Metadata-Version: 2.5
Name: pybotx-registration
Version: 0.1.0
Summary: Secure BotX secret-delivery protocol implementation for pybotx bots
Requires-Python: >=3.11
Requires-Dist: asyncpg<1,>=0.29
Requires-Dist: dependency-injector>=4.41
Requires-Dist: fastapi<1,>=0.115
Requires-Dist: pydantic<3,>=2.8
Requires-Dist: pynacl<2,>=1.5
Requires-Dist: sqlalchemy[asyncio]<3,>=2.0
Provides-Extra: dev
Requires-Dist: check-wheel-contents<1,>=0.6; extra == 'dev'
Requires-Dist: httpx<1,>=0.27; extra == 'dev'
Requires-Dist: mypy<2,>=1.13; extra == 'dev'
Requires-Dist: pybotx==0.77.0; extra == 'dev'
Requires-Dist: pytest-asyncio<1,>=0.24; extra == 'dev'
Requires-Dist: pytest-cov<7,>=6; extra == 'dev'
Requires-Dist: pytest<9,>=8; extra == 'dev'
Requires-Dist: ruff<1,>=0.8; extra == 'dev'
Description-Content-Type: text/markdown

# pybotx-registration

Implementation foundation for the BotX automatic secret-delivery protocol:

- `GET /public_key` returns a Base64-encoded Libsodium public key;
- `POST /register` accepts a sealed `secret_key` and persists it only after
  re-encrypting it for storage;
- duplicate registration never changes an existing credential;
- the request path is authenticated, bounded and validates `server_host` before
  it becomes an outbound endpoint.

The package deliberately has no business handlers and no access to a plaintext
secret outside its account-provider boundary.


## Local verification

```bash
python -m venv .venv
.venv/bin/pip install -e '.[dev]'
.venv/bin/pytest
```

The tests exercise real Libsodium sealed-box encryption/decryption, HTTP
contract responses, durable-at-service-boundary storage semantics, duplicate
and concurrent delivery, lifecycle transitions, and the pybotx API gate.

## Production adapters

`InMemoryRegistrationRepository` and `LocalSecretBoxCipher` are test/dev
adapters only. Before deployment replace them with a PostgreSQL repository
with `UNIQUE(server_id, bot_id)` and a KMS/Vault envelope-encryption adapter.
Use mTLS or `AllowlistedPeerAuthenticator` on a directly connected,
correctly terminated private-network ingress for the router.
