
+        dm = DeviceManager(http_do=http_do)
+        with pytest.raises(DeviceRegistrationError, match="Device not registered"):
+            await dm.unregister(MOCK_TOKEN)
+
+    async def test_auth_error_on_401_during_unregister(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("DELETE", MOCK_DEVICE_URL, status=401)  # unregister fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        with pytest.raises(AuthError):
+            await dm.unregister(MOCK_TOKEN)
+
+    async def test_device_registration_error_on_unregister_failure(self):
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create
+            .add("DELETE", MOCK_DEVICE_URL, status=500)  # unregister fails
+        )
+        dm = DeviceManager(http_do=http_do)
+        await dm.register(MOCK_TOKEN)
+        with pytest.raises(DeviceRegistrationError):
+            await dm.unregister(MOCK_TOKEN)
+
+
+class TestServiceParsing:
+    async def test_empty_services(self):
+        response = {**MOCK_WDM_RESPONSE, "services": {}}
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=response)  # create
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert result.services == {}
+        assert result.encryption_service_url == ""
+
+    async def test_missing_encryption_service_url(self):
+        response = {**MOCK_WDM_RESPONSE, "services": {"messenger": "https://messenger.example.com"}}
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=response)  # create
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert "messenger" in result.services
+        assert result.encryption_service_url == ""
+
+
+class TestDeviceReuseAndReaping:
+    async def test_reuses_existing_device_and_calls_refresh_instead_of_create(self):
+        """Verify that when a device matching name+deviceType already exists,
+        Register refreshes it (PUT) instead of creating a new one (POST).
+        """
+        http_do = (
+            MockHttpDo()
+            .add(
+                "GET",
+                WDM_API_BASE,
+                payload={
+                    "devices": [
+                        {
+                            "webSocketUrl": MOCK_WS_URL,
+                            "url": MOCK_DEVICE_URL,
+                            "userId": MOCK_USER_ID,
+                            "name": "webex-message-handler",
+                            "deviceType": "DESKTOP",
+                            "services": {},
+                        }
+                    ]
+                },
+            )
+            .add("PUT", MOCK_DEVICE_URL, payload=MOCK_WDM_RESPONSE)
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert result.device_url == MOCK_DEVICE_URL
+        # Should be: GET (list) + PUT (refresh)
+        assert len(http_do.calls) == 2
+        assert http_do.calls[0].method == "GET"
+        assert http_do.calls[1].method == "PUT"
+
+    async def test_reaps_devices_on_403_and_retries_create(self):
+        """Verify that a 403 on create triggers reaping of this client's own
+        devices followed by a single retry.
+        """
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, payload={"devices": []})  # reuse check: empty
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", status=403)  # first POST fails
+            .add(
+                "GET",
+                WDM_API_BASE,
+                payload={
+                    "devices": [
+                        {
+                            "url": f"{MOCK_DEVICE_URL}/old",
+                            "name": "webex-message-handler",
+                            "deviceType": "DESKTOP",
+                        }
+                    ]
+                },
+            )  # reap: return device to delete
+            .add("DELETE", f"{MOCK_DEVICE_URL}/old", status=204)  # delete old device
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # retry POST
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert result.device_url == MOCK_DEVICE_URL
+        # Should be: GET (reuse) + POST (403) + GET (reap) + DELETE + POST (retry)
+        assert len(http_do.calls) == 5
+        assert http_do.calls[0].method == "GET"
+        assert http_do.calls[1].method == "POST"
+        assert http_do.calls[2].method == "GET"
+        assert http_do.calls[3].method == "DELETE"
+        assert http_do.calls[4].method == "POST"
+
+    async def test_falls_back_to_create_when_list_fails(self):
+        """Verify that when list fails, register falls back to create."""
+        http_do = (
+            MockHttpDo()
+            .add("GET", WDM_API_BASE, status=500)  # list fails
+            .add("POST", f"{WDM_API_BASE}?includeUpstreamServices=all", payload=MOCK_WDM_RESPONSE)  # create succeeds
+        )
+        dm = DeviceManager(http_do=http_do)
+        result = await dm.register(MOCK_TOKEN)
+
+        assert result.device_url == MOCK_DEVICE_URL
+        # Should be: GET (list fails) + POST (create succeeds)
+        assert len(http_do.calls) == 2

