SessionArmor 0.1.0__tar.gz

sessionarmor-0.1.0/.github/workflows/publish.yaml

@@ -0,0 +1,41 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pypi-publish:
+    name: Upload release to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/SessionArmor
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          print_hash: true

sessionarmor-0.1.0/.github/workflows/tests.yaml

@@ -0,0 +1,49 @@
+name: Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install .[dev]
+
+    - name: Lint with ruff
+      run: |
+        ruff check src/session_armor tests
+
+    - name: Type check with mypy
+      run: |
+        mypy src/session_armor --ignore-missing-imports
+      continue-on-error: true
+
+    - name: Run tests with coverage
+      run: |
+        export PYTHONPATH=$PYTHONPATH:$(pwd)/src
+        pytest tests/ --cov=session_armor --cov-report=xml --cov-report=term-missing
+
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v4
+      if: matrix.python-version == '3.12'
+      with:
+        files: ./coverage.xml
+        fail_ci_if_error: false
+        verbose: true

sessionarmor-0.1.0/.gitignore

@@ -0,0 +1,94 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# ruff
+.ruff_cache/
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/

sessionarmor-0.1.0/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-05-22
+
+### Added
+- **SessionSecurityMiddleware** — Client fingerprint binding (IP + User-Agent hash), absolute/idle session timeouts, JWT claim drift detection, session fixation prevention via `cycle_key()`.
+- **AuditMiddleware** — Privacy-preserving audit trail for authenticated requests with request ID correlation, hashed IPs, sanitized log entries.
+- **GateMiddleware** — Base class for building cacheable, hookable conditional gates (compliance, onboarding, feature flags, maintenance).
+- **Utilities** — `get_client_ip()` with proxy-depth awareness, `hash_value()`, `sanitize_for_log()` with control character stripping, `is_authenticated()`.
+- Full hook system on all three middleware classes for zero-subclass-needed customization.
+- `SESSION_ARMOR_TRUSTED_PROXY_DEPTH` setting to prevent X-Forwarded-For spoofing.
+- `fail_open=False` as defense-grade default on GateMiddleware.
+- CI/CD with GitHub Actions (tests on Python 3.10–3.13, PyPI publishing via trusted publishing).

sessionarmor-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Alex C
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sessionarmor-0.1.0/PKG-INFO

