Class swarmauri_certs_cfssl.CfsslCertService.CfsslCertService

swarmauri_certs_cfssl.CfsslCertService.CfsslCertService

CfsslCertService(
    base_url,
    *,
    default_profile=None,
    default_label=None,
    timeout_s=10.0,
    verify_tls=True,
    auth_bearer=None,
    auth_header=None,
    headers=None,
    use_bundle_for_verify=True,
)

Bases: CertServiceBase

Cloudflare CFSSL-backed X.509 signer and validator.

Source code in swarmauri_certs_cfssl/CfsslCertService.py

def __init__(
    self,
    base_url: str,
    *,
    default_profile: Optional[str] = None,
    default_label: Optional[str] = None,
    timeout_s: float = 10.0,
    verify_tls: bool | str = True,
    auth_bearer: Optional[str] = None,
    auth_header: Optional[Tuple[str, str]] = None,
    headers: Optional[Mapping[str, str]] = None,
    use_bundle_for_verify: bool = True,
) -> None:
    super().__init__()
    self._base = base_url.rstrip("/")
    self._profile = default_profile
    self._label = default_label
    self._timeout = float(timeout_s)
    self._verify = verify_tls
    self._use_bundle = bool(use_bundle_for_verify)

    h: Dict[str, str] = {"Accept": "application/json"}
    if headers:
        h.update({str(k): str(v) for k, v in headers.items()})
    if auth_bearer:
        h["Authorization"] = f"Bearer {auth_bearer}"
    if auth_header:
        name, val = auth_header
        h[name] = val

    self._headers = h
    self._client: Optional[httpx.AsyncClient] = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

type class-attribute instance-attribute

type = 'CfsslCertService'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

version class-attribute instance-attribute

version = '0.1.0'

aclose async

aclose()

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def aclose(self) -> None:
    if self._client is not None:
        await self._client.aclose()
        self._client = None

supports

supports()

Source code in swarmauri_certs_cfssl/CfsslCertService.py

def supports(self) -> Mapping[str, Iterable[str]]:  # type: ignore[override]
    return {
        "key_algs": ("RSA-2048", "RSA-3072", "EC-P256", "EC-P384", "Ed25519"),
        "sig_algs": ("RSA-PSS-SHA256", "ECDSA-P256-SHA256", "Ed25519"),
        "features": ("sign_from_csr", "verify", "parse", "bundle"),
        "profiles": ("server", "client", "code_signing"),
    }

create_csr async

create_csr(
    key,
    subject,
    *,
    san=None,
    extensions=None,
    sig_alg=None,
    challenge_password=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def create_csr(  # type: ignore[override]
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    san: Optional[AltNameSpec] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    challenge_password: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> CsrBytes:
    raise NotImplementedError(
        "CfsslCertService does not build CSRs; use X509CertService for CSR creation."
    )

create_self_signed async

create_self_signed(
    key,
    subject,
    *,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def create_self_signed(  # type: ignore[override]
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> CertBytes:
    raise NotImplementedError(
        "CfsslCertService does not issue self-signed certs; use X509CertService instead."
    )

sign_cert async

sign_cert(
    csr,
    ca_key,
    *,
    issuer=None,
    ca_cert=None,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def sign_cert(  # type: ignore[override]
    self,
    csr: CsrBytes,
    ca_key: KeyRef,
    *,
    issuer: Optional[SubjectSpec] = None,
    ca_cert: Optional[CertBytes] = None,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> CertBytes:
    csr_pem = (
        csr
        if csr.strip().startswith(b"-----BEGIN")
        else x509.load_der_x509_csr(csr).public_bytes(serialization.Encoding.PEM)
    )

    profile = (
        (opts or {}).get("profile")
        or self._profile
        or (ca_key.tags.get("profile") if getattr(ca_key, "tags", None) else None)
    )
    label = (
        (opts or {}).get("label")
        or self._label
        or (ca_key.tags.get("label") if getattr(ca_key, "tags", None) else None)
    )

    payload: Dict[str, Any] = {"certificate_request": csr_pem.decode("utf-8")}
    if profile:
        payload["profile"] = str(profile)
    if label:
        payload["label"] = str(label)

    hosts: list[str] = []
    if extensions and extensions.get("subject_alt_name"):
        san = extensions["subject_alt_name"]  # type: ignore[index]
        for d in san.get("dns") or []:
            hosts.append(str(d))
        for ip in san.get("ip") or []:
            hosts.append(str(ip))
    if hosts:
        payload["hosts"] = hosts

    nb = _ts_epoch(not_before)
    na = _ts_epoch(not_after)
    if nb:
        payload["not_before"] = nb
    if na:
        payload["not_after"] = na

    data = await self._post("/api/v1/cfssl/sign", payload)
    result = data.get("result", {})
    cert_pem = result.get("certificate")
    if not cert_pem:
        raise RuntimeError("CFSSL response missing 'result.certificate'")

    cert_bytes = cert_pem.encode("utf-8")
    return _pem_to_der(cert_bytes) if output_der else cert_bytes

verify_cert async

verify_cert(
    cert,
    *,
    trust_roots=None,
    intermediates=None,
    check_time=None,
    check_revocation=False,
    opts=None,
)

