apizit-cli 0.2.0b1__py3-none-any.whl

apizit_cli/__init__.py

@@ -0,0 +1,3 @@
+"""The APIZIT HTTP client. Importing this package never initializes a session."""
+
+__version__ = "0.2.0b1"

apizit_cli/authentication.py

@@ -0,0 +1,396 @@
+"""Native OAuth with PKCE, a loopback callback and an OS credential vault."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import sys
+import time
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import parse_qs, urlencode, urlsplit
+
+import requests
+
+from apizit_cli.credential_store import CredentialStore, session_lock
+from apizit_cli.errors import CliError, EXIT_AUTH, EXIT_NETWORK, EXIT_USAGE
+
+
+def system_vault():
+    try:
+        if sys.platform == "win32":
+            from keyring.backends.Windows import WinVaultKeyring
+
+            vault = WinVaultKeyring()
+        elif sys.platform == "darwin":
+            from keyring.backends.macOS import Keyring
+
+            vault = Keyring()
+        else:
+            from keyring.backends.SecretService import Keyring
+
+            vault = Keyring()
+        if vault.priority <= 0:
+            raise RuntimeError()
+        return vault
+    except Exception:
+        raise CliError(
+            "The system credential vault is unavailable. Unlock it, or use an injected CI token.",
+            code="CREDENTIAL_VAULT_UNAVAILABLE",
+            exit_code=EXIT_AUTH,
+        ) from None
+
+
+class NativeSession:
+    def __init__(self, origin, *, http=None, vault=None, injected_token=None):
+        self.origin = origin
+        self.http = http or requests.Session()
+        self.http.trust_env = False
+        self._vault = vault
+        self.injected_token = (
+            injected_token if injected_token is not None else os.getenv("APIZIT_TOKEN")
+        )
+        self.access_token = None
+        self.expires_at = 0
+        self._configuration = None
+        self.vault_service = "APIZIT CLI:" + origin
+
+    @property
+    def vault(self):
+        if self._vault is None:
+            self._vault = system_vault()
+        return self._vault
+
+    def configuration(self):
+        if self._configuration is not None:
+            return self._configuration
+        try:
+            response = self.http.get(
+                self.origin + "/auth/cli-configuration", timeout=20, allow_redirects=False
+            )
+            if response.status_code != 200:
+                raise ValueError()
+            value = response.json()
+            if not isinstance(value, dict) or not value.get("client_id"):
+                raise ValueError()
+            origins = set()
+            for field in ("authorization_endpoint", "token_endpoint", "revocation_endpoint"):
+                parsed = urlsplit(value[field])
+                if (
+                    parsed.scheme != "https"
+                    or not parsed.hostname
+                    or parsed.username
+                    or parsed.password
+                    or parsed.query
+                    or parsed.fragment
+                ):
+                    raise ValueError()
+                origins.add((parsed.scheme, parsed.netloc))
+            if len(origins) != 1:
+                raise ValueError()
+            callback = urlsplit(value["redirect_uri"])
+            if (
+                callback.scheme != "http"
+                or callback.hostname != "127.0.0.1"
+                or callback.username
+                or callback.password
+                or not callback.port
+                or not callback.path.startswith("/")
+                or callback.query
+                or callback.fragment
+            ):
+                raise ValueError()
+            self._configuration = value
+            return value
+        except (requests.RequestException, ValueError, KeyError, TypeError):
+            raise CliError(
+                "The APIZIT login configuration is unavailable.",
+                code="LOGIN_CONFIGURATION_UNAVAILABLE",
+                exit_code=EXIT_NETWORK,
+            ) from None
+
+    def _stored(self):
+        try:
+            value = CredentialStore(self.vault, self.vault_service).read()
+            saved = json.loads(value) if value else None
+            if saved is not None and (
+                not isinstance(saved, dict) or not isinstance(saved.get("refresh_token"), str)
+            ):
+                raise ValueError()
+            return saved
+        except CliError:
+            raise
+        except Exception:
+            raise CliError(
+                "The APIZIT session could not be read from the credential vault.",
