fix: warn about possible unsafe key for OctKey instead of raising error. #32

Author: lepture

src/joserfc/rfc7518/oct_key.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 from typing import Any
 import secrets
+import warnings
 from ..util import (
     to_bytes,
     urlsafe_b64decode,
@@ -35,7 +36,7 @@ def import_from_dict(cls, value: DictKey) -> bytes:
     def import_from_bytes(cls, value: bytes, password: Any | None = None) -> bytes:
         # security check
         if value.startswith(POSSIBLE_UNSAFE_KEYS):
-            raise ValueError("This key may not be safe to import")
+            warnings.warn("This key may not be safe to import")
         return value
 
 

tests/jwk/test_oct_key.py

@@ -80,7 +80,7 @@ def test_invalid_key_ops(self):
 
     def test_import_pem_key(self):
         public_pem = read_key("ec-p256-public.pem")
-        self.assertRaises(ValueError, OctKey.import_key, public_pem)
+        self.assertWarns(UserWarning, OctKey.import_key, public_pem)
 
     def test_generate_key(self):
         key = OctKey.generate_key()