summaryrefslogtreecommitdiff
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* Add `as_dict` option to `Algorithm.to_jwk` (#881)Thitat Auareesuksakul2023-05-091-28/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add `as_dict` option to `Algorithm.to_jwt` * Update unit tests * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fixup! Add `as_dict` option to `Algorithm.to_jwt` * fixup! Add `as_dict` option to `Algorithm.to_jwt` * fixup! Update unit tests * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix type errors * Fix tox test errors * Fix typing for Python 3.7 * Add OKP jwk tests * Add `pragma: no cover` to method overloads * Add pragma: no cover to exclude lines --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Add complete types to take all allowed keys into account (#873)Viicos2023-04-164-59/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Use new style typing * Fix type annotations to allow all keys * Use string type annotations where required * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Remove outdated comment * Ignore `if TYPE_CHECKING:` lines in coverage * Remove duplicate test * Fix mypy errors * Update algorithms.py * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fully switch to modern annotations * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Update `pre-commit` mypy config * Use Python 3.11 for mypy * Update mypy Python version in `pyproject.toml` * Few tests mypy fixes * fix mypy errors on tests * Fix key imports * Remove unused import * Fix randomly failing test --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Asif Saif Uddin <auvipy@gmail.com>
* Add client connection error exception (#876)David Davis2023-04-101-1/+10
| | | | | | This change adds a new `PyJWKClientConnectionError` exception which helps to differentiate connection errors from other types of failures when calling methods such as `get_signing_key_from_jwt()`. This allows users to do things like retry the method if there's a connection issue.
* Add a timeout for PyJWKClient requests (#875)David Davis2023-04-081-0/+17
| | | | | | | | | By default, the timeout for urlopen is socket._GLOBAL_DEFAULT_TIMEOUT which is None (meaning that the request never times out): https://docs.python.org/3/library/socket.html#socket.getdefaulttimeout This change sets the timeout to 30 but also adds a timeout variable users can set.
* Make `Algorithm` an abstract base class (#845)Viicos2023-03-062-38/+14
| | | | | | | | | | | * Make `Algorithm` an abstract base class This also removes some tests that are not relevant anymore Raise `NotImplementedError` for `NoneAlgorithm` * Use `hasattr` instead of `getattr` * Only allow `dict` in `encode`
* [pre-commit.ci] pre-commit autoupdate (#855)pre-commit-ci[bot]2023-02-074-15/+3
| | | | | | | | | | | | | | * [pre-commit.ci] pre-commit autoupdate updates: - [github.com/psf/black: 22.12.0 → 23.1.0](https://github.com/psf/black/compare/22.12.0...23.1.0) * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Improve error messages when cryptography isn't installed (#846)Viicos2023-01-261-1/+7
| | | | | | | | | | | * Improve error messages when cryptography isn't installed * Add test * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Fix `_validate_iat` validation (#847)Viicos2023-01-141-0/+7
| | | | | * Fix `_validate_iat` validation * Add test and update changelog
* Make mypy configuration stricter and improve typing (#830)Aarni Koskela2022-12-103-8/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * PyJWS._verify_signature: raise early KeyError if header is missing alg * Make Mypy configuration stricter * Improve typing in jwt.utils * Improve typing in jwt.help * Improve typing in jwt.exceptions * Improve typing in jwt.api_jwk * Improve typing in jwt.api_jws * Improve typing & clean up imports in jwt.algorithms * Correct JWS.decode rettype to any (payload could be something else) * Update typing in api_jwt * Improve typing in jwks_client * Improve typing in docs/conf.py * Fix (benign) mistyping in test_advisory * Fix misc type complaints in tests
* Add `sort_headers` parameter to `api_jwt.encode` (#832)Erik Vroon2022-12-081-0/+11
| | | | | | | | | | | | | | | | | | | | | | | * Add `sort_headers` parameter to `api_jwt.encode` This allows you to not sort headers, which prevents a breaking change between v2.4.0 and v2.5.0 * Add `test_sorting_headers` test * Remove outdated comment about misordered headers * Explicity assert sorting in `test_sorting_of_headers` * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Parametrize `test_sorting_of_headers` * Use normal dict in `test_sorting_of_headers` * fixup! Use normal dict in `test_sorting_of_headers` Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Add PyJWT._{de,en}code_payload hooks (#829)Aarni Koskela2022-12-081-0/+37
| | | | | * Add PyJWT._decode_payload hook * Add PyJWT._encode_payload hook
* Custom header configuration in jwk client (#823)Michael Haines2022-11-161-0/+13
