|
| 1 | +from __future__ import annotations |
| 2 | + |
| 3 | +from collections.abc import Mapping, Sequence |
| 4 | +from dataclasses import dataclass |
| 5 | +from typing import Any |
| 6 | + |
| 7 | +AUTH_COMPOSITION_CONTRACT_SCHEMA = "durable-workflow.v2.auth-composition.contract" |
| 8 | +AUTH_COMPOSITION_CONTRACT_VERSION = 1 |
| 9 | + |
| 10 | +AUTH_COMPOSITION_REQUIRED_EFFECTIVE_CONFIG_FIELDS = ( |
| 11 | + "server_url", |
| 12 | + "namespace", |
| 13 | + "profile", |
| 14 | + "auth", |
| 15 | + "tls", |
| 16 | + "identity", |
| 17 | +) |
| 18 | + |
| 19 | + |
| 20 | +@dataclass(frozen=True) |
| 21 | +class AuthCompositionContractError(ValueError): |
| 22 | + """Raised when the server auth-composition manifest is not compatible.""" |
| 23 | + |
| 24 | + message: str |
| 25 | + |
| 26 | + def __str__(self) -> str: |
| 27 | + return self.message |
| 28 | + |
| 29 | + |
| 30 | +@dataclass(frozen=True) |
| 31 | +class AuthCompositionContract: |
| 32 | + schema: str |
| 33 | + version: int |
| 34 | + connection_precedence: tuple[str, ...] |
| 35 | + profile_precedence: tuple[str, ...] |
| 36 | + canonical_environment: Mapping[str, str] |
| 37 | + auth_material: Mapping[str, Mapping[str, Any]] |
| 38 | + effective_config_required_fields: tuple[str, ...] |
| 39 | + redaction_never_echo: tuple[str, ...] |
| 40 | + |
| 41 | + @property |
| 42 | + def supports_token_auth(self) -> bool: |
| 43 | + token = self.auth_material.get("token") |
| 44 | + return token is not None and token.get("status") == "supported" |
| 45 | + |
| 46 | + @property |
| 47 | + def reserves_mtls(self) -> bool: |
| 48 | + mtls = self.auth_material.get("mtls") |
| 49 | + return mtls is not None and mtls.get("status") == "reserved" |
| 50 | + |
| 51 | + @property |
| 52 | + def reserves_signed_headers(self) -> bool: |
| 53 | + signed_headers = self.auth_material.get("signed_headers") |
| 54 | + return signed_headers is not None and signed_headers.get("status") == "reserved" |
| 55 | + |
| 56 | + |
| 57 | +def parse_auth_composition_contract(manifest: Mapping[str, Any]) -> AuthCompositionContract: |
| 58 | + """Parse and validate the v1 carrier auth-composition contract manifest.""" |
| 59 | + |
| 60 | + _require_value(manifest, "schema", AUTH_COMPOSITION_CONTRACT_SCHEMA) |
| 61 | + _require_value(manifest, "version", AUTH_COMPOSITION_CONTRACT_VERSION) |
| 62 | + |
| 63 | + precedence = _require_mapping(manifest, "precedence") |
| 64 | + canonical_environment = _parse_str_mapping(_require_mapping(manifest, "canonical_environment")) |
| 65 | + auth_material = _parse_auth_material(_require_mapping(manifest, "auth_material")) |
| 66 | + effective_config = _require_mapping(manifest, "effective_config") |
| 67 | + redaction = _require_mapping(manifest, "redaction") |
| 68 | + |
| 69 | + required_fields = _require_str_sequence(effective_config, "required_fields") |
| 70 | + missing_effective_fields = set(AUTH_COMPOSITION_REQUIRED_EFFECTIVE_CONFIG_FIELDS).difference(required_fields) |
| 71 | + if missing_effective_fields: |
| 72 | + fields = ", ".join(sorted(missing_effective_fields)) |
| 73 | + raise AuthCompositionContractError( |
| 74 | + f"Auth composition contract effective_config.required_fields missing [{fields}]." |
| 75 | + ) |
| 76 | + |
| 77 | + _require_env(canonical_environment, "server_url", "DURABLE_WORKFLOW_SERVER_URL") |
| 78 | + _require_env(canonical_environment, "namespace", "DURABLE_WORKFLOW_NAMESPACE") |
| 79 | + _require_env(canonical_environment, "auth_token", "DURABLE_WORKFLOW_AUTH_TOKEN") |
| 80 | + _require_env(canonical_environment, "tls_verify", "DURABLE_WORKFLOW_TLS_VERIFY") |
| 81 | + _require_env(canonical_environment, "profile", "DW_ENV") |
| 82 | + |
| 83 | + token = auth_material.get("token") |
| 84 | + if token is None or token.get("status") != "supported" or token.get("effective_config_value") != "redacted": |
| 85 | + raise AuthCompositionContractError("Auth composition contract must support redacted token auth.") |
| 86 | + |
| 87 | + for reserved in ("mtls", "signed_headers"): |
| 88 | + material = auth_material.get(reserved) |
| 89 | + if material is None or material.get("status") != "reserved": |
| 90 | + raise AuthCompositionContractError( |
| 91 | + f"Auth composition contract must reserve [{reserved}] auth material." |
| 92 | + ) |
| 93 | + |
| 94 | + never_echo = _require_str_sequence(redaction, "never_echo") |
| 95 | + for secret in ("bearer_tokens", "private_keys", "raw_authorization_headers"): |
| 96 | + if secret not in never_echo: |
| 97 | + raise AuthCompositionContractError( |
| 98 | + f"Auth composition contract redaction.never_echo missing [{secret}]." |
| 99 | + ) |
| 100 | + |
| 101 | + return AuthCompositionContract( |
| 102 | + schema=AUTH_COMPOSITION_CONTRACT_SCHEMA, |
| 103 | + version=AUTH_COMPOSITION_CONTRACT_VERSION, |
| 104 | + connection_precedence=tuple(_require_str_sequence(precedence, "connection_values")), |
| 105 | + profile_precedence=tuple(_require_str_sequence(precedence, "profile_selection")), |
| 106 | + canonical_environment=canonical_environment, |
| 107 | + auth_material=auth_material, |
| 108 | + effective_config_required_fields=tuple(required_fields), |
| 109 | + redaction_never_echo=tuple(never_echo), |
| 110 | + ) |
| 111 | + |
| 112 | + |
| 113 | +def _parse_auth_material(value: Mapping[str, Any]) -> Mapping[str, Mapping[str, Any]]: |
| 114 | + parsed: dict[str, Mapping[str, Any]] = {} |
| 115 | + for key, material in value.items(): |
| 116 | + if not isinstance(key, str): |
| 117 | + raise AuthCompositionContractError("Auth composition auth_material keys must be strings.") |
| 118 | + if not isinstance(material, Mapping): |
| 119 | + raise AuthCompositionContractError( |
| 120 | + f"Auth composition auth_material field [{key}] must be an object." |
| 121 | + ) |
| 122 | + parsed[key] = material |
| 123 | + return parsed |
| 124 | + |
| 125 | + |
| 126 | +def _parse_str_mapping(value: Mapping[str, Any]) -> Mapping[str, str]: |
| 127 | + parsed: dict[str, str] = {} |
| 128 | + for key, item in value.items(): |
| 129 | + if not isinstance(key, str): |
| 130 | + raise AuthCompositionContractError("Auth composition mapping keys must be strings.") |
| 131 | + if not isinstance(item, str): |
| 132 | + raise AuthCompositionContractError(f"Auth composition field [{key}] must be a string.") |
| 133 | + parsed[key] = item |
| 134 | + return parsed |
| 135 | + |
| 136 | + |
| 137 | +def _require_mapping(value: Mapping[str, Any], key: str) -> Mapping[str, Any]: |
| 138 | + if key not in value: |
| 139 | + raise AuthCompositionContractError(f"Auth composition contract is missing required field [{key}].") |
| 140 | + item = value[key] |
| 141 | + if not isinstance(item, Mapping): |
| 142 | + raise AuthCompositionContractError(f"Auth composition contract field [{key}] must be an object.") |
| 143 | + return item |
| 144 | + |
| 145 | + |
| 146 | +def _require_str_sequence(value: Mapping[str, Any], key: str) -> Sequence[str]: |
| 147 | + if key not in value: |
| 148 | + raise AuthCompositionContractError(f"Auth composition contract is missing required field [{key}].") |
| 149 | + item = value[key] |
| 150 | + if not isinstance(item, Sequence) or isinstance(item, str | bytes): |
| 151 | + raise AuthCompositionContractError(f"Auth composition contract field [{key}] must be a list.") |
| 152 | + if not all(isinstance(element, str) for element in item): |
| 153 | + raise AuthCompositionContractError(f"Auth composition contract field [{key}] must contain only strings.") |
| 154 | + return item |
| 155 | + |
| 156 | + |
| 157 | +def _require_value(value: Mapping[str, Any], key: str, expected: object) -> None: |
| 158 | + if key not in value: |
| 159 | + raise AuthCompositionContractError(f"Auth composition contract is missing required field [{key}].") |
| 160 | + if value[key] != expected: |
| 161 | + raise AuthCompositionContractError( |
| 162 | + f"Auth composition contract field [{key}] must be [{expected}], got [{value[key]}]." |
| 163 | + ) |
| 164 | + |
| 165 | + |
| 166 | +def _require_env(value: Mapping[str, str], key: str, expected: str) -> None: |
| 167 | + actual = value.get(key) |
| 168 | + if actual != expected: |
| 169 | + raise AuthCompositionContractError( |
| 170 | + f"Auth composition canonical_environment.{key} must be [{expected}], got [{actual}]." |
| 171 | + ) |
0 commit comments