Swarmauri PoP CWT

swarmauri_pop_cwt delivers COSE Sign1 proof-of-possession helpers that align with RFC 8392 and RFC 9449. The signer and verifier share the same Swarmauri PoP contract so services can mix CWT- and JWT-backed access tokens without changing validation logic.

Features

• Provides CwtPoPSigner and CwtPoPVerifier implementations that honour the shared Swarmauri PoP contract
• Accepts asynchronous key resolution hooks for COSE thumbprint matching and supports nonce/replay protections consistent with the DPoP workflow
• Generates cnf bindings that can be embedded into OAuth access tokens or session metadata to enable downstream verification
• Normalises HTTP request parts before signing or verifying to ensure interoperable coverage across services and languages

Installation

Install the package with your preferred tooling:

pip install swarmauri_pop_cwt

uv add swarmauri_pop_cwt

Usage

Signing an outgoing HTTP request

import base64
from cose.algorithms import SignatureAlg
from cose.keys import CoseKey
from swarmauri_pop_cwt import CwtPoPSigner

private_key = CoseKey.from_dict({
    1: 1,  # OKP
    -1: 6,  # Ed25519
    -2: base64.urlsafe_b64decode("11qYAYafhZMrrZ8Zgo5u1g=="),
})
public_key = CoseKey.from_dict({
    1: 1,
    -1: 6,
    -2: base64.urlsafe_b64decode("11qYAYafhZMrrZ8Zgo5u1g=="),
})

signer = CwtPoPSigner(
    private_key=private_key,
    public_key=public_key,
    algorithm=SignatureAlg.EdDSA,
)

cwp_header = signer.sign_request("GET", "https://api.example.com/resource")
print("CWP header:", cwp_header)
print("cnf:", signer.cnf_binding())

Verifying an incoming HTTP request

import asyncio
from cose.keys import CoseKey
from swarmauri_core.pop import CnfBinding, HttpParts, VerifyPolicy
from swarmauri_pop_cwt import CwtPoPVerifier


def memory_key_resolver(thumb: CnfBinding) -> CoseKey:
    return public_key


class ThumbResolver:
    def by_kid(self, kid: bytes):
        return None

    def by_thumb(self, bind: CnfBinding):
        return memory_key_resolver(bind)


async def verify_request(header: str, cnf: CnfBinding, access_token: str) -> None:
    verifier = CwtPoPVerifier()
    req = HttpParts(method="GET", url="https://api.example.com/resource", headers={"CWP": header})
    await verifier.verify_http(
        req,
        cnf,
        policy=VerifyPolicy(require_ath=True),
        keys=ThumbResolver(),
        extras={"access_token": access_token},
    )


asyncio.run(verify_request(cwp_header, signer.cnf_binding(), "opaque-access-token"))

The verifier enforces COSE key thumbprints against the cnf binding and applies the same replay and nonce strategies shared across Swarmauri PoP strategies.

Compatibility

• Python 3.10, 3.11, and 3.12
• Works alongside the shared swarmauri_core.pop abstractions and any asynchronous framework that can supply an HttpParts payload
• Designed to operate with HTTP gateways that forward method, URL, and header information for downstream validation

Related Packages

• swarmauri_pop_dpop for JWT-based Demonstration of Proof-of-Possession headers
• swarmauri_pop_x509 when mutual TLS confirmation is required
• swarmauri_core for the shared PoP contract, HTTP primitives, and error hierarchy leveraged by all PoP implementations

Contributing

Contributions are welcome through the Swarmauri SDK repository. Follow the project style guide, run the formatting and linting commands noted in the root AGENTS.md, and open pull requests with focused commits that describe the improvement.

Support

If you encounter issues integrating Swarmauri PoP CWT flows, please open a GitHub issue with details about your environment and the expected versus observed behaviour. Security concerns should be responsibly disclosed via the contact details in the repository security policy.

License

Apache License 2.0. See the LICENSE file for details.