| | | | | | | | | | | | | | | | | | * allow configuration of custom headers in JWKClient * revert changes to algorithms * document example usage of custom headers * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * black format tests * Add a release note for optional headers arg Co-authored-by: thundercat1 <michael.haines@recursionpharma.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Add `Algorithm.compute_hash_digest` and use it to implement at_hash ↵Stephen Rosen2022-11-021-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | validation example (#775) * Add compute_hash_digest to Algorithm objects `Algorithm.compute_hash_digest` is defined as a method which inspects the object to see that it has the requisite attributes, `hash_alg`. If `hash_alg` is not set, then the method raises a NotImplementedError. This applies to classes like NoneAlgorithm. If `hash_alg` is set, then it is checked for ``` has_crypto # is cryptography available? and isinstance(hash_alg, type) and issubclass(hash_alg, hashes.HashAlgorithm) ``` to see which API for computing a digest is appropriate -- `hashlib` vs `cryptography.hazmat.primitives.hashes`. These checks could be avoided at runtime if it were necessary to optimize further (e.g. attach compute_hash_digest methods to classes with a class decorator) but this is not clearly a worthwhile optimization. Such perf tuning is intentionally omitted for now. * Add doc example of OIDC login flow The goal of this doc example is to demonstrate usage of `get_algorithm_by_name` and `compute_hash_digest` for the purpose of `at_hash` validation. It is not meant to be a "guaranteed correct" and spec-compliant example. closes #314
* Handling 'ImmatureSignatureError' for issued_at time (#794)Sriharan Manogaran2022-10-151-0/+8
| | | | | * Handling 'ImmatureSignatureError' for issued_at time when it is a future time * adding changelog and test cases
* Add cacheing functionality for JWK set (#781)Haoyu(Jerry) Wu2022-08-011-16/+153
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Initial implementation of ttl jwk set cache (cherry picked from commit 479a7c124d63113a2190bd48972cc19172215096) * Add unit test for jwk set cache * Fix failed unit test * Disable cache signing key by default * Add a negative unit test for get_jwk_set * Add functionality to force refresh the jwk set cache when no matching signing key can be found from the cache * Add unit test for refresh cache * Add unit test to unset cache when the network call throws error * fix naming typo * Update unit test naming * Update comment * Add check for lifespan * Update comments for get_signing_key * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix ci error * Add type declaration to fix CI error * Add more unit tests to improve coverage * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Try to increase test coverage to 100% Co-authored-by: Jerry Wu <hawu@roku.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Improve PyJWKSet error accuracy (#786)Julian Maurin2022-08-011-4/+11
| | | | | | | | | * refacto(TestPyJWKSet): crypto_required decorator at the class level * refacto(TestPyJWKSet): add test to validate the constructor behaviour * fix(PyJWKSet): improve error accuracy Co-authored-by: JulianMaurin <julian.maurin@backmarket.com>
* Update audience typing (#782)Julian Maurin2022-07-311-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | * fix(api_jwt): update audience typing & type checking * doc(api): update decode.audience typing * feat(test_api_jwt): ensure audience as bytes raises error * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * refacto(api_jwt): precise typing Co-authored-by: Julian Maurin <julian.maurin.perso@pm.me> Update jwt/api_jwt.py Co-authored-by: Julian Maurin <julian.maurin.perso@pm.me> fix(jwt/api_jwt.py): backport future annotations * fix: handle audience=0 Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Asif Saif Uddin <auvipy@gmail.com>
* Emit a deprecation warning for unsupported kwargs (#776)Stephen Rosen2022-07-052-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `**kwargs` usages cannot be removed without breaking backwards compatibility. Unsupported kwargs cannot even be rejected without breaking compatibility. However, this does not mean that the library cannot identify and warn when unsupported arguments are used. The warning behavior simply has to be separated from any removal of `**kwargs`. All legitimate `**kwargs` usages have been replaced with explicit arguments. Any other arguments will be captured under `**kwargs` and trigger the deprecation warnings. In the cases of `decode() -> decode_complete()` passthrough, the passthrough has been removed to avoid duplicate deprecation warnings on a single usage. This makes a very subtle behavioral change to `**kwargs` *only* for the case of a subclass of PyJWT or PyJWS. Extra arguments used by a specialized subclass won't pass through transparently anymore. In such a case the subclass author has multiple resolutions available, including reimplementation of the `decode()` method to passthrough the additional argument. Although technically backwards-incompatible for a niche subclassing usage, this behavior is very nearly identical and shouldn't pose an issue for the vast majority of pyjwt users. The deprecation warning does not cover all deprecated usages. In particular, several passthrough arguments for claim validation should probably be made available via `options` and later removed. The arguments in need of attention now have inline comments in the signature definitions, but are otherwise left unmodified, leaving current usages correct and valid.
