clear-skies 1.19.20__tar.gz → 1.19.22__tar.gz

{clear_skies-1.19.20 → clear_skies-1.19.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: clear-skies
-Version: 1.19.20
+Version: 1.19.22
 Summary: A framework for building backends in the cloud
 Home-page: https://github.com/cmancone/clearskies
 License: MIT
@@ -15,12 +15,14 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Provides-Extra: jose
+Provides-Extra: jwcrypto
 Provides-Extra: mysql
 Provides-Extra: secrets
 Requires-Dist: akeyless (>=3.6.2,<4.0.0) ; extra == "secrets"
 Requires-Dist: akeyless-cloud-id (>=0.2.3,<0.3.0) ; extra == "secrets"
 Requires-Dist: dateparser (>=1.1.8,<2.0.0)
 Requires-Dist: jose (>=1.0.0,<2.0.0) ; extra == "jose"
+Requires-Dist: jwcrypto (>=1.5.6,<2.0.0) ; extra == "jwcrypto"
 Requires-Dist: pymysql (>=1.1.0,<2.0.0) ; extra == "mysql"
 Requires-Dist: requests (>=2.31.0,<3.0.0)
 Project-URL: Repository, https://github.com/cmancone/clearskies

{clear_skies-1.19.20 → clear_skies-1.19.22}/pyproject.toml

@@ -2,7 +2,7 @@
 
 [tool.poetry]
 name = "clear-skies"
-version = "1.19.20"
+version = "1.19.22"
 description = "A framework for building backends in the cloud"
 authors = [
     "Conor Mancone <cmancone@gmail.com>",
@@ -33,6 +33,7 @@ akeyless = {version = "^3.6.2", optional = true}
 akeyless-cloud-id = {version = "^0.2.3", optional = true}
 pymysql = {version = "^1.1.0", optional = true}
 jose = {version = "^1.0.0", optional = true}
+jwcrypto = {version = "^1.5.6", optional = true}
 
 [[tool.poetry.source]]
 name = "PyPI"
@@ -46,6 +47,7 @@ black = "^23.3.0"
 secrets = ["akeyless", "akeyless-cloud-id"]
 mysql = ["pymysql"]
 jose = ["jose"]
+jwcrypto = ["jwcrypto"]
 
 [tool.black]
 line-length = 120

{clear_skies-1.19.20 → clear_skies-1.19.22}/src/clearskies/authentication/__init__.py

@@ -4,6 +4,7 @@ from .public import Public
 from .auth0_jwks import Auth0JWKS
 from .authorization import Authorization
 from .jwks import JWKS
+from .jwks_jwcrypto import JWKSJwCrypto
 
 
 def public():
@@ -22,6 +23,10 @@ def jwks(jwks_url, **kwargs):
     return BindingConfig(JWKS, jwks_url=jwks_url, **kwargs)
 
 
+def jwks_jwcrypto(jwks_url, **kwargs):
+    return BindingConfig(JWKSJwCrypto, jwks_url=jwks_url, **kwargs)
+
+
 __all__ = [
     "Authorization",
     "BindingConfig",
@@ -34,4 +39,6 @@ __all__ = [
     "authorization",
     "jwks",
     "JWKS",
+    "jwks_jwcrypto",
+    "JWKSJwCrypto",
 ]

{clear_skies-1.19.20 → clear_skies-1.19.22}/src/clearskies/authentication/jwks.py

@@ -7,6 +7,7 @@ class JWKS(Auth0JWKS):
     _audience = None
     _jwks_url = None
     _jwks_cache_time = None
+    _authorization_url = None
 
     def __init__(self, environment, requests, jose_jwt):
         super().__init__(environment, requests, jose_jwt)
@@ -18,6 +19,7 @@ class JWKS(Auth0JWKS):
         audience=None,
         issuer=None,
         documentation_security_name=None,
+        authorization_url=None,
         jwks_cache_time=86400,
     ):
         self._audience = audience
@@ -28,6 +30,7 @@ class JWKS(Auth0JWKS):
             raise ValueError("Must provide 'jwks_url' when using JWKS authentication")
         self._algorithms = ["RS256"] if algorithms is None else algorithms
         self._documentation_security_name = documentation_security_name
+        self._authorization_url = authorization_url if authorization_url else ""
 
     def authenticate(self, input_output):
         auth_header = input_output.get_request_header("authorization", True)
@@ -73,3 +76,13 @@ class JWKS(Auth0JWKS):
             self._jwks_fetched = now
 
         return self._jwks
+
+    def documentation_security_scheme(self):
+        return {
+            "type": "oauth2",
+            "description": "JWT based authentication",
+            "flows": {"implicit": {"authorizationUrl": self._authorization_url, "scopes": {}}},
+        }
+
+    def documentation_security_scheme_name(self):
+        return self._documentation_security_name if self._documentation_security_name is not None else "jwt"

clear_skies-1.19.22/src/clearskies/authentication/jwks_jwcrypto.py

@@ -0,0 +1,39 @@
+import datetime
+import json
+
+from clearskies.authentication import JWKS
+from clearskies.handlers.exceptions import ClientError
+
+
+class JWKSJwCrypto(JWKS):
+    def __init__(self, environment, requests):
+        # the third parameter is supposed to be jose_jwt, but we're going to override all
+        # the functions that use it
+        super().__init__(environment, requests, {})
+
+    def validate_jwt(self, raw_jwt):
+        from jwcrypto import jws, jwk, jwt
+        from jwcrypto.common import JWException
+
+        keys = jwk.JWKSet()
+        keys.import_keyset(json.dumps(self._get_jwks()))
+
+        client_jwt = jwt.JWT()
+        try:
+            client_jwt.deserialize(raw_jwt)
+        except Exception as e:
+            raise ClientError(str(e))
+
+        try:
+            client_jwt.validate(keys)
+            self.jwt_claims = json.loads(client_jwt.claims)
+        except JWException as e:
+            raise ClientError(str(e))
+
+        if self._audience and self.jwt_claims.get("aud") != self._audience:
+            raise ClientError("Audience does not match")
+
+        if self._issuer and self.jwt_claims.get("iss") != self._issuer:
+            raise ClientError("Issuer does not match")
+
+        return True