Encryptors 2.62__tar.gz → 2.64__tar.gz

{encryptors-2.62 → encryptors-2.64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.62
+Version: 2.64
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai
@@ -57,7 +57,7 @@ Requires-Dist: bcrypt==4.3.0
 Requires-Dist: azure-monitor-opentelemetry==1.8.1
 Requires-Dist: uvicorn==0.37.0
 Requires-Dist: gunicorn==23.0.0
-Requires-Dist: jwcrypto==1.5.7
+Requires-Dist: joserfc==1.5.0
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{encryptors-2.62 → encryptors-2.64}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 # ANDERSON REVISAR EL CACHE LOCAL DEL KEYVAULT PARA VALIDAR SI FUNCIONA
 setup(
     name="Encryptors", 
-    version="2.62",
+    version="2.64",
     author="OSDental LLC",
     author_email="support@osdental.ai",
     description="End-to-end algorithm library",
@@ -65,7 +65,7 @@ setup(
         "azure-monitor-opentelemetry==1.8.1",
         "uvicorn==0.37.0",
         "gunicorn==23.0.0",
-        "jwcrypto==1.5.7",
+        "joserfc==1.5.0",
     ],
     entry_points={
     'console_scripts': [

{encryptors-2.62 → encryptors-2.64}/src/Encryptors.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.62
+Version: 2.64
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai
@@ -57,7 +57,7 @@ Requires-Dist: bcrypt==4.3.0
 Requires-Dist: azure-monitor-opentelemetry==1.8.1
 Requires-Dist: uvicorn==0.37.0
 Requires-Dist: gunicorn==23.0.0
-Requires-Dist: jwcrypto==1.5.7
+Requires-Dist: joserfc==1.5.0
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{encryptors-2.62 → encryptors-2.64}/src/Encryptors.egg-info/requires.txt

@@ -46,4 +46,4 @@ bcrypt==4.3.0
 azure-monitor-opentelemetry==1.8.1
 uvicorn==0.37.0
 gunicorn==23.0.0
-jwcrypto==1.5.7
+joserfc==1.5.0