* Do not fail when an unusable key occurs (#762)Matthias Gilch2022-05-313-2/+22
| | | | | | | | | | | | | | | | | | | * Do not fail when a unusable key occurs There may be more than keys in the store which may be (still usable). Therefore we do not want to fail on any key that is not usable by pyjwt, but rather skip when appending to the KeySet * Add test cases with unusable 'alg' keys * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add 'skip keys' to changelog * Update CHANGELOG.rst Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Adjust expected exceptions in option merging tests for PyPy3 (#763)Michał Górny2022-05-261-2/+2
| | | | | | | | | | | | | | | | | | * Adjust expected exceptions in option merging tests for PyPy3 PyPy3 raises ValueError rather than TypeError when trying to combine a dict and a str in dict unpacking. Update the test expectations appropriately. Fixes #580 * Enable GHA testing on Python 3.11 and all PyPy3 versions Enable testing on all Python 3 versions supported by GitHub Actions at the moment. While at it, fix the tox invocation for Python 3.10. * drop pypy3.7 from tox Co-authored-by: Asif Saif Uddin <auvipy@gmail.com>
* Add to_jwk static method to ECAlgorithm (#732)Leon Smith2022-05-232-0/+102
| | | | | | | | | | | | | | | | | * Add to_jwk static method to ECAlgorithm * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add in tests for ECAlgorithm.to_jwk * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Add to_jwk pull request to changelog Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Revert "adding support for compressed payloads (#753)" (#761)Asif Saif Uddin2022-05-231-33/+0
| | | This reverts commit 675fa10db578886ee6cfd1df688236f69560ced4.
* adding support for compressed payloads (#753)Daniel Miles2022-05-191-0/+33
| | | | | | | | | | | | | | | | | | | * adding support for compressed payloads * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * adding test to cover all lines in patch * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * addressing flake8 unused variable and cyclomatic complexity complaints * expanding test for better coverage Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* chore: fix lint errorsJosé Padilla2022-05-151-8/+11
|
* fix: failing advisory testJosé Padilla2022-05-121-0/+3
|
* Merge pull request from GHSA-ffqj-6fqr-9h24José Padilla2022-05-122-1/+110
| | | Co-authored-by: José Padilla <jpadilla@users.noreply.github.com>
* Replace various string interpolations with f-strings (#744)Aarni Koskela2022-04-121-4/+2
|
* Don't mutate options dictionary in .decode_complete() (#743)Aarni Koskela2022-04-051-0/+8
| | | Fixes #679
* Add a deprecation warning when jwt.decode() is called with the legacy ↵Aarni Koskela2022-04-051-0/+16
| | | | | | | verify= argument (#742) Since the arbitrary/unused `**kwargs` can't quite be dropped (as #657 would do) without a major version bump (as reverted in #701), it's still a good idea to warn users if they are attempting to use contradictory arguments for the security-sensitive `verify=` argument.
* Add detached payload support for JWS encoding and decoding (#723)Florent Viard2022-03-261-0/+51
| | | | | | | | | | | | | | | | | | | | | | Specifications allow to have JWS with unencoded detached payloads. This changeset adds detached payload support for encoding and decoding functions. For encoding, detached payload can be enabled by setting the "is_payload_detached" arg or having the "b64=False" inside the headers. For decoding, the detached payload content (bytes) has to be provided with the "detached_payload" arg and "b64=False" has to be found inside the decoded headers. Functionnally, when this feature is used, the signature will be computed over the raw data bytes of the payload, without being base64 encoded and obviously, the payload will not be provided inside the generated JWS. So, the generated JWS will look like: base64url(header)..base64url(signature) Relevant specifications: RFC 7515: "JSON Web Signature (JWS)". (Annexe F) RFC 7797: "JSON Web Signature (JWS) Unencoded Payload Option".
* api_jwk: Add PyJWKSet.__getitem__ (#725)William Woodruff2022-01-251-0/+23
| | | | | | | * api_jwk: Add PyJWKSet.__getitem__ Closes #724. * CHANGELOG: record changes
* Explicit check the key for ECAlgorithm (#713)Evgeniy Tatarkin2021-12-121-0/+12
| | | | | | | | | * Explicit check the key for ECAlgorithm * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Revert "Remove arbitrary kwargs. (#657)" (#701)Asif Saif Uddin2021-10-151-11/+0
| | | This reverts commit 5fe7f2b28ffcd27a3e520be750858944889112ef.
* Use timezone package as Python 3.5+ is required (#694)Kevin Kirsche2021-10-062-7/+7
| | | | | | | | | | | | | | | | | | | * Use timezone package as Python 3.5+ is required This method is deprecated: https://docs.python.org/3/library/datetime.html#datetime.datetime.utcnow Replaced with: https://docs.python.org/3/library/datetime.html#datetime.datetime.utcnow using: https://docs.python.org/3/library/datetime.html#datetime.timezone.utc which seems to indicate this was added in Python 3.2 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Add support for Ed448/EdDSA. (#675)Ajitomi, Daisuke2021-10-034-36/+163
| | | | | * Add support for Ed448/EdDSA. * Add test for verification using EdDSA private key.
