oidcauthlib 3.0.8__tar.gz → 3.0.10__tar.gz

{oidcauthlib-3.0.8/oidcauthlib.egg-info → oidcauthlib-3.0.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.8
+Version: 3.0.10
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0

oidcauthlib-3.0.10/VERSION

@@ -0,0 +1 @@
+3.0.10

{oidcauthlib-3.0.8 → oidcauthlib-3.0.10}/oidcauthlib/auth/token_reader.py

@@ -7,7 +7,7 @@ from typing import Optional, Any, Dict, List, cast
 from uuid import UUID
 
 from joserfc import jwt, jws
-from joserfc.errors import ExpiredTokenError
+from joserfc.errors import ExpiredTokenError, InvalidKeyIdError
 from joserfc.jwk import KeySet
 
 from zoneinfo import ZoneInfo
@@ -147,7 +147,13 @@ class TokenReader:
             if not jwks:
                 raise RuntimeError("JWKS must be fetched before verifying tokens")
             try:
-                decoded = jwt.decode(token, jwks, algorithms=self.algorithms)
+                try:
+                    decoded = jwt.decode(token, jwks, algorithms=self.algorithms)
+                except InvalidKeyIdError:
+                    logger.info("Unknown kid in token during decode; refreshing JWKS and retrying.")
+                    await self._well_known_config_manager.refresh_async()
+                    jwks = await self._well_known_config_manager.get_jwks_async()
+                    decoded = jwt.decode(token, jwks, algorithms=self.algorithms)
                 return decoded.claims
             except Exception as e:
                 logger.exception(f"Failed to decode token: {e}")
@@ -197,8 +203,15 @@ class TokenReader:
         issuer: Optional[str] = None
         audience: Optional[str] = None
         try:
-            # Validate the token
-            verified = jwt.decode(token, jwks, algorithms=self.algorithms)
+            # Validate the token; on unknown kid, refresh JWKS once and retry
+            try:
+                verified = jwt.decode(token, jwks, algorithms=self.algorithms)
+            except InvalidKeyIdError:
+                logger.info("Unknown kid in token; refreshing JWKS from identity providers and retrying.")
+                await self._well_known_config_manager.refresh_async()
+                jwks = await self._well_known_config_manager.get_jwks_async()
+                jwks_kids = [key.get("kid") for key in jwks.keys]
+                verified = jwt.decode(token, jwks, algorithms=self.algorithms)
             issuer = verified.claims.get("iss")
             audience = verified.claims.get("aud") or verified.claims.get(
                 "client_id"
@@ -322,7 +335,13 @@ class TokenReader:
         assert access_token, "Access token must not be empty"
         jwks: KeySet = await self._well_known_config_manager.get_jwks_async()
         try:
-            verified = jwt.decode(access_token, jwks, algorithms=self.algorithms)
+            try:
+                verified = jwt.decode(access_token, jwks, algorithms=self.algorithms)
+            except InvalidKeyIdError:
+                logger.info("Unknown kid in token during validity check; refreshing JWKS and retrying.")
+                await self._well_known_config_manager.refresh_async()
+                jwks = await self._well_known_config_manager.get_jwks_async()
+                verified = jwt.decode(access_token, jwks, algorithms=self.algorithms)
             exp = verified.claims.get("exp")
             now = time.time()
             if exp and exp < now:

{oidcauthlib-3.0.8 → oidcauthlib-3.0.10}/oidcauthlib/auth/well_known_configuration/well_known_configuration_cache.py

@@ -247,6 +247,7 @@ class WellKnownConfigurationCache:
                             await self.well_known_store.put(
                                 key=well_known_uri,
                                 value=well_known_configuration_cache_result.model_dump(),
+                                ttl=self.environment_variables.well_known_cache_ttl_seconds,
                             )
                             logger.info(f"Cached OIDC discovery document for {well_known_uri}")
                         return well_known_configuration_cache_result

{oidcauthlib-3.0.8 → oidcauthlib-3.0.10}/oidcauthlib/utilities/environment/oidc_environment_variables.py

@@ -196,6 +196,26 @@ class OidcEnvironmentVariables(AbstractEnvironmentVariables):
         except ValueError:
             raise ValueError("MAX_MONGO_INLINE_SIZE_KB must be a positive integer representing bytes")
 
+    @property
+    def well_known_cache_ttl_seconds(self) -> int:
+        """TTL in seconds for well-known configuration entries in the persistent store.
+
+        Controls how long OIDC discovery documents (including JWKS keys) are
+        cached in MongoDB before expiring. This ensures key rotations by
+        identity providers are picked up within a bounded window.
+
+        Set via WELL_KNOWN_CACHE_TTL_SECONDS environment variable.
+        Defaults to 3600 seconds (1 hour).
+
+        Returns:
+            TTL in seconds
+        """
+        try:
+            ttl = int(os.environ.get("WELL_KNOWN_CACHE_TTL_SECONDS", "3600"))
+            return ttl
+        except ValueError:
+            raise ValueError("WELL_KNOWN_CACHE_TTL_SECONDS must be a positive integer representing seconds")
+
     @property
     def well_known_config_http_timeout_seconds(self) -> int:
         """HTTP timeout in seconds for fetching well-known configurations.

{oidcauthlib-3.0.8 → oidcauthlib-3.0.10/oidcauthlib.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oidcauthlib
-Version: 3.0.8
+Version: 3.0.10
 Summary: oidcauthlib
 Author-email: Imran Qureshi <imran.qureshi@bwell.com>
 License: Apache-2.0

oidcauthlib-3.0.8/VERSION

@@ -1 +0,0 @@
-3.0.8