attocode-code-intel 0.1.0__py3-none-any.whl

attocode_intel/api/auth/__init__.py

@@ -0,0 +1,128 @@
+"""Authentication package — unified auth resolution for local and service modes."""
+
+from __future__ import annotations
+
+import time
+from typing import TYPE_CHECKING
+
+from fastapi import Header, HTTPException
+
+from attocode_intel.api.deps import get_config
+
+if TYPE_CHECKING:
+    from attocode_intel.api.auth.context import AuthContext
+
+# In-memory revocation cache (jti → expiry_monotonic)
+_revocation_cache: dict[str, float] = {}
+_REVOCATION_CACHE_TTL = 30  # seconds
+_revocation_cache_refreshed_at: float = 0.0
+
+
+async def verify_api_key(authorization: str | None = Header(None)) -> None:
+    """Legacy API key verification (local mode).
+
+    If ATTOCODE_API_KEY is not set, all requests are allowed (local mode).
+    """
+    config = get_config()
+    if not config.api_key:
+        return
+    if not authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+    token = authorization.removeprefix("Bearer ").strip()
+    if token != config.api_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+
+
+async def verify_auth(authorization: str | None = Header(None)) -> None:
+    """Router-level auth guard — delegates to resolve_auth, discards AuthContext."""
+    await resolve_auth(authorization)
+
+
+async def _is_token_revoked(jti: str) -> bool:
+    """Check if a JWT's jti is in the revocation blocklist.
+
+    Uses a 30-second in-memory cache to avoid per-request DB hits.
+    """
+    global _revocation_cache_refreshed_at
+
+    now = time.monotonic()
+
+    # Refresh cache if stale
+    if now - _revocation_cache_refreshed_at > _REVOCATION_CACHE_TTL:
+        try:
+            from attocode_intel.db.engine import get_session
+            from attocode_intel.db.models import RevokedToken
+
+            from sqlalchemy import select
+
+            async for session in get_session():
+                result = await session.execute(select(RevokedToken.jti))
+                _revocation_cache.clear()
+                for row in result:
+                    _revocation_cache[row[0]] = now + _REVOCATION_CACHE_TTL
+                _revocation_cache_refreshed_at = now
+                break
+        except Exception:
+            pass  # If DB is unavailable, use stale cache
+
+    return jti in _revocation_cache
+
+
+async def resolve_auth(authorization: str | None = Header(None)) -> AuthContext:
+    """Unified auth resolver — delegates to legacy or service path based on config.
+
+    In local mode: verifies static API key, returns a stub AuthContext.
+    In service mode: tries JWT first, then service API key resolution.
+    """
+    from attocode_intel.api.auth.context import AuthContext
+
+    config = get_config()
+
+    if not config.is_service_mode:
+        # Local mode — delegate to legacy check
+        await verify_api_key(authorization)
+        return AuthContext(auth_method="legacy")
+
+    # Service mode — try JWT, then API key
+    if not authorization:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    token = authorization.removeprefix("Bearer ").strip()
+    if not token:
+        raise HTTPException(status_code=401, detail="Authorization header required")
+
+    # Try JWT first
+    from attocode_intel.api.auth.jwt import decode_token
+
+    payload = decode_token(token)
+    if payload is not None:
+        if payload.get("type", "access") != "access":
+            raise HTTPException(status_code=401, detail="Access token required")
+        import uuid
+
+        # Check revocation blocklist
+        jti = payload.get("jti")
+        if jti and await _is_token_revoked(jti):
+            raise HTTPException(status_code=401, detail="Token has been revoked")
+
+        try:
+            user_id = uuid.UUID(payload["sub"])
+            org_id = uuid.UUID(payload["org"]) if payload.get("org") else None
+        except (KeyError, TypeError, ValueError, AttributeError) as exc:
+            raise HTTPException(status_code=401, detail="Invalid token identity") from exc
+        return AuthContext(
+            user_id=user_id,
+            org_id=org_id,
+            scopes=payload.get("scopes", []),
+            auth_method="jwt",
+            plan=payload.get("plan", "free"),
+        )
+
+    # Try API key
+    from attocode_intel.api.auth.api_keys import resolve_api_key
+
+    ctx = await resolve_api_key(token)
+    if ctx is not None:
+        return ctx
+
+    raise HTTPException(status_code=401, detail="Invalid credentials")

attocode_intel/api/auth/api_keys.py

@@ -0,0 +1,61 @@
+"""Service API key generation and resolution."""
+
+from __future__ import annotations
+
+import hashlib
+import secrets
+from datetime import datetime, timezone
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from attocode_intel.api.auth.context import AuthContext
+
+
+def generate_api_key() -> tuple[str, str, str]:
+    """Generate a new API key.
+
+    Returns:
+        (plaintext_key, key_hash, key_prefix) — show plaintext once, store hash.
+    """
+    plaintext = f"aci_{secrets.token_urlsafe(32)}"
+    key_hash = hashlib.sha256(plaintext.encode()).hexdigest()
+    key_prefix = plaintext[:12]
+    return plaintext, key_hash, key_prefix
+
+
+async def resolve_api_key(token: str) -> AuthContext | None:
+    """Look up a service API key by its SHA-256 hash. Returns AuthContext or None."""
+    import hashlib
+
+    from sqlalchemy import select
+
+    from attocode_intel.api.auth.context import AuthContext
+    from attocode_intel.db.engine import get_session
+    from attocode_intel.db.models import ApiKey
+
+    key_hash = hashlib.sha256(token.encode()).hexdigest()
+
+    async for session in get_session():
+        result = await session.execute(
+            select(ApiKey).where(ApiKey.key_hash == key_hash)
+        )
+        api_key = result.scalar_one_or_none()
+        if api_key is None:
+            return None
+
+        # Check expiry
+        if api_key.expires_at and api_key.expires_at < datetime.now(timezone.utc):
+            return None
+
+        # Update last_used_at
+        api_key.last_used_at = datetime.now(timezone.utc)
+        await session.commit()
+
+        return AuthContext(
+            user_id=api_key.user_id,
+            org_id=api_key.org_id,
+            scopes=list(api_key.scopes) if api_key.scopes else [],
+            auth_method="api_key",
+            plan="free",
+        )
+    return None

attocode_intel/api/auth/context.py

@@ -0,0 +1,34 @@
+"""Authentication context — carries identity info through request lifecycle."""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+
+
+@dataclass(slots=True)
+class AuthContext:
+    """Identity and authorization context for an authenticated request."""
+
+    user_id: uuid.UUID | None = None
+    org_id: uuid.UUID | None = None
+    scopes: list[str] = field(default_factory=list)
+    auth_method: str = "legacy"  # legacy|jwt|api_key
+    plan: str = "free"  # free|team|enterprise
+
+    def has_scope(self, scope: str) -> bool:
+        """Check if the context has a specific scope."""
+        if not self.scopes:
+            return True  # Empty scopes = full access (legacy mode)
+        return scope in self.scopes
+
+    def require_scope(self, scope: str) -> None:
+        """Raise if the required scope is missing."""
+        if not self.has_scope(scope):
+            from fastapi import HTTPException
+
+            raise HTTPException(status_code=403, detail=f"Missing scope: {scope}")
+
+    def require_role(self, org_id: uuid.UUID, min_role: str) -> None:
+        """Placeholder for role checks — actual check done in route handlers."""
+        pass

attocode_intel/api/auth/jwt.py

@@ -0,0 +1,66 @@
+"""JWT token creation and validation."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from datetime import datetime, timedelta, timezone
+
+logger = logging.getLogger(__name__)
+
+
+def create_access_token(
+    user_id: uuid.UUID,
+    org_id: uuid.UUID | None = None,
+    scopes: list[str] | None = None,
+    plan: str = "free",
+    expires_minutes: int = 60,
+) -> str:
+    """Create a signed JWT access token."""
+    from jose import jwt
+
+    from attocode_intel.api.deps import get_config
+
+    config = get_config()
+    now = datetime.now(timezone.utc)
+    payload = {
+        "sub": str(user_id),
+        "type": "access",
+        "scopes": scopes or [],
+        "plan": plan,
+        "iat": now,
+        "exp": now + timedelta(minutes=expires_minutes),
+    }
+    if org_id:
+        payload["org"] = str(org_id)
+    return jwt.encode(payload, config.secret_key, algorithm="HS256")
+
+
+def create_refresh_token(user_id: uuid.UUID, expires_days: int = 30) -> str:
+    """Create a signed JWT refresh token."""
+    from jose import jwt
+
+    from attocode_intel.api.deps import get_config
+
+    config = get_config()
+    now = datetime.now(timezone.utc)
+    payload = {
+        "sub": str(user_id),
+        "type": "refresh",
+        "iat": now,
+        "exp": now + timedelta(days=expires_days),
+    }
+    return jwt.encode(payload, config.secret_key, algorithm="HS256")
+
+
+def decode_token(token: str) -> dict | None:
+    """Decode and validate a JWT token. Returns payload dict or None if invalid."""
+    from jose import JWTError, jwt
+
+    from attocode_intel.api.deps import get_config
+
+    config = get_config()
+    try:
+        return jwt.decode(token, config.secret_key, algorithms=["HS256"])
+    except JWTError:
+        return None

attocode_intel/api/auth/oauth.py

@@ -0,0 +1,146 @@
+"""OAuth 2.0 authorization code flows (GitHub + Google)."""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    pass
+
+logger = logging.getLogger(__name__)
+
+GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize"
+GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token"
+GITHUB_USER_URL = "https://api.github.com/user"
+
+GOOGLE_AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
+GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo"
+
+
+async def get_github_auth_url(client_id: str, redirect_uri: str, state: str) -> str:
+    """Build the GitHub OAuth authorization URL."""
+    import urllib.parse
+
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "scope": "user:email",
+        "state": state,
+    }
+    return f"{GITHUB_AUTHORIZE_URL}?{urllib.parse.urlencode(params)}"
+
+
+async def exchange_github_code(
+    code: str,
+    client_id: str,
+    client_secret: str,
+) -> dict:
+    """Exchange authorization code for access token and fetch user info.
+
+    Returns dict with keys: github_id, email, name, avatar_url.
+    """
+    import httpx
+
+    async with httpx.AsyncClient() as client:
+        # Exchange code for token
+        token_resp = await client.post(
+            GITHUB_TOKEN_URL,
+            data={
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "code": code,
+            },
+            headers={"Accept": "application/json"},
+        )
+        token_resp.raise_for_status()
+        token_data = token_resp.json()
+        access_token = token_data["access_token"]
+
+        # Fetch user profile
+        user_resp = await client.get(
+            GITHUB_USER_URL,
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        user_resp.raise_for_status()
+        user_data = user_resp.json()
+
+        # Fetch email if not public
+        email = user_data.get("email")
+        if not email:
+            email_resp = await client.get(
+                "https://api.github.com/user/emails",
+                headers={"Authorization": f"Bearer {access_token}"},
+            )
+            email_resp.raise_for_status()
+            emails = email_resp.json()
+            primary = next((e for e in emails if e.get("primary")), None)
+            email = primary["email"] if primary else emails[0]["email"]
+
+        return {
+            "github_id": user_data["id"],
+            "email": email,
+            "name": user_data.get("name") or user_data.get("login", ""),
+            "avatar_url": user_data.get("avatar_url", ""),
+        }
+
+
+async def get_google_auth_url(client_id: str, redirect_uri: str, state: str) -> str:
+    """Build the Google OAuth authorization URL."""
+    import urllib.parse
+
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "scope": "openid email profile",
+        "state": state,
+        "response_type": "code",
+        "access_type": "offline",
+        "prompt": "consent",
+    }
+    return f"{GOOGLE_AUTHORIZE_URL}?{urllib.parse.urlencode(params)}"
+
+
+async def exchange_google_code(
+    code: str,
+    client_id: str,
+    client_secret: str,
+    redirect_uri: str,
+) -> dict:
+    """Exchange authorization code for access token and fetch user info.
+
+    Returns dict with keys: google_id, email, name, avatar_url.
+    """
+    import httpx
+
+    async with httpx.AsyncClient() as client:
+        # Exchange code for token (Google requires form-encoded, not JSON)
+        token_resp = await client.post(
+            GOOGLE_TOKEN_URL,
+            data={
+                "code": code,
+                "client_id": client_id,
+                "client_secret": client_secret,
+                "redirect_uri": redirect_uri,
+                "grant_type": "authorization_code",
+            },
+        )
+        token_resp.raise_for_status()
+        token_data = token_resp.json()
+        access_token = token_data["access_token"]
+
+        # Fetch user profile
+        user_resp = await client.get(
+            GOOGLE_USERINFO_URL,
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        user_resp.raise_for_status()
+        user_data = user_resp.json()
+
+        return {
+            "google_id": user_data["sub"],
+            "email": user_data["email"],
+            "name": user_data.get("name", ""),
+            "avatar_url": user_data.get("picture", ""),
+        }

attocode_intel/api/auth/passwords.py

@@ -0,0 +1,15 @@
+"""Password hashing and verification via bcrypt."""
+
+from __future__ import annotations
+
+import bcrypt
+
+
+def hash_password(password: str) -> str:
+    """Hash a plaintext password with bcrypt."""
+    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    """Verify a plaintext password against a bcrypt hash."""
+    return bcrypt.checkpw(plain.encode(), hashed.encode())