allowedflare 2023.47.0__tar.gz

allowedflare-2023.47.0/LICENSE

@@ -0,0 +1,28 @@
+BSD 3-Clause License
+
+Copyright (c) 2023, Christopher Covington
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

allowedflare-2023.47.0/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.1
+Name: allowedflare
+Version: 2023.47.0
+Summary: Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access
+Project-URL: Homepage, https://github.com/covracer/allowedflare
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography
+Requires-Dist: pyjwt
+Requires-Dist: requests
+
+Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access. A Django reimplementation of https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/#python-example
+
+To run the demo, export these environment variables
+* `ALLOWEDFLARE_ACCESS_URL` https://your-organization.cloudflareaccess.com
+* `ALLOWEDFLARE_AUDIENCE` 64-character hexidecimal string
+* `ALLOWEDFLARE_PRIVATE_DOMAIN` your-domain.tld
+
+Then run
+```
+docker-compose up
+```
+
+Configure Cloudflare Tunnel public hostname demodj.your-domain.tld to http://localhost:8001 or equivalent.
+
+### TODO
+* Better login page
+* Django REST Framework (DRF) support
+* Grant users view permission to all models
+* (Re-) authenticating proxy for different-domain front-ends, like https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/cors/#send-authentication-token-with-cloudflare-worker but
+    - Setting username so it can be logged by gunicorn
+    - Rewriting origin redirects
+    - Setting the XmlHttpRequest(?) header to avoid redirects to the sign-in page
+    - Will the original CF_Authorization cookie need to be copied, similar to X-Forwarded-For?

allowedflare-2023.47.0/README.md

@@ -0,0 +1,23 @@
+Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access. A Django reimplementation of https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/#python-example
+
+To run the demo, export these environment variables
+* `ALLOWEDFLARE_ACCESS_URL` https://your-organization.cloudflareaccess.com
+* `ALLOWEDFLARE_AUDIENCE` 64-character hexidecimal string
+* `ALLOWEDFLARE_PRIVATE_DOMAIN` your-domain.tld
+
+Then run
+```
+docker-compose up
+```
+
+Configure Cloudflare Tunnel public hostname demodj.your-domain.tld to http://localhost:8001 or equivalent.
+
+### TODO
+* Better login page
+* Django REST Framework (DRF) support
+* Grant users view permission to all models
+* (Re-) authenticating proxy for different-domain front-ends, like https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/cors/#send-authentication-token-with-cloudflare-worker but
+    - Setting username so it can be logged by gunicorn
+    - Rewriting origin redirects
+    - Setting the XmlHttpRequest(?) header to avoid redirects to the sign-in page
+    - Will the original CF_Authorization cookie need to be copied, similar to X-Forwarded-For?

allowedflare-2023.47.0/allowedflare.egg-info/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.1
+Name: allowedflare
+Version: 2023.47.0
+Summary: Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access
+Project-URL: Homepage, https://github.com/covracer/allowedflare
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography
+Requires-Dist: pyjwt
+Requires-Dist: requests
+
+Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access. A Django reimplementation of https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/validating-json/#python-example
+
+To run the demo, export these environment variables
+* `ALLOWEDFLARE_ACCESS_URL` https://your-organization.cloudflareaccess.com
+* `ALLOWEDFLARE_AUDIENCE` 64-character hexidecimal string
+* `ALLOWEDFLARE_PRIVATE_DOMAIN` your-domain.tld
+
+Then run
+```
+docker-compose up
+```
+
+Configure Cloudflare Tunnel public hostname demodj.your-domain.tld to http://localhost:8001 or equivalent.
+
+### TODO
+* Better login page
+* Django REST Framework (DRF) support
+* Grant users view permission to all models
+* (Re-) authenticating proxy for different-domain front-ends, like https://developers.cloudflare.com/cloudflare-one/identity/authorization-cookie/cors/#send-authentication-token-with-cloudflare-worker but
+    - Setting username so it can be logged by gunicorn
+    - Rewriting origin redirects
+    - Setting the XmlHttpRequest(?) header to avoid redirects to the sign-in page
+    - Will the original CF_Authorization cookie need to be copied, similar to X-Forwarded-For?

allowedflare-2023.47.0/allowedflare.egg-info/SOURCES.txt

@@ -0,0 +1,9 @@
+LICENSE
+README.md
+pyproject.toml
+allowedflare.egg-info/PKG-INFO
+allowedflare.egg-info/SOURCES.txt
+allowedflare.egg-info/dependency_links.txt
+allowedflare.egg-info/requires.txt
+allowedflare.egg-info/top_level.txt
+django_allowedflare/__init__.py

allowedflare-2023.47.0/allowedflare.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

allowedflare-2023.47.0/allowedflare.egg-info/requires.txt

@@ -0,0 +1,3 @@
+cryptography
+pyjwt
+requests

allowedflare-2023.47.0/allowedflare.egg-info/top_level.txt

@@ -0,0 +1 @@
+django_allowedflare

allowedflare-2023.47.0/django_allowedflare/__init__.py

@@ -0,0 +1,92 @@
+import logging
+from datetime import datetime, timedelta, timezone as datetime_timezone
+from typing import Any
+
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+from django.contrib.auth.backends import ModelBackend
+from django.contrib.auth.models import User
+from django.http import HttpRequest
+from django.utils import timezone as django_utils_timezone
+from django.conf import settings
+from jwt.algorithms import RSAAlgorithm
+from jwt import decode, InvalidSignatureError
+import requests
+
+
+cache_updated = datetime.fromtimestamp(0, tz=datetime_timezone.utc)
+cached_keys: list[RSAPublicKey] = []
+logger = logging.getLogger(__name__)
+
+
+def clean_username(username: str) -> str:
+    return username.removesuffix(f'@{settings.ALLOWEDFLARE_PRIVATE_DOMAIN}')
+
+
+def fetch_or_reuse_keys() -> list[RSAPublicKey]:
+    global cache_updated, cached_keys
+    now = django_utils_timezone.now()
+    # As of June 2023, signing keys are documented as rotated every 6 weeks
+    if cache_updated + timedelta(days=1) < now:
+        response = requests.get(f'{settings.ALLOWEDFLARE_ACCESS_URL}/cdn-cgi/access/certs').json()
+        if response.get('keys'):
+            decoded_keys = [RSAAlgorithm.from_jwk(key) for key in response['keys']]
+            cached_keys = [key for key in decoded_keys if isinstance(key, RSAPublicKey)]
+            cache_updated = now
+    return cached_keys
+
+
+def decode_token(cf_authorization: str) -> dict:
+    for key in fetch_or_reuse_keys():
+        try:
+            return decode(
+                cf_authorization,
+                key=key,
+                audience=settings.ALLOWEDFLARE_AUDIENCE,
+                algorithms=['RS256'],
+            )
+        except InvalidSignatureError:
+            pass
+    return {}
+
+
+def defaults_for_user(token: dict) -> dict:
+    return getattr(settings, 'ALLOWEDFLARE_DEFAULTS_FOR_USER', lambda token: {'is_staff': True})(
+        token
+    )
+
+
+class Allowedflare(ModelBackend):
+    def authenticate(
+        self,
+        request: HttpRequest | None,
+        username: str | None = None,
+        password: str | None = None,
+        **kwargs: Any,
+    ) -> User | None:
+        if not request or 'CF_Authorization' not in request.COOKIES:
+            logger.warning('CF_Authorization cookie missing')
+            return None
+        token = decode_token(request.COOKIES['CF_Authorization'])
+        if not token:
+            logger.warning(f'Invalid CF_Authorization cookie {request.COOKIES["CF_Authorization"]}')
+            return None
+        if 'email' not in token:
+            logger.warning(f'Valid token missing email {token}')
+
+        user, new = User.objects.update_or_create(
+            username=clean_username(token['email']),
+            email=token['email'],
+            defaults=defaults_for_user(token),
+        )
+
+        if new:
+            logger.info(f'New user {user.email} authenticated with Allowedflare')
+        else:
+            logger.info(f'Existing user {user.email} authenticated with Allowedflare')
+        return user
+
+    def get_user(self, user_id: int) -> User | None:
+        try:
+            return User.objects.get(pk=user_id)
+        except User.DoesNotExist:
+            return None

allowedflare-2023.47.0/pyproject.toml

@@ -0,0 +1,42 @@
+[build-system]
+requires = ['setuptools>=61.0', 'setuptools_scm[toml]>=6.2', 'wheel']
+build-backend = 'setuptools.build_meta'
+
+[project]
+classifiers = [
+    'Programming Language :: Python :: 3',
+    'License :: OSI Approved :: BSD License',
+    'Operating System :: OS Independent',
+    'Topic :: Internet :: WWW/HTTP :: Session',
+]
+description = 'Authenticate to Django with JSON Web Tokens (JWTs) signed by Cloudflare Access'
+dependencies = [
+    'cryptography',
+    'pyjwt',
+    'requests',
+]
+dynamic = ['version']
+name = 'allowedflare'
+readme = 'README.md'
+
+[project.urls]
+Homepage = 'https://github.com/covracer/allowedflare'
+
+[tool.black]
+line-length = 100
+skip-magic-trailing-comma = true
+skip-string-normalization = true
+
+[tool.django-stubs]
+django_settings_module = 'demodj.settings'
+
+[tool.ruff]
+line-length = 100
+
+[tool.mypy]
+plugins = ['mypy_django_plugin.main']
+
+[tool.setuptools]
+packages = ['django_allowedflare']
+
+[tool.setuptools_scm]

allowedflare-2023.47.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+