From f84d26f23d59514b001d8296dcadbfb1a05ffb4c Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Fri, 2 Oct 2026 17:15:44 -0300 Subject: [PATCH 01/10] fix(ias): verify JWT signature before stamping telemetry and audit identity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit StarletteIASTelemetryMiddleware was calling parse_token() (unverified JWT decoder) and promoting sap_gtid/user_uuid onto OTel span attributes and the IAS auth context. An attacker could forge a JWT carrying a victim tenant/user ID and permanently pollute telemetry and AuditClient attribution. - Add IASVerifier: JWKS-backed verifier with PyJWKClient, RS256/ES256 alg pinning, issuer/audience/exp/nbf enforcement, key caching and rotation - Add IASVerifier.from_env(): auto-configures from VCAP_SERVICES (CF) or IAS_URL/IAS_CLIENT_ID env vars (K8s); raises IASConfigError if not found - Add VerifiedIASClaims frozen dataclass as provenance marker; add TokenVerifier type alias to sap_cloud_sdk.ias public API - StarletteIASTelemetryMiddleware auto-calls IASVerifier.from_env() at init; logs WARNING and disables identity attrs if no binding found (fail-closed) - _verify_and_extract calls verifier once per request; verified IASClaims flow to both set_auth_context (AuditClient) and OTel span attrs — forged tokens result in None auth context and empty identity attrs - parse_token() unchanged — available as unverified diagnostic decoder - 488 tests pass (22 new for IASVerifier, rewritten middleware tests with auto-config and auth-context coverage) --- .../telemetry/middleware/starlette_a2a.py | 126 +++++-- src/sap_cloud_sdk/ias/__init__.py | 8 +- src/sap_cloud_sdk/ias/_token.py | 20 +- src/sap_cloud_sdk/ias/_verifier.py | 153 ++++++++ .../middleware/test_starlette_a2a.py | 340 ++++++++++++------ tests/ias/unit/test_verifier.py | 203 +++++++++++ 6 files changed, 705 insertions(+), 145 deletions(-) create mode 100644 src/sap_cloud_sdk/ias/_verifier.py create mode 100644 tests/ias/unit/test_verifier.py diff --git a/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py b/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py index 3bbde413..b9f78305 100644 --- a/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py +++ b/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py @@ -2,7 +2,7 @@ import logging from contextvars import ContextVar -from typing import Any, Dict +from typing import Any, Dict, Optional, Tuple from sap_cloud_sdk.core.telemetry.constants import ( ATTR_SAP_TRIGGER_TYPE, @@ -10,7 +10,9 @@ ATTR_USER_ID, ) from sap_cloud_sdk.core.telemetry.middleware.base import TelemetryMiddleware -from sap_cloud_sdk.ias import parse_token, set_auth_context +from sap_cloud_sdk.ias import IASConfigError, IASVerifier, TokenVerifier, VerifiedIASClaims # noqa: F401 +from sap_cloud_sdk.ias import set_auth_context +from sap_cloud_sdk.ias._token import IASClaims try: from starlette.middleware.base import BaseHTTPMiddleware @@ -26,13 +28,19 @@ class _IASMiddleware(BaseHTTPMiddleware): - def __init__(self, app: Any, attrs_var: ContextVar[Dict[str, Any]]) -> None: + def __init__( + self, + app: Any, + attrs_var: ContextVar[Dict[str, Any]], + token_verifier: Optional[TokenVerifier], + ) -> None: super().__init__(app) self._attrs_var = attrs_var + self._token_verifier = token_verifier async def dispatch(self, request: Request, call_next: Any) -> Response: - claims, attrs = _parse_request(request) - set_auth_context(claims) + verified_claims, attrs = _verify_and_extract(request, self._token_verifier) + set_auth_context(verified_claims) token = self._attrs_var.set(attrs) try: return await call_next(request) @@ -41,18 +49,37 @@ async def dispatch(self, request: Request, call_next: Any) -> Response: class StarletteIASTelemetryMiddleware(TelemetryMiddleware): - """Starlette/FastAPI middleware that extracts IAS JWT claims as telemetry attributes. + """Starlette/FastAPI middleware that extracts verified IAS JWT claims as telemetry attributes. - Reads the ``Authorization: Bearer `` header on each request, - parses it as an IAS JWT, and exposes the following as span attributes: + Reads the ``Authorization: Bearer `` header on each request, verifies it using + a :class:`~sap_cloud_sdk.ias.IASVerifier`, and exposes the following as span attributes + on success: - ``sap.tenancy.tenant_id`` from the ``sap_gtid`` claim - ``user.id`` from the ``user_uuid`` claim - If the header is absent or the token cannot be parsed, no attributes are set - and the request continues normally. + The ``x-sap-origin`` header (trigger type, not JWT identity) is always stamped when + present, regardless of token verification outcome. - Each instance owns its own ContextVar to prevent cross-talk when multiple - middleware instances are registered on the same app. + Verified claims are also stored in the IAS auth context (see + :func:`~sap_cloud_sdk.ias.get_auth_context`) for downstream use by the AuditClient + auto-fill. When verification fails, the auth context is set to ``None`` so downstream + consumers see no identity rather than unverified claims. + + **Auto-configuration (recommended):** when no ``token_verifier`` is supplied, the + middleware automatically creates an :class:`~sap_cloud_sdk.ias.IASVerifier` from the + SAP BTP Identity service binding (``VCAP_SERVICES`` on CF, or ``IAS_URL`` env var on + Kubernetes). If the binding is not found, identity attributes are disabled and a + WARNING is logged — the app still starts normally. + + Each instance owns its own ContextVar to prevent cross-talk when multiple middleware + instances are registered on the same app. + + Args: + app: The Starlette/FastAPI application instance. + token_verifier: Optional. A callable that receives the raw ``Authorization`` header + value and returns :class:`~sap_cloud_sdk.ias.VerifiedIASClaims` on success, or + raises on any invalid token. When ``None`` (default), an + :class:`~sap_cloud_sdk.ias.IASVerifier` is auto-configured from the environment. Usage:: @@ -61,18 +88,26 @@ class StarletteIASTelemetryMiddleware(TelemetryMiddleware): from sap_cloud_sdk.core.telemetry.middleware import StarletteIASTelemetryMiddleware app = Starlette(...) + # Auto-configures from IAS service binding — no extra config needed auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) """ - def __init__(self, app: Any) -> None: + def __init__(self, app: Any, token_verifier: Optional[TokenVerifier] = None) -> None: self.app = app + if token_verifier is None: + token_verifier = _auto_configure_verifier() + self._token_verifier = token_verifier self._attrs_var: ContextVar[Dict[str, Any]] = ContextVar( f"ias_attrs_{id(self)}", default={} ) def register(self) -> None: """Register the IAS JWT middleware with ``self.app``.""" - self.app.add_middleware(_IASMiddleware, attrs_var=self._attrs_var) + self.app.add_middleware( + _IASMiddleware, + attrs_var=self._attrs_var, + token_verifier=self._token_verifier, + ) logger.info("Registered IAS telemetry middleware on %r", self.app) def get_attributes(self) -> Dict[str, Any]: @@ -80,22 +115,57 @@ def get_attributes(self) -> Dict[str, Any]: return self._attrs_var.get() -def _parse_request(request: Request): - """Parse the Authorization header and return (IASClaims, telemetry_attrs).""" - auth = request.headers.get("authorization", "") - claims = None +def _verify_and_extract( + request: Request, token_verifier: Optional[TokenVerifier] +) -> Tuple[Optional[IASClaims], Dict[str, Any]]: + """Verify the request token once; return (verified_claims, telemetry_attrs). + + ``x-sap-origin`` is always stamped when present — it is a plain request + header, not JWT identity data, so it is independent of verification. + + Identity attrs and the returned claims are None/empty when: + - no Authorization header is present + - token_verifier is None (fail-closed default) + - the verifier raises for any reason (bad sig, wrong iss, expired, etc.) + """ attrs: Dict[str, Any] = {} - if auth: - try: - claims = parse_token(auth) - except Exception as e: - logger.debug("IAS token parsing failed, skipping telemetry attrs: %s", e) - if claims is not None: - if claims.sap_gtid: - attrs[ATTR_SAP_TENANT_ID] = claims.sap_gtid - if claims.user_uuid: - attrs[ATTR_USER_ID] = claims.user_uuid + origin = request.headers.get("x-sap-origin") if origin: attrs[ATTR_SAP_TRIGGER_TYPE] = origin + + auth = request.headers.get("authorization", "") + if not auth or token_verifier is None: + return None, attrs + + try: + verified = token_verifier(auth) + except Exception as exc: + logger.debug("IAS token verification failed, skipping identity attrs: %s", exc) + return None, attrs + + claims = verified.claims + if claims.sap_gtid: + attrs[ATTR_SAP_TENANT_ID] = claims.sap_gtid + if claims.user_uuid: + attrs[ATTR_USER_ID] = claims.user_uuid return claims, attrs + + +def _auto_configure_verifier() -> Optional[TokenVerifier]: + """Try to build an IASVerifier from the environment; warn and return None if not possible.""" + try: + verifier = IASVerifier.from_env() + logger.debug( + "StarletteIASTelemetryMiddleware: auto-configured IASVerifier from environment" + ) + return verifier + except IASConfigError as exc: + logger.warning( + "StarletteIASTelemetryMiddleware: IAS service binding not found — " + "sap.tenancy.tenant_id and user.id will NOT be stamped on spans. " + "Bind an SAP Identity service instance or set IAS_URL to enable " + "identity attributes. Details: %s", + exc, + ) + return None diff --git a/src/sap_cloud_sdk/ias/__init__.py b/src/sap_cloud_sdk/ias/__init__.py index c2459702..369f0df0 100644 --- a/src/sap_cloud_sdk/ias/__init__.py +++ b/src/sap_cloud_sdk/ias/__init__.py @@ -13,13 +13,19 @@ """ from sap_cloud_sdk.ias._context import get_auth_context, set_auth_context -from sap_cloud_sdk.ias._token import IASClaims, parse_token +from sap_cloud_sdk.ias._token import IASClaims, TokenVerifier, VerifiedIASClaims, parse_token +from sap_cloud_sdk.ias._verifier import IASConfigError, IASVerifier from sap_cloud_sdk.ias.exceptions import IASTokenError __all__ = [ "IASClaims", + "IASConfigError", "IASTokenError", + "IASVerifier", + "TokenVerifier", + "VerifiedIASClaims", "get_auth_context", "parse_token", "set_auth_context", ] + diff --git a/src/sap_cloud_sdk/ias/_token.py b/src/sap_cloud_sdk/ias/_token.py index c2ebc71c..2bef95e3 100644 --- a/src/sap_cloud_sdk/ias/_token.py +++ b/src/sap_cloud_sdk/ias/_token.py @@ -7,7 +7,7 @@ from __future__ import annotations from dataclasses import dataclass, field -from typing import Any, Dict, List, Optional, Union +from typing import Any, Callable, Dict, List, Optional, Union import jwt @@ -172,3 +172,21 @@ def parse_token(token: str) -> IASClaims: k: v for k, v in payload.items() if k not in _KNOWN_CLAIM_VALUES }, ) + + +@dataclass(frozen=True) +class VerifiedIASClaims: + """Claims proven to originate from a successfully verified IAS JWT. + + Construct ONLY after verifying the token's signature, issuer, audience, + algorithm, and time constraints. Its presence is the SDK's provenance + marker for security-sensitive consumers such as the telemetry middleware + and AuditClient auto-fill. + """ + + claims: IASClaims + + +# A verifier receives the raw Authorization header value (may include