whiteroom-bedrock 0.1.0__tar.gz

whiteroom_bedrock-0.1.0/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.4
+Name: whiteroom-bedrock
+Version: 0.1.0
+Summary: Attaches WhiteRoom session attestation to a boto3 bedrock-runtime client
+License: BSL-1.1
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: botocore>=1.34
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: boto3>=1.34; extra == "test"
+
+# whiteroom-bedrock
+
+Client-side half of WhiteRoom's Bedrock adapter (server side lives in
+`apps/engine/src/bedrock/`).
+
+An unmodified AWS SDK has no way to prove its identity to WhiteRoom the way
+`ANTHROPIC_BASE_URL`/`OPENAI_BASE_URL` callers do with a bearer key — every
+Bedrock call is SigV4-signed by the caller's own credentials, and WhiteRoom
+discards that signature (it re-signs outbound with its own assumed-role
+credentials). Proving who called instead happens once, out of band, by
+replaying a signed `sts:GetCallerIdentity` probe to WhiteRoom's `/attest`
+endpoint. This package does that handshake and attaches the resulting
+session token to every subsequent call, so the rest of your agent code never
+has to know WhiteRoom is in the loop.
+
+## Install
+
+```bash
+pip install -e sdks/bedrock-python
+```
+
+## Test
+
+```bash
+pip install -e "sdks/bedrock-python[test]"
+pytest sdks/bedrock-python/tests
+```
+
+No network access or AWS credentials needed — everything's mocked at the
+botocore/urllib layer. `tests/test_attest.py` is the one worth reading
+closely: it directly checks the signed probe has `host`,
+`x-whiteroom-server-id` and `x-amz-date` in `SignedHeaders`, which is
+exactly what the server (`attest.ts`) requires — a change here that broke
+that would otherwise only surface as every real attestation failing
+against a live proxy.
+
+## Use
+
+```python
+import boto3
+import whiteroom_bedrock
+
+client = boto3.client(
+    "bedrock-runtime",
+    region_name="us-east-1",
+    endpoint_url="https://proxy.whiteroom.tech",
+)
+whiteroom_bedrock.install(
+    client,
+    proxy_base_url="https://proxy.whiteroom.tech",
+    server_id="proxy.whiteroom.tech",  # must match the proxy's configured serverId
+    region="us-east-1",
+)
+
+# Everything from here down is a normal bedrock-runtime client.
+response = client.converse(
+    modelId="anthropic.claude-3-5-sonnet-20241022-v2:0",
+    messages=[{"role": "user", "content": [{"text": "hi"}]}],
+)
+```
+
+## What `install()` actually does
+
+- On first call (and again whenever the cached session goes stale), signs a
+  throwaway `GetCallerIdentity` request with whatever credentials this
+  process already resolves for AWS (env vars, shared config, an instance or
+  task role — the standard botocore chain) and POSTs it to `/attest`.
+- Attaches the session token WhiteRoom hands back as `x-whiteroom-session`
+  on every `invoke_model`/`converse` call, via a `before-send` hook — after
+  signing, so it never interferes with the client's own (ultimately
+  discarded) signature.
+- If the proxy ever answers 403 — the session expired, or WhiteRoom
+  restarted and lost its in-memory session table — invalidates the cached
+  token and forces exactly one retry, so callers don't see a transient
+  session death as a failure.
+
+## Not handled here
+
+- **Streaming.** `invoke_model_with_response_stream` and
+  `converse_stream` reach the proxy the same as any other call, but the
+  server actively refuses to proxy streaming responses today (see
+  `routes.ts`) — you'll get a `ValidationException` back, not a stream.
+- **Credential source mismatch.** `region` and credentials are resolved
+  from the default botocore chain unless you pass `region=`/
+  `botocore_session=` explicitly. If the client you're hooking was built
+  with credentials that *don't* come from that chain (e.g. explicit
+  `aws_access_key_id=` on `boto3.client(...)`), attest with the same
+  credentials by passing a `botocore.session.Session` that resolves them.

whiteroom_bedrock-0.1.0/README.md

@@ -0,0 +1,88 @@
+# whiteroom-bedrock
+
+Client-side half of WhiteRoom's Bedrock adapter (server side lives in
+`apps/engine/src/bedrock/`).
+
+An unmodified AWS SDK has no way to prove its identity to WhiteRoom the way
+`ANTHROPIC_BASE_URL`/`OPENAI_BASE_URL` callers do with a bearer key — every
+Bedrock call is SigV4-signed by the caller's own credentials, and WhiteRoom
+discards that signature (it re-signs outbound with its own assumed-role
+credentials). Proving who called instead happens once, out of band, by
+replaying a signed `sts:GetCallerIdentity` probe to WhiteRoom's `/attest`
+endpoint. This package does that handshake and attaches the resulting
+session token to every subsequent call, so the rest of your agent code never
+has to know WhiteRoom is in the loop.
+
+## Install
+
+```bash
+pip install -e sdks/bedrock-python
+```
+
+## Test
+
+```bash
+pip install -e "sdks/bedrock-python[test]"
+pytest sdks/bedrock-python/tests
+```
+
+No network access or AWS credentials needed — everything's mocked at the
+botocore/urllib layer. `tests/test_attest.py` is the one worth reading
+closely: it directly checks the signed probe has `host`,
+`x-whiteroom-server-id` and `x-amz-date` in `SignedHeaders`, which is
+exactly what the server (`attest.ts`) requires — a change here that broke
+that would otherwise only surface as every real attestation failing
+against a live proxy.
+
+## Use
+
+```python
+import boto3
+import whiteroom_bedrock
+
+client = boto3.client(
+    "bedrock-runtime",
+    region_name="us-east-1",
+    endpoint_url="https://proxy.whiteroom.tech",
+)
+whiteroom_bedrock.install(
+    client,
+    proxy_base_url="https://proxy.whiteroom.tech",
+    server_id="proxy.whiteroom.tech",  # must match the proxy's configured serverId
+    region="us-east-1",
+)
+
+# Everything from here down is a normal bedrock-runtime client.
+response = client.converse(
+    modelId="anthropic.claude-3-5-sonnet-20241022-v2:0",
+    messages=[{"role": "user", "content": [{"text": "hi"}]}],
+)
+```
+
+## What `install()` actually does
+
+- On first call (and again whenever the cached session goes stale), signs a
+  throwaway `GetCallerIdentity` request with whatever credentials this
+  process already resolves for AWS (env vars, shared config, an instance or
+  task role — the standard botocore chain) and POSTs it to `/attest`.
+- Attaches the session token WhiteRoom hands back as `x-whiteroom-session`
+  on every `invoke_model`/`converse` call, via a `before-send` hook — after
+  signing, so it never interferes with the client's own (ultimately
+  discarded) signature.
+- If the proxy ever answers 403 — the session expired, or WhiteRoom
+  restarted and lost its in-memory session table — invalidates the cached
+  token and forces exactly one retry, so callers don't see a transient
+  session death as a failure.
+
+## Not handled here
+
+- **Streaming.** `invoke_model_with_response_stream` and
+  `converse_stream` reach the proxy the same as any other call, but the
+  server actively refuses to proxy streaming responses today (see
+  `routes.ts`) — you'll get a `ValidationException` back, not a stream.
+- **Credential source mismatch.** `region` and credentials are resolved
+  from the default botocore chain unless you pass `region=`/
+  `botocore_session=` explicitly. If the client you're hooking was built
+  with credentials that *don't* come from that chain (e.g. explicit
+  `aws_access_key_id=` on `boto3.client(...)`), attest with the same
+  credentials by passing a `botocore.session.Session` that resolves them.

whiteroom_bedrock-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "whiteroom-bedrock"
+version = "0.1.0"
+description = "Attaches WhiteRoom session attestation to a boto3 bedrock-runtime client"
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "BSL-1.1" }
+dependencies = [
+    "botocore>=1.34",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest>=7",
+    "boto3>=1.34",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]

whiteroom_bedrock-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock/__init__.py

@@ -0,0 +1,10 @@
+from .attest import AttestationError, AttestedIdentity, SessionManager
+from .hook import SESSION_HEADER, install
+
+__all__ = [
+    "install",
+    "SessionManager",
+    "AttestationError",
+    "AttestedIdentity",
+    "SESSION_HEADER",
+]

