Encryptors 2.57__tar.gz → 2.58__tar.gz

{encryptors-2.57 → encryptors-2.58}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.57
+Version: 2.58
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai

{encryptors-2.57 → encryptors-2.58}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 # ANDERSON REVISAR EL CACHE LOCAL DEL KEYVAULT PARA VALIDAR SI FUNCIONA
 setup(
     name="Encryptors", 
-    version="2.57",
+    version="2.58",
     author="OSDental LLC",
     author_email="support@osdental.ai",
     description="End-to-end algorithm library",

{encryptors-2.57 → encryptors-2.58}/src/Encryptors.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Encryptors
-Version: 2.57
+Version: 2.58
 Summary: End-to-end algorithm library
 Author: OSDental LLC
 Author-email: support@osdental.ai

{encryptors-2.57 → encryptors-2.58}/src/Encryptors.egg-info/SOURCES.txt

@@ -27,6 +27,7 @@ src/Osdental/Encryptor/Jwt.py
 src/Osdental/Encryptor/Rsa.py
 src/Osdental/Encryptor/Sha512.py
 src/Osdental/Encryptor/__init__.py
+src/Osdental/Enums/AuditType.py
 src/Osdental/Enums/ErrorSource.py
 src/Osdental/Enums/FileType.py
 src/Osdental/Enums/GrahpqlOperation.py
@@ -46,6 +47,7 @@ src/Osdental/Graphql/_Helpers/_TenantPolicy.py
 src/Osdental/Graphql/_Helpers/_TokenService.py
 src/Osdental/Graphql/_Helpers/__init__.py
 src/Osdental/Helpers/AuditDispatcher.py
+src/Osdental/Helpers/AuditHelper.py
 src/Osdental/Helpers/AzureClassifier.py
 src/Osdental/Helpers/GrpcConnection.py
 src/Osdental/Helpers/JwtTokenHelper.py
@@ -61,6 +63,7 @@ src/Osdental/Messaging/Kafka.py
 src/Osdental/Messaging/RabbitMQ.py
 src/Osdental/Messaging/__init__.py
 src/Osdental/Models/ApiResponse.py
+src/Osdental/Models/AuditContext.py
 src/Osdental/Models/Notification.py
 src/Osdental/Models/Response.py
 src/Osdental/Models/Token.py
@@ -74,6 +77,7 @@ src/Osdental/Rest/Middlewares/__init__.py
 src/Osdental/Secrets/AzureKeyVaultProvider.py
 src/Osdental/Secrets/__init__.py
 src/Osdental/Services/JwtAuthTokenService.py
+src/Osdental/Services/ServiceBusAuditEmitter.py
 src/Osdental/Services/WebsocketClient.py
 src/Osdental/Services/__init__.py
 src/Osdental/Storage/AzureBlobStorage.py

encryptors-2.58/src/Osdental/Decorators/SecureResolver.py

@@ -0,0 +1,133 @@
+import logging
+from functools import wraps
+from typing import Callable
+from graphql import GraphQLResolveInfo
+from Osdental.Models.Response import Response
+from Osdental.Graphql.Models import BaseGraphQLContext
+from Osdental.Models.TokenClaims import UserTokenClaims
+from Osdental.Models.Token import AuthToken
+from Osdental.Enums.Profile import Profile
+from Osdental.Exception.ControlledException import (
+    OSDException, AccessDeniedException
+)
+from Osdental.Services import IAuthTokenService
+from Osdental.Helpers._AuthTokenProcessor import (
+    extract_bearer_token, build_auth_token, decrypt_and_parse_payload
+)
+from Osdental.Enums.StatusCode import StatusCode
+from Osdental.Models.AuditContext import AuditContext
+from Osdental.Helpers.AuditHelper import (
+    _build_success_payload, _build_error_payload, _build_unexpected_payload
+)
+
+
+logger = logging.getLogger(__name__)
+
+
+
+def resolver(public: bool = False, action=None):
+
+    def decorator(func: Callable):
+        func._is_public = public
+
+        @wraps(func)
+        async def wrapper(obj, info: GraphQLResolveInfo, **kwargs):
+            try:
+                context: BaseGraphQLContext = info.context
+                container = context.container
+                request = context.request
+                headers = request.headers
+                settings = container.settings
+
+                token: type[AuthToken] | None = None
+
+                # ── 1. AUTENTICACIÓN ──────────────────────────────
+                if not public:
+
+                    token_service: IAuthTokenService = container.auth_token_service
+                    user_token = extract_bearer_token(headers)
+                    
+                    claims: UserTokenClaims = await token_service.validate_internal_access_token(
+                        user_token
+                    )
+
+                # ── 2. DECRYPT DEL PAYLOAD ────────────────────────
+                body = await request.json()
+                variables = body.get("variables") or {}
+                encrypted_payload = kwargs.get("data") or variables.get("data")
+                decrypted_payload = None
+
+                if not public and encrypted_payload is not None:
+                    decrypted_payload = decrypt_and_parse_payload(
+                        aes_key_auth=claims.aes_key_auth,
+                        encrypted_payload=encrypted_payload
+                    )
+
+                    kwargs["data"] = decrypted_payload
+
+                # ── 3. TENANT POLICY ──────────────────────────────
+                if not public:
+
+                    token = build_auth_token(
+                        claims=claims,
+                        headers=request.headers,
+                        decrypted_payload=decrypted_payload,
+                        operation_type=info.operation.operation.value
+                    )
+
+                # ── 4. CONTROL DE ACCESO POR ROL ─────────────────
+                if not public and action:
+                    if Profile(token.abbreviation) not in action.allowed_roles:
+                        raise AccessDeniedException(
+                            status_code=StatusCode.BUSINESS_RULE_WARNING,
+                            error="User not allowed to perform this action"
+                        )
+
+                # ── 5. CONTEXTO DE AUDITORÍA ──────────────
+                # Lo construimos antes del resolver para que siempre exista
+
+                audit_ctx = AuditContext.from_request(
+                    request=request,
+                    settings=settings,
+                    body=body,
+                    operation_type=info.operation.operation.value,
+                    token=token,
+                    decrypted_payload=decrypted_payload,
+                )
+
+                # ── 6. EJECUTAR RESOLVER ──────────────────
+                result = await func(obj, info, **kwargs)
+
+                if not isinstance(result, Response):
+                    raise TypeError("Resolver must return a Response instance")
+
+                # ── 7. AUDITAR ÉXITO ──────────────────────
+                await container.audit_emitter.emit(
+                    _build_success_payload(audit_ctx, result)
+                )
+
+                return result
+
+            except OSDException as e:
+                # logger.warning(f"Business error: {str(e)}")
+                await container.audit_emitter.emit(
+                    _build_error_payload(audit_ctx, e)
+                )
+                return Response(
+                    status=e.status_code,
+                    message=e.message,
+                    error=e.error
+                )
+            except Exception as e:
+                # logger.exception(f"Unexpected error: {str(e)}")
+                await container.audit_emitter.emit(
+                    _build_unexpected_payload(audit_ctx, e)
+                )
+                return Response(
+                    status=StatusCode.INTERNAL_SERVER_ERROR,
+                    message="Could not process request.",
+                    error=str(e)
+                )
+
+        return wrapper
+    return decorator

encryptors-2.58/src/Osdental/Enums/AuditType.py

@@ -0,0 +1,5 @@
+from enum import StrEnum
+
+class AuditType(StrEnum):
+    INTERNAL = "MESSAGE_LOG_INTERNAL"
+    EXTERNAL = "MESSAGE_LOG_EXTERNAL"

