auditize 0.2.1__py3-none-any.whl

auditize/__init__.py

@@ -0,0 +1,4 @@
+# Shortcut for ASGI server, the entrypoint is: auditize:asgi
+from .app import app_factory as asgi
+
+__version__ = "0.2.1"

auditize/__main__.py

@@ -0,0 +1,212 @@
+import argparse
+import asyncio
+import getpass
+import json
+import platform
+import sys
+
+import uvicorn
+
+from auditize import __version__
+from auditize.app import build_api_app, build_app
+from auditize.config import get_config, init_config
+from auditize.database import init_dbm
+from auditize.exceptions import (
+    ConfigAlreadyInitialized,
+    ConfigError,
+    ConstraintViolation,
+)
+from auditize.openapi import get_customized_openapi_schema
+from auditize.permissions.models import Permissions
+from auditize.scheduler import build_scheduler
+from auditize.user.models import User
+from auditize.user.service import (
+    get_users,
+    hash_user_password,
+    save_user,
+)
+
+
+def _lazy_init(*, skip_dbm_init=False):
+    try:
+        init_config()
+    except ConfigAlreadyInitialized:
+        # this case corresponds to tests where config and dbm are already initialized
+        return
+    except ConfigError as exc:
+        sys.exit("ERROR: " + str(exc))
+
+    if not skip_dbm_init:
+        init_dbm()
+
+
+def _get_password() -> str:
+    password = getpass.getpass("Password: ")
+    confirm = getpass.getpass("Confirm password: ")
+
+    if password != confirm:
+        print("Passwords do not match, please try again.", file=sys.stderr)
+        print("", file=sys.stderr)
+        return _get_password()
+
+    return password
+
+
+async def _bootstrap_superadmin(
+    email: str, first_name: str, last_name: str, password: str
+):
+    await save_user(
+        User(
+            first_name=first_name,
+            last_name=last_name,
+            email=email,
+            password_hash=hash_user_password(password),
+            permissions=Permissions(is_superadmin=True),
+        ),
+    )
+
+
+async def bootstrap_superadmin(email: str, first_name: str, last_name: str):
+    _lazy_init()
+
+    password = _get_password()
+
+    try:
+        await _bootstrap_superadmin(email, first_name, last_name, password)
+    except ConstraintViolation:
+        sys.exit(f"Error: user with email {email} already exists")
+    print(f"User with email {email} has been successfully created")
+
+
+async def bootstrap_default_superadmin():
+    _lazy_init()
+
+    users, _ = await get_users(query=None, page=1, page_size=1)
+    if not users:
+        await _bootstrap_superadmin(
+            "super.admin@example.net", "Super", "Admin", "auditize"
+        )
+
+
+async def serve(host: str, port: int):
+    _lazy_init()
+    app = build_app()
+    config = uvicorn.Config(app, host=host, port=port)
+    server = uvicorn.Server(config)
+    await server.serve()
+
+
+async def schedule():
+    _lazy_init()
+    scheduler = build_scheduler()
+    scheduler.start()
+    print("Scheduler started")
+    try:
+        while True:
+            await asyncio.sleep(10)
+    except asyncio.CancelledError:
+        scheduler.shutdown()
+
+
+async def dump_config():
