easyssf-test 0.7.0__tar.gz

easyssf_test-0.7.0/.gitignore

@@ -0,0 +1,22 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+build/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+# IDE
+.idea/
+.vscode/
+
+# Local
+scratch/
+.DS_Store
+conformance/certs/

easyssf_test-0.7.0/PKG-INFO

@@ -0,0 +1,32 @@
+Metadata-Version: 2.5
+Name: easyssf-test
+Version: 0.7.0
+Summary: A test transmitter for SSF receivers: signs SETs, serves metadata and a JWK Set, issues tokens, emulates stream management and the poll endpoint, in-process through an httpx transport
+Project-URL: Homepage, https://easyssf.org
+Project-URL: Repository, https://github.com/easyssf/easyssf-python
+Project-URL: Changelog, https://github.com/easyssf/easyssf-python/blob/main/CHANGELOG.md
+Author: the easyssf authors
+License-Expression: Apache-2.0
+Keywords: caep,openid,risc,security-events,ssf,testing
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: easyssf-core[signing]<0.8,>=0.7
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: joserfc<2,>=1.7
+Description-Content-Type: text/markdown
+
+# easyssf-test
+
+Test support for SSF receivers built with easyssf: `TestTransmitter` signs SETs, serves its metadata
+and JWK Set, issues access tokens and emulates stream management and the poll endpoint, in-process
+through the `httpx.AsyncClient` it hands out, so a test never opens a socket. Signing helpers make
+SETs a receiver must reject, `eventually` and `during` wait for asynchronous outcomes, `ManualClock`
+moves time by hand.
+
+See the [README of easyssf-python](https://github.com/easyssf/easyssf-python#readme).

easyssf_test-0.7.0/README.md

@@ -0,0 +1,9 @@
+# easyssf-test
+
+Test support for SSF receivers built with easyssf: `TestTransmitter` signs SETs, serves its metadata
+and JWK Set, issues access tokens and emulates stream management and the poll endpoint, in-process
+through the `httpx.AsyncClient` it hands out, so a test never opens a socket. Signing helpers make
+SETs a receiver must reject, `eventually` and `during` wait for asynchronous outcomes, `ManualClock`
+moves time by hand.
+
+See the [README of easyssf-python](https://github.com/easyssf/easyssf-python#readme).

easyssf_test-0.7.0/pyproject.toml

@@ -0,0 +1,41 @@
+[project]
+name = "easyssf-test"
+version = "0.7.0"
+description = "A test transmitter for SSF receivers: signs SETs, serves metadata and a JWK Set, issues tokens, emulates stream management and the poll endpoint, in-process through an httpx transport"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+authors = [{ name = "the easyssf authors" }]
+keywords = ["ssf", "caep", "risc", "openid", "security-events", "testing"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Security",
+    "Topic :: Software Development :: Testing",
+    "Typing :: Typed",
+]
+dependencies = [
+    "easyssf-core[signing]>=0.7,<0.8",
+    "joserfc>=1.7,<2",
+    "httpx>=0.28,<1",
+]
+
+[project.urls]
+Homepage = "https://easyssf.org"
+Repository = "https://github.com/easyssf/easyssf-python"
+Changelog = "https://github.com/easyssf/easyssf-python/blob/main/CHANGELOG.md"
+
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/easyssf"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src", "README.md", "tests"]
+
+[tool.uv.sources]
+easyssf-core = { workspace = true }

easyssf_test-0.7.0/src/easyssf/testing/__init__.py

@@ -0,0 +1,43 @@
+"""Test support for SSF receivers: the in-process test transmitter, signing helpers, a manual
+clock and waiting helpers. The port of ``easyssf-test`` of the Java library."""
+
+from easyssf.core.signing import JWT_TYPE, SECEVENT_JWT_TYPE
+
+from .clock import ManualClock
+from .keys import SigningKey, claims_of, generate_key, shared_key, sign, sign_with, unsigned
+from .transmitter import (
+    ACCESS_TOKEN,
+    AUDIENCE,
+    CLIENT_ID,
+    CLIENT_SECRET,
+    InProcessTransport,
+    MetadataLocation,
+    ReportedError,
+    TestTransmitter,
+    client_for,
+)
+from .waiting import during, eventually
+
+__all__ = [
+    "ACCESS_TOKEN",
+    "AUDIENCE",
+    "CLIENT_ID",
+    "CLIENT_SECRET",
+    "JWT_TYPE",
+    "SECEVENT_JWT_TYPE",
+    "InProcessTransport",
+    "ManualClock",
+    "MetadataLocation",
+    "ReportedError",
+    "SigningKey",
+    "TestTransmitter",
+    "claims_of",
+    "client_for",
+    "during",
+    "eventually",
+    "generate_key",
+    "shared_key",
+    "sign",
+    "sign_with",
+    "unsigned",
+]

easyssf_test-0.7.0/src/easyssf/testing/clock.py

@@ -0,0 +1,38 @@
+"""A clock moved by hand, for tests of time-dependent behaviour."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+
+__all__ = ["ManualClock"]
+
+
+class ManualClock:
+    """A clock that only moves when a test moves it; a ``Clock`` for stores and pollers.
+
+    Example:
+        >>> clock = ManualClock()
+        >>> store = InMemoryJtiDedupStore(100, timedelta(minutes=5), clock)
+        >>> clock.advance(timedelta(minutes=6))
+    """
+
+    def __init__(self, now: datetime | None = None) -> None:
+        self._now = now if now is not None else datetime(2026, 1, 1, tzinfo=UTC)
+
+    def __call__(self) -> datetime:
+        """The current time of the clock."""
+        return self._now
+
+    @property
+    def now(self) -> datetime:
+        """The current time of the clock."""
+        return self._now
+
+    def advance(self, delta: timedelta) -> datetime:
+        """Moves the clock forward by ``delta`` and returns the new time."""
+        self._now += delta
+        return self._now
+
+    def set(self, now: datetime) -> None:
+        """Sets the clock to the given time."""
+        self._now = now