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock/attest.py

@@ -0,0 +1,146 @@
+"""
+Client side of the attestation handshake described in
+apps/engine/src/bedrock/attest.ts.
+
+WhiteRoom cannot verify a request's SigV4 signature itself (that would need
+the caller's secret key). Instead we sign a throwaway sts:GetCallerIdentity
+request with whatever AWS credentials this process already has, and send it
+to WhiteRoom's /attest endpoint. WhiteRoom replays it to STS, which can
+verify it, and answers with our ARN plus a short-lived session token. That
+token — not the probe — is what rides on every subsequent Bedrock call.
+"""
+
+from __future__ import annotations
+
+import json
+import threading
+import time
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+
+from botocore.auth import SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.session import Session as BotocoreSession
+
+# The exact, minimal GetCallerIdentity body attest.ts's assertGetCallerIdentity
+# expects: Action=GetCallerIdentity and nothing else but Version.
+_GET_CALLER_IDENTITY_BODY = "Action=GetCallerIdentity&Version=2011-06-15"
+
+
+class AttestationError(Exception):
+    """Raised when the probe can't be built, or WhiteRoom/STS rejects it."""
+
+
+@dataclass(frozen=True)
+class AttestedIdentity:
+    session_token: str
+    arn: str
+    issued_at: float
+
+
+class SessionManager:
+    """
+    Holds one WhiteRoom session token per (proxy, server_id, region) and
+    refreshes it as needed.
+
+    /attest's response carries no expiry (see routes.ts — deliberately: the
+    server owns TTL policy, not the client), so freshness here is a mix of:
+      - proactive: refresh after SESSION_TTL_HINT locally, so a long-idle
+        process doesn't eat the round trip lazily on its very next call
+      - reactive: hook.py invalidates and forces one retry on a 403 from
+        the proxy, which covers a token dying earlier than the hint (server
+        restart, explicit revocation) without the caller doing anything
+
+    Thread-safe: a single lock guards refresh, so concurrent callers on a
+    cold cache queue behind one /attest call instead of each firing their
+    own (the same thundering-herd concern credentials.ts guards against
+    server-side for AssumeRole).
+    """
+
+    SESSION_TTL_HINT_SECONDS = 10 * 60
+
+    def __init__(
+        self,
+        proxy_base_url: str,
+        server_id: str,
+        region: str,
+        botocore_session: BotocoreSession | None = None,
+        timeout_seconds: float = 10.0,
+    ) -> None:
+        self._proxy_base_url = proxy_base_url.rstrip("/")
+        self._server_id = server_id
+        self._region = region
+        self._botocore_session = botocore_session or BotocoreSession()
+        self._timeout_seconds = timeout_seconds
+        self._lock = threading.Lock()
+        self._identity: AttestedIdentity | None = None
+
+    def get_token(self, force: bool = False) -> str:
+        with self._lock:
+            if not force and self._identity is not None:
+                age = time.time() - self._identity.issued_at
+                if age < self.SESSION_TTL_HINT_SECONDS:
+                    return self._identity.session_token
+            self._identity = self._attest()
+            return self._identity.session_token
+
+    def invalidate(self) -> None:
+        with self._lock:
+            self._identity = None
+
+    def _build_probe(self) -> dict:
+        creds = self._botocore_session.get_credentials()
+        if creds is None:
+            raise AttestationError(
+                "no AWS credentials available to attest with — "
+                "whiteroom_bedrock needs the same credential chain your "
+                "bedrock-runtime client uses"
+            )
+        frozen = creds.get_frozen_credentials()
+
+        host = f"sts.{self._region}.amazonaws.com"
+        request = AWSRequest(
+            method="POST",
+            url=f"https://{host}/",
+            data=_GET_CALLER_IDENTITY_BODY,
+            headers={
+                "Host": host,
+                "Content-Type": "application/x-www-form-urlencoded",
+                # Must be present BEFORE signing — SigV4Auth signs whatever
+                # headers exist on the request at add_auth() time, and
+                # attest.ts refuses any probe where this (and host) aren't
+                # in SignedHeaders.
+                "x-whiteroom-server-id": self._server_id,
+            },
+        )
+        SigV4Auth(frozen, "sts", self._region).add_auth(request)
+
+        return {
+            "method": "POST",
+            "headers": dict(request.headers.items()),
+            "body": _GET_CALLER_IDENTITY_BODY,
+        }
+
+    def _attest(self) -> AttestedIdentity:
+        probe = self._build_probe()
+        req = urllib.request.Request(
+            f"{self._proxy_base_url}/attest",
+            data=json.dumps(probe).encode("utf-8"),
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        try:
+            with urllib.request.urlopen(req, timeout=self._timeout_seconds) as resp:
+                payload = json.loads(resp.read())
+        except urllib.error.HTTPError as e:
+            detail = e.read().decode("utf-8", "replace")
+            raise AttestationError(f"WhiteRoom rejected attestation ({e.code}): {detail}") from e
+        except urllib.error.URLError as e:
+            raise AttestationError(f"could not reach WhiteRoom attest endpoint: {e}") from e
+
+        token = payload.get("sessionToken")
+        arn = payload.get("arn", "")
+        if not token:
+            raise AttestationError("WhiteRoom attest response missing sessionToken")
+        return AttestedIdentity(session_token=token, arn=arn, issued_at=time.time())