@@ -0,0 +1,174 @@
+Metadata-Version: 2.4
+Name: SessionArmor
+Version: 0.1.0
+Summary: Defense-grade Django middleware: session security, audit logging, and configurable request gates with hooks.
+Project-URL: Homepage, https://github.com/Tunet-xyz/session_armor
+Project-URL: Documentation, https://github.com/Tunet-xyz/session_armor#readme
+Project-URL: Repository, https://github.com/Tunet-xyz/session_armor
+Project-URL: Issues, https://github.com/Tunet-xyz/session_armor/issues
+Project-URL: Changelog, https://github.com/Tunet-xyz/session_armor/blob/main/CHANGELOG.md
+Author-email: Alex C <alex@coded.uk>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: audit,django,gates,middleware,nist,owasp,security,session
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.0
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: django>=4.2
+Provides-Extra: dev
+Requires-Dist: django-stubs>=4.2.0; extra == 'dev'
+Requires-Dist: mypy>=1.0.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
+Requires-Dist: pytest-django>=4.5; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# SessionArmor
+
+[![Tests](https://github.com/Tunet-xyz/session_armor/actions/workflows/tests.yaml/badge.svg)](https://github.com/Tunet-xyz/session_armor/actions/workflows/tests.yaml)
+[![PyPI version](https://badge.fury.io/py/SessionArmor.svg)](https://pypi.org/project/SessionArmor/)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Django 4.2+](https://img.shields.io/badge/django-4.2+-green.svg)](https://www.djangoproject.com/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+**Defense-grade Django middleware: session security, audit logging, and configurable request gates with hooks.**
+
+Part of the [Tunet](https://github.com/Tunet-xyz) ecosystem — alongside [SwapLayer](https://github.com/Tunet-xyz/swap_layer) and [InfraGlyph](https://github.com/Tunet-xyz/infra_glyph).
+
+---
+
+## What It Does
+
+SessionArmor provides three drop-in Django middleware classes that harden your application's session layer:
+
+| Middleware | Purpose |
+|-----------|---------|
+| `SessionSecurityMiddleware` | Fingerprint binding, absolute/idle timeouts, claim drift detection |
+| `AuditMiddleware` | Privacy-preserving security audit trail for every authenticated request |
+| `GateMiddleware` | Base class for building cacheable conditional gates (compliance, onboarding, feature flags) |
+
+All three are **hookable** — override methods to customize behavior without touching internals.
+
+## References
+
+- [NIST SP 800-53 AC-12](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Session Termination)
+- [NIST SP 800-53 SC-23](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Session Authenticity)
+- [NIST SP 800-53 AU-3/AU-12](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Audit Content/Generation)
+- [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
+
+---
+
+## Installation
+
+```bash
+pip install SessionArmor
+```
+
+## Quick Start
+
+```python
+# settings.py
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    # ... your auth middleware ...
+    'session_armor.session.SessionSecurityMiddleware',
+    'session_armor.audit.AuditMiddleware',
+    # ... rest of your middleware ...
+]
+
+# Optional settings (shown with defaults)
+SESSION_ABSOLUTE_TIMEOUT = 28800      # 8 hours
+SESSION_IDLE_TIMEOUT = 1800           # 30 minutes
+SESSION_BIND_IP = True
+SESSION_BIND_USER_AGENT = True
+SESSION_DETECT_CLAIM_DRIFT = True
+SESSION_ARMOR_TRUSTED_PROXY_DEPTH = 1  # Number of trusted reverse proxies
+```
+
+## Building a Gate
+
+```python
+from session_armor import GateMiddleware
+from django.shortcuts import redirect
+
+class ComplianceGate(GateMiddleware):
+    gate_id = 'compliance'
+    cache_ttl_setting = 'COMPLIANCE_CACHE_TTL'
+    default_cache_ttl = 3600
+    fail_open = False  # Block access if check fails
+
+    def check(self, request) -> bool:
+        return user_accepted_current_terms(request)
+
+    def on_reject(self, request):
+        return redirect('/accept-terms/')
+```
+
+## Customizing Session Security
+
+```python
+from session_armor import SessionSecurityMiddleware
+
+class MySessionSecurity(SessionSecurityMiddleware):
+    exempt_paths = ('/health/', '/static/')
+
+    def get_critical_claims(self, user):
+        # Auth0 / OIDC claims that must not change mid-session
+        return [user.sub, user.organization_uuid, user.platform]
+
+    def get_login_url(self, request):
+        platform = getattr(request.user, 'platform', '')
+        return f'/{platform}/login/' if platform else '/login/'
+```
+
+## Customizing Audit Logging
+
+```python
+from session_armor import AuditMiddleware
+
+class MyAudit(AuditMiddleware):
+    exempt_paths = ('/health/', '/static/', '/favicon.ico')
+
+    def get_user_identity(self, request):
+        return {
+            'uid': request.user.sub,
+            'platform': request.user.platform,
+            'org': request.user.organization_uuid,
+        }
+```
+
+---
+
+## Development
+
+```bash
+# Clone and install
+git clone https://github.com/Tunet-xyz/session_armor.git
+cd session_armor
+pip install -e ".[dev]"
+
+# Run tests
+pytest
+
+# Lint
+ruff check src/session_armor tests
+
+# Type check
+mypy src/session_armor
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

sessionarmor-0.1.0/README.md

@@ -0,0 +1,138 @@
+# SessionArmor
+
+[![Tests](https://github.com/Tunet-xyz/session_armor/actions/workflows/tests.yaml/badge.svg)](https://github.com/Tunet-xyz/session_armor/actions/workflows/tests.yaml)
+[![PyPI version](https://badge.fury.io/py/SessionArmor.svg)](https://pypi.org/project/SessionArmor/)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Django 4.2+](https://img.shields.io/badge/django-4.2+-green.svg)](https://www.djangoproject.com/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+**Defense-grade Django middleware: session security, audit logging, and configurable request gates with hooks.**
+
+Part of the [Tunet](https://github.com/Tunet-xyz) ecosystem — alongside [SwapLayer](https://github.com/Tunet-xyz/swap_layer) and [InfraGlyph](https://github.com/Tunet-xyz/infra_glyph).
+
+---
+
+## What It Does
+
+SessionArmor provides three drop-in Django middleware classes that harden your application's session layer:
+
+| Middleware | Purpose |
+|-----------|---------|
+| `SessionSecurityMiddleware` | Fingerprint binding, absolute/idle timeouts, claim drift detection |
+| `AuditMiddleware` | Privacy-preserving security audit trail for every authenticated request |
+| `GateMiddleware` | Base class for building cacheable conditional gates (compliance, onboarding, feature flags) |
+
+All three are **hookable** — override methods to customize behavior without touching internals.
+
+## References
+
+- [NIST SP 800-53 AC-12](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Session Termination)
+- [NIST SP 800-53 SC-23](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Session Authenticity)
+- [NIST SP 800-53 AU-3/AU-12](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) (Audit Content/Generation)
+- [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
+
+---
+
+## Installation
+
+```bash
+pip install SessionArmor
+```
+
+## Quick Start
+
+```python
+# settings.py
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    # ... your auth middleware ...
+    'session_armor.session.SessionSecurityMiddleware',
+    'session_armor.audit.AuditMiddleware',
+    # ... rest of your middleware ...
+]
+
+# Optional settings (shown with defaults)
+SESSION_ABSOLUTE_TIMEOUT = 28800      # 8 hours
+SESSION_IDLE_TIMEOUT = 1800           # 30 minutes
+SESSION_BIND_IP = True
+SESSION_BIND_USER_AGENT = True
+SESSION_DETECT_CLAIM_DRIFT = True
+SESSION_ARMOR_TRUSTED_PROXY_DEPTH = 1  # Number of trusted reverse proxies
+```
+
+## Building a Gate
+
+```python
+from session_armor import GateMiddleware
+from django.shortcuts import redirect
+
+class ComplianceGate(GateMiddleware):
+    gate_id = 'compliance'
+    cache_ttl_setting = 'COMPLIANCE_CACHE_TTL'
+    default_cache_ttl = 3600
+    fail_open = False  # Block access if check fails
+
+    def check(self, request) -> bool:
+        return user_accepted_current_terms(request)
+
+    def on_reject(self, request):
+        return redirect('/accept-terms/')
+```
+
+## Customizing Session Security
+
+```python
+from session_armor import SessionSecurityMiddleware
+
+class MySessionSecurity(SessionSecurityMiddleware):
+    exempt_paths = ('/health/', '/static/')
+
+    def get_critical_claims(self, user):
+        # Auth0 / OIDC claims that must not change mid-session
+        return [user.sub, user.organization_uuid, user.platform]
+
+    def get_login_url(self, request):
+        platform = getattr(request.user, 'platform', '')
+        return f'/{platform}/login/' if platform else '/login/'
+```
+
+## Customizing Audit Logging
+
+```python
+from session_armor import AuditMiddleware
+
+class MyAudit(AuditMiddleware):
+    exempt_paths = ('/health/', '/static/', '/favicon.ico')
+
+    def get_user_identity(self, request):
+        return {
+            'uid': request.user.sub,
+            'platform': request.user.platform,
+            'org': request.user.organization_uuid,
+        }
+```
+
+---
+
+## Development
+
+```bash
+# Clone and install
+git clone https://github.com/Tunet-xyz/session_armor.git
+cd session_armor
+pip install -e ".[dev]"
+
+# Run tests
+pytest
+
+# Lint
+ruff check src/session_armor tests
+
+# Type check
+mypy src/session_armor
+```
+
+## License
+
+MIT — see [LICENSE](LICENSE).

sessionarmor-0.1.0/SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+We take security seriously. If you discover a security vulnerability in SessionArmor, please report it responsibly.
+
+### How to Report
+
+**Please DO NOT open a public GitHub issue for security vulnerabilities.**
+
+Instead, please email security concerns to: **alex@coded.uk**
+
+Include the following in your report:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+### Response Timeline
+
+- **Acknowledgement:** Within 48 hours
+- **Initial assessment:** Within 5 business days
+- **Fix release:** Within 30 days for critical issues
+
+### Scope
+
+The following are in scope:
+- Session fixation or hijacking bypasses
+- Fingerprint binding bypasses
+- Log injection via sanitization bypass
+- X-Forwarded-For spoofing past proxy depth controls
+- Any bypass of gate middleware security checks
+
+### Out of Scope
+
+- Vulnerabilities in Django itself (report to Django security team)
+- Issues requiring physical access to the server
+- Social engineering attacks

sessionarmor-0.1.0/pyproject.toml

@@ -0,0 +1,98 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/session_armor"]
+
+[project]
+name = "SessionArmor"
+version = "0.1.0"
+description = "Defense-grade Django middleware: session security, audit logging, and configurable request gates with hooks."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+keywords = ["django", "middleware", "security", "session", "audit", "gates", "nist", "owasp"]
+authors = [
+  { name = "Alex C", email = "alex@coded.uk" },
+]
+classifiers = [
+  "Framework :: Django",
+  "Framework :: Django :: 4.2",
+  "Framework :: Django :: 5.0",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "License :: OSI Approved :: MIT License",
+  "Topic :: Security",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+  "Intended Audience :: Developers",
+]
+dependencies = [
+  "Django>=4.2",
+]
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=8.0",
+  "pytest-django>=4.5",
+  "pytest-cov>=4.0.0",
+  "ruff>=0.4",
+  "mypy>=1.0.0",
+  "django-stubs>=4.2.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/Tunet-xyz/session_armor"
+Documentation = "https://github.com/Tunet-xyz/session_armor#readme"
+Repository = "https://github.com/Tunet-xyz/session_armor"
+Issues = "https://github.com/Tunet-xyz/session_armor/issues"
+Changelog = "https://github.com/Tunet-xyz/session_armor/blob/main/CHANGELOG.md"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+addopts = "-v --tb=short"
+DJANGO_SETTINGS_MODULE = "tests.settings"
+
+[tool.mypy]
+python_version = "3.10"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = false
+check_untyped_defs = true
+plugins = ["mypy_django_plugin.main"]
+ignore_missing_imports = true
+
+[tool.django-stubs]
+django_settings_module = "tests.settings"
+
+[tool.ruff]
+target-version = "py310"
+line-length = 100
+
+[tool.ruff.lint]
+select = [
+  "E",   # pycodestyle errors
+  "W",   # pycodestyle warnings
+  "F",   # pyflakes
+  "I",   # isort
+  "B",   # flake8-bugbear
+  "C4",  # flake8-comprehensions
+  "UP",  # pyupgrade
+]
+ignore = [
+  "E501",  # line too long (handled by formatter)
+  "B008",  # do not perform function calls in argument defaults
+  "B904",  # Within except clause, raise with from err
+]
+
+[tool.ruff.lint.isort]
+known-first-party = ["session_armor"]
+
+[tool.coverage.run]
+source = ["src/session_armor"]
+branch = true
+omit = ["*/tests/*", "*/__pycache__/*"]