10xgraph-api 0.7.0__py3-none-any.whl

tenxgraph_api/src/app/core/middleware/security_headers.py

@@ -0,0 +1,239 @@
+"""
+Security Headers Middleware
+
+This middleware adds standard security headers to HTTP responses to protect
+against common web vulnerabilities.
+
+Headers Added:
+- X-Content-Type-Options: Prevents MIME-type sniffing
+- X-Frame-Options: Prevents clickjacking attacks
+- X-XSS-Protection: Enables XSS filtering (legacy browsers)
+- Strict-Transport-Security: Enforces HTTPS (if HTTPS is detected)
+- Content-Security-Policy: Controls resource loading
+- Referrer-Policy: Controls referrer information
+- Permissions-Policy: Controls browser features
+
+Configuration:
+Configure via environment variables or settings:
+- SECURITY_HEADERS_ENABLED: Enable/disable middleware (default: true)
+- HSTS_MAX_AGE: HSTS max-age in seconds (default: 31536000 = 1 year)
+- CSP_POLICY: Custom CSP policy (default: strict policy)
+"""
+
+from collections.abc import Callable
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """
+    Middleware to add security headers to responses.
+
+    This middleware enhances security by adding standard security headers
+    that protect against common web vulnerabilities.
+    """
+
+    def __init__(  # noqa: PLR0913
+        self,
+        app,
+        enable_hsts: bool = True,
+        hsts_max_age: int = 31536000,  # 1 year
+        hsts_include_subdomains: bool = True,
+        hsts_preload: bool = False,
+        frame_options: str = "DENY",
+        content_type_options: str = "nosniff",
+        xss_protection: str = "1; mode=block",
+        referrer_policy: str = "strict-origin-when-cross-origin",
+        permissions_policy: str | None = None,
+        csp_policy: str | None = None,
+    ):
+        """
+        Initialize security headers middleware.
+
+        Args:
+            app: ASGI application
+            enable_hsts: Enable Strict-Transport-Security header
+            hsts_max_age: HSTS max-age in seconds (default: 1 year)
+            hsts_include_subdomains: Include subdomains in HSTS
+            hsts_preload: Enable HSTS preload
+            frame_options: X-Frame-Options value (DENY, SAMEORIGIN, or ALLOW-FROM)
+            content_type_options: X-Content-Type-Options value
+            xss_protection: X-XSS-Protection value
+            referrer_policy: Referrer-Policy value
+            permissions_policy: Permissions-Policy value (optional)
+            csp_policy: Content-Security-Policy value (optional)
+        """
+        super().__init__(app)
+        self.enable_hsts = enable_hsts
+        self.hsts_max_age = hsts_max_age
+        self.hsts_include_subdomains = hsts_include_subdomains
+        self.hsts_preload = hsts_preload
+        self.frame_options = frame_options
+        self.content_type_options = content_type_options
+        self.xss_protection = xss_protection
+        self.referrer_policy = referrer_policy
+        self.permissions_policy = permissions_policy or self._default_permissions_policy()
+        self.csp_policy = csp_policy or self._default_csp_policy()
+
+    def _default_permissions_policy(self) -> str:
+        """
+        Get default Permissions-Policy header value.
+
+        Returns:
+            Default permissions policy string
+        """
+        return (
+            "geolocation=(), microphone=(), camera=(), payment=(), usb=(), "
+            "magnetometer=(), gyroscope=(), accelerometer=()"
+        )
+
+    def _default_csp_policy(self) -> str:
+        """
+        Get default Content-Security-Policy header value.
+
+        Returns:
+            Default CSP policy string
+        """
+        return (
+            "default-src 'self'; "
+            "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://unpkg.com; "
+            "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com;"
+            "img-src 'self' data: https:; "
+            "font-src 'self' data: https://fonts.gstatic.com; "
+            "connect-src 'self'; "
+            "frame-ancestors 'none'; "
+            "base-uri 'self'; "
+            "form-action 'self'"
+        )
+
+    def _build_hsts_header(self) -> str:
+        """
+        Build HSTS header value.
+
+        Returns:
+            HSTS header string
+        """
+        hsts_parts = [f"max-age={self.hsts_max_age}"]
+
+        if self.hsts_include_subdomains:
+            hsts_parts.append("includeSubDomains")
+
+        if self.hsts_preload:
+            hsts_parts.append("preload")
+
+        return "; ".join(hsts_parts)
+
+    def _is_https(self, request: Request) -> bool:
+        """
+        Check if request is using HTTPS.
+
+        Checks both the request scheme and X-Forwarded-Proto header
+        (for proxied requests).
+
+        Args:
+            request: Starlette request object
+
+        Returns:
+            True if HTTPS, False otherwise
+        """
+        # Check request scheme
+        if request.url.scheme == "https":
+            return True
+
+        # Check X-Forwarded-Proto header (for proxied requests)
+        forwarded_proto = request.headers.get("X-Forwarded-Proto", "")
+        return forwarded_proto.lower() == "https"
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        """
+        Process request and add security headers to response.
+
+        Args:
+            request: Incoming request
+            call_next: Next middleware/handler
+
+        Returns:
+            Response with security headers
+        """
+        # Process request
+        response = await call_next(request)
+
+        # Add X-Content-Type-Options header
+        response.headers["X-Content-Type-Options"] = self.content_type_options
+
+        # Add X-Frame-Options header
+        response.headers["X-Frame-Options"] = self.frame_options
+
+        # Add X-XSS-Protection header (for legacy browser support)
+        response.headers["X-XSS-Protection"] = self.xss_protection
+
+        # Add Referrer-Policy header
+        response.headers["Referrer-Policy"] = self.referrer_policy
+
+        # Add Permissions-Policy header
+        if self.permissions_policy:
+            response.headers["Permissions-Policy"] = self.permissions_policy
+
+        # Add Content-Security-Policy header
+        if self.csp_policy:
+            response.headers["Content-Security-Policy"] = self.csp_policy
+
+        # Add Strict-Transport-Security header (only for HTTPS)
+        if self.enable_hsts and self._is_https(request):
+            response.headers["Strict-Transport-Security"] = self._build_hsts_header()
+
+        return response
+
+
+def create_security_headers_middleware(
+    enable_hsts: bool = True,
+    hsts_max_age: int = 31536000,
+    hsts_include_subdomains: bool = True,
+    hsts_preload: bool = False,
+    frame_options: str = "DENY",
+    content_type_options: str = "nosniff",
+    xss_protection: str = "1; mode=block",
+    referrer_policy: str = "strict-origin-when-cross-origin",
+    permissions_policy: str | None = None,
+    csp_policy: str | None = None,
+) -> type[SecurityHeadersMiddleware]:
+    """
+    Factory function to create SecurityHeadersMiddleware with configuration.
+
+    This is a convenience function for creating middleware with custom settings.
+
+    Args:
+        enable_hsts: Enable HSTS header
+        hsts_max_age: HSTS max-age in seconds
+        hsts_include_subdomains: Include subdomains in HSTS
+        hsts_preload: Enable HSTS preload
+        frame_options: X-Frame-Options value
+        content_type_options: X-Content-Type-Options value
+        xss_protection: X-XSS-Protection value
+        referrer_policy: Referrer-Policy value
+        permissions_policy: Permissions-Policy value
+        csp_policy: Content-Security-Policy value
+
+    Returns:
+        Configured SecurityHeadersMiddleware class
+    """
+
+    class ConfiguredSecurityHeadersMiddleware(SecurityHeadersMiddleware):
+        def __init__(self, app):
+            super().__init__(
+                app,
+                enable_hsts=enable_hsts,
+                hsts_max_age=hsts_max_age,
+                hsts_include_subdomains=hsts_include_subdomains,
+                hsts_preload=hsts_preload,
+                frame_options=frame_options,
+                content_type_options=content_type_options,
+                xss_protection=xss_protection,
+                referrer_policy=referrer_policy,
+                permissions_policy=permissions_policy,
+                csp_policy=csp_policy,
+            )
+
+    return ConfiguredSecurityHeadersMiddleware

tenxgraph_api/src/app/core/utils/__init__.py

@@ -0,0 +1,14 @@
+"""Core utilities for 10xGraph CLI."""
