latch-asgi 1.0.3__tar.gz → 1.0.5__tar.gz

{latch_asgi-1.0.3 → latch_asgi-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: latch-asgi
-Version: 1.0.3
+Version: 1.0.5
 Summary: ASGI python server
 Author-Email: Max Smolin <max@latch.bio>
 License: CC0-1.0

{latch_asgi-1.0.3 → latch_asgi-1.0.5}/latch_asgi/auth.py

@@ -27,7 +27,8 @@ authentication_header_regex = re.compile(
         Bearer \s+ (?P<oauth_token>.*) |
         Latch-Execution-Token \s+ (?P<execution_token>.*) |
         Latch-SDK-Token \s+ (?P<sdk_token>.*) |
-        Latch-X-Server-Token \s+ (?P<server_token>.*)
+        Latch-X-Server-Token \s+ (?P<server_token>.*) |
+        Latch-Session-Token \s+ (?P<session_token>.*)
     )$
     """,
     re.IGNORECASE | re.VERBOSE,
@@ -58,6 +59,7 @@ class _HTTPUnauthorized(HTTPErrorResponse):
 class Authorization:
     oauth_sub: str | None = None
     execution_token: str | None = None
+    session_token: str | None = None
     sdk_token: str | None = None
     cross_server_token: str | None = None
 
@@ -105,6 +107,10 @@ def get_signer_sub(auth_header: str) -> Authorization:
         if sdk_token is not None:
             return Authorization(sdk_token=sdk_token)
 
+        session_token = auth_match.group("session_token")
+        if session_token is not None:
+            return Authorization(session_token=session_token)
+
         cross_server_token = auth_match.group("server_token")
         if cross_server_token is not None:
             if (
@@ -141,15 +147,15 @@ def get_signer_sub(auth_header: str) -> Authorization:
             # ) from e
 
     with app_tracer.start_as_current_span("decode jwt"):
+        audience = config.audience if jwt_key != config.self_signed_jwk else None
         try:
             jwt_data: dict[str, str] = jwt.decode(
                 oauth_token,
                 key=jwt_key,
                 algorithms=["RS256", "HS256"],
                 # fixme(maximsmol): gut this abomination
-                audience=(
-                    config.audience if jwt_key != config.self_signed_jwk else None
-                ),
+                audience=audience,
+                options={"verify_aud": audience is not None},
             )
         except jwt.exceptions.InvalidTokenError as e:
             # todo(maximsmol): filter out scope failures and include the correct error code

{latch_asgi-1.0.3 → latch_asgi-1.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "latch-asgi"
-version = "1.0.3"
+version = "1.0.5"
 description = "ASGI python server"
 authors = [
     { name = "Max Smolin", email = "max@latch.bio" },