wsfed-caep 0.1.0__py3-none-any.whl

wsfed_caep/__init__.py

@@ -0,0 +1,58 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Server-side WS-Federation relying party that accepts SAML 2.0 assertions, and a CAEP and RISC receiver.
+
+``signals: false`` turns the receiver off. The relying party does not start one itself. The default is
+on. Sign-in does not change, because WS-Federation does not send OAuth scopes. The flag only gates the
+receiver and the requirement for transmitter metadata.
+
+    from wsfed_caep import RelyingParty
+
+    rp = RelyingParty.from_file("wsfed.json")
+    request = rp.login(relay_state="/")
+    who = rp.handle_reply({"method": method, "url": url, "body": body}, request_id)
+"""
+
+from wsfed_caep.config import read_config_file, resolve_config
+from wsfed_caep.errors import WsFedError
+from wsfed_caep.metadata import IdpMetadata
+from wsfed_caep.relying_party import RelyingParty
+from wsfed_caep.replay import MemoryReplayCache
+from wsfed_caep.ssf import (
+    CAEP_EVENTS,
+    DEFAULT_ENDING_EVENTS,
+    DEFAULT_EVENTS_REQUESTED,
+    EVENT,
+    RISC_EVENTS,
+    MemorySessionIndex,
+    SignalsReceiver,
+    subject_of,
+    tracked_from,
+)
+from wsfed_caep.ssf.session_index import DEFAULT_SUBJECT_ATTRIBUTE
+from wsfed_caep.token import WsFedLogin
+from wsfed_caep.x509util import KeyPair, create_self_signed_key_pair
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "CAEP_EVENTS",
+    "DEFAULT_ENDING_EVENTS",
+    "DEFAULT_EVENTS_REQUESTED",
+    "DEFAULT_SUBJECT_ATTRIBUTE",
+    "EVENT",
+    "IdpMetadata",
+    "KeyPair",
+    "MemoryReplayCache",
+    "MemorySessionIndex",
+    "RISC_EVENTS",
+    "RelyingParty",
+    "SignalsReceiver",
+    "WsFedError",
+    "WsFedLogin",
+    "create_self_signed_key_pair",
+    "read_config_file",
+    "resolve_config",
+    "subject_of",
+    "tracked_from",
+]

