tba-protocol-workload-spiffe-broker-api 0.4.0.dev2__py3-none-any.whl

tba_protocol_workload_spiffe_broker_api/__init__.py

@@ -0,0 +1,18 @@
+from .endpoint import validate_endpoint
+from .references import BrokerWorkloadReference, normalize_reference
+from .rpcs import RPC_DEFINITIONS, RPC_NAMES, BrokerRpcDefinition
+from .service import BrokerApiService
+from .versions import CURRENT_VERSION, VERSION_HISTORY, BrokerApiVersion
+
+__all__ = [
+    "BrokerApiService",
+    "BrokerApiVersion",
+    "BrokerRpcDefinition",
+    "BrokerWorkloadReference",
+    "CURRENT_VERSION",
+    "RPC_DEFINITIONS",
+    "RPC_NAMES",
+    "VERSION_HISTORY",
+    "normalize_reference",
+    "validate_endpoint",
+]

tba_protocol_workload_spiffe_broker_api/bindings.py

@@ -0,0 +1,5 @@
+"""Capability bindings owned by the versioned protocol package."""
+
+PROTOCOL_CAPABILITY_BINDINGS: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CAPABILITY_BINDINGS"]

tba_protocol_workload_spiffe_broker_api/claims.py

@@ -0,0 +1,5 @@
+"""Claim vocabulary selected by the versioned protocol package."""
+
+PROTOCOL_CLAIM_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CLAIM_NAMES"]

tba_protocol_workload_spiffe_broker_api/compatibility.py

@@ -0,0 +1,3 @@
+def require_version(identifier: str) -> None:
+    if identifier != "SPIFFE-v1.15.1-Broker-API":
+        raise ValueError(f"unsupported Broker API revision: {identifier}")

tba_protocol_workload_spiffe_broker_api/endpoint.py

@@ -0,0 +1,3 @@
+def validate_endpoint(address: str) -> None:
+    if not (address.startswith("unix://") or address.startswith("npipe://")):
+        raise ValueError("Broker API requires a local Broker Endpoint")

tba_protocol_workload_spiffe_broker_api/errors.py

@@ -0,0 +1,8 @@
+"""Errors raised by the versioned protocol package."""
+
+
+class ProtocolProfileError(ValueError):
+    """The artifact or request does not satisfy the selected protocol profile."""
+
+
+__all__ = ["ProtocolProfileError"]

tba_protocol_workload_spiffe_broker_api/features.py

@@ -0,0 +1,10 @@
+FEATURES = frozenset(
+    {
+        "x509-svid-subscription",
+        "x509-bundle-subscription",
+        "jwt-svid-fetch",
+        "jwt-bundle-subscription",
+        "delegated-workload-reference",
+        "broker-authorization",
+    }
+)

tba_protocol_workload_spiffe_broker_api/migrations.py

@@ -0,0 +1,8 @@
+def migration_path(
+    source: str, target: str = "SPIFFE-v1.15.1-Broker-API"
+) -> tuple[str, ...]:
+    if source == target:
+        return ()
+    raise ValueError(
+        f"manual Incubating Broker API migration required: {source} to {target}"
+    )

tba_protocol_workload_spiffe_broker_api/references.py

@@ -0,0 +1,18 @@
+from dataclasses import dataclass
+from typing import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerWorkloadReference:
+    kind: str
+    attributes: Mapping[str, object]
+
+
+def normalize_reference(
+    kind: str, attributes: Mapping[str, object]
+) -> BrokerWorkloadReference:
+    if kind not in {"pid", "kubernetes"}:
+        raise ValueError(f"unsupported broker workload reference: {kind}")
+    if not attributes:
+        raise ValueError("broker workload reference attributes are required")
+    return BrokerWorkloadReference(kind, dict(attributes))

tba_protocol_workload_spiffe_broker_api/rpcs.py

@@ -0,0 +1,17 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerRpcDefinition:
+    name: str
+    server_streaming: bool
+    profile: str
+
+
+RPC_DEFINITIONS = (
+    BrokerRpcDefinition("SubscribeToX509SVID", True, "x509-svid"),
+    BrokerRpcDefinition("SubscribeToX509Bundles", True, "x509-svid"),
+    BrokerRpcDefinition("FetchJWTSVID", False, "jwt-svid"),
+    BrokerRpcDefinition("SubscribeToJWTBundles", True, "jwt-svid"),
+)
+RPC_NAMES = frozenset(item.name for item in RPC_DEFINITIONS)

tba_protocol_workload_spiffe_broker_api/schemas.py

@@ -0,0 +1,5 @@
+"""Wire-schema inventory owned by the versioned protocol package."""
+
+PROTOCOL_WIRE_SCHEMA_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_WIRE_SCHEMA_NAMES"]

tba_protocol_workload_spiffe_broker_api/service.py

@@ -0,0 +1,25 @@
+from collections.abc import Callable, Mapping
+from .rpcs import RPC_NAMES
+
+
+class BrokerApiService:
+    def __init__(
+        self,
+        *,
+        authorize: Callable[[object], bool],
+        handlers: Mapping[str, Callable[..., object]],
+    ) -> None:
+        unknown = set(handlers).difference(RPC_NAMES)
+        missing = RPC_NAMES.difference(handlers)
+        if unknown or missing:
+            raise ValueError(
+                f"Broker API handler mismatch; unknown={sorted(unknown)}, missing={sorted(missing)}"
+            )
+        self._authorize, self._handlers = authorize, dict(handlers)
+
+    def dispatch(self, actor: object, rpc: str, request: object) -> object:
+        if not self._authorize(actor):
+            raise PermissionError("broker caller is not authorized")
+        if rpc not in RPC_NAMES:
+            raise ValueError(f"unknown Broker API RPC: {rpc}")
+        return self._handlers[rpc](request)

tba_protocol_workload_spiffe_broker_api/versions.py

@@ -0,0 +1,16 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerApiVersion:
+    identifier: str
+    status: str
+    specification_uri: str
+
+
+CURRENT_VERSION = BrokerApiVersion(
+    "SPIFFE-v1.15.1-Broker-API",
+    "Incubating",
+    "https://github.com/spiffe/spiffe/tree/v1.15.1",
+)
+VERSION_HISTORY = (CURRENT_VERSION,)

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: tba-protocol-workload-spiffe-broker-api
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,17 @@
+tba_protocol_workload_spiffe_broker_api/__init__.py,sha256=WHZgzxzQoD6NT_k8malSXyqi1qKYG0D3KgXozkJLLV4,545
+tba_protocol_workload_spiffe_broker_api/bindings.py,sha256=geO7qbQkZg0dzzGv3daVxr3WhKaDUdlb382DITlWey4,163
+tba_protocol_workload_spiffe_broker_api/claims.py,sha256=WibdHFxqAyKK9njjKwo37vO1RKj76jedqoDQs22LF6U,147
+tba_protocol_workload_spiffe_broker_api/compatibility.py,sha256=lh-5Gyoh_50vKSBVquNrblqzWgAzXzcpE_ZLu_wKy4s,171
+tba_protocol_workload_spiffe_broker_api/endpoint.py,sha256=i-bC9AlrQPczpFdEsvOFTvMOD9m6zn1PaJ4PlcNY3qE,195
+tba_protocol_workload_spiffe_broker_api/errors.py,sha256=KwHVry4N9TO5ZP3zolvxALLJPBFjBOpiNq_-vH4F9lQ,216
+tba_protocol_workload_spiffe_broker_api/features.py,sha256=1Q3LH3JgTBAr0zRJ7xPbWzdUBQq07QR21IVsDLW33Bk,239
+tba_protocol_workload_spiffe_broker_api/migrations.py,sha256=j79c359mE-6V0KhwfAkEPh4PXZwDk6FcErJr-kXMSfI,253
+tba_protocol_workload_spiffe_broker_api/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_protocol_workload_spiffe_broker_api/references.py,sha256=MOFqXrprFHRdK1diRK1eBHkHgPyv2lRL7wyuiFSgQAw,563
+tba_protocol_workload_spiffe_broker_api/rpcs.py,sha256=5AovNQzdXxjWcZTO1Qs3oKX3k9jyehVsyACUs_OxGwc,507
+tba_protocol_workload_spiffe_broker_api/schemas.py,sha256=QHrkgNjQDZ4CzMQvwCKcenekGhjq2ezTtR8VdgdbcWQ,161
+tba_protocol_workload_spiffe_broker_api/service.py,sha256=q6TDIMY1-KtjL7Y_Gut2zbfopZYm4TNSuVJuWuieiJ0,930
+tba_protocol_workload_spiffe_broker_api/versions.py,sha256=jVA9N_IZtoaL4ptGV3o5JrUTw0nZKzAt-C9D_q2H9dY,340
+tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/METADATA,sha256=YGnDzVMVELYUpDP2Ta5CkC8Mb0hpuM1cuICPAKNewDg,431
+tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/RECORD,,

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any