fix: add warnings when using str/bytes as key

Author: lepture

src/joserfc/jwk.py

@@ -1,4 +1,5 @@
 import typing as t
+import warnings
 from ._keys import (
     JWKRegistry,
     KeySet,
@@ -78,5 +79,10 @@ def guess_key(key: KeyFlexible, obj: GuestProtocol, use_random: bool = False) ->
 
 def _normalize_key(key: KeyBase) -> t.Union[Key, KeySet]:
     if isinstance(key, (str, bytes)):
+        warnings.warn(
+            "Please use a Key object instead of bytes or string.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         return OctKey.import_key(key)
     return key

src/joserfc/jws.py

@@ -295,15 +295,17 @@ def detach_content(value: DetachValue) -> DetachValue:
     .. code-block:: python
 
         >>> from joserfc import jws
-        >>> encoded_text = jws.serialize_compact({"alg": "HS256"}, b"hello", "secret")
+        >>> from joserfc.jwk import OctKey
+        >>> key = OctKey.import_key("secret")
+        >>> encoded_text = jws.serialize_compact({"alg": "HS256"}, b"hello", key)
         >>> jws.detach_content(encoded_text)
         'eyJhbGciOiJIUzI1NiJ9..UYmO_lPAY5V0Wf4KZsfhiYs1SxqXPhxvjuYqellDV5A'
 
     You can also detach the JSON serialization:
 
     .. code-block:: python
 
-        >>> obj = jws.serialize_json({"protected": {"alg": "HS256"}}, b"hello", "secret")
+        >>> obj = jws.serialize_json({"protected": {"alg": "HS256"}}, b"hello", key)
         >>> jws.detach_content(obj)
         {
             'payload': '',

tests/jwe/test_compact.py

@@ -98,7 +98,11 @@ def test_ECDH_ES_with_OKP_key(self):
                 )
 
     def test_dir_alg(self):
-        self.assertRaises(InvalidKeyLengthError, encrypt_compact, {"alg": "dir", "enc": "A128GCM"}, b"j", "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(
+            InvalidKeyLengthError,
+            encrypt_compact, {"alg": "dir", "enc": "A128GCM"}, b"j", key
+        )
         for enc in JWE_ENC_MODELS:
             key = OctKey.generate_key(enc.cek_size)
             self.run_case('dir', enc.name, key, key)

tests/jwe/test_errors.py

@@ -12,33 +12,34 @@
 
 class TestJWEErrors(TestCase):
     def test_dir_with_invalid_key_type(self):
-        key = load_key("ec-p256-private.pem")
+        key1 = load_key("ec-p256-private.pem")
         protected = {"alg": "dir", "enc": "A128CBC-HS256"}
         self.assertRaises(
             InvalidKeyTypeError,
             jwe.encrypt_compact,
-            protected, b"i", key,
+            protected, b"i", key1,
         )
 
         protected = {"alg": "A128KW", "enc": "A128CBC-HS256"}
         self.assertRaises(
             InvalidKeyTypeError,
             jwe.encrypt_compact,
-            protected, b"i", key,
+            protected, b"i", key1,
         )
 
         protected = {"alg": "ECDH-ES+A128KW", "enc": "A128CBC-HS256"}
+        key2 = OctKey.import_key("secret")
         self.assertRaises(
             InvalidKeyTypeError,
             jwe.encrypt_compact,
-            protected, b"i", "secret",
+            protected, b"i", key2,
         )
 
         protected = {"alg": "PBES2-HS256+A128KW", "enc": "A128CBC-HS256"}
         self.assertRaises(
             InvalidKeyTypeError,
             jwe.encrypt_compact,
-            protected, b"i", key,
+            protected, b"i", key1,
             algorithms=["PBES2-HS256+A128KW", "A128CBC-HS256"]
         )
 
@@ -64,24 +65,26 @@ def test_A128KW_unwrap_error(self):
 
     def test_invalid_alg(self):
         protected = {"alg": "INVALID", "enc": "A128CBC-HS256"}
+        key = OctKey.import_key("secret")
         self.assertRaises(
             ValueError,
             jwe.encrypt_compact,
-            protected, b"i", "secret"
+            protected, b"i", key
         )
 
     def test_invalid_key_length(self):
         protected = {"alg": "dir", "enc": "A128CBC-HS256"}
+        key = OctKey.import_key("secret")
         self.assertRaises(
             InvalidKeyLengthError,
             jwe.encrypt_compact,
-            protected, b"i", "secret"
+            protected, b"i", key
         )
         protected = {"alg": "A128KW", "enc": "A128CBC-HS256"}
         self.assertRaises(
             InvalidKeyLengthError,
             jwe.encrypt_compact,
-            protected, b"i", "secret"
+            protected, b"i", key
         )
         protected = {"alg": "RSA-OAEP", "enc": "A128CBC-HS256"}
         rsa_key = RSAKey.generate_key(1024)

tests/jwk/test_key_methods.py

@@ -24,12 +24,16 @@ def set_kid(self, kid):
 
 class TestKeyMethods(TestCase):
     def test_guess_str_key(self):
-        key = guess_key("key", Guest())
-        self.assertIsInstance(key, OctKey)
+        self.assertRaises(
+            DeprecationWarning,
+            guess_key, "key", Guest(),
+        )
 
     def test_guess_bytes_key(self):
-        key = guess_key(b"key", Guest())
-        self.assertIsInstance(key, OctKey)
+        self.assertRaises(
+            DeprecationWarning,
+            guess_key, b"key", Guest(),
+        )
 
     def test_guess_callable_key(self):
         oct_key = OctKey.generate_key(parameters={'kid': '1'})
@@ -44,31 +48,34 @@ def key_func2(obj):
         def key_func3(obj):
             return KeySet([oct_key, rsa_key])
 
-        key = guess_key(key_func1, Guest())
-        self.assertIsInstance(key, OctKey)
+        self.assertRaises(
+            DeprecationWarning,
+            guess_key, key_func1, Guest(),
+        )
 
-        key = guess_key(key_func2, Guest())
-        self.assertIsInstance(key, RSAKey)
+        key2 = guess_key(key_func2, Guest())
+        self.assertIsInstance(key2, RSAKey)
 
         guest = Guest()
         guest.set_kid('2')
-        key = guess_key(key_func3, guest)
-        self.assertIsInstance(key, RSAKey)
+        key3 = guess_key(key_func3, guest)
+        self.assertIsInstance(key3, RSAKey)
 
     def test_guess_key_set(self):
         key_set = KeySet([OctKey.generate_key(), RSAKey.generate_key()])
         guest = Guest()
         guest._headers["alg"] = "HS256"
+
         self.assertRaises(ValueError, guess_key, key_set, guest)
-        key = guess_key(key_set, guest, True)
-        self.assertIsInstance(key, OctKey)
-        key = guess_key(key_set, guest)
+        key1 = guess_key(key_set, guest, True)
+        self.assertIsInstance(key1, OctKey)
+        guess_key(key_set, guest)
 
         guest = Guest()
         guest._headers["alg"] = "RS256"
         self.assertRaises(ValueError, guess_key, key_set, guest)
-        key = guess_key(key_set, guest, True)
-        self.assertIsInstance(key, RSAKey)
+        key2 = guess_key(key_set, guest, True)
+        self.assertIsInstance(key2, RSAKey)
 
         guest = Guest()
         guest._headers["alg"] = "ES256"

tests/jws/test_compact.py

@@ -6,36 +6,42 @@
 
 class TestCompact(TestCase):
     def test_registry_is_none(self):
-        value = serialize_compact({"alg": "HS256"}, b"foo", "secret")
+        key = OctKey.import_key("secret")
+        value = serialize_compact({"alg": "HS256"}, b"foo", key)
         expected = 'eyJhbGciOiJIUzI1NiJ9.Zm9v.0pehoi-RMZM1jl-4TP_C4Y6BJ-bcmsuzfDyQpkpJkh0'
         self.assertEqual(value, expected)
 
-        obj = deserialize_compact(value, "secret")
+        obj = deserialize_compact(value, key)
         self.assertEqual(obj.payload, b"foo")
 
     def test_bad_signature_error(self):
+        key = OctKey.import_key("incorrect")
         value = b'eyJhbGciOiJIUzI1NiJ9.Zm9v.0pehoi-RMZM1jl-4TP_C4Y6BJ-bcmsuzfDyQpkpJkh0'
-        self.assertRaises(BadSignatureError, deserialize_compact, value, "incorrect")
+        self.assertRaises(BadSignatureError, deserialize_compact, value, key)
 
     def test_raise_none_supported_alg(self):
-        self.assertRaises(ValueError, serialize_compact, {"alg": "HS512"}, b"foo", "secret")
-        self.assertRaises(ValueError, serialize_compact, {"alg": "NOT"}, b"foo", "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(ValueError, serialize_compact, {"alg": "HS512"}, b"foo", key)
+        self.assertRaises(ValueError, serialize_compact, {"alg": "NOT"}, b"foo", key)
 
     def test_invalid_length(self):
-        self.assertRaises(ValueError, deserialize_compact, b'a.b.c.d', "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(ValueError, deserialize_compact, b'a.b.c.d', key)
 
     def test_no_invalid_header(self):
         # invalid base64
         value = b'abc.Zm9v.0pehoi'
-        self.assertRaises(DecodeError, deserialize_compact, value, "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(DecodeError, deserialize_compact, value, key)
 
         # no alg value
         value = b'eyJhIjoiYiJ9.Zm9v.0pehoi'
-        self.assertRaises(MissingAlgorithmError, deserialize_compact, value, "secret")
+        self.assertRaises(MissingAlgorithmError, deserialize_compact, value, key)
 
     def test_invalid_payload(self):
         value = b'eyJhbGciOiJIUzI1NiJ9.a$b.0pehoi'
-        self.assertRaises(DecodeError, deserialize_compact, value, "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(DecodeError, deserialize_compact, value, key)
 
     def test_with_key_set(self):
         keys = KeySet([
@@ -54,7 +60,8 @@ def test_with_key_set(self):
 
     def test_strict_check_header(self):
         header = {"alg": "HS256", "custom": "hi"}
-        self.assertRaises(ValueError, serialize_compact, header, b"hi", "secret")
+        key = OctKey.import_key("secret")
+        self.assertRaises(ValueError, serialize_compact, header, b"hi", key)
 
         registry = JWSRegistry(strict_check_header=False)
-        serialize_compact(header, b"hi", "secret", registry=registry)
+        serialize_compact(header, b"hi", key, registry=registry)

tests/jws/test_errors.py

@@ -15,92 +15,97 @@
 
 class TestJWSErrors(TestCase):
     def test_without_alg(self):
+        key = OctKey.import_key("secret")
         # missing alg
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            {"kid": "123"}, "i", "secret"
+            {"kid": "123"}, "i", key
         )
 
     def test_none_alg(self):
         header = {"alg": "none"}
+        key = OctKey.import_key("secret")
         text = jws.serialize_compact(
-            header, "i", "secret",
+            header, "i", key,
             algorithms=["none"]
         )
         self.assertRaises(
             BadSignatureError,
             jws.deserialize_compact,
-            text, "secret",
+            text, key,
             algorithms=["none"]
         )
 
     def test_header_invalid_type(self):
         # kid should be a string
         header = {"alg": "HS256", "kid": 123}
+        key = OctKey.import_key("secret")
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
 
         # jwk should be a dict
         header = {"alg": "HS256", "jwk": "dict"}
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
 
         # jku should be a URL
         header = {"alg": "HS256", "jku": "url"}
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
 
         # x5c should be a chain of string
         header = {"alg": "HS256", "x5c": "url"}
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
         header = {"alg": "HS256", "x5c": [1, 2]}
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
 
     def test_crit_header(self):
         header = {"alg": "HS256", "crit": ["kid"]}
+        key = OctKey.import_key("secret")
         # missing kid header
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
 
         header = {"alg": "HS256", "kid": "1", "crit": ["kid"]}
-        jws.serialize_compact(header, "i", "secret")
+        jws.serialize_compact(header, "i", key)
 
     def test_extra_header(self):
         header = {"alg": "HS256", "extra": "hi"}
+        key = OctKey.import_key("secret")
         self.assertRaises(
             ValueError,
             jws.serialize_compact,
-            header, "i", "secret",
+            header, "i", key,
         )
         # bypass extra header
         registry = jws.JWSRegistry(strict_check_header=False)
-        jws.serialize_compact(header, "i", "secret", registry=registry)
+        jws.serialize_compact(header, "i", key, registry=registry)
 
         # or use a header registry
         extra_header = {"extra": HeaderParameter("Extra header", "str", False)}
         registry = jws.JWSRegistry(header_registry=extra_header)
-        jws.serialize_compact(header, "i", "secret", registry=registry)
+        jws.serialize_compact(header, "i", key, registry=registry)
 
     def test_rsa_invalid_signature(self):
         key1 = RSAKey.generate_key()