+                code="CREDENTIAL_VAULT_UNAVAILABLE",
+                exit_code=EXIT_AUTH,
+            ) from None
+
+    def _save(self, tokens, configuration, *, previous=None):
+        refresh = tokens.get("refresh_token") or (previous or {}).get("refresh_token")
+        access = tokens.get("access_token")
+        expiry = tokens.get("expires_in")
+        if (
+            not isinstance(refresh, str)
+            or not refresh
+            or not isinstance(access, str)
+            or not access
+            or type(expiry) is not int
+            or expiry <= 0
+        ):
+            raise CliError(
+                "The login provider returned an incomplete session.",
+                code="LOGIN_RESPONSE_INVALID",
+                exit_code=EXIT_AUTH,
+            )
+        try:
+            CredentialStore(self.vault, self.vault_service).write(
+                json.dumps(
+                    {
+                        "refresh_token": refresh,
+                        "client_id": configuration["client_id"],
+                    }
+                ),
+            )
+        except CliError:
+            raise
+        except Exception:
+            raise CliError(
+                "The APIZIT session could not be saved securely.",
+                code="CREDENTIAL_VAULT_UNAVAILABLE",
+                exit_code=EXIT_AUTH,
+            ) from None
+        self.access_token = access
+        self.expires_at = time.monotonic() + expiry
+
+    def _token_request(self, configuration, data):
+        try:
+            response = self.http.post(
+                configuration["token_endpoint"], data=data, timeout=30, allow_redirects=False
+            )
+            if response.status_code != 200:
+                raise CliError(
+                    "The session was rejected. Run apizit login.",
+                    code="LOGIN_REQUIRED",
+                    exit_code=EXIT_AUTH,
+                )
+            result = response.json()
+            if not isinstance(result, dict):
+                raise ValueError()
+            return result
+        except (requests.RequestException, ValueError):
+            raise CliError(
+                "Could not reach the login provider.",
+                code="LOGIN_PROVIDER_UNAVAILABLE",
+                exit_code=EXIT_NETWORK,
+            ) from None
+
+    def token(self, *, force_refresh=False):
+        if self.injected_token:
+            if (
+                any(char.isspace() for char in self.injected_token)
+                or len(self.injected_token) > 8192
+            ):
+                raise CliError(
+                    "Injected APIZIT token is invalid.", code="INVALID_TOKEN", exit_code=EXIT_AUTH
+                )
+            return self.injected_token
+        if self.access_token and not force_refresh and self.expires_at > time.monotonic() + 60:
+            return self.access_token
+        with session_lock(self.vault_service):
+            return self._renew()
+
+    def _renew(self):
+        saved = self._stored()
+        if not saved:
+            raise CliError(
+                "Sign in with apizit login or inject APIZIT_TOKEN.",
+                code="LOGIN_REQUIRED",
+                exit_code=EXIT_AUTH,
+            )
+        configuration = self.configuration()
+        if saved.get("client_id") != configuration["client_id"]:
+            raise CliError(
+                "The login configuration changed. Run apizit login.",
+                code="LOGIN_REQUIRED",
+                exit_code=EXIT_AUTH,
+            )
+        tokens = self._token_request(
+            configuration,
+            {
+                "grant_type": "refresh_token",
+                "client_id": configuration["client_id"],
+                "refresh_token": saved["refresh_token"],
+            },
+        )
+        self._save(tokens, configuration, previous=saved)
+        return self.access_token
+
+    def login(self, *, open_browser=True, non_interactive=False, timeout=180):
+        if non_interactive:
+            raise CliError(
+                "Interactive login is unavailable in non-interactive mode. Inject a CI token.",
+                code="INTERACTION_REQUIRED",
+                exit_code=EXIT_USAGE,
+            )
+        if self.injected_token:
+            raise CliError(
+                "Unset the injected token before starting an interactive login.",
+                code="INJECTED_TOKEN_ACTIVE",
+                exit_code=EXIT_USAGE,
+            )
+        configuration = self.configuration()
+        self.vault  # Fail before OAuth if secure persistence is unavailable.
+        state = secrets.token_urlsafe(32)
+        verifier = secrets.token_urlsafe(64)
+        challenge = (
+            base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest())
+            .rstrip(b"=")
+            .decode()
+        )
+        callback = urlsplit(configuration["redirect_uri"])
+        outcome = {}
+        deadline = time.monotonic() + timeout
+
+        class Callback(BaseHTTPRequestHandler):
+            def setup(self):
+                self.request.settimeout(max(0.1, min(3.0, deadline - time.monotonic())))
+                super().setup()
+
+            def do_GET(self):
+                parsed = urlsplit(self.path)
+                try:
+                    query = parse_qs(parsed.query, max_num_fields=8, strict_parsing=True)
+                except ValueError:
+                    query = {}
+                valid = (
+                    parsed.path == callback.path
+                    and not parsed.scheme
+                    and not parsed.netloc
+                    and self.headers.get("Host") == callback.netloc
+                    and len(query.get("state", [])) == 1
+                    and hmac.compare_digest(query["state"][0].encode("utf-8"), state.encode())
+                    and not ("code" in query and "error" in query)
+                    and (
+                        (len(query.get("code", [])) == 1 and 0 < len(query["code"][0]) <= 4096)
+                        or (len(query.get("error", [])) == 1 and 0 < len(query["error"][0]) <= 256)
+                    )
+                )
+                if valid and len(query.get("code", [])) == 1 and 0 < len(query["code"][0]) <= 4096:
+                    outcome["code"] = query["code"][0]
+                elif valid and "error" in query:
+                    outcome["error"] = True
+                self.send_response(200 if valid else 400)
+                self.send_header("Content-Type", "text/plain; charset=utf-8")
+                self.send_header("Cache-Control", "no-store")
+                self.send_header("Content-Security-Policy", "default-src 'none'")
+                self.end_headers()
+                self.wfile.write(
+                    b"Return to the APIZIT terminal." if valid else b"Invalid login callback."
+                )
+
+            def log_message(self, *_args):
+                pass
+
+        try:
+            server = HTTPServer(("127.0.0.1", callback.port), Callback)
+        except OSError:
+            raise CliError(
+                "The local login callback port is unavailable. Close the other login and retry.",
+                code="LOGIN_CALLBACK_UNAVAILABLE",
+                exit_code=EXIT_AUTH,
+            ) from None
+        url = (
+            configuration["authorization_endpoint"]
+            + "?"
+            + urlencode(
+                {
+                    "response_type": "code",
+                    "client_id": configuration["client_id"],
+                    "redirect_uri": configuration["redirect_uri"],
+                    "state": state,
+                    "scope": " ".join(configuration["scopes"]),
+                    "code_challenge": challenge,
+                    "code_challenge_method": "S256",
+                }
+            )
+        )
+        print("Complete APIZIT sign-in in your browser:\n" + url, file=sys.stderr)
+        try:
+            if open_browser:
+                webbrowser.open(url)
+            server.timeout = 1
+            while not outcome and time.monotonic() < deadline:
+                server.handle_request()
+        finally:
+            server.server_close()
+        if "code" not in outcome:
+            raise CliError(
+                "Login was not completed. Run apizit login to retry.",
+                code="LOGIN_NOT_COMPLETED",
+                exit_code=EXIT_AUTH,
+            )
+        tokens = self._token_request(
+            configuration,
+            {
+                "grant_type": "authorization_code",
+                "code": outcome["code"],
+                "client_id": configuration["client_id"],
+                "redirect_uri": configuration["redirect_uri"],
+                "code_verifier": verifier,
+            },
+        )
+        with session_lock(self.vault_service):
+            self._save(tokens, configuration)
+        return {"signed_in": True}
+
+    def logout(self):
+        if self.injected_token:
+            raise CliError(
+                "An injected CI token is not a local session. Revoke it with token revoke, or unset APIZIT_TOKEN.",
+                code="INJECTED_TOKEN_ACTIVE",
+                exit_code=EXIT_USAGE,
+            )
+        with session_lock(self.vault_service):
+            return self._logout()
+
+    def _logout(self):
+        incomplete = False
+        try:
+            saved = self._stored()
+        except CliError:
+            saved, incomplete = None, True
+        revoked = not bool(saved) and not incomplete
+        try:
+            if saved:
+                configuration = self.configuration()
+                response = self.http.post(
+                    configuration["revocation_endpoint"],
+                    data={
+                        "token": saved["refresh_token"],
+                        "client_id": configuration["client_id"],
+                    },
+                    timeout=20,
+                    allow_redirects=False,
+                )
+                revoked = response.status_code == 200
+        except (requests.RequestException, CliError):
+            revoked = False
+        finally:
+            if saved or incomplete:
+                try:
+                    CredentialStore(self.vault, self.vault_service).delete()
+                except Exception:
+                    raise CliError(
+                        "The local session could not be removed from the vault.",
+                        code="CREDENTIAL_VAULT_UNAVAILABLE",
+                        exit_code=EXIT_AUTH,
+                    ) from None
+            self.access_token = None
+            self.expires_at = 0
+        return {"signed_out": True, "renewal_revoked": revoked}