tba-protocol-workload-spiffe-broker-api 0.4.0.dev2__tar.gz

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: tba-protocol-workload-spiffe-broker-api
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name="tba-protocol-workload-spiffe-broker-api"
+version="0.4.0.dev2"
+requires-python=">=3.10,<3.15"
+dependencies=[]
+[build-system]
+requires=["poetry-core>=1.0.0"]
+build-backend="poetry.core.masonry.api"
+[tool.poetry]
+packages=[{include="tba_protocol_workload_spiffe_broker_api",from="src"}]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/__init__.py

@@ -0,0 +1,18 @@
+from .endpoint import validate_endpoint
+from .references import BrokerWorkloadReference, normalize_reference
+from .rpcs import RPC_DEFINITIONS, RPC_NAMES, BrokerRpcDefinition
+from .service import BrokerApiService
+from .versions import CURRENT_VERSION, VERSION_HISTORY, BrokerApiVersion
+
+__all__ = [
+    "BrokerApiService",
+    "BrokerApiVersion",
+    "BrokerRpcDefinition",
+    "BrokerWorkloadReference",
+    "CURRENT_VERSION",
+    "RPC_DEFINITIONS",
+    "RPC_NAMES",
+    "VERSION_HISTORY",
+    "normalize_reference",
+    "validate_endpoint",
+]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/bindings.py

@@ -0,0 +1,5 @@
+"""Capability bindings owned by the versioned protocol package."""
+
+PROTOCOL_CAPABILITY_BINDINGS: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CAPABILITY_BINDINGS"]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/claims.py

@@ -0,0 +1,5 @@
+"""Claim vocabulary selected by the versioned protocol package."""
+
+PROTOCOL_CLAIM_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CLAIM_NAMES"]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/compatibility.py

@@ -0,0 +1,3 @@
+def require_version(identifier: str) -> None:
+    if identifier != "SPIFFE-v1.15.1-Broker-API":
+        raise ValueError(f"unsupported Broker API revision: {identifier}")

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/endpoint.py

@@ -0,0 +1,3 @@
+def validate_endpoint(address: str) -> None:
+    if not (address.startswith("unix://") or address.startswith("npipe://")):
+        raise ValueError("Broker API requires a local Broker Endpoint")

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/errors.py

@@ -0,0 +1,8 @@
+"""Errors raised by the versioned protocol package."""
+
+
+class ProtocolProfileError(ValueError):
+    """The artifact or request does not satisfy the selected protocol profile."""
+
+
+__all__ = ["ProtocolProfileError"]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/features.py

@@ -0,0 +1,10 @@
+FEATURES = frozenset(
+    {
+        "x509-svid-subscription",
+        "x509-bundle-subscription",
+        "jwt-svid-fetch",
+        "jwt-bundle-subscription",
+        "delegated-workload-reference",
+        "broker-authorization",
+    }
+)

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/migrations.py

@@ -0,0 +1,8 @@
+def migration_path(
+    source: str, target: str = "SPIFFE-v1.15.1-Broker-API"
+) -> tuple[str, ...]:
+    if source == target:
+        return ()
+    raise ValueError(
+        f"manual Incubating Broker API migration required: {source} to {target}"
+    )

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/references.py

@@ -0,0 +1,18 @@
+from dataclasses import dataclass
+from typing import Mapping
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerWorkloadReference:
+    kind: str
+    attributes: Mapping[str, object]
+
+
+def normalize_reference(
+    kind: str, attributes: Mapping[str, object]
+) -> BrokerWorkloadReference:
+    if kind not in {"pid", "kubernetes"}:
+        raise ValueError(f"unsupported broker workload reference: {kind}")
+    if not attributes:
+        raise ValueError("broker workload reference attributes are required")
+    return BrokerWorkloadReference(kind, dict(attributes))

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/rpcs.py

@@ -0,0 +1,17 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerRpcDefinition:
+    name: str
+    server_streaming: bool
+    profile: str
+
+
+RPC_DEFINITIONS = (
+    BrokerRpcDefinition("SubscribeToX509SVID", True, "x509-svid"),
+    BrokerRpcDefinition("SubscribeToX509Bundles", True, "x509-svid"),
+    BrokerRpcDefinition("FetchJWTSVID", False, "jwt-svid"),
+    BrokerRpcDefinition("SubscribeToJWTBundles", True, "jwt-svid"),
+)
+RPC_NAMES = frozenset(item.name for item in RPC_DEFINITIONS)

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/schemas.py

@@ -0,0 +1,5 @@
+"""Wire-schema inventory owned by the versioned protocol package."""
+
+PROTOCOL_WIRE_SCHEMA_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_WIRE_SCHEMA_NAMES"]

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/service.py

@@ -0,0 +1,25 @@
+from collections.abc import Callable, Mapping
+from .rpcs import RPC_NAMES
+
+
+class BrokerApiService:
+    def __init__(
+        self,
+        *,
+        authorize: Callable[[object], bool],
+        handlers: Mapping[str, Callable[..., object]],
+    ) -> None:
+        unknown = set(handlers).difference(RPC_NAMES)
+        missing = RPC_NAMES.difference(handlers)
+        if unknown or missing:
+            raise ValueError(
+                f"Broker API handler mismatch; unknown={sorted(unknown)}, missing={sorted(missing)}"
+            )
+        self._authorize, self._handlers = authorize, dict(handlers)
+
+    def dispatch(self, actor: object, rpc: str, request: object) -> object:
+        if not self._authorize(actor):
+            raise PermissionError("broker caller is not authorized")
+        if rpc not in RPC_NAMES:
+            raise ValueError(f"unknown Broker API RPC: {rpc}")
+        return self._handlers[rpc](request)

tba_protocol_workload_spiffe_broker_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_broker_api/versions.py

@@ -0,0 +1,16 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class BrokerApiVersion:
+    identifier: str
+    status: str
+    specification_uri: str
+
+
+CURRENT_VERSION = BrokerApiVersion(
+    "SPIFFE-v1.15.1-Broker-API",
+    "Incubating",
+    "https://github.com/spiffe/spiffe/tree/v1.15.1",
+)
+VERSION_HISTORY = (CURRENT_VERSION,)