mainsequence 9.0.3.dev33__tar.gz → 9.0.4__tar.gz

{mainsequence-9.0.3.dev33/mainsequence.egg-info → mainsequence-9.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.3.dev33
+Version: 9.0.4
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.3.dev33 → mainsequence-9.0.4}/mainsequence/server/caller_assertions.py

@@ -15,14 +15,14 @@ import requests
 
 try:
     import jwt
-    from cryptography.hazmat.primitives.asymmetric import rsa
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
     from jwt import InvalidKeyError, InvalidTokenError
 except ImportError as exc:
     raise ImportError("Caller verification requires the mainsequence[server] extra.") from exc
 
 ASSERTION_HEADER = "X-MainSequence-Caller-Assertion"
 ASSERTION_TYPE = "mainsequence-caller-assertion+jwt"
-ASSERTION_ALGORITHM = "RS256"
+ASSERTION_ALGORITHM = "EdDSA"
 MAX_ASSERTION_SECONDS = 300
 KEY_CACHE_SECONDS = 60
 REQUIRED_CLAIMS = frozenset(
@@ -107,7 +107,7 @@ class CallerAssertionVerifier:
         self.issuer = issuer
         self.jwks_url = jwks_url
         self._fetch_jwks = fetch_jwks or self._fetch_public_keys
-        self._keys: dict[str, rsa.RSAPublicKey] = {}
+        self._keys: dict[str, Ed25519PublicKey] = {}
         self._keys_until = 0.0
         self._lock = threading.Lock()
 
@@ -141,35 +141,36 @@ class CallerAssertionVerifier:
             raise CallerAssertionUnavailable("Caller public keys are unavailable.") from None
 
     @staticmethod
-    def _parse_public_keys(document: object) -> dict[str, rsa.RSAPublicKey]:
+    def _parse_public_keys(document: object) -> dict[str, Ed25519PublicKey]:
         if not isinstance(document, dict) or set(document) != {"keys"}:
             raise CallerAssertionUnavailable("Caller public-key document is invalid.")
         entries = document["keys"]
         if not isinstance(entries, list) or not 1 <= len(entries) <= 16:
             raise CallerAssertionUnavailable("Caller public-key set is invalid.")
-        keys: dict[str, rsa.RSAPublicKey] = {}
+        keys: dict[str, Ed25519PublicKey] = {}
         for entry in entries:
             if (
                 not isinstance(entry, dict)
-                or set(entry) != {"kid", "alg", "use", "kty", "n", "e"}
+                or set(entry) != {"kid", "alg", "use", "kty", "crv", "x"}
                 or entry.get("alg") != ASSERTION_ALGORITHM
                 or entry.get("use") != "sig"
-                or entry.get("kty") != "RSA"
+                or entry.get("kty") != "OKP"
+                or entry.get("crv") != "Ed25519"
             ):
                 raise CallerAssertionUnavailable("Caller public key is invalid.")
             kid = entry["kid"]
             if not isinstance(kid, str) or not kid or len(kid) > 128 or kid in keys:
                 raise CallerAssertionUnavailable("Caller public-key ID is invalid.")
             try:
-                key = jwt.algorithms.RSAAlgorithm.from_jwk(entry)
+                key = jwt.algorithms.OKPAlgorithm.from_jwk(entry)
             except (ValueError, TypeError, InvalidKeyError) as exc:
                 raise CallerAssertionUnavailable("Caller public key is invalid.") from exc
-            if not isinstance(key, rsa.RSAPublicKey) or key.key_size < 2048:
-                raise CallerAssertionUnavailable("Caller public key is too small.")
+            if not isinstance(key, Ed25519PublicKey):
+                raise CallerAssertionUnavailable("Caller public key is not an Ed25519 public key.")
             keys[kid] = key
         return keys
 
-    def _key_for(self, kid: str) -> rsa.RSAPublicKey:
+    def _key_for(self, kid: str) -> Ed25519PublicKey:
         with self._lock:
             if time.monotonic() >= self._keys_until or kid not in self._keys:
                 self._keys = {}

{mainsequence-9.0.3.dev33 → mainsequence-9.0.4/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.3.dev33
+Version: 9.0.4
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.3.dev33 → mainsequence-9.0.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.3.dev33"
+version = "9.0.4"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.3.dev33 → mainsequence-9.0.4}/tests/test_caller_assertions.py

@@ -8,7 +8,7 @@ import pytest
 import requests
 
 jwt = pytest.importorskip("jwt")
-rsa = pytest.importorskip("cryptography.hazmat.primitives.asymmetric.rsa")
+ed25519 = pytest.importorskip("cryptography.hazmat.primitives.asymmetric.ed25519")
 
 from mainsequence.server.caller_assertions import (  # noqa: E402
     ASSERTION_TYPE,
@@ -28,16 +28,16 @@ KEYS_URL = f"{ISSUER}/caller-keys/"
 def keys():
     result = []
     for kid in ("first", "second"):
-        key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-        public = jwt.algorithms.RSAAlgorithm.to_jwk(key.public_key(), as_dict=True)
+        key = ed25519.Ed25519PrivateKey.generate()
+        public = jwt.algorithms.OKPAlgorithm.to_jwk(key.public_key(), as_dict=True)
         result.append(
             (
                 key,
                 {
                     "kid": kid,
-                    "alg": "RS256",
+                    "alg": "EdDSA",
                     "use": "sig",
-                    **{name: public[name] for name in ("kty", "n", "e")},
+                    **{name: public[name] for name in ("kty", "crv", "x")},
                 },
             )
         )
@@ -58,7 +58,7 @@ def token(key, *, kid="first", headers=None, **changes):
     }
     claims.update(changes)
     return jwt.encode(
-        claims, key, algorithm="RS256", headers=headers or {"kid": kid, "typ": ASSERTION_TYPE}
+        claims, key, algorithm="EdDSA", headers=headers or {"kid": kid, "typ": ASSERTION_TYPE}
     )
 
 
@@ -131,7 +131,7 @@ def test_rejects_signature_algorithm_type_and_missing_claims(keys):
     with pytest.raises(InvalidCallerAssertion):
         check.verify(
             jwt.encode(
-                claims, key, algorithm="RS256", headers={"kid": "first", "typ": ASSERTION_TYPE}
+                claims, key, algorithm="EdDSA", headers={"kid": "first", "typ": ASSERTION_TYPE}
             )
         )
 

{mainsequence-9.0.3.dev33 → mainsequence-9.0.4}/tests/test_fastapi_request_identity.py

@@ -7,7 +7,7 @@ from uuid import uuid4
 
 import jwt
 import pytest
-from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.asymmetric import ed25519
 from fastapi import FastAPI, Request, WebSocket
 from fastapi.testclient import TestClient
 
@@ -42,10 +42,10 @@ def clean_environment(monkeypatch):
 
 @pytest.fixture
 def signed(monkeypatch):
-    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
-    public = jwt.algorithms.RSAAlgorithm.to_jwk(key.public_key(), as_dict=True)
-    jwk = {name: public[name] for name in ("kty", "n", "e")}
-    fetch = Mock(return_value={"keys": [{"kid": "test", "alg": "RS256", "use": "sig", **jwk}]})
+    key = ed25519.Ed25519PrivateKey.generate()
+    public = jwt.algorithms.OKPAlgorithm.to_jwk(key.public_key(), as_dict=True)
+    jwk = {name: public[name] for name in ("kty", "crv", "x")}
+    fetch = Mock(return_value={"keys": [{"kid": "test", "alg": "EdDSA", "use": "sig", **jwk}]})
     verifier = CallerAssertionVerifier(
         issuer=ISSUER,
         jwks_url=ISSUER + "/fastapi/caller-keys/",
@@ -70,7 +70,7 @@ def signed(monkeypatch):
         )
         claims.update(changes)
         return jwt.encode(
-            claims, key, algorithm="RS256", headers={"kid": "test", "typ": ASSERTION_TYPE}
+            claims, key, algorithm="EdDSA", headers={"kid": "test", "typ": ASSERTION_TYPE}
         )
 
     return token, fetch, verifier