encryptors-2.58/src/Osdental/Helpers/AuditHelper.py

@@ -0,0 +1,118 @@
+import json
+from fastapi import Request
+from typing import Optional, Dict, Any, Literal
+from Osdental.Models.AuditContext import AuditContext
+from Osdental.Models.Response import Response
+from Osdental.Exception.ControlledException import OSDException
+from Osdental.Enums.StatusCode import StatusCode
+from Osdental.Enums.AuditType import AuditType
+
+def build_request_payload(
+    request: Request, 
+    payload: Dict[str, Any], 
+    audit_type: str
+) -> Dict[str, Any]:
+
+    default_value = "*"
+
+    user_ip = request.headers.get("X-Forwarded-For")
+    if user_ip:
+        user_ip = user_ip.split(",")[0]
+    else:
+        user_ip = getattr(request.client, "host", "*")
+
+    SAFE_HEADERS = {
+        "user-agent",
+        "host",
+        "origin",
+        "referer",
+        "content-type"
+    }
+
+    headers = {
+        k: v 
+        for k, v in request.headers.items() 
+        if k.lower() in SAFE_HEADERS
+    }
+
+    return {
+        "idMessageLog": request.headers.get("Idmessagelog"),
+        "environment": payload.get("env"),
+        "header": json.dumps(headers),
+        "microServiceUrl": str(request.url),
+        "microServiceName": payload.get("ms_name"),
+        "microServiceVersion": payload.get("ms_version"),
+        "serviceName": payload.get("operation_name"),
+        "machineNameUser": request.headers.get("Machinenameuser", default_value),
+        "ipUser": user_ip or default_value,
+        "userName": payload.get("user"),
+        "localitation": default_value,
+        "httpMethod": request.method,
+        "messageIn": json.dumps(payload) if payload else default_value,
+        "auditLog": audit_type,
+    }
+
+def _build_final_payload(
+    type_: Literal["RESPONSE", "ERROR"],
+    status_code: int,
+    result: Optional[Any] = None,
+    error: Optional[Any] = None
+) -> Dict[str, Any]:
+
+    result = "*" if result is None else result
+    error = "*" if error is None else error
+
+    if isinstance(result, (dict, list)):
+        result = json.dumps(result)
+
+    return {
+        "type": type_,
+        "httpResponseCode": status_code,
+        "messageOut": result,
+        "errorProducer": error
+    }
+
+def _build_success_payload(ctx: Optional[AuditContext], result: Response) -> Dict[str, Any]:
+    base = _base_payload(ctx, AuditType.INTERNAL)
+    return base | _build_final_payload(
+        type_="RESPONSE",
+        status_code=result.status,
+        result=result.data
+    )
+
+def _build_error_payload(ctx: Optional[AuditContext], exc: OSDException) -> Dict[str, Any]:
+    base = _base_payload(ctx, AuditType.INTERNAL)
+    return base | _build_final_payload(
+        type_="ERROR",
+        status_code=exc.audit_status_code,
+        error=exc.error or exc.message
+    )
+
+def _build_unexpected_payload(ctx: Optional[AuditContext], exc: Exception) -> Dict[str, Any]:
+    base = _base_payload(ctx, AuditType.INTERNAL)
+    return base | _build_final_payload(
+        type_="ERROR",
+        status_code=StatusCode.INTERNAL_SERVER_ERROR,
+        error=str(exc)
+    )
+
+def _base_payload(ctx: Optional[AuditContext], audit_type: AuditType = AuditType.INTERNAL) -> Dict[str, Any]:
+    if not ctx:
+        return {"user": "unknown", "operation_name": "unknown"}
+    
+    return {
+        "idMessageLog": ctx.message_log_id,
+        "environment": ctx.env,
+        "header": json.dumps(ctx.headers or {}),
+        "microServiceUrl": ctx.url,
+        "microServiceName": ctx.ms_name,
+        "microServiceVersion": ctx.ms_version,
+        "serviceName": ctx.operation_name,
+        "machineNameUser": "*",
+        "ipUser": ctx.user_ip or "*",
+        "userName": ctx.user,
+        "localitation": "*",
+        "httpMethod": ctx.http_method,
+        "messageIn": json.dumps(ctx.variables) if ctx.variables else "*",
+        "auditLog": audit_type,
+    }

