Encryptors 2.34__tar.gz → 2.36__tar.gz

{encryptors-2.34 → encryptors-2.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.34
+Version: 2.36
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai

{encryptors-2.34 → encryptors-2.36}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
  
 setup(
     name="Encryptors", 
-    version="2.34",
+    version="2.36",
     author="OSDental LLC",
     author_email="support@osdental.ai",
     description="End-to-end algorithm library",

{encryptors-2.34 → encryptors-2.36}/src/Encryptors.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.34
+Version: 2.36
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai

{encryptors-2.34 → encryptors-2.36}/src/Encryptors.egg-info/SOURCES.txt

@@ -28,6 +28,7 @@ src/Osdental/Exception/__init__.py
 src/Osdental/Graphql/__init__.py
 src/Osdental/Graphql/Extensions/AuditExtension.py
 src/Osdental/Graphql/Extensions/__init__.py
+src/Osdental/Graphql/Models/__init__.py
 src/Osdental/Graphql/_Exceptions/__init__.py
 src/Osdental/Graphql/_Helpers/_AuditHelper.py
 src/Osdental/Graphql/_Helpers/_ExtractAuthToken.py

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Decorators/SecureResolver.py

@@ -2,15 +2,13 @@ import inspect
 import copy
 from functools import wraps
 from typing import Callable, Dict, Any
-from graphql import GraphQLResolveInfo
 from Osdental.Models.Token import AuthToken
 from Osdental.Models.Response import Response
 from Osdental.Shared.Enums.Profile import Profile
-from Osdental.Exception.ControlledException import OSDException
+from Osdental.Exception.ControlledException import OSDException, AccessDeniedException
 from Osdental.Encryptor.Aes import AES
+from Osdental.Graphql.Models import BaseGraphQLContext
 
-
-aes = AES()
 def secure_resolver(action = None):
     def decorator(func: Callable):
 
@@ -18,25 +16,25 @@ def secure_resolver(action = None):
         accepts_data = "data" in signature.parameters
 
         @wraps(func)
-        async def wrapper(obj: Any, info: GraphQLResolveInfo, **kwargs: Dict):
+        async def wrapper(obj: Any, context: BaseGraphQLContext, **kwargs: Dict[str, Any]):
             try:
-                token: AuthToken = info.context.token
-                payload = getattr(info.context, "decrypted_payload", None)
-                aes_key = getattr(info.context, "aes_key", None)
+                token: AuthToken = context.token
+                payload = getattr(context, "decrypted_payload", None)
+                aes_auth = getattr(context, "aes_auth", None)
 
                 if action:
                     if Profile(token.abbreviation) not in action.allowed_roles:
-                        raise OSDException("DB_ERROR_AUTH", "You are not authorized to perform this action.")
+                        raise AccessDeniedException(error="The user's profile is not allowed to perform this action.")
 
                 if accepts_data and payload:
                     kwargs["data"] = payload
 
-                result: Response = await func(obj, info, **kwargs)
+                result: Response = await func(obj, context, **kwargs)
 
-                info.context.audit_plain_response = copy.deepcopy(result)
+                context.audit_plain_response = copy.deepcopy(result)
 
                 if result.data is not None:
-                    result.data = aes.encrypt(aes_key, result.data)
+                    result.data = AES.encrypt(aes_auth, result.data)
 
                 return result.send()
 
@@ -46,7 +44,7 @@ def secure_resolver(action = None):
                     message=getattr(e, "message", "Could not process request."),
                     error=f"{type(e).__name__}: {str(e)}"
                 )
-                info.context.audit_plain_response = result
+                context.audit_plain_response = result
                 return result.send()
 
         return wrapper

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Encryptor/Aes.py

@@ -10,9 +10,8 @@ from Osdental.Shared.Enums.Constant import Constant
 
 class AES:
 
-    def __init__(self):
-        self.IV_LENGTH = 32
-        self.TAG_LENGTH = 16
+    IV_LENGTH = 32
+    TAG_LENGTH = 16
 
     @staticmethod
     def generate_key() -> str:
@@ -20,7 +19,8 @@ class AES:
         key = os.urandom(32)
         return base64.b64encode(key).decode(Constant.DEFAULT_ENCODING)
     
