microsoft-agents-hosting-core 1.10.0.dev4__tar.gz → 1.10.0.dev5__tar.gz

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-hosting-core
-Version: 1.10.0.dev4
+Version: 1.10.0.dev5
 Summary: Core library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-activity==1.10.0.dev4
+Requires-Dist: microsoft-agents-activity==1.10.0.dev5
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: isodate>=0.6.1
 Requires-Dist: python-dotenv>=1.1.1

microsoft_agents_hosting_core-1.10.0.dev5/VERSION.txt

@@ -0,0 +1 @@
+1.10.0.dev5

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents/hosting/core/authorization/connection_settings_base.py

@@ -4,7 +4,16 @@
 from __future__ import annotations
 
 from collections.abc import Mapping
+from dataclasses import dataclass, field, fields
 from typing import Any, TYPE_CHECKING
+from typing_extensions import Self
+
+from microsoft_agents.activity.config import (
+    Configuration,
+    _Configurable,
+    _resolve,
+    xpath,
+)
 
 if TYPE_CHECKING:
     from .agent_auth_configuration import AgentAuthConfiguration
@@ -109,3 +118,87 @@ class _ConnectionSettingsBase:
     ) -> "_ConnectionSettingsBase":
         """Build base settings from an :class:`AgentAuthConfiguration`."""
         return cls(**cls.base_kwargs_from_configuration(configuration))
+
+
+_KNOWN_KWARGS_CACHE: dict[type[ConnectionSettingsBase], list[str]] = {}
+
+
+@dataclass(frozen=True)
+class ConnectionSettingsBase(_Configurable):
+    """Provider-independent settings bound from Configuration.
+
+    Frozen fields cannot be reassigned, but scopes and extras remain mutable.
+    Treat those containers as read-only after handing settings to a provider.
+    """
+
+    client_id: str | None = None
+    authority: str | None = None
+    tenant_id: str | None = None
+    alternate_blueprint_connection_name: str | None = None
+    scopes: list[str] = field(default_factory=list)
+    _extras: Configuration = field(default_factory=Configuration)
+
+    @property
+    def extras(self) -> Configuration:
+        """Return unrecognized provider settings, not an immutable copy."""
+        return self._extras
+
+    @classmethod
+    def _from_agent_auth_config(cls, agent_auth_config: AgentAuthConfiguration) -> Self:
+        attrs = dict(vars(agent_auth_config))
+        attrs.update(attrs.pop("provider_settings", {}))
+        attrs["ISSUERS"] = agent_auth_config.ISSUERS
+        if isinstance(attrs.get("SCOPES"), Mapping):
+            # TODO: Temporary compatibility for legacy indexed scopes; the next
+            # PR's configuration-loader migration will normalize these mappings.
+            attrs["SCOPES"] = _resolve({"SCOPES": attrs["SCOPES"]})["SCOPES"]
+        return cls.from_mapping(attrs)
+
+    @classmethod
+    def _get_init_kwargs(cls, config: Configuration) -> dict:
+        return {
+            "client_id": config.get_strn(cls._xpath("client_id")),
+            "authority": config.get_strn(
+                cls._xpath("authority"), cls._xpath("authorityendpoint")
+            ),
+            "tenant_id": config.get_strn(cls._xpath("tenant_id")),
+            "scopes": config.get_scopes(cls._xpath("scopes")),
+            "alternate_blueprint_connection_name": config.get_strn(
+                "alt_blueprint_name",
+                "ALT_BLUEPRINT_NAME",
+                "alt_blueprint_id",
+                "ALT_BLUEPRINT_ID",
+                *cls._xpath("alternate_blueprint_connection_name"),
+            ),
+        }
+
+    @classmethod
+    def _known_kwargs(cls) -> list[str]:
+        if cls not in _KNOWN_KWARGS_CACHE:
+            _KNOWN_KWARGS_CACHE[cls] = [
+                alias
+                for f in fields(cls)
+                if f.init and f.name != "_extras"
+                for alias in xpath(f.name)
+            ]
+        return _KNOWN_KWARGS_CACHE[cls]
+
+    @classmethod
+    def _get_extras(cls, config: Configuration) -> Configuration:
+        known_kwargs = cls._known_kwargs()
+        base = {k: v for k, v in config.items() if k not in known_kwargs}
+        return Configuration.from_mapping(
+            base, _base_path=config._base_path, **base.pop("extras", {})
+        )
+
+    @classmethod
+    def _from_configuration(cls, config: Configuration) -> Self:
+        try:
+            settings = config.get_section(xpath("settings"))
+        except KeyError:
+            settings = config
+        return cls(**cls._get_init_kwargs(settings), _extras=cls._get_extras(settings))
+
+    @staticmethod
+    def _xpath(name: str) -> list[str]:
+        return xpath(name, lower_snake=True)

