clear-skies 1.19.21__py3-none-any.whl → 1.19.23__py3-none-any.whl

{clear_skies-1.19.21.dist-info → clear_skies-1.19.23.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: clear-skies
-Version: 1.19.21
+Version: 1.19.23
 Summary: A framework for building backends in the cloud
 Home-page: https://github.com/cmancone/clearskies
 License: MIT

{clear_skies-1.19.21.dist-info → clear_skies-1.19.23.dist-info}/RECORD

@@ -4,8 +4,8 @@ clearskies/authentication/__init__.py,sha256=pHKJOfujgvNAbgzQpKVzEhWORwjAZTE4jKh
 clearskies/authentication/auth0_jwks.py,sha256=bzqNaEoG_iPndwttRXuaKpgkDtgOCLAooyifl0I0ACI,4447
 clearskies/authentication/auth_exception.py,sha256=8Tay3Sim2K8vAZ6ldisSJyRyN0cwX7iyGHwfglSKW_A,41
 clearskies/authentication/authorization.py,sha256=eLzBrXMNr1gYoIBZTd8I6uH3R0CfMMjhvimkJt4Amrs,601
-clearskies/authentication/jwks.py,sha256=JsBG4U7eGoKO75CV6J39d91lrVWtjVn6n8fN9RpCYEc,2811
-clearskies/authentication/jwks_jwcrypto.py,sha256=Oq3lID1nXSSaBnmxzpz1TSByvyNbanUHNAmdqDsuM6k,1219
+clearskies/authentication/jwks.py,sha256=AOrCkL7pVznTM6mbrQ3RVHCccws0b_yEtqEOe6NRw5k,3368
+clearskies/authentication/jwks_jwcrypto.py,sha256=PqyQNJZY7P98qgdxNltwCWoPxsaWLDqPuMknB4u2mDc,1732
 clearskies/authentication/public.py,sha256=zNpglAILTU7koz22YaGpMOAtTn_dG8dAP4Q9REdbaOk,630
 clearskies/authentication/secret_bearer.py,sha256=OBkjvw4n-ZLRRtZEKyzdael03DYIwacvUxrj5V9h0Ow,2968
 clearskies/autodoc/__init__.py,sha256=JRUAmd0he8iGlgiZvxewLMIXJqnOFEdvlaKAtHpC2lo,124
@@ -200,7 +200,7 @@ clearskies/tests/simple_api/models/__init__.py,sha256=nUA0W6fgXw_Bxa9CudkaDkC80t
 clearskies/tests/simple_api/models/status.py,sha256=PEhPbaQh5qdUNHp8O0gz91LOLENAEBtqSaHxUPXchaM,699
 clearskies/tests/simple_api/models/user.py,sha256=5_P4Tp1tTdX7PkMJ__epPM5MA7JAeVYGas69vcWloLc,819
 clearskies/tests/simple_api/users_api.py,sha256=KYXCgEofDxHeRdQK67txN5oYUPvxxmB8JTku7L-apk4,2344
-clear_skies-1.19.21.dist-info/LICENSE,sha256=3Ehd0g3YOpCj8sqj0Xjq5qbOtjjgk9qzhhD9YjRQgOA,1053
-clear_skies-1.19.21.dist-info/METADATA,sha256=bfO7PgqWiYWKhHbfeXfUeXfN3Ku9UVvKNYkAyKLh1rI,1712
-clear_skies-1.19.21.dist-info/WHEEL,sha256=d2fvjOD7sXsVzChCqf0Ty0JbHKBaLYwDbGQDwQTnJ50,88
-clear_skies-1.19.21.dist-info/RECORD,,
+clear_skies-1.19.23.dist-info/LICENSE,sha256=3Ehd0g3YOpCj8sqj0Xjq5qbOtjjgk9qzhhD9YjRQgOA,1053
+clear_skies-1.19.23.dist-info/METADATA,sha256=VMOL8V_K1hg1iEQoS8P7Wi8JUii5BikVafGmKUrqA0A,1712
+clear_skies-1.19.23.dist-info/WHEEL,sha256=d2fvjOD7sXsVzChCqf0Ty0JbHKBaLYwDbGQDwQTnJ50,88
+clear_skies-1.19.23.dist-info/RECORD,,

clearskies/authentication/jwks.py

@@ -7,6 +7,7 @@ class JWKS(Auth0JWKS):
     _audience = None
     _jwks_url = None
     _jwks_cache_time = None
+    _authorization_url = None
 
     def __init__(self, environment, requests, jose_jwt):
         super().__init__(environment, requests, jose_jwt)
@@ -18,6 +19,7 @@ class JWKS(Auth0JWKS):
         audience=None,
         issuer=None,
         documentation_security_name=None,
+        authorization_url=None,
         jwks_cache_time=86400,
     ):
         self._audience = audience
@@ -28,6 +30,7 @@ class JWKS(Auth0JWKS):
             raise ValueError("Must provide 'jwks_url' when using JWKS authentication")
         self._algorithms = ["RS256"] if algorithms is None else algorithms
         self._documentation_security_name = documentation_security_name
+        self._authorization_url = authorization_url if authorization_url else ""
 
     def authenticate(self, input_output):
         auth_header = input_output.get_request_header("authorization", True)
@@ -73,3 +76,13 @@ class JWKS(Auth0JWKS):
             self._jwks_fetched = now
 
         return self._jwks
+
+    def documentation_security_scheme(self):
+        return {
+            "type": "oauth2",
+            "description": "JWT based authentication",
+            "flows": {"implicit": {"authorizationUrl": self._authorization_url, "scopes": {}}},
+        }
+
+    def documentation_security_scheme_name(self):
+        return self._documentation_security_name if self._documentation_security_name is not None else "jwt"

clearskies/authentication/jwks_jwcrypto.py

@@ -30,10 +30,22 @@ class JWKSJwCrypto(JWKS):
         except JWException as e:
             raise ClientError(str(e))
 
-        if self._audience and self.jwt_claims.get("aud") != self._audience:
-            raise ClientError("Audience does not match")
-
         if self._issuer and self.jwt_claims.get("iss") != self._issuer:
             raise ClientError("Issuer does not match")
 
+        if self._audience:
+            jwt_audience = self.jwt_claims.get("aud")
+            if not jwt_audience:
+                raise ClientError("Audience does not match")
+            if isinstance(jwt_audience, str):
+                jwt_audience = [jwt_audience]
+            if not isinstance(jwt_audience, list):
+                raise ClientError("I don't understand the audience in that JWT")
+            has_match = False
+            for audience in jwt_audience:
+                if audience == self._audience:
+                    has_match = True
+            if not has_match:
+                raise ClientError("Audience does not match")
+
         return True