JOSE Utility Toolkit

Lightweight helpers for preparing JOSE-ready data: compact base64url segment handling, OpenID Connect access-token hashing, and key material format detection.

Capabilities

Base64url segment handling

• Encoding segments b"abc" and b"\xff\x00" yields YWJj._wA (no padding, dot-delimited). @test
• Decoding YWJj._wA returns (b"abc", b"\xff\x00"); malformed segments (e.g., abcd*) raise a ValueError. @test

Access token hash fingerprint

• Access token s3cr3t with alg RS256 produces TnOMpVY8Bs_QAYKZkz1Y2w (left-most half of the SHA-256 hash, base64url encoded). @test

Key material detection

• -----BEGIN PUBLIC KEY----- content is reported as pem; ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIexample is reported as ssh; short raw bytes return unknown. @test

Binary coercion guard

• Converts "payload" to b"payload", passes through b"raw" unchanged, and raises a TypeError for an integer input. @test

Implementation

@generates

API

from typing import Tuple, Union

ByteInput = Union[bytes, str]

def encode_compact_segments(*segments: ByteInput) -> str:
    """Return dot-joined base64url encodings of provided byte-like segments (no padding)."""

def decode_compact_segments(serialized: str) -> Tuple[bytes, ...]:
    """Decode a dot-delimited compact string back into the original byte segments."""

def access_token_thumbprint(access_token: str, alg: str) -> str:
    """Compute the OpenID Connect at_hash value for the given access token and JOSE alg."""

def detect_key_material(material: ByteInput) -> str:
    """Return 'pem', 'ssh', or 'unknown' based on the key material format."""

def to_bytes(value: ByteInput) -> bytes:
    """Coerce allowed input to bytes, raising TypeError for anything else."""

Dependencies { .dependencies }

python-jose { .dependency }

Provides JOSE utility helpers for base64url encoding, token hash computation, and key material inspection. @satisfied-by