wsfed_caep/cli.py

@@ -0,0 +1,149 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""wsfed-caep command line: generate-keys and metadata."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from pathlib import Path
+
+from wsfed_caep.config import resolve_config
+from wsfed_caep.relying_party import RelyingParty
+from wsfed_caep.x509util import create_self_signed_key_pair
+
+USAGE = """Usage:
+  wsfed-caep generate-keys --config <wsfed.json> [--cn <name>] [--days <n>] [--bits <n>] [--force]
+  wsfed-caep generate-keys --key <file> --cert <file> [--cn <name>] [--days <n>] [--bits <n>] [--force]
+      A new RSA key and a self-signed certificate, written where the configuration's privateKey and
+      certificate point (or to --key and --cert). Refuses to replace existing files without --force.
+      The key decrypts encrypted assertions and can authenticate the Shared Signals receiver (mutual
+      TLS); WS-Federation itself signs nothing. The common name defaults to one naming the realm.
+
+  wsfed-caep metadata --config <wsfed.json> [--out <file>]
+      This relying party's federation metadata, from the configuration (and its certificate, when it
+      has one): give it to the identity provider. Written to --out, or to standard output."""
+
+
+def parse_args(argv: list[str]) -> tuple[str | None, dict]:
+    if not argv:
+        return None, {}
+    command, rest = argv[0], argv[1:]
+    args: dict = {}
+    i = 0
+    while i < len(rest):
+        item = rest[i]
+        if not item.startswith("--"):
+            raise SystemExit(f"unexpected argument {item}\n\n{USAGE}")
+        key = item[2:]
+        if key in ("force", "help"):
+            args[key] = True
+        else:
+            if i + 1 >= len(rest) or rest[i + 1].startswith("--"):
+                raise SystemExit(f"--{key} needs a value\n\n{USAGE}")
+            args[key] = rest[i + 1]
+            i += 1
+        i += 1
+    return command, args
+
+
+def _strip_file(value: str) -> str:
+    return value[5:] if value.startswith("file:") else value
+
+
+def key_paths(args: dict) -> tuple[str, str, str]:
+    config_path = args.get("config") if isinstance(args.get("config"), str) else None
+    key = args.get("key") if isinstance(args.get("key"), str) else None
+    cert = args.get("cert") if isinstance(args.get("cert"), str) else None
+    common_name = args.get("cn") if isinstance(args.get("cn"), str) else None
+    if config_path:
+        raw = json.loads(Path(config_path).read_text(encoding="utf-8"))
+        base = Path(config_path).resolve().parent
+
+        def at(value, what):
+            if not value or "-----BEGIN " in value:
+                raise SystemExit(f"{config_path}'s {what} must be a file path for generate-keys to write to")
+            value = _strip_file(value)
+            path = Path(value)
+            return path if path.is_absolute() else base / path
+
+        if key is None and raw.get("privateKey"):
+            key = str(at(raw.get("privateKey"), "privateKey"))
+        if cert is None and raw.get("certificate"):
+            cert = str(at(raw.get("certificate"), "certificate"))
+        if not common_name and raw.get("realm"):
+            common_name = f"wsfed-caep-nodejs relying party {raw['realm']}"[:64]
+    if not key or not cert:
+        raise SystemExit(f"generate-keys needs --config, or --key and --cert\n\n{USAGE}")
+    return str(Path(key).resolve()), str(Path(cert).resolve()), common_name or "wsfed-caep-nodejs relying party"
+
+
+def main(argv: list[str] | None = None, out=None) -> None:
+    if argv is None:
+        argv = sys.argv[1:]
+    if out is None:
+        out = sys.stdout.write
+    command, args = parse_args(list(argv))
+    if not command or args.get("help") or command == "help":
+        out(USAGE + "\n")
+        return
+    if command == "generate-keys":
+        key, cert, common_name = key_paths(args)
+        if not args.get("force") and (os.path.exists(key) or os.path.exists(cert)):
+            which = key if os.path.exists(key) else cert
+            raise SystemExit(
+                f"{which} already exists; pass --force to replace the key pair.\n"
+                "Replacing it means giving the identity provider the new metadata before it next encrypts to this relying party."
+            )
+        days = int(args["days"]) if isinstance(args.get("days"), str) else None
+        bits = int(args["bits"]) if isinstance(args.get("bits"), str) else None
+        if days is not None and days <= 0:
+            raise SystemExit("--days must be a positive whole number")
+        if bits is not None and bits not in (2048, 3072, 4096):
+            raise SystemExit("--bits must be 2048, 3072 or 4096")
+        pair = create_self_signed_key_pair(common_name, days=days or 1095, bits=bits or 3072)
+        Path(key).parent.mkdir(parents=True, exist_ok=True)
+        Path(cert).parent.mkdir(parents=True, exist_ok=True)
+        fd = os.open(key, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        try:
+            os.write(fd, pair.private_key_pem.encode())
+        finally:
+            os.close(fd)
+        Path(cert).write_text(pair.certificate_pem, encoding="utf-8")
+        os.chmod(cert, 0o644)
+        out(f"Wrote the private key  {key} (mode 600)\n")
+        out(f"Wrote the certificate  {cert}\n")
+        out(f"  subject   {pair.certificate.subject.rfc4514_string()}\n")
+        return
+    if command == "metadata":
+        config_path = args.get("config") if isinstance(args.get("config"), str) else None
+        if not config_path:
+            raise SystemExit(f"metadata needs --config\n\n{USAGE}")
+        raw = json.loads(Path(config_path).read_text(encoding="utf-8"))
+        raw.pop("idpCa", None)
+        xml = RelyingParty(resolve_config(raw, str(Path(config_path).resolve().parent)), None).metadata()
+        target = args.get("out") if isinstance(args.get("out"), str) else None
+        if target:
+            path = Path(target).resolve()
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text(xml, encoding="utf-8")
+            out(f"Wrote the relying party metadata to {path}\n")
+        else:
+            out(xml)
+        return
+    raise SystemExit(f"unknown command {command}\n\n{USAGE}")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except SystemExit as err:
+        if err.code not in (None, 0):
+            sys.stderr.write(f"{err.code if isinstance(err.code, str) else err}\n" if False else (f"{err.code}\n" if isinstance(err.code, str) else ""))
+            if isinstance(err.code, str):
+                sys.exit(1)
+        raise
+    except Exception as err:
+        sys.stderr.write(f"{err}\n")
+        sys.exit(1)

