zscaler-sdk-python 1.0.2__tar.gz → 1.1.0__tar.gz

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: zscaler-sdk-python
-Version: 1.0.2
+Version: 1.1.0
 Summary: Official Python SDK for the Zscaler Products
 Home-page: https://github.com/zscaler/zscaler-sdk-python
 License: MIT

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zscaler-sdk-python"
-version = "1.0.2"
+version = "1.1.0"
 description = "Official Python SDK for the Zscaler Products"
 authors = ["Zscaler, Inc. <devrel@zscaler.com>"]
 license = "MIT"
@@ -45,12 +45,12 @@ arrow = ">=1.3.0"
 black = ">=24.3.0"
 flake8 = ">=7.0.0"
 isort = ">=5.13.0"
-pytest = ">=8.0.0"
+pytest = ">=8.3.5"
 pytest-mock = ">=3.12.0"
 pytest-asyncio = ">=0.23.0"
 pytest-cov = ">=4.1.0"
 pyfakefs = ">=5.7.0"
-responses = ">=0.25.0"
+responses = ">=0.25.7"
 sphinx = ">=7.2.0"
 sphinx-autobuild = ">=2024.1.0"
 sphinx_rtd_theme = ">=1.3.0"

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/__init__.py

@@ -29,7 +29,7 @@ __license__ = "MIT"
 __contributors__ = [
     "William Guilherme",
 ]
-__version__ = "1.0.2"
+__version__ = "1.1.0"
 
 
 from zscaler.oneapi_client import Client as ZscalerClient  # noqa

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/helpers.py

@@ -50,6 +50,9 @@ def to_snake_case(string):
         "dnsResolutionOnTransparentProxyIPv6ExemptUrlCategories": "dns_resolution_on_transparent_proxy_ipv6_exempt_url_categories",
         "endPointDLPLogType": "end_point_dlp_log_type",
         "emailDLPLogType": "email_dlp_log_type",
+        "extranetDNSList": "extranet_dns_list",
+        "primaryDNSServer": "primary_dns_server",
+        "secondaryDNSServer": "secondary_dns_server",
     }
 
     if string in FIELD_EXCEPTIONS:
@@ -108,6 +111,9 @@ def to_lower_camel_case(string):
         "dns_resolution_on_transparent_proxy_ipv6_exempt_url_categories": "dnsResolutionOnTransparentProxyIPv6ExemptUrlCategories",
         "end_point_dlp_log_type": "endPointDLPLogType",
         "email_dlp_log_type": "emailDLPLogType",
+        "extranet_dns_list": "extranetDNSList",
+        "primary_dns_server": "primaryDNSServer",
+        "secondary_dns_server": "secondaryDNSServer",
     }
 
     if string in FIELD_EXCEPTIONS:

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/utils.py

@@ -75,7 +75,7 @@ reformat_params = [
     ("zpa_application_segment_groups", "zpaApplicationSegmentGroups"),
     ("workload_groups", "workloadGroups"),
     ("service_ids", "services"),
-    # etc. expand as needed
+    ("bandwidth_class_ids", "bandwidthClasses"),
 ]
 
 
@@ -675,7 +675,6 @@ def is_valid_ssh_key(private_key: str) -> bool:
     ]
     return any(re.search(pattern, private_key) for pattern in ssh_key_patterns)
 
-
 def validate_and_convert_times(start_time_str, end_time_str, time_zone_str):
     """
     Validates and converts provided time strings to epoch.
@@ -731,6 +730,27 @@ def validate_and_convert_times(start_time_str, end_time_str, time_zone_str):
 
     return start_epoch, end_epoch
 
+def convert_dc_exclusion_times(start_time_str, end_time_str, time_zone_str):
+    """
+    Converts and validates DC exclusion times based on API rules:
+    - start_time must be >= 5 min in the future and within 30 days
+    - end_time must be >= 2 hours after start_time and within 15 days
+    """
+    start_epoch, end_epoch = validate_and_convert_times(start_time_str, end_time_str, time_zone_str)
+
+    now = int(datetime.datetime.now(pytz.timezone(time_zone_str)).timestamp())
+
+    if start_epoch < now + 300:
+        raise ValueError("Start time must be at least 5 minutes in the future.")
+    if start_epoch > now + (30 * 86400):
+        raise ValueError("Start time must be within 30 days from now.")
+
+    if end_epoch < start_epoch + 7200:
+        raise ValueError("End time must be at least 2 hours after start time.")
+    if end_epoch > start_epoch + (15 * 86400):
+        raise ValueError("End time must be within 15 days from start time.")
+
+    return start_epoch, end_epoch
 
 def convert_date_time_to_seconds(date_time):
     """

