jamlib 3.2.0rc2__tar.gz → 3.3.0__tar.gz

{jamlib-3.2.0rc2/src/jamlib.egg-info → jamlib-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: jamlib
-Version: 3.2.0rc2
+Version: 3.3.0
 Summary: Simple and universal library for authorization.
 Author-email: Makridenko Adrian <adrianmakridenko@duck.com>, Ksenia Travnikova <kseniatravnikova@duck.com>
 License: Apache-2.0
@@ -62,6 +62,8 @@ Dynamic: license-file
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/lyaguxafrog/jam)
 [![GitHub License](https://img.shields.io/github/license/lyaguxafrog/jam)](https://github.com/lyaguxafrog/jam/blob/master/LICENSE.md)
 
+**Jam (Jam Auth Module)** - A universal auth* combine that provides popular auth mechanisms strictly according to the specification.
+
 * Documentation: [jam.makridenko.ru](https://jam.makridenko.ru)
 * Changelog: [CHANGELOG.md](https://github.com/lyaguxafrog/jam/blob/master/CHANGELOG.md)
 
@@ -90,6 +92,7 @@ Jam is a library that provides the most popular AUTH* mechanisms right out of th
 * [Server side sessions](https://jam.makridenko.ru/usage/sessions/)
 * [OTP](https://jam.makridenko.ru/usage/otp/)
 * [OAuth2](https://jam.makridenko.ru/usage/oauth2/)
+* [SAML](https://jam.makridenko.ru/usage/saml/)
 
 ### Framework integrations
 
@@ -115,5 +118,6 @@ Here is a comparison with other libraries:
 | Server side sessions  | ✅     | ✅                               | ❌                                    | ❌                                  | ❌                                   |
 | OTP                   | ✅     | ❌                               | ❌                                    | ❌                                  | ✅                                   |
 | OAuth2                | ✅     | ✅                               | ❌                                    | ✅                                  | ❌                                   |
+| SAML 2.0              | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |
 | Flexible config       | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |
 | Modularity            | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |

{jamlib-3.2.0rc2 → jamlib-3.3.0}/README.md

@@ -9,6 +9,8 @@
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/lyaguxafrog/jam)
 [![GitHub License](https://img.shields.io/github/license/lyaguxafrog/jam)](https://github.com/lyaguxafrog/jam/blob/master/LICENSE.md)
 
+**Jam (Jam Auth Module)** - A universal auth* combine that provides popular auth mechanisms strictly according to the specification.
+
 * Documentation: [jam.makridenko.ru](https://jam.makridenko.ru)
 * Changelog: [CHANGELOG.md](https://github.com/lyaguxafrog/jam/blob/master/CHANGELOG.md)
 
@@ -37,6 +39,7 @@ Jam is a library that provides the most popular AUTH* mechanisms right out of th
 * [Server side sessions](https://jam.makridenko.ru/usage/sessions/)
 * [OTP](https://jam.makridenko.ru/usage/otp/)
 * [OAuth2](https://jam.makridenko.ru/usage/oauth2/)
+* [SAML](https://jam.makridenko.ru/usage/saml/)
 
 ### Framework integrations
 
@@ -62,5 +65,6 @@ Here is a comparison with other libraries:
 | Server side sessions  | ✅     | ✅                               | ❌                                    | ❌                                  | ❌                                   |
 | OTP                   | ✅     | ❌                               | ❌                                    | ❌                                  | ✅                                   |
 | OAuth2                | ✅     | ✅                               | ❌                                    | ✅                                  | ❌                                   |
+| SAML 2.0              | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |
 | Flexible config       | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |
 | Modularity            | ✅     | ❌                               | ❌                                    | ❌                                  | ❌                                   |

