feat: link local library

2026-06-17 20:43:56 +02:00
parent 9a770a2af0
commit db59882f33
327 changed files with 22274 additions and 1 deletions
@@ -0,0 +1,104 @@
+import json
+from typing import Union
+
+from cryptojwt.jwk.jwk import key_from_jwk_dict
+from django.core.exceptions import ValidationError
+from django.utils.translation import gettext as _
+from spid_cie_oidc.provider.settings import (
+    OIDCFED_DEFAULT_PROVIDER_PROFILE,
+    OIDCFED_PROVIDER_PROFILES
+)
+from spid_cie_oidc.relying_party.settings import (
+    RP_DEFAULT_PROVIDER_PROFILES,
+    RP_PROVIDER_PROFILES
+)
+
+from .jwks import serialize_key
+from .settings import (
+    ENCRYPTION_ALG_VALUES_SUPPORTED,
+    ENCRYPTION_ENC_SUPPORTED,
+    ENTITY_TYPES,
+    SIGNING_ALG_VALUES_SUPPORTED
+)
+
+
+def validate_public_jwks(values: Union[dict, list]):
+    if isinstance(values, dict):
+        values = [values]
+    try:
+        for jwk_dict in values:
+            _k = key_from_jwk_dict(jwk_dict)
+            if _k.private_key():
+                _pub = serialize_key(_k.public_key())
+                raise ValidationError(
+                    f"This JWK is is private {json.dumps(jwk_dict)}. "
+                    f"It MUST be public instead, like this: {json.dumps([_pub])}."
+                )
+    except Exception as e:
+        raise ValidationError(f"Not valid: {e}")
+
+
+def validate_metadata_algs(metadata: dict):
+    amap = dict(
+        id_token_signing_alg_values_supported = SIGNING_ALG_VALUES_SUPPORTED,
+        id_token_encryption_alg_values_supported = ENCRYPTION_ALG_VALUES_SUPPORTED,
+        id_token_encryption_enc_values_supported = ENCRYPTION_ENC_SUPPORTED,
+        token_endpoint_auth_signing_alg_values_supported = SIGNING_ALG_VALUES_SUPPORTED,
+        userinfo_encryption_alg_values_supported = ENCRYPTION_ALG_VALUES_SUPPORTED,
+        userinfo_encryption_enc_values_supported = ENCRYPTION_ENC_SUPPORTED,
+        userinfo_signing_alg_values_supported = SIGNING_ALG_VALUES_SUPPORTED,
+        request_object_encryption_alg_values_supported = ENCRYPTION_ALG_VALUES_SUPPORTED,
+        request_object_encryption_enc_values_supported = ENCRYPTION_ENC_SUPPORTED,
+        request_object_signing_alg_values_supported = SIGNING_ALG_VALUES_SUPPORTED,
+    )
+    if metadata.get("openid_provider", None):
+        md = metadata["openid_provider"]
+        for k, v in amap.items():
+            if k in md:
+                for alg in md[k]:
+                    if alg not in v:
+                        raise ValidationError(
+                            f"{k} has an unsupported value {alg}. "
+                            f"Supported algs are {v}"
+                        )
+
+
+def validate_entity_metadata(value):
+    status = False
+    for i in ENTITY_TYPES:
+        if i in value:
+            status = True
+    if not status:
+        raise ValidationError(
+            _(f'Need to specify one of {", ".join(ENTITY_TYPES)}')
+        )
+    if "openid_provider" in value:
+        schema = OIDCFED_PROVIDER_PROFILES[OIDCFED_DEFAULT_PROVIDER_PROFILE]
+        try:
+            schema["op_metadata"](**value["openid_provider"])
+        except Exception as e:
+            raise ValidationError(
+                f"OP metadata fail {e}. "
+            )
+    if "openid_relying_party" in value:
+        schema = RP_PROVIDER_PROFILES[RP_DEFAULT_PROVIDER_PROFILES]
+        try:
+            schema["rp_metadata"](**value["openid_relying_party"])
+        except Exception as e:
+            raise ValidationError(
+                f"RP metadata fail {e}. "
+            )
+
+    # TODO - add wallet_provider and wallet_relying_party once standardized
+
+
+def validate_private_jwks(values: Union[dict, list]):
+    if isinstance(values, dict):
+        values = [values]
+    try:
+        for jwk_dict in values:
+            _k = key_from_jwk_dict(jwk_dict)
+            if not _k.private_key():
+                raise ValidationError(f"Can't extract a private JWK from {jwk_dict}")
+    except Exception as e:
+        raise ValidationError(f"Not valid: {e}")