-    def encrypt(self, aes_key:str, data:Dict[str,str] | str | List[Dict[str,str]]) -> str:
+    @classmethod
+    def encrypt(cls, aes_key:str, data:Dict[str,str] | str | List[Dict[str,str]]) -> str:
         """
         Encrypts data using AES-GCM.
         Supports dictionary, string, or list inputs.
@@ -34,7 +34,7 @@ class AES:
 
         try:
             key = base64.b64decode(aes_key)
-            iv = os.urandom(self.IV_LENGTH)
+            iv = os.urandom(cls.IV_LENGTH)
             if isinstance(data, (dict, list)):
                 json_data = json.dumps(data)
             else:
@@ -52,8 +52,8 @@ class AES:
             logger.error(f'Unexpected AES encryption error: {str(e)}')
             raise AESEncryptException(error=str(e))
  
-
-    def decrypt(self, aes_key:str, encrypted_data:str, silent:bool = False):
+    @classmethod
+    def decrypt(cls, aes_key:str, encrypted_data:str, silent:bool = False):
         """
         Decrypts data using AES-GCM.
         Expects encrypted data to represent either a JSON object (dict) or a plain string.
@@ -65,9 +65,9 @@ class AES:
         try:
             key = base64.b64decode(aes_key)
             encrypted_data = base64.b64decode(encrypted_data)
-            iv = encrypted_data[:self.IV_LENGTH]
-            tag = encrypted_data[-self.TAG_LENGTH:]
-            ciphertext = encrypted_data[self.IV_LENGTH:-self.TAG_LENGTH]
+            iv = encrypted_data[:cls.IV_LENGTH]
+            tag = encrypted_data[-cls.TAG_LENGTH:]
+            ciphertext = encrypted_data[cls.IV_LENGTH:-cls.TAG_LENGTH]
             cipher = Cipher(algorithms.AES(key), modes.GCM(iv, tag))
             decryptor = cipher.decryptor()
             plaintext = decryptor.update(ciphertext) + decryptor.finalize()

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Exception/ControlledException.py

@@ -24,6 +24,15 @@ class UnauthorizedException(OSDException):
     ):
         super().__init__(message=message, error=error, status_code=status_code)
 
+class AccessDeniedException(OSDException):
+    def __init__(
+        self, 
+        message: str = Message.ACCESS_DENIED_MSG, 
+        error: str = None, 
+        status_code: str = Code.INVALID_REQUEST_PARAMS_CODE
+    ):
+        super().__init__(message=message, error=error, status_code=status_code)
+
 class RequestDataException(OSDException):
     def __init__(
         self, 

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Graphql/Extensions/AuditExtension.py

@@ -3,36 +3,54 @@ from graphql.pyutils import is_awaitable
 from ariadne.types import Extension
 from Osdental.Encryptor.Aes import AES
 from Osdental.Graphql._Helpers._TenantPolicy import TenantPolicy
+from Osdental.Rest.Context.RequestContext import (
+    current_context,
+    RequestContext
+)
+from Osdental.Graphql.Models import BaseGraphQLContext
 from Osdental.Graphql._Exceptions import AESKeyNotFound
 from Osdental.Shared.Enums.Constant import Constant
 
 class AuditExtension(Extension):
 
     def request_started(self, context):
+        request = context.request
+        self._ctx_token = current_context.set(
+            RequestContext(
+                request=request,
+                request_id=request.headers.get("x-request-id"),
+                user=None
+            )
+        )
+
         self.errors = None
         self.request_payload = None
         self.result = None
-        self.aes = AES()
 
     async def resolve(self, next_, root, info, **kwargs):
 
         if not self.request_payload:
-            context = info.context
+            context: BaseGraphQLContext = info.context
 
-            request = info.context.request
+            request = context.request
             self.request = request
 
-            body = request.state.graphql_body
+            body = await request.json()
+            headers = request.headers
 
             container = context.container
-
             token_service = container.token_service
 
-            aes_key = request.app.state.aes_auth
-            if not aes_key:
-                raise AESKeyNotFound("Could not find authorization key Aes.")
+            aes_auth = request.app.state.aes_auth
+            aes_user = request.app.state.aes_user
+
+            if not aes_auth:
+                raise AESKeyNotFound("AES user key is missing.", "aes_auth")
+            
+            if not aes_user:
+                raise AESKeyNotFound("AES authorization key is missing.", "aes_user")
 
-            original_token = await token_service.authenticate(request)
+            original_token = await token_service.authenticate(headers, aes_user)
             
             variables = body.get("variables") or {}
             encrypted_payload = variables.get("data")
@@ -41,7 +59,7 @@ class AuditExtension(Extension):
 
             if encrypted_payload:
                 try:
-                    decrypted_payload = self.aes.decrypt(aes_key, encrypted_payload)
+                    decrypted_payload = AES.decrypt(aes_auth, encrypted_payload)
 
                     try:
                         decrypted_payload = json.loads(decrypted_payload)
@@ -68,7 +86,7 @@ class AuditExtension(Extension):
 
             context.decrypted_payload = decrypted_payload
             context.token = token
-            context.aes_key = aes_key
+            context.aes_auth = aes_auth
 
         result = next_(root, info, **kwargs)
 

encryptors-2.36/src/Osdental/Graphql/Models/__init__.py

@@ -0,0 +1,14 @@
+from dataclasses import dataclass
+from typing import Optional, Any
+from fastapi import Request
+from Osdental.Models.Token import AuthToken
+
+@dataclass
+class BaseGraphQLContext:
+    request: Request
+    container: Any
+    # valores agregados durante ejecución (AuditExtention)
+    token: Optional[AuthToken] = None
+    decrypted_payload: Optional[dict] = None
+    aes_auth: Optional[str] = None
+    audit_plain_response: Optional[Any] = None

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Graphql/_Exceptions/__init__.py

@@ -3,6 +3,6 @@ from Osdental.Exception.ControlledException import OSDException
 class AESKeyNotFound(OSDException):
     def __init__(
         self, 
-        error: str = None,
+        error: str = None
     ):
         super().__init__(error=error)

encryptors-2.36/src/Osdental/Graphql/_Helpers/_ExtractAuthToken.py

@@ -0,0 +1,11 @@
+from starlette.datastructures import Headers
+
+class ExtractAuthToken:
+
+    @staticmethod
+    def get_auth_token(headers: Headers) -> str:
+        authorization = headers.get("authorization")
+        if not authorization or not authorization.startswith("Bearer "):
+            raise ValueError("Missing Bearer token")
+        
+        return authorization.split(" ")[1]

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Graphql/_Helpers/_TenantPolicy.py

@@ -14,13 +14,16 @@ class TenantPolicy:
         decrypted_payload: Dict[str, Any], 
         operation_type: str
     ) -> AuthToken:
-        aes = AES()
-        # Solo aplicamos cambios si es QUERY
-        if operation_type != OperationType.QUERY.value:
-            return token  # devolver token tal cual
 
+        # Set original idExternalEnterprise
+        token.base_id_external_enterprise = token.id_external_enterprise
         # SUPER ADMIN / OSDEL ADMIN -> UUID 0
-        if token.abbreviation.startswith(("SPAU", "OSDA")):
+        should_use_zero_uuid = (
+            token.abbreviation.startswith(("SPAU", "OSDA")) 
+            and operation_type == OperationType.QUERY
+        )
+
+        if should_use_zero_uuid:
             token.id_external_enterprise = str(UUID(int=0))
             return token
 
@@ -28,13 +31,13 @@ class TenantPolicy:
         if token.abbreviation.startswith("OSDMK"):
             dynamic_client_id = headers.get("dynamicClientId")
             if dynamic_client_id:
-                decrypted_mk_id = aes.decrypt(token.aes_key_auth, dynamic_client_id)
+                decrypted_mk_id = AES.decrypt(token.aes_key_auth, dynamic_client_id)
                 token.id_external_enterprise = decrypted_mk_id
                 token.mk_id_external_enterprise = decrypted_mk_id
                 return token
 
         # If it comes by request, it is taken as priority
-        external_enterprise_req = decrypted_payload.get('idExternalEnterprise')
+        external_enterprise_req = decrypted_payload.get("idExternalEnterprise")
         if external_enterprise_req and token:
             token.id_external_enterprise = external_enterprise_req
 

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Graphql/_Helpers/_TokenService.py

@@ -1,4 +1,4 @@
-from fastapi import Request
+from starlette.datastructures import Headers
 from Osdental.Encryptor.Aes import AES
 from Osdental.Encryptor.Jwt import JWT
 from Osdental.Models.Token import AuthToken
@@ -9,23 +9,20 @@ class TokenService:
     def __init__(self, jwt_user_key: str, auth_validator):
         self.jwt_user_key = jwt_user_key
         self.auth_validator = auth_validator
-        self.aes = AES()
 