+
+from tenxgraph_api.src.app.core.utils.log_sanitizer import (
+    SanitizingFormatter,
+    sanitize_for_logging,
+    sanitize_log_message,
+)
+
+
+__all__ = [
+    "sanitize_for_logging",
+    "sanitize_log_message",
+    "SanitizingFormatter",
+]

tenxgraph_api/src/app/core/utils/log_sanitizer.py

@@ -0,0 +1,216 @@
+"""
+Log sanitization utilities for 10xGraph CLI.
+
+This module provides utilities to sanitize sensitive data before logging,
+preventing tokens, passwords, and other credentials from appearing in logs.
+"""
+
+import logging
+import re
+from typing import Any
+
+
+# Patterns for detecting sensitive field names
+SENSITIVE_PATTERNS = {
+    "token",
+    "password",
+    "secret",
+    "key",
+    "credential",
+    "authorization",
+    "api_key",
+    "access_token",
+    "refresh_token",
+    "auth",
+    "bearer",
+    "jwt",
+    "session",
+    "cookie",
+    "private_key",
+    "passphrase",
+    "pin",
+    "ssn",
+    "credit_card",
+}
+
+# Regex pattern to detect JWT tokens (three base64url parts separated by dots)
+JWT_PATTERN = re.compile(r"^[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*$")
+
+# Regex pattern to detect bearer tokens
+BEARER_PATTERN = re.compile(r"^Bearer\s+[A-Za-z0-9\-_.~+/]+=*$", re.IGNORECASE)
+
+# Tokens embedded anywhere in a message (f-string logs carry no args to sanitize).
+_INLINE_SECRET_PATTERNS = (
+    (re.compile(r"Bearer\s+[A-Za-z0-9\-_.~+/]+=*", re.IGNORECASE), "Bearer ***REDACTED***"),
+    (re.compile(r"\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]*"), "***JWT_TOKEN***"),
+)
+
+
+def redact_text(text: str) -> str:
+    """Redact bearer tokens and JWTs that appear anywhere inside ``text``."""
+    for pattern, replacement in _INLINE_SECRET_PATTERNS:
+        text = pattern.sub(replacement, text)
+    return text
+
+
+def sanitize_for_logging(data: Any, max_depth: int = 10, _current_depth: int = 0) -> Any:
+    """
+    Recursively sanitize sensitive data for safe logging.
+
+    This function walks through data structures and replaces sensitive values
+    with redaction markers. It detects:
+    - Dictionary keys containing sensitive patterns
+    - JWT tokens (by structure)
+    - Bearer tokens
+    - Authorization headers
+
+    Args:
+        data: The data to sanitize (dict, list, str, or any other type)
+        max_depth: Maximum recursion depth to prevent infinite loops
+        _current_depth: Internal parameter tracking current recursion depth
+
+    Returns:
+        Sanitized copy of the data with sensitive values redacted
+
+    Examples:
+        >>> sanitize_for_logging({"user_id": "123", "token": "abc123"})
+        {'user_id': '123', 'token': '***REDACTED***'}
+
+        >>> sanitize_for_logging({"Authorization": "Bearer eyJhbGc..."})
+        {'Authorization': '***REDACTED***'}
+    """
+    # Prevent excessive recursion
+    if _current_depth >= max_depth:
+        return "***MAX_DEPTH_REACHED***"
+
+    if isinstance(data, dict):
+        return {k: _sanitize_value(k, v, max_depth, _current_depth + 1) for k, v in data.items()}
+    if isinstance(data, list):
+        return [sanitize_for_logging(item, max_depth, _current_depth + 1) for item in data]
+    if isinstance(data, tuple):
+        return tuple(sanitize_for_logging(item, max_depth, _current_depth + 1) for item in data)
+    if isinstance(data, str):
+        return _sanitize_string(data)
+    return data
+
+
+def _sanitize_value(key: str, value: Any, max_depth: int, current_depth: int) -> Any:
+    """
+    Sanitize a value based on its key name and content.
