From 0714fff7fa7f4d521825069678441021799ef468 Mon Sep 17 00:00:00 2001
From: George Lambert <marchon@gmail.com>
Date: Sun, 20 Sep 2026 10:13:09 -0400
Subject: [PATCH] fix: stop shadowing json module in GlobalClient HTTP helper

Live VeraeTime token is stored in ~/.verae/auth.properties (not committed).
---
 README.md                                     |  8 ++++----
 .../global_client.py                          | 20 ++++++++++---------
 tests/test_global_client.py                   |  8 ++++----
 3 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/README.md b/README.md
index 4c4feb4..e80d730 100644
--- a/README.md
+++ b/README.md
@@ -33,12 +33,12 @@ Tests:
 uv run pytest
 ```
 
-Global stamp (central VeraeTime):
+Global stamp (central VeraeTime). Token lives at `~/.verae/auth.properties` (mode 600):
 
 ```sh
-export VERAE_GLOBAL_URL=https://api.veraetime.net
-export VERAE_GLOBAL_TOKEN=  # or put access_token= in ~/.verae/auth.properties
-# then call tool stamp with scope=global
+# refresh: POST https://api.veraetime.net/auth/login → access_token=
+# or: export VERAE_GLOBAL_TOKEN=...
+# then stamp with scope=global
 ```
 
 Do not send file bytes to `stamp`. Local receipts persist at `~/.verae/mcp-timestamp-local.json` (`VERAE_LEDGER_PATH`).
diff --git a/src/verae_mcp_timestamping_server/global_client.py b/src/verae_mcp_timestamping_server/global_client.py
index 527c8a4..89a3d1c 100644
--- a/src/verae_mcp_timestamping_server/global_client.py
+++ b/src/verae_mcp_timestamping_server/global_client.py
@@ -24,7 +24,7 @@ DEFAULT_GLOBAL_URL = "https://api.veraetime.net"
 
 class HttpTransport(Protocol):
     def request(
-        self, method: str, url: str, json: dict[str, Any], headers: dict[str, str]
+        self, method: str, url: str, payload: dict[str, Any], headers: dict[str, str]
     ) -> Any: ...
 
 
@@ -40,9 +40,9 @@ class _UrllibResp:
 
 class UrllibHttp:
     def request(
-        self, method: str, url: str, json: dict[str, Any], headers: dict[str, str]
+        self, method: str, url: str, payload: dict[str, Any], headers: dict[str, str]
     ) -> _UrllibResp:
-        data = json_dumps(json).encode()
+        data = json.dumps(payload).encode()
         req = urllib.request.Request(url, data=data, method=method)
         for key, value in headers.items():
             req.add_header(key, value)
@@ -60,10 +60,6 @@ class UrllibHttp:
         return _UrllibResp(status, body, raw)
 
 
-def json_dumps(payload: dict[str, Any]) -> str:
-    return json.dumps(payload)
-
-
 def load_auth_token() -> str:
     env = os.environ.get("VERAE_GLOBAL_TOKEN", "").strip()
     if env:
@@ -108,7 +104,10 @@ class GlobalClient:
     def submit(self, digest: str, cube_id: str = "") -> Receipt:
         url = f"{self.base_url}/api/timestamp"
         res = self.http.request(
-            "POST", url, {"hash": digest, "sync": True}, self._headers()
+            "POST",
+            url,
+            payload={"hash": digest, "sync": True},
+            headers=self._headers(),
         )
         if res.status_code >= 300:
             raise ValueError(f"global timestamp HTTP {res.status_code}: {res.text}")
@@ -128,7 +127,10 @@ class GlobalClient:
     def verify_certificate(self, receipt_id: str) -> VerifyResult:
         url = f"{self.base_url}/api/verify"
         res = self.http.request(
-            "POST", url, {"certificate": receipt_id}, self._headers()
+            "POST",
+            url,
+            payload={"certificate": receipt_id},
+            headers=self._headers(),
         )
         if res.status_code >= 300:
             return VerifyResult(valid=False, error=f"verify HTTP {res.status_code}")
diff --git a/tests/test_global_client.py b/tests/test_global_client.py
index 7896b3b..a46a87a 100644
--- a/tests/test_global_client.py
+++ b/tests/test_global_client.py
@@ -22,20 +22,20 @@ class FakeHttp:
     def __init__(self):
         self.calls: list[tuple[str, str, dict, dict]] = []
 
-    def request(self, method: str, url: str, json: dict, headers: dict) -> _Resp:
-        self.calls.append((method, url, json, headers))
+    def request(self, method: str, url: str, payload: dict, headers: dict) -> _Resp:
+        self.calls.append((method, url, payload, headers))
         if url.endswith("/api/timestamp"):
             return _Resp(
                 200,
                 {
                     "jobId": "job-1",
-                    "hash": json["hash"],
+                    "hash": payload["hash"],
                     "timestamp": "2026-08-15T00:00:00Z",
                     "blockHash": "0xdead",
                 },
             )
         if url.endswith("/api/verify"):
-            if json.get("certificate") == "job-1":
+            if payload.get("certificate") == "job-1":
                 return _Resp(200, {"valid": True, "hash": SHA256_EMPTY})
             return _Resp(200, {"valid": False})
         return _Resp(404, {"error": "nope"})