From 8acef3605899b5f810dfefaca2db6ae0621bec8e Mon Sep 17 00:00:00 2001
From: Maurits van Rees <maurits@vanrees.org>
Date: Sun, 16 Jun 2024 13:12:01 +0200
Subject: [PATCH 1/5] Skip testing the crypt module if it does not exist, like
 on Python 3.13.

Support Python 3.12 and 3.13.
Fixes https://github.com/repoze/repoze.who/issues/44
---
 .github/workflows/ci.yml                  |  2 ++
 .gitignore                                |  1 +
 CHANGES.rst                               | 17 ++++++++++++-----
 repoze/who/plugins/htpasswd.py            |  3 +++
 repoze/who/plugins/tests/test_htpasswd.py | 17 ++++++++++-------
 setup.py                                  |  2 ++
 tox.ini                                   | 10 +++++-----
 7 files changed, 35 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63601da..7c3e6cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,8 @@ jobs:
           - "3.9"
           - "3.10"
           - "3.11"
+          - "3.12"
+          - "3.13"
     steps:
 
     - name: Checkout
diff --git a/.gitignore b/.gitignore
index fd1b555..3c6473a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,5 +6,6 @@ docs/_build/
 *.pyc
 *.egg-info
 .coverage
+.coverage.py*
 coverage.xml
 nosetests.xml
diff --git a/CHANGES.rst b/CHANGES.rst
index 157ea9d..bfc1246 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,6 +1,13 @@
 repoze.who Changelog
 ====================
 
+3.0.0b2 (unreleased)
+--------------------
+
+- Skip testing the crypt module if it does not exist, like on Python 3.13.
+
+- Add support for Python 3.12 and 3.13.
+
 3.0.0b1 (2023-01-16)
 --------------------
 
@@ -106,7 +113,7 @@ repoze.who Changelog
 2.0b1 (2011-05-24)
 ------------------
 
-- Enabled standard use of logging module's configuration mechanism. 
+- Enabled standard use of logging module's configuration mechanism.
   See http://docs.python.org/dev/howto/logging.html#configuring-logging-for-a-library
   Thanks to jgoldsmith for the patch: http://bugs.repoze.org/issue178
 
@@ -180,7 +187,7 @@ repoze.who Changelog
 - Added ``repoze.who.config:make_api_factory_with_config``, a convenience
   method for applications which want to set up their own API Factory from
   a configuration file.
-  
+
 - Fixed example call to ``repoze.who.config:make_middleware_with_config``
   (added missing ``global_config`` argument).  See
   http://bugs.repoze.org/issue114
@@ -248,7 +255,7 @@ Backward Incompatibilities
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 - The middleware used to allow identifier plugins to "pre-authenticate"
-  an identity.  This feature is no longer supported: the ``auth_tkt`` 
+  an identity.  This feature is no longer supported: the ``auth_tkt``
   plugin, which used to use the feature, is now configured to work as
   an authenticator plugin (as well as an identifier).
 
@@ -263,7 +270,7 @@ Backward Incompatibilities
 
 - The following (non-API) functions moved from ``repoze.who.middleware`` to
   ``repoze.who.api``:
-  
+
   - ``make_registries``
   - ``match_classification``
   - ``verify``
@@ -274,7 +281,7 @@ Backward Incompatibilities
 -------------------
 
 - Issue #104:  AuthTkt plugin was passing an invalid cookie value in
-  headers from ``forget``, and was not setting the ``Max-Age`` and 
+  headers from ``forget``, and was not setting the ``Max-Age`` and
   ``Expires`` attributes of those cookies.
 
 
diff --git a/repoze/who/plugins/htpasswd.py b/repoze/who/plugins/htpasswd.py
index a50846b..ccacf17 100644
--- a/repoze/who/plugins/htpasswd.py
+++ b/repoze/who/plugins/htpasswd.py
@@ -91,6 +91,9 @@ def _same_string(x, y):
     return len(mismatches) == 0
 
 def crypt_check(password, hashed):
+    # Note: the crypt module is deprecated since Python 3.11
+    # and will be removed in Python 3.13.
+    # win32 does not have a crypt library at all.
     from crypt import crypt
     salt = hashed[:2]
     return _same_string(hashed, crypt(password, salt))
diff --git a/repoze/who/plugins/tests/test_htpasswd.py b/repoze/who/plugins/tests/test_htpasswd.py
index 76543e6..05f3a71 100644
--- a/repoze/who/plugins/tests/test_htpasswd.py
+++ b/repoze/who/plugins/tests/test_htpasswd.py
@@ -1,6 +1,15 @@
 import unittest
 