webex_message_handler-0.6.13/tests/test_mention_parser.py

@@ -0,0 +1,62 @@
+"""Tests for the mention parser, including a ReDoS regression guard."""
+
+import time
+
+from webex_message_handler.mention_parser import parse_mentions
+
+
+def test_empty_inputs():
+    for v in (None, ""):
+        r = parse_mentions(v)
+        assert r.mentioned_people == []
+        assert r.mentioned_groups == []
+
+
+def test_single_person_mention():
+    html = '<spark-mention data-object-type="person" data-object-id="uuid-1">Alice</spark-mention>'
+    r = parse_mentions(html)
+    assert r.mentioned_people == ["uuid-1"]
+    assert r.mentioned_groups == []
+
+
+def test_multiple_person_mentions_dedup():
+    html = (
+        '<spark-mention data-object-type="person" data-object-id="uuid-1">A</spark-mention>'
+        '<spark-mention data-object-type="person" data-object-id="uuid-2">B</spark-mention>'
+        '<spark-mention data-object-type="person" data-object-id="uuid-1">A</spark-mention>'
+    )
+    assert parse_mentions(html).mentioned_people == ["uuid-1", "uuid-2"]
+
+
+def test_group_mention():
+    html = '<spark-mention data-object-type="groupMention" data-group-type="all">All</spark-mention>'
+    r = parse_mentions(html)
+    assert r.mentioned_people == []
+    assert r.mentioned_groups == ["all"]
+
+
+def test_attribute_order_independent():
+    html = (
+        '<spark-mention data-object-id="uuid-9" data-object-type="person">X</spark-mention>'
+        '<spark-mention data-group-type="all" data-object-type="groupMention">All</spark-mention>'
+    )
+    r = parse_mentions(html)
+    assert r.mentioned_people == ["uuid-9"]
+    assert r.mentioned_groups == ["all"]
+
+
+def test_ignores_non_mention_html():
+    r = parse_mentions("<p>hello <b>world</b></p>")
+    assert r.mentioned_people == []
+    assert r.mentioned_groups == []
+
+
+def test_no_polynomial_backtracking_redos_guard():
+    """Crafted input that made the old two-[^>]* regex backtrack must parse fast."""
+    evil = "<spark-mention" + ' data-object-type="' * 50000
+    start = time.monotonic()
+    r = parse_mentions(evil)
+    elapsed = time.monotonic() - start
+    assert r.mentioned_people == []
+    assert r.mentioned_groups == []
+    assert elapsed < 1.0

webex_message_handler-0.6.11/tests/conftest.py

@@ -1,40 +0,0 @@
-"""Pytest configuration and fixtures."""
-
-import aiohttp
-
-from webex_message_handler.types import FetchRequest, FetchResponse
-
-
-async def create_test_http_do(connector: aiohttp.BaseConnector | None = None):
-    """Create a test HTTP adapter for use in tests."""
-    async def http_do(request: FetchRequest) -> FetchResponse:
-        async with (
-            aiohttp.ClientSession(connector=connector) as session,
-            session.request(
-                request.method,
-                request.url,
-                headers=request.headers,
-                data=request.body,
-            ) as response,
-        ):
-                # Eagerly read the response body before the context closes
-                body_bytes = await response.read()
-                status = response.status
-                ok = 200 <= status < 300
-
-                class TestFetchResponse:
-                    def __init__(self):
-                        self.status = status
-                        self.ok = ok
-                        self._body = body_bytes
-
-                    async def json(self):
-                        import json
-                        return json.loads(self._body.decode('utf-8'))
-
-                    async def text(self):
-                        return self._body.decode('utf-8')
-
-                return TestFetchResponse()  # type: ignore[return-value]
-
-    return http_do

