oci 2.135.2__py3-none-any.whl → 2.137.0__py3-none-any.whl

oci/_vendor/jwt/api_jwk.py

@@ -0,0 +1,108 @@
+# coding: utf-8
+# Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
+# This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+# Original Work: Copyright (c) 2015-2022 José Padilla
+
+import json
+
+from .algorithms import get_default_algorithms
+from .exceptions import InvalidKeyError, PyJWKError, PyJWKSetError
+
+
+class PyJWK:
+    def __init__(self, jwk_data, algorithm=None):
+        self._algorithms = get_default_algorithms()
+        self._jwk_data = jwk_data
+
+        kty = self._jwk_data.get("kty", None)
+        if not kty:
+            raise InvalidKeyError(f"kty is not found: {self._jwk_data}")
+
+        if not algorithm and isinstance(self._jwk_data, dict):
+            algorithm = self._jwk_data.get("alg", None)
+
+        if not algorithm:
+            # Determine alg with kty (and crv).
+            crv = self._jwk_data.get("crv", None)
+            if kty == "EC":
+                if crv == "P-256" or not crv:
+                    algorithm = "ES256"
+                elif crv == "P-384":
+                    algorithm = "ES384"
+                elif crv == "P-521":
+                    algorithm = "ES512"
+                elif crv == "secp256k1":
+                    algorithm = "ES256K"
+                else:
+                    raise InvalidKeyError(f"Unsupported crv: {crv}")
+            elif kty == "RSA":
+                algorithm = "RS256"
+            elif kty == "oct":
+                algorithm = "HS256"
+            elif kty == "OKP":
+                if not crv:
+                    raise InvalidKeyError(f"crv is not found: {self._jwk_data}")
+                if crv == "Ed25519":
+                    algorithm = "EdDSA"
+                else:
+                    raise InvalidKeyError(f"Unsupported crv: {crv}")
+            else:
+                raise InvalidKeyError(f"Unsupported kty: {kty}")
+
+        self.Algorithm = self._algorithms.get(algorithm)
+
+        if not self.Algorithm:
+            raise PyJWKError(f"Unable to find a algorithm for key: {self._jwk_data}")
+
+        self.key = self.Algorithm.from_jwk(self._jwk_data)
+
+    @staticmethod
+    def from_dict(obj, algorithm=None):
+        return PyJWK(obj, algorithm)
+
+    @staticmethod
+    def from_json(data, algorithm=None):
+        obj = json.loads(data)
+        return PyJWK.from_dict(obj, algorithm)
+
+    @property
+    def key_type(self):
+        return self._jwk_data.get("kty", None)
+
+    @property
+    def key_id(self):
+        return self._jwk_data.get("kid", None)
+
+    @property
+    def public_key_use(self):
+        return self._jwk_data.get("use", None)
+
+
+class PyJWKSet:
+    def __init__(self, keys):
+        self.keys = []
+
+        if not keys or not isinstance(keys, list):
+            raise PyJWKSetError("Invalid JWK Set value")
+
+        if len(keys) == 0:
+            raise PyJWKSetError("The JWK Set did not contain any keys")
+
+        for key in keys:
+            self.keys.append(PyJWK(key))
+
+    @staticmethod
+    def from_dict(obj):
+        keys = obj.get("keys", [])
+        return PyJWKSet(keys)
+
+    @staticmethod
+    def from_json(data):
+        obj = json.loads(data)
+        return PyJWKSet.from_dict(obj)
+
+    def __getitem__(self, kid):
+        for key in self.keys:
+            if key.key_id == kid:
+                return key
+        raise KeyError(f"keyset has no key for kid: {kid}")

oci/_vendor/jwt/api_jws.py

@@ -1,61 +1,59 @@
 # coding: utf-8
 # Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
 # This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
-# Original Work: Copyright (c) 2015 José Padilla
+# Original Work: Copyright (c) 2015-2022 José Padilla
 
 import binascii
 import json
-import warnings
-try:
-    # import required by mypy to perform type checking, not used for normal execution
-    from typing import Callable, Dict, List, Optional, Union # NOQA
-except ImportError:
-    pass
+from collections.abc import Mapping
+from typing import Any, Dict, List, Optional, Type
 
