rp_python_sdk 0.11.0__tar.gz → 1.1.1__tar.gz

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.3
 Name: rp_python_sdk
-Version: 0.11.0
+Version: 1.1.1
 Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
 License: Proprietary
 Author: Erik Pragt
@@ -10,10 +10,10 @@ Classifier: License :: Other/Proprietary License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: authlib (>=1.3.2,<2.0.0)
+Requires-Dist: authlib (>=1.6.0,<2.0.0)
 Requires-Dist: cffi (>=1.17.1,<2.0.0)
-Requires-Dist: cryptography (>=43.0.1,<44.0.0)
-Requires-Dist: joserfc (>=1.0.0,<2.0.0)
+Requires-Dist: cryptography (>=45.0.0,<46.0.0)
+Requires-Dist: joserfc (>=1.1.0,<2.0.0)
 Requires-Dist: requests (>=2.32.3,<3.0.0)
 Description-Content-Type: text/markdown
 
@@ -85,6 +85,11 @@ eval "$(pyenv virtualenv-init -)"
 
 ## running tests
 
+Set RP_SAMPLE_APP_TOKEN environment variable. The value can be obtained from the [ConnectID Docs Portal](https://docs.connectid.com.au/docs/relying-parties/getting-started/).
+```shell
+export RP_SAMPLE_APP_TOKEN=<your token>
+```
+
 To run all the test, you can execute the following:
 
 ```bash
@@ -426,6 +431,13 @@ poetry publish
 
 ## Release Notes
 
+### 1.1.1 (Jul 7, 2025)
+- Bugfix release to support manual providers
+- Updated dependencies
+
+### 1.1.0 (Mar 14, 2025)
+- Implement user agent logging.
+
 ### 0.11.0 (Nov 29, 2024)
 - Update to use Authorisation Server issuer attribute as `aud` value when retrieving tokens.
 

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/README.md

@@ -66,6 +66,11 @@ eval "$(pyenv virtualenv-init -)"
 
 ## running tests
 
+Set RP_SAMPLE_APP_TOKEN environment variable. The value can be obtained from the [ConnectID Docs Portal](https://docs.connectid.com.au/docs/relying-parties/getting-started/).
+```shell
+export RP_SAMPLE_APP_TOKEN=<your token>
+```
+
 To run all the test, you can execute the following:
 
 ```bash
@@ -407,6 +412,13 @@ poetry publish
 
 ## Release Notes
 
+### 1.1.1 (Jul 7, 2025)
+- Bugfix release to support manual providers
+- Updated dependencies
+
+### 1.1.0 (Mar 14, 2025)
+- Implement user agent logging.
+
 ### 0.11.0 (Nov 29, 2024)
 - Update to use Authorisation Server issuer attribute as `aud` value when retrieving tokens.
 

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "0.11.0"
+version = "1.1.1"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -9,22 +9,23 @@ readme = "README.md"
 [tool.poetry.dependencies]
 python = "^3.12"
 requests = "^2.32.3"
-authlib = "^1.3.2"
-cryptography = "^43.0.1"
-joserfc = "^1.0.0"
+authlib = "^1.6.0"
+cryptography = "^45.0.0"
+joserfc = "^1.1.0"
 cffi = "^1.17.1"
 
 [tool.poetry.group.test.dependencies]
-pytest = "^8.3.3"
-httpx = "^0.27.2"
+pytest = "^8.4.1"
+httpx = "^0.28.1"
+toml = "^0.10.2"
 
 [tool.poetry.group.dev.dependencies]
-black = "^24.10.0"
-pre-commit = "^3.8.0"
-mypy = "^1.13.0"
+black = "^25.0.0"
+pre-commit = "^4.2.0"
+mypy = "^1.16.1"
 requests-mock = "^1.12.1"
 freezegun = "^1.4.0"
-flake8 = "^7.1.1"
+flake8 = "^7.3.0"
 
 [build-system]
 requires = ["poetry-core"]

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/get_participants.py

@@ -1,9 +1,10 @@
+import json
 from datetime import date
 
 import requests
-import json
 
 from rp_python_sdk.endpoints.util.mapping import from_dict
+from rp_python_sdk.endpoints.util.user_agent import build_user_agent
 from rp_python_sdk.filters.participant_filters import remove_out_of_date_certifications, \
     remove_unofficial_certifications, filter_for_fallback_identity_service_providers, \
     remove_participants_without_auth_servers, remove_fallback_identity_service_provider, \
@@ -62,7 +63,10 @@ def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
     logger.info(f"Retrieving all identity providers from {config.registry_participants_uri}")
 
     response = requests.get(config.registry_participants_uri,
-                            timeout=config.custom_config.timeout_in_seconds)
+                            timeout=config.custom_config.timeout_in_seconds,
+                            headers={
+                                'User-Agent': build_user_agent(config.client_id)
+                            })
     if response.status_code != 200:
         raise RelyingPartyClientSdkException(
             f"Call to identity provider endpoint failed with code: {response.status_code}")
@@ -75,17 +79,29 @@ def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
 
 
 def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) -> AuthorisationServer:
-    result = None
-    for participant in get_participants(config):
-        for server in participant.authorisation_servers:
-            if str(server.authorisation_server_id) == authorisation_server_id:
-                result = server
-                break
+    def find_auth_server_by_id(participants: list[Participant], target_id: str) -> AuthorisationServer | None:
+        for participant in participants:
+            for server in participant.authorisation_servers:
+                if str(server.authorisation_server_id) == target_id:
+                    return server
+        return None
+
+    # Search in main participants
+    result = find_auth_server_by_id(get_participants(config), authorisation_server_id)
+
+    # If not found, check fallback provider participants
+    if result is None:
+        fallback_participants = retrieve_fallback_provider_participants(config)
+        result = find_auth_server_by_id(fallback_participants, authorisation_server_id)
+
+    if result is None:
+        raise RelyingPartyClientSdkException(
+            f"No authorisation server with id: {authorisation_server_id} was found")
 
     return result
 
 
-def get_issuer_metadata(authorisation_server: AuthorisationServer):
+def get_issuer_metadata(authorisation_server: AuthorisationServer) -> IssuerMetadata:
     auth_server_issuer = authorisation_server.open_i_d_discovery_document
 
     try:

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/pushed_authorisation_request.py

@@ -1,6 +1,7 @@
 import json
 import time
 import uuid
+from typing import Any
 from urllib.parse import quote
 
 import requests
@@ -125,7 +126,7 @@ def send_pushed_authorisation_request(config: SdkConfig,
                        code_verifier, state, nonce, x_fapi_interaction_id)
 
 
-def _check_valid_purpose(purpose) -> None:
+def _check_valid_purpose(purpose: str) -> None:
     if len(purpose) < 3 or len(purpose) > 300:
         raise RelyingPartyClientSdkException("Purpose must be between 3 and 300 characters")
 
@@ -149,7 +150,7 @@ def _ensure_mandatory_claims_present(essential_claims: set[str], voluntary_claim
     return result_claims
 
 
-def _generate_claims_request(essential_claims: set[str], voluntary_claims: set[str]):
+def _generate_claims_request(essential_claims: set[str], voluntary_claims: set[str]) -> dict[str, Any]:
     # Filter out any claims that are in both essential and voluntary sets so essential takes precedence
     deduplicated_voluntary_claims = voluntary_claims - essential_claims
 
@@ -179,7 +180,7 @@ def _generate_claims_request(essential_claims: set[str], voluntary_claims: set[s
     return {"id_token": id_token_claims}
 
 
-def _partition_claims(claims: set[str]):
+def _partition_claims(claims: set[str]) -> dict[bool, set[str]]:
     """
     Partition claims into basic and extended types based on a criteria (here, whether they are in extended_claims).
     """
@@ -189,7 +190,7 @@ def _partition_claims(claims: set[str]):
     return partitioned
 
 
-def _map_claims(claims, claim_map):
+def _map_claims(claims: set[str], claim_map: dict[str, Any]) -> dict[str, Any]:
     """
     Map each claim to the provided claim_map.
     """

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/retrieve_tokens.py

@@ -5,12 +5,12 @@ import uuid
 from typing import Tuple, Any
 
 import requests
-from joserfc import jws
-from joserfc.jwk import RSAKey
-from joserfc.jws import JWSRegistry
 from authlib.jose import JsonWebToken
 from authlib.jose.errors import BadSignatureError, DecodeError
 from authlib.jose.util import extract_header
+from joserfc import jws
+from joserfc.jwk import RSAKey
+from joserfc.jws import JWSRegistry
 
 from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
     get_auth_server_details
@@ -72,7 +72,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
 
     key = RSAKey.import_key(config.signing_key)
     header = {'alg': 'PS256', 'kid': config.signing_kid}
-    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload), key, registry = registry)
+    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload), key, registry=registry)
 
     # Data payload
     data = {
@@ -107,7 +107,8 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
     jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id)
     allowed_algs = issuer_metadata.id_token_signing_alg_values_supported
 
-    header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body, issuer_metadata.issuer)
+    header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body,
+                                issuer_metadata.issuer)
 
     token_set = TokenSet(token_input, payload, x_fapi_interaction_id)
 
@@ -197,9 +198,11 @@ def _validate_payload(json_payload: dict[str, Any], nonce: str, callback_body: C
         if json_payload['aud'] != client_id:
             raise RelyingPartyClientSdkException('aud claim in token response does not match client ID')
 
-def _get_unverified_header(id_token:str) -> Any:
+
+def _get_unverified_header(id_token: str) -> Any:
     return extract_header(id_token.split('.')[0].encode(), DecodeError)
 
+
 def _decode_base64(base64_str: str) -> str:
     """
     Decode a Base64 encoded string.
@@ -223,12 +226,14 @@ def _validate_header(json_header: dict, allowed_algs: list) -> None:
             f"alg value in id token header is not one of the supported algorithms listed on the well-known. "
             f"Provided alg {json_header['alg']}")
 
+
 def _find_key_in_jwks(kid: str, token_alg: str, jwks: dict) -> Any:
     for key_element in jwks.get('keys', []):
         if _matching_kid(kid, key_element) and _matching_alg(token_alg, key_element) and _matching_use(key_element):
             return key_element
     return None
 
+
 def _validate_signature(issuer: str, audience: str, allowed_alg: list, id_token: str, jwks: dict) -> None:
     try:
         # Pub key extraction
@@ -257,14 +262,18 @@ def _validate_signature(issuer: str, audience: str, allowed_alg: list, id_token:
         logger.debug(f"Invalid JWT token: {id_token}")
         raise RelyingPartyClientSdkException(f"Invalid JWT signature: {e}")
 
+
 def _matching_use(key_element: dict) -> bool:
     return key_element.get('use') == "sig"
 
+
 def _matching_kid(kid: str, key_element: dict) -> bool:
     return key_element.get('kid') == kid
 
+
 def _matching_alg(token_alg: str, key_element: dict) -> bool:
-    return  key_element.get("alg") is None or key_element.get("alg") == token_alg
+    return key_element.get("alg") is None or key_element.get("alg") == token_alg
+
 
 def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str) -> Any:
     headers = {
@@ -279,4 +288,4 @@ def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str)
             f"Response code for JWKS to {issuer_metadata.jwks_uri} not successful, was: {response.status_code}, "
             f"x-fapi-interaction-id: {x_fapi_interaction_id}, response body: {response.text}")
 
-    return response.json()
+    return response.json()

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/user_info.py

@@ -40,5 +40,5 @@ def call_user_info(config: SdkConfig, authorisation_server_id: str, access_token
             f"Failed to read body from response while connecting to {user_info_endpoint}") from e
 
 
-def _is_success(response: requests.Response):
+def _is_success(response: requests.Response) -> bool:
     return 200 <= response.status_code < 300

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/util/fapi.py

@@ -6,25 +6,24 @@ from rp_python_sdk.model import AuthorisationServer
 from rp_python_sdk.setup_logger import logger
 
 
-def create_x_fapi_interaction_id():
+def create_x_fapi_interaction_id() -> str:
     return str(uuid.uuid4())
 
 
 def log_x_fapi_interaction_id_matches(authorisation_server: AuthorisationServer, request_name: str,
-                                      x_fapi_interaction_id: str, response: Response):
+                                      x_fapi_interaction_id: str, response: Response) -> None:
     fapi_header = response.headers.get('x-fapi-interaction-id')
     if not fapi_header:
         logger.warning(
             f"No x-fapi-interaction-id header returned from auth server {authorisation_server.authorisation_server_id} "
             f"on request {request_name}, expected {x_fapi_interaction_id}")
         return
-
-    if x_fapi_interaction_id == fapi_header:
+    elif x_fapi_interaction_id == fapi_header:
         logger.debug(
             f"x-fapi-interaction-id correctly returned from auth server {authorisation_server.authorisation_server_id} "
             f"on {request_name} matched expected {x_fapi_interaction_id}")
         return
-
-    logger.warning(
-        f"x-fapi-interaction-id returned from auth server {authorisation_server.authorisation_server_id} "
-        f"on {request_name} did not match. sent {x_fapi_interaction_id}, returned {fapi_header}")
+    else:
+        logger.warning(
+            f"x-fapi-interaction-id returned from auth server {authorisation_server.authorisation_server_id} "
+            f"on {request_name} did not match. sent {x_fapi_interaction_id}, returned {fapi_header}")

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/endpoints/util/mapping.py

@@ -11,7 +11,7 @@ def snake_to_pascal(name: str) -> str:
     return ''.join(word.capitalize() for word in name.split('_'))
 
 
-def from_dict(data_class: Type[T], data: Union[dict, list], pascal_case=False) -> Union[T, List[T]]:
+def from_dict(data_class: Type[T], data: Union[dict, list], pascal_case: bool = False) -> Union[T, List[T]]:
     """
     Recursively maps a dictionary or a list of dictionaries to a dataclass or a list of dataclasses.
     Handles key transformations from snake_case to PascalCase, and resolves forward references.

rp_python_sdk-1.1.1/rp_python_sdk/endpoints/util/system_info.py

@@ -0,0 +1,24 @@
+import platform
+
+
+def get_system_info() -> str:
+    os_name = platform.system()  # e.g., "Darwin", "Windows", "Linux"
+    os_version = platform.version()  # e.g., "19.6.0", "10.0.19043", "5.15.0-84-generic"
+    python_version = platform.python_version()  # Python version
+
+    return f"{detect_operating_system(os_name)}; {os_name} {os_version}; Python{python_version}"
+
+
+def detect_operating_system(raw_input: str) -> str:
+    if raw_input is None:
+        return "Unknown"
+
+    os_name = raw_input.lower()
+    if "darwin" in os_name:
+        return "Macintosh"
+    elif "win" in os_name:
+        return "Windows"
+    elif "linux" in os_name:
+        return "Linux"
+    else:
+        return "Other"

rp_python_sdk-1.1.1/rp_python_sdk/endpoints/util/user_agent.py

@@ -0,0 +1,8 @@
+from rp_python_sdk.endpoints.util.system_info import get_system_info
+from rp_python_sdk.endpoints.util.version_info import get_version_info
+
+
+def build_user_agent(client_id: str) -> str:
+    version = get_version_info()
+    platform = get_system_info()
+    return f"cid-rp-python-sdk/{version} ({platform}) +{client_id}"

rp_python_sdk-1.1.1/rp_python_sdk/endpoints/util/version_info.py

@@ -0,0 +1,2 @@
+def get_version_info() -> str:
+    return "1.1.1"  # Version number

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/filters/participant_filters.py

@@ -1,15 +1,16 @@
+from datetime import datetime, date
 from typing import List
 
 from rp_python_sdk.model import Participant
 from rp_python_sdk.sdk_config import CertificationFilter
-from datetime import datetime, date
 
 
 def remove_out_of_date_certifications(participants: List[Participant], reference_date: date) -> List[Participant]:
     for participant in participants:
         for auth_server in participant.authorisation_servers:
             filtered = [certification for certification in auth_server.authorisation_server_certifications if
-                        to_date(certification.certification_start_date) < reference_date < to_date(certification.certification_expiration_date)]
+                        to_date(certification.certification_start_date) < reference_date < to_date(
+                            certification.certification_expiration_date)]
             auth_server.authorisation_server_certifications = filtered
 
     return participants
@@ -93,6 +94,6 @@ def filter_for_fallback_identity_service_providers(participants: List[Participan
     return participants
 
 
-def to_date(date_string: str):
+def to_date(date_string: str) -> date:
     date_format = "%d/%m/%Y"
     return datetime.strptime(date_string, date_format).date()

{rp_python_sdk-0.11.0 → rp_python_sdk-1.1.1}/rp_python_sdk/model.py

@@ -2,6 +2,7 @@ from dataclasses import dataclass
 from typing import Any, Dict, Optional
 from typing import List
 
+
 @dataclass
 class Participant:
     organisation_id: str
@@ -45,11 +46,13 @@ class OrgDomainClaim:
     registration_id: str
     status: str
 
+
 @dataclass
 class ApiDiscoveryEndpoint:
     api_discovery_id: str
     api_endpoint: str
 
+
 @dataclass
 class ApiResource:
     api_resource_id: str
@@ -64,6 +67,7 @@ class ApiResource:
     certification_expiration_date: str
     api_family_type: Optional[str]
 
+
 @dataclass
 class AuthorisationServer:
     authorisation_server_id: str