@biffo/cli 0.38.0 → 0.41.0

package/_skeletons/sibling-template/services/api/src/api/core_client.py

@@ -0,0 +1,64 @@
+import httpx
+from fastapi import HTTPException, Security, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .config import settings
+
+_security = HTTPBearer()
+
+
+class CoreApiError(Exception):
+    def __init__(self, status_code: int, detail: str) -> None:
+        self.status_code = status_code
+        self.detail = detail
+        super().__init__(detail)
+
+
+class CoreApiClient:
+    """
+    Thin per-request client for calling the core project's API (ADR-0002/
+    ADR-0007) — this is the ONLY way this service may read or write data
+    that belongs to the core. It is deliberately NOT
+    packages/python-sdk's BiffoAPIClient: that client is built around a
+    single static BIFFO_JWT_TOKEN env var for background/event-driven
+    plugin code, not a live per-request user token. Here we forward the
+    caller's own bearer token, so the core API applies the exact same
+    tenant/permission scoping it would for a request made directly against
+    it — this service never gets elevated privileges the calling user
+    didn't already have.
+    """
+
+    def __init__(self, bearer_token: str) -> None:
+        self._bearer_token = bearer_token
+
+    async def get(self, path: str) -> dict:
+        async with httpx.AsyncClient(base_url=settings.core_api_url, timeout=10) as client:
+            response = await client.get(
+                path,
+                headers={"Authorization": f"Bearer {self._bearer_token}"},
+            )
+        if response.is_error:
+            raise CoreApiError(response.status_code, response.text)
+        return response.json()  # type: ignore[no-any-return]
+
+    async def post(self, path: str, body: dict) -> dict:
+        async with httpx.AsyncClient(base_url=settings.core_api_url, timeout=10) as client:
+            response = await client.post(
+                path,
+                json=body,
+                headers={"Authorization": f"Bearer {self._bearer_token}"},
+            )
+        if response.is_error:
+            raise CoreApiError(response.status_code, response.text)
+        return response.json()  # type: ignore[no-any-return]
+
+
+def get_core_client(
+    credentials: HTTPAuthorizationCredentials = Security(_security),
+) -> CoreApiClient:
+    if not settings.core_api_url:
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="core_api_url is not configured",
+        )
+    return CoreApiClient(credentials.credentials)

package/_skeletons/sibling-template/services/api/src/api/main.py

@@ -0,0 +1,43 @@
+import asyncio
+
+from aws_lambda_powertools import Logger, Tracer
+from aws_lambda_powertools.utilities.typing import LambdaContext
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from mangum import Mangum
+
+from .config import settings
+from .routers import whoami
+
+logger = Logger()
+tracer = Tracer()
+
+app = FastAPI(
+    title="Sibling API",
+    version="0.0.0",
+    docs_url="/api/docs" if settings.environment != "prod" else None,
+    redoc_url=None,
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=settings.cors_origins,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(whoami.router, prefix="/api/v1")
+
+handler = Mangum(app, lifespan="off")
+
+
+@logger.inject_lambda_context
+@tracer.capture_lambda_handler
+def lambda_handler(event: dict, context: LambdaContext) -> dict:
+    # asyncio.run() (used internally by httpx's async client teardown, among
+    # other things) sets the current event loop to None when it exits,
+    # causing asyncio.get_event_loop() (used by Mangum) to raise RuntimeError
+    # in Python 3.12+. Recreate the loop before each invocation.
+    asyncio.set_event_loop(asyncio.new_event_loop())
+    return handler(event, context)  # type: ignore[reportArgumentType]

