tinesight 0.0.2.dev1__tar.gz

tinesight-0.0.2.dev1/PKG-INFO

@@ -0,0 +1,14 @@
+Metadata-Version: 2.3
+Name: tinesight
+Version: 0.0.2.dev1
+Summary: Tinesight SDK
+Requires-Dist: cryptography>=46.0.3
+Requires-Dist: pycognito>=2024.5.1
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+
+# Tinesight SDK
+
+Standalone python package for Tinesight SDK, published in the Python package `tinesight`.
+
+Check out [SDK Documentation](http://devsdk.tinesight.com)

tinesight-0.0.2.dev1/README.md

@@ -0,0 +1,5 @@
+# Tinesight SDK
+
+Standalone python package for Tinesight SDK, published in the Python package `tinesight`.
+
+Check out [SDK Documentation](http://devsdk.tinesight.com)

tinesight-0.0.2.dev1/pyproject.toml

@@ -0,0 +1,22 @@
+[project]
+name = "tinesight"
+version = "0.0.2.dev1"
+description = "Tinesight SDK"
+readme = "README.md"
+requires-python = ">=3.12"
+dependencies = [
+    "cryptography>=46.0.3",
+    "pycognito>=2024.5.1",
+]
+
+[build-system]
+requires = ["uv_build"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pre-commit>=4.5.0",
+    "pydata-sphinx-theme>=0.16.1",
+    "pytest>=9.0.2",
+    "sphinx>=9.0.4",
+]

tinesight-0.0.2.dev1/src/tinesight/api.py

@@ -0,0 +1,14 @@
+import os
+
+
+class TinesightApiMixin:
+
+    @property
+    def tenant_base_api_uri(self) -> str:
+        subdomain = "devapi" if os.getenv("TINESIGHT_DEV") else "api"
+        return f"https://{subdomain}.tinesight.com"
+
+    @property
+    def public_ux_api_uri(self) -> str:
+        api_ref = "p1pco7l9b1" if os.getenv("TINESIGHT_DEV") else "api"
+        return f"https://{api_ref}.execute-api.us-east-1.amazonaws.com"

tinesight-0.0.2.dev1/src/tinesight/client.py

@@ -0,0 +1,36 @@
+from collections.abc import Callable
+from functools import partial
+from pathlib import Path
+
+import requests
+
+from tinesight.api import TinesightApiMixin
+
+
+class TinesightClient(TinesightApiMixin):
+    """
+    Client for invoking the Tinesight API from a device.
+
+    To use this class, a device must be registered with a signed certificate using the
+    `TinesightRegistrar`.
+
+    Examples:
+        >>> result = TinesightClient(my_key_path, my_cert_path).classify(my_image_bytes)
+        >>> print(result.json)
+        >>> {'class': 'deer', 'probability': 0.98}
+
+    """
+
+    @property
+    def _mtls_post(self) -> Callable:
+        """Private wrapper for making invoking requests with a certa"""
+        return partial(requests.post, cert=(self.cert_path, self.key_path))
+
+    def __init__(self, x509_key_path: Path | str, x509_cert_path: Path | str):
+        self.key_path: str = str(x509_key_path)
+        self.cert_path: str = str(x509_cert_path)
+
+    def classify(self, image_bytes: bytes) -> requests.Response:
+        """Invokes the classification model for the specified image"""
+        classification_url = self.tenant_base_api_uri + "/classify/v1"
+        return self._mtls_post(classification_url, files={"file": image_bytes})