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock/hook.py

@@ -0,0 +1,92 @@
+"""
+Wires session attachment into a boto3/botocore bedrock-runtime client.
+
+An unmodified AWS SDK has no concept of WhiteRoom's session token — every
+Bedrock call it makes is SigV4-signed with the caller's own credentials and
+sent as-is. WhiteRoom's proxy discards that signature outright (it re-signs
+outbound with its own assumed-role credentials — see sigv4.ts's STRIP list)
+and instead identifies the caller from an `x-whiteroom-session` header. This
+module is what attaches that header, transparently, to every call a hooked
+client makes.
+"""
+
+from __future__ import annotations
+
+from botocore.client import BaseClient
+
+from .attest import SessionManager
+
+SESSION_HEADER = "x-whiteroom-session"
+
+# Botocore's event-name slug for the Bedrock Runtime service. Fixed — this
+# module only ever hooks that one service.
+_SERVICE_EVENT_ID = "bedrock-runtime"
+
+# Force at most one re-attest-and-retry per call. Anything past that is a
+# real, persistent rejection (bad server_id, revoked tenant, ...) and should
+# surface to the caller as a normal ClientError rather than loop.
+_MAX_FORCED_RETRIES = 1
+
+
+def install(
+    client: BaseClient,
+    *,
+    proxy_base_url: str,
+    server_id: str,
+    region: str | None = None,
+    botocore_session=None,
+) -> SessionManager:
+    """
+    Call once, right after constructing a bedrock-runtime client pointed at
+    a WhiteRoom proxy:
+
+        client = boto3.client(
+            "bedrock-runtime",
+            region_name="us-east-1",
+            endpoint_url="https://proxy.whiteroom.tech",
+        )
+        whiteroom_bedrock.install(
+            client,
+            proxy_base_url="https://proxy.whiteroom.tech",
+            server_id="proxy.whiteroom.tech",
+            region="us-east-1",
+        )
+
+    Everything past this point — invoke_model, converse, retries, streaming
+    refusals — flows through the client exactly as if it were talking to
+    real Bedrock. `region` defaults to the client's own configured region if
+    omitted; pass it explicitly if the client's credentials weren't resolved
+    from the default chain (e.g. an assumed role built by hand).
+
+    Returns the SessionManager backing this client, in case the caller wants
+    manual control (e.g. `manager.invalidate()` after rotating credentials).
+    """
+    resolved_region = region or client.meta.region_name
+    if not resolved_region:
+        raise ValueError("region could not be determined from the client; pass region= explicitly")
+
+    manager = SessionManager(
+        proxy_base_url=proxy_base_url,
+        server_id=server_id,
+        region=resolved_region,
+        botocore_session=botocore_session,
+    )
+
+    events = client.meta.events
+
+    def _attach_session(request, **kwargs):
+        request.headers[SESSION_HEADER] = manager.get_token()
+
+    def _retry_on_session_rejection(response, attempts, **kwargs):
+        if response is None or attempts > _MAX_FORCED_RETRIES:
+            return None
+        http_response, _parsed = response
+        if http_response is not None and http_response.status_code == 403:
+            manager.invalidate()
+            return 0  # retry immediately; _attach_session will fetch a fresh token
+        return None
+
+    events.register(f"before-send.{_SERVICE_EVENT_ID}", _attach_session)
+    events.register(f"needs-retry.{_SERVICE_EVENT_ID}", _retry_on_session_rejection)
+
+    return manager

