oci 2.135.2__py3-none-any.whl → 2.137.0__py3-none-any.whl

oci/_vendor/jwt/api_jwt.py

@@ -1,227 +1,236 @@
 # coding: utf-8
 # Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
 # This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
-# Original Work: Copyright (c) 2015 José Padilla
+# Original Work: Copyright (c) 2015-2022 José Padilla
 
 import json
 import warnings
 from calendar import timegm
-from datetime import datetime, timedelta
-try:
-    # import required by mypy to perform type checking, not used for normal execution
-    from typing import Callable, Dict, List, Optional, Union # NOQA
-except ImportError:
-    pass
-
-from .api_jws import PyJWS
-from .algorithms import Algorithm, get_default_algorithms  # NOQA
-from .compat import Iterable, Mapping, string_types
+from collections.abc import Iterable, Mapping
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, List, Optional, Type, Union
+
+from . import api_jws
 from .exceptions import (
-    DecodeError, ExpiredSignatureError, ImmatureSignatureError,
-    InvalidAudienceError, InvalidIssuedAtError,
-    InvalidIssuerError, MissingRequiredClaimError
+    DecodeError,
+    ExpiredSignatureError,
+    ImmatureSignatureError,
+    InvalidAudienceError,
+    InvalidIssuedAtError,
+    InvalidIssuerError,
+    MissingRequiredClaimError,
 )
-from .utils import merge_dict
 
 
-class PyJWT(PyJWS):
-    header_type = 'JWT'
+class PyJWT:
+    def __init__(self, options=None):
+        if options is None:
+            options = {}
+        self.options = {**self._get_default_options(), **options}
 
     @staticmethod
-    def _get_default_options():
-        # type: () -> Dict[str, bool]
+    def _get_default_options() -> Dict[str, Union[bool, List[str]]]:
         return {
-            'verify_signature': True,
-            'verify_exp': True,
-            'verify_nbf': True,
-            'verify_iat': True,
-            'verify_aud': True,
-            'verify_iss': True,
-            'require_exp': False,
-            'require_iat': False,
-            'require_nbf': False
+            "verify_signature": True,
+            "verify_exp": True,
+            "verify_nbf": True,
+            "verify_iat": True,
+            "verify_aud": True,
+            "verify_iss": True,
+            "require": [],
         }
 
-    def encode(self,
-               payload,  # type: Union[Dict, bytes]
-               key,  # type: str
-               algorithm='HS256',  # type: str
-               headers=None,  # type: Optional[Dict]
-               json_encoder=None  # type: Optional[Callable]
-               ):
+    def encode(
+        self,
+        payload: Dict[str, Any],
+        key: str,
+        algorithm: Optional[str] = "HS256",
+        headers: Optional[Dict] = None,
+        json_encoder: Optional[Type[json.JSONEncoder]] = None,
+    ) -> str:
         # Check that we get a mapping
         if not isinstance(payload, Mapping):
-            raise TypeError('Expecting a mapping object, as JWT only supports '
-                            'JSON objects as payloads.')
+            raise TypeError(
+                "Expecting a mapping object, as JWT only supports "
+                "JSON objects as payloads."
+            )
 
         # Payload
-        for time_claim in ['exp', 'iat', 'nbf']:
+        payload = payload.copy()
+        for time_claim in ["exp", "iat", "nbf"]:
             # Convert datetime to a intDate value in known time-format claims
             if isinstance(payload.get(time_claim), datetime):
-                payload[time_claim] = timegm(payload[time_claim].utctimetuple())  # type: ignore
+                payload[time_claim] = timegm(payload[time_claim].utctimetuple())
 
         json_payload = json.dumps(
-            payload,
-            separators=(',', ':'),
-            cls=json_encoder
-        ).encode('utf-8')
-
-        return super(PyJWT, self).encode(
-            json_payload, key, algorithm, headers, json_encoder
-        )
-
-    def decode(self,
-               jwt,  # type: str
-               key='',   # type: str
-               verify=True,  # type: bool
-               algorithms=None,  # type: List[str]
-               options=None,  # type: Dict
-               **kwargs):
-
-        if verify and not algorithms:
+            payload, separators=(",", ":"), cls=json_encoder
+        ).encode("utf-8")
+
+        return api_jws.encode(json_payload, key, algorithm, headers, json_encoder)
+
+    def decode_complete(
+        self,
+        jwt: str,
+        key: str = "",
+        algorithms: Optional[List[str]] = None,
+        options: Optional[Dict] = None,
+        **kwargs,
+    ) -> Dict[str, Any]:
+        options = dict(options or {})  # shallow-copy or initialize an empty dict
+        options.setdefault("verify_signature", True)
+
+        # If the user has set the legacy `verify` argument, and it doesn't match
+        # what the relevant `options` entry for the argument is, inform the user
+        # that they're likely making a mistake.
+        if "verify" in kwargs and kwargs["verify"] != options["verify_signature"]:
             warnings.warn(
-                'It is strongly recommended that you pass in a ' +
-                'value for the "algorithms" argument when calling decode(). ' +
-                'This argument will be mandatory in a future version.',
-                DeprecationWarning
+                "The `verify` argument to `decode` does nothing in PyJWT 2.0 and newer. "
+                "The equivalent is setting `verify_signature` to False in the `options` dictionary. "
+                "This invocation has a mismatch between the kwarg and the option entry.",
+                category=DeprecationWarning,
             )
 