 
+try:
+    from crypt import crypt
+except ImportError:
+    # The crypt module is deprecated since Python 3.11
+    # and will be removed in Python 3.13.
+    # win32 does not have a crypt library at all.
+    crypt = None
+
+
 class TestHTPasswdPlugin(unittest.TestCase):
 
     def _getTargetClass(self):
@@ -106,14 +115,8 @@ def warn(self, msg):
         self.assertEqual(len(logger.warnings), 1)
         self.assertTrue('could not open htpasswd' in logger.warnings[0])
 
+    @unittest.skipIf(crypt is None, "crypt module not available")
     def test_crypt_check(self):
-        import sys
-        # win32 does not have a crypt library, don't
-        # fail here
-        if "win32" == sys.platform: # pragma: no cover
-            return
-
-        from crypt import crypt
         salt = '123'
         hashed = crypt('password', salt)
         from repoze.who.plugins.htpasswd import crypt_check
diff --git a/setup.py b/setup.py
index 3473561..a17a551 100644
--- a/setup.py
+++ b/setup.py
@@ -43,6 +43,8 @@ def _read_file(filename):
         "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
         "Programming Language :: Python :: Implementation :: CPython",
         "Programming Language :: Python :: Implementation :: PyPy",
         "Topic :: Internet :: WWW/HTTP",
diff --git a/tox.ini b/tox.ini
index 4e8bd10..5f0f526 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,9 +1,9 @@
 [tox]
-envlist = 
-    py37,py38,py39,py310,py311,pypy3,cover,docs
+envlist =
+    py37,py38,py39,py310,py311,py312,py313,pypy3,cover,docs
 
 [testenv]
-commands = 
+commands =
     python -m pytest --cov=repoze.who --cov-append --cov-report= {toxinidir}/repoze/who/tests/ {toxinidir}/repoze/who/plugins/tests/
 usedevelop=true
 deps =
@@ -19,7 +19,7 @@ setenv =
 skip_install = true
 basepython =
     python3.10
-commands = 
+commands =
     coverage combine
     coverage report --fail-under=100 --show-missing
     coverage xml
@@ -31,7 +31,7 @@ setenv =
 [testenv:docs]
 basepython =
     python3.10
-commands = 
+commands =
     sphinx-build -b html -d docs/_build/doctrees docs docs/_build/html
     sphinx-build -b doctest -d docs/_build/doctrees docs docs/_build/doctest
 deps =

From 24347bde38ee4ea109ae0b75b1268d7b119d932a Mon Sep 17 00:00:00 2001
From: Maurits van Rees <maurits@vanrees.org>
Date: Sun, 16 Jun 2024 13:34:08 +0200
Subject: [PATCH 2/5] Require ``legacy-cgi`` on Python 3.13 or higher so
 ``WebOb`` works.

---
 CHANGES.rst |  2 ++
 setup.py    | 12 +++++++-----
 tox.ini     |  2 --
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/CHANGES.rst b/CHANGES.rst
index bfc1246..ae4b5f6 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -6,6 +6,8 @@ repoze.who Changelog
 
 - Skip testing the crypt module if it does not exist, like on Python 3.13.
 
+- Require ``legacy-cgi`` on Python 3.13 or higher so ``WebOb`` works.
+
 - Add support for Python 3.12 and 3.13.
 
 3.0.0b1 (2023-01-16)
diff --git a/setup.py b/setup.py
index a17a551..d2d59c9 100644
--- a/setup.py
+++ b/setup.py
@@ -26,8 +26,6 @@ def _read_file(filename):
 
 README = _read_file('README.rst')
 CHANGES = _read_file('CHANGES.rst')
-tests_require = ['WebOb', 'zope.interface']
-docs_extras = tests_require + ['Sphinx', 'repoze.sphinx.autointerface']
 
 setup(name='repoze.who',
       version='3.0.0b1',
@@ -61,8 +59,12 @@ def _read_file(filename):
       include_package_data=True,
       namespace_packages=['repoze', 'repoze.who', 'repoze.who.plugins'],
       zip_safe=False,
-      tests_require = tests_require,
-      install_requires=['WebOb', 'zope.interface', 'setuptools'],
+      install_requires=[
+        'WebOb',
+        'zope.interface',
+        'setuptools',
+        'legacy-cgi; python_version > "3.12"',  # WebOb uses the cgi module
+      ],
       test_suite="repoze.who",
       entry_points = """\
       [paste.filter_app_factory]
@@ -72,6 +74,6 @@ def _read_file(filename):
       authenticated = repoze.who.restrict:make_authenticated_restriction
       """,
       extras_require = {
-        'docs': docs_extras,
+        'docs': ['Sphinx', 'repoze.sphinx.autointerface'],
       },
 )
diff --git a/tox.ini b/tox.ini
index 5f0f526..c32087a 100644
--- a/tox.ini
+++ b/tox.ini
@@ -7,8 +7,6 @@ commands =
     python -m pytest --cov=repoze.who --cov-append --cov-report= {toxinidir}/repoze/who/tests/ {toxinidir}/repoze/who/plugins/tests/
 usedevelop=true
 deps =
-    zope.interface
-    WebOb
     virtualenv
     pytest
     pytest-cov

From 9b82289acbce4e49851d3979cede1f3e10383751 Mon Sep 17 00:00:00 2001
From: Maurits van Rees <maurits@vanrees.org>
Date: Sun, 16 Jun 2024 13:42:36 +0200
Subject: [PATCH 3/5] Update GitHub Actions versions.

Maybe then setup-python can find Python 3.13.
---
 .github/workflows/ci.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c3e6cf..637c9a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,10 +24,10 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     - name: Setup Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python }}
 
@@ -41,7 +41,7 @@ jobs:
         tox -e py${{ matrix.python }}
 
     - name: Upload coverage results
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@v4
       with:
         name: coverage-artifacts
         path: .coverage.py${{ matrix.python }}
@@ -55,10 +55,10 @@ jobs:
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
     - name: Setup Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: "3.10"
 
@@ -68,7 +68,7 @@ jobs:
         python -m pip install coverage
 
     - name: Download coverage results
-      uses: actions/download-artifact@v2
+      uses: actions/download-artifact@v4
       with:
         name: coverage-artifacts
         path: .coverage-results/

From f645338a4fdab831212d619c62db99bcd3d05fd1 Mon Sep 17 00:00:00 2001
From: Maurits van Rees <maurits@vanrees.org>
Date: Sun, 16 Jun 2024 13:46:00 +0200
Subject: [PATCH 4/5] gha: allow Python prereleases, so we can test with 3.13.

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 637c9a7..12ddfc5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,6 +30,7 @@ jobs:
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python }}
+        allow-prereleases: true
 
     - name: Install nox
       run: |

From bc542ebffa7f86a93b93d74688009cd0f5b5e2cd Mon Sep 17 00:00:00 2001
From: Maurits van Rees <maurits@vanrees.org>
Date: Sun, 16 Jun 2024 13:48:52 +0200
Subject: [PATCH 5/5] gha: downgrade artifact action versions.

One job finishes correctly, but for the others I get this error:

```
Error: Failed to CreateArtifact: Received non-retryable error: Failed request: (409) Conflict: an artifact with this name already exists on the workflow run
```
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 12ddfc5..dfa3a9a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
         tox -e py${{ matrix.python }}
 
     - name: Upload coverage results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v2
       with:
         name: coverage-artifacts
         path: .coverage.py${{ matrix.python }}
@@ -69,7 +69,7 @@ jobs:
         python -m pip install coverage
 
     - name: Download coverage results
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v2
       with:
         name: coverage-artifacts
         path: .coverage-results/