Class swarmauri_signing_dpop.DpopSigner.DpopSigner

swarmauri_signing_dpop.DpopSigner.DpopSigner

DpopSigner()

Bases: SigningBase

DPoP proof signer/verifier that conforms to the SigningBase/ISigning surface.

Source code in swarmauri_signing_dpop/DpopSigner.py

def __init__(self) -> None:
    self._jws = JwsSignerVerifier()

type class-attribute instance-attribute

type = 'SigningBase'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_signing_dpop/DpopSigner.py

def supports(self) -> dict[str, t.Iterable[str]]:
    structured = ("detached-bytes", "dpop-http-request", "structured-json")
    return {
        "signs": ("bytes", "digest", "envelope", "stream"),
        "verifies": ("bytes", "digest", "envelope", "stream"),
        "envelopes": ("raw", "mapping", *structured),
        "algs": tuple(sorted(a.value for a in _ALLOWED_ALGS)),
        "canons": ("raw", "json"),
        "features": ("detached_only",),
    }

canonicalize_envelope async

canonicalize_envelope(env, *, canon=None, opts=None)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def canonicalize_envelope(
    self,
    env: Envelope,
    *,
    canon: t.Optional[Canon] = None,
    opts: t.Optional[dict[str, t.Any]] = None,
) -> bytes:
    if canon in (None, "raw"):
        if isinstance(env, (bytes, bytearray)):
            return bytes(env)
        if isinstance(env, str):
            return env.encode("utf-8")
    if canon == "json" or not isinstance(env, (bytes, bytearray, str)):
        return _json_c14n(env)  # type: ignore[arg-type]
    raise ValueError(f"Unsupported canon: {canon}")

sign_bytes async

sign_bytes(key, payload, *, alg=None, opts=None)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def sign_bytes(
    self,
    key: KeyRef,
    payload: bytes,
    *,
    alg: t.Optional[str] = None,
    opts: t.Optional[dict[str, t.Any]] = None,
) -> t.Sequence[Signature]:
    o = opts or {}
    htm = (o.get("htm") or "").upper()
    htu = o.get("htu") or ""
    if not htm or not htu:
        raise ValueError("DPoP signing requires opts['htm'] and opts['htu']")

    km = _resolve_keyref(key, alg)
    if km.alg not in _ALLOWED_ALGS:
        raise ValueError(f"Unsupported alg for DPoP: {km.alg.value}")

    iat = int(o.get("iat") or _now())
    jti = o.get("jti") or str(uuid4())
    nonce = o.get("nonce")
    access_token = o.get("access_token")

    claims: dict[str, t.Any] = {"htm": htm, "htu": htu, "iat": iat, "jti": jti}
    if nonce:
        claims["nonce"] = str(nonce)
    if access_token:
        claims["ath"] = _ath_from_access_token(access_token)

    header_extra = {"typ": "dpop+jwt", "jwk": km.pub_jwk}
    token = await self._jws.sign_compact(
        payload=claims,
        alg=km.alg,
        key=km.keyref,
        header_extra=header_extra,
    )
    jkt = _jwk_thumbprint_b64url(km.pub_jwk)
    return [
        {
            "alg": km.alg.value,
            "format": "dpop+jwt",
            "sig": token,
            "jkt": jkt,
        }
    ]

verify_bytes async

verify_bytes(
    payload, signatures, *, require=None, opts=None
)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def verify_bytes(
    self,
    payload: bytes,
    signatures: t.Sequence[Signature],
    *,
    require: t.Optional[dict[str, t.Any]] = None,
    opts: t.Optional[dict[str, t.Any]] = None,
) -> bool:
    if not signatures:
        return False
    req = require or {}
    method_req = (req.get("htm") or "").upper()
    url_req = req.get("htu") or ""
    if not method_req or not url_req:
        raise ValueError("DPoP verify requires require['htm'] and require['htu']")

    max_skew = int(req.get("max_skew_s", 300))
    allowed_algs = {
        (a if isinstance(a, JWAAlg) else JWAAlg(a))
        for a in (req.get("algs") or _ALLOWED_ALGS)
    }
    expect_nonce = req.get("nonce")
    expect_ath = req.get("access_token")
    replay = req.get("replay") or {}
    seen = replay.get("seen")
    mark = replay.get("mark")

    now = _now()