+    _lazy_init(skip_dbm_init=True)
+    config = get_config()
+    print(json.dumps(config.to_dict(), ensure_ascii=False, indent=4))
+
+
+async def dump_openapi():
+    print(
+        json.dumps(
+            get_customized_openapi_schema(
+                build_api_app(cors_allow_origins=[], online_doc=False),
+                include_internal_routes=False,
+            ),
+            ensure_ascii=False,
+            indent=4,
+        )
+    )
+
+
+async def version():
+    print(
+        "auditize version %s (using Python %s - %s)"
+        % (__version__, platform.python_version(), sys.executable)
+    )
+
+
+async def async_main(args=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--version", "-v", action="store_true", help="Print version information"
+    )
+    sub_parsers = parser.add_subparsers()
+
+    # CMD bootstrap-default-superadmin
+    bootstrap_default_superadmin_parser = sub_parsers.add_parser(
+        "bootstrap-default-superadmin",
+        help="Bootstrap a default superadmin user if no users exist",
+    )
+    bootstrap_default_superadmin_parser.set_defaults(
+        func=lambda _: bootstrap_default_superadmin()
+    )
+
+    # CMD bootstrap-superadmin
+    bootstrap_superadmin_parser = sub_parsers.add_parser(
+        "bootstrap-superadmin", help="Create a superadmin user"
+    )
+    bootstrap_superadmin_parser.add_argument("email")
+    bootstrap_superadmin_parser.add_argument("first_name")
+    bootstrap_superadmin_parser.add_argument("last_name")
+    bootstrap_superadmin_parser.set_defaults(
+        func=lambda cmd_args: bootstrap_superadmin(
+            cmd_args.email, cmd_args.first_name, cmd_args.last_name
+        )
+    )
+
+    # CMD serve
+    serve_parser = sub_parsers.add_parser("serve", help="Serve the application")
+    serve_parser.add_argument("--host", default="127.0.0.1")
+    serve_parser.add_argument("--port", default=8000, type=int)
+    serve_parser.set_defaults(func=lambda cmd_args: serve(cmd_args.host, cmd_args.port))
+
+    # CMD schedule
+    schedule_parser = sub_parsers.add_parser(
+        "schedule", help="Schedule Auditize periodic tasks"
+    )
+    schedule_parser.set_defaults(func=lambda _: schedule())
+
+    # CMD config
+    config_parser = sub_parsers.add_parser(
+        "config", help="Dump the Auditize configuration as JSON"
+    )
+    config_parser.set_defaults(func=lambda _: dump_config())
+
+    # CMD openapi
+    openapi_parser = sub_parsers.add_parser("openapi", help="Dump the OpenAPI schema")
+    openapi_parser.set_defaults(func=lambda _: dump_openapi())
+
+    # CMD version
+    version_parser = sub_parsers.add_parser("version", help="Print version information")
+    version_parser.set_defaults(func=lambda _: version())
+
+    parsed_args = parser.parse_args(args)
+
+    if parsed_args.version:
+        await version()
+        return 0
+
+    if not hasattr(parsed_args, "func"):
+        parser.print_help()
+        return 1
+
+    await parsed_args.func(parsed_args)
+
+    return 0
+
+
+def main(args=None):
+    return asyncio.run(async_main(args))
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