{jamlib-3.2.0rc2 → jamlib-3.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "jamlib"
-version = "3.2.0rc2"
+version = "3.3.0"
 description = "Simple and universal library for authorization."
 authors = [
     {name = "Makridenko Adrian",email = "adrianmakridenko@duck.com"},

jamlib-3.3.0/src/jam/__defaults__.py

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+
+from dataclasses import dataclass
+import os
+
+
+@dataclass(slots=True, frozen=True)
+class DEFAULTS:
+    """Jam defaults vars."""
+
+    DEBUG: bool = os.getenv("JAM_DEBUG", "False") == "True"
+    """Debug flag. Use only while developing jam module."""
+
+    TEMP_DIR: str = os.getenv("JAM_TMP_DIR", "/tmp/jam/")
+    """tmp directory for storing temporary files and blobs."""
+
+    ENABLE_PLUGINS: bool = os.getenv("JAM_ENABLE_PLUGINS", "1") == "0"
+    """Enabling experimental plugin features."""
+
+
+defaults = DEFAULTS()

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/__init__.py

@@ -10,5 +10,5 @@ from jam.__base__ import BaseJam
 from jam.instance import Jam
 
 
-__version__ = "3.2.0rc2"
+__version__ = "3.3.0"
 __all__ = ["Jam", "BaseJam"]

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/exceptions/__init__.py

@@ -45,6 +45,17 @@ from .sessions import (
     JamSessionEmptyAESKey,
     JamSessionNotFound,
 )
+from .saml import (
+    JamSAMLError,
+    JamSAMLExpired,
+    JamSAMLNotYetValid,
+    JamSAMLInvalidAudience,
+    JamSAMLInvalidIssuer,
+    JamSAMLEmptyPrivateKey,
+    JamSAMLEmptyPublicKey,
+    JamSAMLUnsupportedAlgorithm,
+    JamSAMLValidationError,
+)
 
 
 __all__ = [
@@ -81,4 +92,13 @@ __all__ = [
     "JamStarlettePluginError",
     "JamSessionNotFound",
     "JamSessionEmptyAESKey",
+    "JamSAMLError",
+    "JamSAMLExpired",
+    "JamSAMLNotYetValid",
+    "JamSAMLInvalidAudience",
+    "JamSAMLInvalidIssuer",
+    "JamSAMLEmptyPrivateKey",
+    "JamSAMLEmptyPublicKey",
+    "JamSAMLUnsupportedAlgorithm",
+    "JamSAMLValidationError",
 ]

jamlib-3.3.0/src/jam/exceptions/saml.py

@@ -0,0 +1,66 @@
+# -*- coding: utf-8 -*-
+
+from .base import JamConfigurationError, JamError, JamValidationError
+
+
+class JamSAMLError(JamError):
+    default_message = "SAML error occurred."
+    default_code = "saml.error"
+
+
+class JamSAMLExpired(JamError):
+    default_message = "SAML assertion has expired."
+    default_code = "saml.assertion_expired"
+
+
+class JamSAMLNotYetValid(JamError):
+    default_message = "SAML assertion is not yet valid."
+    default_code = "saml.assertion_not_yet_valid"
+
+
+class JamSAMLInvalidAudience(JamError):
+    default_message = "SAML assertion audience validation failed."
+    default_code = "saml.invalid_audience"
+
+
+class JamSAMLInvalidIssuer(JamError):
+    default_message = "SAML assertion issuer validation failed."
+    default_code = "saml.invalid_issuer"
+
+
+class JamSAMLEmptyPrivateKey(JamConfigurationError):
+    default_message = "For SAML signing, you must specify `private_key`."
+    default_code = "saml.config.empty_private_key"
+
+
+class JamSAMLEmptyPublicKey(JamConfigurationError):
+    default_message = "For SAML verification, you must specify `public_key`."
+    default_code = "saml.config.empty_public_key"
+
+
+class JamSAMLUnsupportedAlgorithm(JamConfigurationError):
+    default_message = "Unsupported SAML algorithm."
+    default_code = "saml.config.unsupported_algorithm"
+
+
+class JamSAMLValidationError(JamValidationError):
+    default_message = "SAML assertion validation failed."
+    default_code = "saml.validation.assertion_error"
+
+
+class JamSAMLInvalidRecipient(JamError):
+    default_message = (
+        "SAML assertion SubjectConfirmationData Recipient "
+        "does not match the expected ACS URL."
+    )
+    default_code = "saml.invalid_recipient"
+
+
+class JamSAMLReplayDetected(JamError):
+    default_message = "SAML message ID has already been consumed (replay attack)."
+    default_code = "saml.replay_detected"
+
+
+class JamSAMLSOAPError(JamError):
+    default_message = "SAML SOAP/artifact resolution failed."
+    default_code = "saml.soap_error"

