iaptoolkit 0.2.5__tar.gz → 0.2.6__tar.gz

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iaptoolkit
-Version: 0.2.5
+Version: 0.2.6
 Summary: Library of common utils for interacting with Identity-Aware Proxies
 Author: Rob Voigt
 Author-email: code@ravoigt.com

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "iaptoolkit"
-version = "0.2.5"
+version = "0.2.6"
 description = "Library of common utils for interacting with Identity-Aware Proxies"
 authors = ["Rob Voigt <code@ravoigt.com>"]
 readme = "README.md"
@@ -16,7 +16,7 @@ Repository = "https://github.com/RAVoigt/iaptoolkit"
 # ================================
 # Tools etc.
 [tool.black]
-line-length = 100
+line-length = 120
 target-version = ['py311']
 include = '\.pyi?$'
 

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/src/iaptoolkit/exceptions.py

@@ -23,9 +23,7 @@ class TokenStorageException(TokenException):
 
 
 class ServiceAccountTokenException(TokenException):
-    def __init__(
-        self, message: str, google_exception: t.Union[DefaultCredentialsError, RefreshError] | None
-    ):
+    def __init__(self, message: str, google_exception: t.Union[DefaultCredentialsError, RefreshError] | None):
         self.google_exception = google_exception
         credentials_env_var_value = os.environ.get(GOOGLE_CREDENTIALS_FILE_PATH)
         metadata_server_attempted = not credentials_env_var_value

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/src/iaptoolkit/headers.py

@@ -34,9 +34,7 @@ def sanitize_request_headers(headers: dict) -> dict:
     return log_safe_headers
 
 
-def add_token_to_request_headers(
-    request_headers: dict, id_token: str, use_auth_header: bool = False
-) -> dict:
+def add_token_to_request_headers(request_headers: dict, id_token: str, use_auth_header: bool = False) -> dict:
     """
     Adds Bearer token to headers dict. Modifies dict in-place.
     Returns True if added token is a fresh one, or False if token is from cache

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/src/iaptoolkit/tokens/service_account.py

@@ -14,6 +14,7 @@ from iaptoolkit.tokens.token_datastore import datastore
 from iaptoolkit.exceptions import ServiceAccountTokenException
 from iaptoolkit.exceptions import ServiceAccountTokenFailedRefresh
 from iaptoolkit.exceptions import ServiceAccountNoDefaultCredentials
+from iaptoolkit.exceptions import TokenException
 from iaptoolkit.exceptions import TokenStorageException
 
 from .structs import TokenStruct
@@ -41,11 +42,7 @@ class ServiceAccount(object):
     def get_stored_token(iap_client_id: str) -> t.Optional[TokenStruct]:
         try:
             token_dict = datastore.get_stored_service_account_token(iap_client_id)
-            if (
-                not token_dict
-                or not token_dict.get("id_token", None)
-                or not token_dict.get("token_expiry", None)
-            ):
+            if not token_dict or not token_dict.get("id_token", None) or not token_dict.get("token_expiry", None):
                 LOG.debug("No stored service account token for current iap_client_id")
                 return
 
@@ -71,9 +68,7 @@ class ServiceAccount(object):
 
         except Exception as ex:
             # Err on the side of not letting token-caching break requests, hence blanket except
-            raise TokenStorageException(
-                f"Exception when trying to retrieve stored token. exception={ex}"
-            )
+            raise TokenStorageException(f"Exception when trying to retrieve stored token. exception={ex}")
 
     @staticmethod
     def _get_fresh_credentials(iap_client_id: str) -> GoogleIDTokenCredentials:
@@ -104,6 +99,8 @@ class ServiceAccount(object):
     def _get_fresh_token(iap_client_id: str) -> TokenStruct:
         google_credentials = ServiceAccount._get_fresh_credentials(iap_client_id)
         id_token: str = str(google_credentials.token)
+        if not id_token:
+            raise TokenException("Invalid [empty] token retrieved for Service Account.")
 
