clear-skies 1.19.19__tar.gz → 1.19.21__tar.gz

{clear_skies-1.19.19 → clear_skies-1.19.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: clear-skies
-Version: 1.19.19
+Version: 1.19.21
 Summary: A framework for building backends in the cloud
 Home-page: https://github.com/cmancone/clearskies
 License: MIT
@@ -14,13 +14,15 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
-Provides-Extra: jwt
+Provides-Extra: jose
+Provides-Extra: jwcrypto
 Provides-Extra: mysql
 Provides-Extra: secrets
 Requires-Dist: akeyless (>=3.6.2,<4.0.0) ; extra == "secrets"
 Requires-Dist: akeyless-cloud-id (>=0.2.3,<0.3.0) ; extra == "secrets"
 Requires-Dist: dateparser (>=1.1.8,<2.0.0)
-Requires-Dist: jose (>=1.0.0,<2.0.0) ; extra == "jwt"
+Requires-Dist: jose (>=1.0.0,<2.0.0) ; extra == "jose"
+Requires-Dist: jwcrypto (>=1.5.6,<2.0.0) ; extra == "jwcrypto"
 Requires-Dist: pymysql (>=1.1.0,<2.0.0) ; extra == "mysql"
 Requires-Dist: requests (>=2.31.0,<3.0.0)
 Project-URL: Repository, https://github.com/cmancone/clearskies

{clear_skies-1.19.19 → clear_skies-1.19.21}/pyproject.toml

@@ -2,7 +2,7 @@
 
 [tool.poetry]
 name = "clear-skies"
-version = "1.19.19"
+version = "1.19.21"
 description = "A framework for building backends in the cloud"
 authors = [
     "Conor Mancone <cmancone@gmail.com>",
@@ -33,6 +33,7 @@ akeyless = {version = "^3.6.2", optional = true}
 akeyless-cloud-id = {version = "^0.2.3", optional = true}
 pymysql = {version = "^1.1.0", optional = true}
 jose = {version = "^1.0.0", optional = true}
+jwcrypto = {version = "^1.5.6", optional = true}
 
 [[tool.poetry.source]]
 name = "PyPI"
@@ -45,7 +46,8 @@ black = "^23.3.0"
 [tool.poetry.extras]
 secrets = ["akeyless", "akeyless-cloud-id"]
 mysql = ["pymysql"]
-jwt = ["jose"]
+jose = ["jose"]
+jwcrypto = ["jwcrypto"]
 
 [tool.black]
 line-length = 120

{clear_skies-1.19.19 → clear_skies-1.19.21}/src/clearskies/authentication/__init__.py

@@ -4,6 +4,7 @@ from .public import Public
 from .auth0_jwks import Auth0JWKS
 from .authorization import Authorization
 from .jwks import JWKS
+from .jwks_jwcrypto import JWKSJwCrypto
 
 
 def public():
@@ -22,6 +23,10 @@ def jwks(jwks_url, **kwargs):
     return BindingConfig(JWKS, jwks_url=jwks_url, **kwargs)
 
 
+def jwks_jwcrypto(jwks_url, **kwargs):
+    return BindingConfig(JWKSJwCrypto, jwks_url=jwks_url, **kwargs)
+
+
 __all__ = [
     "Authorization",
     "BindingConfig",
@@ -34,4 +39,6 @@ __all__ = [
     "authorization",
     "jwks",
     "JWKS",
+    "jwks_jwcrypto",
+    "JWKSJwCrypto",
 ]

clear_skies-1.19.21/src/clearskies/authentication/jwks_jwcrypto.py

@@ -0,0 +1,39 @@
+import datetime
+import json
+
+from clearskies.authentication import JWKS
+from clearskies.handlers.exceptions import ClientError
+
+
+class JWKSJwCrypto(JWKS):
+    def __init__(self, environment, requests):
+        # the third parameter is supposed to be jose_jwt, but we're going to override all
+        # the functions that use it
+        super().__init__(environment, requests, {})
+
+    def validate_jwt(self, raw_jwt):
+        from jwcrypto import jws, jwk, jwt
+        from jwcrypto.common import JWException
+
+        keys = jwk.JWKSet()
+        keys.import_keyset(json.dumps(self._get_jwks()))
+
+        client_jwt = jwt.JWT()
+        try:
+            client_jwt.deserialize(raw_jwt)
+        except Exception as e:
+            raise ClientError(str(e))
+
+        try:
+            client_jwt.validate(keys)
+            self.jwt_claims = json.loads(client_jwt.claims)
+        except JWException as e:
+            raise ClientError(str(e))
+
+        if self._audience and self.jwt_claims.get("aud") != self._audience:
+            raise ClientError("Audience does not match")
+
+        if self._issuer and self.jwt_claims.get("iss") != self._issuer:
+            raise ClientError("Issuer does not match")
+
+        return True