subnoto-api-client 0.0.99__py3-none-manylinux2014_x86_64.whl

subnoto_api_client/generated/models/post_public_workspace_list_response_500_error.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import Any, TypeVar
+
+from attrs import define as _attrs_define
+
+from ..models.post_public_workspace_list_response_500_error_code import (
+    PostPublicWorkspaceListResponse500ErrorCode,
+)
+
+T = TypeVar("T", bound="PostPublicWorkspaceListResponse500Error")
+
+
+@_attrs_define
+class PostPublicWorkspaceListResponse500Error:
+    """
+    Attributes:
+        code (PostPublicWorkspaceListResponse500ErrorCode): The error code
+        message (str): The error message
+        suggestion (str): A suggestion to resolve the error
+        documentation_url (str): A URL to the documentation
+    """
+
+    code: PostPublicWorkspaceListResponse500ErrorCode
+    message: str
+    suggestion: str
+    documentation_url: str
+
+    def to_dict(self) -> dict[str, Any]:
+        code = self.code.value
+
+        message = self.message
+
+        suggestion = self.suggestion
+
+        documentation_url = self.documentation_url
+
+        field_dict: dict[str, Any] = {}
+
+        field_dict.update(
+            {
+                "code": code,
+                "message": message,
+                "suggestion": suggestion,
+                "documentationUrl": documentation_url,
+            }
+        )
+
+        return field_dict
+
+    @classmethod
+    def from_dict(cls: type[T], src_dict: Mapping[str, Any]) -> T:
+        d = dict(src_dict)
+        code = PostPublicWorkspaceListResponse500ErrorCode(d.pop("code"))
+
+        message = d.pop("message")
+
+        suggestion = d.pop("suggestion")
+
+        documentation_url = d.pop("documentationUrl")
+
+        post_public_workspace_list_response_500_error = cls(
+            code=code,
+            message=message,
+            suggestion=suggestion,
+            documentation_url=documentation_url,
+        )
+
+        return post_public_workspace_list_response_500_error

subnoto_api_client/generated/models/post_public_workspace_list_response_500_error_code.py

@@ -0,0 +1,9 @@
+from enum import Enum
+
+
+class PostPublicWorkspaceListResponse500ErrorCode(str, Enum):
+    INTERNAL_SERVER_ERROR = "INTERNAL_SERVER_ERROR"
+    INVALID_REQUEST_FORMAT = "INVALID_REQUEST_FORMAT"
+
+    def __str__(self) -> str:
+        return str(self.value)

subnoto_api_client/generated/types.py

@@ -0,0 +1,54 @@
+"""Contains some shared types for properties"""
+
+from collections.abc import Mapping, MutableMapping
+from http import HTTPStatus
+from typing import IO, BinaryIO, Generic, Literal, TypeVar
+
+from attrs import define
+
+
+class Unset:
+    def __bool__(self) -> Literal[False]:
+        return False
+
+
+UNSET: Unset = Unset()
+
+# The types that `httpx.Client(files=)` can accept, copied from that library.
+FileContent = IO[bytes] | bytes | str
+FileTypes = (
+    # (filename, file (or bytes), content_type)
+    tuple[str | None, FileContent, str | None]
+    # (filename, file (or bytes), content_type, headers)
+    | tuple[str | None, FileContent, str | None, Mapping[str, str]]
+)
+RequestFiles = list[tuple[str, FileTypes]]
+
+
+@define
+class File:
+    """Contains information for file uploads"""
+
+    payload: BinaryIO
+    file_name: str | None = None
+    mime_type: str | None = None
+
+    def to_tuple(self) -> FileTypes:
+        """Return a tuple representation that httpx will accept for multipart/form-data"""
+        return self.file_name, self.payload, self.mime_type
+
+
+T = TypeVar("T")
+
+
+@define
+class Response(Generic[T]):
+    """A response from an endpoint"""
+
+    status_code: HTTPStatus
+    content: bytes
+    headers: MutableMapping[str, str]
+    parsed: T | None
+
+
+__all__ = ["UNSET", "File", "FileTypes", "RequestFiles", "Response", "Unset"]

subnoto_api_client/middleware/__init__.py

@@ -0,0 +1,15 @@
+# Copyright 2025 Subnoto
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+

subnoto_api_client/middleware/signature_utils.py

@@ -0,0 +1,128 @@
+# Copyright 2025 Subnoto
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+"""
+HTTP signature utilities for signing requests (RFC 9421)
+
+Uses http-message-signatures library (RFC 9421 implementation)
+"""
+
+import base64
+import hashlib
+import time
+from typing import Dict
+
+from http_message_signatures import HTTPMessageSigner, HTTPSignatureKeyResolver, algorithms
+from http_message_signatures import http_sfv
+
+
+class SubnotoHTTPSignatureKeyResolver(HTTPSignatureKeyResolver):
+    """Key resolver for Subnoto API signatures"""
+    
+    def __init__(self, access_key: str, secret_key: str):
+        self.access_key = access_key
+        self.secret_key_bytes = bytes.fromhex(secret_key)
+    
+    def resolve_private_key(self, key_id: str):
+        if key_id == self.access_key:
+            return self.secret_key_bytes
+        return None
+
+
+def sign_request_headers(
+    url: str,
+    method: str,
+    body_content: bytes,
+    access_key: str,
+    secret_key: str,
+    existing_headers: Dict[str, str]
+) -> Dict[str, str]:
+    """
+    Generate HTTP signature headers for a request using RFC 9421
+    
+    Returns a dictionary of headers to add to the request, including:
+    - X-Timestamp
+    - Digest (legacy)
+    - Content-Digest (RFC 9530)
+    - Content-Type
+    - Content-Length
+    - Signature-Input
+    - Signature
+    """
+    # Generate digests
+    sha256_hash = hashlib.sha256(body_content).digest()
+    digest_base64 = base64.b64encode(sha256_hash).decode("utf-8")
+    
+    # Legacy Digest header (for compatibility)
+    digest = f"SHA-256={digest_base64}"
+    
+    # RFC 9530 Content-Digest header (using http_sfv for proper formatting)
+    content_digest_dict = http_sfv.Dictionary({"sha-256": sha256_hash})
+    content_digest = str(content_digest_dict)
+    
+    # Timestamp
+    timestamp = str(int(time.time() * 1000))
+    
+    # Get content type from existing headers (case-insensitive)
+    content_type = "application/json"
+    for k, v in existing_headers.items():
+        if k.lower() == "content-type":
+            content_type = v
+            break
+    
+    # Build headers dict
+    headers = {
+        "X-Timestamp": timestamp,
+        "Digest": digest,
+        "Content-Digest": content_digest,
+        "Content-Type": content_type,
+        "Content-Length": str(len(body_content)),
+    }
+    
+    # Simple object for the signing library (modifies headers in place)
+    class SignableRequest:
+        pass
+    
+    request = SignableRequest()
+    request.method = method
+    request.url = url
+    request.headers = headers
+    request.body = body_content
+    
+    # Sign the request
+    key_resolver = SubnotoHTTPSignatureKeyResolver(access_key, secret_key)
+    signer = HTTPMessageSigner(
+        signature_algorithm=algorithms.HMAC_SHA256,
+        key_resolver=key_resolver
+    )
+    signer.sign(
+        request,
+        key_id=access_key,
+        covered_component_ids=(
+            "x-timestamp",
+            "@authority",
+            "content-type",
+            "content-digest",
+            "content-length"
+        )
+    )
+    
+    # Replace "pyhms" label with "team"
+    if "Signature" in headers:
+        headers["Signature"] = headers["Signature"].replace("pyhms=", "team=")
+    if "Signature-Input" in headers:
+        headers["Signature-Input"] = headers["Signature-Input"].replace("pyhms=", "team=")
+    
+    return headers

subnoto_api_client/middleware/tunnel.py

@@ -0,0 +1,119 @@
+# Copyright 2025 Subnoto
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+from typing import TYPE_CHECKING
+
+import httpx
+
+from ..types import SubnotoError
+
+if TYPE_CHECKING:
+    from ..session import SessionManager
+
+
+def create_tunnel_middleware(session_manager: "SessionManager"):
+    """Create tunnel encryption/decryption middleware"""
+    
+    async def encrypt_request(request: "httpx.Request") -> None:
+        """Encrypt request body before sending"""
+        url = str(request.url)
+        
+        # Skip if not targeting the enclave API
+        if "/tunnel/" not in url and "/public/" not in url:
+            return
+        
+        # Skip tunnel handshake endpoint itself
+        if "/tunnel/session" in url:
+            return
+        
+        # Ensure session is established
+        await session_manager.ensure_session()
+        
+        # Get request body
+        body_content = request.content
+        if not body_content or len(body_content) == 0:
+            raise SubnotoError("EMPTY_REQUEST_BODY")
+        
+        # Encrypt the request body
+        encrypted_message = session_manager.encrypt_request(body_content)
+        
+        if not encrypted_message or len(encrypted_message) == 0:
+            raise SubnotoError("Empty encrypted message")
+        
+        # Get session ID
+        session_id = session_manager.get_session_id()
+        if not session_id:
+            raise SubnotoError("Session ID not available")
+        
+        # Update headers
+        request.headers["X-Session-Id"] = session_id
+        request.headers["Content-Type"] = "application/octet-stream"
+        
+        # Remove old Content-Length so httpx recalculates it
+        if "Content-Length" in request.headers:
+            del request.headers["Content-Length"]
+        
+        # Add cookies if available
+        cookies = session_manager._get_cookies_for_request(url)
+        if cookies:
+            request.headers["Cookie"] = cookies
+        
+        # Update request content using stream - httpx handles Content-Length
+        request.stream = httpx.ByteStream(encrypted_message)
+    
+    async def decrypt_response(response: "httpx.Response") -> None:
+        """Decrypt response body after receiving"""
+        url = str(response.request.url)
+        
+        # Skip if not targeting the enclave API
+        if "/tunnel/" not in url and "/public/" not in url:
+            return
+        
+        # Skip tunnel handshake endpoint itself
+        if "/tunnel/session" in url:
+            return
+        
+        # Check if response is encrypted
+        is_encrypted = (
+            response.headers.get("x-subnoto-encrypted-response") == "true"
+            and response.headers.get("content-type") == "application/octet-stream"
+        )
+        
+        if not is_encrypted:
+            # Return as-is if not encrypted
+            return
+        
+        # Get encrypted data
+        encrypted_data = response.content
+        
+        if len(encrypted_data) == 0:
+            raise SubnotoError("Empty encrypted response")
+        
+        # Decrypt the response
+        decrypted_data = session_manager.decrypt_response(encrypted_data)
+        
+        # Replace response content with decrypted data
+        # Note: httpx.Response is immutable, so we need to modify the stream
+        # This is a workaround - in practice, we may need to return a new response
+        response._content = decrypted_data
+        response.headers["Content-Type"] = "application/json"
+        if "x-subnoto-encrypted-response" in response.headers:
+            del response.headers["x-subnoto-encrypted-response"]
+    
+    return {
+        "request": encrypt_request,
+        "response": decrypt_response
+    }
+

subnoto_api_client/session.py

@@ -0,0 +1,239 @@
+# Copyright 2025 Subnoto
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import asyncio
+from http.cookiejar import Cookie, CookieJar
+from typing import Optional
+from urllib.parse import urlparse
+
+import httpx
+
+try:
+    from oak_py_sdk.oak_client import PyClientSession
+except ImportError as e:
+    raise ImportError(
+        f"oak_client module not found: {e}\n"
+        "Make sure oak_py_sdk is built:\n"
+        "  eval \"$(direnv export bash)\" && bazel build //oak_py_sdk:oak_client"
+    )
+
+from .types import SubnotoConfig, SubnotoError
+
+
+class SessionManager:
+    """Manages Oak session encryption using PyO3 bindings from oak_py_sdk"""
+    
+    def __init__(self, config: SubnotoConfig, http_client: Optional[httpx.AsyncClient] = None):
+        self.config = config
+        self.session_id: Optional[str] = None
+        self.handshake_in_progress = False
+        self.cookie_jar = CookieJar()
+        self.http_client = http_client  # Use provided client for handshake (with signatures)
+        
+        # Create Oak client session using PyO3
+        self._session = PyClientSession(
+            unattested=config.unattested,
+            attester_key=config.attester_key
+        )
+    
+    def _is_session_open(self) -> bool:
+        """Check if the session is open"""
+        return self._session.is_open()
+    
+    async def ensure_session(self) -> None:
+        """Ensure session is established, performing handshake if needed"""
+        if self._is_session_open():
+            return
+        
+        if self.handshake_in_progress:
+            # Wait for existing handshake
+            while self.handshake_in_progress:
+                await asyncio.sleep(0.05)
+            return
+        
+        await self._handshake()
+    
+    async def _handshake(self) -> None:
+        """Perform the Oak session handshake"""
+        self.handshake_in_progress = True
+        
+        try:
+            max_steps = 4
+            step = 0
+            
+            while not self._is_session_open() and step < max_steps:
+                step += 1
+                
+                # Get outgoing handshake message
+                outgoing = self._session.get_outgoing_message()
+                if not outgoing:
+                    break
+                
+                if self._is_session_open():
+                    break
+                
+                # Send to server
+                url = f"{self.config.api_base_url}/tunnel/session"
+                headers = {"Content-Type": "application/octet-stream"}
+                
+                if self.session_id:
+                    headers["X-Session-Id"] = self.session_id
+                
+                # Add cookies
+                cookies_str = self._get_cookies_for_request(url)
+                if cookies_str:
+                    headers["Cookie"] = cookies_str
+                
+                # Use provided client if available (has signatures), otherwise create new one
+                if self.http_client:
+                    response = await self.http_client.post(
+                        url,
+                        content=outgoing,
+                        headers=headers
+                    )
+                else:
+                    async with httpx.AsyncClient() as client:
+                        response = await client.post(
+                            url,
+                            content=outgoing,
+                            headers=headers
+                        )
+                
+                # Extract session ID from first response
+                if not self.session_id:
+                    session_id_header = response.headers.get("X-Session-Id")
+                    if not session_id_header:
+                        raise SubnotoError("No session ID received from server")
+                    self.session_id = session_id_header
+                
+                if not response.is_success:
+                    error_text = response.text
+                    raise SubnotoError(
+                        f"Handshake failed with status {response.status_code}: {error_text}",
+                        response.status_code
+                    )
+                
+                # Store cookies
+                self._store_cookies(response, url)
+                
+                # Process response
+                response_data = response.content
+                if len(response_data) > 0:
+                    self._session.put_incoming_message(bytes(response_data))
+                else:
+                    raise SubnotoError("Empty response from server during handshake")
+            
+            if not self._is_session_open() or not self.session_id:
+                raise SubnotoError("Failed to establish session after handshake")
+        
+        finally:
+            self.handshake_in_progress = False
+    
+    def encrypt_request(self, plaintext: bytes) -> bytes:
+        """Encrypt a request body"""
+        if not self._is_session_open():
+            raise SubnotoError("Session not open")
+        
+        try:
+            # PyClientSession.write expects string, returns bytes
+            plaintext_str = plaintext.decode('utf-8')
+            self._session.write(plaintext_str)
+            
+            # Get the encrypted message
+            encrypted = self._session.get_outgoing_message()
+            if not encrypted:
+                raise SubnotoError("No encrypted message available")
+            
+            return encrypted
+        except Exception as e:
+            raise SubnotoError(f"Encryption failed: {e}")
+    
+    def decrypt_response(self, encrypted: bytes) -> bytes:
+        """Decrypt a response body"""
+        if not self._is_session_open():
+            raise SubnotoError("Session not open")
+        
+        try:
+            # Put the encrypted response into the session
+            self._session.put_incoming_message(encrypted)
+            
+            # Read the decrypted plaintext
+            decrypted_str = self._session.read()
+            if decrypted_str is None:
+                raise SubnotoError("No decrypted message available")
+            
+            return decrypted_str.encode('utf-8')
+        except Exception as e:
+            raise SubnotoError(f"Decryption failed: {e}")
+    
+    def get_session_id(self) -> Optional[str]:
+        """Get the current session ID"""
+        return self.session_id
+    
+    def _get_cookies_for_request(self, url: str) -> str:
+        """Get cookies for a request URL"""
+        from urllib.request import Request as UrllibRequest
+        request = UrllibRequest(url)
+        self.cookie_jar.add_cookie_header(request)
+        return request.get_header("Cookie", "")
+    
+    def _store_cookies(self, response: httpx.Response, url: str) -> None:
+        """Store cookies from a response"""
+        # Extract Set-Cookie headers and add to jar
+        for cookie_str in response.headers.get_list("set-cookie"):
+            # Parse cookie string into Cookie object
+            try:
+                # Simple parsing - in production might want to use http.cookies
+                parts = cookie_str.split(';')[0].split('=', 1)
+                if len(parts) == 2:
+                    name, value = parts
+                    parsed_url = urlparse(url)
+                    cookie = Cookie(
+                        version=0,
+                        name=name.strip(),
+                        value=value.strip(),
+                        port=None,
+                        port_specified=False,
+                        domain=parsed_url.netloc,
+                        domain_specified=True,
+                        domain_initial_dot=False,
+                        path='/',
+                        path_specified=True,
+                        secure=False,
+                        expires=None,
+                        discard=True,
+                        comment=None,
+                        comment_url=None,
+                        rest={},
+                        rfc2109=False
+                    )
+                    self.cookie_jar.set_cookie(cookie)
+            except Exception:
+                pass  # Skip malformed cookies
+    
+    def destroy(self) -> None:
+        """Destroy the session"""
+        self._session = None
+        self.session_id = None
+    
+    def get_attestation_results(self) -> Optional[str]:
+        """Get attestation results as JSON string"""
+        # PyClientSession doesn't expose this yet
+        return None
+    
+    def get_attestation_status(self) -> Optional[str]:
+        """Get attestation status as JSON string"""
+        # PyClientSession doesn't expose this yet
+        return None