tba-concrete-dpop-confirmation-binding 0.4.0.dev2__py3-none-any.whl

tba_concrete_dpop_confirmation_binding/__init__.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+from hmac import compare_digest
+from typing import Any, Mapping
+
+from tba_contracts_identity.resource_server import (
+    AccessTokenClaims,
+    TokenValidationError,
+)
+from tba_bases_proof_of_possession import (
+    ConfirmationBindingValidatorBase,
+    ProofOfPossessionDomainBase,
+)
+from tba_contracts_security_trust import (
+    CapabilityMap,
+    DPoPBinding,
+    VerificationResult,
+    VerifyRequest,
+)
+
+
+def _cnf_from(value: AccessTokenClaims | Mapping[str, Any]) -> Mapping[str, Any]:
+    return value.cnf if isinstance(value, AccessTokenClaims) else value
+
+
+class DpopBindingValidator(ProofOfPossessionDomainBase):
+    """Compare a DPoP JWK thumbprint with the corresponding cnf member."""
+
+    confirmation_member = "jkt"
+
+    def supports(self) -> CapabilityMap:
+        return CapabilityMap(
+            ops={"verify": ("dpop",)},
+            modes=("dpop",),
+            features=("cnf-binding", "proof-of-possession"),
+        )
+
+    def validate_confirmation(
+        self, cnf: Mapping[str, Any], binding: DPoPBinding | None
+    ) -> bool:
+        expected = str(cnf.get(self.confirmation_member) or "").strip()
+        presented = str(getattr(binding, "jwk_thumbprint", "") or "").strip()
+        return (
+            binding is not None
+            and bool(expected)
+            and compare_digest(presented, expected)
+        )
+
+    async def verify(self, request: VerifyRequest) -> VerificationResult:
+        binding = request.context.get("binding")
+        cnf = request.context.get("cnf", {})
+        if not isinstance(cnf, Mapping):
+            return VerificationResult(
+                valid=False, reason="DPoP cnf context must be a mapping"
+            )
+        if not isinstance(binding, DPoPBinding):
+            return VerificationResult(valid=False, reason="missing DPoP binding")
+        valid = self.validate_confirmation(cnf, binding)
+        return VerificationResult(
+            valid=valid,
+            reason=None if valid else "DPoP binding mismatch",
+            claims=binding.confirmation_claim,
+            meta={"method": "dpop"},
+        )
+
+
+class DpopCnfBindingValidator(ConfirmationBindingValidatorBase):
+    """Validate DPoP confirmation material on access-token claims."""
+
+    def __init__(
+        self,
+        confirmation_member: str = "jkt",
+        *,
+        provider: DpopBindingValidator | None = None,
+    ) -> None:
+        self.provider = provider or DpopBindingValidator()
+        self.provider.confirmation_member = confirmation_member
+
+    def supports(self) -> CapabilityMap:
+        return CapabilityMap(ops={"confirmation-binding": ("dpop",)}, modes=("dpop",))
+
+    @property
+    def confirmation_member(self) -> str:
+        return self.provider.confirmation_member
+
+    def validate_confirmation(
+        self, cnf: Mapping[str, Any], binding: DPoPBinding | None
+    ) -> bool:
+        return self.provider.validate_confirmation(cnf, binding)
+
+    def validate(
+        self,
+        claims: AccessTokenClaims | Mapping[str, Any],
+        binding: DPoPBinding | None,
+    ) -> bool:
+        if not self.validate_confirmation(_cnf_from(claims), binding):
+            raise TokenValidationError("DPoP binding mismatch")
+        return True
+
+
+__all__ = ["DpopBindingValidator", "DpopCnfBindingValidator"]

tba_concrete_dpop_confirmation_binding/py.typed

@@ -0,0 +1 @@
+

tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,15 @@
+Metadata-Version: 2.4
+Name: tba-concrete-dpop-confirmation-binding
+Version: 0.4.0.dev2
+Summary: Deterministic DPoP confirmation binding validation.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-bases-proof-of-possession (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
+Requires-Dist: tba-contracts-security-trust (==0.1.0)

tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,5 @@
+tba_concrete_dpop_confirmation_binding/__init__.py,sha256=HPAf-UXLiQkKc70X0b7YqaKlutP_K0Fjt3S9JIVcCys,3313
+tba_concrete_dpop_confirmation_binding/py.typed,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
+tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/METADATA,sha256=18SZWUedujcGlHOUOHGVobd3Oj-142vjIqv15x47AsY,679
+tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/RECORD,,

tba_concrete_dpop_confirmation_binding-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any