tba-concrete-svid 0.4.0.dev2__tar.gz

tba_concrete_svid-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,14 @@
+Metadata-Version: 2.4
+Name: tba-concrete-svid
+Version: 0.4.0.dev2
+Summary: Deterministic SPIFFE ID and SVID structures.
+License-Expression: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-concrete-jose (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)

tba_concrete_svid-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,14 @@
+[project]
+name = "tba-concrete-svid"
+version = "0.4.0.dev2"
+description = "Deterministic SPIFFE ID and SVID structures."
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+dependencies = ["tba-contracts-identity==0.4.0.dev2", "tba-concrete-jose==0.4.0.dev2"]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_concrete_svid", from = "src" }]

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/__init__.py

@@ -0,0 +1,13 @@
+from .jwt_svid import JwtSvidClaimSetPayload, parse_jwt_svid_claims
+from .selectors import normalize_selectors
+from .spiffe_ids import normalize_spiffe_id
+from .x509_svid import X509SvidStructure, validate_x509_svid_structure
+
+__all__ = [
+    "JwtSvidClaimSetPayload",
+    "X509SvidStructure",
+    "normalize_selectors",
+    "normalize_spiffe_id",
+    "parse_jwt_svid_claims",
+    "validate_x509_svid_structure",
+]

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/jwt_svid.py

@@ -0,0 +1,34 @@
+from dataclasses import dataclass
+from typing import Mapping
+
+from .spiffe_ids import normalize_spiffe_id
+
+
+@dataclass(frozen=True, slots=True)
+class JwtSvidClaimSetPayload:
+    subject: str
+    audience: tuple[str, ...]
+    expiration: int
+
+
+def parse_jwt_svid_claims(claims: Mapping[str, object]) -> JwtSvidClaimSetPayload:
+    subject, audience, expiration = (
+        claims.get("sub"),
+        claims.get("aud"),
+        claims.get("exp"),
+    )
+    if not isinstance(subject, str):
+        raise ValueError("JWT-SVID requires a SPIFFE ID subject")
+    normalize_spiffe_id(subject)
+    if isinstance(audience, str):
+        audience = (audience,)
+    elif isinstance(audience, list) and all(isinstance(item, str) for item in audience):
+        audience = tuple(audience)
+    if not isinstance(audience, tuple) or not audience or not all(audience):
+        raise ValueError("JWT-SVID requires a non-empty audience")
+    if not isinstance(expiration, int) or isinstance(expiration, bool):
+        raise ValueError("JWT-SVID requires NumericDate exp")
+    return JwtSvidClaimSetPayload(subject, audience, expiration)
+
+
+__all__ = ["JwtSvidClaimSetPayload", "parse_jwt_svid_claims"]

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/py.typed

@@ -0,0 +1 @@
+

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/selectors.py

@@ -0,0 +1,19 @@
+from collections.abc import Iterable
+
+from tba_contracts_identity.workloads import WorkloadSelector
+
+
+def normalize_selectors(
+    selectors: Iterable[WorkloadSelector],
+) -> tuple[WorkloadSelector, ...]:
+    normalized = tuple(
+        sorted(set(selectors), key=lambda item: (item.selector_type, item.value))
+    )
+    if not normalized or any(
+        not item.selector_type or not item.value for item in normalized
+    ):
+        raise ValueError("workload selectors must be non-empty")
+    return normalized
+
+
+__all__ = ["normalize_selectors"]

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/spiffe_ids.py

@@ -0,0 +1,13 @@
+from tba_contracts_identity.workloads import SpiffeId
+
+
+def normalize_spiffe_id(value: str | SpiffeId) -> SpiffeId:
+    parsed = SpiffeId.parse(value) if isinstance(value, str) else value
+    if parsed.path == "/" or "//" in parsed.path or parsed.path.endswith("/"):
+        raise ValueError(
+            "SPIFFE workload path must identify a non-root normalized workload"
+        )
+    return parsed
+
+
+__all__ = ["normalize_spiffe_id"]

tba_concrete_svid-0.4.0.dev2/src/tba_concrete_svid/x509_svid.py

@@ -0,0 +1,23 @@
+from dataclasses import dataclass
+
+from .spiffe_ids import normalize_spiffe_id
+
+
+@dataclass(frozen=True, slots=True)
+class X509SvidStructure:
+    uri_sans: tuple[str, ...]
+    dns_sans: tuple[str, ...] = ()
+    key_usage_digital_signature: bool = True
+    is_ca: bool = False
+
+
+def validate_x509_svid_structure(value: X509SvidStructure):
+    if len(value.uri_sans) != 1:
+        raise ValueError("X.509-SVID requires exactly one SPIFFE ID URI SAN")
+    spiffe_id = normalize_spiffe_id(value.uri_sans[0])
+    if value.is_ca or not value.key_usage_digital_signature:
+        raise ValueError("X.509-SVID leaf must be non-CA and permit digital signatures")
+    return spiffe_id
+
+
+__all__ = ["X509SvidStructure", "validate_x509_svid_structure"]