mcp-security-framework 2.1.0__tar.gz → 2.2.1__tar.gz

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.1.0
+Version: 2.2.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.1}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.1.0"
+__version__ = "2.2.1"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.1.0 → mcp_security_framework-2.2.1}/mcp_security_framework/core/cert_manager.py

@@ -36,6 +36,7 @@ from typing import Any, Dict, List, Optional, Tuple, Union
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import ec, ed448, ed25519, rsa
+from cryptography.hazmat.primitives.asymmetric.types import PrivateKeyTypes
 from cryptography.x509.oid import ExtendedKeyUsageOID, ExtensionOID, NameOID
 
 from mcp_security_framework.schemas.config import (
@@ -53,6 +54,7 @@ from mcp_security_framework.schemas.models import (
     UnknownRoleError,
 )
 from mcp_security_framework.utils.cert_utils import (
+    CertificateError,
     extract_permissions_from_certificate,
     extract_roles_from_certificate,
     get_certificate_expiry,
@@ -61,6 +63,7 @@ from mcp_security_framework.utils.cert_utils import (
     is_certificate_revoked,
     is_crl_valid,
     parse_certificate,
+    parse_private_key,
     validate_certificate_against_crl,
     validate_certificate_chain,
 )
@@ -123,6 +126,39 @@ def _get_signing_algorithm(private_key):
     return hashes.SHA256()
 
 
+def _load_private_key(
+    key_bytes: bytes,
+    password: Optional[bytes],
+    source: str,
+) -> PrivateKeyTypes:
+    """
+    Load a private key from PEM or DER bytes with optional passphrase.
+
+    This helper wraps parse_private_key to attach a source label and convert
+    from CertificateError (raised by parse_private_key) to CertificateValidationError
+    (expected by callers in this module). The classification of whether the key
+    is encrypted, whether a password was supplied, and whether the password is
+    correct all lives in parse_private_key; this wrapper's only job is to add
+    the source context and bridge the exception type.
+
+    Args:
+        key_bytes: The PEM or DER-encoded private key
+        password: Optional passphrase as bytes, or None
+        source: Human-readable label for error messages (e.g. "CA private key",
+                "Parent CA private key"). Included in all error messages.
+
+    Returns:
+        Loaded private key object
+
+    Raises:
+        CertificateValidationError: When the key cannot be loaded or decrypted
+    """
+    try:
+        return parse_private_key(key_bytes, password=password)
+    except CertificateError as exc:
+        raise CertificateValidationError(f"{source}: {exc}", error_code=-32003) from exc
+
+
 def _subject_attribute(certificate, oid) -> str:
     """
     Return one subject attribute of a certificate, or "" when it carries none.
@@ -616,8 +652,15 @@ class CertificateManager:
                 parent_ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(intermediate_config.parent_ca_key, "rb") as f:
-                parent_ca_key = serialization.load_pem_private_key(
-                    f.read(), password=None
+                password = (
+                    intermediate_config.parent_ca_key_password.encode()
+                    if intermediate_config.parent_ca_key_password
+                    else None
+                )
+                parent_ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="Parent CA private key",
                 )
 
             # Generate intermediate CA private key
@@ -878,7 +921,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(client_config.ca_key_path, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    client_config.ca_key_password.encode()
+                    if client_config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Verify that CA private key matches CA certificate
             _verify_ca_key_matches_cert(
@@ -1104,8 +1156,8 @@ class CertificateManager:
             )
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -1189,7 +1241,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(server_config.ca_key_path, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    server_config.ca_key_password.encode()
+                    if server_config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Verify that CA private key matches CA certificate
             _verify_ca_key_matches_cert(
@@ -1406,8 +1467,8 @@ class CertificateManager:
             )
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -1493,7 +1554,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(ca_key_file, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Create new certificate with extended validity
             builder = x509.CertificateBuilder()
@@ -1651,7 +1721,16 @@ class CertificateManager:
                 ca_cert = x509.load_pem_x509_certificate(f.read())
 
             with open(ca_key_file, "rb") as f:
-                ca_key = serialization.load_pem_private_key(f.read(), password=None)
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                ca_key = _load_private_key(
+                    f.read(),
+                    password=password,
+                    source="CA private key",
+                )
 
             # Create CRL builder
             builder = x509.CertificateRevocationListBuilder()
@@ -2165,8 +2244,15 @@ class CertificateManager:
             # Load CA private key
             with open(ca_key_path, "rb") as f:
                 ca_key_data = f.read()
-            ca_private_key = serialization.load_pem_private_key(
-                ca_key_data, password=None
+            password = (
+                self.config.ca_key_password.encode()
+                if self.config.ca_key_password
+                else None
+            )
+            ca_private_key = _load_private_key(
+                ca_key_data,
+                password=password,
+                source="CA private key",
             )
 
             # Verify that CA private key matches CA certificate
@@ -2249,8 +2335,8 @@ class CertificateManager:
 
         except (FileNotFoundError, PermissionError, ValueError):
             raise
-        except CertificateGenerationError:
-            # Re-raise CertificateGenerationError without wrapping
+        except (CertificateGenerationError, CertificateValidationError):
+            # Re-raise these without wrapping
             raise
         except Exception as e:
             self.logger.error(
@@ -2495,11 +2581,16 @@ class CertificateManager:
                 return key_data.decode("utf-8")
             elif format.lower() == "der":
                 # Convert PEM to DER
-                from cryptography.hazmat.primitives.serialization import (
-                    load_pem_private_key,
+                password = (
+                    self.config.ca_key_password.encode()
+                    if self.config.ca_key_password
+                    else None
+                )
+                key = _load_private_key(
+                    key_data,
+                    password=password,
+                    source="Private key",
                 )
-
-                key = load_pem_private_key(key_data, password=None)
                 return key.private_bytes(
                     encoding=serialization.Encoding.DER,
                     format=serialization.PrivateFormat.PKCS8,