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/zcc/admin_user.py

@@ -16,7 +16,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
-from zscaler.utils import format_url, zcc_param_map
+from zscaler.utils import format_url
 from zscaler.zcc.models.admin_user import AdminUser
 from zscaler.zcc.models.admin_roles import AdminRoles
 

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/zdx/legacy.py

@@ -1,8 +1,8 @@
 import logging
 import os
 import time
-import json
 import requests
+import random
 from hashlib import sha256
 from zscaler import __version__
 from zscaler.cache.no_op_cache import NoOpCache
@@ -12,6 +12,8 @@ from zscaler.user_agent import UserAgent
 # Setup the logger
 setup_logging(logger_name="zscaler-sdk-python")
 logger = logging.getLogger("zscaler-sdk-python")
+_token_cache = {}
+_jwks_cache = {}
 
 
 class LegacyZDXClientHelper:
@@ -82,20 +84,37 @@ class LegacyZDXClientHelper:
         Helper method to perform a GET request with rate limiting retry logic.
         """
         max_retries = self.config["client"]["rateLimit"].get("maxRetries", 3)
+        retry_threshold = self.config["client"]["rateLimit"].get("remainingThreshold", 2)
+
         for attempt in range(max_retries):
             response = session.get(url, timeout=self.timeout)
-            if response.status_code == 429:
-                rate_limit_reset = response.headers.get("RateLimit-Reset")
-                try:
-                    delay = int(rate_limit_reset) + 1 if rate_limit_reset else 1
-                except Exception:
-                    delay = 1
+
+            remaining = response.headers.get("X-Ratelimit-Remaining-Second")
+            limit = response.headers.get("X-Ratelimit-Limit-Second")
+
+            try:
+                remaining_int = int(remaining) if remaining else None
+                limit_int = int(limit) if limit else None
+            except Exception:
+                remaining_int, limit_int = None, None
+
+            # Proactive backoff before hitting the limit
+            if remaining_int is not None and remaining_int < retry_threshold:
+                delay = 1 + random.uniform(0, 0.5)  # Add jitter
                 sanitized_url = url.split("?")[0]
                 logger.info(
-                    f"Rate limit hit on GET {sanitized_url}.Retrying in {delay} seconds (attempt {attempt + 1}/{max_retries})"
+                    f"Rate limit approaching on GET {sanitized_url}. "
+                    f"Remaining={remaining_int}, Limit={limit_int}. "
+                    f"Backing off for {delay:.2f}s (attempt {attempt + 1}/{max_retries})"
                 )
                 time.sleep(delay)
                 continue
+
+            if response.status_code == 429:
+                logger.warning(f"429 received from {url}. Retrying with fallback delay.")
+                time.sleep(1 + random.uniform(0, 0.5))
+                continue
+
             try:
                 response.raise_for_status()
             except Exception as e:
@@ -117,31 +136,6 @@ class LegacyZDXClientHelper:
 
         session.headers.update({"Authorization": f"Bearer {token}"})
 
-        validate_url = f"{self.url}/v1/oauth/validate"
-        try:
-            validate_response = self._get_with_rate_limiting(session, validate_url)
-            validate_data = validate_response.json()
-            # logger.debug(f"Token validation response: {validate_data}")
-            logger.debug(f"Token validation response: {{'valid': {validate_data.get('valid', False)}}}")
-            if not validate_data.get("valid", False):
-                raise Exception("Token validation failed: token is not valid.")
-            else:
-                logger.info("Token validated successfully.")
-        except Exception as e:
-            logger.error("Token validation failed: %s", e)
-            raise Exception(f"Token validation failed: {e}")
-
-        jwks_url = f"{self.url}/v1/oauth/jwks"
-        try:
-            jwks_response = self._get_with_rate_limiting(session, jwks_url)
-            jwks_data = jwks_response.json()
-            # logger.debug(f"JWKS response: {json.dumps(jwks_data, indent=2)}")
-            sanitized_jwks_data = {"keys": [{"kid": key.get("kid")} for key in jwks_data.get("keys", [])]}
-            logger.debug(f"Sanitized JWKS response: {json.dumps(sanitized_jwks_data, indent=2)}")
-        except Exception as e:
-            logger.error("Failed to retrieve JWKS: %s", e)
-            raise Exception(f"Failed to retrieve JWKS: {e}")
-
         return session
 
