tba-concrete-authorization-provenance 0.4.0.dev2__tar.gz

tba_concrete_authorization_provenance-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: tba-concrete-authorization-provenance
+Version: 0.4.0.dev2
+Summary: Deterministic authorization and delegation provenance builders.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-bases-security-provenance (==0.1.0)
+Requires-Dist: tba-contracts-security-trust (==0.1.0)
+Requires-Dist: tba-primitives-identity (==0.4.0.dev2)

tba_concrete_authorization_provenance-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,14 @@
+[project]
+name = "tba-concrete-authorization-provenance"
+version = "0.4.0.dev2"
+description = "Deterministic authorization and delegation provenance builders."
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = ["tba-primitives-identity==0.4.0.dev2", "tba-bases-security-provenance==0.1.0", "tba-contracts-security-trust==0.1.0"]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_concrete_authorization_provenance", from = "src" }]

tba_concrete_authorization_provenance-0.4.0.dev2/src/tba_concrete_authorization_provenance/__init__.py

@@ -0,0 +1,155 @@
+from __future__ import annotations
+
+from typing import Any, Mapping
+
+from tba_primitives_identity.json_canonicalization import canonical_hash, canonical_json
+from tba_bases_security_provenance import ProvenanceArtifactBuilderBase
+from tba_contracts_security_trust import (
+    AuthorizationDecisionTrace,
+    CapabilityMap,
+    DelegationProvenance,
+)
+
+
+def build_authorization_decision_trace(
+    *,
+    tenant_id: str | None,
+    subject: str,
+    issuer: str,
+    audience: str | list[str] | None,
+    resource: str | None,
+    scope: str | None,
+    subject_token_type: str,
+    requested_token_type: str,
+    exchange_mode: str,
+    actor_subject: str | None,
+    source_issuer: str | None,
+    sender_constraint: str,
+    verifier_logic_id: str | None = None,
+    required_claims: tuple[str, ...] = (),
+) -> dict[str, Any]:
+    request_view = {
+        "tenant_id": tenant_id or "",
+        "subject": subject,
+        "issuer": issuer,
+        "audience": audience,
+        "resource": resource,
+        "scope": scope or "",
+        "subject_token_type": subject_token_type,
+        "requested_token_type": requested_token_type,
+        "exchange_mode": exchange_mode,
+        "actor_subject": actor_subject or "",
+        "source_issuer": source_issuer or "",
+        "sender_constraint": sender_constraint,
+    }
+    derived_grant = {
+        "issuer": issuer,
+        "audience": audience,
+        "resource": resource,
+        "scope": scope or "",
+        "token_kind": "access",
+        "requested_token_type": requested_token_type,
+        "exchange_mode": exchange_mode,
+        "actor_subject": actor_subject or "",
+    }
+    policy_view = {
+        "verifier_logic_id": verifier_logic_id or "default-protected-resource-verifier",
+        "required_claims": list(required_claims),
+        "sender_constraint": sender_constraint,
+        "resource": resource,
+        "audience": audience,
+    }
+    request_hash = canonical_hash(request_view)
+    policy_hash = canonical_hash(policy_view)
+    derivation_hash = canonical_hash(derived_grant)
+    trace = AuthorizationDecisionTrace(
+        request_hash=request_hash,
+        policy_hash=policy_hash,
+        derivation_hash=derivation_hash,
+        decision_key=canonical_hash(
+            {
+                "request_hash": request_hash,
+                "policy_hash": policy_hash,
+                "derivation_hash": derivation_hash,
+            }
+        ),
+        request=request_view,
+        derived_grant=derived_grant,
+    )
+    return trace.as_dict()
+
+
+def build_delegation_provenance(
+    *,
+    subject_token: str,
+    actor_token: str | None,
+    subject_claims: Mapping[str, Any],
+    actor_claims: Mapping[str, Any] | None,
+    authorization_trace: Mapping[str, Any],
+    audience: str | list[str] | None,
+    resource: str | None,
+    exchange_mode: str,
+    sender_constraint: str,
+) -> dict[str, Any]:
+    subject_token_hash = canonical_hash({"token": subject_token})
+    actor_token_hash = canonical_hash({"token": actor_token}) if actor_token else None
+    nodes = {
+        "subject": {
+            "sub": str(subject_claims.get("sub") or ""),
+            "iss": str(subject_claims.get("iss") or ""),
+            "aud": subject_claims.get("aud"),
+        },
+        "actor": {
+            "sub": str((actor_claims or {}).get("sub") or ""),
+            "iss": str((actor_claims or {}).get("iss") or ""),
+        }
+        if actor_claims
+        else None,
+    }
+    edge = {
+        "exchange_mode": exchange_mode,
+        "audience": audience,
+        "resource": resource,
+        "sender_constraint": sender_constraint,
+        "decision_key": authorization_trace.get("decision_key"),
+        "subject_token_hash": subject_token_hash,
+        "actor_token_hash": actor_token_hash,
+    }
+    provenance = DelegationProvenance(
+        lineage_id=canonical_hash({"nodes": nodes, "edge": edge}),
+        subject_token_hash=subject_token_hash,
+        actor_token_hash=actor_token_hash,
+        nodes=nodes,
+        edge=edge,
+    )
+    return provenance.as_dict()
+
+
+class DeterministicProvenanceArtifactBuilder(ProvenanceArtifactBuilderBase):
+    """Build authorization and delegation provenance without environmental I/O."""
+
+    def supports(self) -> CapabilityMap:
+        return CapabilityMap(
+            ops={
+                "build_authorization_decision_trace": ("deterministic",),
+                "build_delegation_provenance": ("deterministic",),
+            },
+            features=("authorization-provenance", "delegation-lineage"),
+        )
+
+    def build_authorization_decision_trace(self, **kwargs: Any) -> dict[str, Any]:
+        return build_authorization_decision_trace(**kwargs)
+
+    def build_delegation_provenance(self, **kwargs: Any) -> dict[str, Any]:
+        return build_delegation_provenance(**kwargs)
+
+
+__all__ = [
+    "AuthorizationDecisionTrace",
+    "DelegationProvenance",
+    "DeterministicProvenanceArtifactBuilder",
+    "build_authorization_decision_trace",
+    "build_delegation_provenance",
+    "canonical_hash",
+    "canonical_json",
+]

tba_concrete_authorization_provenance-0.4.0.dev2/src/tba_concrete_authorization_provenance/py.typed

@@ -0,0 +1 @@
+