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/ext/litestar/middleware.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 
-from collections.abc import Callable
+from typing import Any
 
 from litestar.connection import ASGIConnection
 from litestar.middleware import (
@@ -18,7 +18,7 @@ from jam.paseto import BasePASETO
 class BaseMiddleware(AbstractAuthenticationMiddleware):
     """Base Jam middleware for litestar."""
 
-    AUTH_MODULE: Callable
+    AUTH_MODULE: Any
     HEADER_NAME: str | None
     COOKIE_NAME: str | None
     BEARER: bool = False
@@ -95,7 +95,7 @@ class SessionMiddleware(BaseMiddleware):
             if not data:
                 return AuthenticationResult(None, auth=token_model)
             user = self.USER.from_payload(data)
-            return AuthenticationResult(user, token)
+            return AuthenticationResult(user=user, auth=token_model)
         except Exception as e:
             raise JamLitestarPluginError(message=str(e))
 
@@ -113,10 +113,10 @@ class PASETOMiddleware(BaseMiddleware):
         if not token:
             return AuthenticationResult(None, auth=token_model)
         try:
-            data = self.AUTH_MODULE.decode(token)
-            if not data:
+            result = self.AUTH_MODULE.decode(token)
+            if not result:
                 return AuthenticationResult(None, auth=token_model)
-            user = self.USER.from_payload(data)
-            return AuthenticationResult(user, token)
+            user = self.USER.from_payload(result[0])
+            return AuthenticationResult(user=user, auth=token_model)
         except Exception as e:
             raise JamLitestarPluginError(message=str(e))

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/ext/litestar/objects.py

@@ -4,10 +4,7 @@ from __future__ import annotations
 
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
-from typing import Any, TypeVar
-
-
-User = TypeVar("User", bound="BaseUser")
+from typing import Any
 
 
 @dataclass(slots=True)
@@ -23,7 +20,7 @@ class BaseUser(ABC):
 
     @classmethod
     @abstractmethod
-    def from_payload(cls, payload: dict[str, Any]) -> User:
+    def from_payload(cls, payload: dict[str, Any]) -> BaseUser:
         """Build model from payload.
 
         Args:

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/ext/starlette/objects.py

@@ -1,21 +1,20 @@
 # -*- coding: utf-8 -*-
 
+from __future__ import annotations
+
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
-from typing import Any, TypeVar
+from typing import Any
 
 from starlette.authentication import BaseUser as StarletteBaseUser
 
 
-User = TypeVar("User", bound="BaseUser")
-
-
 class BaseUser(ABC, StarletteBaseUser):
     """BaseUser with builder from payload."""
 
     @classmethod
     @abstractmethod
-    def from_payload(cls, payload: dict[str, Any]) -> User:
+    def from_payload(cls, payload: dict[str, Any]) -> BaseUser:
         """Create instance by payload.
 
         Args:
@@ -49,7 +48,7 @@ class SimpleUser(BaseUser):
     payload: dict[str, Any]
 
     @classmethod
-    def from_payload(cls, payload: dict[str, Any]):  # noqa
+    def from_payload(cls, payload: dict[str, Any]) -> SimpleUser:  # noqa
         return cls(payload=payload)
 
     def is_authenticated(self) -> bool:  # type: ignore # noqa

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/__algorithms__.py

@@ -112,6 +112,8 @@ class BaseAlgorithm(ABC):
             except OSError:
                 is_file = False
             return path.read_bytes() if is_file else data.encode()
+        if isinstance(data, rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey):
+            data = data.public_key()
         return data.public_bytes(
             encoding=serialization.Encoding.PEM,
             format=serialization.PublicFormat.SubjectPublicKeyInfo,
@@ -602,6 +604,11 @@ class BaseKeyAlgorithm(ABC):
         if hasattr(self._key, "private_key"):
             return self._key.private_key()
 