the +# "Bearer " prefix) and MUST raise (fail closed) if the token is not valid. +TokenVerifier = Callable[[str], VerifiedIASClaims] diff --git a/src/sap_cloud_sdk/ias/_verifier.py b/src/sap_cloud_sdk/ias/_verifier.py new file mode 100644 index 00000000..54a051ab --- /dev/null +++ b/src/sap_cloud_sdk/ias/_verifier.py @@ -0,0 +1,153 @@ +"""Built-in JWKS-backed IAS JWT verifier.""" + +import json +import logging +import os +from typing import Optional + +import jwt +from jwt import PyJWKClient + +from sap_cloud_sdk.ias._token import VerifiedIASClaims, parse_token +from sap_cloud_sdk.ias.exceptions import IASTokenError + +logger = logging.getLogger(__name__) + +_ENV_IAS_URL = "IAS_URL" +_ENV_IAS_CLIENT_ID = "IAS_CLIENT_ID" + + +class IASConfigError(Exception): + """Raised when IAS configuration cannot be resolved from the environment.""" + + +class IASVerifier: + """JWKS-backed IAS JWT verifier. + + Verifies the JWT signature using the IAS JWKS endpoint and validates + issuer, expiration, and not-before constraints. Optionally validates + the audience (``aud`` claim) against the application's client ID. + + Designed to be instantiated once at application startup and shared across + requests. ``PyJWKClient`` caches keys internally and handles key rotation + transparently. + + Args: + ias_url: IAS tenant base URL, e.g. ``https://.accounts.ondemand.com``. + The JWKS endpoint is derived as ``{ias_url}/oauth2/certs``. + client_id: Expected ``aud`` claim (the application's client ID in IAS). + When provided, tokens issued for other applications are rejected. + When ``None``, audience validation is skipped. + + Usage:: + + from sap_cloud_sdk.ias import IASVerifier + + # Auto-configure from the IAS service binding (recommended) + verifier = IASVerifier.from_env() + + # Or configure explicitly + verifier = IASVerifier( + ias_url="https://mytenant.accounts.ondemand.com", + client_id="my-app-client-id", + ) + + # Use as a TokenVerifier callable + verified = verifier("Bearer ") + print(verified.claims.sap_gtid) + """ + + def __init__(self, ias_url: str, client_id: Optional[str] = None) -> None: + self._ias_url = ias_url.rstrip("/") + self._client_id = client_id + jwks_url = f"{self._ias_url}/oauth2/certs" + self._jwk_client = PyJWKClient(jwks_url, cache_keys=True) + logger.debug( + "IASVerifier initialised (jwks=%s, client_id=%s)", + jwks_url, + client_id or "", + ) + + @classmethod + def from_env(cls) -> "IASVerifier": + """Auto-configure from the SAP BTP Identity service binding. + + Lookup order: + + 1. ``VCAP_SERVICES`` (Cloud Foundry) — + ``identity[0].credentials.{url, clientid}`` + 2. ``IAS_URL`` + ``IAS_CLIENT_ID`` environment variables (Kubernetes / manual) + + Returns: + A configured :class:`IASVerifier` instance. + + Raises: + IASConfigError: when no IAS configuration can be resolved. + """ + vcap_raw = os.getenv("VCAP_SERVICES") + if vcap_raw: + try: + vcap = json.loads(vcap_raw) + for svc_name in ("identity", "xsuaa"): + bindings = vcap.get(svc_name, []) + if bindings: + creds = bindings[0].get("credentials", {}) + url = creds.get("url") or creds.get("issuer") + client_id = creds.get("clientid") + if url: + logger.debug( + "IASVerifier.from_env: configured from VCAP_SERVICES[%s]", + svc_name, + ) + return cls(ias_url=url, client_id=client_id or None) + except (json.JSONDecodeError, KeyError, IndexError, TypeError) as exc: + logger.debug("IASVerifier.from_env: VCAP_SERVICES parse error: %s", exc) + + ias_url = os.getenv(_ENV_IAS_URL) + if ias_url: + client_id = os.getenv(_ENV_IAS_CLIENT_ID) or None + logger.debug("IASVerifier.from_env: configured from env vars") + return cls(ias_url=ias_url, client_id=client_id) + + raise IASConfigError( + f"Cannot auto-configure IASVerifier: no IAS service binding found. " + f"Bind an SAP Identity service instance (sets VCAP_SERVICES on CF or " + f"a Kubernetes secret) or set {_ENV_IAS_URL} (and optionally " + f"{_ENV_IAS_CLIENT_ID}) manually." + ) + + def __call__(self, authorization: str) -> VerifiedIASClaims: + """Verify the token and return its claims. + + Args: + authorization: Raw ``Authorization`` header value. + Accepts ``"Bearer "`` or a bare token string. + + Returns: + :class:`~sap_cloud_sdk.ias.VerifiedIASClaims` on success. + + Raises: + IASTokenError: if the token fails any validation check. + """ + raw = authorization.removeprefix("Bearer ").removeprefix("bearer ").strip() + try: + signing_key = self._jwk_client.get_signing_key_from_jwt(raw) + + options: dict = {"require": ["exp", "iss"]} + decode_kwargs: dict = { + "algorithms": ["RS256", "ES256"], + "issuer": self._ias_url, + "options": options, + } + if self._client_id: + decode_kwargs["audience"] = self._client_id + options["require"].append("aud") + else: + options["verify_aud"] = False + + jwt.decode(raw, signing_key.key, **decode_kwargs) + + except jwt.exceptions.PyJWTError as exc: + raise IASTokenError(f"IAS JWT verification failed: {exc}") from exc + + return VerifiedIASClaims(claims=parse_token(raw)) diff --git a/tests/core/unit/telemetry/middleware/test_starlette_a2a.py b/tests/core/unit/telemetry/middleware/test_starlette_a2a.py index 871798d9..bb5d8869 100644 --- a/tests/core/unit/telemetry/middleware/test_starlette_a2a.py +++ b/tests/core/unit/telemetry/middleware/test_starlette_a2a.py @@ -1,22 +1,24 @@ """Tests for StarletteIASTelemetryMiddleware.""" +import logging import pytest from unittest.mock import MagicMock, AsyncMock, patch from sap_cloud_sdk.core.telemetry.constants import ATTR_SAP_TRIGGER_TYPE, ATTR_SAP_TENANT_ID, ATTR_USER_ID from sap_cloud_sdk.core.telemetry.middleware.starlette_a2a import ( StarletteIASTelemetryMiddleware, - _parse_request, + _auto_configure_verifier, + _verify_and_extract, ) +from sap_cloud_sdk.ias import IASClaims, IASConfigError, IASTokenError, IASVerifier, VerifiedIASClaims -_PATCH_PARSE = "sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.parse_token" +# --------------------------------------------------------------------------- +# Helpers +# --------------------------------------------------------------------------- -def _make_claims(sap_gtid=None, user_uuid=None): - claims = MagicMock() - claims.sap_gtid = sap_gtid - claims.user_uuid = user_uuid - return claims +def _make_verified(sap_gtid=None, user_uuid=None) -> VerifiedIASClaims: + return VerifiedIASClaims(claims=IASClaims(sap_gtid=sap_gtid, user_uuid=user_uuid)) def _make_request(headers: dict): @@ -25,26 +27,74 @@ def _make_request(headers: dict): return request +def _passing_verifier(sap_gtid=None, user_uuid=None): + def verify(token: str) -> VerifiedIASClaims: + return _make_verified(sap_gtid=sap_gtid, user_uuid=user_uuid) + return verify + + +def _failing_verifier(exc=None): + def verify(token: str) -> VerifiedIASClaims: + raise (exc or IASTokenError("verification failed")) + return verify + + +# --------------------------------------------------------------------------- +# _auto_configure_verifier +# --------------------------------------------------------------------------- + +class TestAutoConfigureVerifier: + def test_returns_verifier_when_env_configured(self): + mock_verifier = MagicMock(spec=IASVerifier) + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.return_value = mock_verifier + result = _auto_configure_verifier() + assert result is mock_verifier + + def test_returns_none_when_config_missing(self): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.side_effect = IASConfigError("no binding found") + result = _auto_configure_verifier() + assert result is None + + def test_logs_warning_when_config_missing(self, caplog): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.side_effect = IASConfigError("no IAS binding") + with caplog.at_level(logging.WARNING): + _auto_configure_verifier() + assert any("NOT be stamped" in r.message for r in caplog.records) + + def test_no_warning_when_configured(self, caplog): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.return_value = MagicMock(spec=IASVerifier) + with caplog.at_level(logging.WARNING): + _auto_configure_verifier() + assert not any("NOT be stamped" in r.message for r in caplog.records) + + +# --------------------------------------------------------------------------- +# StarletteIASTelemetryMiddleware construction +# --------------------------------------------------------------------------- + class TestStarletteIASTelemetryMiddleware: def test_register_calls_add_middleware_on_self_app(self): app = MagicMock() - mw = StarletteIASTelemetryMiddleware(app=app) + mw = StarletteIASTelemetryMiddleware(app=app, token_verifier=_passing_verifier()) mw.register() app.add_middleware.assert_called_once() def test_get_attributes_returns_empty_outside_request(self): - mw = StarletteIASTelemetryMiddleware(app=MagicMock()) + mw = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) assert mw.get_attributes() == {} def test_each_instance_has_independent_context_var(self): - mw1 = StarletteIASTelemetryMiddleware(app=MagicMock()) - mw2 = StarletteIASTelemetryMiddleware(app=MagicMock()) + mw1 = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) + mw2 = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) assert mw1._attrs_var is not mw2._attrs_var def test_two_instances_do_not_interfere(self): - mw1 = StarletteIASTelemetryMiddleware(app=MagicMock()) - mw2 = StarletteIASTelemetryMiddleware(app=MagicMock()) - + mw1 = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) + mw2 = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) t1 = mw1._attrs_var.set({ATTR_SAP_TENANT_ID: "tenant-a"}) t2 = mw2._attrs_var.set({ATTR_USER_ID: "user-b"}) try: @@ -54,74 +104,122 @@ def test_two_instances_do_not_interfere(self): mw1._attrs_var.reset(t1) mw2._attrs_var.reset(t2) - -class TestParseRequest: - def test_extracts_tenant_and_user(self): - claims = _make_claims(sap_gtid="t1", user_uuid="u1") + def test_auto_configure_called_when_no_verifier_given(self): + mock_verifier = MagicMock(spec=IASVerifier) + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.return_value = mock_verifier + mw = StarletteIASTelemetryMiddleware(app=MagicMock()) + assert mw._token_verifier is mock_verifier + + def test_auto_configure_failure_sets_none_verifier(self): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.side_effect = IASConfigError("no binding") + mw = StarletteIASTelemetryMiddleware(app=MagicMock()) + assert mw._token_verifier is None + + def test_no_binding_logs_warning(self, caplog): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + MockV.from_env.side_effect = IASConfigError("no binding") + with caplog.at_level(logging.WARNING): + StarletteIASTelemetryMiddleware(app=MagicMock()) + assert any("NOT be stamped" in r.message for r in caplog.records) + + def test_explicit_verifier_bypasses_auto_configure(self): + with patch("sap_cloud_sdk.core.telemetry.middleware.starlette_a2a.IASVerifier") as MockV: + explicit = _passing_verifier() + mw = StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=explicit) + MockV.from_env.assert_not_called() + assert mw._token_verifier is explicit + + def test_explicit_verifier_no_warning(self, caplog): + with caplog.at_level(logging.WARNING): + StarletteIASTelemetryMiddleware(app=MagicMock(), token_verifier=_passing_verifier()) + assert