* Assume JWK is valid for signing if "use" is omitted (#668)Klavionik2021-08-121-0/+14
| | | | | * PyJWKClient: Assume JWK is intended for signing if 'use' claim is either 'sig' or not present * Update CHANGELOG
* Remove arbitrary kwargs. (#657)Ajitomi, Daisuke2021-08-081-0/+11
| | | | | * Remove arbitrary kwargs. * Update CHANGELOG.
* Make typ optional (#644)Ajitomi, Daisuke2021-08-082-0/+86
| | | | | | | | | | | | | | | | | | | | | * Make typ optional. * Update doc. * Update CHANGELOG. * Refine parameter order of for backward compatibility. * Remove comment. * Add Optional to typ. * Keep order of JWT header parameter (typ, alg). * Make typ optional with headers argument. * Make typ optional with headers argument. * Remove unused log.
* Prefer headers['alg'] to algorithm parameter in encode(). (#673)Ajitomi, Daisuke2021-08-051-0/+26
| | | | | | | | | | | * Prefer headers['alg'] to algorithm parameter in encode(). * Fix lack of @crypto_required. * Prefer headers['alg'] to algorithm parameter in encode(). * Prefer headers['alg'] to algorithm parameter in encode(). * Make algorithm parameter of encode() Optioanl explicitly.
* Fix aud validation to support {'aud': null} case. (#670)Ajitomi, Daisuke2021-07-301-0/+19
| | | | | * Fix aud validation to support {'aud': null} case. * Fix aud validation to support {'aud': null} case.
* [pre-commit.ci] pre-commit autoupdate (#650)pre-commit-ci[bot]2021-04-282-2/+2
| | | | | | | | | | | | * [pre-commit.ci] pre-commit autoupdate updates: - [github.com/psf/black: 20.8b1 → 21.4b0](https://github.com/psf/black/compare/20.8b1...21.4b0) - [github.com/PyCQA/flake8: 3.9.0 → 3.9.1](https://github.com/PyCQA/flake8/compare/3.9.0...3.9.1) * Update after pre-commit run Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: José Padilla <jpadilla@webapplicate.com>
* Add to_jwk to Ed25519Algorithm. (#642) (#643)JohannesWill2021-04-281-0/+25
| | | | | | | | | | | | | | | * Add to_jwk to Ed25519Algorithm. (#642) * add test for invalid key * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * update CHANGELOG for #643 * remove alg from jwk Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Allow to verify with private key on ECAlgorithm, as well as on ↵Ajitomi, Daisuke2021-04-161-0/+7
| | | | | | | Ed25519Algorithm. (#645) * Add private key support for ECAlgorithm verify. * Update CHANGELOG.
* Support JWK without alg. (#624)Ajitomi, Daisuke2021-03-221-1/+161
| | | | | | | | | | | * Support JWK without alg. * Make kty mandatory on PyJWK. * Add tests for kty=OKP. * Add tests for OKP-type JWK. * Add support for ES256K.
* Add from_jwk to Ed25519Algorithm (Support kty: OKP). (#623)Ajitomi, Daisuke2021-03-183-0/+78
| | | | | * Support from_jwk on Ed25519Algorithm. * Update CHANGELOG.
* Support ES256K. (#629)Ajitomi, Daisuke2021-03-184-1/+24
| | | | | | | | | * Support ES256K. * Add tests for ES256K. * Add api_jws tests. * Update CHANGELOG.
* Remove padding from JWK test data. (#628)Ajitomi, Daisuke2021-03-183-7/+7
| | | | | | | * Remove padding from JWK test data. * Remove padding from test key string. * Update CHANGELOG.
* Cache signing keys (#611)Steven Pitts2021-02-271-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | * Cache the result of get_signing_key * Include URI in key for getting known signing keys * Add test_get_signing_key_caches_result test * Add test to make sure multiple uris are being distinguished in key caching * Ignore URI in caching * Use functools.lru_cache to cache signing keys * Allow opting out of key caching * Allow adjusting max cached keys * Add #611 change to CHANGELOG.rst * Update CHANGELOG.rst Co-authored-by: José Padilla <jpadilla@webapplicate.com> Co-authored-by: José Padilla <jpadilla@webapplicate.com>
* Validate claims if configured and verify_signature is not. (#608)Rémy HUBSCHER2021-02-151-0/+16
| | | | | | | * Validate claims if configured. * Remove secret and algorithm since we don't validate the signature. * Add changelog.
* Combine repetitive encode/decode tests using parametrize (#577)Jon Dufresne2020-12-211-92/+26
|
View Lorry Controller Status