wsfed_caep/config.py

@@ -0,0 +1,153 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Configuration. signals defaults to on. false is recorded; true and omitted are left off the result."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from urllib.parse import urlparse
+
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+from wsfed_caep.errors import WsFedError
+
+
+class ResolvedConfig:
+    def __init__(self, **kwargs):
+        self.__dict__.update(kwargs)
+
+
+def _pem(value: str) -> bool:
+    return "-----BEGIN " in value
+
+
+def _material(value: str, base_dir: str, what: str) -> str:
+    if value.startswith("env:"):
+        name = value[4:]
+        if not os.environ.get(name):
+            raise WsFedError("config", f"{what} environment variable {name} is not set")
+        value = os.environ[name]
+    if value.startswith("file:"):
+        value = value[5:]
+    if _pem(value):
+        return value
+    path = value if os.path.isabs(value) else str(Path(base_dir) / value)
+    try:
+        return Path(path).read_text(encoding="utf-8")
+    except OSError as err:
+        raise WsFedError("config", f"{what} is neither a PEM nor a readable file ({path})", err) from err
+
+
+def _absolute_url(value, what: str) -> str:
+    if not isinstance(value, str) or not value.strip():
+        raise WsFedError("config", f"{what} is required")
+    try:
+        parsed = urlparse(value)
+        if parsed.scheme not in ("https", "http") or not parsed.netloc:
+            raise ValueError("not http(s)")
+    except Exception:
+        raise WsFedError("config", f"{what} must be an absolute http(s) URL, not {value}") from None
+    return value
+
+
+def _flag(value, default: bool, what: str) -> bool:
+    if value is None:
+        return default
+    if not isinstance(value, bool):
+        raise WsFedError("config", f"{what} must be true or false")
+    return value
+
+
+def _number(value) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool)
+
+
+def _idp_metadata(value: str, base_dir: str) -> str:
+    value = value.strip()
+    if value.startswith("env:"):
+        name = value[4:]
+        if not os.environ.get(name):
+            raise WsFedError("config", f"idpMetadata environment variable {name} is not set")
+        value = os.environ[name].strip()
+    if value.startswith("file:"):
+        value = value[5:]
+    if value.startswith("http://") or value.startswith("https://") or value.startswith("<"):
+        return value
+    return value if os.path.isabs(value) else str(Path(base_dir) / value)
+
+
+def resolve_config(config: dict, base_dir: str | None = None) -> ResolvedConfig:
+    if not isinstance(config, dict):
+        raise WsFedError("config", "the configuration must be an object")
+    base = base_dir or os.getcwd()
+    realm = config.get("realm")
+    if not isinstance(realm, str) or not realm.strip():
+        raise WsFedError("config", "realm is required")
+    reply_url = _absolute_url(config.get("replyUrl"), "replyUrl")
+    raw_metadata = config.get("idpMetadata")
+    if not isinstance(raw_metadata, str) or not raw_metadata.strip():
+        raise WsFedError("config", "idpMetadata is required")
+    skew = 60 if config.get("clockSkewSeconds") is None else config.get("clockSkewSeconds")
+    if not _number(skew) or skew < 0 or skew > 600 or skew != skew:
+        raise WsFedError("config", "clockSkewSeconds must be a number from 0 to 600")
+    signals = _flag(config.get("signals") if "signals" in config else None, True, "signals")
+    # A missing key and an explicit JSON null are both the default. A non-boolean is an error.
+    if "signals" in config:
+        signals = _flag(config.get("signals"), True, "signals")
+    out = ResolvedConfig(
+        realm=realm,
+        reply_url=reply_url,
+        idp_metadata=_idp_metadata(raw_metadata, base),
+        clock_skew_ms=int(skew * 1000) if isinstance(skew, float) and not isinstance(skew, int) else int(skew) * 1000,
+        want_assertions_encrypted=_flag(config.get("wantAssertionsEncrypted") if "wantAssertionsEncrypted" in config else None, False, "wantAssertionsEncrypted"),
+        allow_unsolicited=_flag(config.get("allowUnsolicited") if "allowUnsolicited" in config else None, False, "allowUnsolicited"),
+        request_token_type=_flag(config.get("requestTokenType") if "requestTokenType" in config else None, True, "requestTokenType"),
+    )
+    if "wantAssertionsEncrypted" in config:
+        out.want_assertions_encrypted = _flag(config.get("wantAssertionsEncrypted"), False, "wantAssertionsEncrypted")
+    if "allowUnsolicited" in config:
+        out.allow_unsolicited = _flag(config.get("allowUnsolicited"), False, "allowUnsolicited")
+    if "requestTokenType" in config:
+        out.request_token_type = _flag(config.get("requestTokenType"), True, "requestTokenType")
+    if not signals:
+        out.signals = False
+    has_key = config.get("privateKey") is not None
+    has_cert = config.get("certificate") is not None
+    if has_key != has_cert:
+        raise WsFedError("config", "privateKey and certificate go together: give both or neither")
+    if has_key and has_cert:
+        try:
+            private_key = serialization.load_pem_private_key(_material(config["privateKey"], base, "privateKey").encode(), password=None)
+            certificate = x509.load_pem_x509_certificate(_material(config["certificate"], base, "certificate").encode())
+        except WsFedError:
+            raise
+        except Exception as err:
+            raise WsFedError("config", f"the private key or certificate cannot be read: {err}", err) from err
+        if not isinstance(private_key, rsa.RSAPrivateKey):
+            raise WsFedError("config", f"the private key is {type(private_key).__name__}; an RSA key is required")
+        if certificate.public_key().public_numbers() != private_key.public_key().public_numbers():
+            raise WsFedError("config", "the certificate is not for the private key")
+        out.private_key = private_key
+        out.certificate = certificate
+    elif out.want_assertions_encrypted:
+        raise WsFedError("config", "wantAssertionsEncrypted needs privateKey and certificate: the assertion is encrypted to them")
+    if config.get("idpCa"):
+        out.idp_ca = _material(config["idpCa"], base, "idpCa")
+    if config.get("idpEntityId"):
+        out.idp_entity_id = config["idpEntityId"]
+    return out
+
+
+def read_config_file(path: str, overrides: dict | None = None) -> ResolvedConfig:
+    overrides = overrides or {}
+    try:
+        parsed = json.loads(Path(path).read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as err:
+        raise WsFedError("config", f"{path} cannot be read as JSON: {err}", err) from err
+    defined = {key: value for key, value in overrides.items() if value is not None}
+    merged = {**parsed, **defined}
+    return resolve_config(merged, str(Path(path).resolve().parent))

