ApiLogicServer 14.3.14__py3-none-any.whl → 14.3.25__py3-none-any.whl

api_logic_server_cli/prototypes/manager/system/genai/examples/genai_demo/genai_demo_docs_logic/security/authentication_provider/sql/auth_provider.py

@@ -0,0 +1,127 @@
+from security.authentication_provider.abstract_authentication_provider import Abstract_Authentication_Provider
+import sqlalchemy as sqlalchemy
+import database.database_discovery.authentication_models as authentication_models
+from flask import Flask
+import safrs
+from safrs.errors import JsonapiError
+from dotmap import DotMap  # a dict, but you can say aDict.name instead of aDict['name']... like a row
+from sqlalchemy import inspect
+from http import HTTPStatus
+import logging
+
+
+# **********************
+# sql auth provider
+# **********************
+
+db = None
+session = None
+
+logger = logging.getLogger(__name__)
+
+class ALSError(JsonapiError):
+    
+    def __init__(self, message, status_code=HTTPStatus.BAD_REQUEST):
+        super().__init__()
+        self.message = message
+        self.status_code = status_code
+
+
+class DotMapX(DotMap):
+    """
+    A DotMap (provides for extended user-defined attributes)
+
+    Preserving dot notation - callers do use object.attr, *not* object['attr']
+
+    With check_password method
+
+    Args:
+        DotMap (_type_): _description_
+    """
+    def check_password(self, password=None):
+        logger.warning("Insecure check_password method, using insecure default, override this method for password verification!")
+        return password == self.password_hash
+
+
+class Authentication_Provider(Abstract_Authentication_Provider):
+
+    @staticmethod  #val - option for auth provider setup
+    def configure_auth(flask_app: Flask):
+        """ Called by authentication.py on server start, e.g., to 
+        - initialize jwt
+        - establish Flask end points for login.
+
+        Args:
+            flask_app (Flask): _description_
+            database (object): _description_
+            method_decorators (object): _description_
+        Returns:
+            _type_: (no return)
+        """
+        return
+
+ 
+    @staticmethod
+    def get_user(id: str, password: str = "") -> object:
+        """
+        Must return a DotMapX row or SQLAlchemy row, with attributes:        
+        * name
+        * role_list: a list of row objects with attribute name
+
+        Args:
+            id (str): _description_
+            password (str, optional): _description_. Defaults to "".
+
+        Returns:
+            object: row object is a SQLAlchemy row
+        """
+
+        def row_to_dotmap(row, row_class):
+            rtn_dotmap = DotMapX()
+            mapper = inspect(row_class)
+            for each_column in mapper.columns:
+                rtn_dotmap[each_column.name] = getattr(row, each_column.name)
+            return rtn_dotmap
+
+        global db, session
+        if db is None:
+            db = safrs.DB         # Use the safrs.DB for database access
+            session = db.session  # sqlalchemy.orm.scoping.scoped_session
+
+        try:
+            user = session.query(authentication_models.User).filter(authentication_models.User.id == id).one()
+        except Exception as e:
+            logger.info(f'*****\nauth_provider FAILED looking for: {id}\n*****\n')
+            logger.info(f'excp: {str(e)}\n')
+            # raise e
+            raise ALSError(f"User {id} is not authorized for this system")
+        use_db_row = False
+        if use_db_row:
+            return user
+        else:
+            pass
+            rtn_user = row_to_dotmap(user, authentication_models.User)
+            rtn_user.UserRoleList = []
+            user_roles = getattr(user, "UserRoleList")
+            for each_row in user_roles:
+                each_user_role = row_to_dotmap(each_row, authentication_models.UserRole)
+                rtn_user.UserRoleList.append(each_user_role)
+            return rtn_user  # returning user fails per caution above
+
+    @staticmethod
+    def check_password(user: object, password: str = "") -> bool:
+        """checks whether user-supplied password matches database
+
+        This hides implementation (eg, delegated or now) from authentication caller
+
+        Args:
+            user (object): DotMap or SQLAlchemy row containing id attribute
+            password (str, optional): password as entered by user. Defaults to "".
+
+        Returns:
+            bool: _description_
+        """
+        # return user.check_password(password = password)  : review
+        logger.warning("Checking plaintext password")
+        return password == user.password_hash
+

api_logic_server_cli/prototypes/manager/system/genai/examples/genai_demo/genai_demo_docs_logic/security/declare_security.py

