pattern-agent-sdk 0.1.0__tar.gz → 0.3.0__tar.gz

{pattern_agent_sdk-0.1.0 → pattern_agent_sdk-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pattern_agent_sdk
-Version: 0.1.0
+Version: 0.3.0
 Summary: SDK for Pattern Agentic agents
 Author-email: Amos Joshua <amos@patternagentic.ai>
 License-File: LICENSE.md
@@ -9,6 +9,9 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.11
 Requires-Dist: httpx>=0.27.0
+Requires-Dist: pattern-agentic-messaging>=1.2.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyjwt[crypto]>=2.8.0
 Description-Content-Type: text/markdown
 
 # pattern_agentic_sdk

{pattern_agent_sdk-0.1.0 → pattern_agent_sdk-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pattern_agent_sdk"
-version = "0.1.0"
+version = "0.3.0"
 description = "SDK for Pattern Agentic agents"
 authors = [
   { name="Amos Joshua", email="amos@patternagentic.ai" }
@@ -18,6 +18,9 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.27.0",
+  "PyJWT[crypto]>=2.8.0",
+  "pydantic>=2.0.0",
+  "pattern-agentic-messaging>=1.2.0",
 ]
 
 [tool.hatch.build.targets.wheel]

pattern_agent_sdk-0.3.0/src/pattern_agent_sdk/__init__.py

@@ -0,0 +1,4 @@
+from .sdk import PatternSDK, SessionTokenJWKSConfig, pa_sdk
+from pattern_agentic_messaging.session_token import PatternAgentSessionToken
+
+__all__ = ["PatternAgentSessionToken", "PatternSDK", "SessionTokenJWKSConfig", "pa_sdk"]