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock.egg-info/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.4
+Name: whiteroom-bedrock
+Version: 0.1.0
+Summary: Attaches WhiteRoom session attestation to a boto3 bedrock-runtime client
+License: BSL-1.1
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: botocore>=1.34
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: boto3>=1.34; extra == "test"
+
+# whiteroom-bedrock
+
+Client-side half of WhiteRoom's Bedrock adapter (server side lives in
+`apps/engine/src/bedrock/`).
+
+An unmodified AWS SDK has no way to prove its identity to WhiteRoom the way
+`ANTHROPIC_BASE_URL`/`OPENAI_BASE_URL` callers do with a bearer key — every
+Bedrock call is SigV4-signed by the caller's own credentials, and WhiteRoom
+discards that signature (it re-signs outbound with its own assumed-role
+credentials). Proving who called instead happens once, out of band, by
+replaying a signed `sts:GetCallerIdentity` probe to WhiteRoom's `/attest`
+endpoint. This package does that handshake and attaches the resulting
+session token to every subsequent call, so the rest of your agent code never
+has to know WhiteRoom is in the loop.
+
+## Install
+
+```bash
+pip install -e sdks/bedrock-python
+```
+
+## Test
+
+```bash
+pip install -e "sdks/bedrock-python[test]"
+pytest sdks/bedrock-python/tests
+```
+
+No network access or AWS credentials needed — everything's mocked at the
+botocore/urllib layer. `tests/test_attest.py` is the one worth reading
+closely: it directly checks the signed probe has `host`,
+`x-whiteroom-server-id` and `x-amz-date` in `SignedHeaders`, which is
+exactly what the server (`attest.ts`) requires — a change here that broke
+that would otherwise only surface as every real attestation failing
+against a live proxy.
+
+## Use
+
+```python
+import boto3
+import whiteroom_bedrock
+
+client = boto3.client(
+    "bedrock-runtime",
+    region_name="us-east-1",
+    endpoint_url="https://proxy.whiteroom.tech",
+)
+whiteroom_bedrock.install(
+    client,
+    proxy_base_url="https://proxy.whiteroom.tech",
+    server_id="proxy.whiteroom.tech",  # must match the proxy's configured serverId
+    region="us-east-1",
+)
+
+# Everything from here down is a normal bedrock-runtime client.
+response = client.converse(
+    modelId="anthropic.claude-3-5-sonnet-20241022-v2:0",
+    messages=[{"role": "user", "content": [{"text": "hi"}]}],
+)
+```
+
+## What `install()` actually does
+
+- On first call (and again whenever the cached session goes stale), signs a
+  throwaway `GetCallerIdentity` request with whatever credentials this
+  process already resolves for AWS (env vars, shared config, an instance or
+  task role — the standard botocore chain) and POSTs it to `/attest`.
+- Attaches the session token WhiteRoom hands back as `x-whiteroom-session`
+  on every `invoke_model`/`converse` call, via a `before-send` hook — after
+  signing, so it never interferes with the client's own (ultimately
+  discarded) signature.
+- If the proxy ever answers 403 — the session expired, or WhiteRoom
+  restarted and lost its in-memory session table — invalidates the cached
+  token and forces exactly one retry, so callers don't see a transient
+  session death as a failure.
+
+## Not handled here
+
+- **Streaming.** `invoke_model_with_response_stream` and
+  `converse_stream` reach the proxy the same as any other call, but the
+  server actively refuses to proxy streaming responses today (see
+  `routes.ts`) — you'll get a `ValidationException` back, not a stream.
+- **Credential source mismatch.** `region` and credentials are resolved
+  from the default botocore chain unless you pass `region=`/
+  `botocore_session=` explicitly. If the client you're hooking was built
+  with credentials that *don't* come from that chain (e.g. explicit
+  `aws_access_key_id=` on `boto3.client(...)`), attest with the same
+  credentials by passing a `botocore.session.Session` that resolves them.

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/whiteroom_bedrock/__init__.py
+src/whiteroom_bedrock/attest.py
+src/whiteroom_bedrock/hook.py
+src/whiteroom_bedrock.egg-info/PKG-INFO
+src/whiteroom_bedrock.egg-info/SOURCES.txt
+src/whiteroom_bedrock.egg-info/dependency_links.txt
+src/whiteroom_bedrock.egg-info/requires.txt
+src/whiteroom_bedrock.egg-info/top_level.txt
+tests/test_attest.py
+tests/test_hook.py

