tba-protocol-attestation-eat 0.4.0.dev2__tar.gz

tba_protocol_attestation_eat-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,19 @@
+Metadata-Version: 2.4
+Name: tba-protocol-attestation-eat
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-concrete-claim-eat-nonce (==0.4.0.dev2)
+Requires-Dist: tba-concrete-claim-eat-profile (==0.4.0.dev2)
+Requires-Dist: tba-concrete-claim-eat-submodules (==0.4.0.dev2)
+Requires-Dist: tba-concrete-claim-issued-at (==0.4.0.dev2)
+Requires-Dist: tba-concrete-claim-ueid (==0.4.0.dev2)
+Requires-Dist: tba-concrete-eat (==0.4.0.dev2)
+Requires-Dist: tba-concrete-eat-evidence (==0.4.0.dev2)
+Requires-Dist: tba-contracts-identity (==0.4.0.dev2)

tba_protocol_attestation_eat-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name="tba-protocol-attestation-eat"
+version="0.4.0.dev2"
+requires-python=">=3.10,<3.15"
+dependencies=["tba-concrete-eat==0.4.0.dev2","tba-contracts-identity==0.4.0.dev2","tba-concrete-eat-evidence==0.4.0.dev2","tba-concrete-claim-eat-profile==0.4.0.dev2","tba-concrete-claim-eat-nonce==0.4.0.dev2","tba-concrete-claim-ueid==0.4.0.dev2","tba-concrete-claim-eat-submodules==0.4.0.dev2","tba-concrete-claim-issued-at==0.4.0.dev2"]
+[build-system]
+requires=["poetry-core>=1.0.0"]
+build-backend="poetry.core.masonry.api"
+[tool.poetry]
+packages=[{include="tba_protocol_attestation_eat",from="src"}]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/__init__.py

@@ -0,0 +1,71 @@
+from .bindings import CAPABILITY_REQUIREMENTS
+from .claims import (
+    EAT_CLAIM_CLASSES,
+    EatClaimSetPayload,
+    EatEncoding,
+    compose_eat_claim_set,
+    parse_eat_claims,
+)
+from .profiles import EatProfile
+from .submodules import EatSubmodule, parse_submodules
+from .validation import parse_eat, validate_eat_claims
+from .compatibility import COMPATIBILITY_PATHS, EatCompatibility, compatibility
+from .errors import EatProfileBindingError, EatProtocolError, UnsupportedEatCarrierError
+from .features import FEATURES_BY_VERSION, supports
+from .migrations import migrate_claims
+from .schemas import (
+    EAT_CARRIERS,
+    EAT_CWT_CARRIER,
+    EAT_JWT_CARRIER,
+    EatCarrier,
+    select_carrier,
+)
+from .versions import CURRENT_VERSION, VERSION_HISTORY, EatVersion, select_version
+from tba_contracts_identity.protocol_processing import (
+    build_protocol_capability_report as _build_protocol_capability_report,
+)
+
+
+def capability_report() -> dict[str, object]:
+    return _build_protocol_capability_report(
+        protocol="eat",
+        revision=CURRENT_VERSION.identifier,
+        features=tuple(FEATURES_BY_VERSION[CURRENT_VERSION.identifier]),
+        evidence_links=("tests/unit/test_versioned_eat_sd_jwt_vc_profiles.py",),
+        extra_requirements=CAPABILITY_REQUIREMENTS,
+        include_default_artifact_requirements=False,
+    )
+
+
+__all__ = [
+    "CAPABILITY_REQUIREMENTS",
+    "COMPATIBILITY_PATHS",
+    "CURRENT_VERSION",
+    "EAT_CARRIERS",
+    "EAT_CLAIM_CLASSES",
+    "EatClaimSetPayload",
+    "EatEncoding",
+    "EatProfile",
+    "EatSubmodule",
+    "EAT_CWT_CARRIER",
+    "EAT_JWT_CARRIER",
+    "FEATURES_BY_VERSION",
+    "VERSION_HISTORY",
+    "EatCarrier",
+    "EatCompatibility",
+    "EatProfileBindingError",
+    "EatProtocolError",
+    "EatVersion",
+    "UnsupportedEatCarrierError",
+    "capability_report",
+    "compatibility",
+    "compose_eat_claim_set",
+    "migrate_claims",
+    "parse_eat",
+    "parse_eat_claims",
+    "parse_submodules",
+    "select_carrier",
+    "select_version",
+    "supports",
+    "validate_eat_claims",
+]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/bindings.py