 from .algorithms import (
-    Algorithm, get_default_algorithms, has_crypto, requires_cryptography  # NOQA
+    Algorithm,
+    get_default_algorithms,
+    has_crypto,
+    requires_cryptography,
 )
-from .compat import Mapping, binary_type, string_types, text_type
 from .exceptions import (
-    DecodeError, InvalidAlgorithmError, InvalidSignatureError,
-    InvalidTokenError
+    DecodeError,
+    InvalidAlgorithmError,
+    InvalidSignatureError,
+    InvalidTokenError,
 )
-from .utils import base64url_decode, base64url_encode, force_bytes, merge_dict
+from .utils import base64url_decode, base64url_encode
 
 
-class PyJWS(object):
-    header_typ = 'JWT'
+class PyJWS:
+    header_typ = "JWT"
 
     def __init__(self, algorithms=None, options=None):
         self._algorithms = get_default_algorithms()
-        self._valid_algs = (set(algorithms) if algorithms is not None
-                            else set(self._algorithms))
+        self._valid_algs = (
+            set(algorithms) if algorithms is not None else set(self._algorithms)
+        )
 
         # Remove algorithms that aren't on the whitelist
         for key in list(self._algorithms.keys()):
             if key not in self._valid_algs:
                 del self._algorithms[key]
 
-        if not options:
+        if options is None:
             options = {}
-
-        self.options = merge_dict(self._get_default_options(), options)
+        self.options = {**self._get_default_options(), **options}
 
     @staticmethod
     def _get_default_options():
-        return {
-            'verify_signature': True
-        }
+        return {"verify_signature": True}
 
     def register_algorithm(self, alg_id, alg_obj):
         """
         Registers a new Algorithm for use when creating and verifying tokens.
         """
         if alg_id in self._algorithms:
-            raise ValueError('Algorithm already has a handler.')
+            raise ValueError("Algorithm already has a handler.")
 
         if not isinstance(alg_obj, Algorithm):
-            raise TypeError('Object is not of type `Algorithm`')
+            raise TypeError("Object is not of type `Algorithm`")
 
         self._algorithms[alg_id] = alg_obj
         self._valid_algs.add(alg_id)
@@ -66,8 +64,10 @@ class PyJWS(object):
         Throws KeyError if algorithm is not registered.
         """
         if alg_id not in self._algorithms:
-            raise KeyError('The specified algorithm could not be removed'
-                           ' because it is not registered.')
+            raise KeyError(
+                "The specified algorithm could not be removed"
+                " because it is not registered."
+            )
 
         del self._algorithms[alg_id]
         self._valid_algs.remove(alg_id)
@@ -78,89 +78,130 @@ class PyJWS(object):
         """
         return list(self._valid_algs)
 
-    def encode(self,
-               payload,  # type: Union[Dict, bytes]
-               key,  # type: str
-               algorithm='HS256',  # type: str
-               headers=None,  # type: Optional[Dict]
-               json_encoder=None  # type: Optional[Callable]
-               ):
+    def encode(
+        self,
+        payload: bytes,
+        key: str,
+        algorithm: Optional[str] = "HS256",
+        headers: Optional[Dict] = None,
+        json_encoder: Optional[Type[json.JSONEncoder]] = None,
+        is_payload_detached: bool = False,
+    ) -> str:
         segments = []
 
         if algorithm is None:
-            algorithm = 'none'
+            algorithm = "none"
 
-        if algorithm not in self._valid_algs:
-            pass
+        # Prefer headers values if present to function parameters.
+        if headers:
+            headers_alg = headers.get("alg")
+            if headers_alg:
+                algorithm = headers["alg"]
+
+            headers_b64 = headers.get("b64")
+            if headers_b64 is False:
+                is_payload_detached = True
 
         # Header
-        header = {'typ': self.header_typ, 'alg': algorithm}
+        header = {"typ": self.header_typ, "alg": algorithm}  # type: Dict[str, Any]
 
         if headers:
             self._validate_headers(headers)
             header.update(headers)
 