-        payload, _, _, _ = self._load(jwt)
+        if not options["verify_signature"]:
+            options.setdefault("verify_exp", False)
+            options.setdefault("verify_nbf", False)
+            options.setdefault("verify_iat", False)
+            options.setdefault("verify_aud", False)
+            options.setdefault("verify_iss", False)
 
-        if options is None:
-            options = {'verify_signature': verify}
-        else:
-            options.setdefault('verify_signature', verify)
+        if options["verify_signature"] and not algorithms:
+            raise DecodeError(
+                'It is required that you pass in a value for the "algorithms" argument when calling decode().'
+            )
 
-        decoded = super(PyJWT, self).decode(
-            jwt, key=key, algorithms=algorithms, options=options, **kwargs
+        decoded = api_jws.decode_complete(
+            jwt,
+            key=key,
+            algorithms=algorithms,
+            options=options,
+            **kwargs,
         )
 
         try:
-            payload = json.loads(decoded.decode('utf-8'))
+            payload = json.loads(decoded["payload"])
         except ValueError as e:
-            raise DecodeError('Invalid payload string: %s' % e)
-        if not isinstance(payload, Mapping):
-            raise DecodeError('Invalid payload string: must be a json object')
-
-        if verify:
-            merged_options = merge_dict(self.options, options)
-            self._validate_claims(payload, merged_options, **kwargs)
-
-        return payload
-
-    def _validate_claims(self, payload, options, audience=None, issuer=None,
-                         leeway=0, **kwargs):
-
-        if 'verify_expiration' in kwargs:
-            options['verify_exp'] = kwargs.get('verify_expiration', True)
-            warnings.warn('The verify_expiration parameter is deprecated. '
-                          'Please use verify_exp in options instead.',
-                          DeprecationWarning)
-
+            raise DecodeError(f"Invalid payload string: {e}")
+        if not isinstance(payload, dict):
+            raise DecodeError("Invalid payload string: must be a json object")
+
+        merged_options = {**self.options, **options}
+        self._validate_claims(payload, merged_options, **kwargs)
+
+        decoded["payload"] = payload
+        return decoded
+
+    def decode(
+        self,
+        jwt: str,
+        key: str = "",
+        algorithms: Optional[List[str]] = None,
+        options: Optional[Dict] = None,
+        **kwargs,
+    ) -> Dict[str, Any]:
+        decoded = self.decode_complete(jwt, key, algorithms, options, **kwargs)
+        return decoded["payload"]
+
+    def _validate_claims(
+        self, payload, options, audience=None, issuer=None, leeway=0, **kwargs
+    ):
         if isinstance(leeway, timedelta):
             leeway = leeway.total_seconds()
 
-        if not isinstance(audience, (string_types, type(None), Iterable)):
-            raise TypeError('audience must be a string, iterable, or None')
+        if not isinstance(audience, (bytes, str, type(None), Iterable)):
+            raise TypeError("audience must be a string, iterable, or None")
 
         self._validate_required_claims(payload, options)
 
-        now = timegm(datetime.utcnow().utctimetuple())
+        now = timegm(datetime.now(tz=timezone.utc).utctimetuple())
 
-        if 'iat' in payload and options.get('verify_iat'):
+        if "iat" in payload and options["verify_iat"]:
             self._validate_iat(payload, now, leeway)
 
-        if 'nbf' in payload and options.get('verify_nbf'):
+        if "nbf" in payload and options["verify_nbf"]:
             self._validate_nbf(payload, now, leeway)
 
-        if 'exp' in payload and options.get('verify_exp'):
+        if "exp" in payload and options["verify_exp"]:
             self._validate_exp(payload, now, leeway)
 
-        if options.get('verify_iss'):
+        if options["verify_iss"]:
             self._validate_iss(payload, issuer)
 