auditize/apikey/api.py

@@ -0,0 +1,143 @@
+from typing import Annotated
+from uuid import UUID
+
+from fastapi import APIRouter, Depends
+
+from auditize.apikey import service
+from auditize.apikey.api_models import (
+    ApikeyCreationRequest,
+    ApikeyCreationResponse,
+    ApikeyListResponse,
+    ApikeyReadingResponse,
+    ApikeyRegenerationResponse,
+    ApikeyUpdateRequest,
+)
+from auditize.apikey.models import Apikey, ApikeyUpdate
+from auditize.auth.authorizer import Authenticated, Authorized
+from auditize.exceptions import PermissionDenied
+from auditize.helpers.api.errors import error_responses
+from auditize.permissions.assertions import (
+    can_read_apikey,
+    can_write_apikey,
+)
+from auditize.permissions.operations import authorize_grant
+from auditize.resource.api_models import ResourceSearchParams
+from auditize.resource.pagination.page.api_models import PagePaginationParams
+
+router = APIRouter(responses=error_responses(401, 403))
+
+
+def _ensure_cannot_alter_own_apikey(authorized: Authenticated, apikey_id: UUID):
+    if authorized.apikey and authorized.apikey.id == apikey_id:
+        raise PermissionDenied("Cannot alter own apikey")
+
+
+@router.post(
+    "/apikeys",
+    summary="Create API key",
+    description="Requires `apikey:write` permission.",
+    operation_id="create_apikey",
+    tags=["apikey"],
+    status_code=201,
+    responses=error_responses(400, 409),
+)
+async def create_apikey(
+    authorized: Authorized(can_write_apikey()),
+    apikey: ApikeyCreationRequest,
+) -> ApikeyCreationResponse:
+    apikey_model = Apikey.model_validate(apikey.model_dump())
+    authorize_grant(authorized.permissions, apikey_model.permissions)
+    apikey_id, key = await service.create_apikey(apikey_model)
+    return ApikeyCreationResponse(id=apikey_id, key=key)
+
+
+@router.patch(
+    "/apikeys/{apikey_id}",
+    summary="Update API key",
+    description="Requires `apikey:write` permission.",
+    operation_id="update_apikey",
+    tags=["apikey"],
+    status_code=204,
+    responses=error_responses(400, 404, 409),
+)
+async def update_apikey(
+    authorized: Authorized(can_write_apikey()),
+    apikey_id: UUID,
+    apikey: ApikeyUpdateRequest,
+):
+    _ensure_cannot_alter_own_apikey(authorized, apikey_id)
+    apikey_model = ApikeyUpdate.model_validate(apikey.model_dump(exclude_unset=True))
+    if apikey_model.permissions:
+        authorize_grant(authorized.permissions, apikey_model.permissions)
+    await service.update_apikey(apikey_id, apikey_model)
+
+
+@router.get(
+    "/apikeys/{apikey_id}",
+    summary="Get API key",
+    description="Requires `apikey:read` permission.",
+    operation_id="get_apikey",
+    tags=["apikey"],
+    responses=error_responses(404),
+)
+async def get_repo(
+    authorized: Authorized(can_read_apikey()),
+    apikey_id: UUID,
+) -> ApikeyReadingResponse:
+    apikey = await service.get_apikey(apikey_id)
+    return ApikeyReadingResponse.model_validate(apikey.model_dump())
+
+
+@router.get(
+    "/apikeys",
+    summary="List API keys",
+    description="Requires `apikey:read` permission.",
+    operation_id="list_apikeys",
+    tags=["apikey"],
+)
+async def list_apikeys(
+    authorized: Authorized(can_read_apikey()),
+    search_params: Annotated[ResourceSearchParams, Depends()],
+    page_params: Annotated[PagePaginationParams, Depends()],
+) -> ApikeyListResponse:
+    apikeys, page_info = await service.get_apikeys(
+        query=search_params.query,
+        page=page_params.page,
+        page_size=page_params.page_size,
+    )
+    return ApikeyListResponse.build(apikeys, page_info)
+
+
+@router.delete(
+    "/apikeys/{apikey_id}",
+    summary="Delete API key",
+    description="Requires `apikey:write` permission.",
+    operation_id="delete_apikey",
+    tags=["apikey"],
+    status_code=204,
+    responses=error_responses(404),
+)
+async def delete_apikey(
+    authorized: Authorized(can_write_apikey()),
+    apikey_id: UUID,
+):
+    _ensure_cannot_alter_own_apikey(authorized, apikey_id)
+    await service.delete_apikey(apikey_id)
+
+
+@router.post(
+    "/apikeys/{apikey_id}/key",
+    summary="Re-generate API key secret",
+    description="Requires `apikey:write` permission.",
+    operation_id="generate_apikey_new_secret",
+    tags=["apikey"],
+    status_code=200,
+    responses=error_responses(404),
+)
+async def regenerate_apikey(
+    authorized: Authorized(can_write_apikey()),
+    apikey_id: UUID,
+) -> ApikeyRegenerationResponse:
+    _ensure_cannot_alter_own_apikey(authorized, apikey_id)
+    key = await service.regenerate_apikey(apikey_id)
+    return ApikeyRegenerationResponse(key=key)

