tba-bases-workload-identity 0.4.0.dev2__tar.gz

tba_bases_workload_identity-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,19 @@
+Metadata-Version: 2.4
+Name: tba-bases-workload-identity
+Version: 0.4.0.dev2
+Summary: Protocol-neutral workload reference, credential, verification, delegation, and trust-material bases.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-contracts-workload-identity (==0.4.0.dev2)
+Description-Content-Type: text/markdown
+
+# tba-bases-workload-identity
+
+Canonical bases are protocol neutral: reference resolution, credential provision and verification, delegated provision, and trust-material resolution. SPIFFE-named exports are temporary compatibility bases for existing providers.
+

tba_bases_workload_identity-0.4.0.dev2/README.md

@@ -0,0 +1,3 @@
+# tba-bases-workload-identity
+
+Canonical bases are protocol neutral: reference resolution, credential provision and verification, delegated provision, and trust-material resolution. SPIFFE-named exports are temporary compatibility bases for existing providers.

tba_bases_workload_identity-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,13 @@
+[project]
+name = "tba-bases-workload-identity"
+version = "0.4.0.dev2"
+description = "Protocol-neutral workload reference, credential, verification, delegation, and trust-material bases."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = ["tba-contracts-workload-identity==0.4.0.dev2"]
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+[tool.poetry]
+packages = [{ include = "tba_bases_workload_identity", from = "src" }]

tba_bases_workload_identity-0.4.0.dev2/src/tba_bases_workload_identity/__init__.py

@@ -0,0 +1,101 @@
+"""Reusable protocol-neutral workload-identity bases."""
+
+from abc import ABC
+
+from tba_contracts_workload_identity import (
+    DelegatedWorkloadCredentialProviderPort,
+    DelegatedWorkloadCredentialRequest,
+    ResolvedWorkload,
+    SpiffeId,
+    SpiffeTrustBundle,
+    Svid,
+    SvidProviderPort,
+    SvidVerifierPort,
+    TrustBundleProviderPort,
+    TrustDomain,
+    WorkloadCredential,
+    WorkloadCredentialProviderPort,
+    WorkloadCredentialRequest,
+    WorkloadCredentialSet,
+    WorkloadCredentialVerifierPort,
+    WorkloadIdentityRef,
+    WorkloadReference,
+    WorkloadReferenceResolverPort,
+    WorkloadTrustMaterial,
+    WorkloadTrustMaterialProviderPort,
+)
+
+
+class WorkloadReferenceResolverBase(WorkloadReferenceResolverPort, ABC):
+    def resolve(self, reference: WorkloadReference, /) -> ResolvedWorkload:
+        raise NotImplementedError
+
+
+class WorkloadCredentialProviderBase(WorkloadCredentialProviderPort, ABC):
+    def obtain(self, request: WorkloadCredentialRequest, /) -> WorkloadCredentialSet:
+        raise NotImplementedError
+
+
+class DelegatedWorkloadCredentialProviderBase(
+    DelegatedWorkloadCredentialProviderPort,
+    ABC,
+):
+    def obtain_for(
+        self,
+        request: DelegatedWorkloadCredentialRequest,
+        /,
+    ) -> WorkloadCredentialSet:
+        raise NotImplementedError
+
+
+class WorkloadCredentialVerifierBase(WorkloadCredentialVerifierPort, ABC):
+    def verify(
+        self,
+        credential: WorkloadCredential,
+        expected_identity: WorkloadIdentityRef | None = None,
+        /,
+    ) -> WorkloadIdentityRef:
+        raise NotImplementedError
+
+
+class WorkloadTrustMaterialProviderBase(
+    WorkloadTrustMaterialProviderPort,
+    ABC,
+):
+    def trust_material_for(
+        self,
+        identity: WorkloadIdentityRef,
+        format: str,
+        /,
+    ) -> WorkloadTrustMaterial:
+        raise NotImplementedError
+
+
+# Compatibility bases for the existing SPIFFE-named layer-20 providers. New
+# providers must implement the neutral bases above; these leave layer 05 after
+# those providers are migrated.
+class SvidProviderBase(SvidProviderPort, ABC):
+    def fetch_svid(self, audience: str | None = None, /) -> Svid:
+        raise NotImplementedError
+
+
+class SvidVerifierBase(SvidVerifierPort, ABC):
+    def verify_svid(self, svid: Svid, audience: str | None = None, /) -> SpiffeId:
+        raise NotImplementedError
+
+
+class TrustBundleProviderBase(TrustBundleProviderPort, ABC):
+    def bundle_for(self, trust_domain: TrustDomain, /) -> SpiffeTrustBundle:
+        raise NotImplementedError
+
+
+__all__ = [
+    "DelegatedWorkloadCredentialProviderBase",
+    "SvidProviderBase",
+    "SvidVerifierBase",
+    "TrustBundleProviderBase",
+    "WorkloadCredentialProviderBase",
+    "WorkloadCredentialVerifierBase",
+    "WorkloadReferenceResolverBase",
+    "WorkloadTrustMaterialProviderBase",
+]

tba_bases_workload_identity-0.4.0.dev2/src/tba_bases_workload_identity/py.typed

@@ -0,0 +1 @@
+