encryptors-2.58/src/Osdental/Models/AuditContext.py

@@ -0,0 +1,61 @@
+from dataclasses import dataclass
+from typing import Optional, Dict, Any
+from fastapi import Request
+
+
+@dataclass
+class AuditContext:
+    env: str
+    ms_name: str
+    ms_version: str
+    is_auditable: bool
+    operation_type: str
+    operation_name: str
+    query: Optional[str]
+    variables: Optional[Dict[str, Any]]
+    user: str
+    message_log_id: Optional[str]
+    decrypted_key: Optional[str] = None
+    user_ip: Optional[str] = None
+    headers: Optional[Dict[str, str]] = None
+    url: Optional[str] = None
+    http_method: Optional[str] = None
+
+    SAFE_HEADERS = {"user-agent", "host", "origin", "referer", "content-type"}
+
+    @classmethod
+    def from_request(
+        cls,
+        request: Request,
+        settings,
+        body: Dict,
+        operation_type: str,
+        token=None,
+        decrypted_payload=None,
+    ) -> "AuditContext":
+        
+        user_ip = request.headers.get("X-Forwarded-For")
+        user_ip = user_ip.split(",")[0] if user_ip else getattr(request.client, "host", "*")
+
+        safe_headers = {
+            k: v for k, v in request.headers.items()
+            if k.lower() in cls.SAFE_HEADERS
+        }
+
+        return cls(
+            env=settings.environment,
+            ms_name=settings.microservice_name,
+            ms_version=settings.microservice_version,
+            is_auditable=settings.is_auditable,
+            operation_type=operation_type,
+            operation_name=body.get("operationName", "UnknownOperation"),
+            query=body.get("query"),
+            variables=decrypted_payload,
+            user=token.user_full_name if token else "Public",
+            message_log_id=request.headers.get("Idmessagelog"),
+            decrypted_key=token.aes_key_auth if token else None,
+            user_ip=user_ip,
+            headers=safe_headers,
+            url=str(request.url),
+            http_method=request.method,
+        )

encryptors-2.58/src/Osdental/Services/ServiceBusAuditEmitter.py

@@ -0,0 +1,17 @@
+import json
+from typing import Dict, Any
+from Osdental.Messaging import IMessageQueue
+from Osdental.Storage import IStorageService
+
+class ServiceBusAuditEmitter:
+    
+    def __init__(self, messaging: IMessageQueue, storage: IStorageService):
+        self._messaging = messaging
+        self._storage = storage
+
+    async def emit(self, payload: Dict[str, Any]) -> None:
+        message_log_id = payload.get("idMessageLog")
+        data = json.dumps(payload)
+        blob_name = f"audits/{message_log_id}.text"
+        await self._storage.upload(blob_name, data)
+        await self._messaging.send_message(blob_name)

{encryptors-2.57 → encryptors-2.58}/src/Osdental/Services/__init__.py

@@ -1,4 +1,5 @@
 from abc import ABC, abstractmethod
+from typing import Protocol, Any, Dict
 from Osdental.Models.Notification import Notification
 
 class INotificationPublisher(ABC):
@@ -44,4 +45,9 @@ class IAuthTokenService(ABC):
         self,
         token: str,
     ) -> ActionTokenClaims:
-        pass
+        pass
+
+
+class IAuditEmitter(Protocol):
+    async def emit(self, payload: Dict[str, Any]) -> None:
+        ...

encryptors-2.57/src/Osdental/Decorators/SecureResolver.py

@@ -1,250 +0,0 @@
-import logging
-from functools import wraps
-from typing import Callable, Dict, Any
-from graphql import GraphQLResolveInfo
-from Osdental.Models.Response import Response
-from Osdental.Graphql.Models import BaseGraphQLContext
-from Osdental.Models.TokenClaims import UserTokenClaims
-from Osdental.Models.Token import AuthToken
-from Osdental.Enums.Profile import Profile
-from Osdental.Exception.ControlledException import (
-    OSDException, AccessDeniedException
-)
-from Osdental.Services import IAuthTokenService
-from Osdental.Helpers._AuthTokenProcessor import (
-    extract_bearer_token, build_auth_token, decrypt_and_parse_payload
-)
-from Osdental.Enums.StatusCode import StatusCode
-from Osdental.Storage import IStorageService
-from Osdental.Messaging import IMessageQueue
-from Osdental.Graphql._Helpers._AuditHelper import AuditHelper
-from Osdental.Constants.Constant import Constant
-from Osdental.Helpers.ResponseDecryptor import decryptor_data, VALID_TYPES
-
-logger = logging.getLogger(__name__)
-
-
-async def __test(
-    messaging: IMessageQueue,
-    storage: IStorageService,
-    request_payload: Dict[str, Any],
-    request,
-    result: Response,
-    decrypted_key: str,
-    audit_type: str
-) -> None:
-    
-    import json
-
-    if not request_payload.get("is_auditable"):
-        logger.info("Auditing is disabled. Skipping audit processing.")
-        return
-        
-    operation_name = request_payload.get("operation_name")
-    if operation_name == 'UnknownOperation':
-        logger.info("Skipping audit: no data in GraphQL response")
-        return
-    
-    request_audit_payload = AuditHelper.build_request_payload(
-        request=request,
-        payload=request_payload,
-        audit_type=audit_type
-    )
-
-    status_code = result.status
-    message = result.message
-    data = result.data
-    error = result.error if result.error else message
-
-    if audit_type == Constant.MESSAGE_LOG_INTERNAL:
-        ERROR_PREFIXES = ("ERROR", "WARNING")
-        if isinstance(status_code, int):
-            is_error = not (200 <= status_code < 300)
-        elif isinstance(status_code, str):
-            is_error = status_code.upper().startswith(ERROR_PREFIXES)
-    else:
-        try:
-            is_error = not (200 <= status_code < 300)
-        except ValueError:
-            is_error = True
-
-    if is_error:
-        err_payload = AuditHelper.build_final_payload(
-            _type="ERROR",
-            status_code=status_code,
-            error=error
-        )
-        audit_message = request_audit_payload | err_payload
-    else:
-        if isinstance(result, Response):
-            
-            encryption_type = result.encryption_type
-            
-        
-            if encryption_type in VALID_TYPES and decrypted_key and data:
-                data = decryptor_data(encryption_type, decrypted_key, data)
-
-        res_payload = AuditHelper.build_final_payload(
-            _type="RESPONSE",
-            status_code=status_code,
-            result=data
-        )
-        audit_message = request_audit_payload | res_payload
-
-    message_log_id = request.headers.get("Idmessagelog")
-    if not message_log_id:
-        logger.warning("No Idmessagelog header found. Skipping audit storage.")
-        return
-    
-    data = json.dumps(audit_message)
-    # print(f"data: {data}")
-    # blob_name = f"audits/{message_log_id}.text"
-    # success = await storage.upload(blob_name, data)
-    
-    # if not success:
-    #     logger.error("Failed to upload audit log to storage. Skipping message dispatch.")
-    #     return
-    
-    # await messaging.send_message(blob_name)
-    
-    # dispatcher.dispatch(
-    #     request=request,
-    #     request_payload=request_payload,
-    #     result=result,
-    #     metadata={
-    #         "decrypted_key": decrypted_key
-    #     },
-    #     audit_type="MESSAGE_LOG_INTERNAL"
-    # )
-
-def resolver(public: bool = False, action=None):
-
-    def decorator(func: Callable):
-        func._is_public = public
-
-        @wraps(func)
-        async def wrapper(obj, info: GraphQLResolveInfo, **kwargs):
-            try:
-                context: BaseGraphQLContext = info.context
-                container = context.container
-                request = context.request
-                headers = request.headers
-                settings = container.settings
-
-                token: type[AuthToken] | None = None
-
-                # ── 1. AUTENTICACIÓN ──────────────────────────────
-                if not public:
-
-                    token_service: IAuthTokenService = container.auth_token_service
-                    user_token = extract_bearer_token(headers)
-                    
-                    claims: UserTokenClaims = await token_service.validate_internal_access_token(
-                        user_token
-                    )
-
-                # ── 2. DECRYPT DEL PAYLOAD ────────────────────────
-                body = await request.json()
-                variables = body.get("variables") or {}
-                encrypted_payload = kwargs.get("data") or variables.get("data")
-                decrypted_payload = None
-
-                if not public and encrypted_payload is not None:
-                    decrypted_payload = decrypt_and_parse_payload(
-                        aes_key_auth=claims.aes_key_auth,
-                        encrypted_payload=encrypted_payload
-                    )
-
-                    kwargs["data"] = decrypted_payload
-
-                # ── 3. TENANT POLICY ──────────────────────────────
-                if not public:
-
-                    token = build_auth_token(
-                        claims=claims,
-                        headers=request.headers,
-                        decrypted_payload=decrypted_payload,
-                        operation_type=info.operation.operation.value
-                    )
-
-                # ── 4. CONTROL DE ACCESO POR ROL ─────────────────
-                if not public and action:
-                    if Profile(token.abbreviation) not in action.allowed_roles:
-                        raise AccessDeniedException(
-                            status_code=StatusCode.BUSINESS_RULE_WARNING,
-                            error="User not allowed to perform this action"
-                        )
-
-                # ── 5. EJECUTAR RESOLVER ──────────────────────────
-                result = await func(obj, info, **kwargs)
-
-                if not isinstance(result, Response):
-                    raise TypeError("Resolver must return a Response instance")
-
-                
-
-                request_payload = {
-                    "env": settings.environment,
-                    "ms_name": settings.microservice_name,
-                    "ms_version": settings.microservice_version,
-                    "is_auditable": settings.is_auditable,
-                    "operation_type": info.operation.operation.value,
-                    "operation_name": body.get("operationName", "UnknownOperation"),
-                    "query": body.get("query"),
-                    "variables": decrypted_payload,
-                    "user": (
-                        token.user_full_name 
-                        if token 
-                        else "Public"
-                    )
-                }
-
-                if isinstance(result, Response):
-                    decrypted_key = result.key if not token else token.aes_key_auth
-                
-                await __test(
-                    messaging=container.az_sb_audit,
-                    storage=container.az_blob_storage,
-                    request_payload=request_payload,
-                    request=request,
-                    decrypted_key=decrypted_key,
-                    result=result,
-                    audit_type="MESSAGE_LOG_INTERNAL"
-                )
-
-                return result
-
-            except OSDException as e:
-                # logger.warning(f"Business error: {str(e)}")
-                if e.is_external:
-                    err_payload = AuditHelper.build_final_payload(
-                        _type="ERROR",
-                        status_code=e.status_code,
-                        error=result.error if result.error else e.message
-                    )
-                else:
-                    err_payload = AuditHelper.build_final_payload(
-                        _type="ERROR",
-                        status_code=e.audit_status_code,
-                        error=result.error if result.error else e.message
-                    )
-                return Response(
-                    status=e.status_code,
-                    message=e.message,
-                    error=e.error
-                )
-            except Exception as e:
-                # logger.exception(f"Unexpected error: {str(e)}")
-                err_payload = AuditHelper.build_final_payload(
-                    _type="ERROR",
-                    status_code=StatusCode.INTERNAL_SERVER_ERROR,
-                    error=str(e)
-                )
-                return Response(
-                    status=StatusCode.INTERNAL_SERVER_ERROR,
-                    message="Could not process request.",
-                    error=str(e)
-                )
-
-        return wrapper
-    return decorator