rp_python_sdk 1.2.0__tar.gz → 1.3.1__tar.gz

{rp_python_sdk-1.2.0 → rp_python_sdk-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rp_python_sdk
-Version: 1.2.0
+Version: 1.3.1
 Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
 License: Proprietary
 Author: Erik Pragt
@@ -13,8 +13,8 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: authlib (>=1.6.6,<2.0.0)
 Requires-Dist: cffi (>=2.0.0,<3.0.0)
-Requires-Dist: cryptography (>=46.0.2,<47.0.0)
-Requires-Dist: joserfc (>=1.6.1,<2.0.0)
+Requires-Dist: cryptography (>=46.0.5,<47.0.0)
+Requires-Dist: joserfc (>=1.6.3,<2.0.0)
 Requires-Dist: requests (>=2.32.5,<3.0.0)
 Requires-Dist: urllib3 (>=2.6.3,<3.0.0)
 Description-Content-Type: text/markdown
@@ -451,6 +451,16 @@ poetry publish
 
 ## Release Notes
 
+### 1.3.1 (May 4, 2026)
+- Updated dependencies
+
+### 1.3.0 (23 Mar, 2026)
+- **OpenID Connect Discovery Section 4.3 Compliance**: Implemented issuer validation to ensure the issuer value in the provider configuration matches the Issuer URL used to retrieve it
+  - Added validation that compares the issuer in `/.well-known/openid-configuration` response with the expected issuer URL
+  - Properly handles trailing slash normalisation per RFC 3986
+  - Throws descriptive exception when issuer mismatch is detected, stopping the flow as required by the specification
+  - Validates both fresh and cached issuer metadata
+
 ### 1.2.0 (Feb 11, 2026)
 - **New Feature: HTTP Response Cache** - Added in-memory LRU cache for HTTP responses to improve SDK performance
   - Caches participants registry, OIDC discovery documents, and JWKS endpoints

{rp_python_sdk-1.2.0 → rp_python_sdk-1.3.1}/README.md

@@ -430,6 +430,16 @@ poetry publish
 
 ## Release Notes
 
+### 1.3.1 (May 4, 2026)
+- Updated dependencies
+
+### 1.3.0 (23 Mar, 2026)
+- **OpenID Connect Discovery Section 4.3 Compliance**: Implemented issuer validation to ensure the issuer value in the provider configuration matches the Issuer URL used to retrieve it
+  - Added validation that compares the issuer in `/.well-known/openid-configuration` response with the expected issuer URL
+  - Properly handles trailing slash normalisation per RFC 3986
+  - Throws descriptive exception when issuer mismatch is detected, stopping the flow as required by the specification
+  - Validates both fresh and cached issuer metadata
+
 ### 1.2.0 (Feb 11, 2026)
 - **New Feature: HTTP Response Cache** - Added in-memory LRU cache for HTTP responses to improve SDK performance
   - Caches participants registry, OIDC discovery documents, and JWKS endpoints

{rp_python_sdk-1.2.0 → rp_python_sdk-1.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "1.2.0"
+version = "1.3.1"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -10,8 +10,8 @@ readme = "README.md"
 python = "^3.12"
 requests = "^2.32.5"
 authlib = "^1.6.6"
-cryptography = "^46.0.2"
-joserfc = "^1.6.1"
+cryptography = "^46.0.5"
+joserfc = "^1.6.3"
 cffi = "^2.0.0"
 urllib3 = "^2.6.3"
 
@@ -21,7 +21,7 @@ httpx = "^0.28.1"
 toml = "^0.10.2"
 
 [tool.poetry.group.dev.dependencies]
-black = "^26.0.0"
+black = "^26.3.1"
 pre-commit = "^4.5.1"
 mypy = "^1.19.1"
 requests-mock = "^1.12.1"

{rp_python_sdk-1.2.0 → rp_python_sdk-1.3.1}/rp_python_sdk/endpoints/get_participants.py

@@ -117,6 +117,17 @@ def get_auth_server_details(config: SdkConfig, authorisation_server_id: str, cac
     return result
 
 
+def _validate_issuer_match(discovery_url: str, actual_issuer: str) -> None:
+    well_known_suffix = "/.well-known/openid-configuration"
+    if well_known_suffix not in discovery_url or not actual_issuer:
+        return
+    expected_issuer = discovery_url[:discovery_url.index(well_known_suffix)]
+    if expected_issuer.rstrip("/") != actual_issuer.rstrip("/"):
+        raise RelyingPartyClientSdkException(
+            f"Issuer mismatch: discovery URL implies issuer '{expected_issuer}' "
+            f"but discovery document contains issuer '{actual_issuer}'")
+
+
 def get_issuer_metadata(authorisation_server: AuthorisationServer, cache: HttpCache) -> IssuerMetadata:
     url = authorisation_server.open_i_d_discovery_document
 
@@ -124,7 +135,9 @@ def get_issuer_metadata(authorisation_server: AuthorisationServer, cache: HttpCa
     cached = cache.get(url)
     if cached:
         logger.debug(f"Cache hit for URL: {url}")
-        return from_dict(IssuerMetadata, json.loads(cached))
+        metadata = from_dict(IssuerMetadata, json.loads(cached))
+        _validate_issuer_match(url, metadata.issuer)
+        return metadata
 
     logger.debug(f"Cache miss for URL: {url}")
 
@@ -137,7 +150,9 @@ def get_issuer_metadata(authorisation_server: AuthorisationServer, cache: HttpCa
         cache.put(url, response.text)
         logger.debug(f"Cached response for URL: {url}, size: {len(response.text)} bytes")
 
-        return from_dict(IssuerMetadata, json.loads(response.text))
+        metadata = from_dict(IssuerMetadata, json.loads(response.text))
+        _validate_issuer_match(url, metadata.issuer)
+        return metadata
 
     except requests.exceptions.HTTPError as http_err:
         raise RelyingPartyClientSdkException(

rp_python_sdk-1.3.1/rp_python_sdk/endpoints/util/version_info.py

@@ -0,0 +1,2 @@
+def get_version_info() -> str:
+    return "1.3.1"  # Version number

rp_python_sdk-1.2.0/rp_python_sdk/endpoints/util/version_info.py

@@ -1,2 +0,0 @@
-def get_version_info() -> str:
-    return "1.2.0"  # Version number