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def verify_cert(  # type: ignore[override]
    self,
    cert: CertBytes,
    *,
    trust_roots: Optional[Sequence[CertBytes]] = None,
    intermediates: Optional[Sequence[CertBytes]] = None,
    check_time: Optional[int] = None,
    check_revocation: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> Dict[str, Any]:
    use_bundle = (opts or {}).get("use_bundle", self._use_bundle)
    flavor = (opts or {}).get("flavor", "optimal")

    cert_pem = cert if cert.strip().startswith(b"-----BEGIN") else _der_to_pem(cert)

    chain_len = 1
    bundle_ok = False
    bundle_reason = None

    if use_bundle:
        payload: Dict[str, Any] = {
            "certificate": cert_pem.decode("utf-8"),
            "flavor": flavor,
        }
        if trust_roots:
            payload["roots"] = "\n".join(
                (c if isinstance(c, bytes) else c.encode("utf-8")).decode("utf-8")
                for c in trust_roots
            )
        if intermediates:
            payload["intermediates"] = "\n".join(
                (c if isinstance(c, bytes) else c.encode("utf-8")).decode("utf-8")
                for c in intermediates
            )

        try:
            b = await self._post("/api/v1/cfssl/bundle", payload)
            res = b.get("result", {})
            chain_pem = res.get("bundle")
            if chain_pem:
                chain_len = chain_pem.count("-----BEGIN CERTIFICATE-----")
                bundle_ok = True
        except Exception as e:  # pragma: no cover - network failure
            bundle_ok = False
            bundle_reason = str(e)

    x = x509.load_pem_x509_certificate(cert_pem)
    now_epoch = int(
        dt.datetime.utcnow().timestamp() if check_time is None else check_time
    )
    nbf = int(x.not_valid_before_utc.timestamp())
    naf = int(x.not_valid_after_utc.timestamp())
    time_ok = (now_epoch >= nbf) and (now_epoch <= naf)

    bc = None
    try:
        bc = x.extensions.get_extension_for_class(x509.BasicConstraints).value
    except Exception:
        pass
    is_ca = bool(bc.ca) if bc else False

    out: Dict[str, Any] = {
        "valid": bool(time_ok and (bundle_ok or not use_bundle)),
        "reason": (None if time_ok else "time_invalid")
        or (None if bundle_ok or not use_bundle else bundle_reason),
        "issuer": _parse_name(x.issuer),
        "subject": _parse_name(x.subject),
        "not_before": nbf,
        "not_after": naf,
        "chain_len": chain_len,
        "is_ca": is_ca,
        "revocation_checked": False if check_revocation else False,
    }
    return out

parse_cert async

parse_cert(cert, *, include_extensions=True, opts=None)

Source code in swarmauri_certs_cfssl/CfsslCertService.py

async def parse_cert(  # type: ignore[override]
    self,
    cert: CertBytes,
    *,
    include_extensions: bool = True,
    opts: Optional[Dict[str, Any]] = None,
) -> Dict[str, Any]:
    pem = cert if cert.strip().startswith(b"-----BEGIN") else _der_to_pem(cert)
    c = x509.load_pem_x509_certificate(pem)

    info: Dict[str, Any] = {
        "tbs_version": c.tbs_certificate_bytes is not None and 3 or 3,
        "serial": int(c.serial_number),
        "issuer": _parse_name(c.issuer),
        "subject": _parse_name(c.subject),
        "not_before": int(c.not_valid_before_utc.timestamp()),
        "not_after": int(c.not_valid_after_utc.timestamp()),
    }

    if include_extensions:
        try:
            bc = c.extensions.get_extension_for_class(x509.BasicConstraints).value
            info["basic_constraints"] = {"ca": bc.ca, "path_len": bc.path_length}
        except Exception:
            pass

        try:
            san = c.extensions.get_extension_for_class(
                x509.SubjectAlternativeName
            ).value
            dns = [str(x.value) for x in san.get_values_for_type(x509.DNSName)]
            ips = [str(x.value) for x in san.get_values_for_type(x509.IPAddress)]
            uris = [
                str(x.value)
                for x in san.get_values_for_type(x509.UniformResourceIdentifier)
            ]
            emails = [
                str(x.value) for x in san.get_values_for_type(x509.RFC822Name)
            ]
            info["san"] = {
                "dns": dns or None,
                "ip": ips or None,
                "uri": uris or None,
                "email": emails or None,
            }
        except Exception:
            pass

        try:
            ku = c.extensions.get_extension_for_class(x509.KeyUsage).value
            info["key_usage"] = {
                "digital_signature": ku.digital_signature,
                "content_commitment": ku.content_commitment,
                "key_encipherment": ku.key_encipherment,
                "data_encipherment": ku.data_encipherment,
                "key_agreement": ku.key_agreement,
                "key_cert_sign": ku.key_cert_sign,
                "crl_sign": ku.crl_sign,
                "encipher_only": ku.encipher_only,
                "decipher_only": ku.decipher_only,
            }
        except Exception:
            pass

        try:
            eku = c.extensions.get_extension_for_class(x509.ExtendedKeyUsage).value
            info["eku"] = list(_ext_key_usage_to_oids(eku))
        except Exception:
            pass

        try:
            skid = c.extensions.get_extension_for_class(
                x509.SubjectKeyIdentifier
            ).value
            info["skid"] = base64.b16encode(skid.digest).decode("ascii").lower()
        except Exception:
            pass

        try:
            akid = c.extensions.get_extension_for_class(
                x509.AuthorityKeyIdentifier
            ).value
            if akid.key_identifier:
                info["akid"] = (
                    base64.b16encode(akid.key_identifier).decode("ascii").lower()
                )
        except Exception:
            pass

    return info

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger