|
| 1 | +from datetime import UTC, datetime, timedelta |
| 2 | +from enum import StrEnum |
| 3 | +from typing import Self |
| 4 | + |
| 5 | +import jwt |
| 6 | + |
| 7 | +from objectstore_client.scope import Scope |
| 8 | + |
| 9 | + |
| 10 | +class Permission(StrEnum): |
| 11 | + """ |
| 12 | + Enum listing permissions that Objectstore tokens may be granted. |
| 13 | + """ |
| 14 | + |
| 15 | + OBJECT_READ = "object.read" |
| 16 | + OBJECT_WRITE = "object.write" |
| 17 | + OBJECT_DELETE = "object.delete" |
| 18 | + |
| 19 | + @classmethod |
| 20 | + def max(cls) -> list[Self]: |
| 21 | + return list(cls.__members__.values()) |
| 22 | + |
| 23 | + |
| 24 | +class TokenGenerator: |
| 25 | + def __init__( |
| 26 | + self, |
| 27 | + kid: str, |
| 28 | + secret_key: str, |
| 29 | + expiry_seconds: int = 60, |
| 30 | + permissions: list[Permission] = Permission.max(), |
| 31 | + ): |
| 32 | + self.kid = kid |
| 33 | + self.secret_key = secret_key |
| 34 | + self.expiry_seconds = expiry_seconds |
| 35 | + self.permissions = permissions |
| 36 | + |
| 37 | + def sign_for_scope(self, usecase: str, scope: Scope) -> str: |
| 38 | + """ |
| 39 | + Sign a JWT for the passed-in usecase and scope using the configured key |
| 40 | + information, expiry, and permissions. |
| 41 | +
|
| 42 | + The JWT is signed using EdDSA, so `self.secret_key` must be an EdDSA private |
| 43 | + key. `self.kid` is used by the Objectstore server to load the corresponding |
| 44 | + public key from its configuration. |
| 45 | + """ |
| 46 | + headers = {"kid": self.kid} |
| 47 | + claims = { |
| 48 | + "res": { |
| 49 | + "os:usecase": usecase, |
| 50 | + **{k: str(v) for k, v in scope.dict().items()}, |
| 51 | + }, |
| 52 | + "permissions": self.permissions, |
| 53 | + "exp": datetime.now(tz=UTC) + timedelta(seconds=self.expiry_seconds), |
| 54 | + } |
| 55 | + |
| 56 | + return jwt.encode(claims, self.secret_key, algorithm="EdDSA", headers=headers) |
0 commit comments