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock.egg-info/requires.txt

@@ -0,0 +1,5 @@
+botocore>=1.34
+
+[test]
+pytest>=7
+boto3>=1.34

whiteroom_bedrock-0.1.0/src/whiteroom_bedrock.egg-info/top_level.txt

@@ -0,0 +1 @@
+whiteroom_bedrock

whiteroom_bedrock-0.1.0/tests/test_attest.py

@@ -0,0 +1,190 @@
+"""
+Tests the probe construction and session caching in attest.py.
+
+The probe-shape tests are the important ones: attest.ts on the server side
+specifically requires host, x-whiteroom-server-id and x-amz-date to all be
+in SignedHeaders (see apps/engine/src/bedrock/attest.ts and its own test
+suite, bedrock-attest.test.ts). A change here that stops signing one of
+those would only ever surface as every real attestation failing against a
+live proxy -- this is the one place that's caught locally instead.
+"""
+
+import json
+import time
+from unittest.mock import patch
+from urllib.error import HTTPError, URLError
+
+import pytest
+from botocore.credentials import Credentials
+
+from whiteroom_bedrock.attest import AttestationError, SessionManager
+
+
+class FakeCredentialSession:
+    """Stands in for botocore.session.Session -- just get_credentials()."""
+
+    def __init__(self, creds=None):
+        self._creds = creds if creds is not None else Credentials(
+            "AKIAFAKEEXAMPLE", "fakesecret1234567890", token="fake-session-token"
+        )
+
+    def get_credentials(self):
+        return self._creds
+
+
+def make_manager(**overrides):
+    kwargs = dict(
+        proxy_base_url="https://proxy.whiteroom.tech",
+        server_id="proxy.whiteroom.tech",
+        region="us-east-1",
+        botocore_session=FakeCredentialSession(),
+    )
+    kwargs.update(overrides)
+    return SessionManager(**kwargs)
+
+
+class TestBuildProbe:
+    def test_method_and_body_are_exactly_get_caller_identity(self):
+        probe = make_manager()._build_probe()
+        assert probe["method"] == "POST"
+        assert probe["body"] == "Action=GetCallerIdentity&Version=2011-06-15"
+
+    def test_signed_headers_include_everything_the_server_requires(self):
+        # Direct regression test for the server-side fix: attest.ts rejects
+        # a probe unless host, x-whiteroom-server-id AND x-amz-date are all
+        # in SignedHeaders (not just present as headers).
+        probe = make_manager()._build_probe()
+        auth = probe["headers"]["Authorization"]
+        signed_headers = auth.split("SignedHeaders=")[1].split(",")[0].split(";")
+        for required in ("host", "x-whiteroom-server-id", "x-amz-date"):
+            assert required in signed_headers, f"{required} missing from SignedHeaders: {signed_headers}"
+
+    def test_server_id_header_matches_what_was_configured(self):
+        probe = make_manager(server_id="my-proxy.example.com")._build_probe()
+        assert probe["headers"]["x-whiteroom-server-id"] == "my-proxy.example.com"
+
+    def test_host_targets_sts_in_the_configured_region(self):
+        probe = make_manager(region="eu-west-1")._build_probe()
+        assert probe["headers"]["Host"] == "sts.eu-west-1.amazonaws.com"
+
+    def test_includes_security_token_for_temporary_credentials(self):
+        probe = make_manager()._build_probe()
+        assert probe["headers"]["X-Amz-Security-Token"] == "fake-session-token"
+
+    def test_omits_security_token_for_static_credentials(self):
+        static_creds = Credentials("AKIASTATIC", "staticsecret")
+        probe = make_manager(botocore_session=FakeCredentialSession(static_creds))._build_probe()
+        assert "X-Amz-Security-Token" not in probe["headers"]
+
+    def test_raises_when_no_credentials_are_available(self):
+        class NoCreds:
+            def get_credentials(self):
+                return None
+
+        with pytest.raises(AttestationError, match="no AWS credentials"):
+            make_manager(botocore_session=NoCreds())._build_probe()