tinesight-0.0.2.dev1/src/tinesight/registrar.py

@@ -0,0 +1,138 @@
+import io
+import os
+from http import HTTPStatus
+from pathlib import Path
+
+import requests
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives import serialization
+from cryptography.x509.oid import NameOID
+from pycognito.utils import RequestsSrpAuth, TokenType
+
+from tinesight.api import TinesightApiMixin
+
+# Cognito configuration - these should be set before using TinesightRegistrar
+# TODO (NP) figure out how to switch between dev and prod
+COGNITO_USER_POOL_ID = os.environ.get("COGNITO_USER_POOL_ID", "us-east-1_g1yNKyU6h")
+COGNITO_CLIENT_ID = os.environ.get("COGNITO_CLIENT_ID", "3255n0uofh58rqqiqhodtqtdp7")
+AWS_REGION = os.environ.get("AWS_REGION", "us-east-1")
+
+
+class TinesightRegistrar(TinesightApiMixin):
+    """
+    Represents a Tinesight tenant, with functionality for generating a signed certificate per device.
+
+    Examples:
+        >>> tsr = TinesightRegistrar()
+        >>> tsr.login(my_tinesight_account_user_name, my_tinesight_account_password)
+        >>> cert = tsr.register_device(my_local_key_path, device_id)
+        >>> with open('mydevice.crt', 'w') as fp:
+        >>>     fp.write(cert)
+
+    By following this example you can then instantiate a TinesightClient to invoke the Tinesight API.
+    """
+
+    def __init__(
+        self, country_name: str = "US", state: str | None = None, organization: str | None = None
+    ):
+        if not COGNITO_USER_POOL_ID or not COGNITO_CLIENT_ID:
+            raise ValueError(
+                "COGNITO_USER_POOL_ID and COGNITO_CLIENT_ID must be set as environment variables"
+            )
+        self.auth: RequestsSrpAuth | None = None
+        self.country_name = country_name
+        self.state = state
+        self.organization = organization
+
+    def login(self, username: str, password: str) -> "TinesightRegistrar":
+        """
+        Basic login to using Cognito IDP with the SRP flow. This method is required to be called
+        prior to registering any devices.
+        """
+        self.auth: RequestsSrpAuth = RequestsSrpAuth(
+            username=username,
+            password=password,
+            user_pool_id=COGNITO_USER_POOL_ID,
+            client_id=COGNITO_CLIENT_ID,
+            user_pool_region=AWS_REGION,
+            auth_token_type=TokenType.ID_TOKEN,
+        )
+        return self
+
+    @staticmethod
+    def _read_private_key(pem_key_path: Path, key_password: str | None = None):
+        # load the private key
+        with open(pem_key_path, "rb") as fp:
+            pk_contents = fp.read()
+        return serialization.load_pem_private_key(
+            pk_contents, password=key_password.encode() if key_password else None
+        )
+
+    def register_device(
+        self, device_id: str, pem_key_path: Path, key_password: str = None
+    ) -> bytes | None:
+        """
+        Registers a uniquely identified device for your account by creating a certificate
+        signing request and returning a signed certificate identifying your device, which will
+        enable mTLS invocation of the Tinesight API. Certificates expire after one year.
+
+        If a device with this device_id has already been registered and its certificate is not expired,
+        an exception will be thrown. If the certificate for this device is expired, a new
+        certificate will be returned.
+
+        This method requires the `TinesightRegistrar.login()` method to have been called prior
+        to executing.
+
+        :param device_id: unique device identifier
+        :param pem_key_path: path to your secret key
+        :param key_password: str, default None - password to your secret key
+
+        :return: certificate (str)
+        """
+        if self.auth is None:
+            print("Need to call login prior to registering a device")
+            return None
+
+        key = self._read_private_key(pem_key_path, key_password)
+
+        # create a certificate signing request
+        csr = (
+            x509.CertificateSigningRequestBuilder()
+            .subject_name(
+                x509.Name(
+                    [
+                        # Provide various details about who we are.
+                        x509.NameAttribute(NameOID.COUNTRY_NAME, self.country_name),
+                        x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, self.state or ""),
+                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, self.organization or ""),
+                        x509.NameAttribute(NameOID.COMMON_NAME, device_id),
+                    ]
+                )
+            )
+            .add_extension(
+                x509.ExtendedKeyUsage(
+                    [
+                        x509.ExtendedKeyUsageOID.CLIENT_AUTH  # Specifies the certificate is for client authentication
+                    ]
+                ),
+                critical=False,
+            )
+            .add_extension(
+                x509.SubjectAlternativeName([x509.RFC822Name(self.auth.username)]), critical=False
+            )
+            .sign(key, hashes.SHA256())
+        )
+
+        # request the signed certificate
+        target_url = self.public_ux_api_uri + "/register-device/v1"
+        response = requests.post(
+            target_url,
+            data=csr.public_bytes(serialization.Encoding.PEM),
+            auth=self.auth,
+        )
+        if response.status_code == HTTPStatus.OK:
+            json_response = response.json()
+            return json_response["certificate"].encode("utf-8")
+        else:
+            return None