iaptoolkit 0.2.6__tar.gz → 0.3.0__tar.gz

{iaptoolkit-0.2.6 → iaptoolkit-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: iaptoolkit
-Version: 0.2.6
+Version: 0.3.0
 Summary: Library of common utils for interacting with Identity-Aware Proxies
 Author: Rob Voigt
 Author-email: code@ravoigt.com
@@ -8,6 +8,7 @@ Requires-Python: >=3.11,<4.0
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
 Requires-Dist: google-auth (>=2.29.0,<3.0.0)
 Requires-Dist: kvcommon (>=0.1.3,<0.2.0)
 Requires-Dist: pytest (>=7.4.4,<8.0.0)

{iaptoolkit-0.2.6 → iaptoolkit-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "iaptoolkit"
-version = "0.2.6"
+version = "0.3.0"
 description = "Library of common utils for interacting with Identity-Aware Proxies"
 authors = ["Rob Voigt <code@ravoigt.com>"]
 readme = "README.md"

{iaptoolkit-0.2.6 → iaptoolkit-0.3.0}/src/iaptoolkit/__init__.py

@@ -16,6 +16,7 @@ from iaptoolkit.tokens.service_account import ServiceAccount
 from iaptoolkit.tokens.structs import ResultAddTokenHeader
 
 from iaptoolkit.tokens.structs import TokenRefreshStruct
+from iaptoolkit.tokens.structs import TokenStruct
 from iaptoolkit.utils.urls import is_url_safe_for_token
 
 LOG = logger.get_logger("iaptk")
@@ -38,11 +39,9 @@ class IAPToolkit:
     def sanitize_request_headers(request_headers: dict) -> dict:
         return headers.sanitize_request_headers(request_headers)
 
-    def get_token_oidc(self, bypass_cached: bool = False) -> TokenRefreshStruct:
+    def get_token_oidc(self, bypass_cached: bool = False) -> TokenStruct:
         try:
-            return ServiceAccount.get_token(
-                iap_client_id=self._GOOGLE_IAP_CLIENT_ID, bypass_cached=bypass_cached
-            )
+            return ServiceAccount.get_token(iap_client_id=self._GOOGLE_IAP_CLIENT_ID, bypass_cached=bypass_cached)
         except ServiceAccountTokenException as ex:
             LOG.debug(ex)
             raise
@@ -60,7 +59,11 @@ class IAPToolkit:
         return struct.id_token
 
     def get_token_and_add_to_headers(
-        self, request_headers: dict, use_oauth2: bool = False, use_auth_header: bool = False
+        self,
+        request_headers: dict,
+        use_oauth2: bool = False,
+        use_auth_header: bool = False,
+        bypass_cached: bool = False,
     ) -> bool:
         """
         Retrieves an auth token and inserts it into the supplied request_headers dict.
@@ -72,20 +75,29 @@ class IAPToolkit:
                 As a general guideline, OIDC is the assumed default approach for ServiceAccounts.
             use_auth_header: If true, use the 'Authorization' header instead of 'Proxy-Authorization'
 
+        Returns:
+            True if token retrieved from cache, False if fresh from API
+
 
         """
-        if not use_oauth2:
-            token_refresh_struct: TokenRefreshStruct = self.get_token_oidc()
+        id_token = None
+        from_cache = False
+        if use_oauth2:
+            token_refresh_struct: TokenRefreshStruct = self.get_token_oauth2(bypass_cached=bypass_cached)
+            id_token = token_refresh_struct.id_token
+            from_cache = token_refresh_struct.from_cache
         else:
-            token_refresh_struct: TokenRefreshStruct = self.get_token_oauth2()
+            token_struct: TokenStruct = self.get_token_oidc(bypass_cached=bypass_cached)
+            id_token = token_struct.id_token
+            from_cache = token_struct.from_cache
 
         headers.add_token_to_request_headers(
             request_headers=request_headers,
-            id_token=token_refresh_struct.id_token,
+            id_token=id_token,
             use_auth_header=use_auth_header,
         )
 