wsfed_caep/encryption.py

@@ -0,0 +1,128 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Decrypt an EncryptedAssertion or EncryptedID. RSA-OAEP wraps the content key; AES-GCM or AES-CBC holds the XML.
+RSA PKCS#1 v1.5 is refused. An OAEP digest that differs from its MGF1 hash is refused."""
+
+from __future__ import annotations
+
+import base64
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from lxml import etree
+
+from wsfed_caep.errors import WsFedError
+from wsfed_caep.xmlutil import NS, attr, child, descendants, is_el, text
+
+CIPHERS = {
+    "http://www.w3.org/2009/xmlenc11#aes128-gcm": {"name": "aes-128-gcm", "gcm": True, "key_length": 16},
+    "http://www.w3.org/2009/xmlenc11#aes192-gcm": {"name": "aes-192-gcm", "gcm": True, "key_length": 24},
+    "http://www.w3.org/2009/xmlenc11#aes256-gcm": {"name": "aes-256-gcm", "gcm": True, "key_length": 32},
+    "http://www.w3.org/2001/04/xmlenc#aes128-cbc": {"name": "aes-128-cbc", "gcm": False, "key_length": 16},
+    "http://www.w3.org/2001/04/xmlenc#aes192-cbc": {"name": "aes-192-cbc", "gcm": False, "key_length": 24},
+    "http://www.w3.org/2001/04/xmlenc#aes256-cbc": {"name": "aes-256-cbc", "gcm": False, "key_length": 32},
+}
+OAEP_MGF1P = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
+OAEP = "http://www.w3.org/2009/xmlenc11#rsa-oaep"
+DIGESTS = {
+    "http://www.w3.org/2000/09/xmldsig#sha1": hashes.SHA1,
+    "http://www.w3.org/2001/04/xmlenc#sha256": hashes.SHA256,
+    "http://www.w3.org/2001/04/xmldsig-more#sha384": hashes.SHA384,
+    "http://www.w3.org/2001/04/xmlenc#sha512": hashes.SHA512,
+}
+DIGEST_NAMES = {
+    "http://www.w3.org/2000/09/xmldsig#sha1": "sha1",
+    "http://www.w3.org/2001/04/xmlenc#sha256": "sha256",
+    "http://www.w3.org/2001/04/xmldsig-more#sha384": "sha384",
+    "http://www.w3.org/2001/04/xmlenc#sha512": "sha512",
+}
+MGFS = {
+    "http://www.w3.org/2009/xmlenc11#mgf1sha1": "sha1",
+    "http://www.w3.org/2009/xmlenc11#mgf1sha256": "sha256",
+    "http://www.w3.org/2009/xmlenc11#mgf1sha384": "sha384",
+    "http://www.w3.org/2009/xmlenc11#mgf1sha512": "sha512",
+}
+
+
+def _fail(message: str, cause: BaseException | None = None) -> None:
+    raise WsFedError("decryption", message, cause)
+
+
+def _b64(value: str) -> bytes:
+    return base64.b64decode("".join(value.split()))
+
+
+def _unwrap_key(encrypted_key: etree._Element, key: RSAPrivateKey) -> bytes:
+    method = child(encrypted_key, NS["xenc"], "EncryptionMethod")
+    alg = attr(method, "Algorithm") if method is not None else ""
+    alg = alg or ""
+    if alg not in (OAEP_MGF1P, OAEP):
+        _fail(f"the content key is wrapped with {alg or '(none)'}; only RSA-OAEP is accepted")
+    digest_method = child(method, NS["ds"], "DigestMethod") if method is not None else None
+    digest_alg = attr(digest_method, "Algorithm") if digest_method is not None else None
+    digest_name = DIGEST_NAMES.get(digest_alg, "sha1") if digest_alg else "sha1"
+    if digest_alg and digest_alg not in DIGESTS:
+        _fail(f"the OAEP digest {digest_alg} is not supported")