not any("NOT be stamped" in r.message for r in caplog.records) + + +# --------------------------------------------------------------------------- +# _verify_and_extract: core security behaviour +# --------------------------------------------------------------------------- + +class TestVerifyAndExtract: + + def test_no_verifier_returns_none_claims_and_empty_attrs(self): request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert result == {ATTR_SAP_TENANT_ID: "t1", ATTR_USER_ID: "u1"} + claims, attrs = _verify_and_extract(request, None) + assert claims is None + assert ATTR_SAP_TENANT_ID not in attrs + assert ATTR_USER_ID not in attrs - def test_omits_missing_tenant(self): - claims = _make_claims(sap_gtid=None, user_uuid="u1") + def test_verified_token_returns_claims_and_stamps_identity(self): request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert result == {ATTR_USER_ID: "u1"} - assert ATTR_SAP_TENANT_ID not in result + claims, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid="t1", user_uuid="u1")) + assert claims is not None + assert claims.sap_gtid == "t1" + assert attrs[ATTR_SAP_TENANT_ID] == "t1" + assert attrs[ATTR_USER_ID] == "u1" + + def test_forged_token_returns_none_claims_and_empty_identity(self): + request = _make_request({"authorization": "Bearer forged"}) + claims, attrs = _verify_and_extract(request, _failing_verifier(IASTokenError("bad sig"))) + assert claims is None + assert ATTR_SAP_TENANT_ID not in attrs + assert ATTR_USER_ID not in attrs + + def test_origin_stamped_when_no_verifier(self): + request = _make_request({"authorization": "Bearer tok", "x-sap-origin": "ui5"}) + _, attrs = _verify_and_extract(request, None) + assert attrs == {ATTR_SAP_TRIGGER_TYPE: "ui5"} - def test_omits_missing_user(self): - claims = _make_claims(sap_gtid="t1", user_uuid=None) - request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert result == {ATTR_SAP_TENANT_ID: "t1"} - assert ATTR_USER_ID not in result + def test_origin_stamped_when_verifier_raises(self): + request = _make_request({"authorization": "Bearer bad", "x-sap-origin": "job"}) + _, attrs = _verify_and_extract(request, _failing_verifier()) + assert attrs[ATTR_SAP_TRIGGER_TYPE] == "job" + assert ATTR_SAP_TENANT_ID not in attrs - def test_returns_empty_when_no_auth_header(self): + def test_origin_stamped_on_verified_path(self): + request = _make_request({"authorization": "Bearer tok", "x-sap-origin": "ui5"}) + _, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid="t1", user_uuid="u1")) + assert attrs[ATTR_SAP_TRIGGER_TYPE] == "ui5" + assert attrs[ATTR_SAP_TENANT_ID] == "t1" + + def test_no_auth_header_returns_none_claims(self): request = _make_request({}) - with patch(_PATCH_PARSE) as mock_parse: - parsed_claims, result = _parse_request(request) - mock_parse.assert_not_called() - assert result == {} - assert parsed_claims is None + claims, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid="t1")) + assert claims is None + assert attrs == {} - def test_returns_empty_on_parse_error(self): - request = _make_request({"authorization": "Bearer bad"}) - with patch(_PATCH_PARSE, side_effect=ValueError("bad token")): - parsed_claims, result = _parse_request(request) - assert result == {} - assert parsed_claims is None + def test_no_auth_header_origin_still_stamped(self): + request = _make_request({"x-sap-origin": "ui5"}) + _, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid="t1")) + assert attrs == {ATTR_SAP_TRIGGER_TYPE: "ui5"} - def test_returns_empty_when_both_claims_absent(self): - claims = _make_claims(sap_gtid=None, user_uuid=None) + def test_omits_missing_tenant(self): request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert result == {} + _, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid=None, user_uuid="u1")) + assert ATTR_SAP_TENANT_ID not in attrs + assert attrs[ATTR_USER_ID] == "u1" - def test_includes_origin_header_when_present(self): - claims = _make_claims(sap_gtid="t1", user_uuid="u1") - request = _make_request({"authorization": "Bearer tok", "x-sap-origin": "ui5"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert result[ATTR_SAP_TRIGGER_TYPE] == "ui5" - - def test_omits_origin_attr_when_header_absent(self): - claims = _make_claims(sap_gtid="t1", user_uuid="u1") + def test_omits_missing_user(self): request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - _, result = _parse_request(request) - assert ATTR_SAP_TRIGGER_TYPE not in result + _, attrs = _verify_and_extract(request, _passing_verifier(sap_gtid="t1", user_uuid=None)) + assert ATTR_USER_ID not in attrs + assert attrs[ATTR_SAP_TENANT_ID] == "t1" + + @pytest.mark.parametrize("exc_msg", [ + "alg=none rejected", "HS256 confusion", "unknown kid", + "wrong issuer", "wrong audience", "token expired", "not yet valid", + ]) + def test_invalid_token_variants_stamp_nothing(self, exc_msg): + request = _make_request({"authorization": "Bearer bad"}) + claims, attrs = _verify_and_extract(request, _failing_verifier(IASTokenError(exc_msg))) + assert claims is None + assert ATTR_SAP_TENANT_ID not in attrs + assert ATTR_USER_ID not in attrs - def test_returns_claims_object(self): - claims = _make_claims(sap_gtid="t1", user_uuid="u1") - request = _make_request({"authorization": "Bearer tok"}) - with patch(_PATCH_PARSE, return_value=claims): - parsed_claims, _ = _parse_request(request) - assert parsed_claims is claims +# --------------------------------------------------------------------------- +# Inner middleware dispatch — set_auth_context integration +# --------------------------------------------------------------------------- class TestInnerMiddlewareDispatch: def _get_inner_class_and_kwargs(self, mw: StarletteIASTelemetryMiddleware): @@ -132,78 +230,92 @@ def _get_inner_class_and_kwargs(self, mw: StarletteIASTelemetryMiddleware): return args[0], kwargs @pytest.mark.anyio - async def test_sets_attrs_in_context_var_during_request(self): - mw = StarletteIASTelemetryMiddleware(app=MagicMock()) - claims = _make_claims(sap_gtid="tenant-1", user_uuid="user-1") + async def test_sets_attrs_and_auth_context_on_verified_token(self): + mw = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_passing_verifier(sap_gtid="t1", user_uuid="u1"), + ) inner_cls, kwargs = self._get_inner_class_and_kwargs(mw) - request = _make_request({"authorization": "Bearer tok"}) + captured_attrs = {} + captured_context = {} + + from sap_cloud_sdk.ias import get_auth_context + + async def call_next(req): + captured_attrs.update(mw._attrs_var.get()) + ctx = get_auth_context() + if ctx: + captured_context["sap_gtid"] = ctx.sap_gtid + return MagicMock() + + inner = inner_cls(app=MagicMock(), **kwargs) + await inner.dispatch(request, call_next) + + assert captured_attrs[ATTR_SAP_TENANT_ID] == "t1" + assert captured_context.get("sap_gtid") == "t1" + + @pytest.mark.anyio + async def test_forged_token_clears_auth_context(self): + from sap_cloud_sdk.ias import get_auth_context, set_auth_context + + set_auth_context(IASClaims(sap_gtid="stale")) + mw = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_failing_verifier(IASTokenError("forged")), + ) + inner_cls, kwargs = self._get_inner_class_and_kwargs(mw) + request = _make_request({"authorization": "Bearer forged"}) captured = {} async def call_next(req): - captured.update(mw._attrs_var.get()) + captured["ctx"] = get_auth_context() return MagicMock() inner = inner_cls(app=MagicMock(), **kwargs) - with patch(_PATCH_PARSE, lambda t: claims): - await inner.dispatch(request, call_next) + await inner.dispatch(request, call_next) - assert captured == {ATTR_SAP_TENANT_ID: "tenant-1", ATTR_USER_ID: "user-1"} + assert captured["ctx"] is None @pytest.mark.anyio async def test_context_var_reset_after_request(self): - mw = StarletteIASTelemetryMiddleware(app=MagicMock()) - claims = _make_claims(sap_gtid="t1", user_uuid="u1") + mw = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_passing_verifier(sap_gtid="t1", user_uuid="u1"), + ) inner_cls, kwargs = self._get_inner_class_and_kwargs(mw) - request = _make_request({"authorization": "Bearer tok"}) inner = inner_cls(app=MagicMock(), **kwargs) - with patch(_PATCH_PARSE, lambda t: claims): - await inner.dispatch(request, AsyncMock(return_value=MagicMock())) - + await inner.dispatch(request, AsyncMock(return_value=MagicMock())) assert mw._attrs_var.get() == {} @pytest.mark.anyio async def test_context_var_reset_on_exception(self): - mw = StarletteIASTelemetryMiddleware(app=MagicMock()) - claims = _make_claims(sap_gtid="t1", user_uuid="u1") + mw = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_passing_verifier(sap_gtid="t1"), + ) inner_cls, kwargs = self._get_inner_class_and_kwargs(mw) - request = _make_request({"authorization": "Bearer tok"}) async def raises(req): raise RuntimeError("downstream") inner = inner_cls(app=MagicMock(), **kwargs) - with patch(_PATCH_PARSE, lambda t: claims): - with pytest.raises(RuntimeError): - await inner.dispatch(request, raises) - + with pytest.raises(RuntimeError): + await inner.dispatch(request, raises) assert mw._attrs_var.get() == {} - @pytest.mark.anyio - async def test_no_auth_header_sets_empty_attrs(self): - mw = StarletteIASTelemetryMiddleware(app=MagicMock()) - inner_cls, kwargs = self._get_inner_class_and_kwargs(mw) - - request = _make_request({}) - captured = {} - - async def call_next(req): - captured.update(mw._attrs_var.get()) - return MagicMock() - - inner = inner_cls(app=MagicMock(), **kwargs) - await inner.dispatch(request, call_next) - - assert captured == {} - @pytest.mark.anyio async def test_two_instances_independent_during_dispatch(self): - mw1 = StarletteIASTelemetryMiddleware(app=MagicMock()) - mw2 = StarletteIASTelemetryMiddleware(app=MagicMock()) - claims1 = _make_claims(sap_gtid="tenant-1", user_uuid=None) - claims2 = _make_claims(sap_gtid=None, user_uuid="user-2") + mw1 = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_passing_verifier(sap_gtid="tenant-1", user_uuid=None), + ) + mw2 = StarletteIASTelemetryMiddleware( + app=MagicMock(), + token_verifier=_passing_verifier(sap_gtid=None, user_uuid="user-2"), + ) inner1_cls, kwargs1 = self._get_inner_class_and_kwargs(mw1) inner2_cls, kwargs2 = self._get_inner_class_and_kwargs(mw2) inner1 = inner1_cls(app=MagicMock(), **kwargs1) @@ -220,10 +332,8 @@ async def next2(r): captured2.update(mw2._attrs_var.get()) return MagicMock() - with patch(_PATCH_PARSE, lambda t: claims1): - await inner1.dispatch(req, next1) - with patch(_PATCH_PARSE, lambda t: claims2): - await inner2.dispatch(req, next2) + await inner1.dispatch(req, next1) + await inner2.dispatch(req, next2) assert captured1 == {ATTR_SAP_TENANT_ID: "tenant-1"} assert captured2 == {ATTR_USER_ID: "user-2"} diff --git a/tests/ias/unit/test_verifier.py b/tests/ias/unit/test_verifier.py new file mode 100644 index 00000000..e1181b12 --- /dev/null +++ b/tests/ias/unit/test_verifier.py @@ -0,0 +1,203 @@ +"""Unit tests for sap_cloud_sdk.ias IASVerifier.""" + +import json +import pytest +from unittest.mock import MagicMock, patch + +from sap_cloud_sdk.ias import IASClaims, IASConfigError, IASTokenError, IASVerifier, VerifiedIASClaims + + +class TestIASVerifierFromEnv: + def