     def create_token(self):
@@ -152,6 +146,13 @@ class LegacyZDXClientHelper:
         Raises:
             Exception: If token retrieval fails.
         """
+        cache_key = f"{self._client_id}:{self._client_secret}"
+        if cache_key in _token_cache:
+            logger.info("Using cached ZDX token.")
+            self.auth_token = _token_cache[cache_key]
+            self.request_executor._default_headers["Authorization"] = f"Bearer {self.auth_token}"
+            return {"token": self.auth_token}
+
         max_retries = self.config["client"]["rateLimit"].get("maxRetries", 3)
         for attempt in range(max_retries):
             epoch_time = int(time.time())
@@ -165,7 +166,6 @@ class LegacyZDXClientHelper:
             }
 
             token_url = f"{self.url}/v1/oauth/token"
-            # logger.debug(f"Token request URL: {token_url}")
             response = requests.post(
                 token_url,
                 json=payload,
@@ -177,22 +177,25 @@ class LegacyZDXClientHelper:
             )
 
             if response.status_code == 429:
-                rate_limit_reset = response.headers.get("RateLimit-Reset")
+                remaining = response.headers.get("X-Ratelimit-Remaining-Second")
                 try:
-                    delay = int(rate_limit_reset) + 1 if rate_limit_reset else 1
+                    remaining_int = int(remaining) if remaining else None
                 except Exception:
-                    delay = 1
-                logger.info(
-                    # f"Rate limit hit on token request. Retrying in {delay} seconds (attempt {attempt + 1}/{max_retries})."
-                    "Rate limit hit on token request. Retrying after a delay. Attempt %d of %d.",
-                    attempt + 1,
-                    max_retries,
-                )
-                time.sleep(delay)
-                continue
+                    remaining_int = None
+
+                delay = 1 + random.uniform(0, 0.5)  # Default 1s backoff + jitter
+                if remaining_int is not None and remaining_int < 2:
+                    logger.warning(
+                        "Rate limit exceeded on token request. Retrying in %.2fs (attempt %d/%d)",
+                        delay,
+                        attempt + 1,
+                        max_retries,
+                    )
+                    time.sleep(delay)
+                    continue
 
             try:
-                response.raise_for_status()  # Raise exception for non-2xx responses
+                response.raise_for_status()
             except Exception as e:
                 logger.error("Failed to retrieve token: %s", e)
                 raise Exception(f"Failed to retrieve token: {e}")
@@ -204,6 +207,7 @@ class LegacyZDXClientHelper:
 
             # Save the token and update default headers for subsequent requests
             self.auth_token = token
+            _token_cache[cache_key] = token  # ✅ Cache it
             self.request_executor._default_headers["Authorization"] = f"Bearer {token}"
 
             return token_data
@@ -231,12 +235,60 @@ class LegacyZDXClientHelper:
         Returns:
             dict: The JWKS response.
         """
-        response, error = self.request_executor.execute(self.request_executor.create_request("GET", "/v1/oauth/jwks"))
+        if self._client_id in _jwks_cache:
+            logger.info("Using cached JWKS data.")
+            return _jwks_cache[self._client_id]
 
-        if error:
-            raise Exception(f"Failed to retrieve JWKS: {error}")
+        jwks_url = f"{self.url}/v1/oauth/jwks"
+        max_retries = self.config["client"]["rateLimit"].get("maxRetries", 3)
+        retry_threshold = self.config["client"]["rateLimit"].get("remainingThreshold", 2)
 
-        return response.data
+        for attempt in range(max_retries):
+            response = requests.get(
+                jwks_url,
+                headers={
+                    "Authorization": f"Bearer {self.auth_token}",
+                    "User-Agent": self.user_agent,
+                },
+                timeout=self.timeout,
+            )
+
+            remaining = response.headers.get("X-Ratelimit-Remaining-Second")
+            try:
+                remaining_int = int(remaining) if remaining else None
+            except Exception:
+                remaining_int = None
+
+            # Proactive backoff
+            if remaining_int is not None and remaining_int < retry_threshold:
+                delay = 1 + random.uniform(0, 0.5)
+                logger.info(
+                    "Rate limit approaching on JWKS request. Remaining=%s. Backing off %.2fs (attempt %d/%d)",
+                    remaining,
+                    delay,
+                    attempt + 1,
+                    max_retries,
+                )
+                time.sleep(delay)
+                continue
+
+            if response.status_code == 429:
+                delay = 1 + random.uniform(0, 0.5)
+                logger.warning("429 on JWKS request. Retrying after %.2fs (attempt %d/%d)", delay, attempt + 1, max_retries)
+                time.sleep(delay)
+                continue
+
+            try:
+                response.raise_for_status()
+            except Exception as e:
+                logger.error("Failed to retrieve JWKS: %s", e)
+                raise Exception(f"Failed to retrieve JWKS: {e}")
+
+            jwks_data = response.json()
+            _jwks_cache[self._client_id] = jwks_data  # ✅ Cache the JWKS data
+            return jwks_data
+
+        raise Exception(f"Failed to retrieve JWKS after {max_retries} attempts due to rate limiting.")
 
