v1.2.0

What's Changed

Recovery from tokens the Monta API refuses, so a stale token no longer surfaces as a credentials prompt (#14). This is the library side of nickknissen/hass-monta#321, where a Home Assistant user was asked to re-enter working credentials roughly once an hour.

• A refused refresh token now falls back to the client id and secret instead of ending the attempt. Previously the stored refresh expiry is a month out, so every later call retried the same dead token and nothing short of new credentials got out of it.
• A request refused with a 401 drops the token and is tried once more. Token validity is judged locally against this machine's clock, so a slow clock or a token revoked ahead of its expiry could get an authentication error out of an otherwise healthy client.
• Requests refused at the same moment share one replacement token rather than each minting their own and rotating the refresh token out from under the others.
• A refused token is dropped from TokenStorage, not just from memory, so storage that outlives the process does not hand the dead token back on the next start.

Behaviour change

• MontaApiClientAuthenticationError now carries status, the HTTP status the API answered with, so callers can tell a refused token (401) from a request the credentials are not allowed to make (403). Only a 401 is retried.
• A 403 now raises with the message "Request not permitted" rather than "Invalid credentials", which was untrue of credentials the API had accepted. Code matching on the exception type is unaffected; code matching on the message string is not.

Also

• First test suite for the client, run against Python 3.11 through 3.14 in CI.

Full Changelog: v1.1.0...v1.2.0