test_cf_vcap_services_identity_binding(self, monkeypatch): + vcap = {"identity": [{"credentials": {"url": "https://ias.example.com", "clientid": "my-app"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://ias.example.com" + assert v._client_id == "my-app" + + def test_cf_vcap_services_strips_trailing_slash(self, monkeypatch): + vcap = {"identity": [{"credentials": {"url": "https://ias.example.com/", "clientid": "cid"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://ias.example.com" + + def test_cf_vcap_services_no_client_id(self, monkeypatch): + vcap = {"identity": [{"credentials": {"url": "https://ias.example.com"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._client_id is None + + def test_cf_vcap_services_xsuaa_fallback(self, monkeypatch): + vcap = {"xsuaa": [{"credentials": {"url": "https://xsuaa.example.com", "clientid": "xc"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://xsuaa.example.com" + + def test_k8s_env_vars(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.setenv("IAS_URL", "https://k8s-ias.example.com") + monkeypatch.setenv("IAS_CLIENT_ID", "k8s-client") + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://k8s-ias.example.com" + assert v._client_id == "k8s-client" + + def test_k8s_env_vars_no_client_id(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.setenv("IAS_URL", "https://k8s-ias.example.com") + monkeypatch.delenv("IAS_CLIENT_ID", raising=False) + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._client_id is None + + def test_raises_when_nothing_configured(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.delenv("IAS_URL", raising=False) + monkeypatch.delenv("IAS_CLIENT_ID", raising=False) + with pytest.raises(IASConfigError): + IASVerifier.from_env() + + def test_raises_with_malformed_vcap(self, monkeypatch): + monkeypatch.setenv("VCAP_SERVICES", "not-valid-json") + monkeypatch.delenv("IAS_URL", raising=False) + with pytest.raises(IASConfigError): + IASVerifier.from_env() + + def test_raises_with_empty_bindings(self, monkeypatch): + vcap = {"identity": [], "xsuaa": []} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + with pytest.raises(IASConfigError): + IASVerifier.from_env() + + def test_vcap_takes_precedence_over_env_var(self, monkeypatch): + vcap = {"identity": [{"credentials": {"url": "https://vcap-ias.example.com", "clientid": "vc"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.setenv("IAS_URL", "https://env-ias.example.com") + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://vcap-ias.example.com" + + +class TestIASVerifierCall: + def _make_verifier(self, ias_url="https://ias.example.com", client_id=None): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier(ias_url=ias_url, client_id=client_id) + return v + + def _mock_jwk_key(self, verifier): + mock_key = MagicMock() + mock_key.key = "mock-signing-key" + verifier._jwk_client.get_signing_key_from_jwt.return_value = mock_key + return mock_key + + def test_returns_verified_ias_claims_on_success(self): + import jwt as pyjwt + verifier = self._make_verifier() + raw_token = pyjwt.encode({"sap_gtid": "t1", "user_uuid": "u1"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {"sap_gtid": "t1", "user_uuid": "u1", "iss": "https://ias.example.com"} + result = verifier(f"Bearer {raw_token}") + assert isinstance(result, VerifiedIASClaims) + assert result.claims.sap_gtid == "t1" + + def test_strips_bearer_prefix(self): + import jwt as pyjwt + verifier = self._make_verifier() + raw_token = pyjwt.encode({"sub": "x"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {} + verifier(f"Bearer {raw_token}") + call_args = verifier._jwk_client.get_signing_key_from_jwt.call_args[0][0] + assert call_args == raw_token + + def test_raises_on_bad_signature(self): + import jwt.exceptions + verifier = self._make_verifier() + verifier._jwk_client.get_signing_key_from_jwt.side_effect = jwt.exceptions.InvalidSignatureError("bad") + with pytest.raises(IASTokenError, match="IAS JWT verification failed"): + verifier("Bearer bad.token") + + def test_raises_on_expired_token(self): + import jwt.exceptions + verifier = self._make_verifier() + verifier._jwk_client.get_signing_key_from_jwt.side_effect = jwt.exceptions.ExpiredSignatureError("exp") + with pytest.raises(IASTokenError): + verifier("Bearer expired") + + def test_raises_on_wrong_issuer(self): + import jwt.exceptions + verifier = self._make_verifier() + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.side_effect = jwt.exceptions.InvalidIssuerError("iss") + with pytest.raises(IASTokenError): + verifier("Bearer tok") + + def test_raises_on_wrong_audience(self): + import jwt.exceptions + verifier = self._make_verifier(client_id="expected") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.side_effect = jwt.exceptions.InvalidAudienceError("aud") + with pytest.raises(IASTokenError): + verifier("Bearer tok") + + def test_pins_asymmetric_algorithms_only(self): + import jwt as pyjwt + verifier = self._make_verifier() + raw_token = pyjwt.encode({"sub": "x"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {} + verifier(f"Bearer {raw_token}") + _, kwargs = mock_decode.call_args_list[0] + assert kwargs["algorithms"] == ["RS256", "ES256"] + assert "none" not in kwargs["algorithms"] + assert "HS256" not in kwargs["algorithms"] + + def test_requires_exp_and_iss(self): + import jwt as pyjwt + verifier = self._make_verifier() + raw_token = pyjwt.encode({"sub": "x"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {} + verifier(f"Bearer {raw_token}") + _, kwargs = mock_decode.call_args_list[0] + assert "exp" in kwargs["options"]["require"] + assert "iss" in kwargs["options"]["require"] + + def test_includes_audience_when_client_id_set(self): + import jwt as pyjwt + verifier = self._make_verifier(client_id="my-client") + raw_token = pyjwt.encode({"sub": "x"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {} + verifier(f"Bearer {raw_token}") + _, kwargs = mock_decode.call_args_list[0] + assert kwargs.get("audience") == "my-client" + assert "aud" in kwargs["options"]["require"] + + def test_skips_audience_when_no_client_id(self): + import jwt as pyjwt + verifier = self._make_verifier(client_id=None) + raw_token = pyjwt.encode({"sub": "x"}, key="s", algorithm="HS256") + self._mock_jwk_key(verifier) + with patch("sap_cloud_sdk.ias._verifier.jwt.decode") as mock_decode: + mock_decode.return_value = {} + verifier(f"Bearer {raw_token}") + _, kwargs = mock_decode.call_args_list[0] + assert "audience" not in kwargs + assert kwargs["options"].get("verify_aud") is False From bd62c01e64c2cbab7cce5113dcb9325f51d8582d Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Wed, 7 Oct 2026 14:49:05 -0300 Subject: [PATCH 02/10] chore: bump version to 0.57.3, fix ruff formatting Fix ruff-format violations in starlette_a2a.py and ias/__init__.py (multi-line imports and method signature wrapping) and bump patch version to 0.57.3 to satisfy the version-bump CI check. --- pyproject.toml | 2 +- .../telemetry/middleware/starlette_a2a.py | 10 +++++-- src/sap_cloud_sdk/ias/__init__.py | 8 ++++-- uv.lock | 28 ++++++++++++++----- 4 files changed, 36 insertions(+), 12 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 9f45a831..b894a0fb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "sap-cloud-sdk" -version = "0.58.1" +version = "0.58.2" description = "SAP Cloud SDK for Python" readme = "README.md" license = "Apache-2.0" diff --git a/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py b/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py index b9f78305..14162ea5 100644 --- a/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py +++ b/src/sap_cloud_sdk/core/telemetry/middleware/starlette_a2a.py @@ -10,7 +10,11 @@ ATTR_USER_ID, ) from sap_cloud_sdk.core.telemetry.middleware.base import TelemetryMiddleware -from sap_cloud_sdk.ias import IASConfigError, IASVerifier, TokenVerifier, VerifiedIASClaims # noqa: F401 +from sap_cloud_sdk.ias import ( + IASConfigError, + IASVerifier, + TokenVerifier, +) # noqa: F401 from sap_cloud_sdk.ias import set_auth_context from sap_cloud_sdk.ias._token import IASClaims @@ -92,7 +96,9 @@ class StarletteIASTelemetryMiddleware(TelemetryMiddleware): auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) """ - def __init__(self, app: Any, token_verifier: Optional[TokenVerifier] = None) -> None: + def __init__( + self, app: Any, token_verifier: Optional[TokenVerifier] = None + ) -> None: self.app = app if token_verifier is None: token_verifier = _auto_configure_verifier() diff --git a/src/sap_cloud_sdk/ias/__init__.py b/src/sap_cloud_sdk/ias/__init__.py index 369f0df0..d88cec58 100644 --- a/src/sap_cloud_sdk/ias/__init__.py +++ b/src/sap_cloud_sdk/ias/__init__.py @@ -13,7 +13,12 @@ """ from sap_cloud_sdk.ias._context import get_auth_context, set_auth_context -from sap_cloud_sdk.ias._token import IASClaims, TokenVerifier, VerifiedIASClaims, parse_token +from sap_cloud_sdk.ias._token import ( + IASClaims, + TokenVerifier, + VerifiedIASClaims, + parse_token, +) from sap_cloud_sdk.ias._verifier import IASConfigError, IASVerifier from sap_cloud_sdk.ias.exceptions import IASTokenError @@ -28,4 +33,3 @@ "parse_token", "set_auth_context", ] - diff --git a/uv.lock b/uv.lock index dbff64b1..fa859196 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 5 +revision = 3 requires-python = ">=3.11" resolution-markers = [ "python_full_version >= '3.15' and sys_platform == 'win32'", @@ -166,9 +166,9 @@ name = "aiologic" version = "0.17.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "sniffio" }, - { name = "typing-extensions" }, - { name = "wrapt" }, + { name = "sniffio", marker = "python_full_version < '3.13'" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, + { name = "wrapt", marker = "python_full_version < '3.13'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/f1/7a/d51f2fde1e8ae8a83431f8e97b7a71e9358cdb1d4d2ce6be387fa44d68de/aiologic-0.17.1.tar.gz", hash = "sha256:2e1b93b9e88ced318c2a63ad7b382688f40cbfe40e3d42258d49dc9c5aea179d", size = 252354, upload-time = "2026-06-27T20:41:33.25Z" } wheels = [ @@ -816,8 +816,8 @@ name = "culsans" version = "0.11.