+        if isinstance(
+            self._key, rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey
+        ):
+            return self._key
+
         key_bytes = self._load_key_data(self._key)
         return serialization.load_pem_private_key(
             key_bytes, password=self._password
@@ -620,6 +627,8 @@ class BaseKeyAlgorithm(ABC):
             except OSError:
                 is_file = False
             return path.read_bytes() if is_file else data.encode()
+        if isinstance(data, rsa.RSAPrivateKey | ec.EllipticCurvePrivateKey):
+            data = data.public_key()
         return data.public_bytes(
             encoding=serialization.Encoding.PEM,
             format=serialization.PublicFormat.SubjectPublicKeyInfo,

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/jwe.py

@@ -66,6 +66,8 @@ class JWE(BaseJWE):
 
         self._alg = alg.upper()
         self._enc = enc.upper()
+        if isinstance(key, JWKClass):
+            key = key._to_keylike()
         self._key = key
         self._password = password
         self._serializer = serializer

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/jwk.py

@@ -56,9 +56,6 @@ class JWKRSA(JWKCommon, total=False):
         ... }
     """
 
-    kty: Literal["RSA"]
-    """Key Type. Fixed to "RSA"."""
-
     n: str
     """RSA modulus n. The modulus value for the RSA public key."""
 
@@ -98,9 +95,6 @@ class JWKEC(JWKCommon, total=False):
         ... }
     """
 
-    kty: Literal["EC"]
-    """Key Type. Fixed to "EC"."""
-
     crv: Literal["P-256", "P-384", "P-521"]
     """Elliptic curve name. The curve on which the key is based."""
 
@@ -126,9 +120,6 @@ class JWKOct(JWKCommon, total=False):
         ... }
     """
 
-    kty: Literal["oct"]
-    """Key Type. Fixed to "oct"."""
-
     k: str
     """Key value. The base64url-encoded symmetric key value."""
 

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/jws.py

@@ -84,7 +84,7 @@ class JWS(BaseJWS):
     def serialize_compact(
         self,
         protected: dict[str, Any],
-        payload: bytes | str,
+        payload: bytes | str | dict[str, Any],
     ) -> str:
         """Create JWS Compact Serialization.
 

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/jwt.py

@@ -25,7 +25,7 @@ from jam.jose.__algorithms__ import (
     KeyLike,
     create_algorithm,
 )
-from jam.jose.__base__ import BaseJWS, BaseJWT
+from jam.jose.__base__ import BaseJWT
 from jam.jose.jwe import JWE
 from jam.jose.jws import JWS
 from jam.jose.lists import BaseJWTList
@@ -81,6 +81,11 @@ class JWT(BaseJWT):
         self._logger = logger
         self._serializer = serializer
 
+        self.jws: JWS | None = None
+        self.jwe: JWE | None = None
+        self._alg: str | None = None
+        self._enc: str | None = None
+
         if jws is not None:
             if alg is not None:
                 raise JamConfigurationError(
@@ -158,47 +163,60 @@ class JWT(BaseJWT):
             return key.encode() if key else key
         return key
 
-    def _build_jws(self) -> BaseJWS:
-        if not self._alg or not self._key:
+    def _build_jws(self) -> JWS:
+        alg = self._alg
+        key = self._key
+        if not alg or not key:
             raise JamConfigurationError(message="JWS requires 'alg' and 'key'")
 
-        return self.JWS(
-            alg=self._alg,
-            key=self._key,
+        return JWS(
+            alg=alg,
+            key=key,
             password=self._password,
             logger=self._logger,
         )
 
     def _build_jwe(self) -> JWE:
-        if not self._enc:
+        enc = self._enc
+        if not enc:
             raise JamConfigurationError(
                 message="JWE requires 'enc' to be provided"
             )
 
