Class swarmauri_certs_self_signed.SelfSignedCertificate.SelfSignedCertificate

swarmauri_certs_self_signed.SelfSignedCertificate.SelfSignedCertificate

Bases: CertServiceBase

Minimal self-signed certificate builder exposed as a cert service.

subject class-attribute instance-attribute

subject = Field(
    default_factory=lambda: SubjectSpec(CN="localhost")
)

san class-attribute instance-attribute

san = None

extensions class-attribute instance-attribute

extensions = None

not_before class-attribute instance-attribute

not_before = None

not_after class-attribute instance-attribute

not_after = None

lifetime_days class-attribute instance-attribute

lifetime_days = 365

serial class-attribute instance-attribute

serial = None

output_der class-attribute instance-attribute

output_der = False

password class-attribute instance-attribute

password = None

type class-attribute instance-attribute

type = 'CertServiceBase'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_certs_self_signed/SelfSignedCertificate.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "features": ("self_signed",),
        "key_algs": ("RSA", "ECDSA", "Ed25519", "Ed448"),
        "sig_algs": ("RSA-SHA256", "ECDSA-SHA256", "Ed25519", "Ed448"),
        "formats": ("PEM", "DER"),
    }

issue

issue(
    key,
    *,
    subject=None,
    san=None,
    extensions=None,
    not_before=None,
    not_after=None,
    lifetime_days=None,
    serial=None,
    output_der=None,
    password=None,
)

Source code in swarmauri_certs_self_signed/SelfSignedCertificate.py

def issue(
    self,
    key: KeyRef,
    *,
    subject: Optional[SubjectSpec] = None,
    san: Optional[AltNameSpec] = None,
    extensions: Optional[CertExtensionSpec] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    lifetime_days: Optional[int] = None,
    serial: Optional[int] = None,
    output_der: Optional[bool] = None,
    password: Optional[bytes] = None,
) -> bytes:
    if key.material is None:
        raise ValueError(
            "Self-signed issuance requires a private key in KeyRef.material (PEM)."
        )

    pwd = password if password is not None else self.password
    if (
        pwd is None
        and key.tags
        and isinstance(key.tags.get("passphrase"), (str, bytes))
    ):
        pwd = (
            key.tags["passphrase"].encode()
            if isinstance(key.tags["passphrase"], str)
            else key.tags["passphrase"]
        )

    private_key = serialization.load_pem_private_key(key.material, password=pwd)
    public_key = private_key.public_key()

    subject_spec = subject or self.subject
    subj = _name_from_subject(subject_spec)
    issuer = subj

    nb_epoch = not_before if not_before is not None else self.not_before
    na_epoch = not_after if not_after is not None else self.not_after

    if nb_epoch is not None:
        nb = datetime.fromtimestamp(int(nb_epoch), tz=timezone.utc)
    else:
        nb = _now_utc() - timedelta(seconds=300)

    if na_epoch is not None:
        na = datetime.fromtimestamp(int(na_epoch), tz=timezone.utc)
    else:
        life = lifetime_days if lifetime_days is not None else self.lifetime_days
        na = nb + timedelta(days=int(life))

    serial_number = (
        serial if serial is not None else self.serial or x509.random_serial_number()
    )

    builder = (
        x509.CertificateBuilder()
        .subject_name(subj)
        .issuer_name(issuer)
        .public_key(public_key)
        .serial_number(serial_number)
        .not_valid_before(nb)
        .not_valid_after(na)
    )

    ext_spec = extensions if extensions is not None else self.extensions

    bc = _bc_from_spec(ext_spec.get("basic_constraints")) if ext_spec else None
    if bc:
        builder = builder.add_extension(bc, critical=True)

    ku = _ku_from_spec(ext_spec.get("key_usage")) if ext_spec else None
    if ku:
        builder = builder.add_extension(ku, critical=True)

    eku = _eku_from_spec(ext_spec.get("extended_key_usage")) if ext_spec else None
    if eku:
        builder = builder.add_extension(eku, critical=False)

    san_spec = (
        ext_spec.get("subject_alt_name")
        if ext_spec and ext_spec.get("subject_alt_name")
        else san or self.san
    )
    san_ext = _san_from_spec(san_spec)
    if san_ext:
        builder = builder.add_extension(san_ext, critical=False)

    skid = x509.SubjectKeyIdentifier.from_public_key(public_key)
    builder = builder.add_extension(skid, critical=False)
    akid = x509.AuthorityKeyIdentifier.from_issuer_public_key(public_key)
    builder = builder.add_extension(akid, critical=False)

    if ext_spec and ext_spec.get("name_constraints"):
        nc = ext_spec["name_constraints"]
        permitted_dns = [x509.DNSName(d) for d in (nc.get("permitted_dns") or [])]
        excluded_dns = [x509.DNSName(d) for d in (nc.get("excluded_dns") or [])]
        permitted_ip = [
            x509.IPAddress(x509.ipaddress.ip_address(ip))
            for ip in (nc.get("permitted_ip") or [])
        ]  # type: ignore[attr-defined]
        excluded_ip = [
            x509.IPAddress(x509.ipaddress.ip_address(ip))
            for ip in (nc.get("excluded_ip") or [])
        ]  # type: ignore[attr-defined]
        permitted_uri = [
            x509.UniformResourceIdentifier(u)
            for u in (nc.get("permitted_uri") or [])
        ]
        excluded_uri = [
            x509.UniformResourceIdentifier(u)
            for u in (nc.get("excluded_uri") or [])
        ]
        permitted_email = [
            x509.RFC822Name(e) for e in (nc.get("permitted_email") or [])
        ]
        excluded_email = [
            x509.RFC822Name(e) for e in (nc.get("excluded_email") or [])
        ]

