rp_python_sdk 1.1.7__tar.gz → 1.3.0__tar.gz

rp_python_sdk-1.1.7/README.md → rp_python_sdk-1.3.0/PKG-INFO

@@ -1,3 +1,24 @@
+Metadata-Version: 2.4
+Name: rp_python_sdk
+Version: 1.3.0
+Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
+License: Proprietary
+Author: Erik Pragt
+Author-email: erik.pragt@connectid.com.au
+Requires-Python: >=3.12,<4.0
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: authlib (>=1.6.6,<2.0.0)
+Requires-Dist: cffi (>=2.0.0,<3.0.0)
+Requires-Dist: cryptography (>=46.0.5,<47.0.0)
+Requires-Dist: joserfc (>=1.6.3,<2.0.0)
+Requires-Dist: requests (>=2.32.5,<3.0.0)
+Requires-Dist: urllib3 (>=2.6.3,<3.0.0)
+Description-Content-Type: text/markdown
+
 # Python SDK for Relying Parties
 
 [![Build Python SDK](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml/badge.svg)](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml)
@@ -182,7 +203,12 @@ client = RelyingPartyClientSdk(
     client_id='https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a',
     signing_kid='1X8udt28NY8NiSS8OJFvabv63K5igyFx5pM5ajKlMx8',
     custom_config=CustomConfig(
-      enable_auto_compliance_verification=False
+      enable_auto_compliance_verification=False,
+      # HTTP cache configuration (optional)
+      cache_enabled=True,                    # Enable/disable caching (default: True)
+      cache_ttl_minutes=10,                  # Cache TTL in minutes (default: 10)
+      cache_max_entries=100,                 # Max cached entries (default: 100)
+      cache_max_element_size_bytes=5242880   # Max size per entry in bytes (default: 5MB)
     )
   ),
 )
@@ -190,6 +216,19 @@ client = RelyingPartyClientSdk(
 participants = client.get_participants()
 ```
 
+### HTTP Response Caching
+
+The SDK includes an in-memory LRU cache that automatically caches HTTP responses for stable endpoints (participants registry,
+OIDC discovery documents, and JWKS endpoints) to improve performance and reduce network calls. The cache is enabled by default
+with sensible defaults, but can be customized or disabled via the `CustomConfig` options shown above.
+
+Key cache features:
+- **Thread-safe**: Safe for concurrent use across multiple threads
+- **LRU eviction**: Automatically evicts least recently used entries when the cache is full
+- **TTL expiration**: Entries expire after the configured TTL (default: 10 minutes)
+- **Size limits**: Prevents caching of responses that exceed the configured size limit
+- **Transparent**: Caching is automatic and transparent to SDK users
+
 The response will contain List of Organisations and their Authorisation Server, with an object structure similar to below.
 
 They key fields of interest are:
@@ -412,6 +451,24 @@ poetry publish
 
 ## Release Notes
 
+## 1.3.0 (23 Mar, 2026)
+- **OpenID Connect Discovery Section 4.3 Compliance**: Implemented issuer validation to ensure the issuer value in the provider configuration matches the Issuer URL used to retrieve it
+  - Added validation that compares the issuer in `/.well-known/openid-configuration` response with the expected issuer URL
+  - Properly handles trailing slash normalisation per RFC 3986
+  - Throws descriptive exception when issuer mismatch is detected, stopping the flow as required by the specification
+  - Validates both fresh and cached issuer metadata
+
+### 1.2.0 (Feb 11, 2026)
+- **New Feature: HTTP Response Cache** - Added in-memory LRU cache for HTTP responses to improve SDK performance
+  - Caches participants registry, OIDC discovery documents, and JWKS endpoints
+  - Configurable TTL (default: 10 minutes), max entries (default: 100), and size limits (default: 5MB per entry)
+  - Thread-safe with automatic LRU eviction
+  - Cache can be disabled or customized via `CustomConfig`:
+    - `cache_enabled` (bool, default: `True`)
+    - `cache_ttl_minutes` (int, default: `10`)
+    - `cache_max_entries` (int, default: `100`)
+    - `cache_max_element_size_bytes` (int, default: `5242880`)
+
 ### 1.1.7 (Jan 9, 2026)
 - Security fix: Updated urllib3 to 2.6.3 to address high severity vulnerability (CVE-2026-21441)
 
@@ -486,3 +543,4 @@ def send_pushed_authorisation_request(config: SdkConfig,
 
 ### 0.1.0 (March 27, 2024)
 - Initial version
+

rp_python_sdk-1.1.7/PKG-INFO → rp_python_sdk-1.3.0/README.md

@@ -1,24 +1,3 @@
-Metadata-Version: 2.4
-Name: rp_python_sdk
-Version: 1.1.7
-Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
-License: Proprietary
-Author: Erik Pragt
-Author-email: erik.pragt@connectid.com.au
-Requires-Python: >=3.12,<4.0
-Classifier: License :: Other/Proprietary License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: authlib (>=1.6.6,<2.0.0)
-Requires-Dist: cffi (>=2.0.0,<3.0.0)
-Requires-Dist: cryptography (>=46.0.2,<47.0.0)
-Requires-Dist: joserfc (>=1.6.1,<2.0.0)
-Requires-Dist: requests (>=2.32.5,<3.0.0)
-Requires-Dist: urllib3 (>=2.6.3,<3.0.0)
-Description-Content-Type: text/markdown
-
 # Python SDK for Relying Parties
 
 [![Build Python SDK](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml/badge.svg)](https://github.com/connectid-tools/rp-python-sdk/actions/workflows/build.yml)
@@ -203,7 +182,12 @@ client = RelyingPartyClientSdk(
     client_id='https://rp.directory.sandbox.connectid.com.au/openid_relying_party/280518db-9807-4824-b080-324d94b45f6a',
     signing_kid='1X8udt28NY8NiSS8OJFvabv63K5igyFx5pM5ajKlMx8',
     custom_config=CustomConfig(
-      enable_auto_compliance_verification=False
+      enable_auto_compliance_verification=False,
+      # HTTP cache configuration (optional)
+      cache_enabled=True,                    # Enable/disable caching (default: True)
+      cache_ttl_minutes=10,                  # Cache TTL in minutes (default: 10)
+      cache_max_entries=100,                 # Max cached entries (default: 100)
+      cache_max_element_size_bytes=5242880   # Max size per entry in bytes (default: 5MB)
     )
   ),
 )
@@ -211,6 +195,19 @@ client = RelyingPartyClientSdk(
 participants = client.get_participants()
 ```
 
+### HTTP Response Caching
+
+The SDK includes an in-memory LRU cache that automatically caches HTTP responses for stable endpoints (participants registry,
+OIDC discovery documents, and JWKS endpoints) to improve performance and reduce network calls. The cache is enabled by default
+with sensible defaults, but can be customized or disabled via the `CustomConfig` options shown above.
+
+Key cache features:
+- **Thread-safe**: Safe for concurrent use across multiple threads
+- **LRU eviction**: Automatically evicts least recently used entries when the cache is full
+- **TTL expiration**: Entries expire after the configured TTL (default: 10 minutes)
+- **Size limits**: Prevents caching of responses that exceed the configured size limit
+- **Transparent**: Caching is automatic and transparent to SDK users
+
 The response will contain List of Organisations and their Authorisation Server, with an object structure similar to below.
 
 They key fields of interest are:
@@ -433,6 +430,24 @@ poetry publish
 
 ## Release Notes
 
+## 1.3.0 (23 Mar, 2026)
+- **OpenID Connect Discovery Section 4.3 Compliance**: Implemented issuer validation to ensure the issuer value in the provider configuration matches the Issuer URL used to retrieve it
+  - Added validation that compares the issuer in `/.well-known/openid-configuration` response with the expected issuer URL
+  - Properly handles trailing slash normalisation per RFC 3986
+  - Throws descriptive exception when issuer mismatch is detected, stopping the flow as required by the specification
+  - Validates both fresh and cached issuer metadata
+
+### 1.2.0 (Feb 11, 2026)
+- **New Feature: HTTP Response Cache** - Added in-memory LRU cache for HTTP responses to improve SDK performance
+  - Caches participants registry, OIDC discovery documents, and JWKS endpoints
+  - Configurable TTL (default: 10 minutes), max entries (default: 100), and size limits (default: 5MB per entry)
+  - Thread-safe with automatic LRU eviction
+  - Cache can be disabled or customized via `CustomConfig`:
+    - `cache_enabled` (bool, default: `True`)
+    - `cache_ttl_minutes` (int, default: `10`)
+    - `cache_max_entries` (int, default: `100`)
+    - `cache_max_element_size_bytes` (int, default: `5242880`)
+
 ### 1.1.7 (Jan 9, 2026)
 - Security fix: Updated urllib3 to 2.6.3 to address high severity vulnerability (CVE-2026-21441)
 
@@ -507,4 +522,3 @@ def send_pushed_authorisation_request(config: SdkConfig,
 
 ### 0.1.0 (March 27, 2024)
 - Initial version
-

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "1.1.7"
+version = "1.3.0"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -10,8 +10,8 @@ readme = "README.md"
 python = "^3.12"
 requests = "^2.32.5"
 authlib = "^1.6.6"
-cryptography = "^46.0.2"
-joserfc = "^1.6.1"
+cryptography = "^46.0.5"
+joserfc = "^1.6.3"
 cffi = "^2.0.0"
 urllib3 = "^2.6.3"
 
@@ -21,7 +21,7 @@ httpx = "^0.28.1"
 toml = "^0.10.2"
 
 [tool.poetry.group.dev.dependencies]
-black = "^25.0.0"
+black = "^26.0.0"
 pre-commit = "^4.5.1"
 mypy = "^1.19.1"
 requests-mock = "^1.12.1"

rp_python_sdk-1.3.0/rp_python_sdk/cache/http_cache.py

@@ -0,0 +1,117 @@
+from collections import OrderedDict
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from threading import Lock
+from typing import Optional
+from rp_python_sdk.sdk_config import CustomConfig
+
+from rp_python_sdk.setup_logger import logger
+
+@dataclass
+class CacheEntry:
+    content: str
+    fetched_at: datetime
+    size_bytes: int
+
+
+class HttpCache:
+    def __init__(self, config: CustomConfig) -> None:
+        self._enabled = config.cache_enabled
+        self._ttl_minutes = config.cache_ttl_minutes
+        self._max_entries = config.cache_max_entries
+        self._max_element_size_bytes = config.cache_max_element_size_bytes
+
+        self._cache: OrderedDict[str, CacheEntry] = OrderedDict()
+        self._lock = Lock()
+
+        logger.debug(
+            f"HTTP cache initialized: enabled={self._enabled}, ttlMinutes={self._ttl_minutes}, "
+            f"maxEntries={self._max_entries}, maxElementSize={self._max_element_size_bytes}"
+        )
+
+    def get(self, url: str) -> Optional[str]:
+        if not self._enabled:
+            return None
+
+        with self._lock:
+            if url not in self._cache:
+                return None
+
+            entry = self._cache[url]
+
+            if self._is_stale_entry(entry):
+                logger.debug(f"Cache entry stale for URL: {url}")
+                return None
+
+            self._cache.move_to_end(url)
+            logger.debug(f"Cache hit for URL: {url}")
+            return entry.content
+
+    def put(self, url: str, content: str) -> None:
+        if not self._enabled:
+            return
+
+        size_bytes = len(content.encode('utf-8'))
+
+        if size_bytes > self._max_element_size_bytes:
+            logger.warning(
+                f"Response too large to cache: {size_bytes} bytes (max: {self._max_element_size_bytes}), URL: {url}"
+            )
+            return
+
+        with self._lock:
+            entry = CacheEntry(
+                content=content,
+                fetched_at=datetime.now(timezone.utc),
+                size_bytes=size_bytes
+            )
+
+            self._cache[url] = entry
+            self._cache.move_to_end(url)
+
+            logger.debug(f"Cached response for URL: {url}, size: {size_bytes} bytes")
+
+            if len(self._cache) > self._max_entries:
+                evicted_url, _ = self._cache.popitem(last=False)
+                logger.debug(f"Evicted cache entry for URL: {evicted_url}")
+
+    def is_stale(self, url: str) -> bool:
+        if not self._enabled:
+            return False
+
+        with self._lock:
+            if url not in self._cache:
+                return False
+
+            entry = self._cache[url]
+            return self._is_stale_entry(entry)
+
+    def evict(self, url: str) -> None:
+        if not self._enabled:
+            return
+
+        with self._lock:
+            if url in self._cache:
+                del self._cache[url]
+                logger.debug(f"Evicted cache entry for URL: {url}")
+
+    def clear(self) -> None:
+        if not self._enabled:
+            return
+
+        with self._lock:
+            self._cache.clear()
+            logger.debug("Cache cleared")
+
+    def size(self) -> int:
+        with self._lock:
+            return len(self._cache)
+
+    def is_enabled(self) -> bool:
+        return self._enabled
+
+    def _is_stale_entry(self, entry: CacheEntry) -> bool:
+        expiry_time: datetime = entry.fetched_at + timedelta(minutes=self._ttl_minutes)
+        current_time: datetime = datetime.now(timezone.utc)
+        is_stale: bool = current_time >= expiry_time
+        return is_stale

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/endpoints/get_participants.py

@@ -14,10 +14,11 @@ from rp_python_sdk.model import Participant
 from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
 from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
+from rp_python_sdk.cache.http_cache import HttpCache
 
 
-def get_participants(config: SdkConfig) -> list[Participant]:
-    participants = _retrieve_full_participants_list(config)
+def get_participants(config: SdkConfig, cache: HttpCache) -> list[Participant]:
+    participants = _retrieve_full_participants_list(config, cache)
 
     filtered_participants = remove_fallback_identity_service_provider(participants)
 
@@ -47,8 +48,8 @@ def get_participants(config: SdkConfig) -> list[Participant]:
     return filtered_participants
 
 
-def retrieve_fallback_provider_participants(config: SdkConfig) -> list[Participant]:
-    participants = _retrieve_full_participants_list(config)
+def retrieve_fallback_provider_participants(config: SdkConfig, cache: HttpCache) -> list[Participant]:
+    participants = _retrieve_full_participants_list(config, cache)
 
     filtered_participants = remove_out_of_date_certifications(participants, date.today())
     filtered_participants = remove_unofficial_certifications(filtered_participants)
@@ -59,10 +60,21 @@ def retrieve_fallback_provider_participants(config: SdkConfig) -> list[Participa
     return filtered_participants
 
 
-def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
-    logger.info(f"Retrieving all identity providers from {config.registry_participants_uri}")
+def _retrieve_full_participants_list(config: SdkConfig, cache: HttpCache) -> list[Participant]:
+    url = config.registry_participants_uri
 
-    response = requests.get(config.registry_participants_uri,
+    # Try cache first
+    cached = cache.get(url)
+    if cached:
+        logger.debug(f"Cache hit for URL: {url}")
+        participant_list: list[Participant] = from_dict(Participant, json.loads(cached), pascal_case=True)
+        logger.info(f"Retrieved identity providers from cache, num orgs found: {len(participant_list)}")
+        return participant_list
+
+    logger.debug(f"Cache miss for URL: {url}")
+    logger.info(f"Retrieving all identity providers from {url}")
+
+    response = requests.get(url,
                             timeout=config.custom_config.timeout_in_seconds,
                             headers={
                                 'User-Agent': build_user_agent(config.client_id)
@@ -71,6 +83,10 @@ def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
         raise RelyingPartyClientSdkException(
             f"Call to identity provider endpoint failed with code: {response.status_code}")
 
+    # Cache the successful response
+    cache.put(url, response.text)
+    logger.debug(f"Cached response for URL: {url}, size: {len(response.text)} bytes")
+
     # participant_list: list[Participant] = Participant.from_json(response.text)
     participant_list: list[Participant] = from_dict(Participant, json.loads(response.text), pascal_case=True)
 
@@ -78,7 +94,7 @@ def _retrieve_full_participants_list(config: SdkConfig) -> list[Participant]:
     return participant_list
 
 
-def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) -> AuthorisationServer:
+def get_auth_server_details(config: SdkConfig, authorisation_server_id: str, cache: HttpCache) -> AuthorisationServer:
     def find_auth_server_by_id(participants: list[Participant], target_id: str) -> AuthorisationServer | None:
         for participant in participants:
             for server in participant.authorisation_servers:
@@ -87,11 +103,11 @@ def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) ->
         return None
 
     # Search in main participants
-    result = find_auth_server_by_id(get_participants(config), authorisation_server_id)
+    result = find_auth_server_by_id(get_participants(config, cache), authorisation_server_id)
 
     # If not found, check fallback provider participants
     if result is None:
-        fallback_participants = retrieve_fallback_provider_participants(config)
+        fallback_participants = retrieve_fallback_provider_participants(config, cache)
         result = find_auth_server_by_id(fallback_participants, authorisation_server_id)
 
     if result is None:
@@ -101,19 +117,46 @@ def get_auth_server_details(config: SdkConfig, authorisation_server_id: str) ->
     return result
 
 
-def get_issuer_metadata(authorisation_server: AuthorisationServer) -> IssuerMetadata:
-    auth_server_issuer = authorisation_server.open_i_d_discovery_document
+def _validate_issuer_match(discovery_url: str, actual_issuer: str) -> None:
+    well_known_suffix = "/.well-known/openid-configuration"
+    if well_known_suffix not in discovery_url or not actual_issuer:
+        return
+    expected_issuer = discovery_url[:discovery_url.index(well_known_suffix)]
+    if expected_issuer.rstrip("/") != actual_issuer.rstrip("/"):
+        raise RelyingPartyClientSdkException(
+            f"Issuer mismatch: discovery URL implies issuer '{expected_issuer}' "
+            f"but discovery document contains issuer '{actual_issuer}'")
+
+
+def get_issuer_metadata(authorisation_server: AuthorisationServer, cache: HttpCache) -> IssuerMetadata:
+    url = authorisation_server.open_i_d_discovery_document
+
+    # Try cache first
+    cached = cache.get(url)
+    if cached:
+        logger.debug(f"Cache hit for URL: {url}")
+        metadata = from_dict(IssuerMetadata, json.loads(cached))
+        _validate_issuer_match(url, metadata.issuer)
+        return metadata
+
+    logger.debug(f"Cache miss for URL: {url}")
 
     try:
-        logger.info(f"Getting discovery document from {auth_server_issuer}")
-        response = requests.get(auth_server_issuer)
+        logger.info(f"Getting discovery document from {url}")
+        response = requests.get(url)
         response.raise_for_status()  # Raises an exception for 4XX or 5XX errors
 
-        return from_dict(IssuerMetadata, json.loads(response.text))
+        # Cache the successful response
+        cache.put(url, response.text)
+        logger.debug(f"Cached response for URL: {url}, size: {len(response.text)} bytes")
+
+        metadata = from_dict(IssuerMetadata, json.loads(response.text))
+        _validate_issuer_match(url, metadata.issuer)
+        return metadata
 
     except requests.exceptions.HTTPError as http_err:
         raise RelyingPartyClientSdkException(
             f"Call to identity provider endpoint failed with code: {response.status_code}") from http_err
     except requests.exceptions.RequestException as req_err:
         raise RelyingPartyClientSdkException(
-            f"Failed to connect to authorisation service {auth_server_issuer}") from req_err
+            f"Failed to connect to authorisation service {url}") from req_err

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/endpoints/pushed_authorisation_request.py

@@ -16,6 +16,7 @@ from rp_python_sdk.model import PARResponse
 from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientSdkException
 from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
+from rp_python_sdk.cache.http_cache import HttpCache
 
 extended_claims = {"over16", "over18", "over21", "over25", "over65", "beneficiary_account_au",
                    "beneficiary_account_au_payid", "beneficiary_account_international"}
@@ -25,14 +26,15 @@ def send_pushed_authorisation_request(config: SdkConfig,
                                       authorisation_server_id: str,
                                       essential_claims: set[str],
                                       voluntary_claims: set[str],
-                                      purpose: str) -> PARResponse:
+                                      purpose: str,
+                                      cache: HttpCache) -> PARResponse:
     _check_valid_purpose(purpose)
 
     checked_essential_claims = _ensure_mandatory_claims_present(essential_claims, voluntary_claims)
     claim_request = _generate_claims_request(checked_essential_claims, voluntary_claims)
 
-    authorisation_server = get_auth_server_details(config, authorisation_server_id)
-    issuer_metadata = get_issuer_metadata(authorisation_server)
+    authorisation_server = get_auth_server_details(config, authorisation_server_id, cache)
+    issuer_metadata = get_issuer_metadata(authorisation_server, cache)
 
     auth_server_url = issuer_metadata.issuer
     x_fapi_interaction_id = create_x_fapi_interaction_id()

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/endpoints/retrieve_tokens.py

@@ -22,12 +22,13 @@ from rp_python_sdk.relying_party_client_sdk_exception import RelyingPartyClientS
 from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
 
+from rp_python_sdk.cache.http_cache import HttpCache
 
 def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_body: CallbackBody,
                     original_code_verifier: str,
-                    original_state: str, nonce: str) -> TokenSet:
-    authorisation_server = get_auth_server_details(config, authorisation_server_id)
-    issuer_metadata = get_issuer_metadata(authorisation_server)
+                    original_state: str, nonce: str, cache: HttpCache) -> TokenSet:
+    authorisation_server = get_auth_server_details(config, authorisation_server_id, cache)
+    issuer_metadata = get_issuer_metadata(authorisation_server, cache)
 
     if issuer_metadata.issuer != callback_body.iss:
         raise RelyingPartyClientSdkException(
@@ -104,7 +105,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
 
     token_input = from_dict(TokenInput, json.loads(response.text))
 
-    jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id)
+    jwks_response_body = _get_jwks_json(issuer_metadata, x_fapi_interaction_id, cache)
     allowed_algs = issuer_metadata.id_token_signing_alg_values_supported
 
     header, payload = _validate(token_input, jwks_response_body, allowed_algs, nonce, client_id, callback_body,
@@ -113,7 +114,7 @@ def retrieve_tokens(config: SdkConfig, authorisation_server_id: str, callback_bo
     token_set = TokenSet(token_input, payload, x_fapi_interaction_id)
 
     if config.custom_config.enable_auto_compliance_verification:
-        call_user_info(config, authorisation_server_id, token_set.token_input.access_token)
+        call_user_info(config, authorisation_server_id, token_set.token_input.access_token, cache)
 
     logger.info(
         f"Token response successfully retrieved from authorisation server {authorisation_server_id}, "
@@ -275,17 +276,31 @@ def _matching_alg(token_alg: str, key_element: dict) -> bool:
     return key_element.get("alg") is None or key_element.get("alg") == token_alg
 
 
-def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str) -> Any:
+def _get_jwks_json(issuer_metadata: IssuerMetadata, x_fapi_interaction_id: str, cache: HttpCache) -> Any:
+    url = issuer_metadata.jwks_uri
+
+    # Try cache first
+    cached = cache.get(url)
+    if cached:
+        logger.debug(f"Cache hit for URL: {url}")
+        return json.loads(cached)
+
+    logger.debug(f"Cache miss for URL: {url}")
+
     headers = {
         "Accept": "application/json",
         "x-fapi-interaction-id": x_fapi_interaction_id
     }
-    response = requests.get(issuer_metadata.jwks_uri, headers=headers)
+    response = requests.get(url, headers=headers)
     response.raise_for_status()
 
     if not response.ok:
         raise RelyingPartyClientSdkException(
-            f"Response code for JWKS to {issuer_metadata.jwks_uri} not successful, was: {response.status_code}, "
+            f"Response code for JWKS to {url} not successful, was: {response.status_code}, "
             f"x-fapi-interaction-id: {x_fapi_interaction_id}, response body: {response.text}")
 
+    # Cache the successful response
+    cache.put(url, response.text)
+    logger.debug(f"Cached response for URL: {url}, size: {len(response.text)} bytes")
+
     return response.json()

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/endpoints/user_info.py

@@ -2,6 +2,7 @@ from typing import Any
 
 import requests
 
+from rp_python_sdk.cache.http_cache import HttpCache
 from rp_python_sdk.endpoints.get_participants import get_issuer_metadata, \
     get_auth_server_details
 from rp_python_sdk.endpoints.util.fapi import create_x_fapi_interaction_id
@@ -10,12 +11,12 @@ from rp_python_sdk.sdk_config import SdkConfig
 from rp_python_sdk.setup_logger import logger
 
 
-def call_user_info(config: SdkConfig, authorisation_server_id: str, access_token: str) -> dict[str, Any]:
+def call_user_info(config: SdkConfig, authorisation_server_id: str, access_token: str, cache: HttpCache) -> dict[str, Any]:
     x_fapi_interaction_id = create_x_fapi_interaction_id()
     logger.info(f"Making call to user info endpoint, x-fapi-interaction-id: {x_fapi_interaction_id}")
 
-    authorisation_server = get_auth_server_details(config, authorisation_server_id)
-    issuer_metadata = get_issuer_metadata(authorisation_server)
+    authorisation_server = get_auth_server_details(config, authorisation_server_id, cache)
+    issuer_metadata = get_issuer_metadata(authorisation_server, cache)
 
     user_info_endpoint = issuer_metadata.get_preferred_userinfo_endpoint()
 

rp_python_sdk-1.3.0/rp_python_sdk/endpoints/util/version_info.py

@@ -0,0 +1,2 @@
+def get_version_info() -> str:
+    return "1.3.0"  # Version number

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/relying_party_client_sdk.py

@@ -1,3 +1,4 @@
+from rp_python_sdk.cache.http_cache import HttpCache
 from rp_python_sdk.endpoints.get_participants import get_participants, \
     retrieve_fallback_provider_participants
 from rp_python_sdk.endpoints.pushed_authorisation_request import send_pushed_authorisation_request
@@ -12,6 +13,7 @@ class RelyingPartyClientSdk:
 
     def __init__(self, config: SdkConfig):
         self.config = config
+        self.cache = HttpCache(config.custom_config)
 
         if config.custom_config.enable_auto_compliance_verification:
             logger.info(f"Auto Compliance Verification mode enabled, printing config information: "
@@ -21,10 +23,10 @@ class RelyingPartyClientSdk:
                         f"registry_participants_uri={self.config.registry_participants_uri}")
 
     def get_participants(self) -> list[Participant]:
-        return get_participants(self.config)
+        return get_participants(self.config, self.cache)
 
     def get_fallback_provider_participants(self) -> list[Participant]:
-        return retrieve_fallback_provider_participants(self.config)
+        return retrieve_fallback_provider_participants(self.config, self.cache)
 
     def send_pushed_authorisation_request(self, authorisation_server_id: str,
                                           essential_claims: set[str] | None = None,
@@ -36,9 +38,9 @@ class RelyingPartyClientSdk:
         checked_purpose = purpose if purpose else self.config.custom_config.purpose
 
         return send_pushed_authorisation_request(self.config, authorisation_server_id, checked_essential_claims,
-                                                 checked_voluntary_claims, checked_purpose)
+                                                 checked_voluntary_claims, checked_purpose, self.cache)
 
     def retrieve_tokens(self, authorisation_server_id: str, callback_body: CallbackBody, original_code_verifier: str,
                         original_state: str, nonce: str) -> TokenSet:
         return retrieve_tokens(self.config, authorisation_server_id, callback_body, original_code_verifier,
-                               original_state, nonce)
+                               original_state, nonce, self.cache)

{rp_python_sdk-1.1.7 → rp_python_sdk-1.3.0}/rp_python_sdk/sdk_config.py

@@ -23,6 +23,10 @@ class CustomConfig:
     required_claims: List[str] = field(default_factory=list)
     required_participant_certifications: List['CertificationFilter'] = field(default_factory=list)
     timeout_in_seconds: int = 10
+    cache_enabled: bool = True
+    cache_ttl_minutes: int = 10
+    cache_max_entries: int = 100
+    cache_max_element_size_bytes: int = 5242880
 
     def __post_init__(self) -> None:
         if self.include_uncertified_participants:

rp_python_sdk-1.1.7/rp_python_sdk/endpoints/util/version_info.py

@@ -1,2 +0,0 @@
-def get_version_info() -> str:
-    return "1.1.7"  # Version number