     def get_base_url(self, endpoint):
         return self.url

{zscaler_sdk_python-1.0.2 → zscaler_sdk_python-1.1.0}/zscaler/zia/admin_roles.py

@@ -17,6 +17,7 @@ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 from zscaler.api_client import APIClient
 from zscaler.request_executor import RequestExecutor
 from zscaler.zia.models.admin_roles import AdminRoles
+from zscaler.zia.models.admin_roles import PasswordExpiry
 from zscaler.utils import format_url
 
 
@@ -242,3 +243,108 @@ class AdminRolesAPI(APIClient):
         if error:
             return (None, response, error)
         return (None, response, None)
+
+    def get_password_expiry_settings(self) -> tuple:
+        """
+        Retrieves the password expiration information for all the admins
+
+        Note: This method is not compatible with Zidentity enabled Tenants
+
+        Returns:
+            tuple: A tuple containing:
+                - PasswordExpiry: The current password expiry settings object.
+                - Response: The raw HTTP response returned by the API.
+                - error: An error message if the request failed; otherwise, `None`.
+
+        Examples:
+            Retrieves the password expiration information for all the admins
+
+            >>> settings, _, err = client.zia.admin_roles.get_password_expiry_settings()
+            >>> if err:
+            ...     print(f"Error fetching password expiry settings: {err}")
+            ...     return
+            ... print("Current password expiry settings fetched successfully.")
+            ... print(settings)
+        """
+        http_method = "get".upper()
+        api_url = format_url(
+            f"""
+            {self._zia_base_endpoint}
+            /passwordExpiry/settings
+        """
+        )
+
+        request, error = self._request_executor.create_request(http_method, api_url)
+
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request)
+
+        if error:
+            return (None, response, error)
+
+        try:
+            advanced_settings = PasswordExpiry(response.get_body())
+            return (advanced_settings, response, None)
+        except Exception as ex:
+            return (None, response, ex)
+
+    def update_password_expiry_settings(self, **kwargs) -> tuple:
+        """
+        Updates the password expiration information for all the admins.
+
+        Note: This method is not compatible with Zidentity enabled Tenants
+
+        Args:
+            Supported attributes:
+                - password_expiration_enabled (bool): Specifies whether password expiration is enabled for the admin
+                - password_expiry_days (int): Password expiration duration, calculated in days
+
+        Returns:
+            tuple: A tuple containing:
+                - PasswordExpiry: The updated password expiry settings object.
+                - Response: The raw HTTP response returned by the API.
+                - error: An error message if the update failed; otherwise, `None`.
+
+        Examples:
+            Update advanced threat protection settings by blocking specific threats:
+
+            >>> settings, _, err = client.zia.admin_roles.update_password_expiry_settings(
+            ...     password_expiration_enabled = True,
+            ...     password_expiry_days = '90',
+            ... )
+            >>> if err:
+            ...     print(f"Error fetching password expiry: {err}")
+            ...     return
+            ... print("Current password expiry fetched successfully.")
+            ... print(settings)
+        """
+        http_method = "put".upper()
+        api_url = format_url(
+            f"""
+            {self._zia_base_endpoint}
+            /cyberThreatProtection/advancedThreatSettings
+            """
+        )
+
+        body = {}
+        body.update(kwargs)
+
+        request, error = self._request_executor.create_request(http_method, api_url, body, {}, {})
+        if error:
+            return (None, None, error)
+
+        response, error = self._request_executor.execute(request, PasswordExpiry)
+        if error:
+            return (None, response, error)
+
+        try:
+            if response and hasattr(response, "get_body") and response.get_body():
+                result = PasswordExpiry(self.form_response_body(response.get_body()))
+            else:
+                result = PasswordExpiry()
+        except Exception as error:
+            return (None, response, error)
+
+        return (result, response, None)