-        json_header = force_bytes(
-            json.dumps(
-                header,
-                separators=(',', ':'),
-                cls=json_encoder
-            )
-        )
+        if not header["typ"]:
+            del header["typ"]
+
+        if is_payload_detached:
+            header["b64"] = False
+        elif "b64" in header:
+            # True is the standard value for b64, so no need for it
+            del header["b64"]
+
+        json_header = json.dumps(
+            header, separators=(",", ":"), cls=json_encoder
+        ).encode()
 
         segments.append(base64url_encode(json_header))
-        segments.append(base64url_encode(payload))
+
+        if is_payload_detached:
+            msg_payload = payload
+        else:
+            msg_payload = base64url_encode(payload)
+        segments.append(msg_payload)
 
         # Segments
-        signing_input = b'.'.join(segments)
+        signing_input = b".".join(segments)
+
         try:
             alg_obj = self._algorithms[algorithm]
             key = alg_obj.prepare_key(key)
             signature = alg_obj.sign(signing_input, key)
 
-        except KeyError:
+        except KeyError as e:
             if not has_crypto and algorithm in requires_cryptography:
                 raise NotImplementedError(
-                    "Algorithm '%s' could not be found. Do you have cryptography "
-                    "installed?" % algorithm
-                )
-            else:
-                raise NotImplementedError('Algorithm not supported')
+                    f"Algorithm '{algorithm}' could not be found. Do you have cryptography installed?"
+                ) from e
+            raise NotImplementedError("Algorithm not supported") from e
 
         segments.append(base64url_encode(signature))
 
-        return b'.'.join(segments)
-
-    def decode(self,
-               jwt,  # type: str
-               key='',   # type: str
-               verify=True,  # type: bool
-               algorithms=None,  # type: List[str]
-               options=None,  # type: Dict
-               **kwargs):
-
-        merged_options = merge_dict(self.options, options)
-        verify_signature = merged_options['verify_signature']
+        # Don't put the payload content inside the encoded token when detached
+        if is_payload_detached:
+            segments[1] = b""
+        encoded_string = b".".join(segments)
+
+        return encoded_string.decode("utf-8")
+
+    def decode_complete(
+        self,
+        jwt: str,
+        key: str = "",
+        algorithms: Optional[List[str]] = None,
+        options: Optional[Dict] = None,
+        detached_payload: Optional[bytes] = None,
+        **kwargs,
+    ) -> Dict[str, Any]:
+        if options is None:
+            options = {}
+        merged_options = {**self.options, **options}
+        verify_signature = merged_options["verify_signature"]
 
         if verify_signature and not algorithms:
-            warnings.warn(
-                'It is strongly recommended that you pass in a ' +
-                'value for the "algorithms" argument when calling decode(). ' +
-                'This argument will be mandatory in a future version.',
-                DeprecationWarning
+            raise DecodeError(
+                'It is required that you pass in a value for the "algorithms" argument when calling decode().'
             )
 
         payload, signing_input, header, signature = self._load(jwt)
 
-        if not verify:
-            warnings.warn('The verify parameter is deprecated. '
-                          'Please use verify_signature in options instead.',
-                          DeprecationWarning, stacklevel=2)
-        elif verify_signature:
-            self._verify_signature(payload, signing_input, header, signature,
-                                   key, algorithms)
+        if header.get("b64", True) is False:
+            if detached_payload is None:
+                raise DecodeError(
+                    'It is required that you pass in a value for the "detached_payload" argument to decode a message having the b64 header set to false.'
+                )
+            payload = detached_payload
+            signing_input = b".".join([signing_input.rsplit(b".", 1)[0], payload])
+
+        if verify_signature:
+            self._verify_signature(signing_input, header, signature, key, algorithms)
+
+        return {
+            "payload": payload,
+            "header": header,
+            "signature": signature,
+        }
 