        builder = builder.add_extension(
            x509.NameConstraints(
                permitted_subtrees=(
                    permitted_dns + permitted_ip + permitted_uri + permitted_email
                )
                or None,
                excluded_subtrees=(
                    excluded_dns + excluded_ip + excluded_uri + excluded_email
                )
                or None,
            ),
            critical=True,
        )

    sig_hash = _choose_sig_hash(private_key)
    cert = builder.sign(private_key=private_key, algorithm=sig_hash)

    encoding = (
        serialization.Encoding.DER
        if (output_der if output_der is not None else self.output_der)
        else serialization.Encoding.PEM
    )
    return cert.public_bytes(encoding)

create_self_signed async

create_self_signed(
    key,
    subject,
    *,
    serial=None,
    not_before=None,
    not_after=None,
    extensions=None,
    sig_alg=None,
    output_der=False,
    opts=None,
)

Source code in swarmauri_certs_self_signed/SelfSignedCertificate.py

async def create_self_signed(
    self,
    key: KeyRef,
    subject: SubjectSpec,
    *,
    serial: Optional[int] = None,
    not_before: Optional[int] = None,
    not_after: Optional[int] = None,
    extensions: Optional[CertExtensionSpec] = None,
    sig_alg: Optional[str] = None,
    output_der: bool = False,
    opts: Optional[Dict[str, Any]] = None,
) -> bytes:
    san_override = opts.get("san") if opts else None
    lifetime_override = opts.get("lifetime_days") if opts else None
    password_override = opts.get("password") if opts else None
    if isinstance(password_override, str):
        password_override = password_override.encode()
    return self.issue(
        key,
        subject=subject,
        san=san_override,
        extensions=extensions,
        not_before=not_before,
        not_after=not_after,
        lifetime_days=lifetime_override,
        serial=serial,
        output_der=output_der,
        password=password_override,
    )

tls_server classmethod

tls_server(
    common_name,
    dns_names=(),
    ip_addrs=(),
    lifetime_days=397,
)

Source code in swarmauri_certs_self_signed/SelfSignedCertificate.py

@classmethod
def tls_server(
    cls,
    common_name: str,
    dns_names: Sequence[str] = (),
    ip_addrs: Sequence[str] = (),
    lifetime_days: int = 397,
) -> "SelfSignedCertificate":
    subject: SubjectSpec = SubjectSpec(CN=common_name)  # type: ignore[call-arg]
    san = AltNameSpec(dns=list(dns_names), ip=list(ip_addrs))  # type: ignore[call-arg]
    ext: CertExtensionSpec = CertExtensionSpec(  # type: ignore[call-arg]
        basic_constraints=BasicConstraintsSpec(ca=False, path_len=None),  # type: ignore[call-arg]
        key_usage=KeyUsageSpec(  # type: ignore[call-arg]
            digital_signature=True,
            key_encipherment=True,
            data_encipherment=False,
            key_agreement=False,
            content_commitment=False,
            key_cert_sign=False,
            crl_sign=False,
            encipher_only=False,
            decipher_only=False,
        ),
        extended_key_usage=ExtendedKeyUsageSpec(oids=["serverAuth"]),  # type: ignore[call-arg]
        subject_alt_name=san,
    )
    return cls(
        subject=subject, san=san, extensions=ext, lifetime_days=lifetime_days
    )

mTLS_client classmethod

mTLS_client(common_name, emails=(), lifetime_days=365)

Source code in swarmauri_certs_self_signed/SelfSignedCertificate.py

@classmethod
def mTLS_client(
    cls,
    common_name: str,
    emails: Sequence[str] = (),
    lifetime_days: int = 365,
) -> "SelfSignedCertificate":
    subject: SubjectSpec = SubjectSpec(CN=common_name)  # type: ignore[call-arg]
    san = AltNameSpec(email=list(emails))  # type: ignore[call-arg]
    ext: CertExtensionSpec = CertExtensionSpec(  # type: ignore[call-arg]
        basic_constraints=BasicConstraintsSpec(ca=False, path_len=None),  # type: ignore[call-arg]
        key_usage=KeyUsageSpec(  # type: ignore[call-arg]
            digital_signature=True,
            key_encipherment=False,
            data_encipherment=False,
            key_agreement=False,
            content_commitment=False,
            key_cert_sign=False,
            crl_sign=False,
            encipher_only=False,
            decipher_only=False,
        ),
        extended_key_usage=ExtendedKeyUsageSpec(oids=["clientAuth"]),  # type: ignore[call-arg]
        subject_alt_name=san,
    )
    return cls(
        subject=subject, san=san, extensions=ext, lifetime_days=lifetime_days
    )

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

create_csr async

create_csr(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def create_csr(self, *a, **kw):
    raise NotImplementedError("create_csr() must be implemented by subclass")

sign_cert async

sign_cert(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def sign_cert(self, *a, **kw):
    raise NotImplementedError("sign_cert() must be implemented by subclass")

verify_cert async

verify_cert(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def verify_cert(self, *a, **kw):
    raise NotImplementedError("verify_cert() must be implemented by subclass")

parse_cert async

parse_cert(*a, **kw)

Source code in swarmauri_base/certs/CertServiceBase.py

async def parse_cert(self, *a, **kw):
    raise NotImplementedError("parse_cert() must be implemented by subclass")