webex_message_handler-0.6.11/tests/test_device_manager.py

@@ -1,164 +0,0 @@
-"""Tests for DeviceManager."""
-
-import pytest
-from aioresponses import aioresponses
-
-from tests.conftest import create_test_http_do
-from webex_message_handler.device_manager import WDM_API_BASE, DeviceManager
-from webex_message_handler.errors import AuthError, DeviceRegistrationError
-
-MOCK_TOKEN = "test-token"
-MOCK_DEVICE_URL = "https://wdm-a.wbx2.com/wdm/api/v1/devices/test-device-id"
-MOCK_WS_URL = "wss://mercury.example.com/socket"
-MOCK_USER_ID = "user-123"
-
-MOCK_WDM_RESPONSE = {
-    "webSocketUrl": MOCK_WS_URL,
-    "url": MOCK_DEVICE_URL,
-    "userId": MOCK_USER_ID,
-    "services": {
-        "encryptionServiceUrl": "https://encryption.example.com",
-        "messenger": "https://messenger.example.com",
-    },
-}
-
-
-class TestRegister:
-    async def test_successful_registration(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            result = await dm.register(MOCK_TOKEN)
-
-        assert result.web_socket_url == MOCK_WS_URL
-        assert result.device_url == MOCK_DEVICE_URL
-        assert result.user_id == MOCK_USER_ID
-        assert result.encryption_service_url == "https://encryption.example.com"
-        assert result.services["messenger"] == "https://messenger.example.com"
-
-    async def test_auth_error_on_401(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, status=401)
-            with pytest.raises(AuthError):
-                await dm.register(MOCK_TOKEN)
-
-    async def test_device_registration_error_on_non_2xx(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, status=400)
-            with pytest.raises(DeviceRegistrationError, match="Failed to register device"):
-                await dm.register(MOCK_TOKEN)
-
-    async def test_device_registration_error_on_network_failure(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, exception=ConnectionError("Network error"))
-            with pytest.raises(DeviceRegistrationError):
-                await dm.register(MOCK_TOKEN)
-
-
-class TestRefresh:
-    async def test_successful_refresh(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-
-            refreshed = {**MOCK_WDM_RESPONSE, "webSocketUrl": "wss://mercury-new.example.com/socket"}
-            m.put(MOCK_DEVICE_URL, payload=refreshed)
-            result = await dm.refresh(MOCK_TOKEN)
-
-        assert result.web_socket_url == "wss://mercury-new.example.com/socket"
-
-    async def test_error_if_not_registered(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with pytest.raises(DeviceRegistrationError, match="Device not registered"):
-            await dm.refresh(MOCK_TOKEN)
-
-    async def test_auth_error_on_401_during_refresh(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-            m.put(MOCK_DEVICE_URL, status=401)
-            with pytest.raises(AuthError):
-                await dm.refresh(MOCK_TOKEN)
-
-    async def test_device_registration_error_on_refresh_failure(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-            m.put(MOCK_DEVICE_URL, status=500)
-            with pytest.raises(DeviceRegistrationError):
-                await dm.refresh(MOCK_TOKEN)
-
-
-class TestUnregister:
-    async def test_successful_unregister(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-            m.delete(MOCK_DEVICE_URL, status=204)
-            await dm.unregister(MOCK_TOKEN)
-
-    async def test_error_if_not_registered(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with pytest.raises(DeviceRegistrationError, match="Device not registered"):
-            await dm.unregister(MOCK_TOKEN)
-
-    async def test_auth_error_on_401_during_unregister(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-            m.delete(MOCK_DEVICE_URL, status=401)
-            with pytest.raises(AuthError):
-                await dm.unregister(MOCK_TOKEN)
-
-    async def test_device_registration_error_on_unregister_failure(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=MOCK_WDM_RESPONSE)
-            await dm.register(MOCK_TOKEN)
-            m.delete(MOCK_DEVICE_URL, status=500)
-            with pytest.raises(DeviceRegistrationError):
-                await dm.unregister(MOCK_TOKEN)
-
-
-class TestServiceParsing:
-    async def test_empty_services(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        response = {**MOCK_WDM_RESPONSE, "services": {}}
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=response)
-            result = await dm.register(MOCK_TOKEN)
-
-        assert result.services == {}
-        assert result.encryption_service_url == ""
-
-    async def test_missing_encryption_service_url(self):
-        http_do = await create_test_http_do()
-        dm = DeviceManager(http_do=http_do)
-        response = {**MOCK_WDM_RESPONSE, "services": {"messenger": "https://messenger.example.com"}}
-        with aioresponses() as m:
-            m.post(WDM_API_BASE, payload=response)
-            result = await dm.register(MOCK_TOKEN)
-
-        assert "messenger" in result.services
-        assert result.encryption_service_url == ""