         # Google lib uses deprecated 'utcfromtimestamp' func as of v2.29.x
         # e.g.: datetime.datetime.utcfromtimestamp(payload["exp"])
@@ -114,9 +111,7 @@ class ServiceAccount(object):
         return TokenStruct(id_token=id_token, expiry=token_expiry)
 
     @staticmethod
-    def get_token(
-        iap_client_id: str, bypass_cached: bool = False, attempts: int = 0
-    ) -> TokenRefreshStruct:
+    def get_token(iap_client_id: str, bypass_cached: bool = False, attempts: int = 0) -> TokenRefreshStruct:
         """Retrieves an OIDC token for the current environment either from environment variable or from
         metadata service.
 
@@ -149,9 +144,7 @@ class ServiceAccount(object):
 
             ServiceAccount._store_token(iap_client_id, token_struct.id_token, token_struct.expiry)
 
-            token_refresh_struct = TokenRefreshStruct(
-                id_token=token_struct.id_token, token_is_new=not token_from_cache
-            )
+            token_refresh_struct = TokenRefreshStruct(id_token=token_struct.id_token, token_is_new=not token_from_cache)
             return token_refresh_struct
 
         except ServiceAccountTokenException as ex:
@@ -173,9 +166,7 @@ class GoogleServiceAccount(ServiceAccount):
 
     def __init__(self, iap_client_id: str) -> None:
         if not iap_client_id or not isinstance(iap_client_id, str):
-            raise ServiceAccountTokenException(
-                "Invalid iap_client_id for GoogleServiceAccount", google_exception=None
-            )
+            raise ServiceAccountTokenException("Invalid iap_client_id for GoogleServiceAccount", google_exception=None)
         self._iap_client_id = iap_client_id
         super().__init__()
 

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/src/iaptoolkit/tokens/token_datastore.py

@@ -4,9 +4,11 @@ import typing as t
 from kvcommon import logger
 from kvcommon.datastore.backend import DatastoreBackend
 from kvcommon.datastore.backend import DictBackend
+
 # from kvcommon.datastore.backend import TOMLBackend
 from kvcommon.datastore import VersionedDatastore
 
+from iaptoolkit.exceptions import TokenException
 from iaptoolkit.constants import IAPTOOLKIT_CONFIG_VERSION
 
 
@@ -38,9 +40,10 @@ class TokenDatastore(VersionedDatastore):
             return
         return token_struct_dict
 
-    def store_service_account_token(
-        self, iap_client_id: str, id_token: str, token_expiry: datetime.datetime
-    ):
+    def store_service_account_token(self, iap_client_id: str, id_token: str, token_expiry: datetime.datetime):
+        if not id_token:
+            raise TokenException("TokenDatastore: Attempting to store invalid [empty] token")
+
         tokens_dict = self.get_or_create_nested_dict(self._service_account_tokens_key)
         tokens_dict[iap_client_id] = dict(id_token=id_token, token_expiry=token_expiry.isoformat())
 
@@ -62,6 +65,7 @@ class TokenDatastore(VersionedDatastore):
     #     # TODO: OAuth2
     #     raise NotImplementedError()
 
+
 datastore = TokenDatastore(DictBackend)
 
 # if PERSISTENT_DATASTORE_ENABLED:

{iaptoolkit-0.2.5 → iaptoolkit-0.2.6}/src/iaptoolkit/utils/urls.py

@@ -21,7 +21,8 @@ def is_url_safe_for_token(
             f"Invalid url_parts - Expected a ParseResult - Got: "
             f"'{str(url_parts)}' (type#: {type(url_parts).__name__})"
         )
-    if allowed_domains is not None and not isinstance(allowed_domains, (list, set, tuple)) :
+
+    if allowed_domains is not None and not isinstance(allowed_domains, (list, set, tuple)):
         raise TypeError("allowed_domains must be a list, set or tuple if not None")
 
     netloc = get_netloc_without_port_from_url_parts(url_parts)
@@ -34,8 +35,7 @@ def is_url_safe_for_token(
     for domain in allowed_domains:
         if domain == "" or not isinstance(domain, str):
             raise InvalidDomain(
-                f"Empty or non-string domain in allowed_domains: "
-                f"'{str(domain)}' (type#: {type(domain).__name__})"
+                f"Empty or non-string domain in allowed_domains: " f"'{str(domain)}' (type#: {type(domain).__name__})"
             )
 
         if netloc.endswith(domain):