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "aiologic" }, - { name = "typing-extensions" }, + { name = "aiologic", marker = "python_full_version < '3.13'" }, + { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/d9/e3/49afa1bc180e0d28008ec6bcdf82a4072d1c7a41032b5b759b60814ca4b0/culsans-0.11.0.tar.gz", hash = "sha256:0b43d0d05dce6106293d114c86e3fb4bfc63088cfe8ff08ed3fe36891447fe33", size = 107546, upload-time = "2025-12-31T23:15:38.196Z" } wheels = [ @@ -1187,7 +1187,9 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/4e/a3/07297917485ee2ca85bc3c8dc6ed85ad3fffcf424047fba62671dba68e97/greenlet-3.5.5-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:be63afcbbccfad3dd95a1ba12ada84dab2ef32031973d80b5b92df67fa763a61", size = 294165, upload-time = "2026-08-10T13:25:17.987Z" }, { url = "https://files.pythonhosted.org/packages/db/51/6f732f9314cda54c5fd48a7620c7160f4f286967e8045ad94b9d66ce80b7/greenlet-3.5.5-cp311-cp311-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8a268024ce2d7d2b04694bf1594058981a9fa663d1df4b762dee499211ed7c1c", size = 613610, upload-time = "2026-08-10T14:14:33.829Z" }, { url = "https://files.pythonhosted.org/packages/d8/c0/b27589e25d220289edcd4d582b2b17b83058d1a56d53d971b6ea1a34f10d/greenlet-3.5.5-cp311-cp311-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:35cbb8bf55ace57fbccb4fb8622c4521713acd8691e77f4696d416ea7ca527da", size = 625481, upload-time = "2026-08-10T14:27:23.647Z" }, + { url = "https://files.pythonhosted.org/packages/39/82/5c873dbb4fb001d22fbbd50e80d4c1b0181ddae106856132160f84b94e88/greenlet-3.5.5-cp311-cp311-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:abc8bc8d9f935cd685457545b6a53863a877fdc12c2c0f5ee9beee18d9db139c", size = 633329, upload-time = "2026-08-10T14:30:06.062Z" }, { url = "https://files.pythonhosted.org/packages/51/2d/f2c928218ac52f26d7a2c188c171d1b7e728b23782cb3347e7b4fce1493a/greenlet-3.5.5-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:74cc6df89ec5302337adc9cf096221cbed2510fd444b0e0f1586cf0470740864", size = 624562, upload-time = "2026-08-10T13:40:48.064Z" }, + { url = "https://files.pythonhosted.org/packages/70/12/f7df98e72a8eb4a7edfec5a08d6d1a4ab53a52c95ba0b2ea6c10b8dd9bd0/greenlet-3.5.5-cp311-cp311-manylinux_2_39_riscv64.whl", hash = "sha256:3134291427bb0f3526e9d90311988caf336eb43730e95244997a4fb15f45144f", size = 428145, upload-time = "2026-08-10T14:30:01.071Z" }, { url = "https://files.pythonhosted.org/packages/3e/4a/92fc51d5d35912f4f06eec037ba347985defd0be47463a010a325634d9d2/greenlet-3.5.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6d9b454c5fc48aeaa7c4337813dbf513a6870468e426438a04d922c6d0fe63db", size = 1584909, upload-time = "2026-08-10T14:15:04.343Z" }, { url = "https://files.pythonhosted.org/packages/ac/58/ed98b80ac5738c149a5258544843c45601ade1fd70f61740cdaead6351b3/greenlet-3.5.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:03551ed792cb1b4fc0277a0c60dfd8c343894a0ba06fe60dcd22f568b433da39", size = 1651184, upload-time = "2026-08-10T13:40:28.879Z" }, { url = "https://files.pythonhosted.org/packages/d8/be/b582ceb80cefdf9d8da34078714e4b12b3d16f509dee0f65e40a5cc8fc7d/greenlet-3.5.5-cp311-cp311-win_amd64.whl", hash = "sha256:ab3df3dffb58bf70564e93a5cec7941e4d9faa5a36cc4234a10d3131afe04f53", size = 323280, upload-time = "2026-08-10T13:26:07.495Z" }, @@ -1195,7 +1197,9 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/2e/7e/9ecd0285e3153532ae07aeb88063c43c72b4221cf0d4d123b02f3682e3ff/greenlet-3.5.5-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:49520f0c95a48b42cf55414b8e8479beb274ea70431afc33e3f79903c71f4380", size = 295809, upload-time = "2026-08-10T13:25:34.023Z" }, { url = "https://files.pythonhosted.org/packages/35/73/60e4bbcc89252037b18087f2ec16405d5b2d5be42dde191bbf3667e96102/greenlet-3.5.5-cp312-cp312-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:55272212cbc5f43d1d723725ab931f1939969b7e9523882ca58b55061769d053", size = 611910, upload-time = "2026-08-10T14:14:35.18Z" }, { url = "https://files.pythonhosted.org/packages/a4/17/cd5134be659cd4a443e7a61ae670dabec165a814c51162916d637b6dd38e/greenlet-3.5.5-cp312-cp312-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:655bca754a2ef4efcb0eb48a94d3f4593536d0f3d48f8ed44343c01d16a92f95", size = 624198, upload-time = "2026-08-10T14:27:25.229Z" }, + { url = "https://files.pythonhosted.org/packages/9b/30/87c212b5c684d0e72974f1063b7a9687631e8985902c06e1016542c874e7/greenlet-3.5.5-cp312-cp312-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6ca5d6ae0739e5764f2cfcfaa562ac5a990cbdaedca93251c5e3cf07c362371f", size = 629504, upload-time = "2026-08-10T14:30:07.967Z" }, { url = "https://files.pythonhosted.org/packages/78/ac/5c5b959999b6f09c3026b5dfe171575bc3121c5236ce74f495096f25b203/greenlet-3.5.5-cp312-cp312-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:147b25a42e5ca5be3d42356e8f608b37af715a1c196e9bf9d1627f3341adfe1d", size = 621439, upload-time = "2026-08-10T13:40:49.391Z" }, + { url = "https://files.pythonhosted.org/packages/63/2c/eb487fafc9f50ffff2b1e0b697f70fb34bf150821c08ab225aacf5583a7e/greenlet-3.5.5-cp312-cp312-manylinux_2_39_riscv64.whl", hash = "sha256:1b5ed9162c0c098e0bbc2cf88a94f433c1b8926f831745252e099e5d83e17759", size = 432462, upload-time = "2026-08-10T14:30:02.309Z" }, { url = "https://files.pythonhosted.org/packages/c8/8b/6acf112ed8aee499f25b4d6949820fb02ac950ff9c1f3d793bd5be0599f2/greenlet-3.5.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:27493374cff1d1b7919dc8126547f2aea582737e3046147b434b1e12de56389b", size = 1581342, upload-time = "2026-08-10T14:15:05.653Z" }, { url = "https://files.pythonhosted.org/packages/b8/d7/734e5f198888876b42d7616ff6644c075baf6b8a2412deadd6b0e1b8b20c/greenlet-3.5.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:12e2ee66c2aba86133f10fd99d6a8856c6d351ffb7be0e4d52ef2cc5fbb705b2", size = 1645744, upload-time = "2026-08-10T13:40:30.353Z" }, { url = "https://files.pythonhosted.org/packages/de/30/1f42b88dc587b5899ee50616ad56ee40cafaf225df4fb829f10183c62a5c/greenlet-3.5.5-cp312-cp312-win_amd64.whl", hash = "sha256:49ddacd36af37735fab103846f4ee4d18a492dde72730d1699c0c8ebe30d9f18", size = 324171, upload-time = "2026-08-10T13:28:44.472Z" }, @@ -1203,7 +1207,9 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/fb/3d/8cef5f724ec0d4add2af8961d504535ec60c3cca9e464f6d03bdba29d85b/greenlet-3.5.5-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:b79fd2a5bc099b5e744f34c4c9a58954a5f4cb7529fb4b6e8446057d61b6edaa", size = 294730, upload-time = "2026-08-10T13:27:51.206Z" }, { url = "https://files.pythonhosted.org/packages/88/4b/8e7aa3f514273aecff30a16ab1bac09ff54cfc7e6860fdd8058c37ff2499/greenlet-3.5.5-cp313-cp313-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:634cf15a233a949136879dd388e25d3296e16f3f1e217d2456797b8579ebc6ed", size = 614536, upload-time = "2026-08-10T14:14:36.589Z" }, { url = "https://files.pythonhosted.org/packages/85/48/4e95e9dd5a8a397dc6a6345dd7f1935113d0fca4f85e89d3976da9cd988d/greenlet-3.5.5-cp313-cp313-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:499adea519f748407fc6806d20eedabac2884fd73b9f38d81236e190ba20dfef", size = 626924, upload-time = "2026-08-10T14:27:27.048Z" }, + { url = "https://files.pythonhosted.org/packages/0e/84/eaa476d6bf3816828d0d70e80dcc36bf30a058233bd889e707e693f6e860/greenlet-3.5.5-cp313-cp313-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7278591501941bb2456af102bb9cd59aab48c6cfd6e2dd68fa1290bb0c49a42", size = 632726, upload-time = "2026-08-10T14:30:09.874Z" }, { url = "https://files.pythonhosted.org/packages/89/5d/398a1c71fa7a277deeb376c999979de6786f08fc2d5747a0b9d6e11738dd/greenlet-3.5.5-cp313-cp313-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2eabb980975cba5b93a95f6f69287d05fc05ac955bfd6a320a7c083eeb52c0b0", size = 623906, upload-time = "2026-08-10T13:40:50.501Z" }, + { url = "https://files.pythonhosted.org/packages/d0/f2/0cc2849ede68579291e9c59b3ab6ec1958f98681cca5b14d8fc75bf674a4/greenlet-3.5.5-cp313-cp313-manylinux_2_39_riscv64.whl", hash = "sha256:4dfc7c4470354e7b09184d1a3a985761053a2fd694ddb5b5c80242afc2c8c90b", size = 434966, upload-time = "2026-08-10T14:30:03.729Z" }, { url = "https://files.pythonhosted.org/packages/04/1b/745450fc5ea9e0cb17d840d248f284db3363de736d362c7d2d883e3eadba/greenlet-3.5.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:03115c2e0a371999bf8ae616aa8d653f96641d4705c457aebaa187276e9f7537", size = 1581430, upload-time = "2026-08-10T14:15:06.853Z" }, { url = "https://files.pythonhosted.org/packages/d4/29/d51b296e3191bb15d3d81ec375af1909e4466c0f395d744ed475801798a9/greenlet-3.5.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4441153ffba21b90d3ca89fe3d31f5c093ae6c0bf0cfdfc98f54cde22f95b62e", size = 1645684, upload-time = "2026-08-10T13:40:32.133Z" }, { url = "https://files.pythonhosted.org/packages/12/63/369f1a1625e64e9e31df3963c6044056e3fdfa3fa3fdba3c54ffefa6e987/greenlet-3.5.5-cp313-cp313-win_amd64.whl", hash = "sha256:95c5b1f4b3a193f8a0c2de4bfdcb48d119f7f1063941f1de1f2168051b3e52dd", size = 324075, upload-time = "2026-08-10T13:26:58.974Z" }, @@ -1211,7 +1217,9 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/7f/8c/080e881fa2be95ff1ddbd6994b2bab3b1a78df3b3fcab39306011764fcc7/greenlet-3.5.5-cp314-cp314-macosx_11_0_universal2.whl", hash = "sha256:d4a389a852e392a6366058651a20fa5ba40d979865aa81bea2ccbdc44805070d", size = 295309, upload-time = "2026-08-10T13:26:03.032Z" }, { url = "https://files.pythonhosted.org/packages/25/cc/0ac614e6586c0e42d4cc281a5819150f4f43685744a4c5ff77139286409d/greenlet-3.5.5-cp314-cp314-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:70b157cd319873e8b544ddc2de158f55bbd0a9b0218c8ce9332039801518e328", size = 661185, upload-time = "2026-08-10T14:14:37.867Z" }, { url = "https://files.pythonhosted.org/packages/5e/b9/6808725354be8ad305dfe5172377664fc9642d4fc043be246b3314cf4482/greenlet-3.5.5-cp314-cp314-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8bdfd1424abcf26832961e766570cae79efdb9599d709088c9cb6ef82b194926", size = 673419, upload-time = "2026-08-10T14:27:28.652Z" }, + { url = "https://files.pythonhosted.org/packages/eb/52/f005d579acde46c3d1cc3cab1c9f3d5708c8a3006a4120e8cf5da801afe9/greenlet-3.5.5-cp314-cp314-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d98ef6f92e67c6dbf299dbfd8facc1b0d2d9cedf91e325e73b3d0373fe4309d8", size = 677863, upload-time = "2026-08-10T14:30:11.663Z" }, { url = "https://files.pythonhosted.org/packages/42/2e/40c509967da7f254680826a2fa0dd22138ec79946c70b97542d74cde8b43/greenlet-3.5.5-cp314-cp314-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:182de51c6b572a705f2fafaab2e783bcf7d2760940229dfe73086cbae037af3e", size = 670822, upload-time = "2026-08-10T13:40:51.833Z" }, + { url = "https://files.pythonhosted.org/packages/c4/8a/a75f8a2bdcef3c358a3147cdc9db3aa83755f0a038f766ab0bedb66f512c/greenlet-3.5.5-cp314-cp314-manylinux_2_39_riscv64.whl", hash = "sha256:159df1942d88e8f784cbb38d6f18bdb365cd11319cfbb3e89623de2b97892d53", size = 480554, upload-time = "2026-08-10T14:30:05.171Z" }, { url = "https://files.pythonhosted.org/packages/2d/22/c3c2eee4a8fe191d6d1d183086c56133d646024e3d70bfd414829f64560b/greenlet-3.5.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8fec3f165dfe332e490c3247c0f6c23b0bfc45f06496ad7f00ddb00e3d35e4dc", size = 1628469, upload-time = "2026-08-10T14:15:08.11Z" }, { url = "https://files.pythonhosted.org/packages/f7/87/25babd09b94cb1f03e71db815fde463f0262e40cfbd953d58a8d77311351/greenlet-3.5.