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents/hosting/core/authorization/jwt/__init__.py

@@ -3,8 +3,12 @@
 
 from ._authorize_request import _authorize_request
 from .jwt_token_validator import JwtTokenValidator
+from .jwt_connection_settings import JwtConnectionSettings
+from .token_validation_configuration import TokenValidationConfiguration
 
 __all__ = [
     "JwtTokenValidator",
     "_authorize_request",
+    "JwtConnectionSettings",
+    "TokenValidationConfiguration",
 ]

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents/hosting/core/authorization/jwt/_authorize_request.py

@@ -4,7 +4,10 @@
 import logging
 
 from jwt import PyJWTError
+from typing import Any, Mapping
+from weakref import WeakKeyDictionary
 
+from microsoft_agents.activity.config import Configuration
 from microsoft_agents.hosting.core.http import HttpResponse
 
 from ..agent_auth_configuration import AgentAuthConfiguration
@@ -13,9 +16,33 @@ from .jwt_token_validator import JwtTokenValidator
 
 logger = logging.getLogger(__name__)
 
+_TOKEN_VALIDATION_CACHE: WeakKeyDictionary[Any, JwtTokenValidator] = WeakKeyDictionary()
+
+
+def _resolve_token_validator(
+    auth_config: Configuration | AgentAuthConfiguration | None,
+    cache_key: Any = None,
+) -> JwtTokenValidator | None:
+
+    if cache_key is not None and cache_key in _TOKEN_VALIDATION_CACHE:
+        return _TOKEN_VALIDATION_CACHE[cache_key]
+
+    if auth_config is not None:
+        config: AgentAuthConfiguration | Configuration = auth_config
+        if not isinstance(auth_config, AgentAuthConfiguration):
+            config = Configuration(auth_config)
+        validator = JwtTokenValidator(config)
+        if cache_key is not None:
+            _TOKEN_VALIDATION_CACHE[cache_key] = validator
+        return validator
+    return None
+
 
 async def _authorize_request(
-    authorization_header: str | None, auth_config: AgentAuthConfiguration | None
+    authorization_header: str | None,
+    auth_config: Configuration | AgentAuthConfiguration | None,
+    *,
+    cache_key: Any = None
 ) -> ClaimsIdentity | HttpResponse:
     """
     Authorizes a request based on the provided JWT token in the Authorization header.
@@ -25,16 +52,16 @@ async def _authorize_request(
     :return: A ClaimsIdentity object if the token is valid, or an HttpResponse with an
         error message and status code if the token is invalid or missing.
     """
+    validator = _resolve_token_validator(auth_config, cache_key)
 
-    if auth_config is None:
+    if not validator:
         return HttpResponse(
             body={"error": "Agent Authentication configuration not found"},
             status_code=500,
         )
-    validator = JwtTokenValidator(auth_config)
 
     if not authorization_header:
-        if auth_config.ANONYMOUS_ALLOWED:
+        if validator.config.anonymous_allowed:
             claims_identity = validator.get_anonymous_claims()
             return claims_identity
         return HttpResponse(

microsoft_agents_hosting_core-1.10.0.dev5/microsoft_agents/hosting/core/authorization/jwt/jwt_connection_settings.py

@@ -0,0 +1,40 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from microsoft_agents.activity.config import Configuration, xpath
+
+from .._entra_issuers import default_connection_issuers
+from ..connection_settings_base import ConnectionSettingsBase
+
+
+@dataclass(frozen=True)
+class JwtConnectionSettings(ConnectionSettingsBase):
+    """Provider-independent connection settings for inbound JWT validation."""
+
+    validate_issuer: bool = False
+    issuers: list[str] = field(default_factory=list)
+    anonymous_allowed: bool = False
+
+    @classmethod
+    def _get_init_kwargs(cls, config: Configuration) -> dict:
+        base = super()._get_init_kwargs(config)
+        issuers = config.get_str_list(xpath("issuers"))
+        issuers = issuers or default_connection_issuers(
+            base.get("tenant_id"), base.get("authority")
+        )
+        base.update(
+            {
+                "validate_issuer": config.get_bool(
+                    xpath("validate_issuer"), default=False
+                ),
+                "issuers": issuers,
+                "anonymous_allowed": config.get_bool(
+                    xpath("anonymous_allowed"), default=False
+                ),
+            }
+        )
+        return base

