Add iOS auth functionality - #3
Merged
Merged
Conversation
Paprika's login does not actually require the RSA-signed purchase license to issue a token: the v1 login endpoint accepts email and password alone, and that token works against the v2 sync endpoints. This unblocks iOS users, whose license lives in the system keychain rather than the local SQLite database, so the `purchases` table needed for license decryption never exists (issue #1). - auth: add Auth.authenticate_password_only(); credentials fall back to KAPPARI_EMAIL / KAPPARI_PASSWORD - network_client: authenticate() now takes optional license_data and signature; password-only login goes through v1, and login response parsing is shared - config: a database is no longer required to construct Config/Auth; license decryption still validates db_file itself - docs: correct authentication.md and crypto.md, which stated the RSA signature was mandatory, and document the password-only flow - tests: add a live password-only authentication test Closes #1
Add password-only authentication for license-free login
Closed
johnwbyrd
approved these changes
May 31, 2026
johnwbyrd
left a comment
johnwbyrd
left a comment
Owner
There was a problem hiding this comment.
LGTM, at least as a first draft. Little concerned about leaning back on the v1 API, but it's better than what I currently have.
Owner
|
Can you take a look at the ruff error and clean up please? Thanks! |
This commit addresses improvements across the dependency management, development environment setup, and core library code. Changes include: * **Dependency Management:** Updated `pyproject.toml` to utilize the modern `[dependency-groups]` format. * **Lock File:** Introduced `uv.lock` to ensure highly reproducible dependency environments. * **Documentation:** Updated the `README.md` to recommend `uv sync` as the primary method for installing development dependencies. * **Code Refactor:** Renamed `filename` to `_filename` in `kappari/network_client.py` to pass ruff check.
Owner
|
nvm I took care of it! Thanks very much! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Paprika's login doesn't actually require the RSA-signed purchase license to issue a token. The v1 login endpoint (POST /api/v1/account/login/) accepts email + password alone, and that token works against the v2 sync endpoints. This unblocks iOS users, whose license lives in the system keychain rather than the SQLite DB — so the purchases table needed for license decryption never exists. Addresses #1.
Changes*
Auth.authenticate_password_only() — logs in with credentials only (falls back to KAPPARI_EMAIL / KAPPARI_PASSWORD)
NetworkClient.authenticate() now takes optional license_data/signature; password-only login routes through v1; shared response parsing
Config no longer requires a database to construct (license decryption still validates db_file itself)
Corrected authentication.md / crypto.md, which stated the RSA signature was mandatory; documented the password-only flow
Added a live password-only auth test