easyssf_test-0.7.0/src/easyssf/testing/keys.py

@@ -0,0 +1,131 @@
+"""Signing keys and signing helpers for tests: keys the receiver accepts, keys it must reject,
+and JWSs signed with whatever a test needs, with no minimum key size and no algorithm check."""
+
+from __future__ import annotations
+
+import base64
+import json
+import threading
+from dataclasses import dataclass, replace
+from typing import TYPE_CHECKING
+
+from joserfc import jws
+from joserfc.jwk import RSAKey
+
+from easyssf.core import Claims, parse_claims
+from easyssf.core.signing import SECEVENT_JWT_TYPE, Signer
+
+if TYPE_CHECKING:
+    from joserfc.jwk import ECKey, OKPKey
+
+__all__ = ["SigningKey", "claims_of", "generate_key", "shared_key", "sign", "sign_with", "unsigned"]
+
+
+@dataclass(frozen=True, slots=True)
+class SigningKey:
+    """An RSA key a transmitter signs with."""
+
+    key_id: str
+    """The ``kid`` the signed tokens carry."""
+    key: RSAKey
+    """The private key."""
+
+    def with_key_id(self, key_id: str) -> SigningKey:
+        """The same key under another ``kid``."""
+        return replace(self, key_id=key_id)
+
+    def public_jwk(self) -> Claims:
+        """The public key as a JWK with the ``kid`` and ``use``."""
+        jwk = self.key.as_dict(private=False)
+        jwk["kid"] = self.key_id
+        jwk["use"] = "sig"
+        return jwk
+
+    def signer(self, algorithm: str = "RS256") -> Signer:
+        """The key as a :class:`~easyssf.core.signing.Signer`, for SETs built with
+        :func:`easyssf.core.new_set`. Refuses a key below 2048 bits, as the signer does."""
+        return Signer(self.key, algorithm, self.key_id)
+
+
+def generate_key(bits: int, key_id: str) -> SigningKey:
+    """Makes a fresh key of the given size, for SETs the receiver must reject
+    (``generate_key(1024, "weak")``) or ones of another transmitter. :func:`shared_key` is faster."""
+    import warnings
+
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        return SigningKey(key_id, RSAKey.generate_key(bits))
+
+
+_shared_lock = threading.Lock()
+_shared: SigningKey | None = None
+
+
+def shared_key() -> SigningKey:
+    """The 2048 bit key every default transmitter of the process signs with: generating one takes
+    a while, and the tests do not depend on the keys of two transmitters differing."""
+    global _shared  # noqa: PLW0603
+    with _shared_lock:
+        if _shared is None:
+            _shared = generate_key(2048, "test-key")
+        return _shared
+
+
+def sign(key: SigningKey, typ: str | None, claims: Claims) -> str:
+    """Signs the claims with ``RS256``; ``typ`` is the ``typ`` header, left out if ``None`` or
+    ``""``. ``SECEVENT_JWT_TYPE`` makes a SET."""
+    return sign_with(key, "RS256", typ, claims)
+
+
+def sign_with(key: SigningKey | ECKey | OKPKey, algorithm: str, typ: str | None, claims: Claims) -> str:
+    """Signs the claims as a JWS in compact serialization with any algorithm of RFC 7518 that fits
+    the key: ``RS256``, ``PS256``, ``ES256``, ``EdDSA``, ... No minimum key size, unlike
+    :class:`~easyssf.core.signing.Signer`: tests need to sign with keys the receiver has to reject."""
+    import warnings
+
+    if isinstance(key, SigningKey):
+        protected: dict[str, str] = {"alg": algorithm, "kid": key.key_id}
+        private = key.key
+    else:
+        protected = {"alg": algorithm}
+        if key.kid:
+            protected["kid"] = key.kid
+        private = key  # type: ignore[assignment]
+    if typ:
+        protected["typ"] = typ
+    payload = json.dumps(claims, separators=(",", ":")).encode()
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        return jws.serialize_compact(protected, payload, private, algorithms=[algorithm])
+
+
+def unsigned(claims: Claims, typ: str | None = SECEVENT_JWT_TYPE) -> str:
+    """The claims as an unsecured JWT (RFC 7519, section 6): ``alg`` of ``none``, no signature."""
+    header: dict[str, str] = {"alg": "none"}
+    if typ:
+        header["typ"] = typ
+    return _b64(json.dumps(header, separators=(",", ":")).encode()) + "." + _b64(_dump(claims)) + "."
+
+
+def claims_of(compact: str) -> Claims:
+    """The claims of a JWS in compact serialization, without any verification.
+
+    Raises:
+        ValueError: if it is not a JWS whose payload is a JSON object.
+    """
+    parts = compact.split(".")
+    if len(parts) != 3:
+        raise ValueError("not a JWS in compact serialization")
+    return parse_claims(_unb64(parts[1]))
+
+
+def _dump(claims: Claims) -> bytes:
+    return json.dumps(claims, separators=(",", ":")).encode()
+
+
+def _b64(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def _unb64(segment: str) -> bytes:
+    return base64.urlsafe_b64decode(segment + "=" * (-len(segment) % 4))