pattern_agent_sdk-0.3.0/src/pattern_agent_sdk/sdk.py

@@ -0,0 +1,316 @@
+import asyncio
+import os
+import json
+import time
+import base64
+import logging
+import tempfile
+from typing import Optional
+
+import httpx
+import jwt as pyjwt
+from jwt import PyJWKClient
+from pydantic import BaseModel
+from pattern_agentic_messaging import PASlimApp, PASlimConfig
+from pattern_agentic_messaging.session_token import PatternAgentSessionToken
+
+logger = logging.getLogger(__name__)
+
+
+def _parse_extra_headers(raw: Optional[str]) -> dict[str, str]:
+    if not raw:
+        return {}
+    try:
+        decoded = base64.b64decode(raw)
+        headers = json.loads(decoded)
+        if isinstance(headers, dict) and all(isinstance(k, str) and isinstance(v, str) for k, v in headers.items()):
+            return headers
+    except Exception:
+        pass
+    logger.warning("PatternSDK: __PA_AGENT_SERVICES_TOKEN_REQUEST_HEADERS is malformed, ignoring")
+    return {}
+
+
+def _decode_jwt_payload(token: str) -> dict:  # no sig check: token just received from local sidecar
+    parts = token.split(".")
+    if len(parts) != 3:
+        raise ValueError("Invalid JWT format")
+    payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
+    return json.loads(base64.urlsafe_b64decode(payload_b64))
+
+
+class SessionTokenJWKSConfig(BaseModel):
+    jwks_url: str
+    issuer: Optional[str] = None
+    audience: str
+
+
+
+class PatternSDK:
+    def __init__(self, services_endpoint: Optional[str] = None, token_request_headers: Optional[str] = None):
+        self._services_endpoint = (services_endpoint or "").rstrip("/")
+        self._enabled = bool(self._services_endpoint)
+        if not self._enabled:
+            logger.info("PatternSDK: no services endpoint configured, SDK disabled")
+            return
+        self._mint_headers = _parse_extra_headers(token_request_headers)
+        self._token: Optional[str] = None
+        self._deployment_id: Optional[str] = None
+        self._token_exp: float = 0
+        self._renew_failed: bool = False
+        self._config_cache: Optional[dict] = None
+        self._prompts_cache: Optional[dict] = None
+        self._persist_token_to_disk: bool = False
+        self._token_persist_path: Optional[str] = None
+        self._session_jwks_config: Optional[SessionTokenJWKSConfig] = None
+        self._jwks_client: Optional[PyJWKClient] = None
+
+    def _require_enabled(self):
+        if not self._enabled:
+            raise RuntimeError("PatternSDK is disabled: services endpoint not specified")
+
+    @property
+    def _endpoint(self) -> str:
+        return self._services_endpoint
+
+    async def _mint_token(self) -> str:
+        url = f"{self._endpoint}/mint-agent-token"
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                resp = await client.post(url, headers=self._mint_headers or None)
+        except httpx.ConnectError as e:
+            logger.error(f"PatternSDK: cannot connect to agent services at {url} — is the sidecar running? {e}")
+            raise
+        except httpx.TimeoutException:
+            logger.error(f"PatternSDK: request to {url} timed out")
+            raise
+
+        if resp.status_code != 200:
+            logger.error(f"PatternSDK: mint-agent-token returned {resp.status_code}: {resp.text}")
+            raise RuntimeError(
+                f"Error authorizing agent for pattern-agentic services: {resp.status_code} {resp.reason_phrase}"
+            )
+
+        try:
+            token = resp.json()["token"]
+        except (KeyError, json.JSONDecodeError) as e:
+            logger.error(f"PatternSDK: mint-agent-token response missing 'token' field: {resp.text}")
+            raise RuntimeError("mint-agent-token response missing 'token' field") from e
+
+        payload = _decode_jwt_payload(token)
+        self._token = token
+        self._deployment_id = payload["sub"]
+        self._token_exp = payload.get("exp", 0)
+        self._renew_failed = False
+        if self._persist_token_to_disk:
+            self._write_token_to_disk()
+        return token
+
+    async def _ensure_token(self):
+        if not self._token or time.time() >= self._token_exp:
+            await self._mint_token()
+
+    def _token_is_expired(self) -> bool:
+        return time.time() >= self._token_exp
+
+    def _write_token_to_disk(self):
+        path = self._token_persist_path
+        parent = os.path.dirname(path)
+        os.makedirs(parent, exist_ok=True)
+        fd, tmp = tempfile.mkstemp(dir=parent)
+        try:
+            os.write(fd, self._token.encode())
+            os.fchmod(fd, 0o600)
+        finally:
+            os.close(fd)
+        try:
+            os.rename(tmp, path)
+        except BaseException:
+            os.unlink(tmp)
+            raise
+
+    async def enable_token_persistence(self):
+        self._require_enabled()
+        path = os.environ.get("__PA_AGENT_SDK_TOKEN_PERSIST_PATH")
+        if not path:
+            raise RuntimeError(
+                "Invalid configuration, env variable __PA_AGENT_SDK_TOKEN_PERSIST_PATH is required to access the token on disk"
+            )
+        if os.path.isdir(path):
+            path = os.path.join(path, f"agent-{os.getpid()}.jwt")
+        self._token_persist_path = path
+        self._persist_token_to_disk = True
+        await self._ensure_token()
+        self._write_token_to_disk()
+
+    @property
+    def token_file_path(self) -> str:
+        if not self._persist_token_to_disk:
+            raise RuntimeError("Token persistence has not been enabled — call enable_token_persistence() first")
+        return self._token_persist_path
+
+    async def _request(self, method: str, path: str) -> dict:
+        await self._ensure_token()
+        url = f"{self._endpoint}/deployment/{self._deployment_id}{path}"
+        headers = {"Authorization": f"Bearer {self._token}"}
+
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                resp = await client.request(method, url, headers=headers)
+        except httpx.ConnectError as e:
+            logger.error(f"PatternSDK: cannot connect to {url}: {e}")
+            raise
+        except httpx.TimeoutException:
+            logger.error(f"PatternSDK: request to {url} timed out")
+            raise
+
+        if resp.status_code == 403 and self._token_is_expired() and not self._renew_failed:
+            logger.info("PatternSDK: got 403 with expired token, attempting renewal")
+            try:
+                await self._mint_token()
+            except Exception:
+                self._renew_failed = True
+                logger.error("PatternSDK: token renewal failed after 403, not retrying")
+                raise
+            headers = {"Authorization": f"Bearer {self._token}"}
+            try:
+                async with httpx.AsyncClient(timeout=10) as client:
+                    resp = await client.request(method, url, headers=headers)
+            except httpx.ConnectError as e:
+                logger.error(f"PatternSDK: cannot connect to {url} on retry: {e}")
+                raise
+            except httpx.TimeoutException:
+                logger.error(f"PatternSDK: retry request to {url} timed out")
+                raise
+
+        if resp.status_code == 401:
+            logger.error(f"PatternSDK: 401 from {path}: {resp.text}")
+            raise PermissionError(f"Unauthorized: {resp.text}")
+        if resp.status_code == 403:
+            logger.error(f"PatternSDK: 403 from {path}: {resp.text}")
+            raise PermissionError(f"Forbidden: {resp.text}")
+        if resp.status_code >= 400:
+            logger.error(f"PatternSDK: {resp.status_code} from {path}: {resp.text}")
+            raise RuntimeError(
+                f"Error fetching {path} from pattern-agentic services: {resp.status_code} {resp.reason_phrase}"
+            )
+
+        return resp.json()
+
+    async def session_token_config(self) -> SessionTokenJWKSConfig:
+        if self._session_jwks_config:
+            return self._session_jwks_config
+        self._require_enabled()
+        url = f"{self._endpoint}/session-token-config"
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                resp = await client.get(url)
+        except httpx.ConnectError as e:
+            logger.error(f"PatternSDK: cannot connect to {url}: {e}")
+            raise
+        except httpx.TimeoutException:
+            logger.error(f"PatternSDK: request to {url} timed out")
+            raise
+        if resp.status_code >= 400:
+            logger.error(f"PatternSDK: {resp.status_code} from session-token-config: {resp.text}")
+            raise RuntimeError(f"Failed to fetch session token config: {resp.status_code}")
+        data = resp.json()
+        self._session_jwks_config = SessionTokenJWKSConfig(**data)
+        self._jwks_client = PyJWKClient(
+            self._session_jwks_config.jwks_url,
+            cache_keys=True,
+        )
+        return self._session_jwks_config
+
+    async def verify_session_token(self, token, *, verify_agent_peers: bool = True) -> PatternAgentSessionToken:
+        if isinstance(token, PatternAgentSessionToken):
+            raw = token.raw_token
+        else:
+            raw = token
+        if not self._jwks_client or not self._session_jwks_config:
+            await self.session_token_config()
+        signing_key = self._jwks_client.get_signing_key_from_jwt(raw)
+        decode_kwargs = {
+            "jwt": raw,
+            "key": signing_key.key,
+            "algorithms": ["RS256"],
+            "audience": self._session_jwks_config.audience,
+        }
+        if self._session_jwks_config.issuer:
+            decode_kwargs["issuer"] = self._session_jwks_config.issuer
+        payload = pyjwt.decode(**decode_kwargs)
+        verified = PatternAgentSessionToken(
+            session_id=payload["sub"],
+            tenant_id=payload["tenant_id"],
+            user_id=payload["user_id"],
+            agents=payload.get("agents", []),
+            exp=payload["exp"],
+            iat=payload["iat"],
+            raw_token=raw,
+        )
+        if verify_agent_peers:
+            if not self._deployment_id:
+                raise RuntimeError("Cannot verify agent peers: SDK has no deployment identity (token not yet minted)")
+            if self._deployment_id not in verified.agents:
+                raise PermissionError(
+                    f"Session token does not authorize this agent: "
+                    f"deployment={self._deployment_id} not in agents={verified.agents}"
+                )
+        return verified
+
+    async def _build_agent_app(self, *, verify_sessions: bool = True) -> PASlimApp:
+        self._require_enabled()
+        await self._ensure_token()
+        cfg = await self.config()
+        sys_params = cfg.get("__system_params", {})
+        slim_endpoint = sys_params.get("PA_SLIM_ENDPOINT", "")
+        slim_name = sys_params.get("PA_SLIM_NAME", "")
+        slim_secret = sys_params.get("PA_SLIM_SHARED_SECRET", "")
+        if not slim_endpoint or not slim_name or not slim_secret:
+            raise RuntimeError(
+                f"Missing SLIM config from agent services: "
+                f"PA_SLIM_ENDPOINT={slim_endpoint!r}, PA_SLIM_NAME={slim_name!r}, "
+                f"PA_SLIM_SHARED_SECRET={'***' if slim_secret else '(empty)'}"
+            )
+        await self.session_token_config()
+
+        config = PASlimConfig(
+            local_name=slim_name,
+            endpoint=slim_endpoint,
+            auth_secret=slim_secret,
+            message_discriminator="type",
+        )
+        app = PASlimApp(config)
+        if verify_sessions:
+            app.session_token_verifier = self.verify_session_token
+        logger.info(f"PatternSDK: agent configured (deployment={self._deployment_id} slim_name={slim_name})")
+        return app
+
+    def agent_app(self, *, verify_sessions: bool = True) -> PASlimApp:
+        return asyncio.run(self._build_agent_app(verify_sessions=verify_sessions))
+
+    async def config(self, key: Optional[str] = None):
+        self._require_enabled()
+        if self._config_cache is None:
+            self._config_cache = await self._request("GET", "/config")
+        if key is not None:
+            return self._config_cache.get(key)
+        return self._config_cache
+
+    async def prompt(self, slug: str) -> Optional[str]:
+        self._require_enabled()
+        if self._prompts_cache is None:
+            self._prompts_cache = await self._request("GET", "/prompts")
+        return self._prompts_cache.get(slug)
+
+    async def prompts(self) -> dict:
+        self._require_enabled()
+        if self._prompts_cache is None:
+            self._prompts_cache = await self._request("GET", "/prompts")
+        return self._prompts_cache
+
+
+pa_sdk = PatternSDK(
+    os.environ.get("__PA_AGENT_SERVICES_ENDPOINT"),
+    os.environ.get("__PA_AGENT_SERVICES_TOKEN_REQUEST_HEADERS"),
+)

pattern_agent_sdk-0.3.0/tests/test_sdk.py

@@ -0,0 +1,335 @@
+import json
+import os
+import stat
+import time
+import base64
+from unittest.mock import AsyncMock, patch, MagicMock
+
+import httpx
+import jwt as pyjwt
+import pytest
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import serialization
+
+from pattern_agent_sdk import AgentSessionToken, PatternSDK, SessionTokenJWKSConfig
+from pattern_agent_sdk.sdk import _decode_jwt_payload, _parse_extra_headers
+
+
+def _make_jwt(payload: dict) -> str:
+    header = base64.urlsafe_b64encode(b'{"alg":"HS256"}').rstrip(b"=").decode()
+    body = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b"=").decode()
+    return f"{header}.{body}.fakesig"
+
+
+class TestDecodeJwtPayload:
+    def test_valid_token(self):
+        payload = {"sub": "dep-123", "exp": 9999999999}
+        token = _make_jwt(payload)
+        assert _decode_jwt_payload(token) == payload
+
+    def test_invalid_token(self):
+        with pytest.raises(ValueError, match="Invalid JWT format"):
+            _decode_jwt_payload("not.a.valid.jwt.token")
+
+    def test_two_parts(self):
+        with pytest.raises(ValueError, match="Invalid JWT format"):
+            _decode_jwt_payload("only.two")
+
+
+class TestParseExtraHeaders:
+    def test_valid_headers(self):
+        raw = base64.b64encode(json.dumps({"X-Forwarded-Client-Cert": "Hash=abc"}).encode()).decode()
+        assert _parse_extra_headers(raw) == {"X-Forwarded-Client-Cert": "Hash=abc"}
+
+    def test_empty_or_none(self):
+        assert _parse_extra_headers(None) == {}
+        assert _parse_extra_headers("") == {}
+
+    def test_malformed_base64(self):
+        assert _parse_extra_headers("not-valid-base64!!!") == {}
+
+    def test_non_dict_json(self):
+        raw = base64.b64encode(b'["a","b"]').decode()
+        assert _parse_extra_headers(raw) == {}
+
+    def test_non_string_values(self):
+        raw = base64.b64encode(json.dumps({"key": 123}).encode()).decode()
+        assert _parse_extra_headers(raw) == {}
+
+
+class TestMintTokenHeaders:
+    async def test_mint_token_sends_extra_headers(self, respx_mock):
+        extra = {"X-Forwarded-Client-Cert": "Hash=abc123"}
+        raw = base64.b64encode(json.dumps(extra).encode()).decode()
+        sdk = PatternSDK("http://localhost:9999", token_request_headers=raw)
+
+        token = _make_jwt({"sub": "dep-1", "exp": 9999999999})
+        route = respx_mock.post("http://localhost:9999/mint-agent-token").mock(
+            return_value=httpx.Response(200, json={"token": token})
+        )
+
+        await sdk._mint_token()
+
+        assert route.called
+        req = route.calls[0].request
+        assert req.headers["X-Forwarded-Client-Cert"] == "Hash=abc123"
+
+    async def test_mint_token_no_extra_headers(self, respx_mock):
+        sdk = PatternSDK("http://localhost:9999")
+
+        token = _make_jwt({"sub": "dep-1", "exp": 9999999999})
+        route = respx_mock.post("http://localhost:9999/mint-agent-token").mock(
+            return_value=httpx.Response(200, json={"token": token})
+        )
+
+        await sdk._mint_token()
+
+        assert route.called
+        req = route.calls[0].request
+        assert "X-Forwarded-Client-Cert" not in req.headers
+
+
+class TestPatternSDKNoEndpoint:
+    def test_init_silent_when_no_endpoint(self):
+        sdk = PatternSDK()
+        assert not sdk._enabled
+
+    async def test_methods_raise_when_disabled(self):
+        sdk = PatternSDK()
+        with pytest.raises(RuntimeError, match="SDK is disabled"):
+            await sdk.config()
+        with pytest.raises(RuntimeError, match="SDK is disabled"):
+            await sdk.prompt("inference")
+        with pytest.raises(RuntimeError, match="SDK is disabled"):
+            await sdk.prompts()
+
+
+class TestConfigCaching:
+    async def test_config_cached(self):
+        sdk = PatternSDK("http://localhost:9999")
+        mock_data = {"key1": "val1", "key2": "val2"}
+
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=mock_data) as mock_req:
+            result1 = await sdk.config()
+            result2 = await sdk.config()
+            result3 = await sdk.config("key1")
+
+        assert result1 == mock_data
+        assert result2 == mock_data
+        assert result3 == "val1"
+        mock_req.assert_awaited_once_with("GET", "/config")
+
+    async def test_config_key_missing_returns_none(self):
+        sdk = PatternSDK("http://localhost:9999")
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value={"a": 1}):
+            assert await sdk.config("missing") is None
+
+
+class TestPromptsCaching:
+    async def test_prompt_shares_cache_with_prompts(self):
+        sdk = PatternSDK("http://localhost:9999")
+        mock_data = {"greeting": "Hello!", "farewell": "Bye!"}
+
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=mock_data) as mock_req:
+            single = await sdk.prompt("greeting")
+            all_prompts = await sdk.prompts()
+
+        assert single == "Hello!"
+        assert all_prompts == mock_data
+        mock_req.assert_awaited_once_with("GET", "/prompts")
+
+    async def test_prompt_missing_returns_none(self):
+        sdk = PatternSDK("http://localhost:9999")
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value={}):
+            assert await sdk.prompt("nope") is None
+
+
+class TestTokenPersistence:
+    async def test_enable_writes_token_to_disk(self, respx_mock, tmp_path):
+        token = _make_jwt({"sub": "dep-1", "exp": 9999999999})
+        respx_mock.post("http://localhost:9999/mint-agent-token").mock(
+            return_value=httpx.Response(200, json={"token": token})
+        )
+        sdk = PatternSDK("http://localhost:9999")
+        path = str(tmp_path / "token")
+
+        with patch.dict(os.environ, {"__PA_AGENT_SDK_TOKEN_PERSIST_PATH": path}):
+            await sdk.enable_token_persistence()
+
+        assert sdk.token_file_path == path
+        assert open(path).read() == token
+        assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
+
+    async def test_missing_env_var_raises(self):
+        sdk = PatternSDK("http://localhost:9999")
+        with patch.dict(os.environ, {}, clear=True):
+            with pytest.raises(RuntimeError, match="__PA_AGENT_SDK_TOKEN_PERSIST_PATH is required"):
+                await sdk.enable_token_persistence()
+
+    def test_token_file_path_raises_when_not_enabled(self):
+        sdk = PatternSDK("http://localhost:9999")
+        with pytest.raises(RuntimeError, match="Token persistence has not been enabled"):
+            _ = sdk.token_file_path
+
+    async def test_token_refresh_updates_file(self, respx_mock, tmp_path):
+        token1 = _make_jwt({"sub": "dep-1", "exp": 9999999999})
+        token2 = _make_jwt({"sub": "dep-1", "exp": 9999999999, "v": 2})
+        route = respx_mock.post("http://localhost:9999/mint-agent-token")
+        route.side_effect = [
+            httpx.Response(200, json={"token": token1}),
+            httpx.Response(200, json={"token": token2}),
+        ]
+        sdk = PatternSDK("http://localhost:9999")
+        path = str(tmp_path / "token")
+
+        with patch.dict(os.environ, {"__PA_AGENT_SDK_TOKEN_PERSIST_PATH": path}):
+            await sdk.enable_token_persistence()
+
+        assert open(path).read() == token1
+
+        sdk._token_exp = 0
+        await sdk._ensure_token()
+
+        assert open(path).read() == token2
+
+    async def test_disabled_sdk_raises(self):
+        sdk = PatternSDK()
+        with pytest.raises(RuntimeError, match="SDK is disabled"):
+            await sdk.enable_token_persistence()
+
+
+def _rsa_key_pair():
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    private_pem = private_key.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption(),
+    )
+    return private_key, private_pem
+
+
+def _make_session_jwt(private_pem: bytes, payload: dict, headers: dict | None = None) -> str:
+    return pyjwt.encode(payload, private_pem, algorithm="RS256", headers=headers)
+
+
+class TestSessionTokenConfig:
+    async def test_fetches_and_caches(self):
+        sdk = PatternSDK("http://localhost:9999")
+        config_data = {"jwks_url": "https://example.com/.well-known/jwks.json", "audience": "my-app"}
+
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=config_data) as mock_req:
+            result1 = await sdk.session_token_config()
+            result2 = await sdk.session_token_config()
+
+        assert result1 == SessionTokenJWKSConfig(jwks_url="https://example.com/.well-known/jwks.json", audience="my-app")
+        assert result2 is result1
+        mock_req.assert_awaited_once_with("GET", "/session_token_jwks_config")
+        assert sdk._jwks_client is not None
+
+    async def test_with_issuer(self):
+        sdk = PatternSDK("http://localhost:9999")
+        config_data = {
+            "jwks_url": "https://example.com/.well-known/jwks.json",
+            "audience": "my-app",
+            "issuer": "https://auth.example.com",
+        }
+
+        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=config_data):
+            result = await sdk.session_token_config()
+
+        assert result.issuer == "https://auth.example.com"
+
+
+class TestVerifySessionToken:
+    def test_raises_without_config(self):
+        sdk = PatternSDK("http://localhost:9999")
+        with pytest.raises(RuntimeError, match="Session token verification not configured"):
+            sdk.verify_session_token("some.jwt.token")
+
+    def test_valid_token(self):
+        private_key, private_pem = _rsa_key_pair()
+        now = int(time.time())
+        payload = {
+            "sub": "session-abc",
+            "tenant_id": "tenant-1",
+            "user_id": "user-42",
+            "agents": ["agent-a", "agent-b"],
+            "exp": now + 3600,
+            "iat": now,
+            "aud": "my-app",
+        }
+        token = _make_session_jwt(private_pem, payload)
+
+        sdk = PatternSDK("http://localhost:9999")
+        sdk._session_jwks_config = SessionTokenJWKSConfig(
+            jwks_url="https://example.com/.well-known/jwks.json",
+            audience="my-app",
+        )
+        mock_signing_key = MagicMock()
+        mock_signing_key.key = private_key.public_key()
+        sdk._jwks_client = MagicMock()
+        sdk._jwks_client.get_signing_key_from_jwt.return_value = mock_signing_key
+
+        result = sdk.verify_session_token(token)
+
+        assert isinstance(result, AgentSessionToken)
+        assert result.session_id == "session-abc"
+        assert result.tenant_id == "tenant-1"
+        assert result.user_id == "user-42"
+        assert result.agents == ["agent-a", "agent-b"]
+        assert result.exp == now + 3600
+        assert result.iat == now
+
+    def test_expired_token_raises(self):
+        private_key, private_pem = _rsa_key_pair()
+        now = int(time.time())
+        payload = {
+            "sub": "session-abc",
+            "tenant_id": "tenant-1",
+            "user_id": "user-42",
+            "agents": [],
+            "exp": now - 100,
+            "iat": now - 3700,
+            "aud": "my-app",
+        }
+        token = _make_session_jwt(private_pem, payload)
+
+        sdk = PatternSDK("http://localhost:9999")
+        sdk._session_jwks_config = SessionTokenJWKSConfig(
+            jwks_url="https://example.com/.well-known/jwks.json",
+            audience="my-app",
+        )
+        mock_signing_key = MagicMock()
+        mock_signing_key.key = private_key.public_key()
+        sdk._jwks_client = MagicMock()
+        sdk._jwks_client.get_signing_key_from_jwt.return_value = mock_signing_key
+
+        with pytest.raises(pyjwt.ExpiredSignatureError):
+            sdk.verify_session_token(token)
+
+    def test_wrong_audience_raises(self):
+        private_key, private_pem = _rsa_key_pair()
+        now = int(time.time())
+        payload = {
+            "sub": "session-abc",
+            "tenant_id": "tenant-1",
+            "user_id": "user-42",
+            "agents": [],
+            "exp": now + 3600,
+            "iat": now,
+            "aud": "wrong-audience",
+        }
+        token = _make_session_jwt(private_pem, payload)
+
+        sdk = PatternSDK("http://localhost:9999")
+        sdk._session_jwks_config = SessionTokenJWKSConfig(
+            jwks_url="https://example.com/.well-known/jwks.json",
+            audience="my-app",
+        )
+        mock_signing_key = MagicMock()
+        mock_signing_key.key = private_key.public_key()
+        sdk._jwks_client = MagicMock()
+        sdk._jwks_client.get_signing_key_from_jwt.return_value = mock_signing_key
+
+        with pytest.raises(pyjwt.InvalidAudienceError):
+            sdk.verify_session_token(token)

pattern_agent_sdk-0.1.0/src/pattern_agent_sdk/__init__.py

@@ -1,3 +0,0 @@
-from .sdk import PatternSDK, pa_sdk
-
-__all__ = ["PatternSDK", "pa_sdk"]

pattern_agent_sdk-0.1.0/src/pattern_agent_sdk/sdk.py

@@ -1,164 +0,0 @@
-import os
-import json
-import time
-import base64
-import logging
-from typing import Optional
-
-import httpx
-
-logger = logging.getLogger(__name__)
-
-
-def _parse_extra_headers(raw: Optional[str]) -> dict[str, str]:
-    if not raw:
-        return {}
-    try:
-        decoded = base64.b64decode(raw)
-        headers = json.loads(decoded)
-        if isinstance(headers, dict) and all(isinstance(k, str) and isinstance(v, str) for k, v in headers.items()):
-            return headers
-    except Exception:
-        pass
-    logger.warning("PatternSDK: __PA_AGENT_SERVICES_TOKEN_REQUEST_HEADERS is malformed, ignoring")
-    return {}
-
-
-def _decode_jwt_payload(token: str) -> dict:
-    parts = token.split(".")
-    if len(parts) != 3:
-        raise ValueError("Invalid JWT format")
-    payload_b64 = parts[1] + "=" * (-len(parts[1]) % 4)
-    return json.loads(base64.urlsafe_b64decode(payload_b64))
-
-
-class PatternSDK:
-    def __init__(self, services_endpoint: Optional[str] = None, token_request_headers: Optional[str] = None):
-        self._services_endpoint = (services_endpoint or "").rstrip("/")
-        self._enabled = bool(self._services_endpoint)
-        if not self._enabled:
-            logger.info("PatternSDK: no services endpoint configured, SDK disabled")
-            return
-        self._mint_headers = _parse_extra_headers(token_request_headers)
-        self._token: Optional[str] = None
-        self._deployment_id: Optional[str] = None
-        self._token_exp: float = 0
-        self._renew_failed: bool = False
-        self._config_cache: Optional[dict] = None
-        self._prompts_cache: Optional[dict] = None
-
-    def _require_enabled(self):
-        if not self._enabled:
-            raise RuntimeError("PatternSDK is disabled: services endpoint not specified")
-
-    @property
-    def _endpoint(self) -> str:
-        return self._services_endpoint
-
-    async def _mint_token(self) -> str:
-        url = f"{self._endpoint}/mint-agent-token"
-        try:
-            async with httpx.AsyncClient(timeout=10) as client:
-                resp = await client.post(url, headers=self._mint_headers or None)
-        except httpx.ConnectError as e:
-            logger.error(f"PatternSDK: cannot connect to agent services at {url} — is the sidecar running? {e}")
-            raise
-        except httpx.TimeoutException:
-            logger.error(f"PatternSDK: request to {url} timed out")
-            raise
-
-        if resp.status_code != 200:
-            logger.error(f"PatternSDK: mint-agent-token returned {resp.status_code}: {resp.text}")
-            resp.raise_for_status()
-
-        try:
-            token = resp.json()["token"]
-        except (KeyError, json.JSONDecodeError) as e:
-            logger.error(f"PatternSDK: mint-agent-token response missing 'token' field: {resp.text}")
-            raise RuntimeError("mint-agent-token response missing 'token' field") from e
-
-        payload = _decode_jwt_payload(token)
-        self._token = token
-        self._deployment_id = payload["sub"]
-        self._token_exp = payload.get("exp", 0)
-        self._renew_failed = False
-        return token
-
-    async def _ensure_token(self):
-        if not self._token or time.time() >= self._token_exp:
-            await self._mint_token()
-
-    def _token_is_expired(self) -> bool:
-        return time.time() >= self._token_exp
-
-    async def _request(self, method: str, path: str) -> dict:
-        await self._ensure_token()
-        url = f"{self._endpoint}/deployment/{self._deployment_id}{path}"
-        headers = {"Authorization": f"Bearer {self._token}"}
-
-        try:
-            async with httpx.AsyncClient(timeout=10) as client:
-                resp = await client.request(method, url, headers=headers)
-        except httpx.ConnectError as e:
-            logger.error(f"PatternSDK: cannot connect to {url}: {e}")
-            raise
-        except httpx.TimeoutException:
-            logger.error(f"PatternSDK: request to {url} timed out")
-            raise
-
-        if resp.status_code == 403 and self._token_is_expired() and not self._renew_failed:
-            logger.info("PatternSDK: got 403 with expired token, attempting renewal")
-            try:
-                await self._mint_token()
-            except Exception:
-                self._renew_failed = True
-                logger.error("PatternSDK: token renewal failed after 403, not retrying")
-                raise
-            headers = {"Authorization": f"Bearer {self._token}"}
-            try:
-                async with httpx.AsyncClient(timeout=10) as client:
-                    resp = await client.request(method, url, headers=headers)
-            except httpx.ConnectError as e:
-                logger.error(f"PatternSDK: cannot connect to {url} on retry: {e}")
-                raise
-            except httpx.TimeoutException:
-                logger.error(f"PatternSDK: retry request to {url} timed out")
-                raise
-
-        if resp.status_code == 401:
-            logger.error(f"PatternSDK: 401 from {path}: {resp.text}")
-            raise PermissionError(f"Unauthorized: {resp.text}")
-        if resp.status_code == 403:
-            logger.error(f"PatternSDK: 403 from {path}: {resp.text}")
-            raise PermissionError(f"Forbidden: {resp.text}")
-        if resp.status_code >= 400:
-            logger.error(f"PatternSDK: {resp.status_code} from {path}: {resp.text}")
-            resp.raise_for_status()
-
-        return resp.json()
-
-    async def config(self, key: Optional[str] = None):
-        self._require_enabled()
-        if self._config_cache is None:
-            self._config_cache = await self._request("GET", "/config")
-        if key is not None:
-            return self._config_cache.get(key)
-        return self._config_cache
-
-    async def prompt(self, slug: str) -> Optional[str]:
-        self._require_enabled()
-        if self._prompts_cache is None:
-            self._prompts_cache = await self._request("GET", "/prompts")
-        return self._prompts_cache.get(slug)
-
-    async def prompts(self) -> dict:
-        self._require_enabled()
-        if self._prompts_cache is None:
-            self._prompts_cache = await self._request("GET", "/prompts")
-        return self._prompts_cache
-
-
-pa_sdk = PatternSDK(
-    os.environ.get("__PA_AGENT_SERVICES_ENDPOINT"),
-    os.environ.get("__PA_AGENT_SERVICES_TOKEN_REQUEST_HEADERS"),
-)

pattern_agent_sdk-0.1.0/tests/test_sdk.py

@@ -1,138 +0,0 @@
-import json
-import base64
-from unittest.mock import AsyncMock, patch
-
-import httpx
-import pytest
-
-from pattern_agent_sdk import PatternSDK
-from pattern_agent_sdk.sdk import _decode_jwt_payload, _parse_extra_headers
-
-
-def _make_jwt(payload: dict) -> str:
-    header = base64.urlsafe_b64encode(b'{"alg":"HS256"}').rstrip(b"=").decode()
-    body = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b"=").decode()
-    return f"{header}.{body}.fakesig"
-
-
-class TestDecodeJwtPayload:
-    def test_valid_token(self):
-        payload = {"sub": "dep-123", "exp": 9999999999}
-        token = _make_jwt(payload)
-        assert _decode_jwt_payload(token) == payload
-
-    def test_invalid_token(self):
-        with pytest.raises(ValueError, match="Invalid JWT format"):
-            _decode_jwt_payload("not.a.valid.jwt.token")
-
-    def test_two_parts(self):
-        with pytest.raises(ValueError, match="Invalid JWT format"):
-            _decode_jwt_payload("only.two")
-
-
-class TestParseExtraHeaders:
-    def test_valid_headers(self):
-        raw = base64.b64encode(json.dumps({"X-Forwarded-Client-Cert": "Hash=abc"}).encode()).decode()
-        assert _parse_extra_headers(raw) == {"X-Forwarded-Client-Cert": "Hash=abc"}
-
-    def test_empty_or_none(self):
-        assert _parse_extra_headers(None) == {}
-        assert _parse_extra_headers("") == {}
-
-    def test_malformed_base64(self):
-        assert _parse_extra_headers("not-valid-base64!!!") == {}
-
-    def test_non_dict_json(self):
-        raw = base64.b64encode(b'["a","b"]').decode()
-        assert _parse_extra_headers(raw) == {}
-
-    def test_non_string_values(self):
-        raw = base64.b64encode(json.dumps({"key": 123}).encode()).decode()
-        assert _parse_extra_headers(raw) == {}
-
-
-class TestMintTokenHeaders:
-    async def test_mint_token_sends_extra_headers(self, respx_mock):
-        extra = {"X-Forwarded-Client-Cert": "Hash=abc123"}
-        raw = base64.b64encode(json.dumps(extra).encode()).decode()
-        sdk = PatternSDK("http://localhost:9999", token_request_headers=raw)
-
-        token = _make_jwt({"sub": "dep-1", "exp": 9999999999})
-        route = respx_mock.post("http://localhost:9999/mint-agent-token").mock(
-            return_value=httpx.Response(200, json={"token": token})
-        )
-
-        await sdk._mint_token()
-
-        assert route.called
-        req = route.calls[0].request
-        assert req.headers["X-Forwarded-Client-Cert"] == "Hash=abc123"
-
-    async def test_mint_token_no_extra_headers(self, respx_mock):
-        sdk = PatternSDK("http://localhost:9999")
-
-        token = _make_jwt({"sub": "dep-1", "exp": 9999999999})
-        route = respx_mock.post("http://localhost:9999/mint-agent-token").mock(
-            return_value=httpx.Response(200, json={"token": token})
-        )
-
-        await sdk._mint_token()
-
-        assert route.called
-        req = route.calls[0].request
-        assert "X-Forwarded-Client-Cert" not in req.headers
-
-
-class TestPatternSDKNoEndpoint:
-    def test_init_silent_when_no_endpoint(self):
-        sdk = PatternSDK()
-        assert not sdk._enabled
-
-    async def test_methods_raise_when_disabled(self):
-        sdk = PatternSDK()
-        with pytest.raises(RuntimeError, match="SDK is disabled"):
-            await sdk.config()
-        with pytest.raises(RuntimeError, match="SDK is disabled"):
-            await sdk.prompt("inference")
-        with pytest.raises(RuntimeError, match="SDK is disabled"):
-            await sdk.prompts()
-
-
-class TestConfigCaching:
-    async def test_config_cached(self):
-        sdk = PatternSDK("http://localhost:9999")
-        mock_data = {"key1": "val1", "key2": "val2"}
-
-        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=mock_data) as mock_req:
-            result1 = await sdk.config()
-            result2 = await sdk.config()
-            result3 = await sdk.config("key1")
-
-        assert result1 == mock_data
-        assert result2 == mock_data
-        assert result3 == "val1"
-        mock_req.assert_awaited_once_with("GET", "/config")
-
-    async def test_config_key_missing_returns_none(self):
-        sdk = PatternSDK("http://localhost:9999")
-        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value={"a": 1}):
-            assert await sdk.config("missing") is None
-
-
-class TestPromptsCaching:
-    async def test_prompt_shares_cache_with_prompts(self):
-        sdk = PatternSDK("http://localhost:9999")
-        mock_data = {"greeting": "Hello!", "farewell": "Bye!"}
-
-        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value=mock_data) as mock_req:
-            single = await sdk.prompt("greeting")
-            all_prompts = await sdk.prompts()
-
-        assert single == "Hello!"
-        assert all_prompts == mock_data
-        mock_req.assert_awaited_once_with("GET", "/prompts")
-
-    async def test_prompt_missing_returns_none(self):
-        sdk = PatternSDK("http://localhost:9999")
-        with patch.object(sdk, "_request", new_callable=AsyncMock, return_value={}):
-            assert await sdk.prompt("nope") is None