@@ -0,0 +1,48 @@
+"""RFC 9711 wire elements mapped to reportable capabilities."""
+
+from tba_contracts_identity.capabilities import ProtocolCapabilityRequirement
+
+from .versions import CURRENT_VERSION
+
+CAPABILITY_REQUIREMENTS = (
+    ProtocolCapabilityRequirement(
+        "eat",
+        CURRENT_VERSION.identifier,
+        "eat-protected-token-verification",
+        "application/eat+jwt application/eat+cwt",
+        "attestation.appraisal",
+        "verify_evidence",
+        "attestation-evidence",
+    ),
+    ProtocolCapabilityRequirement(
+        "eat",
+        CURRENT_VERSION.identifier,
+        "eat-reference-backed-appraisal",
+        "eat_profile",
+        "attestation.appraisal",
+        "appraise",
+        "verified-attestation-evidence",
+    ),
+    ProtocolCapabilityRequirement(
+        "eat",
+        CURRENT_VERSION.identifier,
+        "eat-reference-resolution",
+        "eat_profile",
+        "attestation.appraisal",
+        "resolve_reference_material",
+        "attestation-reference-manifest",
+        required=False,
+    ),
+    ProtocolCapabilityRequirement(
+        "eat",
+        CURRENT_VERSION.identifier,
+        "eat-appraisal-recording",
+        "appraisal-result",
+        "attestation.appraisal",
+        "record_result",
+        "attestation-result",
+        required=False,
+    ),
+)
+
+__all__ = ["CAPABILITY_REQUIREMENTS"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/claims.py

@@ -0,0 +1,17 @@
+"""Versioned EAT protocol exports backed by deterministic layer-10 claims."""
+
+from tba_concrete_eat.claims import (
+    EAT_CLAIM_CLASSES,
+    EatClaimSetPayload,
+    EatEncoding,
+    compose_eat_claim_set,
+    parse_eat_claims,
+)
+
+__all__ = [
+    "EAT_CLAIM_CLASSES",
+    "EatClaimSetPayload",
+    "EatEncoding",
+    "compose_eat_claim_set",
+    "parse_eat_claims",
+]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/compatibility.py

@@ -0,0 +1,27 @@
+"""Supported EAT revision compatibility paths."""
+
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class EatCompatibility:
+    source: str
+    target: str
+    compatible: bool
+    migration_required: bool
+
+
+COMPATIBILITY_PATHS = (
+    EatCompatibility("RFC9711", "RFC9711", True, False),
+    EatCompatibility("draft-ietf-rats-eat-30", "RFC9711", True, True),
+)
+
+
+def compatibility(source: str, target: str = "RFC9711") -> EatCompatibility:
+    for path in COMPATIBILITY_PATHS:
+        if path.source == source and path.target == target:
+            return path
+    return EatCompatibility(source, target, False, False)
+
+
+__all__ = ["COMPATIBILITY_PATHS", "EatCompatibility", "compatibility"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/errors.py

@@ -0,0 +1,20 @@
+"""EAT protocol mapping errors."""
+
+
+class EatProtocolError(ValueError):
+    """Base error for an RFC 9711 mapping failure."""
+
+
+class UnsupportedEatCarrierError(EatProtocolError):
+    """Raised when neither the EAT JWT nor EAT CWT carrier applies."""
+
+
+class EatProfileBindingError(EatProtocolError):
+    """Raised when the authenticated profile and evidence profile differ."""
+
+
+__all__ = [
+    "EatProfileBindingError",
+    "EatProtocolError",
+    "UnsupportedEatCarrierError",
+]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/features.py