-        return token_refresh_struct.token_is_new
+        return from_cache
 
     @staticmethod
     def is_url_safe_for_token(
@@ -104,6 +116,7 @@ class IAPToolkit:
         valid_domains: t.List[str] | None = None,
         use_oauth2: bool = False,
         use_auth_header: bool = False,
+        bypass_cached: bool = False,
     ) -> ResultAddTokenHeader:
         """
         Checks that the supplied URL is valid (i.e.; in valid_domains) and if so, retrieves a
@@ -123,10 +136,11 @@ class IAPToolkit:
                 request_headers=request_headers,
                 use_oauth2=use_oauth2,
                 use_auth_header=use_auth_header,
+                bypass_cached=bypass_cached,
             )
             return ResultAddTokenHeader(token_added=True, token_is_fresh=token_is_fresh)
         else:
-            LOG.warn(
+            LOG.warning(
                 "URL is not approved: %s - Token will not be added to headers. Valid domains are: %s",
                 url,
                 valid_domains,
@@ -146,10 +160,17 @@ class IAPToolkit_OIDC(IAPToolkit):
         raise NotImplementedError("Cannot call OAuth2 methods on OIDC-only instance of IAPToolkit.")
 
     def get_token_and_add_to_headers(
-        self, request_headers: dict, use_auth_header: bool = False, use_oauth2: bool = False,
+        self,
+        request_headers: dict,
+        use_auth_header: bool = False,
+        use_oauth2: bool = False,
+        bypass_cached: bool = False,
     ) -> bool:
         return super().get_token_and_add_to_headers(
-            request_headers=request_headers, use_oauth2=use_oauth2, use_auth_header=use_auth_header
+            request_headers=request_headers,
+            use_oauth2=use_oauth2,
+            use_auth_header=use_auth_header,
+            bypass_cached=bypass_cached,
         )
 
     def check_url_and_add_token_header(
@@ -158,6 +179,7 @@ class IAPToolkit_OIDC(IAPToolkit):
         request_headers: dict,
         valid_domains: t.List[str] | None = None,
         use_auth_header: bool = False,
+        bypass_cached: bool = False,
     ) -> ResultAddTokenHeader:
         return super().check_url_and_add_token_header(
             url,
@@ -165,6 +187,7 @@ class IAPToolkit_OIDC(IAPToolkit):
             valid_domains=valid_domains,
             use_oauth2=False,
             use_auth_header=use_auth_header,
+            bypass_cached=bypass_cached,
         )
 
 
@@ -193,10 +216,17 @@ class IAPToolkit_OAuth2(IAPToolkit):
         raise NotImplementedError("Cannot call OIDC methods on OAuth2-only instance of IAPToolkit.")
 
     def get_token_and_add_to_headers(
-        self, request_headers: dict, use_auth_header: bool = False, use_oauth2: bool = True,
+        self,
+        request_headers: dict,
+        use_auth_header: bool = False,
+        use_oauth2: bool = True,
+        bypass_cached: bool = False,
     ) -> bool:
         return super().get_token_and_add_to_headers(
-            request_headers=request_headers, use_oauth2=use_oauth2, use_auth_header=use_auth_header
+            request_headers=request_headers,
+            use_oauth2=use_oauth2,
+            use_auth_header=use_auth_header,
+            bypass_cached=bypass_cached,
         )
 
     def check_url_and_add_token_header(
@@ -205,6 +235,7 @@ class IAPToolkit_OAuth2(IAPToolkit):
         request_headers: dict,
         valid_domains: t.List[str] | None = None,
         use_auth_header: bool = False,
+        bypass_cached: bool = False,
     ) -> ResultAddTokenHeader:
         return super().check_url_and_add_token_header(
             url=url,
@@ -212,4 +243,5 @@ class IAPToolkit_OAuth2(IAPToolkit):
             valid_domains=valid_domains,
             use_oauth2=True,
             use_auth_header=use_auth_header,
+            bypass_cached=bypass_cached,
         )

{iaptoolkit-0.2.6 → iaptoolkit-0.3.0}/src/iaptoolkit/tokens/service_account.py

@@ -46,24 +46,24 @@ class ServiceAccount(object):
                 LOG.debug("No stored service account token for current iap_client_id")
                 return
 
-            id_token_from_dict = token_dict.get("id_token")
-            token_expiry_from_dict = token_dict.get("token_expiry", "")
-
-            if not id_token_from_dict:
-                LOG.warning("Invalid stored ID token")
-                return
+            id_token_from_dict: str = token_dict.get("id_token", "")
+            token_expiry_from_dict: str = token_dict.get("token_expiry", "")
 
             token_expiry = ""
             try:
                 token_expiry = datetime.datetime.fromisoformat(token_expiry_from_dict)
             except (ValueError, TypeError) as ex:
-                LOG.debug("Invalid token expiry for current iap_client_id")
+                LOG.debug("Invalid token expiry for stored token - Could not parse from ISO format to datetime.")
                 return
 