+
+    Args:
+        key: The dictionary key
+        value: The value to sanitize
+        max_depth: Maximum recursion depth
+        current_depth: Current recursion depth
+
+    Returns:
+        Sanitized value
+    """
+    # Check if key name contains sensitive patterns
+    key_lower = key.lower()
+    if any(pattern in key_lower for pattern in SENSITIVE_PATTERNS):
+        return "***REDACTED***"
+
+    # Recursively sanitize the value
+    return sanitize_for_logging(value, max_depth, current_depth)
+
+
+def _sanitize_string(value: str) -> str:
+    """
+    Sanitize a string value if it appears to be sensitive.
+
+    Args:
+        value: String to check and potentially sanitize
+
+    Returns:
+        Original string or redaction marker
+    """
+    max_value = 32
+    # Check for JWT token pattern
+    if len(value) > max_value and JWT_PATTERN.match(value):
+        return "***JWT_TOKEN***"
+
+    # Check for Bearer token pattern
+    if BEARER_PATTERN.match(value):
+        return "***BEARER_TOKEN***"
+
+    # Check if string looks like a long random token (>32 chars, alphanumeric)
+    if len(value) > max_value and value.replace("-", "").replace("_", "").isalnum():
+        # Could be an API key or token
+        return f"{value[:4]}...{value[-4:]}"
+
+    return value
+
+
+def sanitize_log_message(message: str, *args: Any, **kwargs: Any) -> tuple[str, tuple, dict]:
+    """
+    Sanitize log message arguments.
+
+    This is useful for sanitizing arguments passed to logger.debug(), logger.info(), etc.
+
+    Args:
+        message: Log message format string
+        *args: Positional arguments for the log message
+        **kwargs: Keyword arguments for the log message
+
+    Returns:
+        Tuple of (message, sanitized_args, sanitized_kwargs)
+
+    Examples:
+        >>> msg, args, kwargs = sanitize_log_message(
+        ...     "User %s logged in", {"user_id": "123", "token": "secret"}
+        ... )
+        >>> # args will have sanitized data
+    """
+    sanitized_args = tuple(sanitize_for_logging(arg) for arg in args)
+    sanitized_kwargs = {k: sanitize_for_logging(v) for k, v in kwargs.items()}
+    return message, sanitized_args, sanitized_kwargs
+
+
+class SanitizingFormatter(logging.Formatter):
+    """
+    A wrapper for log formatters that sanitizes sensitive data.
+
+    This can be used to wrap existing formatters to add sanitization. It is a
+    proper ``logging.Formatter`` subclass so it can be passed to
+    ``Handler.setFormatter`` without type errors, while delegating the actual
+    formatting to the wrapped base formatter.
+
+    Example:
+        import logging
+
+        formatter = logging.Formatter('%(asctime)s - %(message)s')
+        sanitizing_formatter = SanitizingFormatter(formatter)
+        handler.setFormatter(sanitizing_formatter)
+    """
+
+    def __init__(self, base_formatter: logging.Formatter) -> None:
+        """
+        Initialize the sanitizing formatter.
+
+        Args:
+            base_formatter: The underlying formatter to wrap
+        """
+        super().__init__()
+        self.base_formatter = base_formatter
+
+    def format(self, record: logging.LogRecord) -> str:
+        """
+        Format the log record with sanitization.
+
+        Args:
+            record: LogRecord to format
+
+        Returns:
+            Formatted and sanitized log string
+        """
+        # Sanitize the message arguments
+        if isinstance(record.args, tuple) and record.args:
+            record.args = tuple(sanitize_for_logging(arg) for arg in record.args)
+        elif isinstance(record.args, dict):
+            record.args = sanitize_for_logging(record.args)
+
+        # Format using the base formatter, then catch tokens already baked into the text
+        # (f-string messages, exception text, tracebacks).
+        return redact_text(self.base_formatter.format(record))