Class swarmauri_tokens_sshcert.SshCertTokenService.SshCertTokenService

swarmauri_tokens_sshcert.SshCertTokenService.SshCertTokenService

SshCertTokenService(
    ca_key_provider, *, ca_kid, ca_key_version=None
)

Bases: TokenServiceBase

Source code in swarmauri_tokens_sshcert/SshCertTokenService.py

def __init__(
    self,
    ca_key_provider: IKeyProvider,
    *,
    ca_kid: str,
    ca_key_version: Optional[int] = None,
) -> None:
    super().__init__()
    self._kp = ca_key_provider
    self._ca_kid = ca_kid
    self._ca_ver = ca_key_version

type class-attribute instance-attribute

type = 'SshCertTokenService'

model_config class-attribute instance-attribute

model_config = ConfigDict(
    extra="allow", arbitrary_types_allowed=True
)

id class-attribute instance-attribute

id = Field(default_factory=generate_id)

members class-attribute instance-attribute

members = None

owners class-attribute instance-attribute

owners = None

host class-attribute instance-attribute

host = None

default_logger class-attribute

default_logger = None

logger class-attribute instance-attribute

logger = None

name class-attribute instance-attribute

name = None

resource class-attribute instance-attribute

resource = Field(default=CRYPTO.value, frozen=True)

version class-attribute instance-attribute

version = '0.1.0'

supports

supports()

Source code in swarmauri_tokens_sshcert/SshCertTokenService.py

def supports(self) -> Mapping[str, Iterable[str]]:
    return {
        "formats": ("SSH-CERT",),
        "algs": ("ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256"),
    }

mint async

mint(
    claims,
    *,
    alg,
    kid=None,
    key_version=None,
    headers=None,
    lifetime_s=None,
    issuer=None,
    subject=None,
    audience=None,
    scope=None,
)

Source code in swarmauri_tokens_sshcert/SshCertTokenService.py

async def mint(
    self,
    claims: Dict[str, Any],
    *,
    alg: str,
    kid: Optional[str] = None,
    key_version: Optional[int] = None,
    headers: Optional[Dict[str, Any]] = None,
    lifetime_s: Optional[int] = None,
    issuer: Optional[str] = None,
    subject: Optional[str] = None,
    audience: Optional[Union[str, list[str]]] = None,
    scope: Optional[str] = None,
) -> str:
    _require_ssh_keygen()
    subj_pub: str = claims.get("subject_pub") or claims.get("subject_public")
    if not isinstance(subj_pub, str) or not subj_pub.strip():
        raise ValueError("claims['subject_pub'] (OpenSSH public key) is required")
    if not subj_pub.strip().endswith("\n"):
        subj_pub = subj_pub.strip() + "\n"

    params = _MintParams(
        cert_type=(claims.get("cert_type") or "user"),
        principals=tuple(claims.get("principals") or []),
        key_id=(claims.get("key_id") or claims.get("kid") or "ssh-cert"),
        serial=claims.get("serial"),
        valid_after=claims.get("valid_after"),
        valid_before=claims.get("valid_before"),
        critical_options=dict(claims.get("critical_options") or {}),
        extensions=dict(claims.get("extensions") or {}),
    )
    if params.cert_type not in ("user", "host"):
        raise ValueError("claims['cert_type'] must be 'user' or 'host'")
    if not params.principals:
        raise ValueError("claims['principals'] is required and must be non-empty")

    ca_ref = await self._kp.get_key(self._ca_kid, self._ca_ver, include_secret=True)
    if not ca_ref.material:
        raise RuntimeError(
            "CA private key material is not exportable under current policy"
        )
    ca_priv_path = _write_temp(ca_ref.material, mode=0o600, suffix=".pem")

    subj_pub_path = _write_temp(subj_pub, mode=0o600, suffix=".pub")
    cert_out_path = (
        subj_pub_path[:-4] + "-cert.pub"
        if subj_pub_path.endswith(".pub")
        else subj_pub_path + "-cert.pub"
    )

    v_spec = _format_validity_v_spec(params.valid_after, params.valid_before)
    if not (params.valid_after and params.valid_before) and lifetime_s:
        if lifetime_s % 60 == 0:
            v_spec = f"+{int(lifetime_s / 60)}m"
        else:
            v_spec = f"+{int(lifetime_s)}s"

    cmd = [
        "ssh-keygen",
        "-s",
        ca_priv_path,
        "-I",
        params.key_id,
        "-V",
        v_spec,
        "-z",
        str(params.serial if params.serial is not None else int(time.time())),
    ]

    if params.cert_type == "user":
        cmd += ["-n", ",".join(params.principals)]
    else:
        cmd += ["-h", "-n", ",".join(params.principals)]

    for k, v in params.critical_options.items():
        if v is None or v == "":
            cmd += ["-O", k]
        else:
            cmd += ["-O", f"{k}={v}"]

    for k, v in params.extensions.items():
        if v is None or v == "":
            cmd += ["-O", k]
        else:
            cmd += ["-O", f"{k}={v}"]

    cmd.append(subj_pub_path)

    try:
        subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        cert_line = _read_file(cert_out_path).decode("utf-8").strip()
        if not any(cert_line.startswith(p) for p in _SSH_CERT_PREFIXES):
            raise RuntimeError("Unexpected certificate format from ssh-keygen")
        return cert_line
    except subprocess.CalledProcessError as e:
        raise RuntimeError(f"ssh-keygen failed: {e.output.strip()}") from e
    finally:
        _del(subj_pub_path)
        _del(cert_out_path)
        _del(ca_priv_path)

verify async

verify(token, *, issuer=None, audience=None, leeway_s=60)

Source code in swarmauri_tokens_sshcert/SshCertTokenService.py

async def verify(
    self,
    token: str,
    *,
    issuer: Optional[str] = None,
    audience: Optional[Union[str, list[str]]] = None,
    leeway_s: int = 60,
) -> Dict[str, Any]:
    _require_ssh_keygen()

    cert_path = _write_temp(
        token if token.endswith("\n") else token + "\n",
        mode=0o600,
        suffix="-cert.pub",
    )

    ca_ref = await self._kp.get_key(
        self._ca_kid, self._ca_ver, include_secret=False
    )
    if not ca_ref.public:
        raise RuntimeError(
            "CA public key not available from provider for verification"
        )
    ca_pub_text = (
        ca_ref.public.decode("utf-8")
        if isinstance(ca_ref.public, (bytes, bytearray))
        else ca_ref.public
    )
    ca_fp = _fp_of_public(ca_pub_text)

    try:
        out = subprocess.check_output(
            ["ssh-keygen", "-Lf", cert_path], text=True, stderr=subprocess.STDOUT
        )
    except subprocess.CalledProcessError as e:
        _del(cert_path)
        raise ValueError(
            f"Invalid SSH certificate (ssh-keygen -Lf failed): {e.output.strip()}"
        ) from e

    info = _parse_cert_listing(out)

    signed_by = info.get("signed_by_sha256")
    if not signed_by:
        _del(cert_path)
        raise ValueError(
            "Unable to determine signing CA fingerprint from certificate"
        )
    if signed_by != ca_fp:
        _del(cert_path)
        raise ValueError("Certificate signer does not match configured CA")

    def _parse_ts(s: str) -> int:
        s = s.replace("T", " ").strip()
        tm = time.strptime(s, "%Y-%m-%d %H:%M:%S")
        return int(time.mktime(time.gmtime(time.mktime(tm))))

    now = int(time.time())
    va = info.get("valid_after_str")
    vb = info.get("valid_before_str")
    if va and vb:
        va_epoch = _parse_ts(va)
        vb_epoch = _parse_ts(vb)
        info["valid_after"] = va_epoch
        info["valid_before"] = vb_epoch
        if now + leeway_s < va_epoch:
            _del(cert_path)
            raise ValueError("Certificate not yet valid")
        if vb_epoch and now > vb_epoch + leeway_s:
            _del(cert_path)
            raise ValueError("Certificate expired")

    if audience is not None:
        principals = set(info.get("principals", []))
        if isinstance(audience, str):
            aud_ok = audience in principals
        else:
            aud_ok = any(a in principals for a in audience)
        if not aud_ok:
            _del(cert_path)
            raise ValueError("Audience/principal mismatch")

    info["active"] = True
    _del(cert_path)
    return info

jwks async

jwks()

Source code in swarmauri_tokens_sshcert/SshCertTokenService.py

async def jwks(self) -> dict:
    return {"keys": []}

register_model classmethod

register_model()

Decorator to register a base model in the unified registry.

RETURNS	DESCRIPTION
Callable	A decorator function that registers the model class. TYPE: Callable[[Type[BaseModel]], Type[BaseModel]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_model(cls) -> Callable[[Type[BaseModel]], Type[BaseModel]]:
    """
    Decorator to register a base model in the unified registry.

    Returns:
        Callable: A decorator function that registers the model class.
    """

    def decorator(model_cls: Type[BaseModel]):
        """Register ``model_cls`` as a base model."""
        model_name = model_cls.__name__
        if model_name in cls._registry:
            glogger.warning(
                "Model '%s' is already registered; skipping duplicate.", model_name
            )
            return model_cls

        cls._registry[model_name] = {"model_cls": model_cls, "subtypes": {}}
        glogger.debug("Registered base model '%s'.", model_name)
        DynamicBase._recreate_models()
        return model_cls

    return decorator

register_type classmethod

register_type(resource_type=None, type_name=None)

Decorator to register a subtype under one or more base models in the unified registry.

PARAMETER	DESCRIPTION
resource_type	The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase) are used. TYPE: Optional[Union[Type[T], List[Type[T]]]] DEFAULT: None
type_name	An optional custom type name for the subtype. TYPE: Optional[str] DEFAULT: None

RETURNS	DESCRIPTION
Callable	A decorator function that registers the subtype. TYPE: Callable[[Type[DynamicBase]], Type[DynamicBase]]

Source code in swarmauri_base/DynamicBase.py

@classmethod
def register_type(
    cls,
    resource_type: Optional[Union[Type[T], List[Type[T]]]] = None,
    type_name: Optional[str] = None,
) -> Callable[[Type["DynamicBase"]], Type["DynamicBase"]]:
    """
    Decorator to register a subtype under one or more base models in the unified registry.

    Parameters:
        resource_type (Optional[Union[Type[T], List[Type[T]]]]):
            The base model(s) under which to register the subtype. If None, all direct base classes (except DynamicBase)
            are used.
        type_name (Optional[str]): An optional custom type name for the subtype.

    Returns:
        Callable: A decorator function that registers the subtype.
    """

    def decorator(subclass: Type["DynamicBase"]):
        """Register ``subclass`` as a subtype."""
        if resource_type is None:
            resource_types = [
                base for base in subclass.__bases__ if base is not cls
            ]
        elif not isinstance(resource_type, list):
            resource_types = [resource_type]
        else:
            resource_types = resource_type

        for rt in resource_types:
            if not issubclass(subclass, rt):
                raise TypeError(
                    f"'{subclass.__name__}' must be a subclass of '{rt.__name__}'."
                )
            final_type_name = type_name or getattr(
                subclass, "_type", subclass.__name__
            )
            base_model_name = rt.__name__

            if base_model_name not in cls._registry:
                cls._registry[base_model_name] = {"model_cls": rt, "subtypes": {}}
                glogger.debug(
                    "Created new registry entry for base model '%s'.",
                    base_model_name,
                )

            subtypes_dict = cls._registry[base_model_name]["subtypes"]
            if final_type_name in subtypes_dict:
                glogger.warning(
                    "Type '%s' already exists under '%s'; skipping duplicate.",
                    final_type_name,
                    base_model_name,
                )
                continue

            subtypes_dict[final_type_name] = subclass
            glogger.debug(
                "Registered '%s' as '%s' under '%s'.",
                subclass.__name__,
                final_type_name,
                base_model_name,
            )

        DynamicBase._recreate_models()
        return subclass

    return decorator

model_validate_toml classmethod

model_validate_toml(toml_data)

Validate a model from a TOML string.

Source code in swarmauri_base/TomlMixin.py

@classmethod
def model_validate_toml(cls, toml_data: str):
    """Validate a model from a TOML string."""
    try:
        # Parse TOML into a Python dictionary
        toml_content = tomllib.loads(toml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(toml_content))
    except tomllib.TOMLDecodeError as e:
        raise ValueError(f"Invalid TOML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_toml

model_dump_toml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a TOML representation of the model.

Source code in swarmauri_base/TomlMixin.py

def model_dump_toml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a TOML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into TOML
    return toml.dumps(filtered_data)

model_validate_yaml classmethod

model_validate_yaml(yaml_data)

Validate a model from a YAML string.

Source code in swarmauri_base/YamlMixin.py

@classmethod
def model_validate_yaml(cls, yaml_data: str):
    """Validate a model from a YAML string."""
    try:
        # Parse YAML into a Python dictionary
        yaml_content = yaml.safe_load(yaml_data)

        # Convert the dictionary to JSON and validate using Pydantic
        return cls.model_validate_json(json.dumps(yaml_content))
    except yaml.YAMLError as e:
        raise ValueError(f"Invalid YAML data: {e}")
    except ValidationError as e:
        raise ValueError(f"Validation failed: {e}")

model_dump_yaml

model_dump_yaml(
    fields_to_exclude=None, api_key_placeholder=None
)

Return a YAML representation of the model.

Source code in swarmauri_base/YamlMixin.py

def model_dump_yaml(self, fields_to_exclude=None, api_key_placeholder=None):
    """Return a YAML representation of the model."""
    if fields_to_exclude is None:
        fields_to_exclude = []

    # Load the JSON string into a Python dictionary
    json_data = json.loads(self.model_dump_json())

    # Function to recursively remove specific keys and handle api_key placeholders
    def process_fields(data, fields_to_exclude):
        """Recursively filter fields and apply placeholders."""
        if isinstance(data, dict):
            return {
                key: (
                    api_key_placeholder
                    if key == "api_key" and api_key_placeholder is not None
                    else process_fields(value, fields_to_exclude)
                )
                for key, value in data.items()
                if key not in fields_to_exclude
            }
        elif isinstance(data, list):
            return [process_fields(item, fields_to_exclude) for item in data]
        else:
            return data

    # Filter the JSON data
    filtered_data = process_fields(json_data, fields_to_exclude)

    # Convert the filtered data into YAML using safe mode
    return yaml.safe_dump(filtered_data, default_flow_style=False)

model_post_init

model_post_init(logger=None)

Assign a logger instance after model initialization.

Source code in swarmauri_base/LoggerMixin.py

def model_post_init(self, logger: Optional[FullUnion[LoggerBase]] = None) -> None:
    """Assign a logger instance after model initialization."""

    # Directly assign the provided FullUnion[LoggerBase] or fallback to the
    # class-level default.
    self.logger = self.logger or logger or self.default_logger