mcp-security-framework 2.3.0__tar.gz → 2.3.1__tar.gz

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.3.0
+Version: 2.3.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
@@ -60,6 +60,10 @@ Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0.0; extra == "test"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "test"
 Requires-Dist: pytest-mock>=3.8.0; extra == "test"
+Requires-Dist: fastapi>=0.68.0; extra == "test"
+Requires-Dist: uvicorn[standard]>=0.15.0; extra == "test"
+Requires-Dist: flask>=2.0.0; extra == "test"
+Requires-Dist: flask-cors>=3.0.0; extra == "test"
 Requires-Dist: httpx>=0.24.0; extra == "test"
 Dynamic: license-file
 

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.3.0"
+__version__ = "2.3.1"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework/core/cert_manager.py

@@ -27,6 +27,7 @@ Version: 1.0.0
 License: MIT
 """
 
+import ipaddress
 import logging
 import os
 from datetime import datetime, timedelta, timezone
@@ -248,6 +249,14 @@ def _certificate_type_of(certificate) -> CertificateType:
     return CertificateType.CLIENT
 
 
+def _subject_alt_name(value: str) -> x509.GeneralName:
+    """Return the correct SAN type for a DNS name or IP literal string."""
+    try:
+        return x509.IPAddress(ipaddress.ip_address(value))
+    except ValueError:
+        return x509.DNSName(value)
+
+
 class CertificateManager:
     """
     Certificate Management Class
@@ -1023,6 +1032,10 @@ class CertificateManager:
                 x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),
                 critical=False,
             )
+            builder = builder.add_extension(
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_key.public_key()),
+                critical=False,
+            )
 
             # Add roles and permissions to certificate extensions
             # Validate and normalize roles using CertificateRole enum
@@ -1333,11 +1346,15 @@ class CertificateManager:
                 x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),
                 critical=False,
             )
+            builder = builder.add_extension(
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_key.public_key()),
+                critical=False,
+            )
 
             # Add Subject Alternative Name (SAN) if provided
             if server_config.subject_alt_names:
                 san_names = [
-                    x509.DNSName(name) for name in server_config.subject_alt_names
+                    _subject_alt_name(name) for name in server_config.subject_alt_names
                 ]
 
                 builder = builder.add_extension(

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework/core/ssl_manager.py

@@ -518,6 +518,7 @@ class SSLManager:
             else:
                 # For other modes, use default context with verification
                 context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+                context.check_hostname = bool(self.config.check_hostname)
                 context.verify_mode = self._get_verify_mode(actual_verify_mode)
 
                 # Set minimum TLS version

mcp_security_framework-2.3.1/mcp_security_framework/examples/tls_certificate_regressions_example.py