auditize/apikey/api_models.py

@@ -0,0 +1,84 @@
+from datetime import datetime
+from uuid import UUID
+
+from pydantic import BaseModel, Field
+
+from auditize.apikey.models import Apikey
+from auditize.permissions.api_models import PermissionsInputData, PermissionsOutputData
+from auditize.resource.api_models import HasDatetimeSerialization, IdField
+from auditize.resource.pagination.page.api_models import PagePaginatedResponse
+
+
+def _ApikeyNameField(**kwargs):  # noqa
+    return Field(
+        description="The API key name",
+        json_schema_extra={"example": "Integration API key"},
+        **kwargs,
+    )
+
+
+def _ApikeyIdField():  # noqa
+    return IdField(description="API key ID")
+
+
+def _ApikeyKeyField(description="The API key secret", **kwargs):  # noqa
+    return Field(
+        description=description,
+        json_schema_extra={
+            "example": "aak-_euGzb85ZisAZtwx8d78NtC1ohK5suU7-u_--jIENlU"
+        },
+        **kwargs,
+    )
+
+
+def _ApikeyPermissionsField(**kwargs):  # noqa
+    return Field(
+        description="The API key permissions",
+        **kwargs,
+    )
+
+
+class ApikeyCreationRequest(BaseModel):
+    name: str = _ApikeyNameField()
+    permissions: PermissionsInputData = _ApikeyPermissionsField(
+        default_factory=PermissionsInputData
+    )
+
+
+class ApikeyUpdateRequest(BaseModel):
+    name: str = _ApikeyNameField(default=None)
+    permissions: PermissionsInputData = _ApikeyPermissionsField(default=None)
+
+
+class ApikeyCreationResponse(BaseModel):
+    id: UUID = _ApikeyIdField()
+    key: str = _ApikeyKeyField()
+
+
+class ApikeyReadingResponse(BaseModel):
+    id: UUID = _ApikeyIdField()
+    name: str = _ApikeyNameField()
+    permissions: PermissionsOutputData = _ApikeyPermissionsField()
+
+
+class ApikeyListResponse(PagePaginatedResponse[Apikey, ApikeyReadingResponse]):
+    @classmethod
+    def build_item(cls, apikey: Apikey) -> ApikeyReadingResponse:
+        return ApikeyReadingResponse.model_validate(apikey.model_dump())
+
+
+class ApikeyRegenerationResponse(BaseModel):
+    key: str = _ApikeyKeyField(description="The new API key secret")
+
+
+class AccessTokenRequest(BaseModel):
+    permissions: PermissionsInputData = _ApikeyPermissionsField()
+
+
+class AccessTokenResponse(BaseModel, HasDatetimeSerialization):
+    access_token: str = Field(
+        description="The access token",
+    )
+    expires_at: datetime = Field(
+        description="The access token expiration time",
+    )

auditize/apikey/models.py

@@ -0,0 +1,17 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field
+
+from auditize.permissions.models import Permissions
+from auditize.resource.models import HasCreatedAt, HasId
+
+
+class Apikey(BaseModel, HasId, HasCreatedAt):
+    name: str
+    key_hash: Optional[str] = Field(default=None)
+    permissions: Permissions = Field(default_factory=Permissions)
+
+
+class ApikeyUpdate(BaseModel):
+    name: str = None
+    permissions: Permissions = None

auditize/apikey/service.py

@@ -0,0 +1,103 @@
+import hashlib
+import secrets
+from uuid import UUID
+
+from auditize.apikey.models import Apikey, ApikeyUpdate
+from auditize.auth.constants import APIKEY_SECRET_PREFIX
+from auditize.database import get_dbm
+from auditize.exceptions import enhance_constraint_violation_exception
+from auditize.permissions.operations import normalize_permissions, update_permissions
+from auditize.permissions.service import remove_repo_from_permissions
+from auditize.repo.service import ensure_repos_in_permissions_exist
+from auditize.resource.pagination.page.models import PagePaginationInfo
+from auditize.resource.pagination.page.service import find_paginated_by_page
+from auditize.resource.service import (
+    create_resource_document,
+    delete_resource_document,
+    get_resource_document,
+    update_resource_document,
+)
+
+
+def _hash_key(key: str) -> str:
+    # Generate a non-salted hash of the key, so it can be looked up afterward
+    return hashlib.sha256(key.encode()).hexdigest()
+
+
+def _generate_key() -> tuple[str, str]:
+    value = APIKEY_SECRET_PREFIX + secrets.token_urlsafe(32)
+    return value, _hash_key(value)
+
+
+async def create_apikey(apikey: Apikey) -> tuple[UUID, str]:
+    await ensure_repos_in_permissions_exist(apikey.permissions)
+    key, key_hash = _generate_key()
+    with enhance_constraint_violation_exception("error.constraint_violation.apikey"):
+        apikey_id = await create_resource_document(
+            get_dbm().core_db.apikeys,
+            {
+                **apikey.model_dump(exclude={"id", "key_hash", "permissions"}),
+                "key_hash": key_hash,
+                "permissions": normalize_permissions(apikey.permissions).model_dump(),
+            },
+        )
+    return apikey_id, key
+
+
+async def update_apikey(apikey_id: UUID, update: ApikeyUpdate):
+    doc_update = update.model_dump(exclude_unset=True, exclude={"permissions"})
+    if update.permissions:
+        apikey = await get_apikey(apikey_id)
+        apikey_permissions = update_permissions(apikey.permissions, update.permissions)
+        await ensure_repos_in_permissions_exist(apikey_permissions)
+        doc_update["permissions"] = apikey_permissions.model_dump()
+
+    with enhance_constraint_violation_exception("error.constraint_violation.apikey"):
+        await update_resource_document(get_dbm().core_db.apikeys, apikey_id, doc_update)
+
+
+async def regenerate_apikey(apikey_id: UUID) -> str:
+    dbm = get_dbm()
+    key, key_hash = _generate_key()
+    await update_resource_document(
+        dbm.core_db.apikeys, apikey_id, {"key_hash": key_hash}
+    )
+    return key
+
+
+async def _get_apikey(filter: any) -> Apikey:
+    dbm = get_dbm()
+    result = await get_resource_document(dbm.core_db.apikeys, filter)
+    return Apikey.model_validate(result)
+
+
+async def get_apikey(apikey_id: UUID) -> Apikey:
+    return await _get_apikey(apikey_id)
+
+
+async def get_apikey_by_key(key: str) -> Apikey:
+    return await _get_apikey({"key_hash": _hash_key(key)})
+
+
+async def get_apikeys(
+    query: str, page: int, page_size: int
+) -> tuple[list[Apikey], PagePaginationInfo]:
+    dbm = get_dbm()
+    results, page_info = await find_paginated_by_page(
+        dbm.core_db.apikeys,
+        filter={"$text": {"$search": query}} if query else None,
+        sort=[("name", 1)],
+        page=page,
+        page_size=page_size,
+    )
+    return [Apikey.model_validate(result) async for result in results], page_info
+
+
+async def delete_apikey(apikey_id: UUID):
+    dbm = get_dbm()
+    await delete_resource_document(dbm.core_db.apikeys, apikey_id)
+
+
+async def remove_repo_from_apikeys_permissions(repo_id: UUID):
+    dbm = get_dbm()
+    await remove_repo_from_permissions(dbm.core_db.apikeys, repo_id)

