rp_python_sdk 0.7.0__tar.gz → 0.9.0__tar.gz

rp_python_sdk-0.7.0/README.md → rp_python_sdk-0.9.0/PKG-INFO

@@ -1,3 +1,22 @@
+Metadata-Version: 2.1
+Name: rp_python_sdk
+Version: 0.9.0
+Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
+License: Proprietary
+Author: Erik Pragt
+Author-email: erik.pragt@connectid.com.au
+Requires-Python: >=3.12,<4.0
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Dist: authlib (>=1.3.2,<2.0.0)
+Requires-Dist: cffi (>=1.17.1,<2.0.0)
+Requires-Dist: cryptography (>=43.0.1,<44.0.0)
+Requires-Dist: joserfc (>=1.0.0,<2.0.0)
+Requires-Dist: requests (>=2.32.3,<3.0.0)
+Description-Content-Type: text/markdown
+
 # Python SDK for Relying Parties
 
 [![Build Python SDK](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml/badge.svg)](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml)
@@ -407,6 +426,29 @@ poetry publish
 
 ## Release Notes
 
+### 0.9.0 (Oct 18, 2024)
+- Added support for Python 3.13
+- Added support for `payment` ApiResources
+- Updated all dependencies
+
+### 0.8.0 (Sep 3, 2024)
+- Breaking change: When `essential_claims` was empty it used the `default_claims` list. That logic has been removed.
+
+```python
+def send_pushed_authorisation_request(config: SdkConfig,
+                                      authorisation_server_id: str,
+                                      essential_claims: set[str],
+                                      voluntary_claims: set[str],
+                                      purpose: str) -> PARResponse:
+    # this has been removed
+    if len(essential_claims) == 0:
+        essential_claims = default_claims
+    ...
+```
+
+### 0.7.1 (June 28, 2024)
+- Made `scope` field optional in accordance with rfc-6749.
+
 ### 0.7.0 (June 14, 2024)
 - Changed purpose field to allow 3 to 300 characters (up from 50)
 
@@ -426,4 +468,5 @@ poetry publish
 - Implemented all endpoints
 
 ### 0.1.0 (March 27, 2024)
-- Initial version
+- Initial version
+

rp_python_sdk-0.7.0/PKG-INFO → rp_python_sdk-0.9.0/README.md

@@ -1,19 +1,3 @@
-Metadata-Version: 2.1
-Name: rp_python_sdk
-Version: 0.7.0
-Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
-License: Proprietary
-Author: Erik Pragt
-Author-email: erik.pragt@connectid.com.au
-Requires-Python: >=3.12,<4.0
-Classifier: License :: Other/Proprietary License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.12
-Requires-Dist: authlib (>=1.3.0,<2.0.0)
-Requires-Dist: dataclass-wizard (>=0.22.3,<0.23.0)
-Requires-Dist: requests (>=2.31.0,<3.0.0)
-Description-Content-Type: text/markdown
-
 # Python SDK for Relying Parties
 
 [![Build Python SDK](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml/badge.svg)](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml)
@@ -423,6 +407,29 @@ poetry publish
 
 ## Release Notes
 
+### 0.9.0 (Oct 18, 2024)
+- Added support for Python 3.13
+- Added support for `payment` ApiResources
+- Updated all dependencies
+
+### 0.8.0 (Sep 3, 2024)
+- Breaking change: When `essential_claims` was empty it used the `default_claims` list. That logic has been removed.
+
+```python
+def send_pushed_authorisation_request(config: SdkConfig,
+                                      authorisation_server_id: str,
+                                      essential_claims: set[str],
+                                      voluntary_claims: set[str],
+                                      purpose: str) -> PARResponse:
+    # this has been removed
+    if len(essential_claims) == 0:
+        essential_claims = default_claims
+    ...
+```
+
+### 0.7.1 (June 28, 2024)
+- Made `scope` field optional in accordance with rfc-6749.
+
 ### 0.7.0 (June 14, 2024)
 - Changed purpose field to allow 3 to 300 characters (up from 50)
 

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "0.7.0"
+version = "0.9.0"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -8,20 +8,23 @@ readme = "README.md"
 
 [tool.poetry.dependencies]
 python = "^3.12"
-dataclass-wizard = "^0.22.3"
-requests = "^2.31.0"
-authlib = "^1.3.0"
+requests = "^2.32.3"
+authlib = "^1.3.2"
+cryptography = "^43.0.1"
+joserfc = "^1.0.0"
+cffi = "^1.17.1"
 
 [tool.poetry.group.test.dependencies]
-pytest = "^8.0.0"
-httpx = "^0.27.0"
+pytest = "^8.3.3"
+httpx = "^0.27.2"
 
 [tool.poetry.group.dev.dependencies]
-black = "^24.3.0"
-pre-commit = "^3.5.0"
-mypy = "^1.9.0"
+black = "^24.10.0"
+pre-commit = "^3.8.0"
+mypy = "^1.11.2"
 requests-mock = "^1.12.1"
 freezegun = "^1.4.0"
+flake8 = "^7.1.1"
 
 [build-system]
 requires = ["poetry-core"]

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/endpoints/get_participants.py

@@ -1,7 +1,9 @@
 from datetime import date
 
 import requests
+import json
 
+from rp_python_sdk.endpoints.util.mapping import from_dict
 from rp_python_sdk.filters.participant_filters import remove_out_of_date_certifications, \
     remove_unofficial_certifications, filter_for_fallback_identity_service_providers, \
     remove_participants_without_auth_servers, remove_fallback_identity_service_provider, \
@@ -65,7 +67,8 @@ def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
         raise RelyingPartyClientSdkException(
             f"Call to identity provider endpoint failed with code: {response.status_code}")
 
-    participant_list: list[Participant] = Participant.from_json(response.text)
+    # participant_list: list[Participant] = Participant.from_json(response.text)
+    participant_list: list[Participant] = from_dict(Participant, json.loads(response.text), pascal_case=True)
 
     logger.info(f"Retrieved identity providers, num orgs found: {len(participant_list)}")
     return participant_list
@@ -83,14 +86,14 @@ def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) ->
 
 
 def get_issuer_metadata(authorisation_server: AuthorisationServer):
-    auth_server_issuer = authorisation_server.open_id_discovery_document
+    auth_server_issuer = authorisation_server.open_i_d_discovery_document
 
     try:
         logger.info(f"Getting discovery document from {auth_server_issuer}")
         response = requests.get(auth_server_issuer)
         response.raise_for_status()  # Raises an exception for 4XX or 5XX errors
 
-        return IssuerMetadata.from_json(response.text)
+        return from_dict(IssuerMetadata, json.loads(response.text))
 
     except requests.exceptions.HTTPError as http_err:
         raise RelyingPartyClientSdkException(

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/endpoints/pushed_authorisation_request.py

@@ -16,9 +16,6 @@ from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientS
 from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
 
-default_claims = {"name", "given_name", "middle_name", "family_name", "phone_number", "email", "address", "birthdate",
-                  "txn"}
-
 extended_claims = {"over16", "over18", "over21", "over25", "over65", "beneficiary_account_au",
                    "beneficiary_account_au_payid", "beneficiary_account_international"}
 
@@ -28,9 +25,6 @@ def send_pushed_authorisation_request(config: SdkConfig,
                                       essential_claims: set[str],
                                       voluntary_claims: set[str],
                                       purpose: str) -> PARResponse:
-    if len(essential_claims) == 0:
-        essential_claims = default_claims
-
     _check_valid_purpose(purpose)
 
     checked_essential_claims = _ensure_mandatory_claims_present(essential_claims, voluntary_claims)
@@ -117,10 +111,12 @@ def send_pushed_authorisation_request(config: SdkConfig,
                              cert=(config.transport_pem, config.transport_key),
                              verify=config.ca_pem)
 
-    log_x_fapi_interaction_id_matches(authorisation_server, "send_pushed_authorisation_request", x_fapi_interaction_id, response)
+    log_x_fapi_interaction_id_matches(authorisation_server, "send_pushed_authorisation_request",
+                                      x_fapi_interaction_id, response)
 
     if not response.ok:
-        raise RelyingPartyClientSdkException(f"Response code for PAR to {authorisation_server_id} not successful, was: {response.status_code} x-fapi-interaction-id: {x_fapi_interaction_id}")
+        raise RelyingPartyClientSdkException(f"Response code for PAR to {authorisation_server_id} not successful, "
+                                             f"was: {response.status_code} x-fapi-interaction-id: {x_fapi_interaction_id}")
 
     request_uri = response.json()['request_uri']
     logger.debug(f"PAR was sent, request_uri='{request_uri}'")
@@ -138,7 +134,8 @@ def _check_valid_purpose(purpose) -> None:
     contains_illegal_char = any(char in purpose for char in illegal_chars)
     if contains_illegal_char:
         raise RelyingPartyClientSdkException(
-            f"Purpose cannot contain any of the following characters: {', '.join(illegal_chars)}, purpose supplied: [{purpose}]")
+            f"Purpose cannot contain any of the following characters: {', '.join(illegal_chars)}, "
+            f"purpose supplied: [{purpose}]")
 
 
 def _ensure_mandatory_claims_present(essential_claims: set[str], voluntary_claims: set[str]) -> set[str]:

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/endpoints/retrieve_tokens.py

@@ -5,12 +5,15 @@ import uuid
 from typing import Tuple, Any
 
 import requests
-from authlib.jose import JsonWebSignature
+from joserfc import jws
+from joserfc.jwk import RSAKey
+from joserfc.jws import JWSRegistry
 
 from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
     get_auth_server_details
 from rp_python_sdk.endpoints.user_info import call_user_info
 from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id, log_x_fapi_interaction_id_matches
+from rp_python_sdk.endpoints.util.mapping import from_dict
 from rp_python_sdk.model import CallbackBody, TokenSet, TokenInput, IssuerMetadata
 from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
 from rp_python_sdk.sdk_config import SdkConfig
@@ -60,18 +63,19 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
         'iat': iat,
     }
 
-    jws = JsonWebSignature()
-    header = {'alg': 'PS256', 'kid': config.signing_kid}
+    # See https://jose.authlib.org/en/guide/registry/
+    registry = JWSRegistry(algorithms=["PS256"])
 
-    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload),
-                                                 config.signing_key)
+    key = RSAKey.import_key(config.signing_key)
+    header = {'alg': 'PS256', 'kid': config.signing_kid}
+    client_assertion_jwt = jws.serialize_compact(header, json.dumps(client_assertion_payload), key, registry = registry)
 
     # Data payload
     data = {
         "grant_type": "authorization_code",
         "code": callback_body.code,
         "redirect_uri": redirect_uri,
-        "client_assertion": client_assertion_jwt.decode("utf-8"),
+        "client_assertion": client_assertion_jwt,
         "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
         "code_verifier": original_code_verifier
     }
@@ -94,7 +98,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
             f"Response code for token endpoint to {token_endpoint} not successful, was: {response.status_code}, "
             f"x-fapi-interaction-id: {x_fapi_interaction_id}, response body: " + response.text)
 