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents/hosting/core/authorization/jwt/jwt_token_validator.py

@@ -9,6 +9,8 @@ from dataclasses import dataclass
 
 from jwt import PyJWKClient, PyJWK, decode, get_unverified_header
 
+from microsoft_agents.activity.config import Configuration
+
 from ..agent_auth_configuration import AgentAuthConfiguration
 from ..authentication_constants import AuthenticationConstants
 from ..claims_identity import ClaimsIdentity
@@ -20,6 +22,8 @@ from .._entra_issuers import (
     jwks_login_host,
     well_known_first_party_issuers,
 )
+from .token_validation_configuration import TokenValidationConfiguration
+from .jwt_connection_settings import JwtConnectionSettings
 
 logger = logging.getLogger(__name__)
 
@@ -75,12 +79,39 @@ class JwtTokenValidator:
 
     _jwk_client_manager = _JwkClientManager()
 
-    def __init__(self, configuration: AgentAuthConfiguration):
+    def __init__(self, configuration: AgentAuthConfiguration | Configuration):
         """Initializes the JwtTokenValidator with the given configuration.
 
-        :param configuration: An instance of AgentAuthConfiguration containing the necessary settings for token validation.
+        :param configuration: Application Configuration used to bind
+            TokenValidationConfiguration. AgentAuthConfiguration is accepted
+            through a legacy conversion path.
         """
-        self.configuration = configuration
+        if isinstance(configuration, AgentAuthConfiguration):
+            self._config = TokenValidationConfiguration(
+                tenant_id=configuration.tenant_id,
+                anonymous_allowed=configuration.ANONYMOUS_ALLOWED,
+                audiences=[
+                    conn.CLIENT_ID
+                    for conn in configuration._connections.values()
+                    if conn.CLIENT_ID
+                ],
+                connections={
+                    name: JwtConnectionSettings._from_agent_auth_config(conn)
+                    for name, conn in configuration._connections.items()
+                },
+                default_jwt_settings=JwtConnectionSettings._from_agent_auth_config(
+                    configuration
+                ),
+            )
+        else:
+            self._config = TokenValidationConfiguration.from_configuration(
+                configuration
+            )
+
+    @property
+    def config(self) -> TokenValidationConfiguration:
+        """Return the bound token-validation policy and connection settings."""
+        return self._config
 
     async def validate_token(self, token: str) -> ClaimsIdentity:
         """Validates a JWT token.
@@ -106,15 +137,17 @@ class JwtTokenValidator:
         # root-configuration endpoint for backward-compatible network egress.
         # This is routing only -- final acceptance is checked against the
         # signature-verified claims below.
-        routing_config = (
-            self.configuration._jwt_patch_find_connection(
-                unverified_payload.get(AuthenticationConstants.AUDIENCE_CLAIM)
-            )
-            or self.configuration
+        routing_config = self._config.get_connection_settings(
+            unverified_payload.get(AuthenticationConstants.AUDIENCE_CLAIM)
         )
+        if not routing_config:
+            logger.warning(
+                "No default or specific routing configuration found for the given audience."
+            )
+            raise ValueError("Invalid audience.")
         jwks_uri = _build_jwks_uri(
             unverified_payload.get(AuthenticationConstants.ISSUER_CLAIM),
-            self.configuration,
+            self.config,
             routing_config,
         )
         key = await self._jwk_client_manager.get_signing_key(jwks_uri, header)
@@ -128,23 +161,26 @@ class JwtTokenValidator:
         )
 
         aud = decoded_token.get(AuthenticationConstants.AUDIENCE_CLAIM, "")
-        if not self.configuration._jwt_patch_is_valid_aud(aud):
+        if not self._config.validate_audience(aud):
             logger.warning("JWT audience not accepted.")
             raise ValueError("Invalid audience.")
 
-        matched_config = (
-            self.configuration._jwt_patch_find_connection(aud) or routing_config
-        )
+        matched_config = self._config.get_connection_settings(aud)
+        if not matched_config:
+            logger.warning(
+                "No default or specific routing configuration found for the given audience."
+            )
+            raise ValueError("Invalid audience.")
 