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c6ce25fee6cabc8bf22cb8b52e642cbb821be5b9aec8094d07ff03378141b8e9", size = 1691952, upload-time = "2026-08-10T13:40:33.502Z" }, { url = "https://files.pythonhosted.org/packages/2e/3d/5cc9701117ea4dc0eb7bf1f4f9b7888a6e2e5277ddfae095805ace50f2b6/greenlet-3.5.5-cp314-cp314-win_amd64.whl", hash = "sha256:7dffc5c859fe6059974df1e37d7923d654a83e2ae18fdd616994270e001115e1", size = 327458, upload-time = "2026-08-10T13:27:02.868Z" }, @@ -1219,14 +1227,18 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/24/e0/50cd600b469e5734c72709b6b1838b6bc63f307b573c772c3132d6ecfe92/greenlet-3.5.5-cp314-cp314t-macosx_11_0_universal2.whl", hash = "sha256:0e5a7de979d764aea1f5b6e95cf92b5b37741b9823702041f34b126e7f690277", size = 305471, upload-time = "2026-08-10T13:26:20.568Z" }, { url = "https://files.pythonhosted.org/packages/75/a3/77acd66dfc6387b5219b2080806c0cabb73c10eb1bb44b413c40a62015ba/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fef01bd457f11fc158b130ca0027a3c365693280e8e231b65bdaf57999f39f5b", size = 672470, upload-time = "2026-08-10T14:14:39.058Z" }, { url = "https://files.pythonhosted.org/packages/b9/71/0d178142dca3ec19f46fb2212ae73d30ad53b9d548dc64804086033a7089/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5173a72310725a74afc82c164f0e52cb8ad0de62f2bb623f24f6c0cc07d80272", size = 679973, upload-time = "2026-08-10T14:27:30.072Z" }, + { url = "https://files.pythonhosted.org/packages/aa/ac/0d7887aa4bbfc9eba075cc428244dfc96f623478454d5ec81180d0d6bd5a/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5e9ec2e7c98e895fcea0c5cc57b2606cf86ece6d0a56578f3eb225e2af4f0387", size = 681587, upload-time = "2026-08-10T14:30:13.519Z" }, { url = "https://files.pythonhosted.org/packages/6e/31/46eb8567302eaf787abf88d09df014e14ae3baf460af1b8b0efdbd3efcd5/greenlet-3.5.5-cp314-cp314t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44f08341873200ba8a60a8bc14ace3d91f1754f7fa7bc66157714a8cd420a476", size = 676634, upload-time = "2026-08-10T13:40:53.004Z" }, + { url = "https://files.pythonhosted.org/packages/4f/18/8d58ba1c429b0383e3219a3d0e0bba241d0444d8ed05b73349953c7d7c7b/greenlet-3.5.5-cp314-cp314t-manylinux_2_39_riscv64.whl", hash = "sha256:102817506f6090b5176c746a82603341a549b40e5c3d5b72a4c672228a918c41", size = 510175, upload-time = "2026-08-10T14:30:07.047Z" }, { url = "https://files.pythonhosted.org/packages/a3/e9/b88bbf5b29970cb84172dc2c32aa3e5e579ceb94c808e81c826454138850/greenlet-3.5.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:d246c0db9a2513cd45f019ba178ea4d4d4705bd210ee465e2c15d76a1ab13874", size = 1637320, upload-time = "2026-08-10T14:15:09.317Z" }, { url = "https://files.pythonhosted.org/packages/6d/8c/7631ed29cc6f0392f11830076e172ce4885e70b0bc2c1bce1731176d4b4e/greenlet-3.5.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:72507285b5caa1d17904a3f7c322ca780823a54170a0e04ec3f37bcc60d4db71", size = 1697412, upload-time = "2026-08-10T13:40:34.924Z" }, { url = "https://files.pythonhosted.org/packages/da/0f/f7dd935f9c4cb1be49098770587f54d8a78518e55c89bce86c4fb4109057/greenlet-3.5.5-cp314-cp314t-win_amd64.whl", hash = "sha256:7805655781fb8f28a55d05fe57ed61f5f10f1892fb587673e3bb5264f28041f0", size = 331514, upload-time = "2026-08-10T13:29:20.611Z" }, { url = "https://files.pythonhosted.org/packages/b7/e5/681b01f8fbc1b55232822f99e8f8afeb78a55a7c76a7bf9dbdc7ccb03a6d/greenlet-3.5.5-cp315-cp315-macosx_11_0_universal2.whl", hash = "sha256:c0db80fcd5b8aece93f66c64f78a786bbb6b96c5fe63ef5a5a4581ecf8bab206", size = 295975, upload-time = "2026-08-10T13:28:45.985Z" }, { url = "https://files.pythonhosted.org/packages/11/f2/69b488cd9e7267bf4b0fe8cdebf25d8d6df680d21bdf41150d23e23d6652/greenlet-3.5.5-cp315-cp315-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b241c32f912ada659808d68e308c568baf577eebf757d15471472de0c18cfad", size = 666823, upload-time = "2026-08-10T14:14:40.222Z" }, { url = "https://files.pythonhosted.org/packages/84/d4/d5bc2fdebbdda0c94555925ba79948b8395d75a7f6a36cc85dce5bab9f11/greenlet-3.5.5-cp315-cp315-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ef6a08349401d8eaf3cb12688ac8557de95788556b8631ef17555a4a173022c0", size = 677613, upload-time = "2026-08-10T14:27:31.543Z" }, + { url = "https://files.pythonhosted.org/packages/65/53/4e13642efc4d7ad6554ecb2242a5be42666b2e1a067323e88dfc0124a04b/greenlet-3.5.5-cp315-cp315-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:37faa97daccb6d9f4c2141ce3118d023c3c5506864a7d8bdf726f665018c1f76", size = 681436, upload-time = "2026-08-10T14:30:14.839Z" }, { url = "https://files.pythonhosted.org/packages/bd/93/542d8a3a90f3b35c6ad8bf7e56a03010287f2cafa289a5b7985b5207db39/greenlet-3.5.5-cp315-cp315-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f2e3d061b8e13aec2f0441689b3c71b244a20e5d274a52cb0f7e31bd1d139552", size = 675930, upload-time = "2026-08-10T13:40:54.205Z" }, + { url = "https://files.pythonhosted.org/packages/cd/32/188447c9a468d6977d2989397226b0c6b65ab6f4cf943f931643328512fc/greenlet-3.5.5-cp315-cp315-manylinux_2_39_riscv64.whl", hash = "sha256:b18007dc2473a7942fd157366b55f01da6fed7ce85318591005b419e0a439474", size = 487404, upload-time = "2026-08-10T14:30:08.903Z" }, { url = "https://files.pythonhosted.org/packages/52/b5/89c9f2e8460d71101037d47a1feed11928615a5edd42370be290e0657eeb/greenlet-3.5.5-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:9ab5f5b93655e77fe0d6c2dfd22b5eac751bb1f876d8ec21761b7c1fb9266007", size = 1633878, upload-time = "2026-08-10T14:15:10.693Z" }, { url = "https://files.pythonhosted.org/packages/b8/60/297de93f3b02ac78a5e04d32bb8bbe3080f4a73d8ed95016561463b70618/greenlet-3.5.5-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:f0e5a21bd4452a88cf032fc43c4a5b307ab1380eacb63b5988f9c0317885e773", size = 1696597, upload-time = "2026-08-10T13:40:36.252Z" }, { url = "https://files.pythonhosted.org/packages/18/25/54c6eaff4f337fb670215e89eb2d00d9499487b658e709d4b477be4a342e/greenlet-3.5.5-cp315-cp315-win_amd64.whl", hash = "sha256:469dbb0a78625642f4a626cfd0c6e8bccc0385b5e49189b6308bbe849ec88a8e", size = 327700, upload-time = "2026-08-10T13:28:06.752Z" }, @@ -1234,7 +1246,9 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/10/e2/3144c0a116067ac1e30457b0139a94d60d1d36a86e015de68e9ac87cb3bc/greenlet-3.5.5-cp315-cp315t-macosx_11_0_universal2.whl", hash = "sha256:68184dfcf50ccaa8e864770fe0633a7e27250ea9329f8192ef47ee9ecfd78e1c", size = 306387, upload-time = "2026-08-10T13:27:00.897Z" }, { url = "https://files.pythonhosted.org/packages/5c/a1/cb4223a7e9b9f43b8807e8eb212358bfe2dfaa174a9ea2889eb1714dcba2/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9ec0dc0e59dc9c61af5c47348365ccbbd7addfafe0a93b00336ff3da2907bdc6", size = 676472, upload-time = "2026-08-10T14:14:41.417Z" }, { url = "https://files.pythonhosted.org/packages/9e/cd/a154b4498e5d8f12ada291cfb3b8d596eadde2177f5bf09a9be699d2a446/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e604f58e35833fc46ef20302bcb314dddbfd3fcf33a4f936216d51dd678d63ae", size = 684238, upload-time = "2026-08-10T14:27:32.946Z" }, + { url = "https://files.pythonhosted.org/packages/ce/f4/e450a68a152f819491d8c7df6a8254e761d87e6a78759268961f8c5bd4dd/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2888a3a38bc5ee5bb6c438372197152e815837e4fab7ed7a1f86ef18ffd58ad1", size = 686022, upload-time = "2026-08-10T14:30:15.96Z" }, { url = "https://files.pythonhosted.org/packages/bf/bb/b0031d260c2968a3c87deebc51d80c64e499377f993aafe06ee3b7488cc2/greenlet-3.5.5-cp315-cp315t-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:40239b5384f96da3963585cc6d7eaa9b56f8ae67e8d92cc82dd9e202fc847de3", size = 681246, upload-time = "2026-08-10T13:40:55.402Z" }, + { url = "https://files.pythonhosted.org/packages/18/23/17e63d6bf3b9c9b9dbea981b7f643a71f79603bdfb4f1c3a9cf353e22aed/greenlet-3.5.5-cp315-cp315t-manylinux_2_39_riscv64.whl", hash = "sha256:1e8d9391fe77f15649589a907cef972dbbd6352ef7ff7dc0492f658c0c26495f", size = 516951, upload-time = "2026-08-10T14:30:10.907Z" }, { url = "https://files.pythonhosted.org/packages/9a/07/da554b71ab88e649da146e1065d86a48a5c5d92e50ab74ef41b504aa7f56/greenlet-3.5.5-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:a1eaccf5c3a1d3e46dead602c72e6836731e8e245c9de6a27764567b6b62d4c0", size = 1642735, upload-time = "2026-08-10T14:15:11.92Z" }, { url = "https://files.pythonhosted.org/packages/78/76/26a3782a051677668af9d92beaa47cd87ba9dd5072f762961144a03dd4c6/greenlet-3.5.5-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:19e4e026fe20691f333b8eb1a3bc9625eceba8c3f9d62ec5a6f8581afbc6b5a5", size = 1700925, upload-time = "2026-08-10T13:40:37.656Z" }, { url = "https://files.pythonhosted.org/packages/28/d9/fe7baf4190c2ae71f267efb9de21b3172bb35bc0ed1ef53dd6027d658e33/greenlet-3.5.5-cp315-cp315t-win_amd64.whl", hash = "sha256:712aee154f648bde84634654bb38bb78c69ac640c37a45c9effed800735049d8", size = 331829, upload-time = "2026-08-10T13:26:48.851Z" }, @@ -4349,7 +4363,7 @@ wheels = [ [[package]] name = "sap-cloud-sdk" -version = "0.58.1" +version = "0.58.2" source = { editable = "." } dependencies = [ { name = "cryptography" }, From 3f1a85d2f38592807c5249ca990ec1f09e96a2e9 Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Wed, 7 Oct 2026 15:41:26 -0300 Subject: [PATCH 03/10] docs(ias): add IASVerifier and VerifiedIASClaims documentation Add a "Verified Claims" section to the IAS user guide covering IASVerifier, VerifiedIASClaims, and zero-config middleware usage. Update the telemetry user guide to document token verification behaviour, the fail-closed default, and the custom verifier option. --- .../core/telemetry/user-guide.md | 46 +++++++++++- src/sap_cloud_sdk/ias/user-guide.md | 72 +++++++++++++++++++ 2 files changed, 116 insertions(+), 2 deletions(-) diff --git a/src/sap_cloud_sdk/core/telemetry/user-guide.md b/src/sap_cloud_sdk/core/telemetry/user-guide.md index f0b0f5df..ceb28c12 100644 --- a/src/sap_cloud_sdk/core/telemetry/user-guide.md +++ b/src/sap_cloud_sdk/core/telemetry/user-guide.md @@ -363,11 +363,20 @@ auto_instrument(middlewares=[MyMiddleware(app=app)]) ### Built-in: `StarletteIASTelemetryMiddleware` -For Starlette/FastAPI apps with IAS authentication, the SDK ships a ready-to-use middleware that reads the `Authorization: Bearer ` header on each request, parses it as an IAS JWT, and injects: +For Starlette/FastAPI apps with IAS authentication, the SDK ships a ready-to-use middleware that +reads the `Authorization: Bearer ` header on each request, **verifies** it as an IAS JWT +using JWKS-backed signature verification, and injects: - `sap.tenancy.tenant_id` from the `sap_gtid` claim - `user.id` from the `user_uuid` claim -If the header is absent or the token cannot be parsed, no attributes are set and the request continues normally. +Identity attributes are stamped **only** when token verification succeeds. Forged or invalid tokens +result in no identity attributes and an empty auth context — the request continues normally. + +#### Zero-config (IAS service binding present) + +When an `identity` or `xsuaa` service binding is available (`VCAP_SERVICES` on CF, `IAS_URL` env +var on Kubernetes), `StarletteIASTelemetryMiddleware` auto-configures `IASVerifier` at construction +with no extra code: ```python from starlette.applications import Starlette @@ -375,9 +384,42 @@ from sap_cloud_sdk.core.telemetry import auto_instrument from sap_cloud_sdk.core.telemetry.middleware import StarletteIASTelemetryMiddleware app = Starlette(...) +# Auto-configures IASVerifier from VCAP_SERVICES (CF) or IAS_URL (K8s) auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) ``` +**Agents with an IAS service binding get verified telemetry and auth context with zero code changes.