Class swarmauri_certservice_stepca.StepCaCertService.StepCaCertService

swarmauri_certservice_stepca.StepCaCertService.StepCaCertService

StepCaCertService(
    ca_url,
    *,
    verify_tls=True,
    timeout_s=6.0,
    provisioner=None,
    token_provider=None,
)

Bases: CertServiceBase

X.509 CSR and certificate handling via a step-ca backend.

Implements portions of RFC 2986 (CSRs) and RFC 5280 (X.509 certificates).

Source code in swarmauri_certservice_stepca/StepCaCertService.py

def __init__(
    self,
    ca_url: str,
    *,
    verify_tls: Union[bool, str, bytes] = True,
    timeout_s: float = 6.0,
    provisioner: Optional[str] = None,
    token_provider: Optional[Callable[[Dict[str, Any]], Awaitable[str]]] = None,
) -> None:
    super().__init__(
        ca_url=ca_url.rstrip("/"),
        verify_tls=verify_tls,
        timeout_s=float(timeout_s),
        provisioner=provisioner,
        token_provider=token_provider,
    )
    self._client: Optional[httpx.AsyncClient] = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

type class-attribute instance-attribute

type = 'StepCaCertService'

ca_url instance-attribute

ca_url

verify_tls class-attribute instance-attribute

verify_tls = True

timeout_s class-attribute instance-attribute

timeout_s = 6.0

provisioner class-attribute instance-attribute

provisioner = None

token_provider class-attribute instance-attribute

token_provider = None

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

version class-attribute instance-attribute

version = '0.1.0'

aclose async

aclose()

Source code in swarmauri_certservice_stepca/StepCaCertService.py

async def aclose(self) -> None:
    if self._client is not None:
        await self._client.aclose()
        self._client = None

supports

supports()

Return supported algorithms and features.

Source code in swarmauri_certservice_stepca/StepCaCertService.py

def supports(self) -> Mapping[str, Iterable[str]]:
    """Return supported algorithms and features."""
    return {
        "key_algs": ("RSA-2048", "RSA-3072", "EC-P256", "Ed25519"),
        "sig_algs": ("RSA-PSS-SHA256", "ECDSA-P256-SHA256", "Ed25519"),
        "features": ("csr", "sign_from_csr", "verify", "parse", "remote_ca"),
    }

create_csr async

create_csr(
    key,
    subject,
    *,
    san=None,
    extensions=None,
    sig_alg=None,
    challenge_password=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certservice_stepca/StepCaCertService.py

async def create_csr(
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    san: Optional[AltNameSpec] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    challenge_password: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> CsrBytes:
    sk = _load_private_key(key)
    builder = x509.CertificateSigningRequestBuilder()
    builder = builder.subject_name(_to_name(subject))
    if sanext := _san_from_spec(san):
        builder = builder.add_extension(sanext, critical=False)
    for ext in _extensions_from_spec(extensions):
        builder = builder.add_extension(ext.value, critical=ext.critical)
    if challenge_password:
        builder = builder.add_attribute(
            x509.ObjectIdentifier("1.2.840.113549.1.9.7"),
            challenge_password.encode(),
        )
    if sig_alg is None:
        if isinstance(sk, rsa.RSAPrivateKey):
            csr = builder.sign(sk, hashes.SHA256())
        elif isinstance(sk, ec.EllipticCurvePrivateKey):
            csr = builder.sign(sk, hashes.SHA256())
        elif isinstance(sk, ed25519.Ed25519PrivateKey):
            csr = builder.sign(sk, None)
        else:
            raise ValueError("Unsupported private key type for CSR signing.")
    else:
        if isinstance(sk, rsa.RSAPrivateKey):
            csr = builder.sign(sk, hashes.SHA256())
        elif isinstance(sk, ec.EllipticCurvePrivateKey):
            csr = builder.sign(sk, hashes.SHA256())
        elif isinstance(sk, ed25519.Ed25519PrivateKey):
            csr = builder.sign(sk, None)
        else:
            raise ValueError("Unsupported private key type for CSR signing.")
    encoding = (
        serialization.Encoding.DER if output_der else serialization.Encoding.PEM
    )
    return csr.public_bytes(encoding)

sign_cert async

sign_cert(
    csr,
    ca_key,
    *,
    issuer=None,
    ca_cert=None,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certservice_stepca/StepCaCertService.py

async def sign_cert(
    self,
    csr: CsrBytes,
    ca_key: KeyRef,
    *,
    issuer: Optional[SubjectSpec] = None,
    ca_cert: Optional[CertBytes] = None,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> CertBytes:
    payload: Dict[str, Any] = {}
    if (
        b"BEGIN CERTIFICATE REQUEST" in csr
        or b"BEGIN NEW CERTIFICATE REQUEST" in csr
    ):
        csr_pem = csr.decode() if isinstance(csr, (bytes, bytearray)) else csr
    else:
        csr_pem = (
            x509.load_der_x509_csr(csr)
            .public_bytes(serialization.Encoding.PEM)
            .decode()
        )
    payload["csr"] = csr_pem
    if not_before:
        payload["notBefore"] = dt.datetime.fromtimestamp(
            int(not_before), dt.timezone.utc
        ).isoformat()
    if not_after:
        payload["notAfter"] = dt.datetime.fromtimestamp(
            int(not_after), dt.timezone.utc
        ).isoformat()
    if self.provisioner or (opts and opts.get("provisioner")):
        payload["provisioner"] = (
            opts.get("provisioner") if opts else self.provisioner
        )
    if opts and opts.get("template_data"):
        payload["templateData"] = opts["template_data"]
    if opts and opts.get("extra"):
        payload.update(dict(opts["extra"]))
    ott: Optional[str] = None
    if opts and isinstance(opts.get("ott") or opts.get("token"), str):
        ott = str(opts.get("ott") or opts.get("token"))
    elif self.token_provider:
        claims = self._claims_from_csr(csr_pem)
        ott = await self.token_provider(claims)
    if not ott:
        raise ValueError(
            "StepCaCertService.sign_cert requires 'ott' in opts or a token_provider on the service.",
        )
    payload["ott"] = ott
    payload["token"] = ott
    client = await self._http()
    resp = await client.post("/1.0/sign", json=payload)
    if resp.status_code >= 400:
        try:
            data = resp.json()
            raise RuntimeError(
                f"step-ca sign failed: {data.get('message') or data}"
            )
        except Exception:  # pragma: no cover - fall through for non-JSON
            raise
    content_type = resp.headers.get("content-type", "")
    if "application/json" in content_type:
        data = resp.json()
        pem = data.get("crt") or data.get("certificate") or data.get("pem")
        if isinstance(pem, list):
            cert_pem = "\n".join(pem)
        elif isinstance(pem, str):
            cert_pem = pem
        else:
            cert_pem = resp.text
    else:
        cert_pem = resp.text
    if output_der:
        cert = x509.load_pem_x509_certificate(cert_pem.encode())
        return cert.public_bytes(serialization.Encoding.DER)
    return cert_pem.encode()

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

create_self_signed async

create_self_signed(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def create_self_signed(self, *a, **kw):
    raise NotImplementedError(
        "create_self_signed() must be implemented by subclass"
    )

verify_cert async

verify_cert(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def verify_cert(self, *a, **kw):
    raise NotImplementedError("verify_cert() must be implemented by subclass")

parse_cert async

parse_cert(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def parse_cert(self, *a, **kw):
    raise NotImplementedError("parse_cert() must be implemented by subclass")