-    token_input = TokenInput.from_json(response.text)
+    token_input = from_dict(TokenInput, json.loads(response.text))
 
     jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id)
     allowed_algs = issuer_metadata.id_token_signing_alg_values_supported

rp_python_sdk-0.9.0/rp_python_sdk/endpoints/util/mapping.py

@@ -0,0 +1,54 @@
+from typing import Type, TypeVar, Union, List, get_type_hints
+
+T = TypeVar('T')
+
+
+def snake_to_pascal(name: str) -> str:
+    """
+    Converts a snake_case string to PascalCase.
+    Example: organisation_id -> OrganisationId
+    """
+    return ''.join(word.capitalize() for word in name.split('_'))
+
+
+def from_dict(data_class: Type[T], data: Union[dict, list], pascal_case=False) -> Union[T, List[T]]:
+    """
+    Recursively maps a dictionary or a list of dictionaries to a dataclass or a list of dataclasses.
+    Handles key transformations from snake_case to PascalCase, and resolves forward references.
+    """
+    if isinstance(data, list):
+        # Map each item in the list to the dataclass
+        return [from_dict(data_class, item, pascal_case) for item in data]
+
+    if not isinstance(data, dict):
+        raise ValueError(
+            f"Expected a dictionary to map to {data_class.__name__}, but got {type(data).__name__}: {data}")
+
+    # Get the fields of the dataclass, resolving forward references
+    fieldtypes = get_type_hints(data_class)
+
+    # Prepare the arguments for the dataclass constructor
+    data_class_kwargs = {}
+    for field, field_type in fieldtypes.items():
+        # Convert the snake_case field name to PascalCase to match the JSON key
+        json_field = field
+        if (pascal_case):
+            json_field = snake_to_pascal(field)
+
+        # Fetch the corresponding value from the JSON data
+        field_value = data.get(json_field)
+
+        if isinstance(field_value, list):
+            inner_type = field_type.__args__[0]
+            data_class_kwargs[field] = [from_dict(inner_type, item, pascal_case) if isinstance(item, dict) else item for
+                                        item in field_value]
+        elif isinstance(field_value, dict):
+            data_class_kwargs[field] = from_dict(field_type, field_value, pascal_case)
+        else:
+            # Handle authorisation_servers case
+            if field == "authorisation_servers" and field_value is None:
+                data_class_kwargs[field] = []
+            else:
+                data_class_kwargs[field] = field_value
+
+    return data_class(**data_class_kwargs)

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/filters/participant_filters.py

@@ -96,4 +96,3 @@ def filter_for_fallback_identity_service_providers(participants: List[Participan
 def to_date(date_string: str):
     date_format = "%d/%m/%Y"
     return datetime.strptime(date_string, date_format).date()
-

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/model.py

@@ -2,11 +2,8 @@ from dataclasses import dataclass
 from typing import Any, Dict, Optional
 from typing import List
 
-from dataclass_wizard import JSONWizard
-
-
 @dataclass
-class Participant(JSONWizard):
+class Participant:
     organisation_id: str
     status: str
     organisation_name: str
@@ -29,7 +26,7 @@ class Participant(JSONWizard):
 
 
 @dataclass
-class AuthorisationServerCertification(JSONWizard):
+class AuthorisationServerCertification:
     certification_start_date: str  # date
     certification_expiration_date: str  # date
     certification_id: str
@@ -42,31 +39,49 @@ class AuthorisationServerCertification(JSONWizard):
 
 
 @dataclass
-class OrgDomainClaim(JSONWizard):
+class OrgDomainClaim:
     authorisation_domain_name: str
     authority_name: str
     registration_id: str
     status: str
 
+@dataclass
+class ApiDiscoveryEndpoint:
+    api_discovery_id: str
+    api_endpoint: str
+
+@dataclass
+class ApiResource:
+    api_resource_id: str
+    api_version: str
+    api_discovery_endpoints: List[ApiDiscoveryEndpoint]
+    family_complete: bool
+    api_certification_uri: Optional[str]
+    certification_status: Optional[str]
+    # should be a date
+    certification_start_date: str
+    # should be a date
+    certification_expiration_date: str
+    api_family_type: Optional[str]
 