@@ -0,0 +1,142 @@
+"""
+TLS and certificate regression examples.
+
+These examples are deliberately small and file-backed. They exercise public
+configuration and certificate APIs with real SSL contexts and X.509 artifacts,
+so callers can copy the patterns into their own applications without relying on
+test doubles.
+"""
+
+import ipaddress
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from typing import Dict
+
+from cryptography import x509
+from cryptography.x509.oid import ExtensionOID
+
+from mcp_security_framework import SSLConfig
+from mcp_security_framework.core.cert_manager import CertificateManager
+from mcp_security_framework.core.ssl_manager import SSLManager
+from mcp_security_framework.schemas.config import (
+    CAConfig,
+    CertificateConfig,
+    ServerCertConfig,
+)
+
+
+def _manager(root: Path) -> CertificateManager:
+    """Create a CertificateManager that writes only under the given root."""
+    return CertificateManager(
+        CertificateConfig(
+            enabled=True,
+            ca_creation_mode=True,
+            cert_storage_path=str(root / "certs"),
+            key_storage_path=str(root / "keys"),
+        )
+    )
+
+
+def ca_only_client_tls_config_is_valid() -> SSLConfig:
+    """Build one-way client TLS config that trusts a CA without client identity."""
+    with TemporaryDirectory(prefix="sf-ca-only-client-tls-") as tmp:
+        root = Path(tmp)
+        ca_pair = _manager(root).create_root_ca(
+            CAConfig(
+                common_name="Example CA",
+                organization="Example Org",
+                key_size=2048,
+            )
+        )
+        return SSLConfig(
+            enabled=True,
+            verify=True,
+            ca_cert_file=ca_pair.certificate_path,
+            check_hostname=True,
+        )
+
+
+def client_context_honors_disabled_hostname_check() -> bool:
+    """Return whether create_client_context preserves check_hostname=False."""
+    config = SSLConfig(enabled=False, verify=True, check_hostname=False)
+    context = SSLManager(config).create_client_context()
+    return context.check_hostname
+
+
+def issued_leaf_extension_presence() -> Dict[str, bool]:
+    """Return whether an issued server certificate has RFC 5280 key ids."""
+    with TemporaryDirectory(prefix="sf-leaf-key-ids-") as tmp:
+        root = Path(tmp)
+        manager = _manager(root)
+        ca_pair = manager.create_root_ca(
+            CAConfig(
+                common_name="Key Identifier CA",
+                organization="Example Org",
+                key_size=2048,
+            )
+        )
+        server_pair = manager.create_server_certificate(
+            ServerCertConfig(
+                common_name="localhost",
+                organization="Example Org",
+                key_size=2048,
+                ca_cert_path=ca_pair.certificate_path,
+                ca_key_path=ca_pair.private_key_path,
+                subject_alt_names=["localhost"],
+            )
+        )
+        cert = x509.load_pem_x509_certificate(
+            Path(server_pair.certificate_path).read_bytes()
+        )
+        return {
+            "subject_key_identifier": _has_extension(
+                cert, ExtensionOID.SUBJECT_KEY_IDENTIFIER
+            ),
+            "authority_key_identifier": _has_extension(
+                cert, ExtensionOID.AUTHORITY_KEY_IDENTIFIER
+            ),
+        }
+
+
+def ip_subject_alt_name_is_encoded_as_ip_address() -> Dict[str, bool]:
+    """Return how create_server_certificate encodes a loopback SAN."""
+    with TemporaryDirectory(prefix="sf-ip-san-") as tmp:
+        root = Path(tmp)
+        manager = _manager(root)
+        ca_pair = manager.create_root_ca(
+            CAConfig(
+                common_name="IP SAN CA",
+                organization="Example Org",
+                key_size=2048,
+            )
+        )
+        server_pair = manager.create_server_certificate(
+            ServerCertConfig(
+                common_name="127.0.0.1",
+                organization="Example Org",
+                key_size=2048,
+                ca_cert_path=ca_pair.certificate_path,
+                ca_key_path=ca_pair.private_key_path,
+                subject_alt_names=["127.0.0.1"],
+            )
+        )
+        cert = x509.load_pem_x509_certificate(
+            Path(server_pair.certificate_path).read_bytes()
+        )
+        san = cert.extensions.get_extension_for_oid(
+            ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+        ).value
+        expected_ip = ipaddress.ip_address("127.0.0.1")
+        return {
+            "has_ip_address": expected_ip in san.get_values_for_type(x509.IPAddress),
+            "has_dns_name": "127.0.0.1" in san.get_values_for_type(x509.DNSName),
+        }
+
+
+def _has_extension(cert: x509.Certificate, oid: x509.ObjectIdentifier) -> bool:
+    """Return True when the certificate contains the extension."""
+    try:
+        cert.extensions.get_extension_for_oid(oid)
+    except x509.ExtensionNotFound:
+        return False
+    return True

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework/middleware/fastapi_middleware.py

@@ -73,7 +73,7 @@ def require_permissions(*permissions: str) -> Any:
     permissions to routes that opt in.
     """
 
-    def _required_permissions_marker() -> None:
+    async def _required_permissions_marker() -> None:
         """
         Carry the declared permissions; it is never called for its result.
 