         # Issuer allow-list validation is explicit opt-in
-        # (AgentAuthConfiguration.VALIDATE_ISSUER) to preserve backward
+        # (JwtConnectionSettings.validate_issuer) to preserve backward
         # compatibility for existing deployments. Tid-to-issuer binding,
         # however, is always enforced per issue #626: it only engages when
         # the (verified) issuer is itself a recognized Entra issuer carrying
         # a GUID tenant, so Bot Framework/non-Entra and tenant-alias issuers
         # are unaffected, and a missing ``tid`` claim skips the check rather
         # than failing closed.
-        if matched_config.VALIDATE_ISSUER:
+        if matched_config.validate_issuer:
             _validate_issuer(
                 decoded_token.get(AuthenticationConstants.ISSUER_CLAIM), matched_config
             )
@@ -164,8 +200,8 @@ class JwtTokenValidator:
 
 def _build_jwks_uri(
     iss: Any,
-    root_config: AgentAuthConfiguration,
-    routing_config: AgentAuthConfiguration,
+    root_config: TokenValidationConfiguration,
+    routing_config: JwtConnectionSettings,
 ) -> str:
     """Builds the JWKS URI for the (unverified, routing-only) issuer and the
     root and audience-selected connection configurations.
@@ -186,29 +222,29 @@ def _build_jwks_uri(
     if bf_uri:
         return bf_uri
 
-    if is_gov_authority(routing_config.AUTHORITY):
-        host = jwks_login_host(routing_config.AUTHORITY)
+    if is_gov_authority(routing_config.authority):
+        host = jwks_login_host(routing_config.authority)
         tenant = (
-            effective_tenant(routing_config.TENANT_ID, routing_config.AUTHORITY)
+            effective_tenant(routing_config.tenant_id, routing_config.authority)
             or "common"
         )
         return f"{host}/{tenant}/discovery/v2.0/keys"
 
     return (
         "https://login.microsoftonline.com/"
-        f"{root_config.TENANT_ID or 'common'}/discovery/v2.0/keys"
+        f"{root_config.tenant_id or 'common'}/discovery/v2.0/keys"
     )
 
 
-def _get_valid_issuers(config: AgentAuthConfiguration) -> set[str]:
+def _get_valid_issuers(config: JwtConnectionSettings) -> set[str]:
     """Case-insensitive union of the connection's configured/default issuers
-    (``AgentAuthConfiguration.ISSUERS``) and the always-trusted Microsoft
+    (``JwtConnectionSettings.issuers``) and the always-trusted Microsoft
     first-party issuers for the connection's cloud."""
-    combined = list(config.ISSUERS) + well_known_first_party_issuers(config.AUTHORITY)
+    combined = list(config.issuers) + well_known_first_party_issuers(config.authority)
     return {issuer.lower() for issuer in combined}
 
 
-def _is_multi_tenant(config: AgentAuthConfiguration) -> bool:
+def _is_multi_tenant(config: JwtConnectionSettings) -> bool:
     """A connection configured for the Entra ``common``/``organizations``
     meta-tenant ("blueprint" agent) has no single known calling tenant at
     configuration time, so :func:`_is_acceptable_tenant_issuer` is used instead
@@ -221,11 +257,11 @@ def _is_multi_tenant(config: AgentAuthConfiguration) -> bool:
     AUTHORITY embeds ``common``/``organizations`` (rather than TENANT_ID) is
     still recognized as multi-tenant.
     """
-    tenant = (effective_tenant(config.TENANT_ID, config.AUTHORITY) or "").lower()
+    tenant = (effective_tenant(config.tenant_id, config.authority) or "").lower()
     return tenant in ("common", "organizations")
 
 
-def _is_acceptable_tenant_issuer(iss: str, config: AgentAuthConfiguration) -> bool:
+def _is_acceptable_tenant_issuer(iss: str, config: JwtConnectionSettings) -> bool:
     """Whether ``iss`` is a canonical Entra issuer acceptable for a multi-tenant
     connection: it must carry a tenant GUID and, for cloud-specific v2 issuers,
     match the connection's cloud (public vs US Government). The cloud-agnostic
@@ -233,10 +269,10 @@ def _is_acceptable_tenant_issuer(iss: str, config: AgentAuthConfiguration) -> bo
     info = entra_issuer_info(iss)
     if info is None:
         return False
-    return info.gov is None or info.gov == is_gov_authority(config.AUTHORITY)
+    return info.gov is None or info.gov == is_gov_authority(config.authority)
 
 
-def _validate_issuer(iss: Any, config: AgentAuthConfiguration) -> None:
+def _validate_issuer(iss: Any, config: JwtConnectionSettings) -> None:
     """Validates that the token's ``iss`` claim is accepted for the matched
     connection: either present in the connection's issuer allow-list, or, for
     a multi-tenant (``common``/``organizations``) connection, a canonical

microsoft_agents_hosting_core-1.10.0.dev5/microsoft_agents/hosting/core/authorization/jwt/token_validation_configuration.py

