feat: initial gnap and http signatures implementation #10

elijah0kello · 2025-06-17T23:43:24Z

Changes in this PR

added classes for key management
added http signature header support for requests to auth server and resource server
added unit tests
added github actions file to run tests

Things to note

integration tests are still failing since when I was making requests to https://auth.interledger-test.dev, I didn't have any public keys registered.
I therefore need some help understanding how to upload public keys to the AS.

Authors

Run unit tests

poetry run pytest -s test/unit

feat: http signature client

…-python-sdk into ft/gnap-utils

Chore: Updated Readme Docs

elijah0kello · 2025-06-19T05:40:58Z

@Tymmmy I have added some usage documentation in the README.md. Still adding more docs though.

The current docs should give an idea of how I envisioned the client to be used.

elijah0kello · 2025-06-22T12:02:31Z

The integration test for requesting a grant is now passing.

to run integration tests.

poetry run pytest -s tests/integration/test_grants.py

I registered a wallet , created keys and loaded it in privkey.pem.example for testing

sidvishnoi

Looking good!
Did a quick first pass, will try setting up locally for next round of review.

sidvishnoi · 2025-07-01T12:27:36Z

.github/workflows/test.yml

+
+    strategy:
+      matrix:
+        python-version: [3.11, 3.12, 3.13]


Can we aim from Python 3.9 as it's still a supported version?
One old version, one "most used supported" version, and one latest (even beta)?

sidvishnoi · 2025-07-01T12:27:46Z

.github/workflows/test.yml

@@ -0,0 +1,44 @@
+name: Test Python open payments sdk f


Suggested change

name: Test Python open payments sdk f

name: Test Python Open Payments SDK

sidvishnoi · 2025-07-01T12:28:04Z

.github/workflows/test.yml

+
+jobs:
+  test:
+    runs-on: ubuntu-latest


Can we test on Windows as well?

sidvishnoi · 2025-07-01T12:28:41Z

.github/workflows/test.yml

+      - name: Install Poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | python3 -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Configure Poetry
+        run: |
+          poetry config virtualenvs.create false


Can we merge these two into "Set up Poetry"?

sidvishnoi · 2025-07-01T12:30:10Z

README.md

 ```
 > poetry install
 ```


So the code becomes part of Step 2:

Suggested change

```

> poetry install

```

```

> poetry install

```

sidvishnoi · 2025-07-01T13:21:49Z

src/open_payments_sdk/api/auth.py

+        request = self.set_content_digest(request=request)
+        request = self.sign_request(request,("content-type","content-digest","content-length",*self.get_default_covered_components()))
+        response = self.http_client.send(request=request)
+        return response.json()


Skipping model_validate? for this response?

sidvishnoi · 2025-07-01T13:29:31Z

src/open_payments_sdk/gnap_utils/security.py

+        )
+        return message
+
+    def get_default_headers(self) -> dict:


Should these methods be made @staticmethod or move moved out of the class? They're essentially constants.

sidvishnoi · 2025-07-01T13:38:53Z

src/open_payments_sdk/gnap_utils/keys.py

+    def load_ed25519_private_key_from_pem(self,pem_str: Union[str, bytes]) -> Ed25519PrivateKey:
+        """
+        Read private key from str or bytes string
+        """
+        if isinstance(pem_str,str):
+            pem_str = pem_str.encode("utf-8")


Nit: given we'll be using encoded bytes, better to name this variable pem_bytes:

Suggested change

def load_ed25519_private_key_from_pem(self,pem_str: Union[str, bytes]) -> Ed25519PrivateKey:

"""

Read private key from str or bytes string

"""

if isinstance(pem_str,str):

pem_str = pem_str.encode("utf-8")

def load_ed25519_private_key_from_pem(self,pem_bytes: Union[str, bytes]) -> Ed25519PrivateKey:

"""

Read private key from str or bytes string

"""

if isinstance(pem_bytes,str):

pem_bytes = pem_bytes.encode("utf-8")

sidvishnoi · 2025-07-01T13:41:07Z

src/open_payments_sdk/http.py

+            method: str,
+            url: str,
+            headers = None,
+            data = None,


Should this be typed as dict as well?

sidvishnoi · 2025-07-01T13:43:43Z

src/open_payments_sdk/http.py

+            data = None,
+            json: dict = None,
+            params: dict = None
+    ) -> httpx.Request:


Should we expose this httpx dependency like this to other modules? Seems fine from perspective of better control at call-site, but makes dependency harder to switch when/if needed.

elijah0kello · 2025-07-01T19:29:07Z

thanks @sidvishnoi for these comments. I will address them ASAP.

johngian · 2025-07-14T06:35:05Z

Some overall comments about this PR:

I think 33 commits are not very manageable/readable to review. I suggest the commits to be more atomic.
I am not sure what's the policy for 3rd party libraries but I would advise against building on top of non established authentication related libraries

elijah0kello · 2025-07-14T06:54:15Z

thanks @johngian for these comments.

I am happy to take you through the codebase if it is overwhelming. Also it is just a lot of commits but the actual code changes are not so many.
In regard to the third party lib, I read through the code base for the http signatures lib and also made a PR to fix something that was wrong. That being said if there is a policy, let's hear it and I'll address that specific issue with a custom implementation of http signatures.

johngian · 2025-07-14T07:05:23Z

@elijah0kello its not about having an overwhelming codebase. There is a purpose and value on having atomic commits. The PR at its current state (from a quick look) has 4+ commits that are about running unit tests and 3-4 commits only about updating docs, on top of that there is a bunch of merge commits from other repositories which don't bring much value in the context of the commit history. Also there is a commit that fixes a typo of a change introduced in this changeset.

Regarding the http signatures lib i would defer to the folks from the organization to decide but if it was my decision i would rather have an implementation that is audited/vetted by the org or built internally just for the purpose of ILF projects.

johngian · 2025-07-14T07:11:32Z

README.md

+Install it in your project
+
+```bash
+pip install </path/to/>open-payments-python-sdk/dist/open_payments_sdk-0.1.0-py3-none-any.whl


We do have a poetry based setup, there is no need to point to a pinned version of the wheel file.

johngian · 2025-07-14T07:12:59Z

README.md

+To use this sdk, you will first need to install it in your project.  Currently you will need to build from source but once it is hosted on pypi you will be able to install it with pip
+
+```bash
+python3 -m pip install open-payments-python-sdk #currently not setup


If you are running poetry install why do you need to explicitly install the module?

koekiebox · 2025-07-14T07:50:09Z

@elijah0kello its not about having an overwhelming codebase. There is a purpose and value on having atomic commits. The PR at its current state (from a quick look) has 4+ commits that are about running unit tests and 3-4 commits only about updating docs, on top of that there is a bunch of merge commits from other repositories which don't bring much value in the context of the commit history. Also there is a commit that fixes a typo of a change introduced in this changeset.

Regarding the http signatures lib i would defer to the folks from the organization to decide but if it was my decision i would rather have an implementation that is audited/vetted by the org or built internally just for the purpose of ILF projects.

I am happy, as long as we introduce CVE scanning to ensure the libraries are safe to use. I have left other comments on the PR. 🙇

koekiebox

Left a couple of comments, mostly regarding pip-audit.

koekiebox · 2025-06-23T08:31:18Z

.gitignore

@@ -170,3 +170,4 @@ poetry.toml
 pyrightconfig.json

 # End of https://www.toptal.com/developers/gitignore/api/python
+privkey.pem


add new line.

koekiebox · 2025-07-14T07:44:32Z

pyproject.toml

-    {name = "Yiannis Giannelos",email = "johngiannelos@gmail.com"}
+    {name = "Yiannis Giannelos",email = "johngiannelos@gmail.com"},
+    {name = "Elijah Okello", email = "elijahokello90@gmail.com"},
+    {name = "Kasweka Michael Mukoko", email = "kasweka.mukoko@izyane.com"}
 ]
 license = {text = "Apache-2.0"}
 requires-python = ">=3.11"
 dependencies = [
    "httpx (>=0.28.1,<0.29.0)",


There doesn't seem to be any vulnerabilities with these dependencies, but could we also run the pip-audit as part of the workflow?

jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Install dependencies run: | python3 -m pip install . # assumes dependencies declared in pyproject.toml python3 -m pip install pip-audit - name: Run pip-audit run: pip-audit .

koekiebox · 2025-07-14T07:45:38Z

.github/workflows/test.yml

+
+jobs:
+  test:
+    runs-on: ubuntu-latest


Could you also run an audit as part of the flow?

elijah0kello · 2025-07-14T09:00:10Z

thanks @koekiebox for comments.

I will address as advised. Especially the dependency auditing.

Co-authored-by: Sid Vishnoi <8426945+sidvishnoi@users.noreply.github.com>

elijah0kello and others added 23 commits February 11, 2025 09:25

chore: update project progress

50cc13d

Merge branch 'main' of github.com:elijah0kello/open-payments-python-sdk

64ee7e0

Make fetch_spec.sh runnable from any directory

2130dd8

Merge branch 'main' of github.com:elijah0kello/open-payments-python-sdk

e9e8dcf

created requirements.txt

baa2e9f

feat: http signature implementations

9b725c3

feat: implemented gnap functionality

61ba6c9

chore: removed requirements.txt

6a2ccd3

ci: added test workflow for github actions

8719193

ci: fixed failing test workflow

adc8124

ci: run unit tests only

777b019

ci: run tests for python 3.13

0a20138

ci: run unit tests only

94cd07f

Merge pull request #1 from Kasweka1/ft/http-signatures

d327d72

feat: http signature client

chore: added unit test files

188cc0d

Merge branch 'ft/gnap-utils' of github.com:elijah0kello/open-payments…

90c9d37

…-python-sdk into ft/gnap-utils

chore: fixed whitespace issues

00885a3

feat: updated readme docs

250d03b

chore: added get signed headers function

25b523c

Merge pull request #2 from Kasweka1/ft/set-up-documentation

3056025

Chore: Updated Readme Docs

docs: updated documentation

a2aed05

feat: added http signatures to resource and grant classes

f56b513

fix: fixed failiing wallet integration tests

2ca863f

Tymmmy requested review from sidvishnoi, adrianboros and koekiebox June 18, 2025 06:10

elijah0kello added 3 commits June 18, 2025 22:31

chore: put client in sdk folder

a813747

docs: added documentation for sdk

de3c090

chore: fix failing tests

a43785c

elijah0kello added 6 commits June 19, 2025 11:11

fix: fixed typo in OpenPaymentsClient class name

cb07c23

docs: updated docs

f040f2a

chore: updated test folder in ci

75f7708

feat: fix failing grant requests

7b21489

chore: wrote unit and integration tests

782ec63

docs: added usage docs

aa4493c

chore: remove unused imports

293b0d8

sidvishnoi reviewed Jul 1, 2025

View reviewed changes

johngian reviewed Jul 14, 2025

View reviewed changes

koekiebox requested changes Jul 14, 2025

View reviewed changes

elijah0kello and others added 2 commits July 17, 2025 20:03

Update README.md

973bc42

Co-authored-by: Sid Vishnoi <8426945+sidvishnoi@users.noreply.github.com>

Update README.md

9303f8e

Co-authored-by: Sid Vishnoi <8426945+sidvishnoi@users.noreply.github.com>

	name: Test Python open payments sdk f
	name: Test Python Open Payments SDK

feat: initial gnap and http signatures implementation #10

Are you sure you want to change the base?

feat: initial gnap and http signatures implementation #10

Uh oh!

Conversation

elijah0kello commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes in this PR

Things to note

Authors

Run unit tests

Uh oh!

elijah0kello commented Jun 19, 2025

Uh oh!

elijah0kello commented Jun 22, 2025

Uh oh!

sidvishnoi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elijah0kello commented Jul 1, 2025

Uh oh!

johngian commented Jul 14, 2025

Uh oh!

elijah0kello commented Jul 14, 2025

Uh oh!

johngian commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

koekiebox commented Jul 14, 2025

Uh oh!

koekiebox left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elijah0kello commented Jul 14, 2025

Uh oh!

Uh oh!

elijah0kello commented Jun 17, 2025 •

edited

Loading

johngian commented Jul 14, 2025 •

edited

Loading