doc: add changelog, comments

Author: namsnath

CHANGELOG.md

@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [unreleased]
 
 ## [0.29.0] - 2025-02-17
+- **[Breaking] Makes URL path normalization case sensitive**
+ - Updates `normalise_url_path_or_throw_error` to be case sensitive
+ - URL paths will not be converted to lower-case, and will be kept as-is.
 - Fixes an issue where `removeDevice` API allowed removing TOTP devices without the user completing MFA.
   - Brings SDK in-line with Node SDK v21.1.0
 

supertokens_python/normalised_url_path.py

@@ -45,11 +45,15 @@ def is_a_recipe_path(self) -> bool:
 
 
 def normalise_url_path_or_throw_error(input_str: str) -> str:
+    """
+    Normalize URLs and obtain their path.
+    """
     input_str = input_str.strip()
     input_str_lower = input_str.lower()
 
     try:
         if not input_str_lower.startswith(("http://", "https://")):
+            # Raise and fall-through to handling below
             raise Exception("converting to proper URL")
 
         url_obj = urlparse(input_str)
@@ -62,15 +66,18 @@ def normalise_url_path_or_throw_error(input_str: str) -> str:
     except Exception:
         pass
 
+    # URL specifies a domain but no scheme, try parsing with scheme added
     if (
         domain_given(input_str_lower) or input_str_lower.startswith("localhost")
     ) and not input_str_lower.startswith(("http://", "https://")):
         input_str = "http://" + input_str
         return normalise_url_path_or_throw_error(input_str)
 
+    # Only a path given, add a leading slash
     if not input_str.startswith("/"):
         input_str = "/" + input_str
 
+    # Parse the path with a dummy scheme and domain
     try:
         urlparse(f"http://example.com{input_str}")
         return normalise_url_path_or_throw_error(f"http://example.com{input_str}")