@@ -0,0 +1,75 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License.
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from microsoft_agents.activity.config import Configuration, _Configurable, xpath
+
+from .jwt_connection_settings import JwtConnectionSettings
+
+
+@dataclass(frozen=True)
+class TokenValidationConfiguration(_Configurable):
+    tenant_id: str | None = None
+    audiences: list[str] = field(default_factory=list)
+    anonymous_allowed: bool = False
+    default_jwt_settings: JwtConnectionSettings | None = None
+    connections: dict[str, JwtConnectionSettings] = field(default_factory=dict)
+
+    @classmethod
+    def _from_configuration(
+        cls, configuration: Configuration
+    ) -> TokenValidationConfiguration:
+        token_validation = configuration.get_section(
+            xpath("token_validation"), default=Configuration()
+        )
+        audiences = token_validation.get_str_list(xpath("audiences"))
+        tenant_id = token_validation.get_strn(xpath("tenant_id"))
+        anonymous_allowed = token_validation.get_booln(xpath("anonymous_allowed"))
+
+        connections: dict[str, JwtConnectionSettings] = {}
+        connection_config = configuration.get_section(
+            xpath("connections"), default=Configuration()
+        )
+        for name in connection_config:
+            connections[name] = JwtConnectionSettings.from_configuration(
+                connection_config.get_section(name)
+            )
+
+        update_audiences = not audiences
+        update_tenant_id = not tenant_id
+        default_jwt_settings: JwtConnectionSettings | None = None
+        for conn_name, conn in connections.items():
+            if conn_name.upper() == "SERVICE_CONNECTION":
+                if update_tenant_id:
+                    tenant_id = conn.tenant_id
+                default_jwt_settings = conn
+            if update_audiences and conn.client_id:
+                audiences.append(conn.client_id)
+
+        if default_jwt_settings is not None and anonymous_allowed is None:
+            anonymous_allowed = default_jwt_settings.anonymous_allowed
+
+        return cls(
+            tenant_id=tenant_id,
+            audiences=audiences,
+            connections=connections,
+            default_jwt_settings=default_jwt_settings,
+            anonymous_allowed=anonymous_allowed or False,
+        )
+
+    def validate_audience(self, aud: Any) -> bool:
+        if not aud or not isinstance(aud, str):
+            return False
+        return any(aud.lower() == target.lower() for target in self.audiences)
+
+    def get_connection_settings(self, aud: Any) -> JwtConnectionSettings | None:
+        if not aud or not isinstance(aud, str):
+            return None
+        for conn in self.connections.values():
+            if conn.client_id and conn.client_id.lower() == aud.lower():
+                return conn
+        return self.default_jwt_settings

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents_hosting_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: microsoft-agents-hosting-core
-Version: 1.10.0.dev4
+Version: 1.10.0.dev5
 Summary: Core library for Microsoft Agents
 Author: Microsoft Corporation
 License-Expression: MIT
@@ -15,7 +15,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: microsoft-agents-activity==1.10.0.dev4
+Requires-Dist: microsoft-agents-activity==1.10.0.dev5
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: isodate>=0.6.1
 Requires-Dist: python-dotenv>=1.1.1

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents_hosting_core.egg-info/SOURCES.txt

@@ -98,7 +98,9 @@ microsoft_agents/hosting/core/authorization/connection_settings_base.py
 microsoft_agents/hosting/core/authorization/connections.py
 microsoft_agents/hosting/core/authorization/jwt/__init__.py
 microsoft_agents/hosting/core/authorization/jwt/_authorize_request.py
+microsoft_agents/hosting/core/authorization/jwt/jwt_connection_settings.py
 microsoft_agents/hosting/core/authorization/jwt/jwt_token_validator.py
+microsoft_agents/hosting/core/authorization/jwt/token_validation_configuration.py
 microsoft_agents/hosting/core/authorization/telemetry/__init__.py
 microsoft_agents/hosting/core/authorization/telemetry/constants.py
 microsoft_agents/hosting/core/authorization/telemetry/metrics.py

{microsoft_agents_hosting_core-1.10.0.dev4 → microsoft_agents_hosting_core-1.10.0.dev5}/microsoft_agents_hosting_core.egg-info/requires.txt

@@ -1,4 +1,4 @@
-microsoft-agents-activity==1.10.0.dev4
+microsoft-agents-activity==1.10.0.dev5
 pyjwt>=2.10.1
 isodate>=0.6.1
 python-dotenv>=1.1.1

microsoft_agents_hosting_core-1.10.0.dev4/VERSION.txt

@@ -1 +0,0 @@
-1.10.0.dev4