+    mgf = "sha1"
+    if alg == OAEP and method is not None:
+        mgf_el = child(method, NS["xenc11"], "MGF")
+        mgf_alg = attr(mgf_el, "Algorithm") if mgf_el is not None else None
+        if mgf_alg:
+            if mgf_alg not in MGFS:
+                _fail(f"the OAEP mask generation function {mgf_alg} is not supported")
+            mgf = MGFS[mgf_alg]
+    if mgf != digest_name:
+        _fail(f"OAEP with digest {digest_name} and MGF1 {mgf} is not supported; node:crypto uses one hash for both")
+    cipher_value = descendants(encrypted_key, NS["xenc"], "CipherValue")
+    hash_new = DIGESTS[digest_alg] if digest_alg else hashes.SHA1
+    try:
+        return key.decrypt(
+            _b64(text(cipher_value[0]) if cipher_value else ""),
+            padding.OAEP(mgf=padding.MGF1(algorithm=hash_new()), algorithm=hash_new(), label=None),
+        )
+    except WsFedError:
+        raise
+    except Exception as err:
+        _fail("the content key could not be unwrapped with this relying party's key", err)
+    raise AssertionError("unreachable")
+
+
+def decrypt_element(encrypted: etree._Element, key: RSAPrivateKey) -> str:
+    data = encrypted if is_el(encrypted, NS["xenc"], "EncryptedData") else child(encrypted, NS["xenc"], "EncryptedData")
+    if data is None:
+        _fail(f"<{etree.QName(encrypted).localname}> has no EncryptedData")
+    method = child(data, NS["xenc"], "EncryptionMethod")
+    alg = attr(method, "Algorithm") if method is not None else None
+    cipher = CIPHERS.get(alg or "")
+    if not cipher:
+        _fail(f"the content is encrypted with {alg or '(none)'}, which is not supported")
+    keys = descendants(encrypted, NS["xenc"], "EncryptedKey")
+    if not keys:
+        _fail(f"<{etree.QName(encrypted).localname}> carries no EncryptedKey")
+    content_key = _unwrap_key(keys[0], key)
+    if len(content_key) != cipher["key_length"]:
+        _fail(f"the content key is {len(content_key)} bytes; {cipher['name']} needs {cipher['key_length']}")
+    cipher_data = child(data, NS["xenc"], "CipherData")
+    value_el = child(cipher_data, NS["xenc"], "CipherValue") if cipher_data is not None else None
+    raw = _b64(text(value_el))
+    try:
+        if cipher["gcm"]:
+            if len(raw) < 12 + 16:
+                _fail("the ciphertext is too short")
+            return AESGCM(content_key).decrypt(raw[:12], raw[12:], None).decode("utf-8")
+        if len(raw) < 32 or len(raw) % 16:
+            _fail("the ciphertext is not a whole number of blocks")
+        decryptor = Cipher(algorithms.AES(content_key), modes.CBC(raw[:16])).decryptor()
+        plain = decryptor.update(raw[16:]) + decryptor.finalize()
+        pad = plain[-1]
+        if pad < 1 or pad > 16:
+            _fail("the decrypted content is not padded as XML Encryption pads it")
+        return plain[:-pad].decode("utf-8")
+    except WsFedError:
+        raise
+    except Exception as err:
+        _fail("the content could not be decrypted", err)
+    raise AssertionError("unreachable")