+
+
+class TestGetToken:
+    def test_caches_within_the_ttl_window(self):
+        manager = make_manager()
+        calls = []
+
+        def fake_attest():
+            calls.append(1)
+            from whiteroom_bedrock.attest import AttestedIdentity
+            return AttestedIdentity(session_token=f"tok-{len(calls)}", arn="arn:aws:iam::123:user/a", issued_at=time.time())
+
+        with patch.object(manager, "_attest", side_effect=fake_attest):
+            first = manager.get_token()
+            second = manager.get_token()
+
+        assert first == second == "tok-1"
+        assert len(calls) == 1
+
+    def test_force_refreshes_even_within_the_ttl_window(self):
+        manager = make_manager()
+        calls = []
+
+        def fake_attest():
+            calls.append(1)
+            from whiteroom_bedrock.attest import AttestedIdentity
+            return AttestedIdentity(session_token=f"tok-{len(calls)}", arn="arn:aws:iam::123:user/a", issued_at=time.time())
+
+        with patch.object(manager, "_attest", side_effect=fake_attest):
+            manager.get_token()
+            second = manager.get_token(force=True)
+
+        assert second == "tok-2"
+        assert len(calls) == 2
+
+    def test_refreshes_once_the_ttl_hint_has_passed(self):
+        manager = make_manager()
+        calls = []
+
+        def fake_attest():
+            calls.append(1)
+            from whiteroom_bedrock.attest import AttestedIdentity
+            # issued_at backdated past the TTL hint, as if time had passed.
+            return AttestedIdentity(
+                session_token=f"tok-{len(calls)}",
+                arn="arn:aws:iam::123:user/a",
+                issued_at=time.time() - SessionManager.SESSION_TTL_HINT_SECONDS - 1,
+            )
+
+        with patch.object(manager, "_attest", side_effect=fake_attest):
+            manager.get_token()
+            second = manager.get_token()
+
+        assert second == "tok-2"
+        assert len(calls) == 2
+
+    def test_invalidate_forces_a_fresh_attest_on_the_next_call(self):
+        manager = make_manager()
+        calls = []
+
+        def fake_attest():
+            calls.append(1)
+            from whiteroom_bedrock.attest import AttestedIdentity
+            return AttestedIdentity(session_token=f"tok-{len(calls)}", arn="arn:aws:iam::123:user/a", issued_at=time.time())
+
+        with patch.object(manager, "_attest", side_effect=fake_attest):
+            manager.get_token()
+            manager.invalidate()
+            second = manager.get_token()
+
+        assert second == "tok-2"
+        assert len(calls) == 2
+
+
+class TestAttestErrorHandling:
+    def test_wraps_an_http_error_from_the_proxy(self):
+        manager = make_manager()
+        err = HTTPError("https://proxy.whiteroom.tech/attest", 401, "Unauthorized", {}, None)
+        err.read = lambda: b'{"message":"server-ID mismatch"}'
+        with patch("urllib.request.urlopen", side_effect=err):
+            with pytest.raises(AttestationError, match="401"):
+                manager.get_token()
+
+    def test_wraps_a_network_error_reaching_the_proxy(self):
+        manager = make_manager()
+        with patch("urllib.request.urlopen", side_effect=URLError("connection refused")):
+            with pytest.raises(AttestationError, match="could not reach"):
+                manager.get_token()
+
+    def test_raises_when_the_proxy_response_has_no_session_token(self):
+        manager = make_manager()
+
+        class FakeResponse:
+            def read(self):
+                return json.dumps({"arn": "arn:aws:iam::123:user/a"}).encode()
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *a):
+                return False
+
+        with patch("urllib.request.urlopen", return_value=FakeResponse()):
+            with pytest.raises(AttestationError, match="missing sessionToken"):
+                manager.get_token()