encryptors-2.64/src/Osdental/Helpers/JwtTokenHelper.py

@@ -0,0 +1,179 @@
+import json
+from datetime import datetime, timedelta, timezone
+from joserfc import jwe, jwt
+from joserfc.jwk import RSAKey
+from Osdental.Models.TokenClaims import TokenValidationOptions
+from Osdental.Exception.ControlledException import UnauthorizedException
+from Osdental.Enums.StatusCode import StatusCode
+
+class JwtTokenHelper:
+
+    def __init__(
+        self,
+        private_key_pem: str,
+        public_key_pem: str,
+    ):
+        self._private_key = RSAKey.import_key(
+            private_key_pem.encode()
+        )
+        self._public_key = RSAKey.import_key(
+            public_key_pem.encode()
+        )
+
+        self._jwe_algorithms = ["RSA-OAEP", "A256CBC-HS512"]
+
+    def generate_token(
+        self,
+        claims: dict,
+        expiration_minutes: int,
+    ) -> str:
+
+        now = datetime.now(timezone.utc)
+
+        payload = {
+            **claims,
+            "iat": int(now.timestamp()),
+            "nbf": int(now.timestamp()),
+            "exp": int(
+                (
+                    now
+                    + timedelta(
+                        minutes=expiration_minutes
+                    )
+                ).timestamp()
+            ),
+        }
+
+        # 1. Firmar → JWS (inner JWT)
+        signed: str = jwt.encode(
+            header={"alg": "RS256", "typ": "JWT"},
+            claims=payload,
+            key=self._private_key,
+        )
+
+        # 2. Encriptar → JWE (outer token)
+        encrypted: str = jwe.encrypt_compact(
+            protected={"alg": "RSA-OAEP", "enc": "A256CBC-HS512", "cty": "JWT"},
+            plaintext=signed.encode(),          # el JWT firmado es el payload del JWE
+            public_key=self._public_key,
+        )
+
+        return encrypted
+
+    def get_claims_ignore_expiration(
+        self,
+        token: str,
+    ) -> dict:
+        """
+        Desencripta y verifica FIRMA únicamente.
+
+        NO valida: exp, nbf, iat, iss, aud.
+
+        Usar exclusivamente en el flujo de refresh token,
+        donde el token puede estar vencido pero la firma debe ser válida.
+        """
+        return self._decode(token, validate_exp=False)
+    
+
+    def validate_token(
+        self,
+        token: str,
+        options: TokenValidationOptions | None = None,
+    ) -> dict:
+        """
+        Desencripta, verifica firma, valida exp y,
+        opcionalmente, iss y aud según el TokenValidationOptions recibido.
+        """
+        options = options or TokenValidationOptions()
+
+        claims = self._decode(token, validate_exp=True)
+
+        self._validate_registered_claims(claims, options)
+
+        return claims
+    
+
+    def _decode(
+        self,
+        token: str,
+        validate_exp: bool,
+    ) -> dict:
+        """
+        Núcleo del proceso:
+          1. Desencripta el JWE  →  valida criptografía outer
+          2. Verifica la firma del JWT inner  →  valida criptografía inner
+          3. Valida exp solo si validate_exp=True
+        """
+        try:
+            # --- Paso 1: desencriptar JWE ---
+            decrypted = jwe.decrypt_compact(
+                value=token.encode(),
+                private_key=self._private_key,
+                algorithms=self._jwe_algorithms,
+            )
+
+            inner_token: str = decrypted.plaintext.decode()
+
+            # --- Paso 2: verificar firma (decode NO valida claims) ---
+            token_obj = jwt.decode(
+                value=inner_token,
+                key=self._public_key,
+            )
+
+            claims: dict = token_obj.claims
+
+            # --- Paso 3: validar exp solo si se pide ---
+            if validate_exp:
+                now = datetime.now(timezone.utc)
+                exp = claims.get("exp")
+
+                if exp is None:
+                    raise UnauthorizedException(
+                        message="Token missing exp claim",
+                        status_code=StatusCode.UNAUTHORIZED,
+                    )
+
+                if int(now.timestamp()) > exp:
+                    raise UnauthorizedException(
+                        message="Token expired",
+                        status_code=StatusCode.UNAUTHORIZED,
+                    )
+
+            return claims
+
+        except UnauthorizedException:
+            raise
+
+        except Exception as exc:
+            raise UnauthorizedException(
+                message="Invalid token",
+                status_code=StatusCode.UNAUTHORIZED,
+            ) from exc
+
+    def _validate_registered_claims(
+        self,
+        claims: dict,
+        options: TokenValidationOptions,
+    ) -> None:
+
+        if options.validate_issuer:
+
+            if not options.issuer:
+                raise ValueError("issuer is required in options")
+
+            if claims.get("iss") != options.issuer:
+                raise UnauthorizedException(
+                    message="Invalid issuer",
+                    status_code=StatusCode.UNAUTHORIZED,
+                )
+
+        if options.validate_audience:
+
+            if not options.audience:
+                raise ValueError("audience is required in options")
+
+            if claims.get("aud") != options.audience:
+                raise UnauthorizedException(
+                    message="Invalid audience",
+                    status_code=StatusCode.UNAUTHORIZED,
+                )

{encryptors-2.62 → encryptors-2.64}/src/Osdental/Services/JwtAuthTokenService.py

@@ -130,6 +130,31 @@ class JwtAuthTokenService(IAuthTokenService):
             )
         )
 
+        return UserTokenClaims(
+            id_legacy=claims["id_legacy"],
+            id_enterprise=claims["id_enterprise"],
+            id_token=claims["id_token"],
+            id_user=claims["id_user"],
+            id_external_enterprise=claims["id_external_enterprise"],
+            id_profile=claims["id_profile"],
+            user_full_name=claims["user_full_name"],
+            abbreviation=claims["abbreviation"],
+            aes_key_auth=claims["aes_key_auth"],
+        )
+    
+
+    async def validate_token_for_refresh(
+        self,
+        token: str,
+    ) -> UserTokenClaims:
+        """
+        Valida firma pero ignora exp.
+        Usar exclusivamente para emitir un nuevo token cuando el anterior venció.
+        """
+        await self.__get_token_signatures()
+
+        claims = self._jwt.get_claims_ignore_expiration(token)
+
         return UserTokenClaims(
             id_legacy=claims["id_legacy"],
             id_enterprise=claims["id_enterprise"],

