regent-httpsig 0.1.0__py3-none-any.whl → 0.2.0__py3-none-any.whl

regent_httpsig/__init__.py

@@ -11,7 +11,7 @@ from regent_httpsig.sfv import parse_signature_agent
 from regent_httpsig.sign import DIRECTORY_MEDIA_TYPE, EgressSigner, generate_seed
 from regent_httpsig.verify import WBA_TAG, HttpsigVerifier, VerifiedSignature
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 __all__ = [
     "DIRECTORY_MEDIA_TYPE",

regent_httpsig/config.py

@@ -30,3 +30,11 @@ class HttpsigConfig:
     # Hosts exempt from the https-only + public-IP SSRF guard (local dev only —
     # e.g. frozenset({"localhost"})). Leave empty in production.
     insecure_hosts: frozenset[str] = field(default_factory=frozenset)
+    # AAuth -11 (editor's copy): JOSE algs must be fully-specified per RFC 9864 —
+    # implementations MUST NOT accept the polymorphic "EdDSA". True enforces that;
+    # the False default keeps accepting "EdDSA" while the -10 ecosystem migrates.
+    require_fully_specified_algs: bool = False
+    # This service's public URL (e.g. "https://api.example"). Required to accept
+    # AAuth person tokens — their `aud` must name this resource. None disables
+    # the person-token path entirely.
+    resource_url: str | None = None

regent_httpsig/verify.py

@@ -55,7 +55,23 @@ logger = logging.getLogger("regent_httpsig")
 WBA_TAG = "web-bot-auth"
 WBA_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory"
 AAUTH_METADATA_PATH = "/.well-known/aauth-agent.json"
+AAUTH_PERSON_METADATA_PATH = "/.well-known/aauth-person.json"
 AAUTH_JWT_TYP = "aa-agent+jwt"
+AAUTH_PERSON_TYP = "aa-person+jwt"
+# -11: a person token "lives at most one hour" — enforced with a small tolerance.
+PERSON_TOKEN_MAX_LIFETIME = 3600 + 90
+
+
+def _register_fully_specified_algs() -> None:
+    """Register 'Ed25519' (RFC 9864 fully-specified) with PyJWT — same math as
+    the polymorphic 'EdDSA', which AAuth -11 forbids implementations to accept."""
+    import contextlib
+
+    import jwt as pyjwt
+    from jwt.algorithms import OKPAlgorithm
+
+    with contextlib.suppress(ValueError):  # already registered = fine
+        pyjwt.register_algorithm("Ed25519", OKPAlgorithm())
 
 
 @dataclass
@@ -84,6 +100,31 @@ class VerifiedSignature:
         return out
 
 
+class _KeyidOptionalParams(dict):  # type: ignore[type-arg]
+    """RFC 9421 makes ``keyid`` OPTIONAL, but the upstream verifier reads
+    ``params["keyid"]`` unconditionally. On the AAuth path the key comes from
+    the token's ``cnf.jwk``, so conforming signers (e.g. aauth-signing) omit
+    keyid entirely. Returning None for a missing keyid routes resolution to our
+    StaticKeyResolver default WITHOUT adding the key to the params — iteration
+    is unchanged, so the reconstructed signature base stays byte-identical."""
+
+    def __getitem__(self, key: str) -> Any:
+        if key == "keyid" and key not in self:
+            return None
+        return super().__getitem__(key)
+
+
+class _KeyidOptionalVerifier(HTTPMessageVerifier):
+    def _verify_one(self, *, label: Any, sig_input: Any, signature: Any,
+                    message: Any, max_age: Any) -> Any:
+        if "keyid" not in sig_input.params:
+            sig_input.params = _KeyidOptionalParams(sig_input.params)
+        return super()._verify_one(  # type: ignore[no-untyped-call]
+            label=label, sig_input=sig_input, signature=signature,
+            message=message, max_age=max_age,
+        )
+
+
 def _keys_from_jwks(doc: dict[str, Any]) -> dict[str, Ed25519PublicKey]:
     keys: dict[str, Ed25519PublicKey] = {}
     for jwk in list(doc.get("keys") or [])[:10]:
@@ -261,22 +302,47 @@ class HttpsigVerifier:
             return None
         label, token = parsed
 
+        _register_fully_specified_algs()
         try:
             header = pyjwt.get_unverified_header(token)
             unverified = pyjwt.decode(token, options={"verify_signature": False})
         except Exception:  # noqa: BLE001
             return None
-        if header.get("typ") != AAUTH_JWT_TYP or header.get("alg") in (None, "none"):
+        if header.get("alg") in (None, "none"):
             return None
+
+        # -11 token-type dispatch: agent tokens (identity mode) and person tokens
+        # (PS-issued, per-resource, opt-in via config.resource_url).
+        typ = header.get("typ")
+        if typ == AAUTH_JWT_TYP:
+            scheme, expected_dwk = "aauth", "aauth-agent.json"
+            metadata_path, audience = AAUTH_METADATA_PATH, None
+        elif typ == AAUTH_PERSON_TYP:
+            if not self.config.resource_url:
+                logger.info("person token presented but config.resource_url is not "
+                            "set — person-token verification is disabled")
+                return None
+            scheme, expected_dwk = "aauth-person", "aauth-person.json"
+            metadata_path, audience = AAUTH_PERSON_METADATA_PATH, self.config.resource_url
+        else:
+            return None
+
         iss = str(unverified.get("iss", ""))
-        bad_iss = unverified.get("dwk") != "aauth-agent.json" or not iss.startswith("https://")
+        bad_iss = unverified.get("dwk") != expected_dwk or not iss.startswith("https://")
         if bad_iss and not (
             iss and urlsplit(iss).hostname in self.config.insecure_hosts  # dev escape
         ):
             return None
 
-        # 1) Verify the agent_token against the issuer's published JWKS.
-        metadata = await self._fetch_json(iss.rstrip("/") + AAUTH_METADATA_PATH)
+        # AAuth -11 / RFC 9864: fully-specified algorithms. "EdDSA" (polymorphic)
+        # is accepted only while require_fully_specified_algs is False — a
+        # transition affordance for the -10 ecosystem.
+        allowed_algs = ["Ed25519", "ES256", "RS256"]
+        if not self.config.require_fully_specified_algs:
+            allowed_algs.append("EdDSA")
+
+        # 1) Verify the token against the issuer's published JWKS.
+        metadata = await self._fetch_json(iss.rstrip("/") + metadata_path)
         if not metadata or not metadata.get("jwks_uri"):
             return None
         jwks = await self._fetch_json(str(metadata["jwks_uri"]))
@@ -289,29 +355,51 @@ class HttpsigVerifier:
                     issuer_key = pyjwt.PyJWK(k).key
                     break
                 except Exception:  # noqa: BLE001
-                    continue
+                    # PyJWK's internal registry predates RFC 9864 names — a JWKS
+                    # advertising alg "Ed25519" is valid in -11 but unknown to it.
+                    try:
+                        issuer_key = load_ed25519_jwk(k)
+                        break
+                    except ValueError:
+                        continue
         if issuer_key is None:
             return None
         try:
             claims = pyjwt.decode(
                 token,
                 key=issuer_key,
-                algorithms=["EdDSA", "ES256", "RS256"],
-                options={"require": ["iss", "sub", "exp", "iat"]},
+                algorithms=allowed_algs,
+                audience=audience,
+                options={
+                    "require": ["iss", "sub", "exp", "iat"],
+                    "verify_aud": audience is not None,
+                },
             )
         except Exception as exc:  # noqa: BLE001
             logger.info("aauth token invalid iss=%s: %s", iss, str(exc)[:200])
             return None
 
+        # -11: a person token "lives at most one hour".
+        if typ == AAUTH_PERSON_TYP:
+            lifetime = int(claims.get("exp", 0)) - int(claims.get("iat", 0))
+            if lifetime <= 0 or lifetime > PERSON_TOKEN_MAX_LIFETIME:
+                logger.info("person token lifetime %ss out of bounds iss=%s", lifetime, iss)
+                return None
+
         # 2) Proof of possession: the request signature must verify against cnf.jwk.
         cnf_jwk = (claims.get("cnf") or {}).get("jwk")
         if not isinstance(cnf_jwk, dict):
             return None
+        # -11 strict mode: the cnf JWK "MUST carry a fully-specified alg member".
+        if self.config.require_fully_specified_algs and cnf_jwk.get("alg") != "Ed25519":
+            logger.info("cnf.jwk alg %r is not fully-specified iss=%s",
+                        cnf_jwk.get("alg"), iss)
+            return None
         try:
             pop_key = load_ed25519_jwk(cnf_jwk)
         except ValueError:
             return None
-        verifier = HTTPMessageVerifier(
+        verifier = _KeyidOptionalVerifier(
             signature_algorithm=ED25519,
             key_resolver=StaticKeyResolver({}, default=pop_key),
             component_resolver_class=DictKeyComponentResolver,
@@ -332,11 +420,15 @@ class HttpsigVerifier:
             return None
 
         return VerifiedSignature(
-            scheme="aauth",
+            scheme=scheme,
             agent=iss,
             keyid=jwk_thumbprint(cnf_jwk),
             trusted=iss in self.config.trusted_agents,
             sub=str(claims.get("sub", "")),
             label=label,
-            claims={k: claims[k] for k in ("iss", "sub", "exp", "ps") if k in claims},
+            claims={
+                k: claims[k]
+                for k in ("iss", "sub", "exp", "ps", "aud", "jti", "mission_s256")
+                if k in claims
+            },
         )

{regent_httpsig-0.1.0.dist-info → regent_httpsig-0.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: regent-httpsig
-Version: 0.1.0
+Version: 0.2.0
 Summary: Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth.
 Project-URL: Homepage, https://github.com/regent-protocol/regent-httpsig
 Project-URL: Repository, https://github.com/regent-protocol/regent-httpsig
@@ -72,6 +72,12 @@ signature yields `None`, and nothing ever raises on untrusted input. Use
 `regent_httpsig.fastapi.RequiredSignatureDep` when a signature must be present — the 401
 tells the agent exactly how to sign.
 
+> **Behind a reverse proxy?** The agent signed the *public* URL
+> (`https://api.example/…`), but your ASGI server sees `http://container/…`. The FastAPI
+> dependency rebuilds the signed URL from `X-Forwarded-Proto` + `Host`, so make sure your
+> proxy forwards the scheme — nginx: `proxy_set_header X-Forwarded-Proto $scheme;`.
+> If signatures mysteriously fail to verify in production, check this first.
+
 ## Sign: get your agent past bot walls
 
 ```python
@@ -101,6 +107,7 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
 | AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
 ¹ The signature bytes printed in the draft's own A.2.2 example do **not** verify over the
@@ -108,6 +115,13 @@ draft's own signature base (the legacy A.2.3 vector and RFC 9421 B.2.6 both do,
 is in the example, not the canonicalization). Ed25519 is deterministic, so our test pins the
 vector re-signed with the same RFC test key over the same byte-exact base — reported upstream.
 
+² Cross-library interop with `aauth-signing`'s jwt scheme: token layer, `cnf.jwk` proof of
+possession and canonicalization all verify. Its signers correctly omit the optional `keyid`
+parameter — which exposed an unconditional `keyid` read in the underlying RFC 9421 library
+that we now handle. One deviation reported upstream to `aauth-signing`: it emits the
+`Signature` byte sequence as base64url, while RFC 8941 requires standard base64. The
+keyid-less shape is pinned in CI.
+
 ## Both dialects, one verifier
 
 - **Web Bot Auth** (`draft-meunier-web-bot-auth-architecture`): key discovery via
@@ -117,6 +131,9 @@ vector re-signed with the same RFC test key over the same byte-exact base — re
 - **AAuth** (`draft-hardt-oauth-aauth-protocol`, identity-based mode): the agent carries a
   JWT `agent_token` in `Signature-Key`; the issuer's JWKS verifies the token, the token's
   `cnf.jwk` verifies the request signature. Install with `pip install 'regent-httpsig[aauth]'`.
+  Tracks the **-11 editor's copy**: fully-specified algorithms (RFC 9864, `Ed25519` — with a
+  transition flag for the -10 ecosystem's `EdDSA`) and **person tokens** (`aa-person+jwt`,
+  opt-in via `HttpsigConfig.resource_url`).
   For a full-protocol AAuth implementation (both roles, all token types) see
   [christian-posta/aauth-python-library](https://github.com/christian-posta/aauth-python-library) —
   this library is the thin relying-party verifier that handles both dialects.

{regent_httpsig-0.1.0.dist-info → regent_httpsig-0.2.0.dist-info}/RECORD

@@ -1,14 +1,14 @@
-regent_httpsig/__init__.py,sha256=UZ-RmE0KLmqjD7JV7LnSOnPTc5FPO-5OtQzvsYq9PAs,987
+regent_httpsig/__init__.py,sha256=9TWY0NncSbLGXq4mosCKEB1SGKHcIPOpYgAyOzPp_7Y,987
 regent_httpsig/cli.py,sha256=WUSLQ2WuEX4E85L2C2EgoUfu5cWpj6MRSG1UVNHpzcw,2005
-regent_httpsig/config.py,sha256=xkILlWugaD8Nn4huAgL6RP-C916KxCYRn0YpqCkMOGc,1422
+regent_httpsig/config.py,sha256=dGWzZtS5DhCr59ecR3scX-JdHD4iZ4XFcioejz2KXDA,1954
 regent_httpsig/fastapi.py,sha256=YmfrKdeMft2vpuiRlivIEHYC4BIs3ioR7T3t1ZEzcJ4,3707
 regent_httpsig/jwk.py,sha256=h4vgnIgpnyKeWdWpm7g_hEyXZOPVREWn-bD4JN07tT0,1637
 regent_httpsig/netguard.py,sha256=Sqg08mdC94RWvnQLJaH4weZW0nN2VlTJF5wVF8VYGHY,2121
 regent_httpsig/sfv.py,sha256=kcQsBLw9h4h_6D3z2rv0-3_gLZQYC47B9VZi-oS_Vgk,4975
 regent_httpsig/sign.py,sha256=B5ChxFxuuKL0i10bGrgFImzyh8GMjWIqNDECXehBWTA,4397
-regent_httpsig/verify.py,sha256=YVcYWqxUBmqSdWrW8nBCSceT7YApAUjO5J-FIMKBRVM,14256
-regent_httpsig-0.1.0.dist-info/METADATA,sha256=4v_RgOudkaT3ui9921kZhM8R5fGfJbLl5e3e1pDBTh0,7871
-regent_httpsig-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-regent_httpsig-0.1.0.dist-info/entry_points.txt,sha256=SgZdmc27V14IAmwOjbBoCYLsbrALaqdTUHNHLbil2dU,59
-regent_httpsig-0.1.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-regent_httpsig-0.1.0.dist-info/RECORD,,
+regent_httpsig/verify.py,sha256=nMSOc1hY29X4SW2g9SD9LwLXt6ladBI7-iUU-1bYpwA,18461
+regent_httpsig-0.2.0.dist-info/METADATA,sha256=76bz3NCU5pNPZfPWg-URUmeFvJjqOd-vIlpM03aFXEU,9129
+regent_httpsig-0.2.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+regent_httpsig-0.2.0.dist-info/entry_points.txt,sha256=SgZdmc27V14IAmwOjbBoCYLsbrALaqdTUHNHLbil2dU,59
+regent_httpsig-0.2.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+regent_httpsig-0.2.0.dist-info/RECORD,,