Class swarmauri_certservice_ms_adcs.MsAdcsCertService.MsAdcsCertService

swarmauri_certservice_ms_adcs.MsAdcsCertService.MsAdcsCertService

MsAdcsCertService(
    base_url,
    *,
    default_template="User",
    auth=_AuthCfg(),
    session=None,
    timeout_s=15.0,
)

Bases: CertServiceBase

Microsoft AD CS Web Enrollment client.

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

def __init__(
    self,
    base_url: str,
    *,
    default_template: Optional[str] = "User",
    auth: _AuthCfg = _AuthCfg(),
    session: Optional[requests.Session] = None,
    timeout_s: float = 15.0,
) -> None:
    super().__init__()
    self._base = base_url.rstrip("/")
    self._tmpl = default_template
    self._auth_cfg = auth
    self._timeout = timeout_s
    self._s = session or requests.Session()
    self._configure_auth()

type class-attribute instance-attribute

type = 'MsAdcsCertService'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "key_algs": (
            "RSA-2048",
            "RSA-3072",
            "RSA-4096",
            "EC-P256",
            "EC-P384",
            "Ed25519",
        ),
        "sig_algs": ("RSA-PSS-SHA256", "ECDSA-P256-SHA256", "Ed25519"),
        "features": ("sign_from_csr", "verify", "parse", "chain_bundle"),
        "profiles": ("server", "client", "email_protection", "code_signing"),
    }

create_csr async

create_csr(
    key,
    subject,
    *,
    san=None,
    extensions=None,
    sig_alg=None,
    challenge_password=None,
    output_der=False,
    opts=None,
)

Build a PKCS#10 CSR using the private key contained in KeyRef.material.

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

async def create_csr(  # type: ignore[override]
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    san: Optional[AltNameSpec] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    challenge_password: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> bytes:
    """Build a PKCS#10 CSR using the private key contained in KeyRef.material."""
    if not key.material:
        raise ValueError(
            "create_csr: KeyRef.material must contain a PEM private key"
        )

    priv = serialization.load_pem_private_key(key.material, password=None)
    builder = x509.CertificateSigningRequestBuilder().subject_name(
        _mk_name(subject)
    )

    if san:
        dns = [x509.DNSName(d) for d in (san.get("dns") or [])]
        ips = []
        for ip in san.get("ip") or []:
            from ipaddress import ip_address

            ips.append(x509.IPAddress(ip_address(ip)))
        uris = [x509.UniformResourceIdentifier(u) for u in (san.get("uri") or [])]
        emails = [x509.RFC822Name(e) for e in (san.get("email") or [])]
        upns = [
            x509.OtherName(
                x509.ObjectIdentifier("1.3.6.1.4.1.311.20.2.3"), u.encode("utf-8")
            )
            for u in (san.get("upn") or [])
        ]
        san_list = dns + ips + uris + emails + upns
        if san_list:
            builder = builder.add_extension(
                x509.SubjectAlternativeName(san_list), critical=False
            )

    if extensions:
        ku = extensions.get("key_usage")
        if ku:
            builder = builder.add_extension(
                x509.KeyUsage(
                    digital_signature=ku.get("digital_signature", False),
                    content_commitment=ku.get("content_commitment", False),
                    key_encipherment=ku.get("key_encipherment", False),
                    data_encipherment=ku.get("data_encipherment", False),
                    key_agreement=ku.get("key_agreement", False),
                    key_cert_sign=ku.get("key_cert_sign", False),
                    crl_sign=ku.get("crl_sign", False),
                    encipher_only=ku.get("encipher_only", False),
                    decipher_only=ku.get("decipher_only", False),
                ),
                critical=True,
            )
        eku = extensions.get("extended_key_usage")
        if eku and (oids := eku.get("oids")):
            mapped = []
            for token in oids:
                if token == "serverAuth":
                    mapped.append(ExtendedKeyUsageOID.SERVER_AUTH)
                elif token == "clientAuth":
                    mapped.append(ExtendedKeyUsageOID.CLIENT_AUTH)
                elif token == "emailProtection":
                    mapped.append(ExtendedKeyUsageOID.EMAIL_PROTECTION)
                elif token == "codeSigning":
                    mapped.append(ExtendedKeyUsageOID.CODE_SIGNING)
                else:
                    mapped.append(x509.ObjectIdentifier(token))
            builder = builder.add_extension(
                x509.ExtendedKeyUsage(mapped), critical=False
            )