package/_skeletons/sibling-template/services/api/src/api/middleware/auth.py

@@ -0,0 +1,111 @@
+import json
+from dataclasses import dataclass
+from functools import lru_cache
+from typing import cast
+
+import httpx
+import jwt
+from aws_lambda_powertools import Logger
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+from fastapi import HTTPException, Security, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jwt import PyJWTError
+from jwt.algorithms import RSAAlgorithm
+
+from ..config import settings
+
+logger = Logger()
+_security = HTTPBearer()
+
+
+@dataclass(frozen=True)
+class AuthenticatedUser:
+    """Verified identity extracted from the core project's Cognito JWT."""
+
+    sub: str
+    email: str
+    username: str
+
+
+# Ported near-verbatim from the core project's services/api/src/api/middleware/auth.py
+# (ADR-0007) — this sibling's API Gateway already has its own Cognito JWT
+# authorizer (see modules/cloud/aws/api-gateway), so a request only reaches
+# this Lambda at all if a valid token was already presented. This second,
+# independent verification is deliberate defense in depth, not redundant:
+# it means the Lambda's own authorization logic never trusts API Gateway's
+# authorizer having run correctly, matching how the core API itself behaves.
+@lru_cache(maxsize=1)
+def _get_jwks(user_pool_id: str, region: str) -> dict:
+    """Fetch and cache JWKS. Cached per Lambda instance lifetime."""
+    if settings.cognito_jwks_json:
+        return json.loads(settings.cognito_jwks_json)  # type: ignore[no-any-return]
+    url = f"https://cognito-idp.{region}.amazonaws.com/{user_pool_id}/.well-known/jwks.json"
+    response = httpx.get(url, timeout=10)
+    response.raise_for_status()
+    return response.json()  # type: ignore[no-any-return]
+
+
+def _verify_token(token: str) -> dict:
+    try:
+        unverified_headers = jwt.get_unverified_header(token)
+    except PyJWTError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Malformed token",
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc
+
+    kid = unverified_headers.get("kid")
+    jwks = _get_jwks(settings.cognito_user_pool_id, settings.cognito_region)
+    signing_key = next((k for k in jwks["keys"] if k["kid"] == kid), None)
+
+    if signing_key is None and not settings.cognito_jwks_json:
+        # Unknown kid and we can fetch remotely — JWKS may have rotated;
+        # bust the cache and retry once.
+        _get_jwks.cache_clear()
+        jwks = _get_jwks(settings.cognito_user_pool_id, settings.cognito_region)
+        signing_key = next((k for k in jwks["keys"] if k["kid"] == kid), None)
+
+    if signing_key is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Unknown signing key",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    try:
+        # PyJWT needs a key object, not a raw JWK dict — convert the matched JWK.
+        # A Cognito JWKS only publishes public keys, so this is always public.
+        public_key = cast(RSAPublicKey, RSAAlgorithm.from_jwk(json.dumps(signing_key)))
+        claims: dict = jwt.decode(
+            token,
+            public_key,
+            algorithms=["RS256"],
+            audience=settings.cognito_client_id,
+        )
+    except PyJWTError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"Token invalid: {exc}",
+            headers={"WWW-Authenticate": "Bearer"},
+        ) from exc
+
+    return claims
+
+
+async def require_auth(
+    credentials: HTTPAuthorizationCredentials = Security(_security),
+) -> AuthenticatedUser:
+    """
+    FastAPI dependency that verifies the core project's Cognito JWT and
+    returns the caller's identity.
+
+    Raises HTTP 401 if the token is missing, expired, or invalid.
+    """
+    claims = _verify_token(credentials.credentials)
+
+    return AuthenticatedUser(
+        sub=claims["sub"],
+        email=claims.get("email", ""),
+        username=claims.get("cognito:username", claims.get("username", "")),
+    )

package/_skeletons/sibling-template/services/api/src/api/routers/whoami.py

@@ -0,0 +1,21 @@
+from fastapi import APIRouter, Depends
+
+from ..middleware.auth import AuthenticatedUser, require_auth
+
+router = APIRouter()
+
+
+@router.get("/whoami")
+async def whoami(caller: AuthenticatedUser = Depends(require_auth)) -> dict:
+    """
+    Proves the shared-Cognito-session SSO (ADR-0007) actually works: the
+    frontend calls this immediately after finding a session, and only
+    renders "Hello <username>" once this independently-verified response
+    comes back — never trusting a client-side JWT decode for display.
+    """
+    return {"username": caller.username or caller.email or caller.sub}
+
+
+@router.get("/health")
+async def health() -> dict:
+    return {"status": "ok"}

package/_skeletons/sibling-template/services/api/tests/conftest.py

@@ -0,0 +1,24 @@
+from collections.abc import Generator
+
+import pytest
+from fastapi.testclient import TestClient
+
+from api.main import app
+from api.middleware.auth import AuthenticatedUser, require_auth
+
+
+@pytest.fixture
+def authenticated_client() -> Generator[TestClient]:
+    app.dependency_overrides[require_auth] = lambda: AuthenticatedUser(
+        sub="abc-123",
+        email="a@example.com",
+        username="testuser",
+    )
+    client = TestClient(app)
+    yield client
+    app.dependency_overrides.pop(require_auth, None)
+
+
+@pytest.fixture
+def client() -> TestClient:
+    return TestClient(app)

package/_skeletons/sibling-template/services/api/tests/test_whoami.py

@@ -0,0 +1,21 @@
+from fastapi.testclient import TestClient
+
+
+def test_whoami_returns_username_for_authenticated_caller(authenticated_client: TestClient) -> None:
+    response = authenticated_client.get("/api/v1/whoami")
+
+    assert response.status_code == 200
+    assert response.json() == {"username": "testuser"}
+
+
+def test_whoami_rejects_unauthenticated_requests(client: TestClient) -> None:
+    response = client.get("/api/v1/whoami")
+
+    assert response.status_code == 401  # No Authorization header at all — HTTPBearer's own 401
+
+
+def test_health_requires_no_auth(client: TestClient) -> None:
+    response = client.get("/api/v1/health")
+
+    assert response.status_code == 200
+    assert response.json() == {"status": "ok"}