mainframe.json_web_token
========================

.. py:module:: mainframe.json_web_token


Classes
-------

.. autoapisummary::

   mainframe.json_web_token.CachedPyJWKClient
   mainframe.json_web_token.AuthenticationData
   mainframe.json_web_token.JsonWebToken


Functions
---------

.. autoapisummary::

   mainframe.json_web_token.get_jwks_client


Module Contents
---------------

.. py:class:: CachedPyJWKClient(uri: str, lifespan: float = 10.0)

   Bases: :py:obj:`jwt.PyJWKClient`


   Refresh the JWKS on a fixed schedule, independent of requested key IDs.


   .. py:attribute:: _cache_lock


   .. py:method:: get_signing_key(kid: str) -> jwt.PyJWK

      Return the signing key matching the given ``kid``.

      If no match is found in the current JWK Set, the set is
      refreshed from the endpoint and the lookup is retried once.

      :param kid: The key ID to look up.
      :type kid: str
      :returns: The matching signing key.
      :rtype: PyJWK
      :raises PyJWKClientError: If no matching key is found after
          refreshing.



.. py:function:: get_jwks_client(jwks_uri: str) -> jwt.PyJWKClient

   Return a shared JWKS client with PyJWT's key-set cache.


.. py:class:: AuthenticationData

   .. py:attribute:: issuer
      :type:  str


   .. py:attribute:: subject
      :type:  str


   .. py:attribute:: audience
      :type:  str


   .. py:attribute:: issued_at
      :type:  datetime.datetime


   .. py:attribute:: expires_at
      :type:  datetime.datetime


   .. py:attribute:: grant_type
      :type:  str | None


   .. py:method:: from_dict(data: dict[Any, Any]) -> Self
      :classmethod:



.. py:class:: JsonWebToken

   Validate Cloudflare Access JSON Web Token using PyJWT.


   .. py:attribute:: jwt_access_token
      :type:  str


   .. py:attribute:: audience


   .. py:attribute:: jwks_uri


   .. py:attribute:: algorithm
      :type:  str
      :value: 'RS256'



   .. py:method:: validate() -> AuthenticationData