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework/schemas/config.py

@@ -231,21 +231,27 @@ class SSLConfig(BaseModel):
     def validate_ssl_configuration(self) -> Self:
         """Validate SSL configuration consistency."""
         if self.enabled:
-            # If verify is disabled, don't require certificate files or memory flag
-            if self.verify and not self.material_from_memory:
-                # material_from_memory=False means files are required.
-                # material_from_memory=True means bytes will be supplied at call time,
-                # so files are not checked here. This keeps the early error for the
-                # common case — everyone who configures file paths — and makes the
-                # intent visible in the configuration itself, which is where an auditor
-                # will look. An explicit opt-in prevents the false positive that occurs
-                # when someone sets verify=True in secure-by-default code but hasn't yet
-                # assembled the bytes.
-                if not self.cert_file or not self.key_file:
+            if self.cert_file or self.key_file:
+                if not (self.cert_file and self.key_file):
                     raise ValueError(
-                        "SSL enabled with verification but certificate and key "
-                        "files are required"
+                        "SSL certificate and key files must be configured together"
                     )
+            if self.client_cert_file or self.client_key_file:
+                if not (self.client_cert_file and self.client_key_file):
+                    raise ValueError(
+                        "SSL client certificate and key files must be configured "
+                        "together"
+                    )
+            if (
+                self.verify
+                and not self.material_from_memory
+                and not self.ca_cert_file
+                and not (self.cert_file and self.key_file)
+            ):
+                raise ValueError(
+                    "SSL enabled with verification but certificate and key "
+                    "files are required"
+                )
         return self
 
 

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.3.0
+Version: 2.3.1
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
@@ -60,6 +60,10 @@ Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0.0; extra == "test"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "test"
 Requires-Dist: pytest-mock>=3.8.0; extra == "test"
+Requires-Dist: fastapi>=0.68.0; extra == "test"
+Requires-Dist: uvicorn[standard]>=0.15.0; extra == "test"
+Requires-Dist: flask>=2.0.0; extra == "test"
+Requires-Dist: flask-cors>=3.0.0; extra == "test"
 Requires-Dist: httpx>=0.24.0; extra == "test"
 Dynamic: license-file
 

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework.egg-info/SOURCES.txt

@@ -35,6 +35,7 @@ mcp_security_framework/examples/gateway_example.py
 mcp_security_framework/examples/microservice_example.py
 mcp_security_framework/examples/protected_keys_example.py
 mcp_security_framework/examples/standalone_example.py
+mcp_security_framework/examples/tls_certificate_regressions_example.py
 mcp_security_framework/middleware/__init__.py
 mcp_security_framework/middleware/auth_middleware.py
 mcp_security_framework/middleware/fastapi_auth_middleware.py

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/mcp_security_framework.egg-info/requires.txt

@@ -37,4 +37,8 @@ pytest>=7.0.0
 pytest-cov>=4.0.0
 pytest-asyncio>=0.21.0
 pytest-mock>=3.8.0
+fastapi>=0.68.0
+uvicorn[standard]>=0.15.0
+flask>=2.0.0
+flask-cors>=3.0.0
 httpx>=0.24.0

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mcp-security-framework"
-version = "2.3.0"
+version = "2.3.1"
 description = "Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations."
 readme = "README.md"
 license = {text = "MIT"}
@@ -81,6 +81,10 @@ test = [
     "pytest-cov>=4.0.0",
     "pytest-asyncio>=0.21.0",
     "pytest-mock>=3.8.0",
+    "fastapi>=0.68.0",
+    "uvicorn[standard]>=0.15.0",
+    "flask>=2.0.0",
+    "flask-cors>=3.0.0",
     "httpx>=0.24.0",
 ]
 
@@ -161,6 +165,7 @@ python_files = ["test_*.py", "*_test.py"]
 python_classes = ["Test*"]
 python_functions = ["test_*"]
 markers = [
+    "asyncio: marks tests that run on an asyncio event loop",
     "slow: marks tests as slow (deselect with '-m \"not slow\"')",
     "integration: marks tests as integration tests",
     "unit: marks tests as unit tests",
@@ -189,4 +194,3 @@ exclude_lines = [
     "class .*\\bProtocol\\):",
     "@(abc\\.)?abstractmethod",
 ]
-