** + +#### Without an IAS service binding + +If no binding is found, a WARNING is logged at startup: + +``` +StarletteIASTelemetryMiddleware: IAS service binding not found — sap.tenancy.tenant_id +and user.id will NOT be stamped on spans. Bind an SAP Identity service instance to enable +verified identity attributes. +``` + +The app starts and handles requests normally — only the identity span attributes are omitted. +Add an IAS service binding to restore them. + +#### Custom verifier (advanced) + +For scenarios where the token has already been verified upstream (e.g. Istio/Kyma mTLS), pass +a custom `TokenVerifier` callable: + +```python +from sap_cloud_sdk.ias import IASVerifier, TokenVerifier + +my_verifier: TokenVerifier = IASVerifier( + ias_url="https://my-tenant.accounts.ondemand.com", + client_id="my-client-id", +) +auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app, token_verifier=my_verifier)]) +``` + +See the [IAS user guide](../../ias/user-guide.md#verified-claims) for the full `IASVerifier` API. + --- ## Configuration diff --git a/src/sap_cloud_sdk/ias/user-guide.md b/src/sap_cloud_sdk/ias/user-guide.md index f6957972..014c51f4 100644 --- a/src/sap_cloud_sdk/ias/user-guide.md +++ b/src/sap_cloud_sdk/ias/user-guide.md @@ -82,3 +82,75 @@ claims = parse_token(token) set_tenant_id(claims.app_tid or "") add_span_attribute("enduser.id", claims.scim_id or claims.sub or "") ``` + +--- + +## Verified Claims + +`parse_token` decodes the JWT without verifying its signature. For security-sensitive +consumers — telemetry identity attributes, audit context — use `IASVerifier` to perform +JWKS-backed signature verification before trusting the claims. + +### IASVerifier + +`IASVerifier` is a built-in verifier that fetches signing keys from the IAS JWKS endpoint and +validates the token's signature, issuer, algorithm, and expiry. It auto-configures itself from +the environment: + +- **Cloud Foundry**: reads `VCAP_SERVICES` → `identity[0]` or `xsuaa[0]` credentials. +- **Kubernetes / local**: reads `IAS_URL` (and optionally `IAS_CLIENT_ID`) environment variables. + +```python +from sap_cloud_sdk.ias import IASVerifier, IASConfigError + +# Auto-configure from VCAP_SERVICES (CF) or IAS_URL (K8s) +try: + verifier = IASVerifier.from_env() +except IASConfigError: + # No IAS binding found — handle gracefully + ... + +# Or configure explicitly +verifier = IASVerifier(ias_url="https://my-tenant.accounts.ondemand.com", client_id="my-client-id") + +# Verify a token — raises IASTokenError on any failure +verified = verifier("Bearer ") +claims = verified.claims # IASClaims, provably from IAS +``` + +`IASVerifier` pins algorithms to `RS256` and `ES256` (asymmetric only), caches signing keys +internally, and handles key rotation transparently. + +### VerifiedIASClaims + +`VerifiedIASClaims` is a frozen dataclass that wraps `IASClaims`. Its presence is the SDK's +provenance marker: an instance can only be obtained by calling a `TokenVerifier` that ran +signature verification. Never construct it directly from `parse_token` output in security- +sensitive code. + +```python +from sap_cloud_sdk.ias import VerifiedIASClaims, IASClaims + +verified: VerifiedIASClaims = verifier("Bearer ") +claims: IASClaims = verified.claims # access the underlying claims +``` + +### Zero-config with StarletteIASTelemetryMiddleware + +When an IAS service binding is present, `StarletteIASTelemetryMiddleware` auto-configures +`IASVerifier.from_env()` and verifies every token before stamping span attributes or setting +the auth context — no extra code required: + +```python +from starlette.applications import Starlette +from sap_cloud_sdk.core.telemetry import auto_instrument +from sap_cloud_sdk.core.telemetry.middleware import StarletteIASTelemetryMiddleware + +app = Starlette(...) +# IASVerifier auto-configured from VCAP_SERVICES or IAS_URL +auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) +``` + +If no binding is found, a WARNING is logged at startup and identity attributes are not stamped +until a binding is added. See [Telemetry user guide](../core/telemetry/user-guide.md#built-in-starletteiastelemetrymiddleware) +for details. From 3abb886b54d5bbc29831b7af98e5848b478c247e Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 11:51:40 -0300 Subject: [PATCH 04/10] docs(ias): fix paragraph line wrapping in Verified Claims section MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Keep each prose paragraph on a single line so Markdown renders correctly and the raw text is easier to read — addresses review feedback. --- src/sap_cloud_sdk/ias/user-guide.md | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-) diff --git a/src/sap_cloud_sdk/ias/user-guide.md b/src/sap_cloud_sdk/ias/user-guide.md index 014c51f4..5defbb16 100644 --- a/src/sap_cloud_sdk/ias/user-guide.md +++ b/src/sap_cloud_sdk/ias/user-guide.md @@ -87,15 +87,11 @@ add_span_attribute("enduser.id", claims.scim_id or claims.sub or "") ## Verified Claims -`parse_token` decodes the JWT without verifying its signature. For security-sensitive -consumers — telemetry identity attributes, audit context — use `IASVerifier` to perform -JWKS-backed signature verification before trusting the claims. +`parse_token` decodes the JWT without verifying its signature. For security-sensitive consumers — telemetry identity attributes, audit context — use `IASVerifier` to perform JWKS-backed signature verification before trusting the claims. ### IASVerifier -`IASVerifier` is a built-in verifier that fetches signing keys from the IAS JWKS endpoint and -validates the token's signature, issuer, algorithm, and expiry. It auto-configures itself from -the environment: +`IASVerifier` is a built-in verifier that fetches signing keys from the IAS JWKS endpoint and validates the token's signature, issuer, algorithm, and expiry. It auto-configures itself from the environment: - **Cloud Foundry**: reads `VCAP_SERVICES` → `identity[0]` or `xsuaa[0]` credentials. - **Kubernetes / local**: reads `IAS_URL` (and optionally `IAS_CLIENT_ID`) environment variables. @@ -118,15 +114,11 @@ verified = verifier("Bearer ") claims = verified.claims # IASClaims, provably from IAS ``` -`IASVerifier` pins algorithms to `RS256` and `ES256` (asymmetric only), caches signing keys -internally, and handles key rotation transparently. +`IASVerifier` pins algorithms to `RS256` and `ES256` (asymmetric only), caches signing keys internally, and handles key rotation transparently. ### VerifiedIASClaims -`VerifiedIASClaims` is a frozen dataclass that wraps `IASClaims`. Its presence is the SDK's -provenance marker: an instance can only be obtained by calling a `TokenVerifier` that ran -signature verification. Never construct it directly from `parse_token` output in security- -sensitive code. +`VerifiedIASClaims` is a frozen dataclass that wraps `IASClaims`. Its presence is the SDK's provenance marker: an instance can only be obtained by calling a `TokenVerifier` that ran signature verification. Never construct it directly from `parse_token` output in security-sensitive code. ```python from sap_cloud_sdk.ias import VerifiedIASClaims, IASClaims @@ -137,9 +129,7 @@ claims: IASClaims = verified.claims # access the underlying claims ### Zero-config with StarletteIASTelemetryMiddleware -When an IAS service binding is present, `StarletteIASTelemetryMiddleware` auto-configures -`IASVerifier.from_env()` and verifies every token before stamping span attributes or setting -the auth context — no extra code required: +When an IAS service binding is present, `StarletteIASTelemetryMiddleware` auto-configures `IASVerifier.from_env()` and verifies every token before stamping span attributes or setting the auth context — no extra code required: ```python from starlette.applications import Starlette @@ -151,6 +141,4 @@ app = Starlette(...) auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) ``` -If no binding is found, a WARNING is logged at startup and identity attributes are not stamped -until a binding is added. See [Telemetry user guide](../core/telemetry/user-guide.md#built-in-starletteiastelemetrymiddleware) -for details. +If no binding is found, a WARNING is logged at startup and identity attributes are not stamped until a binding is added. See [Telemetry user guide](../core/telemetry/user-guide.md#built-in-starletteiastelemetrymiddleware) for details. From b3037335906afe33ba08c4042051d52320d8e8f8 Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 12:28:17 -0300 Subject: [PATCH 05/10] feat(ias): add Kubernetes secret mount lookup to IASVerifier.from_env() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extend the three-step lookup in from_env() with a new step 2 that reads the identity-service secret from the volume mount at /etc/secrets/appfnd/identity-service/default/ (url + clientid fields). The mount is populated automatically by the agent deployment template (via the existing identity-service PushSecret), so agents need no app.yaml changes to get zero-config IAS verification. Lookup order: VCAP_SERVICES → K8s mount → IAS_URL env var. --- src/sap_cloud_sdk/ias/_verifier.py | 45 +++++++++++++++++++-- src/sap_cloud_sdk/ias/user-guide.md | 3 +- tests/ias/unit/test_verifier.py | 61 +++++++++++++++++++++++++++++ 3 files changed, 104 insertions(+), 5 deletions(-) diff --git a/src/sap_cloud_sdk/ias/_verifier.py b/src/sap_cloud_sdk/ias/_verifier.py index 54a051ab..98a404dc 100644 --- a/src/sap_cloud_sdk/ias/_verifier.py +++ b/src/sap_cloud_sdk/ias/_verifier.py @@ -3,11 +3,15 @@ import json import logging import os +from dataclasses import dataclass from typing import Optional import jwt from jwt import PyJWKClient +from sap_cloud_sdk.core.secret_resolver.resolver import ( + read_from_mount_and_fallback_to_env_var as _read_secret, +) from sap_cloud_sdk.ias._token import VerifiedIASClaims, parse_token from sap_cloud_sdk.ias.exceptions import IASTokenError @@ -16,6 +20,17 @@ _ENV_IAS_URL = "IAS_URL" _ENV_IAS_CLIENT_ID = "IAS_CLIENT_ID" +_SECRET_MOUNT_BASE = "/etc/secrets/appfnd" +_ENV_VAR_BASE = "CLOUD_SDK_CFG" +_SECRET_MODULE = "identity-service" +_SECRET_DEFAULT_INSTANCE = "default" + + +@dataclass +class _IASBindingData: + url: str = "" + clientid: str = "" + class IASConfigError(Exception): """Raised when IAS configuration cannot be resolved from the environment.""" @@ -76,7 +91,9 @@ def from_env(cls) -> "IASVerifier": 1. ``VCAP_SERVICES`` (Cloud Foundry) — ``identity[0].credentials.