    if challenge_password:
        builder = builder.add_attribute(
            x509.OID_PKCS9_CHALLENGE_PASSWORD, challenge_password.encode()
        )

    sig_hash = hashes.SHA256()
    csr = builder.sign(priv, sig_hash)
    data = csr.public_bytes(
        serialization.Encoding.DER if output_der else serialization.Encoding.PEM
    )
    return data

create_self_signed async

create_self_signed(
    key,
    subject,
    *,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Emit a simple self-signed certificate with sane defaults.

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

async def create_self_signed(  # type: ignore[override]
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> bytes:
    """Emit a simple self-signed certificate with sane defaults."""
    if not key.material:
        raise ValueError(
            "create_self_signed: KeyRef.material must contain a PEM private key"
        )

    from datetime import datetime, timezone

    priv = serialization.load_pem_private_key(key.material, password=None)
    pub = priv.public_key()

    nb = datetime.fromtimestamp(not_before or (_now() - 300), tz=timezone.utc)
    na = datetime.fromtimestamp(
        not_after or (_now() + 365 * 24 * 3600), tz=timezone.utc
    )

    builder = (
        x509.CertificateBuilder()
        .subject_name(_mk_name(subject))
        .issuer_name(_mk_name(subject))
        .serial_number(serial or x509.random_serial_number())
        .not_valid_before(nb)
        .not_valid_after(na)
        .public_key(pub)
    )

    builder = builder.add_extension(
        x509.SubjectKeyIdentifier.from_public_key(pub), critical=False
    )
    builder = builder.add_extension(
        x509.BasicConstraints(ca=False, path_length=None), critical=True
    )

    cert = builder.sign(private_key=priv, algorithm=hashes.SHA256())
    data = cert.public_bytes(
        serialization.Encoding.DER if output_der else serialization.Encoding.PEM
    )
    return data

sign_cert async

sign_cert(
    csr,
    ca_key,
    *,
    issuer=None,
    ca_cert=None,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Submit CSR to AD CS Web Enrollment and return the issued certificate.

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

async def sign_cert(  # type: ignore[override]
    self,
    csr: bytes,
    ca_key: KeyRef,
    *,
    issuer: Optional[SubjectSpec] = None,
    ca_cert: Optional[bytes] = None,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> bytes:
    """Submit CSR to AD CS Web Enrollment and return the issued certificate."""
    raise NotImplementedError("AD CS interaction not implemented in tests")

verify_cert async

verify_cert(
    cert,
    *,
    trust_roots=None,
    intermediates=None,
    check_time=None,
    check_revocation=False,
    opts=None,
)

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

async def verify_cert(  # type: ignore[override]
    self,
    cert: bytes,
    *,
    trust_roots: Optional[Sequence[bytes]] = None,
    intermediates: Optional[Sequence[bytes]] = None,
    check_time: Optional[int] = None,
    check_revocation: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> Dict[str, Any]:
    c = _load_cert_any(cert)
    now = _now() if check_time is None else int(check_time)
    ok_time = c.not_valid_before.timestamp() <= now <= c.not_valid_after.timestamp()

    result = {
        "valid": ok_time,
        "reason": None if ok_time else "time_window",
        "subject": c.subject.rfc4514_string(),
        "issuer": c.issuer.rfc4514_string(),
        "not_before": int(c.not_valid_before.timestamp()),
        "not_after": int(c.not_valid_after.timestamp()),
        "is_ca": any(
            isinstance(ext.value, x509.BasicConstraints) and ext.value.ca
            for ext in c.extensions
        ),
        "revocation_checked": False,
    }