 @dataclass
-class AuthorisationServer(JSONWizard):
+class AuthorisationServer:
     authorisation_server_id: str
-    api_resources: List[str]
+    api_resources: List[ApiResource]
     authorisation_server_certifications: List[AuthorisationServerCertification]
     customer_friendly_description: str
     customer_friendly_logo_uri: str
     customer_friendly_name: str
     developer_portal_uri: str
     terms_of_service_uri: str
-    open_id_discovery_document: str
+    open_i_d_discovery_document: str
     issuer: str
     payload_signing_cert_location_uri: str
     parent_authorisation_server_id: str
 
 
 @dataclass
-class OrgDomainRoleClaim(JSONWizard):
+class OrgDomainRoleClaim:
     status: str
     authorisation_domain: str
     role: str
@@ -97,16 +112,16 @@ class TokenSet:
 
 
 @dataclass
-class TokenInput(JSONWizard):
+class TokenInput:
     access_token: str
-    scope: str
     id_token: str
     token_type: str
     expires_in: Optional[int] = None
+    scope: Optional[str] = None
 
 
 @dataclass
-class MtlsEndpointAliases(JSONWizard):
+class MtlsEndpointAliases:
     token_endpoint: Optional[str] = None
     pushed_authorization_request_endpoint: Optional[str] = None
     authorization_endpoint: Optional[str] = None
@@ -114,7 +129,7 @@ class MtlsEndpointAliases(JSONWizard):
 
 
 @dataclass
-class IssuerMetadata(JSONWizard):
+class IssuerMetadata:
     issuer: str
     jwks_uri: str
     id_token_signing_alg_values_supported: List[str]
@@ -126,20 +141,20 @@ class IssuerMetadata(JSONWizard):
 
     def get_preferred_token_endpoint(self) -> str:
         return self.mtls_endpoint_aliases.token_endpoint \
-            if self.mtls_endpoint_aliases.token_endpoint \
+            if self.mtls_endpoint_aliases and self.mtls_endpoint_aliases.token_endpoint \
             else self.token_endpoint
 
     def get_preferred_pushed_authorization_request_endpoint(self) -> str:
         return self.mtls_endpoint_aliases.pushed_authorization_request_endpoint \
-            if self.mtls_endpoint_aliases.pushed_authorization_request_endpoint \
+            if self.mtls_endpoint_aliases and self.mtls_endpoint_aliases.pushed_authorization_request_endpoint \
             else self.pushed_authorization_request_endpoint
 
     def get_preferred_authorization_endpoint(self) -> str:
         return self.mtls_endpoint_aliases.authorization_endpoint \
-            if self.mtls_endpoint_aliases.authorization_endpoint \
+            if self.mtls_endpoint_aliases and self.mtls_endpoint_aliases.authorization_endpoint \
             else self.authorization_endpoint
 
     def get_preferred_userinfo_endpoint(self) -> str:
         return self.mtls_endpoint_aliases.userinfo_endpoint \
-            if self.mtls_endpoint_aliases.userinfo_endpoint\
+            if self.mtls_endpoint_aliases and self.mtls_endpoint_aliases.userinfo_endpoint \
             else self.userinfo_endpoint

{rp_python_sdk-0.7.0 → rp_python_sdk-0.9.0}/rp_python_sdk/relying_party_client_sdk.py

@@ -14,7 +14,11 @@ class RelyingPartyClientSdk:
         self.config = config
 
         if config.custom_config.enable_auto_compliance_verification:
-            logger.info(f"Auto Compliance Verification mode enabled, printing config information: {self.config}")
+            logger.info(f"Auto Compliance Verification mode enabled, printing config information: "
+                        f"client_id={self.config.client_id}, "
+                        f"signing_kid={self.config.signing_kid}, "
+                        f"application_redirect_uri={self.config.application_redirect_uri}, "
+                        f"registry_participants_uri={self.config.registry_participants_uri}")
 
     def get_participants(self) -> list[Participant]:
         return get_participants(self.config)