rp_python_sdk 0.3.0__py3-none-any.whl

rp_python_sdk/filters/participant_filters.py

@@ -0,0 +1,99 @@
+from typing import List
+
+from rp_python_sdk.model import Participant
+from rp_python_sdk.sdk_config import CertificationFilter
+from datetime import datetime, date
+
+
+def remove_out_of_date_certifications(participants: List[Participant], reference_date: date) -> List[Participant]:
+    for participant in participants:
+        for auth_server in participant.authorisation_servers:
+            filtered = [certification for certification in auth_server.authorisation_server_certifications if
+                        to_date(certification.certification_start_date) < reference_date < to_date(certification.certification_expiration_date)]
+            auth_server.authorisation_server_certifications = filtered
+
+    return participants
+
+
+def remove_unofficial_certifications(participants: List[Participant]) -> List[Participant]:
+    for participant in participants:
+        for auth_server in participant.authorisation_servers:
+            filtered = [certification for certification in auth_server.authorisation_server_certifications
+                        if certification.status == "Certified"]
+
+            auth_server.authorisation_server_certifications = filtered
+
+    return participants
+
+
+def remove_inactive_auth_servers(participants: List[Participant]) -> List[Participant]:
+    for participant in participants:
+        filtered = [auth_server for auth_server in participant.authorisation_servers if any(
+            certification.profile_type == "Redirect" and certification.profile_variant == "FAPI2 Adv. OP w/Private Key, PAR"
+            for certification in auth_server.authorisation_server_certifications)]
+
+        participant.authorisation_servers = filtered
+
+    return participants
+
+
+def remove_participants_without_auth_servers(participants: List[Participant]) -> List[Participant]:
+    return [participant for participant in participants if participant.authorisation_servers]
+
+
+def filter_auth_servers_for_supported_claims(participants: List[Participant], claims: List[str]) -> List[Participant]:
+    name_claims = ["name", "given_name", "middle_name", "family_name"]
+    has_name_claims = any(claim in name_claims for claim in claims)
+
+    formatted_claims = ["name"] + [claim for claim in claims if
+                                   claim not in name_claims] if has_name_claims else claims
+
+    for participant in participants:
+        filtered = [auth_server for auth_server in participant.authorisation_servers
+                    if set([certification.profile_variant for certification in
+                            auth_server.authorisation_server_certifications
+                            if certification.profile_type == "ConnectID Claims"]).issuperset(formatted_claims)]
+
+        participant.authorisation_servers = filtered
+
+    return participants
+
+
+def filter_for_required_certifications(participants: List[Participant],
+                                       certifications: List[CertificationFilter]) -> List[Participant]:
+    for certification in certifications:
+        for participant in participants:
+            filtered = [auth_server for auth_server in participant.authorisation_servers if any(
+                server_certification.profile_type == certification.profile_type and server_certification.profile_variant == certification.profile_variant
+                for server_certification in auth_server.authorisation_server_certifications)]
+
+            participant.authorisation_servers = filtered
+
+    return participants
+
+
+def remove_fallback_identity_service_provider(participants: List[Participant]) -> List[Participant]:
+    for participant in participants:
+        filtered = [auth_server for auth_server in participant.authorisation_servers if not any(
+            certification.profile_type == "ConnectID" and certification.profile_variant == "Fallback Identity Service Provider"
+            for certification in auth_server.authorisation_server_certifications)]
+        participant.authorisation_servers = filtered
+
+    return participants
+
+
+def filter_for_fallback_identity_service_providers(participants: List[Participant]) -> List[Participant]:
+    for participant in participants:
+        filtered = [auth_server for auth_server in participant.authorisation_servers if any(
+            certification.profile_type == "ConnectID" and certification.profile_variant == "Fallback Identity Service Provider"
+            for certification in auth_server.authorisation_server_certifications)]
+
+        participant.authorisation_servers = filtered
+
+    return participants
+
+
+def to_date(date_string: str):
+    date_format = "%d/%m/%Y"
+    return datetime.strptime(date_string, date_format).date()
+

rp_python_sdk/model.py

@@ -0,0 +1,137 @@
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+from typing import List
+
+from dataclass_wizard import JSONWizard
+
+
+@dataclass
+class Participant(JSONWizard):
+    organisation_id: str
+    status: str
+    organisation_name: str
+    created_on: str
+    legal_entity_name: str
+    country_of_registration: str
+    company_register: str
+    registration_number: str
+    registration_id: str
+    registered_name: str
+    address_line1: str
+    address_line2: str
+    city: str
+    postcode: str
+    country: str
+    parent_organisation_reference: str
+    authorisation_servers: List['AuthorisationServer']  # Use quotes for forward references
+    org_domain_claims: List['OrgDomainClaim']
+    org_domain_role_claims: List['OrgDomainRoleClaim']
+
+
+@dataclass
+class AuthorisationServerCertification(JSONWizard):
+    certification_start_date: str  # date
+    certification_expiration_date: str  # date
+    certification_id: str
+    authorisation_server_id: str
+    status: str
+    profile_variant: str
+    profile_type: str
+    profile_version: str
+    certification_uri: str
+
+
+@dataclass
+class OrgDomainClaim(JSONWizard):
+    authorisation_domain_name: str
+    authority_name: str
+    registration_id: str
+    status: str
+
+
+@dataclass
+class AuthorisationServer(JSONWizard):
+    authorisation_server_id: str
+    api_resources: List[str]
+    authorisation_server_certifications: List[AuthorisationServerCertification]
+    customer_friendly_description: str
+    customer_friendly_logo_uri: str
+    customer_friendly_name: str
+    developer_portal_uri: str
+    terms_of_service_uri: str
+    open_id_discovery_document: str
+    issuer: str
+    payload_signing_cert_location_uri: str
+    parent_authorisation_server_id: str
+
+
+@dataclass
+class OrgDomainRoleClaim(JSONWizard):
+    status: str
+    authorisation_domain: str
+    role: str
+    registration_id: str
+
+
+@dataclass
+class CallbackBody:
+    code: str
+    iss: str
+    state: str
+
+
+@dataclass
+class PARResponse:
+    auth_url: str
+    code_verifier: str
+    state: str
+    nonce: str
+    x_fapi_interaction_id: str
+
+
+@dataclass
+class TokenSet:
+    token_input: 'TokenInput'
+    claims: Dict[str, Any]
+    x_fapi_interaction_id: str
+
+
+@dataclass
+class TokenInput(JSONWizard):
+    access_token: str
+    scope: str
+    id_token: str
+    token_type: str
+    expires_in: Optional[int] = None
+
+
+@dataclass
+class MtlsEndpointAliases(JSONWizard):
+    token_endpoint: Optional[str] = None
+    pushed_authorization_request_endpoint: Optional[str] = None
+    authorization_endpoint: Optional[str] = None
+    userinfo_endpoint: Optional[str] = None
+
+
+@dataclass
+class IssuerMetadata(JSONWizard):
+    issuer: str
+    jwks_uri: str
+    id_token_signing_alg_values_supported: List[str]
+    token_endpoint: str
+    pushed_authorization_request_endpoint: str
+    authorization_endpoint: str
+    userinfo_endpoint: str
+    mtls_endpoint_aliases: MtlsEndpointAliases
+
+    def get_preferred_token_endpoint(self) -> str:
+        return self.mtls_endpoint_aliases.token_endpoint if self.mtls_endpoint_aliases.token_endpoint else self.token_endpoint
+
+    def get_preferred_pushed_authorization_request_endpoint(self) -> str:
+        return self.mtls_endpoint_aliases.pushed_authorization_request_endpoint if self.mtls_endpoint_aliases.pushed_authorization_request_endpoint else self.pushed_authorization_request_endpoint
+
+    def get_preferred_authorization_endpoint(self) -> str:
+        return self.mtls_endpoint_aliases.authorization_endpoint if self.mtls_endpoint_aliases.authorization_endpoint else self.authorization_endpoint
+
+    def get_preferred_userinfo_endpoint(self) -> str:
+        return self.mtls_endpoint_aliases.userinfo_endpoint if self.mtls_endpoint_aliases.userinfo_endpoint else self.userinfo_endpoint

rp_python_sdk/relying_party_client_sdk.py

@@ -0,0 +1,40 @@
+from rp_python_sdk.endpoints.get_participants import get_participants, \
+    retrieve_fallback_provider_participants
+from rp_python_sdk.endpoints.pushed_authorisation_request import send_pushed_authorisation_request
+from rp_python_sdk.endpoints.retrieve_tokens import retrieve_tokens
+
+from rp_python_sdk.model import Participant, PARResponse, CallbackBody, TokenSet
+from rp_python_sdk.sdk_config import SdkConfig
+from rp_python_sdk.setup_logger import logger
+
+
+class RelyingPartyClientSdk:
+
+    def __init__(self, config: SdkConfig):
+        self.config = config
+
+        if config.custom_config.enable_auto_compliance_verification:
+            logger.info(f"Auto Compliance Verification mode enabled, printing config information: {self.config}")
+
+    def get_participants(self) -> list[Participant]:
+        return get_participants(self.config)
+
+    def get_fallback_provider_participants(self) -> list[Participant]:
+        return retrieve_fallback_provider_participants(self.config)
+
+    def send_pushed_authorisation_request(self, authorisation_server_id: str,
+                                          essential_claims: set[str] | None = None,
+                                          voluntary_claims: set[str] | None = None,
+                                          purpose: str | None = None) -> PARResponse:
+        # Converting the claims to a set just in case a non-set (e.g. list) was passed in.
+        checked_essential_claims = set(essential_claims) if essential_claims else set()
+        checked_voluntary_claims = set(voluntary_claims) if voluntary_claims else set()
+        checked_purpose = purpose if purpose else self.config.custom_config.purpose
+
+        return send_pushed_authorisation_request(self.config, authorisation_server_id, checked_essential_claims,
+                                                 checked_voluntary_claims, checked_purpose)
+
+    def retrieve_tokens(self, authorisation_server_id: str, callback_body: CallbackBody, original_code_verifier: str,
+                        original_state: str, nonce: str) -> TokenSet:
+        return retrieve_tokens(self.config, authorisation_server_id, callback_body, original_code_verifier,
+                               original_state, nonce)

rp_python_sdk/relying_party_client_sdk_exception.py

@@ -0,0 +1,2 @@
+class RelyingPartyClientSdkException(Exception):
+    pass

rp_python_sdk/sdk_config.py

@@ -0,0 +1,72 @@
+from dataclasses import dataclass, field
+from typing import Any, List
+from urllib.parse import urlparse
+
+from rp_python_sdk.setup_logger import logger
+
+
+def assert_not_blank(value: str, parameter_name: str) -> None:
+    if not value.strip():
+        raise ValueError(f"{parameter_name} can't be blank")
+
+
+def assert_not_null(value: Any, parameter_name: str) -> None:
+    if value is None:
+        raise ValueError(f"{parameter_name} can't be null")
+
+
+@dataclass
+class CustomConfig:
+    enable_auto_compliance_verification: bool = False
+    purpose: str = "verifying your identity"
+    include_uncertified_participants: bool = False
+    required_claims: List[str] = field(default_factory=list)
+    required_participant_certifications: List['CertificationFilter'] = field(default_factory=list)
+    timeout_in_seconds: int = 10
+
+    def __post_init__(self) -> None:
+        if self.include_uncertified_participants:
+            logger.info("Identity provider list will not be filtered as includeUncertifiedParticipants=true")
+        else:
+            if self.required_claims:
+                logger.info(
+                    f"Identity provider list will be filtered for participants that support the following claims: {self.required_claims}")
+            if self.required_participant_certifications:
+                logger.info(
+                    f"Identity provider list will be filtered for participants that support the following certifications: {self.required_participant_certifications}")
+
+
+@dataclass
+class SdkConfig:
+    signing_kid: str
+    transport_key: str
+    transport_pem: str
+    signing_key: str
+    signing_pem: str
+    ca_pem: str
+    application_redirect_uri: str
+    registry_participants_uri: str
+    client_id: str
+    custom_config: CustomConfig  # TODO: fix this = field(default_factory=lambda: CustomConfig())
+
+    def __post_init__(self) -> None:
+        assert_not_blank(self.signing_kid, "Signing kid")
+        assert_not_blank(self.transport_key, "Transport key")
+        assert_not_blank(self.transport_pem, "Transport pem")
+        assert_not_blank(self.signing_key, "Signing key")
+        assert_not_blank(self.signing_pem, "Signing pem")
+        assert_not_blank(self.ca_pem, "CA pem")
+
+        # For URI validation, we're using urlparse
+        for uri_attr in ['application_redirect_uri', 'registry_participants_uri', 'client_id']:
+            uri_value = getattr(self, uri_attr)
+            assert_not_null(urlparse(uri_value).scheme, uri_attr)  # Simple check to ensure it's a valid URI
+
+
+@dataclass
+class CertificationFilter:
+    profile_variant: str
+    profile_type: str
+
+    def __str__(self) -> str:
+        return f"CertificationFilter{{profileVariant='{self.profile_variant}', profileType='{self.profile_type}'}}"

rp_python_sdk/setup_logger.py

@@ -0,0 +1,12 @@
+import logging
+import sys
+
+logging.basicConfig(level=logging.DEBUG)
+logger = logging.getLogger('relying_party_client_sdk')
+
+handler = logging.StreamHandler(sys.stdout)
+handler.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+handler.setFormatter(formatter)
+
+logger.addHandler(handler)

rp_python_sdk-0.3.0.dist-info/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 markgreene74
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.