encryptors-2.62/src/Osdental/Helpers/JwtTokenHelper.py

@@ -1,171 +0,0 @@
-import json
-from datetime import datetime, timedelta, timezone
-from jwcrypto import jwk
-from jwcrypto import jwt
-from jwcrypto import jwe
-from jwcrypto.jwt import JWTExpired
-from Osdental.Models.TokenClaims import TokenValidationOptions
-from Osdental.Exception.ControlledException import UnauthorizedException
-from Osdental.Enums.StatusCode import StatusCode
-
-class JwtTokenHelper:
-
-    def __init__(
-        self,
-        private_key_pem: str,
-        public_key_pem: str,
-    ):
-        self._private_key = jwk.JWK.from_pem(
-            private_key_pem.encode()
-        )
-
-        self._public_key = jwk.JWK.from_pem(
-            public_key_pem.encode()
-        )
-
-    def generate_token(
-        self,
-        claims: dict,
-        expiration_minutes: int,
-    ) -> str:
-
-        now = datetime.now(timezone.utc)
-
-        payload = {
-            **claims,
-            "iat": int(now.timestamp()),
-            "nbf": int(now.timestamp()),
-            "exp": int(
-                (
-                    now
-                    + timedelta(
-                        minutes=expiration_minutes
-                    )
-                ).timestamp()
-            ),
-        }
-
-        signed_token = jwt.JWT(
-            header={
-                "alg": "RS256",
-                "typ": "JWT",
-            },
-            claims=payload,
-        )
-
-        signed_token.make_signed_token(
-            self._private_key
-        )
-
-        encrypted_token = jwt.JWT(
-            header={
-                "alg": "RSA-OAEP",
-                "enc": "A256CBC-HS512",
-                "cty": "JWT",
-            },
-            claims=signed_token.serialize(),
-        )
-
-        encrypted_token.make_encrypted_token(
-            self._public_key
-        )
-
-        return encrypted_token.serialize()
-
-    def get_claims(
-        self,
-        token: str,
-    ) -> dict:
-        """
-        Desencripta y verifica firma.
-
-        NO valida:
-        - issuer
-        - audience
-
-        Retorna claims incluso si el token está expirado.
-        """
-
-        try:
-            encrypted = jwe.JWE()
-
-            encrypted.deserialize(
-                token
-            )
-
-            encrypted.decrypt(
-                self._private_key
-            )
-
-            inner_token = (
-                encrypted.payload.decode()
-            )
-
-            verified = jwt.JWT()
-
-            verified.deserialize(
-                jwt=inner_token,
-                key=self._public_key,
-            )
-
-            return json.loads(
-                verified.claims
-            )
-        
-        except JWTExpired:
-            raise UnauthorizedException(
-                message="Token expired",
-                status_code=StatusCode.UNAUTHORIZED
-            )
-
-    def validate_claims(
-        self,
-        claims: dict,
-        options: TokenValidationOptions,
-    ) -> None:
-
-
-        if options.validate_issuer:
-
-            if not options.issuer:
-                raise ValueError(
-                    "issuer is required"
-                )
-
-            if claims.get("iss") != options.issuer:
-                raise ValueError(
-                    "Invalid issuer"
-                )
-
-
-        if options.validate_audience:
-
-            if not options.audience:
-                raise ValueError(
-                    "audience is required"
-                )
-
-            if claims.get("aud") != options.audience:
-                raise ValueError(
-                    "Invalid audience"
-                )
-
-
-    def validate_token(
-        self,
-        token: str,
-        options: TokenValidationOptions | None = None,
-    ) -> dict:
-
-        options = options or TokenValidationOptions()
-
-        claims = self.get_claims(
-            token
-        )
-
-        self.validate_claims(
-            claims=claims,
-            options=options,
-        )
-
-        return claims