auditize/app/__init__.py

@@ -0,0 +1,48 @@
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+
+from auditize.app.app_api import build_app as build_api_app
+from auditize.app.app_static import build_app as build_static_app
+from auditize.app.cors import setup_cors
+from auditize.config import get_config, init_config
+from auditize.database import init_dbm
+
+__all__ = ("build_app", "build_api_app", "app_factory")
+
+
+@asynccontextmanager
+async def _setup_app(_):
+    dbm = init_dbm()
+    await dbm.setup()
+    yield
+
+
+def build_app():
+    # This function is intended to be used in a context where
+    # config and dbm have already been initialized
+    app = FastAPI(openapi_url=None)
+    config = get_config()
+    app.mount(
+        "/api",
+        build_api_app(
+            cors_allow_origins=config.cors_allow_origins, online_doc=config.online_doc
+        ),
+    )
+    app.mount("/", build_static_app(cors_allow_origins=config.cors_allow_origins))
+    return app
+
+
+def app_factory():
+    # This function is intended to be used with
+    # uvicorn auditize.app:app_factory --factory
+    config = init_config()
+    app = FastAPI(lifespan=_setup_app, openapi_url=None)
+    app.mount(
+        "/api",
+        build_api_app(
+            cors_allow_origins=config.cors_allow_origins, online_doc=config.online_doc
+        ),
+    )
+    app.mount("/", build_static_app(cors_allow_origins=config.cors_allow_origins))
+    return app

auditize/app/app_api.py

@@ -0,0 +1,42 @@
+from fastapi import APIRouter, FastAPI
+from fastapi.exceptions import RequestValidationError
+
+from auditize.apikey.api import router as apikey_api_router
+from auditize.app.cors import setup_cors
+from auditize.auth.api import router as auth_api_router
+from auditize.exceptions import AuditizeException
+from auditize.helpers.api.errors import (
+    make_response_from_exception,
+)
+from auditize.i18n import get_request_lang
+from auditize.log.api import router as log_api_router
+from auditize.log_filter.api import router as log_filter_api_router
+from auditize.log_i18n_profile.api import router as log_i18n_profile_api_router
+from auditize.openapi import customize_openapi
+from auditize.repo.api import router as repo_api_router
+from auditize.user.api import router as user_api_router
+
+
+def _exception_handler(request, exc):
+    return make_response_from_exception(exc, get_request_lang(request))
+
+
+def build_app(*, cors_allow_origins: list[str], online_doc: bool):
+    if online_doc:
+        app = FastAPI()
+    else:
+        app = FastAPI(openapi_url=None)
+    app.add_exception_handler(AuditizeException, _exception_handler)
+    app.add_exception_handler(RequestValidationError, _exception_handler)
+    customize_openapi(app)
+    router = APIRouter()
+    router.include_router(auth_api_router)
+    router.include_router(log_api_router)
+    router.include_router(repo_api_router)
+    router.include_router(user_api_router)
+    router.include_router(apikey_api_router)
+    router.include_router(log_i18n_profile_api_router)
+    router.include_router(log_filter_api_router)
+    app.include_router(router)
+    setup_cors(app, cors_allow_origins=cors_allow_origins)
+    return app

auditize/app/app_static.py

@@ -0,0 +1,25 @@
+import os.path as osp
+
+from fastapi import FastAPI
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import FileResponse
+from starlette.staticfiles import StaticFiles
+
+from auditize.app.cors import setup_cors
+
+_STATIC_DIR = osp.join(osp.dirname(__file__), osp.pardir, "data", "html")
+
+
+async def _index_html_redirection(request, call_next):
+    response = await call_next(request)
+    if response.status_code == 404:
+        return FileResponse(osp.join(_STATIC_DIR, "index.html"))
+    return response
+
+
+def build_app(*, cors_allow_origins: list[str]):
+    app = FastAPI(openapi_url=None)
+    app.mount("", StaticFiles(directory=_STATIC_DIR))
+    app.add_middleware(BaseHTTPMiddleware, dispatch=_index_html_redirection)
+    setup_cors(app, cors_allow_origins=cors_allow_origins)
+    return app

auditize/app/cors.py

@@ -0,0 +1,15 @@
+from fastapi import FastAPI
+from starlette.middleware.cors import CORSMiddleware
+
+
+def setup_cors(app: FastAPI, *, cors_allow_origins: list[str]):
+    if not cors_allow_origins:
+        return
+
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=cors_allow_origins,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )