rp_python_sdk 0.3.0__py3-none-any.whl

rp_python_sdk/endpoints/get_participants.py

@@ -0,0 +1,98 @@
+import time
+from datetime import date
+
+import requests
+from rp_python_sdk.filters.participant_filters import remove_out_of_date_certifications, \
+    remove_unofficial_certifications, filter_for_fallback_identity_service_providers, \
+    remove_participants_without_auth_servers, remove_fallback_identity_service_provider, \
+    filter_auth_servers_for_supported_claims, filter_for_required_certifications, remove_inactive_auth_servers
+from rp_python_sdk.model import IssuerMetadata, AuthorisationServer
+from rp_python_sdk.model import Participant
+from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
+from rp_python_sdk.sdk_config import SdkConfig
+from rp_python_sdk.setup_logger import logger
+
+
+def get_participants(config: SdkConfig) -> list[Participant]:
+
+    participants = _retrieve_full_participants_list(config)
+
+    filtered_participants = remove_fallback_identity_service_provider(participants)
+
+    if config.custom_config.include_uncertified_participants:
+        logger.info("Identity provider list has not been filtered as includeUncertifiedParticipants=true")
+        filtered_participants = remove_participants_without_auth_servers(filtered_participants)
+        return filtered_participants
+
+    filtered_participants = remove_out_of_date_certifications(filtered_participants, date.today())
+    filtered_participants = remove_unofficial_certifications(filtered_participants)
+
+    if len(config.custom_config.required_claims) != 0:
+        logger.debug(f"Identity provider list filtered for participants that support the "
+                     f"following claims: {config.custom_config.required_claims}")
+        filtered_participants = filter_auth_servers_for_supported_claims(filtered_participants, config.custom_config.required_claims)
+
+    if len(config.custom_config.required_participant_certifications) != 0:
+        logger.debug(f"Identity provider list filtered for participants that support the "
+                     f"following certifications: {config.custom_config.required_participant_certifications}")
+        filtered_participants = filter_for_required_certifications(filtered_participants, config.custom_config.required_participant_certifications)
+
+    filtered_participants = remove_inactive_auth_servers(filtered_participants)
+    filtered_participants = remove_participants_without_auth_servers(filtered_participants)
+
+    return filtered_participants
+
+def retrieve_fallback_provider_participants(config: SdkConfig) -> list[Participant]:
+    participants = _retrieve_full_participants_list(config)
+
+    filtered_participants = remove_out_of_date_certifications(participants, date.today())
+    filtered_participants = remove_unofficial_certifications(filtered_participants)
+
+    filtered_participants = filter_for_fallback_identity_service_providers(filtered_participants)
+    filtered_participants = remove_participants_without_auth_servers(filtered_participants)
+
+    return filtered_participants
+
+
+def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
+    logger.info(f"Retrieving all identity providers from {config.registry_participants_uri}")
+
+    response = requests.get(config.registry_participants_uri,
+                            timeout=config.custom_config.timeout_in_seconds)
+    if response.status_code != 200:
+        raise RelyingPartyClientSdkException(
+            f"Call to identity provider endpoint failed with code: {response.status_code}")
+
+    participant_list: list[Participant] = Participant.from_json(response.text)
+
+    logger.info(f"Retrieved identity providers, num orgs found: {len(participant_list)}")
+    return participant_list
+
+
+def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) -> AuthorisationServer:
+    result = None
+    for participant in get_participants(config):
+        for server in participant.authorisation_servers:
+            if str(server.authorisation_server_id) == authorisation_server_id:
+                result = server
+                break
+
+    return result
+
+
+def get_issuer_metadata(authorisation_server: AuthorisationServer):
+    auth_server_issuer = authorisation_server.open_id_discovery_document
+
+    try:
+        logger.info(f"Getting discovery document from {auth_server_issuer}")
+        response = requests.get(auth_server_issuer)
+        response.raise_for_status()  # Raises an exception for 4XX or 5XX errors
+
+        return IssuerMetadata.from_json(response.text)
+
+    except requests.exceptions.HTTPError as http_err:
+        raise RelyingPartyClientSdkException(
+            f"Call to identity provider endpoint failed with code: {response.status_code}") from http_err
+    except requests.exceptions.RequestException as req_err:
+        raise RelyingPartyClientSdkException(
+            f"Failed to connect to authorisation service {auth_server_issuer}") from req_err

rp_python_sdk/endpoints/pushed_authorisation_request.py

@@ -0,0 +1,204 @@
+import json
+import time
+import uuid
+from urllib.parse import quote
+
+import requests
+from authlib.common.security import generate_token
+from authlib.jose import JsonWebSignature
+from authlib.oauth2.rfc7636 import create_s256_code_challenge
+
+from rp_python_sdk.endpoints.get_participants import get_auth_server_details, \
+    get_issuer_metadata
+from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id, log_x_fapi_interaction_id_matches
+from rp_python_sdk.model import PARResponse
+from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
+from rp_python_sdk.sdk_config import SdkConfig
+from rp_python_sdk.setup_logger import logger
+
+default_claims = {"name", "given_name", "middle_name", "family_name", "phone_number", "email", "address", "birthdate",
+                  "txn"}
+
+extended_claims = {"over16", "over18", "over21", "over25", "over65", "beneficiary_account_au",
+                   "beneficiary_account_au_payid", "beneficiary_account_international"}
+
+
+def send_pushed_authorisation_request(config: SdkConfig,
+                                      authorisation_server_id: str,
+                                      essential_claims: set[str],
+                                      voluntary_claims: set[str],
+                                      purpose: str) -> PARResponse:
+    if len(essential_claims) == 0:
+        essential_claims = default_claims
+
+    _check_valid_purpose(purpose)
+
+    checked_essential_claims = _ensure_mandatory_claims_present(essential_claims, voluntary_claims)
+    claim_request = _generate_claims_request(checked_essential_claims, voluntary_claims)
+
+    authorisation_server = get_auth_server_details(config, authorisation_server_id)
+    issuer_metadata = get_issuer_metadata(authorisation_server)
+
+    auth_server_url = issuer_metadata.issuer
+    x_fapi_interaction_id = create_x_fapi_interaction_id()
+
+    logger.info(
+        f"Sending PAR to auth server: {authorisation_server_id} - {authorisation_server.customer_friendly_name}, "
+        f"essential claims requested: {checked_essential_claims}, voluntary claims requested: {voluntary_claims}, "
+        f"x-fapi-interaction-id: {x_fapi_interaction_id}, purpose: {purpose}")
+
+    par_endpoint = issuer_metadata.get_preferred_pushed_authorization_request_endpoint()
+    auth_endpoint = issuer_metadata.get_preferred_authorization_endpoint()
+    redirect_uri = config.application_redirect_uri
+    client_id = config.client_id
+
+    current_time_in_seconds = int(time.time())
+
+    iat = current_time_in_seconds
+    exp = current_time_in_seconds + 300
+
+    state = generate_token()
+    nonce = generate_token()
+    scope = "openid"
+    jti = str(uuid.uuid4())
+
+    code_verifier = generate_token(48)
+    code_challenge = create_s256_code_challenge(code_verifier)
+
+    header = {'alg': 'PS256', 'kid': config.signing_kid}
+    request_payload = {
+        'iss': client_id,
+        'aud': auth_server_url,
+        'exp': exp,
+        'nbf': iat,
+        'response_type': 'code',
+        'code_challenge_method': 'S256',
+        'nonce': nonce,
+        'client_id': client_id,
+        'scope': scope,
+        'claims': claim_request,
+        'redirect_uri': redirect_uri,
+        'state': state,
+        'prompt': 'consent',
+        'code_challenge': code_challenge,
+        'purpose': purpose,
+    }
+
+    jws = JsonWebSignature()
+    request_jwt = jws.serialize_compact(header, json.dumps(request_payload), config.signing_key)
+
+    client_assertion_payload = {
+        'sub': client_id,
+        'aud': auth_server_url,
+        'iss': client_id,
+        'exp': exp,
+        'jti': jti,
+        'iat': iat,
+    }
+
+    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload),
+                                                 config.signing_key)
+
+    # Data payload
+    data = {
+        "request": request_jwt.decode("utf-8"),
+        "client_assertion": client_assertion_jwt.decode("utf-8"),
+        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+    }
+
+    # Custom headers
+    headers = {
+        "accept": "application/json",
+        "x-fapi-interaction-id": x_fapi_interaction_id
+    }
+
+    # Making the POST request
+    response = requests.post(par_endpoint, data=data, headers=headers,
+                             cert=(config.transport_pem, config.transport_key),
+                             verify=config.ca_pem)
+
+    log_x_fapi_interaction_id_matches(authorisation_server, "send_pushed_authorisation_request", x_fapi_interaction_id, response)
+
+    request_uri = response.json()['request_uri']
+    logger.debug(f"PAR was sent, request_uri='{request_uri}'")
+
+    return PARResponse(_construct_auth_url(auth_endpoint, client_id, request_uri),
+                       code_verifier, state, nonce, x_fapi_interaction_id)
+
+
+def _check_valid_purpose(purpose) -> None:
+    if len(purpose) < 3 or len(purpose) > 50:
+        raise RelyingPartyClientSdkException("Purpose must be between 3 and 50 characters")
+
+    illegal_chars = ["<", ">", "(", ")", "{", "}", "'", "\\"]
+
+    contains_illegal_char = any(char in purpose for char in illegal_chars)
+    if contains_illegal_char:
+        raise RelyingPartyClientSdkException(
+            f"Purpose cannot contain any of the following characters: {', '.join(illegal_chars)}, purpose supplied: [{purpose}]")
+
+
+def _ensure_mandatory_claims_present(essential_claims: set[str], voluntary_claims: set[str]) -> set[str]:
+    if "txn" in essential_claims or "txn" in voluntary_claims:
+        return essential_claims
+
+    # Create a copy of the essential_claims to avoid modifying the original set
+    result_claims = essential_claims.copy()
+    # Add "txn" to the set
+    result_claims.add("txn")
+    return result_claims
+
+
+def _generate_claims_request(essential_claims: set[str], voluntary_claims: set[str]):
+    # Filter out any claims that are in both essential and voluntary sets so essential takes precedence
+    deduplicated_voluntary_claims = voluntary_claims - essential_claims
+
+    # Create maps for essential and voluntary claims
+    essential = {"essential": True}
+    voluntary = {"essential": False}
+
+    # Partition claims into basic and extended types
+    partitioned_essential_claims = _partition_claims(essential_claims)
+    partitioned_voluntary_claims = _partition_claims(deduplicated_voluntary_claims)
+
+    # Map basic claims to their respective maps
+    id_token_claims = _map_claims(partitioned_essential_claims[False], essential)
+    id_token_claims.update(_map_claims(partitioned_voluntary_claims[False], voluntary))
+
+    # Map extended claims to their respective maps
+    extended_claims = _map_claims(partitioned_essential_claims[True], essential)
+    extended_claims.update(_map_claims(partitioned_voluntary_claims[True], voluntary))
+
+    # Add extended claims to idTokenClaims if any exist
+    if extended_claims:
+        id_token_claims["verified_claims"] = {
+            "verification": {"trust_framework": {"value": "au_connectid"}},
+            "claims": extended_claims
+        }
+
+    return {"id_token": id_token_claims}
+
+
+def _partition_claims(claims: set[str]):
+    """
+    Partition claims into basic and extended types based on a criteria (here, whether they are in extended_claims).
+    """
+    partitioned: dict[bool, set[str]] = {True: set(), False: set()}
+    for claim in claims:
+        partitioned[claim in extended_claims].add(claim)
+    return partitioned
+
+
+def _map_claims(claims, claim_map):
+    """
+    Map each claim to the provided claim_map.
+    """
+    return {claim: claim_map for claim in claims}
+
+
+def _construct_auth_url(auth_endpoint: str, client_id: str, request_uri: str) -> str:
+    return (
+        f"{auth_endpoint}"
+        f"?client_id={quote(client_id)}"
+        f"&request_uri={quote(request_uri)}"
+    )

rp_python_sdk/endpoints/retrieve_tokens.py

@@ -0,0 +1,254 @@
+import base64
+import json
+import time
+import uuid
+from typing import Tuple, Any
+
+import requests
+from authlib.jose import JsonWebSignature
+
+from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
+    get_auth_server_details
+from rp_python_sdk.endpoints.user_info import call_user_info
+from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id, log_x_fapi_interaction_id_matches
+from rp_python_sdk.model import CallbackBody, TokenSet, TokenInput, IssuerMetadata
+from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
+from rp_python_sdk.sdk_config import SdkConfig
+from rp_python_sdk.setup_logger import logger
+
+
+def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_body: CallbackBody,
+                    original_code_verifier: str,
+                    original_state: str, nonce: str) -> TokenSet:
+    authorisation_server = get_auth_server_details(config, authorisation_server_id)
+    issuer_metadata = get_issuer_metadata(authorisation_server)
+
+    if issuer_metadata.issuer != callback_body.iss:
+        raise RelyingPartyClientSdkException(
+            f"Issuer returned from authorization endpoint ({callback_body.iss} does not match issuer defined in authorization server well-known ({issuer_metadata.issuer})")
+
+    x_fapi_interaction_id = create_x_fapi_interaction_id()
+    logger.info(
+        f"Retrieving token response from authorisation server: {authorisation_server_id} - {authorisation_server.customer_friendly_name}, x-fapi-interaction-id: {x_fapi_interaction_id}")
+
+    token_endpoint = issuer_metadata.get_preferred_token_endpoint()
+
+    if callback_body.state != original_state:
+        raise RelyingPartyClientSdkException(
+            f"Callback response state value does not match state, callback state: {callback_body.state}, state {original_state}, x-fapi-interaction-id: {x_fapi_interaction_id}")
+
+    if callback_body.iss != issuer_metadata.issuer:
+        raise RelyingPartyClientSdkException(
+            f"iss mismatch, expected {issuer_metadata.issuer} , got: {callback_body.iss}")
+
+    redirect_uri = config.application_redirect_uri
+    client_id = config.client_id
+    current_time_in_seconds = int(time.time())
+    iat = current_time_in_seconds
+    exp = current_time_in_seconds + 300
+    jti = str(uuid.uuid4())
+
+    client_assertion_payload = {
+        'sub': client_id,
+        'aud': token_endpoint,
+        'iss': client_id,
+        'exp': exp,
+        'jti': jti,
+        'iat': iat,
+    }
+
+    jws = JsonWebSignature()
+    header = {'alg': 'PS256', 'kid': config.signing_kid}
+
+    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload),
+                                                 config.signing_key)
+
+    # Data payload
+    data = {
+        "grant_type": "authorization_code",
+        "code": callback_body.code,
+        "redirect_uri": redirect_uri,
+        "client_assertion": client_assertion_jwt.decode("utf-8"),
+        "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        "code_verifier": original_code_verifier
+    }
+
+    # Custom headers
+    headers = {
+        "accept": "application/json",
+        "x-fapi-interaction-id": x_fapi_interaction_id
+    }
+
+    # Making the POST request
+    response = requests.post(token_endpoint, data=data, headers=headers,
+                             cert=(config.transport_pem, config.transport_key),
+                             verify=config.ca_pem)
+
+    log_x_fapi_interaction_id_matches(authorisation_server, "retrieve_tokens", x_fapi_interaction_id, response)
+
+    token_input = TokenInput.from_json(response.text)
+
+    jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id)
+    allowed_algs = issuer_metadata.id_token_signing_alg_values_supported
+
+    header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body)
+
+    token_set = TokenSet(token_input, payload, x_fapi_interaction_id)
+
+    if config.custom_config.enable_auto_compliance_verification:
+        call_user_info(config, authorisation_server_id, token_set.token_input.access_token)
+
+    logger.info(
+        f"Token response successfully retrieved from authorisation server {authorisation_server_id}, x-fapi-interaction-id: {x_fapi_interaction_id}, txn: {token_set.claims['txn']}")
+
+    return token_set
+
+
+def _validate(token_input: TokenInput, jwks_response_body: dict[str, Any], allowed_algs: list[str],
+              nonce: str, client_id: str,
+              callback_body: CallbackBody) -> Tuple[dict[str, Any], dict[str, Any]]:
+    """
+    Decode and parse an ID token into JSON objects for header and payload.
+
+    :param token_input: A dictionary containing an 'idToken' key, which is a Base64 encoded string
+    :param jwks_response_body
+    :param allowed_algs
+    :param nonce
+    :param client_id
+    :param callback_body
+    :return: two dictionaries for header and payload
+    """
+    id_token = token_input.id_token
+    header_base64 = id_token.split('.')[0]
+    header = _decode_base64(header_base64)
+    header_json = json.loads(header)
+
+    payload_base64 = id_token.split('.')[1]
+    payload = _decode_base64(payload_base64)
+    payload_json = json.loads(payload)
+
+    _validate_header(header_json, jwks_response_body, allowed_algs, id_token)
+    _validate_payload(payload_json, nonce, callback_body, client_id)
+
+    return header_json, payload_json
+
+
+def _validate_payload(json_payload: dict[str, Any], nonce: str, callback_body: CallbackBody,
+                      client_id: str) -> None:
+    if 'nonce' not in json_payload:
+        raise RelyingPartyClientSdkException('nonce claim missing from token response')
+
+    if json_payload['nonce'] != nonce:
+        raise RelyingPartyClientSdkException(
+            f"nonce returned in ID token: {json_payload['nonce']} does not match provided nonce: {nonce}")
+
+    current_time_stamp = int(time.time())
+
+    if 'iss' not in json_payload:
+        raise RelyingPartyClientSdkException('iss claim missing from token response')
+
+    if 'iat' not in json_payload:
+        raise RelyingPartyClientSdkException('iat claim missing from token response')
+
+    if 'aud' not in json_payload:
+        raise RelyingPartyClientSdkException('aud claim missing from token response')
+
+    if 'exp' not in json_payload:
+        raise RelyingPartyClientSdkException('exp claim missing from token response')
+
+    # Check if iat claim is older than 10 minutes ago
+    if json_payload['iat'] < current_time_stamp - 600:
+        raise RelyingPartyClientSdkException('iat claim in token response is too old')
+
+    # Check exp claim is older than current epoch (allowing for 5 minute skew)
+    if json_payload['exp'] < current_time_stamp - 300:
+        raise RelyingPartyClientSdkException('id token expired more than 5 minutes ago')
+
+    # Check the iss claim is valid
+    if json_payload['iss'] != callback_body.iss:
+        raise RelyingPartyClientSdkException(
+            f'iss claim in token response "{json_payload["iss"]}" does not match the expected value of "{callback_body.iss}"')
+
+    # Extract aud claim from either list or string
+    if isinstance(json_payload['aud'], list):
+        for aud_element in json_payload['aud']:
+            if aud_element != client_id:
+                raise RelyingPartyClientSdkException(
+                    'one of the aud claim elements in token response does not match client ID')
+    else:
+        if json_payload['aud'] != client_id:
+            raise RelyingPartyClientSdkException('aud claim in token response does not match client ID')
+
+
+def _decode_base64(base64_str: str) -> str:
+    """
+    Decode a Base64 encoded string.
+    :param base64_str: Base64 encoded string
+    :return: decoded string
+    """
+    decoded_bytes = base64.b64decode(base64_str + '==')
+    return decoded_bytes.decode('utf-8')
+
+
+def _validate_header(json_header, jwks, allowed_algs, id_token: str) -> None:
+    if 'alg' not in json_header or json_header['alg'] == 'none':
+        raise RelyingPartyClientSdkException("no alg value in the token response jwt header")
+
+    if 'kid' not in json_header:
+        raise RelyingPartyClientSdkException("no kid value in the token response jwt header")
+
+    kid = json_header['kid']
+    jwk = None
+
+    for key_element in jwks.get('keys', []):
+        if _matching_kid(kid, key_element) and _none_or_matching_alg(json_header, key_element):
+            jwk = key_element
+            break
+
+    if jwk is None:
+        raise RelyingPartyClientSdkException(
+            f"kid provided does not match any key in the jwks for specified algorithm in token header: {json_header['alg']}")
+
+    found_alg = any(alg.lower() == json_header['alg'].lower() for alg in allowed_algs)
+    if not found_alg:
+        raise RelyingPartyClientSdkException(
+            "alg value in id token header is not one of the supported algorithms listed on the well-known")
+
+    # try:
+    #     validate_signature(token_input.get('id_token'), jwk)
+    # except (JOSEError, ValueError) as e:
+    #     raise RelyingPartyClientSdkException(f"exception while validation jwt signature: {e}")
+
+
+def _validate_signature(self, id_token, jwk):
+    # Implement JWT signature validation based on the jwk provided and the library you're using
+    pass
+
+
+def _matching_kid(kid: str, key_element) -> bool:
+    # Implement this to match the 'kid' from the JWT with one from the JWKS
+    return key_element.get('kid') == kid
+
+
+def _none_or_matching_alg(json_header, key_element) -> bool:
+    # Implement this to check if the 'alg' in JWT matches the one in the key element, if required
+    return True
+
+
+def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str) -> Any:
+    headers = {
+        "Accept": "application/json",
+        "x-fapi-interaction-id": x_fapi_interaction_id
+    }
+    response = requests.get(issuer_metadata.jwks_uri, headers=headers)
+    response.raise_for_status()
+
+    if not _is_success(response):
+        raise RelyingPartyClientSdkException(
+            f"Response code for JWKS to {issuer_metadata.jwks_uri} not successful, was: {response.status_code}, x-fapi-interaction-id: {x_fapi_interaction_id}, response body: {response.text}")
+
+    return response.json()
+
+
+def _is_success(response: requests.Response):
+    return 200 <= response.status_code < 300

rp_python_sdk/endpoints/user_info.py

@@ -0,0 +1,44 @@
+from typing import Any
+
+import requests
+
+from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
+    get_auth_server_details
+from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id
+from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
+from rp_python_sdk.sdk_config import SdkConfig
+from rp_python_sdk.setup_logger import logger
+
+
+def call_user_info(config: SdkConfig, authorisation_server_id: str, access_token: str) -> dict[str, Any]:
+    x_fapi_interaction_id = create_x_fapi_interaction_id()
+    logger.info(f"Making call to user info endpoint, x-fapi-interaction-id: {x_fapi_interaction_id}")
+
+    authorisation_server = get_auth_server_details(config, authorisation_server_id)
+    issuer_metadata = get_issuer_metadata(authorisation_server)
+
+    user_info_endpoint = issuer_metadata.get_preferred_userinfo_endpoint()
+
+    headers = {
+        "Authorization": f"Bearer {access_token}",
+        "x-fapi-interaction-id": x_fapi_interaction_id
+    }
+
+    try:
+        response = requests.get(user_info_endpoint, headers=headers,
+                                cert=(config.transport_pem, config.transport_key),
+                                verify=config.ca_pem)
+
+        if not _is_success(response):
+            raise RelyingPartyClientSdkException(
+                f"Call to user info endpoint failed with code: {response.status_code}")
+
+        return response.json()
+
+    except requests.exceptions.RequestException as e:
+        raise RelyingPartyClientSdkException(
+            f"Failed to read body from response while connecting to {user_info_endpoint}") from e
+
+
+def _is_success(response: requests.Response):
+    return 200 <= response.status_code < 300

rp_python_sdk/endpoints/util/fapi.py

@@ -0,0 +1,30 @@
+import uuid
+
+from requests.models import Response
+
+from rp_python_sdk.model import AuthorisationServer
+from rp_python_sdk.setup_logger import logger
+
+
+def create_x_fapi_interaction_id():
+    return str(uuid.uuid4())
+
+
+def log_x_fapi_interaction_id_matches(authorisation_server: AuthorisationServer, request_name: str,
+                                      x_fapi_interaction_id: str, response: Response):
+    fapi_header = response.headers.get('x-fapi-interaction-id')
+    if not fapi_header:
+        logger.warning(
+            f"No x-fapi-interaction-id header returned from auth server {authorisation_server.authorisation_server_id} "
+            f"on request {request_name}, expected {x_fapi_interaction_id}")
+        return
+
+    if x_fapi_interaction_id == fapi_header:
+        logger.debug(
+            f"x-fapi-interaction-id correctly returned from auth server {authorisation_server.authorisation_server_id} "
+            f"on {request_name} matched expected {x_fapi_interaction_id}")
+        return
+
+    logger.warning(
+        f"x-fapi-interaction-id returned from auth server {authorisation_server.authorisation_server_id} "
+        f"on {request_name} did not match. sent {x_fapi_interaction_id}, returned {fapi_header}")