1616AUTH_URL = os .environ .get ("AUTH_URL" , "https://api.service.nhs.uk/oauth2/token" )
1717PUBLIC_KEY_URL = os .environ .get ("PUBLIC_KEY_URL" , "https://example.com" )
1818API_KEY = os .environ .get ("API_KEY" , "api_key" )
19- TOKEN_TABLE_NAME = os .environ .get ("TOKEN_TABLE_NAME" , "" )
19+ TOKEN_TABLE_NAME = os .environ .get ("TOKEN_TABLE_NAME" , "table_name " )
2020BRANCH_NAME = os .environ .get ("DDB_INDEX_TAG" , "" )
2121
2222
@@ -40,7 +40,7 @@ def handle_request(payload: dict[str, Any]) -> dict[str, Any]:
4040
4141 _validate_assertions (assertions )
4242
43- token = generate_random_token ()
43+ token = _generate_random_token ()
4444
4545 item = {
4646 "access_token" : token ,
@@ -61,6 +61,39 @@ def handle_request(payload: dict[str, Any]) -> dict[str, Any]:
6161 return response
6262
6363
64+ def _validate_payload (payload : dict [str , Any ]) -> None :
65+ if not payload .get ("grant_type" ):
66+ raise ValueError ("grant_type is missing" )
67+ client_assertion_type = payload .get ("client_assertion_type" )
68+ if (
69+ not client_assertion_type
70+ or client_assertion_type [0 ]
71+ != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
72+ ):
73+ raise ValueError (
74+ "Missing or invalid client_assertion_type - "
75+ "must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'"
76+ )
77+ if not payload .get ("client_assertion" ):
78+ raise ValueError ("Missing client_assertion" )
79+
80+
81+ def _get_jwt_headers (client_assertion : str ) -> dict [str , Any ]:
82+ unverified_headers = jwt .get_unverified_header (client_assertion ) # noqa: S5659
83+ _logger .debug ("unverified headers: %s" , unverified_headers )
84+ algorithm = unverified_headers .get ("alg" , "" )
85+ if algorithm not in JWT_ALGORITHMS :
86+ raise ValueError (
87+ "Invalid 'alg' header in client_assertion JWT - unsupported JWT algorithm"
88+ " - must be 'RS512'"
89+ )
90+
91+ if not unverified_headers .get ("kid" ):
92+ raise ValueError ("Missing 'kid' header in client_assertion JWT" )
93+
94+ return unverified_headers
95+
96+
6497def _get_jwk_key_from_url_by_kid (kid : str ) -> Any :
6598
6699 # TODO - once we have our endpoint setup we can query it here
@@ -100,23 +133,6 @@ def _get_jwk_key_from_url_by_kid(kid: str) -> Any:
100133 return key
101134
102135
103- def _validate_payload (payload : dict [str , Any ]) -> None :
104- if not payload .get ("grant_type" ):
105- raise ValueError ("grant_type is missing" )
106- client_assertion_type = payload .get ("client_assertion_type" )
107- if (
108- not client_assertion_type
109- or client_assertion_type [0 ]
110- != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
111- ):
112- raise ValueError (
113- "Missing or invalid client_assertion_type - "
114- "must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'"
115- )
116- if not payload .get ("client_assertion" ):
117- raise ValueError ("Missing client_assertion" )
118-
119-
120136def _validate_assertions (assertions : dict [str , Any ]) -> None :
121137 expected_api_key = API_KEY
122138
@@ -142,30 +158,14 @@ def _validate_assertions(assertions: dict[str, Any]) -> None:
142158 raise ValueError ("Missing exp claim in assertions" )
143159
144160
145- def _get_jwt_headers (client_assertion : str ) -> dict [str , Any ]:
146- unverified_headers = jwt .get_unverified_header (client_assertion )
147- _logger .debug ("unverified headers: %s" , unverified_headers )
148- algorithm = unverified_headers .get ("alg" , "" )
149- if algorithm not in JWT_ALGORITHMS :
150- raise ValueError (
151- "Invalid 'alg' header in client_assertion JWT - unsupported JWT algorithm"
152- " - must be 'RS512'"
153- )
154-
155- if not unverified_headers .get ("kid" ):
156- raise ValueError ("Missing 'kid' header in client_assertion JWT" )
157-
158- return unverified_headers
159-
160-
161161def check_valid_uuid4 (string : str ) -> bool :
162162 uuid_regex = (
163163 r"^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
164164 )
165165 return re .match (uuid_regex , string ) is not None
166166
167167
168- def generate_random_token () -> str :
168+ def _generate_random_token () -> str :
169169 return "" .join (
170170 secrets .choice (
171171 "-._~+/" + string .ascii_uppercase + string .ascii_lowercase + string .digits
0 commit comments