openshell-shared 0.1.2__py3-none-any.whl

protocols/negotiation/challenge.py

@@ -0,0 +1,127 @@
+# shared/protocols/negotiation/challenge.py
+
+import json
+import secrets
+from time import time
+from uuid6 import uuid7
+
+from .models import AuthenticationChallenge, AuthenticationResponse
+from shared.cryptography.signatures import sign_data, verify_signature
+
+
+SCHEMA_VERSION = 1
+
+CHALLENGE_TYPE_SERVER_AUTHENTICATION = "server_authentication"
+CHALLENGE_TYPE_CLIENT_AUTHENTICATION = "client_authentication"
+
+
+class ChallengeProtocol:
+
+    # -----------------------------
+    # SERIALIZATION CANÓNICA
+    # -----------------------------
+    @staticmethod
+    def _serialize(data: dict) -> dict:
+        return json.loads(
+            json.dumps(data, sort_keys=True, separators=(",", ":"))
+        )
+
+    @staticmethod
+    def _challenge_payload(challenge: AuthenticationChallenge) -> dict:
+        # SOLO campos relevantes para firma (CRÍTICO)
+        return ChallengeProtocol._serialize({
+            "schema": challenge.schema,
+            "challenge_type": challenge.challenge_type,
+            "challenge_id": challenge.challenge_id,
+            "issuer_uid": challenge.issuer_uid,
+            "target_uid": challenge.target_uid,
+            "nonce": challenge.nonce,
+            "issued_at": challenge.issued_at,
+            "expires_at": challenge.expires_at,
+        })
+
+    # -----------------------------
+    # CREACIÓN
+    # -----------------------------
+    @staticmethod
+    def create(challenge_type: str, issuer_uid: str, target_uid: str, expires_in: int = 60):
+        now = int(time())
+
+        return AuthenticationChallenge(
+            schema=SCHEMA_VERSION,
+            challenge_type=challenge_type,
+            challenge_id=str(uuid7()),
+            issuer_uid=issuer_uid,
+            target_uid=target_uid,
+            nonce=secrets.token_hex(32),
+            issued_at=now,
+            expires_at=now + expires_in
+        )
+
+    # -----------------------------
+    # FIRMA
+    # -----------------------------
+    @staticmethod
+    def sign(private_key: str, challenge: AuthenticationChallenge) -> AuthenticationResponse:
+        payload = ChallengeProtocol._challenge_payload(challenge)
+
+        signature = sign_data(private_key, payload)
+
+        return AuthenticationResponse(
+            schema=SCHEMA_VERSION,
+            challenge_id=challenge.challenge_id,
+            responder_uid=challenge.target_uid,
+            signature=signature
+        )
+
+    # -----------------------------
+    # VERIFICACIÓN
+    # -----------------------------
+    @staticmethod
+    def verify(public_key: str, challenge: AuthenticationChallenge, response: AuthenticationResponse) -> bool:
+        payload = ChallengeProtocol._challenge_payload(challenge)
+        return verify_signature(public_key, payload, response.signature)
+
+    # -----------------------------
+    # UTILIDADES
+    # -----------------------------
+    @staticmethod
+    def is_expired(challenge) -> bool:
+        return int(time()) > challenge.expires_at
+
+    @staticmethod
+    def validate_type(challenge, expected_type: str) -> bool:
+        return challenge.challenge_type == expected_type
+
+    # -----------------------------
+    # SERIALIZACIÓN ROBUSTA
+    # -----------------------------
+    @staticmethod
+    def challenge_to_dict(challenge) -> dict:
+        return {
+            "schema": challenge.schema,
+            "challenge_type": challenge.challenge_type,
+            "challenge_id": challenge.challenge_id,
+            "issuer_uid": challenge.issuer_uid,
+            "target_uid": challenge.target_uid,
+            "nonce": challenge.nonce,
+            "issued_at": challenge.issued_at,
+            "expires_at": challenge.expires_at,
+        }
+
+    @staticmethod
+    def response_to_dict(response) -> dict:
+        return {
+            "schema": response.schema,
+            "challenge_id": response.challenge_id,
+            "responder_uid": response.responder_uid,
+            "signature": response.signature,
+        }
+
+    @staticmethod
+    def challenge_from_dict(data: dict):
+        return AuthenticationChallenge(**data)
+
+    @staticmethod
+    def response_from_dict(data: dict):
+        return AuthenticationResponse(**data)

protocols/negotiation/models.py

@@ -0,0 +1,28 @@
+from dataclasses import dataclass
+
+
+@dataclass
+class AuthenticationChallenge:
+    schema: int
+
+    challenge_type: str
+
+    challenge_id: str
+
+    issuer_uid: str
+    target_uid: str
+
+    nonce: str
+
+    issued_at: int
+    expires_at: int
+
+@dataclass
+class AuthenticationResponse:
+    schema: int
+
+    challenge_id: str
+
+    responder_uid: str
+
+    signature: str

standards/certificates/status.py

@@ -0,0 +1,12 @@
+from enum import Enum
+
+
+class CertificateStatus(str, Enum):
+    ACTIVE = "ACTIVE"
+    REVOKED = "REVOKED"
+    EXPIRED = "EXPIRED"
+    COMPROMISED = "COMPROMISED"
+
+    @staticmethod
+    def exists(value: str) -> bool:
+        return value in CertificateStatus._value2member_map_

standards/certificates/types.py

@@ -0,0 +1,11 @@
+from enum import Enum
+
+SCHEMA_VERSION = 1
+
+class CertificateType(str, Enum):
+    DOMAIN_MANAGEMENT = "DOMAIN_MANAGEMENT"
+    MANAGER_AUTHORIZATION = "MANAGER_AUTHORIZATION"
+
+    @staticmethod
+    def exists(value: str) -> bool:
+        return value in CertificateType._value2member_map_

standards/entities/types.py

@@ -0,0 +1,14 @@
+from enum import Enum
+
+
+class EntityType(str, Enum):
+
+    AGENT = "AGENT"
+
+    CONSOLE = "CONSOLE"
+
+    PROXY = "PROXY"
+
+    MANAGER = "MANAGER"
+
+    ROOT_AUTHORITY = "ROOT_AUTHORITY"

standards/events/schemas/entity_registered.py

@@ -0,0 +1,13 @@
+from dataclasses import dataclass
+
+
+@dataclass
+class EntityRegisteredEventDetails:
+
+    schema: int
+
+    source: str
+
+    method: str
+
+    fingerprint: str

standards/events/types.py

@@ -0,0 +1,18 @@
+from enum import Enum
+
+
+class EventType(str, Enum):
+
+    ENTITY_REGISTERED = "entity.registered"
+
+    ENTITY_REVOKED = "entity.revoked"
+
+    DOMAIN_CREATED = "domain.created"
+
+    DOMAIN_UPDATED = "domain.updated"
+
+    DOMAIN_DELETED = "domain.deleted"
+    
+    MEMBERSHIP_CREATED = "membership.created"
+
+    TRUST_ESTABLISHED = "trust.established"

standards/passports/types.py

@@ -0,0 +1,5 @@
+from enum import Enum
+
+class PASSPORT_TYPE(str, Enum):
+	OPEN = "OPEN"
+	CLOSED = "CLOSED"

standards/permissions/types.py

@@ -0,0 +1,14 @@
+from enum import Enum
+
+
+class Permission(str, Enum):
+
+    DOMAIN_READ = "domain.read"
+
+    DOMAIN_WRITE = "domain.write"
+
+    ENTITY_REGISTER = "entity.register"
+
+    ENTITY_REVOKE = "entity.revoke"
+
+    PROXY_USE = "proxy.use"

standards/roles/types.py

@@ -0,0 +1,8 @@
+from enum import Enum
+
+class ROLE(str, Enum):
+	PROPIETARY = "PROPIETARY"
+	ADMINISTRATOR = "ADMINISTRATOR"
+	OPERATOR = "OPERATOR"
+	AGENT = "AGENT"
+	SUPERVISOR = "SUPERVISOR"

standards/transports/types.py

@@ -0,0 +1,24 @@
+from enum import Enum
+
+
+class TransportType(str, Enum):
+    TCP = "TCP"
+    UDP = "UDP"
+
+    HTTP = "HTTP"
+    HTTPS = "HTTPS"
+
+    WEBSOCKET = "WEBSOCKET"
+    WEBSOCKET_SECURE = "WEBSOCKET_SECURE"
+
+    QUIC = "QUIC"
+
+    BLUETOOTH = "BLUETOOTH"
+    SERIAL = "SERIAL"
+
+    TOR = "TOR"
+
+
+    @staticmethod
+    def exists(value: str) -> bool:
+        return value in TransportType._value2member_map_