whiteroom_bedrock-0.1.0/tests/test_hook.py

@@ -0,0 +1,139 @@
+"""
+Tests install()'s session-attachment and 403-retry logic in hook.py.
+
+Uses a fake botocore client (just enough of .meta.events.register to capture
+the handlers install() wires up) rather than a real boto3 client, so these
+run without network access or a real AWS SDK event bus -- the actual
+end-to-end path (a real boto3 client, a real HTTP server) was validated
+manually when this adapter was built; these pin the handler logic itself so
+a future change can't silently break it.
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from whiteroom_bedrock.hook import SESSION_HEADER, install
+
+
+class FakeEvents:
+    """Records registrations instead of actually dispatching anything."""
+
+    def __init__(self):
+        self.registered = {}
+
+    def register(self, event_name, handler):
+        self.registered[event_name] = handler
+
+
+class FakeMeta:
+    def __init__(self, region_name="us-east-1"):
+        self.region_name = region_name
+        self.events = FakeEvents()
+
+
+class FakeClient:
+    def __init__(self, region_name="us-east-1"):
+        self.meta = FakeMeta(region_name)
+
+
+class FakeRequest:
+    def __init__(self):
+        self.headers = {}
+
+
+def install_with_fake_manager(client=None, **overrides):
+    """install() always builds its own real SessionManager; tests patch its
+    get_token/invalidate afterward via the manager it returns."""
+    client = client or FakeClient()
+    kwargs = dict(proxy_base_url="https://proxy.whiteroom.tech", server_id="proxy.whiteroom.tech")
+    kwargs.update(overrides)
+    manager = install(client, **kwargs)
+    return client, manager
+
+
+class TestInstall:
+    def test_registers_before_send_and_needs_retry_for_bedrock_runtime(self):
+        client, _ = install_with_fake_manager()
+        assert "before-send.bedrock-runtime" in client.meta.events.registered
+        assert "needs-retry.bedrock-runtime" in client.meta.events.registered
+
+    def test_resolves_region_from_the_client_when_not_given_explicitly(self):
+        client = FakeClient(region_name="eu-west-1")
+        _, manager = install_with_fake_manager(client)
+        assert manager._region == "eu-west-1"
+
+    def test_explicit_region_overrides_the_client_default(self):
+        client = FakeClient(region_name="eu-west-1")
+        _, manager = install_with_fake_manager(client, region="ap-southeast-2")
+        assert manager._region == "ap-southeast-2"
+
+    def test_raises_when_no_region_can_be_determined(self):
+        client = FakeClient(region_name=None)
+        with pytest.raises(ValueError, match="region"):
+            install(client, proxy_base_url="https://proxy.whiteroom.tech", server_id="proxy.whiteroom.tech")
+
+    def test_returns_the_session_manager_for_manual_control(self):
+        _, manager = install_with_fake_manager()
+        assert hasattr(manager, "get_token")
+        assert hasattr(manager, "invalidate")
+
+
+class TestAttachSession:
+    def test_sets_the_session_header_from_get_token(self):
+        client, manager = install_with_fake_manager()
+        with patch.object(manager, "get_token", return_value="wrbs_testtoken123"):
+            handler = client.meta.events.registered["before-send.bedrock-runtime"]
+            request = FakeRequest()
+            handler(request)
+        assert request.headers[SESSION_HEADER] == "wrbs_testtoken123"
+
+    def test_does_not_force_a_refresh_on_every_call(self):
+        # get_token() is called with no force argument -- the hook relies on
+        # SessionManager's own TTL caching, it doesn't re-attest every call.
+        client, manager = install_with_fake_manager()
+        with patch.object(manager, "get_token", return_value="tok") as mock_get_token:
+            handler = client.meta.events.registered["before-send.bedrock-runtime"]
+            handler(FakeRequest())
+        mock_get_token.assert_called_once_with()
+
+
+class TestRetryOnSessionRejection:
+    def _invoke(self, client, response, attempts):
+        handler = client.meta.events.registered["needs-retry.bedrock-runtime"]
+        return handler(response=response, attempts=attempts)
+
+    def test_forces_an_immediate_retry_on_the_first_403(self):
+        client, manager = install_with_fake_manager()
+        http_response = MagicMock(status_code=403)
+        with patch.object(manager, "invalidate") as mock_invalidate:
+            result = self._invoke(client, (http_response, None), attempts=1)
+        assert result == 0
+        mock_invalidate.assert_called_once()
+
+    def test_does_not_force_a_second_retry(self):
+        # Two failures in a row is treated as a real, persistent rejection
+        # (bad server_id, revoked tenant) -- not something re-attesting a
+        # second time will fix.
+        client, manager = install_with_fake_manager()
+        http_response = MagicMock(status_code=403)
+        with patch.object(manager, "invalidate") as mock_invalidate:
+            result = self._invoke(client, (http_response, None), attempts=2)
+        assert result is None
+        mock_invalidate.assert_not_called()
+
+    def test_ignores_non_403_statuses(self):
+        client, manager = install_with_fake_manager()
+        http_response = MagicMock(status_code=500)
+        with patch.object(manager, "invalidate") as mock_invalidate:
+            result = self._invoke(client, (http_response, None), attempts=1)
+        assert result is None
+        mock_invalidate.assert_not_called()
+
+    def test_ignores_a_missing_response(self):
+        client, _ = install_with_fake_manager()
+        assert self._invoke(client, None, attempts=1) is None
+
+    def test_ignores_a_missing_http_response(self):
+        client, _ = install_with_fake_manager()
+        assert self._invoke(client, (None, None), attempts=1) is None