{url, clientid}`` - 2. ``IAS_URL`` + ``IAS_CLIENT_ID`` environment variables (Kubernetes / manual) + 2. Kubernetes volume mount — ``/etc/secrets/appfnd/identity-service/default/{url,clientid}`` + (mounted automatically by the agent deployment template) + 3. ``IAS_URL`` + ``IAS_CLIENT_ID`` environment variables (manual / legacy) Returns: A configured :class:`IASVerifier` instance. @@ -103,6 +120,26 @@ def from_env(cls) -> "IASVerifier": except (json.JSONDecodeError, KeyError, IndexError, TypeError) as exc: logger.debug("IASVerifier.from_env: VCAP_SERVICES parse error: %s", exc) + # Step 2 — Kubernetes volume mount (identity-service secret) + try: + binding = _IASBindingData() + _read_secret( + base_volume_mount=_SECRET_MOUNT_BASE, + base_var_name=_ENV_VAR_BASE, + module=_SECRET_MODULE, + instance=_SECRET_DEFAULT_INSTANCE, + target=binding, + ) + if binding.url: + logger.debug( + "IASVerifier.from_env: configured from Kubernetes secret mount (%s/%s)", + _SECRET_MODULE, + _SECRET_DEFAULT_INSTANCE, + ) + return cls(ias_url=binding.url, client_id=binding.clientid or None) + except Exception as exc: + logger.debug("IASVerifier.from_env: secret mount lookup failed: %s", exc) + ias_url = os.getenv(_ENV_IAS_URL) if ias_url: client_id = os.getenv(_ENV_IAS_CLIENT_ID) or None @@ -111,9 +148,9 @@ def from_env(cls) -> "IASVerifier": raise IASConfigError( f"Cannot auto-configure IASVerifier: no IAS service binding found. " - f"Bind an SAP Identity service instance (sets VCAP_SERVICES on CF or " - f"a Kubernetes secret) or set {_ENV_IAS_URL} (and optionally " - f"{_ENV_IAS_CLIENT_ID}) manually." + f"Set VCAP_SERVICES (CF), mount the identity-service secret at " + f"{_SECRET_MOUNT_BASE}/{_SECRET_MODULE}/{_SECRET_DEFAULT_INSTANCE}/ (Kubernetes), " + f"or set {_ENV_IAS_URL} (and optionally {_ENV_IAS_CLIENT_ID}) manually." ) def __call__(self, authorization: str) -> VerifiedIASClaims: diff --git a/src/sap_cloud_sdk/ias/user-guide.md b/src/sap_cloud_sdk/ias/user-guide.md index 5defbb16..d8f75fa9 100644 --- a/src/sap_cloud_sdk/ias/user-guide.md +++ b/src/sap_cloud_sdk/ias/user-guide.md @@ -94,7 +94,8 @@ add_span_attribute("enduser.id", claims.scim_id or claims.sub or "") `IASVerifier` is a built-in verifier that fetches signing keys from the IAS JWKS endpoint and validates the token's signature, issuer, algorithm, and expiry. It auto-configures itself from the environment: - **Cloud Foundry**: reads `VCAP_SERVICES` → `identity[0]` or `xsuaa[0]` credentials. -- **Kubernetes / local**: reads `IAS_URL` (and optionally `IAS_CLIENT_ID`) environment variables. +- **Kubernetes (managed runtime)**: reads the `identity-service` secret mounted at `/etc/secrets/appfnd/identity-service/default/` — mounted automatically by the agent deployment template, no `app.yaml` changes needed. +- **Manual / local**: reads `IAS_URL` (and optionally `IAS_CLIENT_ID`) environment variables. ```python from sap_cloud_sdk.ias import IASVerifier, IASConfigError diff --git a/tests/ias/unit/test_verifier.py b/tests/ias/unit/test_verifier.py index e1181b12..7dbe1384 100644 --- a/tests/ias/unit/test_verifier.py +++ b/tests/ias/unit/test_verifier.py @@ -86,6 +86,67 @@ def test_vcap_takes_precedence_over_env_var(self, monkeypatch): v = IASVerifier.from_env() assert v._ias_url == "https://vcap-ias.example.com" + def test_k8s_mount_success(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.delenv("IAS_URL", raising=False) + + def _fake_read_secret(base_volume_mount, base_var_name, module, instance, target): + target.url = "https://mount-ias.example.com" + target.clientid = "mount-client" + + with patch("sap_cloud_sdk.ias._verifier._read_secret", side_effect=_fake_read_secret): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://mount-ias.example.com" + assert v._client_id == "mount-client" + + def test_k8s_mount_no_url_falls_through_to_env_var(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.setenv("IAS_URL", "https://env-ias.example.com") + + def _fake_read_secret(base_volume_mount, base_var_name, module, instance, target): + target.clientid = "mount-client" + # url stays "" + + with patch("sap_cloud_sdk.ias._verifier._read_secret", side_effect=_fake_read_secret): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://env-ias.example.com" + + def test_k8s_mount_raises_falls_through_to_env_var(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.setenv("IAS_URL", "https://env-ias.example.com") + + with patch("sap_cloud_sdk.ias._verifier._read_secret", side_effect=RuntimeError("mount not found")): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://env-ias.example.com" + + def test_vcap_takes_precedence_over_mount(self, monkeypatch): + vcap = {"identity": [{"credentials": {"url": "https://vcap-ias.example.com", "clientid": "vc"}}]} + monkeypatch.setenv("VCAP_SERVICES", json.dumps(vcap)) + monkeypatch.delenv("IAS_URL", raising=False) + + def _fake_read_secret(base_volume_mount, base_var_name, module, instance, target): + target.url = "https://mount-ias.example.com" + + with patch("sap_cloud_sdk.ias._verifier._read_secret", side_effect=_fake_read_secret): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://vcap-ias.example.com" + + def test_mount_takes_precedence_over_env_var(self, monkeypatch): + monkeypatch.delenv("VCAP_SERVICES", raising=False) + monkeypatch.setenv("IAS_URL", "https://env-ias.example.com") + + def _fake_read_secret(base_volume_mount, base_var_name, module, instance, target): + target.url = "https://mount-ias.example.com" + + with patch("sap_cloud_sdk.ias._verifier._read_secret", side_effect=_fake_read_secret): + with patch("sap_cloud_sdk.ias._verifier.PyJWKClient"): + v = IASVerifier.from_env() + assert v._ias_url == "https://mount-ias.example.com" + class TestIASVerifierCall: def _make_verifier(self, ias_url="https://ias.example.com", client_id=None): From 8062415364bf13086462f1f23a8b77fd3084f5ec Mon Sep 17 00:00:00 2001 From: tiagoek Date: Thu, 8 Oct 2026 15:56:55 -0300 Subject: [PATCH 06/10] Potential fix for pull request finding 'CodeQL / Clear-text logging of sensitive information' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/sap_cloud_sdk/ias/_verifier.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/src/sap_cloud_sdk/ias/_verifier.py b/src/sap_cloud_sdk/ias/_verifier.py index 98a404dc..d61946f2 100644 --- a/src/sap_cloud_sdk/ias/_verifier.py +++ b/src/sap_cloud_sdk/ias/_verifier.py @@ -131,11 +131,7 @@ def from_env(cls) -> "IASVerifier": target=binding, ) if binding.url: - logger.debug( - "IASVerifier.from_env: configured from Kubernetes secret mount (%s/%s)", - _SECRET_MODULE, - _SECRET_DEFAULT_INSTANCE, - ) + logger.debug("IASVerifier.from_env: configured from Kubernetes secret mount") return cls(ias_url=binding.url, client_id=binding.clientid or None) except Exception as exc: logger.debug("IASVerifier.from_env: secret mount lookup failed: %s", exc) From 9c94a224475b47c6ca1442974f9197d87f3c38d1 Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 16:35:40 -0300 Subject: [PATCH 07/10] ci: re-trigger checks against latest commit From 81ce6aff848c099afe19f032f614203e0e517917 Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 16:37:18 -0300 Subject: [PATCH 08/10] style: apply ruff format after CodeQL autofix --- src/sap_cloud_sdk/ias/_verifier.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/sap_cloud_sdk/ias/_verifier.py b/src/sap_cloud_sdk/ias/_verifier.py index d61946f2..53784bbc 100644 --- a/src/sap_cloud_sdk/ias/_verifier.py +++ b/src/sap_cloud_sdk/ias/_verifier.py @@ -131,7 +131,9 @@ def from_env(cls) -> "IASVerifier": target=binding, ) if binding.url: - logger.debug("IASVerifier.from_env: configured from Kubernetes secret mount") + logger.debug( + "IASVerifier.from_env: configured from Kubernetes secret mount" + ) return cls(ias_url=binding.url, client_id=binding.clientid or None) except Exception as exc: logger.debug("IASVerifier.from_env: secret mount lookup failed: %s", exc) From 7f9cf492645cf6dab61f0dd13569364907045d32 Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 17:50:06 -0300 Subject: [PATCH 09/10] docs: update user guides to reflect K8s secret mount as primary lookup --- src/sap_cloud_sdk/core/telemetry/user-guide.md | 9 +++++---- src/sap_cloud_sdk/ias/user-guide.md | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/src/sap_cloud_sdk/core/telemetry/user-guide.md b/src/sap_cloud_sdk/core/telemetry/user-guide.md index ceb28c12..063644e9 100644 --- a/src/sap_cloud_sdk/core/telemetry/user-guide.md +++ b/src/sap_cloud_sdk/core/telemetry/user-guide.md @@ -374,9 +374,11 @@ result in no identity attributes and an empty auth context — the request conti #### Zero-config (IAS service binding present) -When an `identity` or `xsuaa` service binding is available (`VCAP_SERVICES` on CF, `IAS_URL` env -var on Kubernetes), `StarletteIASTelemetryMiddleware` auto-configures `IASVerifier` at construction -with no extra code: +When an IAS service binding is available, `StarletteIASTelemetryMiddleware` auto-configures `IASVerifier` at construction with no extra code. Lookup order: + +1. `VCAP_SERVICES` (Cloud Foundry) +2. Kubernetes secret mount at `/etc/secrets/appfnd/identity-service/default/` — populated automatically by the agent deployment template, no `app.yaml` changes needed +3. `IAS_URL` environment variable (manual / local) ```python from starlette.applications import Starlette @@ -384,7 +386,6 @@ from sap_cloud_sdk.core.telemetry import auto_instrument from sap_cloud_sdk.core.telemetry.middleware import StarletteIASTelemetryMiddleware app = Starlette(...) -# Auto-configures IASVerifier from VCAP_SERVICES (CF) or IAS_URL (K8s) auto_instrument(middlewares=[StarletteIASTelemetryMiddleware(app=app)]) ``` diff --git a/src/sap_cloud_sdk/ias/user-guide.md b/src/sap_cloud_sdk/ias/user-guide.md index d8f75fa9..ff9000fb 100644 --- a/src/sap_cloud_sdk/ias/user-guide.md +++ b/src/sap_cloud_sdk/ias/user-guide.md @@ -100,7 +100,7 @@ add_span_attribute("enduser.id", claims.scim_id or claims.sub or "") ```python from sap_cloud_sdk.ias import IASVerifier, IASConfigError -# Auto-configure from VCAP_SERVICES (CF) or IAS_URL (K8s) +# Auto-configure from VCAP_SERVICES (CF), K8s secret mount, or IAS_URL env var try: verifier = IASVerifier.from_env() except IASConfigError: From b61b3766bfc7412748ae9ef828d7b50c7d10f8cf Mon Sep 17 00:00:00 2001 From: Tiago Kochenborger Date: Thu, 8 Oct 2026 18:10:19 -0300 Subject: [PATCH 10/10] docs(telemetry): fix paragraph line wrapping in StarletteIASTelemetryMiddleware section --- src/sap_cloud_sdk/core/telemetry/user-guide.md | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/src/sap_cloud_sdk/core/telemetry/user-guide.md b/src/sap_cloud_sdk/core/telemetry/user-guide.md index 063644e9..82ab964d 100644 --- a/src/sap_cloud_sdk/core/telemetry/user-guide.md +++ b/src/sap_cloud_sdk/core/telemetry/user-guide.md @@ -363,14 +363,11 @@ auto_instrument(middlewares=[MyMiddleware(app=app)]) ### Built-in: `StarletteIASTelemetryMiddleware` -For Starlette/FastAPI apps with IAS authentication, the SDK ships a ready-to-use middleware that -reads the `Authorization: Bearer ` header on each request, **verifies** it as an IAS JWT -using JWKS-backed signature verification, and injects: +For Starlette/FastAPI apps with IAS authentication, the SDK ships a ready-to-use middleware that reads the `Authorization: Bearer ` header on each request, **verifies** it as an IAS JWT using JWKS-backed signature verification, and injects: - `sap.tenancy.tenant_id` from the `sap_gtid` claim - `user.id` from the `user_uuid` claim -Identity attributes are stamped **only** when token verification succeeds. Forged or invalid tokens -result in no identity attributes and an empty auth context — the request continues normally. +Identity attributes are stamped **only** when token verification succeeds. Forged or invalid tokens result in no identity attributes and an empty auth context — the request continues normally. #### Zero-config (IAS service binding present) @@ -406,8 +403,7 @@ Add an IAS service binding to restore them. #### Custom verifier (advanced) -For scenarios where the token has already been verified upstream (e.g. Istio/Kyma mTLS), pass -a custom `TokenVerifier` callable: +For scenarios where the token has already been verified upstream (e.g. Istio/Kyma mTLS), pass a custom `TokenVerifier` callable: ```python from sap_cloud_sdk.ias import IASVerifier, TokenVerifier