tba-protocol-workload-spiffe-workload-api 0.4.0.dev2__tar.gz

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: tba-protocol-workload-spiffe-workload-api
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,10 @@
+[project]
+name="tba-protocol-workload-spiffe-workload-api"
+version="0.4.0.dev2"
+requires-python=">=3.10,<3.15"
+dependencies=[]
+[build-system]
+requires=["poetry-core>=1.0.0"]
+build-backend="poetry.core.masonry.api"
+[tool.poetry]
+packages=[{include="tba_protocol_workload_spiffe_workload_api",from="src"}]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/__init__.py

@@ -0,0 +1,18 @@
+from .endpoint import validate_endpoint
+from .rpcs import FORBIDDEN_EXTENSION_RPCS, RPC_DEFINITIONS, RPC_NAMES, RpcDefinition
+from .service import WorkloadApiService
+from .streams import validate_full_snapshot
+from .versions import CURRENT_VERSION, VERSION_HISTORY, WorkloadApiVersion
+
+__all__ = [
+    "CURRENT_VERSION",
+    "FORBIDDEN_EXTENSION_RPCS",
+    "RPC_DEFINITIONS",
+    "RPC_NAMES",
+    "VERSION_HISTORY",
+    "RpcDefinition",
+    "WorkloadApiService",
+    "WorkloadApiVersion",
+    "validate_endpoint",
+    "validate_full_snapshot",
+]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/bindings.py

@@ -0,0 +1,5 @@
+"""Capability bindings owned by the versioned protocol package."""
+
+PROTOCOL_CAPABILITY_BINDINGS: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CAPABILITY_BINDINGS"]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/claims.py

@@ -0,0 +1,5 @@
+"""Claim vocabulary selected by the versioned protocol package."""
+
+PROTOCOL_CLAIM_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CLAIM_NAMES"]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/compatibility.py

@@ -0,0 +1,3 @@
+def require_version(identifier: str) -> None:
+    if identifier != "SPIFFE-Workload-API-1.0":
+        raise ValueError(f"unsupported Workload API revision: {identifier}")

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/endpoint.py

@@ -0,0 +1,5 @@
+def validate_endpoint(address: str) -> None:
+    if not (address.startswith("unix://") or address.startswith("npipe://")):
+        raise ValueError(
+            "Workload API endpoint must use an explicitly configured local transport"
+        )

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/errors.py

@@ -0,0 +1,8 @@
+"""Errors raised by the versioned protocol package."""
+
+
+class ProtocolProfileError(ValueError):
+    """The artifact or request does not satisfy the selected protocol profile."""
+
+
+__all__ = ["ProtocolProfileError"]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/features.py

@@ -0,0 +1,10 @@
+FEATURES = frozenset(
+    {
+        "x509-svid-stream",
+        "x509-bundle-stream",
+        "jwt-svid-fetch",
+        "jwt-bundle-stream",
+        "jwt-svid-validation",
+        "full-snapshot-streams",
+    }
+)

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/migrations.py

@@ -0,0 +1,6 @@
+def migration_path(
+    source: str, target: str = "SPIFFE-Workload-API-1.0"
+) -> tuple[str, ...]:
+    if source == target:
+        return ()
+    raise ValueError(f"manual Workload API migration required: {source} to {target}")

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/rpcs.py

@@ -0,0 +1,19 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class RpcDefinition:
+    name: str
+    server_streaming: bool
+    profile: str
+
+
+RPC_DEFINITIONS = (
+    RpcDefinition("FetchX509SVID", True, "x509-svid"),
+    RpcDefinition("FetchX509Bundles", True, "x509-svid"),
+    RpcDefinition("FetchJWTSVID", False, "jwt-svid"),
+    RpcDefinition("FetchJWTBundles", True, "jwt-svid"),
+    RpcDefinition("ValidateJWTSVID", False, "jwt-svid"),
+)
+RPC_NAMES = frozenset(item.name for item in RPC_DEFINITIONS)
+FORBIDDEN_EXTENSION_RPCS = frozenset({"FetchWITSVID", "FetchCWTSVID"})

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/schemas.py

@@ -0,0 +1,5 @@
+"""Wire-schema inventory owned by the versioned protocol package."""
+
+PROTOCOL_WIRE_SCHEMA_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_WIRE_SCHEMA_NAMES"]

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/service.py

@@ -0,0 +1,18 @@
+from collections.abc import Callable, Mapping
+from .rpcs import RPC_NAMES
+
+
+class WorkloadApiService:
+    def __init__(self, handlers: Mapping[str, Callable[..., object]]) -> None:
+        unknown = set(handlers).difference(RPC_NAMES)
+        if unknown:
+            raise ValueError(f"Workload API must not be extended: {sorted(unknown)}")
+        missing = RPC_NAMES.difference(handlers)
+        if missing:
+            raise ValueError(f"missing Workload API handlers: {sorted(missing)}")
+        self._handlers = dict(handlers)
+
+    def dispatch(self, rpc: str, request: object) -> object:
+        if rpc not in RPC_NAMES:
+            raise ValueError(f"unknown Workload API RPC: {rpc}")
+        return self._handlers[rpc](request)

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/streams.py

@@ -0,0 +1,6 @@
+def validate_full_snapshot(
+    previous: frozenset[str], current: frozenset[str], *, declared_full_snapshot: bool
+) -> frozenset[str]:
+    if not declared_full_snapshot:
+        raise ValueError("SPIFFE stream updates must be complete snapshots")
+    return current

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2/src/tba_protocol_workload_spiffe_workload_api/versions.py

@@ -0,0 +1,16 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class WorkloadApiVersion:
+    identifier: str
+    status: str
+    specification_uri: str
+
+
+CURRENT_VERSION = WorkloadApiVersion(
+    "SPIFFE-Workload-API-1.0",
+    "stable",
+    "https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md",
+)
+VERSION_HISTORY = (CURRENT_VERSION,)