wsfed_caep/errors.py

@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Failures this library reports. Applications treat them as a failed sign-in and log the code."""
+
+
+class WsFedError(Exception):
+    """A config, metadata, message, xml, signature, validation, replay, decryption, or ssf failure."""
+
+    def __init__(self, code: str, message: str, cause: BaseException | None = None):
+        super().__init__(message)
+        self.code = code
+        if cause is not None:
+            self.__cause__ = cause

wsfed_caep/http_client.py

@@ -0,0 +1,82 @@
+# SPDX-FileCopyrightText: 2026 Iya CyberSecurity Solutions, LLC
+# SPDX-License-Identifier: MIT
+"""Back channel: identity-provider metadata and the Shared Signals transmitter. TLS is verified."""
+
+from __future__ import annotations
+
+import http.client
+import socket
+import ssl
+import tempfile
+import urllib.parse
+from pathlib import Path
+
+from wsfed_caep.errors import WsFedError
+
+MAX_BYTES = 2 * 1024 * 1024
+TIMEOUT_S = 15
+
+
+def send(url: str, init: dict | None, tls: dict | None, code: str) -> dict:
+    init = init or {}
+    tls = tls or {}
+    parsed = urllib.parse.urlsplit(url)
+    if parsed.scheme not in ("https", "http"):
+        raise WsFedError(code, f"{url} is not an http(s) URL")
+    payload = None if init.get("body") is None else str(init["body"]).encode("utf-8")
+    headers = {str(k): str(v) for k, v in (init.get("headers") or {}).items()}
+    if payload is not None:
+        headers.setdefault("Content-Length", str(len(payload)))
+    port = parsed.port or (443 if parsed.scheme == "https" else 80)
+    path = parsed.path or "/"
+    if parsed.query:
+        path = f"{path}?{parsed.query}"
+    context = None
+    cert_path = key_path = None
+    try:
+        if parsed.scheme == "https":
+            context = ssl.create_default_context()
+            if tls.get("ca"):
+                context.load_verify_locations(cadata=tls["ca"])
+            if tls.get("cert") and tls.get("key"):
+                cert_file = tempfile.NamedTemporaryFile("w", delete=False, suffix=".pem")
+                key_file = tempfile.NamedTemporaryFile("w", delete=False, suffix=".pem")
+                cert_file.write(tls["cert"])
+                key_file.write(tls["key"])
+                cert_file.close()
+                key_file.close()
+                cert_path, key_path = cert_file.name, key_file.name
+                context.load_cert_chain(certfile=cert_path, keyfile=key_path)
+            conn: http.client.HTTPConnection = http.client.HTTPSConnection(parsed.hostname, port, timeout=TIMEOUT_S, context=context)
+        else:
+            conn = http.client.HTTPConnection(parsed.hostname, port, timeout=TIMEOUT_S)
+        try:
+            conn.request(init.get("method") or "GET", path, body=payload, headers=headers)
+            response = conn.getresponse()
+            chunks: list[bytes] = []
+            size = 0
+            while True:
+                chunk = response.read(65536)
+                if not chunk:
+                    break
+                size += len(chunk)
+                if size > MAX_BYTES:
+                    raise WsFedError(code, f"{url} answered more than {MAX_BYTES} bytes")
+                chunks.append(chunk)
+            ctype = response.getheader("content-type") or ""
+            return {"status": response.status, "content_type": ctype, "body": b"".join(chunks).decode("utf-8", "replace")}
+        finally:
+            conn.close()
+    except WsFedError:
+        raise
+    except (socket.timeout, TimeoutError) as err:
+        raise WsFedError(code, f"{url} did not answer within {TIMEOUT_S} s", err) from err
+    except Exception as err:
+        reason = getattr(err, "reason", None)
+        if isinstance(reason, (socket.timeout, TimeoutError)):
+            raise WsFedError(code, f"{url} did not answer within {TIMEOUT_S} s", err) from err
+        raise WsFedError(code, f"{url}: {err}", err) from err
+    finally:
+        for name in (cert_path, key_path):
+            if name:
+                Path(name).unlink(missing_ok=True)