-            token_struct = TokenStruct(id_token=id_token_from_dict, expiry=token_expiry)
+            token_struct = TokenStruct(id_token=id_token_from_dict, expiry=token_expiry, from_cache=True)
+            if not token_struct.valid:
+                LOG.debug("Stored service account token for current iap_client_id is INVALID")
+                return
             if token_struct.expired:
                 LOG.debug("Stored service account token for current iap_client_id has EXPIRED")
                 return
+
             return token_struct
 
         except Exception as ex:
@@ -108,10 +108,10 @@ class ServiceAccount(object):
         # Python datetimes assume local TZ, and we want to explicitly only work in UTC here.
         token_expiry = google_credentials.expiry.replace(tzinfo=datetime.timezone.utc)
 
-        return TokenStruct(id_token=id_token, expiry=token_expiry)
+        return TokenStruct(id_token=id_token, expiry=token_expiry, from_cache=False)
 
     @staticmethod
-    def get_token(iap_client_id: str, bypass_cached: bool = False, attempts: int = 0) -> TokenRefreshStruct:
+    def get_token(iap_client_id: str, bypass_cached: bool = False, attempts: int = 0) -> TokenStruct:
         """Retrieves an OIDC token for the current environment either from environment variable or from
         metadata service.
 
@@ -135,17 +135,17 @@ class ServiceAccount(object):
         use_cache = not bypass_cached
 
         try:
-            token_from_cache = False
-            token_struct = (use_cache and ServiceAccount.get_stored_token(iap_client_id)) or None
-            if use_cache and token_struct:
-                token_from_cache = True
-            else:
-                token_struct = ServiceAccount._get_fresh_token(iap_client_id)
+            token_struct: TokenStruct | None = None
+
+            if use_cache:
+                token_struct = ServiceAccount.get_stored_token(iap_client_id)
 
-            ServiceAccount._store_token(iap_client_id, token_struct.id_token, token_struct.expiry)
+            if not token_struct:
+                token_struct = ServiceAccount._get_fresh_token(iap_client_id)
+                if use_cache:
+                    ServiceAccount._store_token(iap_client_id, token_struct.id_token, token_struct.expiry)
 
-            token_refresh_struct = TokenRefreshStruct(id_token=token_struct.id_token, token_is_new=not token_from_cache)
-            return token_refresh_struct
+            return token_struct
 
         except ServiceAccountTokenException as ex:
             attempts += 1
@@ -173,7 +173,7 @@ class GoogleServiceAccount(ServiceAccount):
     def get_stored_token(self) -> t.Optional[TokenStruct]:
         return ServiceAccount.get_stored_token(self._iap_client_id)
 
-    def get_token(self, bypass_cached: bool = False, attempts: int = 0) -> TokenRefreshStruct:
+    def get_token(self, bypass_cached: bool = False, attempts: int = 0) -> TokenStruct:
         return ServiceAccount.get_token(
             iap_client_id=self._iap_client_id, bypass_cached=bypass_cached, attempts=attempts
         )

{iaptoolkit-0.2.6 → iaptoolkit-0.3.0}/src/iaptoolkit/tokens/structs.py

@@ -8,10 +8,18 @@ from kvcommon import logger
 LOG = logger.get_logger("iaptk")
 
 
+def validate_token(token: str | None) -> bool:
+    if not isinstance(token, str) or token.strip() == "":
+        return False
+
+    return True
+
+
 @dataclass(kw_only=True)
 class TokenStruct:
     id_token: str
     expiry: datetime.datetime
+    from_cache: bool = False
 
     @property
     def expired(self):
@@ -30,17 +38,28 @@ class TokenStruct:
             LOG.error("Exception when checking token expiry. exception=%s", ex)
             return True
 
+    @property
+    def valid(self):
+        return validate_token(self.id_token)
+
 
 @dataclass(kw_only=True)
 class TokenRefreshStruct:
     id_token: str
-    token_is_new: bool = True
+    from_cache: bool = False
 
+    @property
+    def valid(self):
+        return validate_token(self.id_token)
 
 @dataclass(kw_only=True)
 class TokenStructOAuth2(TokenStruct):
     refresh_token: str
-    new_refresh_token: bool = False
+    from_cache: bool = False
+
+    @property
+    def valid(self):
+        return validate_token(self.refresh_token)
 
 
 @dataclass(kw_only=True)