mainframe.json_web_token

Classes

CachedPyJWKClient	Refresh the JWKS on a fixed schedule, independent of requested key IDs.
AuthenticationData
JsonWebToken	Validate Cloudflare Access JSON Web Token using PyJWT.

Functions

get_jwks_client(→ jwt.PyJWKClient)

Return a shared JWKS client with PyJWT's key-set cache.

Module Contents

class mainframe.json_web_token.CachedPyJWKClient(uri: str, lifespan: float = 10.0)

Bases: jwt.PyJWKClient

Refresh the JWKS on a fixed schedule, independent of requested key IDs.

_cache_lock

get_signing_key(kid: str) → jwt.PyJWK

Return the signing key matching the given kid.

If no match is found in the current JWK Set, the set is refreshed from the endpoint and the lookup is retried once.

Parameters:

kid (str) – The key ID to look up.

Returns:

The matching signing key.

Return type:

PyJWK

Raises:

PyJWKClientError – If no matching key is found after refreshing.

mainframe.json_web_token.get_jwks_client(jwks_uri: str) → jwt.PyJWKClient

Return a shared JWKS client with PyJWT’s key-set cache.

class mainframe.json_web_token.AuthenticationData

issuer: str

subject: str

audience: str

issued_at: datetime.datetime

expires_at: datetime.datetime

grant_type: str | None

classmethod from_dict(data: dict[Any, Any]) → Self

class mainframe.json_web_token.JsonWebToken

Validate Cloudflare Access JSON Web Token using PyJWT.

jwt_access_token: str

audience

jwks_uri

algorithm: str = 'RS256'

validate() → AuthenticationData