@@ -0,0 +1,45 @@
+from security.system.authorization import Grant, Security, Security, DefaultRolePermission, GlobalFilter
+import logging
+from database import models
+import safrs
+
+db = safrs.DB
+session = db.session
+
+app_logger = logging.getLogger(__name__)
+
+declare_security_message = "No Grants Yet"  # printed in api_logic_server.py
+
+"""
+First, Activate Security: https://apilogicserver.github.io/Docs/Security-Activation/
+
+Then, Declare Security here: https://apilogicserver.github.io/Docs/Security-Authorization/
+
+See documentation: https://apilogicserver.github.io/Docs/Security-Overview/
+
+Security is invoked on server start (api_logic_server_run), per activation in `config.py`
+
+Your Code Goes Here - alter the starter code below to suit your needs
+"""
+
+class Roles():
+    """ For code completion (auth data is the source of truth) 
+    
+    Revise these for your app's roles"""
+    manager = "manager"
+    teller = "teller"
+    tenant = "tenant"
+    customer = "customer"
+    read_only = "readonly"
+    admin = "CS_ADMIN"
+    public="public"             # p1/p (no roles, but gets public)
+    sa="sa"
+    
+DefaultRolePermission(to_role=Roles.sa, can_read=True, can_update=True, can_insert=True, can_delete=True)
+DefaultRolePermission(to_role=Roles.tenant, can_read=True, can_delete=True)
+DefaultRolePermission(to_role=Roles.admin, can_read=True, can_insert=True,can_update=True, can_delete=True)
+DefaultRolePermission(to_role=Roles.manager, can_read=True, can_insert=True,can_update=True, can_delete=False)
+DefaultRolePermission(to_role=Roles.teller, can_read=True, can_insert=True,can_update=True, can_delete=False)
+DefaultRolePermission(to_role=Roles.customer, can_read=True, can_insert=True,can_update=True, can_delete=False)
+DefaultRolePermission(to_role=Roles.read_only, can_read=True, can_insert=False,can_update=False, can_delete=False)
+DefaultRolePermission(to_role=Roles.public, can_read=True, can_insert=False,can_update=False, can_delete=False)

api_logic_server_cli/prototypes/manager/system/genai/examples/genai_demo/genai_demo_docs_logic/security/system/authentication.py

@@ -0,0 +1,129 @@
+"""
+System support for login / authentication.
+
+Applications POST to login to obtain an access token,
+which they provide in the header of subsequent requests.
+
+e.g. 
+def login():
+    post_uri = 'http://localhost:5656/auth/login'
+    post_data = {"username": "_user_","password": "_password_"}
+    r = requests.post(url=post_uri, json = post_data)
+    response_text = r.text
+    status_code = r.status_code
+    if status_code > 300:
+        raise Exception(f'POST login failed with {r.text}')
+    result_data = json.loads(response_text)
+    result_map = DotMap(result_data)
+    token = result_map.access_token
+    header = {'Authorization': 'Bearer {}'.format(f'{token}')}
+    return header
+"""
+
+import logging, sys
+from flask import Flask
+from flask import jsonify, request
+from flask_jwt_extended import JWTManager
+from flask_jwt_extended import jwt_required as jwt_required_ori
+from flask_jwt_extended import create_access_token
+from datetime import timedelta
+from functools import wraps
+import config.config as config
+from config.config import Args
+from security.authentication_provider.abstract_authentication_provider import Abstract_Authentication_Provider
+from flask_cors import CORS, cross_origin
+
+authentication_provider : Abstract_Authentication_Provider = config.Config.SECURITY_PROVIDER  # type: ignore
+# note: direct config access is disparaged, but used since args not set up when this imported
+
+security_logger = logging.getLogger(__name__)
+
+JWT_EXCLUDE = 'jwt_exclude'
+
+def jwt_required(*args, **kwargs):
+    from flask import request
+    _jwt_required_ori = jwt_required_ori(*args, **kwargs)
+    def _wrapper(fn):
+        if request.endpoint == 'api.authentication-User.login':
+            return fn
+        return _jwt_required_ori(fn)
+    return _wrapper
+
+
+def configure_auth(flask_app: Flask, database: object, method_decorators: list[object]):
+    """
+    Called on server start by api_logic_server_run to 
+    - initialize jwt
+    - establish Flask end points for login.
+
+    Args:
+        flask_app (Flask): _description_
+        database (object): _description_
+        method_decorators (object): _description_
+    Returns:
+        _type_: (no return)
+    """
+    from config.config import Config
+
+    
+    flask_app.config["PROPAGATE_EXCEPTIONS"] = True
+    flask_app.config["JWT_SECRET_KEY"] = "ApiLogicServerSecret"  # Change this!
+    flask_app.config["JWT_ACCESS_TOKEN_EXPIRES"] = timedelta(minutes=222)  #  change as you see fit
+    flask_app.config["JWT_REFRESH_TOKEN_EXPIRES"] = timedelta(days=30)
+
+    Config.SECURITY_PROVIDER.configure_auth(flask_app=flask_app)   # type-specific configuration
+
+    jwt = JWTManager(flask_app)
+    
+    @flask_app.route("/ontimizeweb/services/rest/auth/login", methods=["POST","OPTIONS"])
+    @flask_app.route("/ontimizeweb/services/rest/users/login", methods=["POST","OPTIONS"])
+    @flask_app.route("/api/auth/login", methods=["POST"])
+    @cross_origin(supports_credentials=False)
+    def login():
+        """
+        Post id/password, returns token to be placed in header of subsequent requests.
+        curl -X POST http://apilogicserver:5655/api/auth/login -d '{"username":"admin","password":"p"}'
+        Returns:
+            string: access token
+        """
+        if request.method == 'OPTIONS':
+            return jsonify(success=True)    
+        try:   
+            username = request.json.get("username", None)
+            password = request.json.get("password", None)
+        except:
+            username = ''
+            password = ''
+            auth = request.headers.get("Authorization", None)
+            if auth and auth.startswith("Basic"):  # support basic auth
+                import base64
+                base64_message = auth[6:]
+                print(f"auth found: {auth}")
+                #base64_message = 'UHl0aG9uIGlzIGZ1bg=='
+                base64_bytes = base64_message.encode('ascii')
+                message_bytes = base64.b64decode(base64_bytes)
+                message = message_bytes.decode('ascii')
+                s = message.split(":")
+                username = s[0]
+                password = s[1]
+
+        user = authentication_provider.get_user(username, password)
+        if not user or not authentication_provider.check_password(user = user, password = password):
+            return jsonify("Wrong username or password"), 401
+        
+        access_token = create_access_token(identity=user)  # serialize and encode
+        from flask import g
+        g.access_token = access_token
+        return jsonify(access_token=access_token)
+    
+    @jwt.user_identity_loader
+    def user_identity_lookup(user):
+        return user.id
+
+    @jwt.user_lookup_loader
+    def user_lookup_callback(_jwt_header, jwt_data):
+        identity = jwt_data["sub"]
+        return authentication_provider.get_user(identity, jwt_data)
+
+    method_decorators.append(jwt_required())
+    security_logger.info("\nAuthentication loaded -- api calls now require authorization header")