    for sig in signatures:
        token = sig.get("sig")
        if not isinstance(token, str):
            continue
        try:
            parts = token.split(".")
            if len(parts) != 3:
                continue
            header = json.loads(_b64url_dec(parts[0]))
            if header.get("typ") != "dpop+jwt":
                continue
            alg_raw = header.get("alg")
            jwk = header.get("jwk")
            alg_enum = JWAAlg(alg_raw)
            if alg_enum not in allowed_algs or not isinstance(jwk, dict):
                continue

            result = await self._jws.verify_compact(
                token,
                jwks_resolver=lambda _kid, _alg, jwk=jwk: jwk,
                alg_allowlist=[alg_enum],
            )
            claims = json.loads(result.payload.decode("utf-8"))

            if (claims.get("htm") or "").upper() != method_req:
                continue
            if claims.get("htu") != url_req:
                continue
            iat = int(claims.get("iat", 0))
            if abs(now - iat) > max_skew:
                continue
            if expect_nonce is not None and claims.get("nonce") != expect_nonce:
                continue
            if expect_ath is not None:
                ath = claims.get("ath")
                if not isinstance(ath, str) or ath != _ath_from_access_token(
                    expect_ath
                ):
                    continue

            jti = claims.get("jti")
            if not isinstance(jti, str) or not jti:
                continue
            if seen and seen(jti):
                continue
            if mark:
                try:
                    mark(jti, max_skew)
                except Exception:
                    pass

            return True
        except Exception:
            continue
    return False

sign_digest async

sign_digest(key, digest, *, alg=None, opts=None)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def sign_digest(
    self,
    key: KeyRef,
    digest: bytes,
    *,
    alg: t.Optional[Alg] = None,
    opts: t.Optional[t.Mapping[str, t.Any]] = None,
) -> t.Sequence[Signature]:
    return await self.sign_bytes(key, digest, alg=alg, opts=opts)

verify_digest async

verify_digest(
    digest, signatures, *, require=None, opts=None
)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def verify_digest(
    self,
    digest: bytes,
    signatures: t.Sequence[Signature],
    *,
    require: t.Optional[t.Mapping[str, t.Any]] = None,
    opts: t.Optional[t.Mapping[str, t.Any]] = None,
) -> bool:
    return await self.verify_bytes(digest, signatures, require=require, opts=opts)

sign_envelope async

sign_envelope(key, env, *, alg=None, canon=None, opts=None)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def sign_envelope(
    self,
    key: KeyRef,
    env: Envelope,
    *,
    alg: t.Optional[str] = None,
    canon: t.Optional[Canon] = None,
    opts: t.Optional[dict[str, t.Any]] = None,
) -> t.Sequence[Signature]:
    _ = await self.canonicalize_envelope(env, canon=canon, opts=opts)
    return await self.sign_bytes(key, b"", alg=alg, opts=opts)

verify_envelope async

verify_envelope(
    env, signatures, *, canon=None, require=None, opts=None
)

Source code in swarmauri_signing_dpop/DpopSigner.py

async def verify_envelope(
    self,
    env: Envelope,
    signatures: t.Sequence[Signature],
    *,
    canon: t.Optional[Canon] = None,
    require: t.Optional[dict[str, t.Any]] = None,
    opts: t.Optional[dict[str, t.Any]] = None,
) -> bool:
    _ = await self.canonicalize_envelope(env, canon=canon, opts=opts)
    return await self.verify_bytes(b"", signatures, require=require, opts=opts)

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger

sign_stream async

sign_stream(key, payload, *, alg=None, opts=None)

Source code in swarmauri_base/signing/SigningBase.py

async def sign_stream(
    self,
    key: KeyRef,
    payload: ByteStream,
    *,
    alg: Optional[Alg] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> Sequence[Signature]:
    data = await _stream_to_bytes(payload)
    return await self.sign_bytes(key, data, alg=alg, opts=opts)

verify_stream async

verify_stream(
    payload, signatures, *, require=None, opts=None
)

Source code in swarmauri_base/signing/SigningBase.py

async def verify_stream(
    self,
    payload: ByteStream,
    signatures: Sequence[Signature],
    *,
    require: Optional[Mapping[str, object]] = None,
    opts: Optional[Mapping[str, object]] = None,
) -> bool:
    data = await _stream_to_bytes(payload)
    return await self.verify_bytes(data, signatures, require=require, opts=opts)