-        return payload
+    def decode(
+        self,
+        jwt: str,
+        key: str = "",
+        algorithms: Optional[List[str]] = None,
+        options: Optional[Dict] = None,
+        **kwargs,
+    ) -> str:
+        decoded = self.decode_complete(jwt, key, algorithms, options, **kwargs)
+        return decoded["payload"]
 
     def get_unverified_header(self, jwt):
         """Returns back the JWT header parameters as a dict()
@@ -174,73 +215,79 @@ class PyJWS(object):
         return headers
 
     def _load(self, jwt):
-        if isinstance(jwt, text_type):
-            jwt = jwt.encode('utf-8')
+        if isinstance(jwt, str):
+            jwt = jwt.encode("utf-8")
 
-        if not issubclass(type(jwt), binary_type):
-            raise DecodeError("Invalid token type. Token must be a {0}".format(
-                binary_type))
+        if not isinstance(jwt, bytes):
+            raise DecodeError(f"Invalid token type. Token must be a {bytes}")
 
         try:
-            signing_input, crypto_segment = jwt.rsplit(b'.', 1)
-            header_segment, payload_segment = signing_input.split(b'.', 1)
-        except ValueError:
-            raise DecodeError('Not enough segments')
+            signing_input, crypto_segment = jwt.rsplit(b".", 1)
+            header_segment, payload_segment = signing_input.split(b".", 1)
+        except ValueError as err:
+            raise DecodeError("Not enough segments") from err
 
         try:
             header_data = base64url_decode(header_segment)
-        except (TypeError, binascii.Error):
-            raise DecodeError('Invalid header padding')
+        except (TypeError, binascii.Error) as err:
+            raise DecodeError("Invalid header padding") from err
 
         try:
-            header = json.loads(header_data.decode('utf-8'))
+            header = json.loads(header_data)
         except ValueError as e:
-            raise DecodeError('Invalid header string: %s' % e)
+            raise DecodeError(f"Invalid header string: {e}") from e
 
         if not isinstance(header, Mapping):
-            raise DecodeError('Invalid header string: must be a json object')
+            raise DecodeError("Invalid header string: must be a json object")
 
         try:
             payload = base64url_decode(payload_segment)
-        except (TypeError, binascii.Error):
-            raise DecodeError('Invalid payload padding')
+        except (TypeError, binascii.Error) as err:
+            raise DecodeError("Invalid payload padding") from err
 
         try:
             signature = base64url_decode(crypto_segment)
-        except (TypeError, binascii.Error):
-            raise DecodeError('Invalid crypto padding')
+        except (TypeError, binascii.Error) as err:
+            raise DecodeError("Invalid crypto padding") from err
 
         return (payload, signing_input, header, signature)
 
-    def _verify_signature(self, payload, signing_input, header, signature,
-                          key='', algorithms=None):
+    def _verify_signature(
+        self,
+        signing_input,
+        header,
+        signature,
+        key="",
+        algorithms=None,
+    ):
 
-        alg = header.get('alg')
+        alg = header.get("alg")
 
         if algorithms is not None and alg not in algorithms:
-            raise InvalidAlgorithmError('The specified alg value is not allowed')
+            raise InvalidAlgorithmError("The specified alg value is not allowed")
 
         try:
             alg_obj = self._algorithms[alg]
             key = alg_obj.prepare_key(key)
 
             if not alg_obj.verify(signing_input, key, signature):
-                raise InvalidSignatureError('Signature verification failed')
+                raise InvalidSignatureError("Signature verification failed")
 
-        except KeyError:
-            raise InvalidAlgorithmError('Algorithm not supported')
+        except KeyError as e:
+            raise InvalidAlgorithmError("Algorithm not supported") from e
 
     def _validate_headers(self, headers):
-        if 'kid' in headers:
-            self._validate_kid(headers['kid'])
+        if "kid" in headers:
+            self._validate_kid(headers["kid"])
 
     def _validate_kid(self, kid):
-        if not isinstance(kid, string_types):
-            raise InvalidTokenError('Key ID header parameter must be a string')
+        if not isinstance(kid, str):
+            raise InvalidTokenError("Key ID header parameter must be a string")
 
 
 _jws_global_obj = PyJWS()
 encode = _jws_global_obj.encode
+decode_complete = _jws_global_obj.decode_complete
 decode = _jws_global_obj.decode
 register_algorithm = _jws_global_obj.register_algorithm
 unregister_algorithm = _jws_global_obj.unregister_algorithm