-        if options.get('verify_aud'):
+        if options["verify_aud"]:
             self._validate_aud(payload, audience)
 
     def _validate_required_claims(self, payload, options):
-        if options.get('require_exp') and payload.get('exp') is None:
-            raise MissingRequiredClaimError('exp')
-
-        if options.get('require_iat') and payload.get('iat') is None:
-            raise MissingRequiredClaimError('iat')
-
-        if options.get('require_nbf') and payload.get('nbf') is None:
-            raise MissingRequiredClaimError('nbf')
+        for claim in options["require"]:
+            if payload.get(claim) is None:
+                raise MissingRequiredClaimError(claim)
 
     def _validate_iat(self, payload, now, leeway):
         try:
-            int(payload['iat'])
+            int(payload["iat"])
         except ValueError:
-            raise InvalidIssuedAtError('Issued At claim (iat) must be an integer.')
+            raise InvalidIssuedAtError("Issued At claim (iat) must be an integer.")
 
     def _validate_nbf(self, payload, now, leeway):
         try:
-            nbf = int(payload['nbf'])
+            nbf = int(payload["nbf"])
         except ValueError:
-            raise DecodeError('Not Before claim (nbf) must be an integer.')
+            raise DecodeError("Not Before claim (nbf) must be an integer.")
 
         if nbf > (now + leeway):
-            raise ImmatureSignatureError('The token is not yet valid (nbf)')
+            raise ImmatureSignatureError("The token is not yet valid (nbf)")
 
     def _validate_exp(self, payload, now, leeway):
         try:
-            exp = int(payload['exp'])
+            exp = int(payload["exp"])
         except ValueError:
-            raise DecodeError('Expiration Time claim (exp) must be an'
-                              ' integer.')
+            raise DecodeError("Expiration Time claim (exp) must be an" " integer.")
 
         if exp < (now - leeway):
-            raise ExpiredSignatureError('Signature has expired')
+            raise ExpiredSignatureError("Signature has expired")
 
     def _validate_aud(self, payload, audience):
-        if audience is None and 'aud' not in payload:
-            return
+        if audience is None:
+            if "aud" not in payload or not payload["aud"]:
+                return
+            # Application did not specify an audience, but
+            # the token has the 'aud' claim
+            raise InvalidAudienceError("Invalid audience")
 
-        if audience is not None and 'aud' not in payload:
+        if "aud" not in payload or not payload["aud"]:
             # Application specified an audience, but it could not be
             # verified since the token does not contain a claim.
-            raise MissingRequiredClaimError('aud')
-
-        if audience is None and 'aud' in payload:
-            # Application did not specify an audience, but
-            # the token has the 'aud' claim
-            raise InvalidAudienceError('Invalid audience')
+            raise MissingRequiredClaimError("aud")
 
-        audience_claims = payload['aud']
+        audience_claims = payload["aud"]
 
-        if isinstance(audience_claims, string_types):
+        if isinstance(audience_claims, str):
             audience_claims = [audience_claims]
         if not isinstance(audience_claims, list):
-            raise InvalidAudienceError('Invalid claim format in token')
-        if any(not isinstance(c, string_types) for c in audience_claims):
-            raise InvalidAudienceError('Invalid claim format in token')
+            raise InvalidAudienceError("Invalid claim format in token")
+        if any(not isinstance(c, str) for c in audience_claims):
+            raise InvalidAudienceError("Invalid claim format in token")
 
-        if isinstance(audience, string_types):
+        if isinstance(audience, str):
             audience = [audience]
 
-        if not any(aud in audience_claims for aud in audience):
-            raise InvalidAudienceError('Invalid audience')
+        if all(aud not in audience_claims for aud in audience):
+            raise InvalidAudienceError("Invalid audience")
 
     def _validate_iss(self, payload, issuer):
         if issuer is None:
             return
 
-        if 'iss' not in payload:
-            raise MissingRequiredClaimError('iss')
+        if "iss" not in payload:
+            raise MissingRequiredClaimError("iss")
 
-        if payload['iss'] != issuer:
-            raise InvalidIssuerError('Invalid issuer')
+        if payload["iss"] != issuer:
+            raise InvalidIssuerError("Invalid issuer")
 
 
 _jwt_global_obj = PyJWT()
 encode = _jwt_global_obj.encode
+decode_complete = _jwt_global_obj.decode_complete
 decode = _jwt_global_obj.decode
-register_algorithm = _jwt_global_obj.register_algorithm
-unregister_algorithm = _jwt_global_obj.unregister_algorithm
-get_unverified_header = _jwt_global_obj.get_unverified_header

oci/_vendor/jwt/exceptions.py

@@ -1,12 +1,13 @@
 # coding: utf-8
 # Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
 # This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
-# Original Work: Copyright (c) 2015 José Padilla
+# Original Work: Copyright (c) 2015-2022 José Padilla
 
 class PyJWTError(Exception):
     """
     Base class for all exceptions
     """
+
     pass
 
 
@@ -55,10 +56,16 @@ class MissingRequiredClaimError(InvalidTokenError):
         self.claim = claim
 
     def __str__(self):
-        return 'Token is missing the "%s" claim' % self.claim
+        return f'Token is missing the "{self.claim}" claim'
+
+
+class PyJWKError(PyJWTError):
+    pass
 
 
-# Compatibility aliases (deprecated)
-ExpiredSignature = ExpiredSignatureError
-InvalidAudience = InvalidAudienceError
-InvalidIssuer = InvalidIssuerError
+class PyJWKSetError(PyJWTError):
+    pass
+
+
+class PyJWKClientError(PyJWTError):
+    pass

oci/_vendor/jwt/help.py

@@ -1,7 +1,7 @@
 # coding: utf-8
 # Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
 # This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
-# Original Work: Copyright (c) 2015 José Padilla
+# Original Work: Copyright (c) 2015-2022 José Padilla
 
 from __future__ import print_function
 
@@ -13,13 +13,8 @@ from . import __version__ as pyjwt_version
 
 try:
     import cryptography
-except ImportError:
-    cryptography = None
-
-try:
-    import ecdsa
-except ImportError:
-    ecdsa = None
+except ModuleNotFoundError:
+    cryptography = None  # type: ignore
 
 
 def info():
@@ -28,8 +23,11 @@ def info():
     Based on the requests package help utility module.
     """
     try:
-        platform_info = {"system": platform.system(), "release": platform.release()}
-    except IOError:
+        platform_info = {
+            "system": platform.system(),
+            "release": platform.release(),
+        }
+    except OSError:
         platform_info = {"system": "Unknown", "release": "Unknown"}
 
     implementation = platform.python_implementation()
@@ -37,10 +35,10 @@ def info():
     if implementation == "CPython":
         implementation_version = platform.python_version()
     elif implementation == "PyPy":
-        implementation_version = "%s.%s.%s" % (
-            sys.pypy_version_info.major,
-            sys.pypy_version_info.minor,
-            sys.pypy_version_info.micro,
+        implementation_version = (
+            f"{sys.pypy_version_info.major}."
+            f"{sys.pypy_version_info.minor}."
+            f"{sys.pypy_version_info.micro}"
         )
         if sys.pypy_version_info.releaselevel != "final":
             implementation_version = "".join(
@@ -51,7 +49,10 @@ def info():
 
     return {
         "platform": platform_info,
-        "implementation": {"name": implementation, "version": implementation_version},
+        "implementation": {
+            "name": implementation,
+            "version": implementation_version,
+        },
         "cryptography": {"version": getattr(cryptography, "__version__", "")},
         "pyjwt": {"version": pyjwt_version},
     }

oci/_vendor/jwt/jwks_client.py

@@ -0,0 +1,64 @@
+# coding: utf-8
+# Modified Work: Copyright (c) 2018, 2024, Oracle and/or its affiliates.  All rights reserved.
+# This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+# Original Work: Copyright (c) 2015-2022 José Padilla
+
+import json
+import urllib.request
+from functools import lru_cache
+from typing import Any, List
+
+from .api_jwk import PyJWK, PyJWKSet
+from .api_jwt import decode_complete as decode_token
+from .exceptions import PyJWKClientError
+
+
+class PyJWKClient:
+    def __init__(self, uri: str, cache_keys: bool = True, max_cached_keys: int = 16):
+        self.uri = uri
+        if cache_keys:
+            # Cache signing keys
+            # Ignore mypy (https://github.com/python/mypy/issues/2427)
+            self.get_signing_key = lru_cache(maxsize=max_cached_keys)(self.get_signing_key)  # type: ignore
+
+    def fetch_data(self) -> Any:
+        with urllib.request.urlopen(self.uri) as response:
+            return json.load(response)
+
+    def get_jwk_set(self) -> PyJWKSet:
+        data = self.fetch_data()
+        return PyJWKSet.from_dict(data)
+
+    def get_signing_keys(self) -> List[PyJWK]:
+        jwk_set = self.get_jwk_set()
+        signing_keys = [
+            jwk_set_key
+            for jwk_set_key in jwk_set.keys
+            if jwk_set_key.public_key_use in ["sig", None] and jwk_set_key.key_id
+        ]
+
+        if not signing_keys:
+            raise PyJWKClientError("The JWKS endpoint did not contain any signing keys")
+
+        return signing_keys
+
+    def get_signing_key(self, kid: str) -> PyJWK:
+        signing_keys = self.get_signing_keys()
+        signing_key = None
+
+        for key in signing_keys:
+            if key.key_id == kid:
+                signing_key = key
+                break
+
+        if not signing_key:
+            raise PyJWKClientError(
+                f'Unable to find a signing key that matches: "{kid}"'
+            )
+
+        return signing_key
+
+    def get_signing_key_from_jwt(self, token: str) -> PyJWK:
+        unverified = decode_token(token, options={"verify_signature": False})
+        header = unverified["header"]
+        return self.get_signing_key(header.get("kid"))