    issuer_bytes = None
    for src in intermediates or []:
        try:
            ic = _load_cert_any(src)
            if ic.subject == c.issuer:
                issuer_bytes = src
                break
        except Exception:  # pragma: no cover - best effort
            pass
    if issuer_bytes is None:
        for src in trust_roots or []:
            try:
                rc = _load_cert_any(src)
                if rc.subject == c.issuer:
                    issuer_bytes = src
                    break
            except Exception:  # pragma: no cover - best effort
                pass

    if issuer_bytes is not None:
        try:
            issuer = _load_cert_any(issuer_bytes)
            pub = issuer.public_key()
            if isinstance(pub, rsa.RSAPublicKey):
                pub.verify(
                    c.signature,
                    c.tbs_certificate_bytes,
                    padding.PKCS1v15(),
                    c.signature_hash_algorithm,
                )
            else:
                pub.verify(
                    c.signature,
                    c.tbs_certificate_bytes,
                    c.signature_hash_algorithm,
                )
            result["valid"] = result["valid"] and True
        except Exception:
            result["valid"] = False
            result["reason"] = "bad_signature"
    return result

parse_cert async

parse_cert(cert, *, include_extensions=True, opts=None)

Source code in swarmauri_certservice_ms_adcs/MsAdcsCertService.py

async def parse_cert(  # type: ignore[override]
    self,
    cert: bytes,
    *,
    include_extensions: bool = True,
    opts: Optional[Dict[str, Any]] = None,
) -> Dict[str, Any]:
    c = _load_cert_any(cert)
    out: Dict[str, Any] = {
        "serial": int(c.serial_number),
        "sig_alg": c.signature_algorithm_oid.dotted_string,
        "issuer": c.issuer.rfc4514_string(),
        "subject": c.subject.rfc4514_string(),
        "not_before": int(c.not_valid_before.timestamp()),
        "not_after": int(c.not_valid_after.timestamp()),
        "skid": None,
        "akid": None,
        "san": None,
        "eku": None,
        "key_usage": None,
        "is_ca": False,
    }
    if include_extensions:
        for ext in c.extensions:
            if isinstance(ext.value, x509.SubjectKeyIdentifier):
                out["skid"] = ext.value.digest.hex(":")
            elif isinstance(ext.value, x509.AuthorityKeyIdentifier):
                out["akid"] = (ext.value.key_identifier or b"").hex(":")
            elif isinstance(ext.value, x509.SubjectAlternativeName):
                san = {"dns": [], "ip": [], "uri": [], "email": []}
                for gn in ext.value:
                    if isinstance(gn, x509.DNSName):
                        san["dns"].append(gn.value)
                    elif isinstance(gn, x509.RFC822Name):
                        san["email"].append(gn.value)
                    elif isinstance(gn, x509.UniformResourceIdentifier):
                        san["uri"].append(gn.value)
                    elif isinstance(gn, x509.IPAddress):
                        san["ip"].append(str(gn.value))
                out["san"] = san
            elif isinstance(ext.value, x509.ExtendedKeyUsage):
                out["eku"] = [oid.dotted_string for oid in ext.value]
            elif isinstance(ext.value, x509.KeyUsage):
                out["key_usage"] = {
                    "digital_signature": ext.value.digital_signature,
                    "content_commitment": ext.value.content_commitment,
                    "key_encipherment": ext.value.key_encipherment,
                    "data_encipherment": ext.value.data_encipherment,
                    "key_agreement": ext.value.key_agreement,
                    "key_cert_sign": ext.value.key_cert_sign,
                    "crl_sign": ext.value.crl_sign,
                    "encipher_only": ext.value.encipher_only,
                    "decipher_only": ext.value.decipher_only,
                }
            elif isinstance(ext.value, x509.BasicConstraints):
                out["is_ca"] = ext.value.ca
    return out

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger