e744336385
C-6: ConnectorRuntime enforces capability_mask per operation.
READ-only ACs cannot invoke MUTATE operations (wipe, lock, retire).
C-7: AC validated against database (exists, active, not expired)
before connector invocation.
C-9: Delegated AC capability bounded by delegator's capability.
C-10: Command counter uses atomic SQL increment with limit check.
M-23: expire_stale() uses same atomic SQL pattern.
H-1: Sensitive credential fields hidden from repr/logs via repr=False.
H-2: Stub backend requires ALLOW_STUB_CREDENTIALS=true to activate.
H-3: Kerberos backend raises CredentialResolutionError instead of
returning stub ticket.
H-4: Chronicle INTENT emitted before execution, RESULT after.
H-5: device_id validated as UUID before Graph API URL interpolation.
H-8: ConnectorRuntime enforces governance for all connector invocations.
Signed-off-by: Tyler King <tking@guildhouse.dev>
34 lines
1.5 KiB
Python
34 lines
1.5 KiB
Python
try:
|
|
from urllib.parse import urlparse
|
|
except ImportError: # Fall back to Python 2
|
|
from urlparse import urlparse
|
|
|
|
# We may support more auth schemes in the future
|
|
class PopAuthScheme(object):
|
|
HTTP_GET = "GET"
|
|
HTTP_POST = "POST"
|
|
HTTP_PUT = "PUT"
|
|
HTTP_DELETE = "DELETE"
|
|
HTTP_PATCH = "PATCH"
|
|
_HTTP_METHODS = (HTTP_GET, HTTP_POST, HTTP_PUT, HTTP_DELETE, HTTP_PATCH)
|
|
# Internal design: https://identitydivision.visualstudio.com/DevEx/_git/AuthLibrariesApiReview?path=/PoPTokensProtocol/PopTokensProtocol.md
|
|
def __init__(self, http_method=None, url=None, nonce=None):
|
|
"""Create an auth scheme which is needed to obtain a Proof-of-Possession token.
|
|
|
|
:param str http_method:
|
|
Its value is an uppercase http verb, such as "GET" and "POST".
|
|
:param str url:
|
|
The url to be signed.
|
|
:param str nonce:
|
|
The nonce came from resource's challenge.
|
|
"""
|
|
if not (http_method and url and nonce):
|
|
# In the future, we may also support accepting an http_response as input
|
|
raise ValueError("All http_method, url and nonce are required parameters")
|
|
if http_method not in self._HTTP_METHODS:
|
|
raise ValueError("http_method must be uppercase, according to "
|
|
"https://datatracker.ietf.org/doc/html/draft-ietf-oauth-signed-http-request-03#section-3")
|
|
self._http_method = http_method
|
|
self._url = urlparse(url)
|
|
self._nonce = nonce
|
|
|