@@ -0,0 +1,26 @@
+FEATURES_BY_VERSION = {
+    "draft-ietf-rats-eat-30": frozenset(
+        {"jwt", "cwt", "eat-profile", "nonce", "submodules"}
+    ),
+    "RFC9711": frozenset(
+        {
+            "jwt",
+            "cwt",
+            "eat-profile",
+            "nonce",
+            "submodules",
+            "detached-bundles",
+            "nested-tokens",
+        }
+    ),
+}
+
+
+def supports(feature: str, version: str = "RFC9711") -> bool:
+    try:
+        return feature in FEATURES_BY_VERSION[version]
+    except KeyError as exc:
+        raise ValueError(f"unsupported EAT version: {version}") from exc
+
+
+__all__ = ["FEATURES_BY_VERSION", "supports"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/migrations.py

@@ -0,0 +1,16 @@
+from typing import Any, Mapping
+
+
+def migrate_claims(
+    value: Mapping[str | int, Any], *, source: str, target: str = "RFC9711"
+) -> dict[str | int, Any]:
+    if source == target:
+        return dict(value)
+    if source != "draft-ietf-rats-eat-30" or target != "RFC9711":
+        raise ValueError(f"unsupported EAT migration: {source} -> {target}")
+    if "eat_profile" not in value and 265 not in value:
+        raise ValueError("EAT migration requires an explicit eat_profile")
+    return dict(value)
+
+
+__all__ = ["migrate_claims"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/profiles.py

@@ -0,0 +1,5 @@
+"""Versioned EAT protocol export for the deterministic profile value."""
+
+from tba_concrete_eat.profiles import EatProfile
+
+__all__ = ["EatProfile"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/schemas.py

@@ -0,0 +1,34 @@
+"""RFC 9711 protected-carrier mappings."""
+
+from dataclasses import dataclass
+
+from tba_contracts_identity.tokens import TokenEnvelopeFormat
+
+from .errors import UnsupportedEatCarrierError
+
+
+@dataclass(frozen=True, slots=True)
+class EatCarrier:
+    media_type: str
+    envelope_format: TokenEnvelopeFormat
+
+
+EAT_JWT_CARRIER = EatCarrier("application/eat+jwt", TokenEnvelopeFormat.JWT)
+EAT_CWT_CARRIER = EatCarrier("application/eat+cwt", TokenEnvelopeFormat.CWT)
+EAT_CARRIERS = (EAT_JWT_CARRIER, EAT_CWT_CARRIER)
+
+
+def select_carrier(media_type: str) -> EatCarrier:
+    for carrier in EAT_CARRIERS:
+        if carrier.media_type == media_type:
+            return carrier
+    raise UnsupportedEatCarrierError(f"unsupported EAT media type: {media_type}")
+
+
+__all__ = [
+    "EAT_CARRIERS",
+    "EAT_CWT_CARRIER",
+    "EAT_JWT_CARRIER",
+    "EatCarrier",
+    "select_carrier",
+]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/submodules.py

@@ -0,0 +1,5 @@
+"""Versioned EAT protocol exports backed by deterministic submodule values."""
+
+from tba_concrete_eat.submodules import EatSubmodule, parse_submodules
+
+__all__ = ["EatSubmodule", "parse_submodules"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/validation.py

@@ -0,0 +1,5 @@
+"""Versioned EAT protocol exports backed by deterministic validation."""
+
+from tba_concrete_eat.validation import parse_eat, validate_eat_claims
+
+__all__ = ["parse_eat", "validate_eat_claims"]

tba_protocol_attestation_eat-0.4.0.dev2/src/tba_protocol_attestation_eat/versions.py

@@ -0,0 +1,25 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class EatVersion:
+    identifier: str
+    status: str
+    published: str
+
+
+VERSION_HISTORY = (
+    EatVersion("draft-ietf-rats-eat-30", "superseded-draft", "2024-01"),
+    EatVersion("RFC9711", "standards-track", "2025-04"),
+)
+CURRENT_VERSION = VERSION_HISTORY[-1]
+
+
+def select_version(identifier: str = "RFC9711") -> EatVersion:
+    for version in VERSION_HISTORY:
+        if version.identifier == identifier:
+            return version
+    raise ValueError(f"unsupported EAT version: {identifier}")
+
+
+__all__ = ["CURRENT_VERSION", "VERSION_HISTORY", "EatVersion", "select_version"]