-        key_type = self._detect_key_type(self._key)
+        key = self._key
+        key_type = self._detect_key_type(key)
 
         if key_type == "rsa":
             jwe_alg = "RSA-OAEP"
-            enc_key = self._key
+            enc_key = key
         elif key_type == "ec":
             jwe_alg = "ECDH-ES"
-            enc_key = self._key
+            enc_key = key
         elif key_type == "symmetric":
-            key_len = (
-                len(self._key)
-                if isinstance(self._key, bytes)
-                else len(self._key.encode())
-            )
+            if isinstance(key, bytes):
+                key_bytes = key
+            elif isinstance(key, str):
+                key_bytes = key.encode("utf-8")
+            else:
+                raise JamInvalidKeyTypeError(
+                    message="Symmetric JWE requires a bytes or str key"
+                )
+            key_len = len(key_bytes)
             jwe_alg = "A256KW" if key_len >= 32 else "A128KW"
-            enc_key = self._derive_encryption_key(self._key)
+            enc_key = self._derive_encryption_key(key_bytes)
         else:
             raise JamInvalidKeyTypeError(
                 message=f"Unsupported key type for JWE: {key_type}"
             )
 
+        if enc_key is None:
+            raise JamInvalidKeyTypeError(
+                message=f"Unsupported key type for JWE: {key_type}"
+            )
+
         return self.JWE(
             alg=jwe_alg,
-            enc=self._enc,
+            enc=enc,
             key=enc_key,
             password=self._password,
             serializer=self._serializer,
@@ -354,13 +372,15 @@ class JWT(BaseJWT):
     @property
     def _algo(self) -> BaseAlgorithm:
         """Get or create algorithm instance."""
+        alg = self._alg
+        key = self._key
         if self._algorithm is None:
-            if not self._alg or not self._key:
+            if not alg or not key:
                 raise JamConfigurationError(
                     message="JWS requires 'alg' and 'key'"
                 )
             self._algorithm = create_algorithm(
-                self._alg, self._key, self._password, self._logger
+                alg, key, self._password, self._logger
             )
         return self._algorithm
 
@@ -569,10 +589,15 @@ class JWT(BaseJWT):
 
             decoded = self.jws.verify(plaintext, True)
             payload = decoded.get("payload")
-            if isinstance(payload, bytes):
-                payload_str = payload.decode("utf-8")
-            else:
-                payload_str = payload
+            payload_str = (
+                payload.decode("utf-8")
+                if isinstance(payload, bytes)
+                else payload
+            )
+            if not isinstance(payload_str, str):
+                raise JamJWSVerificationError(
+                    message="Invalid JWS payload in nested token.",
+                )
 
             if "." in payload_str:
                 inner_parts = payload_str.split(".")
@@ -594,9 +619,11 @@ class JWT(BaseJWT):
                     inner_decoded = self.jws.verify(payload_str, True)
 
                 inner_payload = inner_decoded.get("payload")
-                if isinstance(inner_payload, bytes):
+                if isinstance(inner_payload, bytes | str):
                     return self._serializer.loads(inner_payload)
-                return self._serializer.loads(inner_payload)
+                raise JamJWSVerificationError(
+                    message="Invalid inner JWS payload.",
+                )
 
             return self._serializer.loads(payload_str)
 

{jamlib-3.2.0rc2 → jamlib-3.3.0}/src/jam/jose/lists/redis.py

@@ -134,9 +134,11 @@ class RedisList(BaseJWTList):
         """
         if not tokens:
             return {}
-        keys = [self._make_key(t) for t in tokens]
-        exists = self._redis.exists(*keys)
-        return {token: bool(result) for token, result in zip(tokens, exists)}
+        pipe = self._redis.pipeline()
+        for token in tokens:
+            pipe.exists(self._make_key(token))
+        results = pipe.execute()
+        return {token: bool(result) for token, result in zip(tokens, results)}
 
     def delete(self, token: str) -> None:
         """Remove a token from the list.