-    async def authenticate(self, request: Request) -> AuthToken:
-        encrypted_token = ExtractAuthToken.get_auth_token(request)
+    async def authenticate(self, headers: Headers, aes_user: str) -> AuthToken:
+        encrypted_token = ExtractAuthToken.get_auth_token(headers)
 
-        aes_user = request.app.state.aes_user
-
-        user_token = self.aes.decrypt(aes_user, encrypted_token)
+        user_token = AES.decrypt(aes_user, encrypted_token)
         payload = JWT.extract_payload(user_token, self.jwt_user_key)
         token = AuthToken(**payload)
 
         # Validate via RPC
-        request = {
+        paylod = {
             'idToken': token.id_token,
             'idUser': token.id_user
         }
-        is_valid = await self.auth_validator.validate_auth_token(request)
+        is_valid = await self.auth_validator.validate_auth_token(paylod)
         if not is_valid:
             raise ValueError("You are not authorized to access this portal.")
 

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Helpers/AuditDispatcher.py

@@ -87,7 +87,7 @@ class AuditDispatcher:
             request=request,
             audit_config=self._audit_config,
             operation_name=operation_name,
-            full_name=request_payload.get("user"),
+            full_name=request_payload.get("user", "Joe Doe"),
             payload=request_payload.get("variables")
         )
         request_audit_payload = await AuditHelper.build_request_payload(audit=audit)

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Http/APIClient.py

@@ -37,9 +37,11 @@ class APIClient:
                 **kwargs
             )
 
-            request = current_context.get()
+            ctx = current_context.get()
+
+            if ctx and ctx.request:
+                request = ctx.request
 
-            if request:
                 dispatcher = request.app.state.audit_dispatcher
                 dispatcher.dispatch(
                     request=request,

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Models/Token.py

@@ -18,8 +18,6 @@ class AuthToken(BaseModel):
     access_token: Optional[str] = Field(default=None, alias="accessToken")
     base_id_external_enterprise: Optional[str] = Field(default=None, alias="baseIdExternalEnterprise")
     mk_id_external_enterprise: Optional[str] = Field(default=None, alias="mkIdExternalEnterprise")
-    jwt_user_key: Optional[str] = Field(default=None, alias="jwtUserKey")
-    legacy: Optional[Legacy] = Field(default=None, alias="legacy")
 
     class ConfigDict:
         populate_by_name = True

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Shared/Enums/Code.py

@@ -8,6 +8,7 @@ class Code(StrEnum):
     APP_ERROR_CODE = 'DB_ERROR_CONTROLLED'
     UNEXPECTED_ERROR_CODE = 'DB_ERROR_UNEXPECTED'
     INVALID_REQUEST_PARAMS_CODE = 'DB_WARNING_INVALID_REQUEST_PARAMS'
+    ACCESS_DENIED_CODE = "DB_WARNING_ACCESS_DENIED_CODE"
     DATABASE_ERROR_CODE = 'DB_WARNING_DATABASE_ERROR'
     DATABASE_CONNECTION_ERROR_CODE = 'DB_ERROR_DATABASE_CONNECTION'
     RSA_ERROR_CODE = 'DB_ERROR_RSA'

{encryptors-2.34 → encryptors-2.36}/src/Osdental/Shared/Enums/Message.py

@@ -1,6 +1,7 @@
 from enum import StrEnum
 
 class Message(StrEnum):
+    ACCESS_DENIED_MSG = "You do not have the necessary privileges for this operation."
     UNEXPECTED_ERROR_MSG = 'Something went wrong while processing your request. Please try again later.'
     PORTAL_ACCESS_RESTRICTED_MSG = 'You are not authorized to access this portal.'
     PROCESS_SUCCESS_MSG = 'Process executed successfully.'

encryptors-2.34/src/Osdental/Graphql/_Helpers/_ExtractAuthToken.py

@@ -1,11 +0,0 @@
-from fastapi import Request
-
-class ExtractAuthToken:
-
-    @staticmethod
-    def get_auth_token(request: Request) -> str:
-        authorization = request.headers.get("authorization")
-        if not authorization or not authorization.startswith("Bearer "):
-            raise ValueError("Missing Bearer token")
-        
-        return authorization.split(" ")[1]