auditize 0.2.1__py3-none-any.whl

auditize/auth/api.py

@@ -0,0 +1,83 @@
+from fastapi import APIRouter
+from starlette.responses import Response
+
+from auditize.apikey.api_models import AccessTokenRequest, AccessTokenResponse
+from auditize.auth.authorizer import (
+    AuthorizedApikey,
+    AuthorizedUser,
+)
+from auditize.auth.constants import ACCESS_TOKEN_PREFIX
+from auditize.auth.jwt import generate_access_token, generate_session_token
+from auditize.config import get_config
+from auditize.database import get_dbm
+from auditize.helpers.api.errors import error_responses
+from auditize.permissions.models import Permissions
+from auditize.permissions.operations import authorize_grant
+from auditize.user import service
+from auditize.user.api_models import UserAuthenticationRequest, UserMeResponse
+
+router = APIRouter()
+
+
+@router.post(
+    "/auth/user/login",
+    summary="User login",
+    operation_id="user_login",
+    tags=["auth", "internal"],
+    status_code=200,
+    responses=error_responses(400, 401),
+)
+async def login_user(
+    request: UserAuthenticationRequest,
+    response: Response,
+) -> UserMeResponse:
+    config = get_config()
+    user = await service.authenticate_user(request.email, request.password)
+    token, expires_at = generate_session_token(user.email)
+
+    response.set_cookie(
+        "session",
+        token,
+        expires=expires_at,
+        httponly=True,
+        samesite="strict",
+        secure=config.cookie_secure,
+    )
+
+    return UserMeResponse.from_user(user)
+
+
+@router.post(
+    "/auth/user/logout",
+    summary="User logout",
+    operation_id="user_logout",
+    tags=["auth", "internal"],
+    status_code=204,
+    responses=error_responses(401),
+)
+async def logout_user(
+    authorized: AuthorizedUser(),
+    response: Response,
+):
+    response.delete_cookie("session", httponly=True, samesite="strict", secure=True)
+
+
+@router.post(
+    "/auth/access-token",
+    summary="Generate access token",
+    operation_id="generate_access_token",
+    tags=["auth"],
+    status_code=200,
+    responses=error_responses(401, 403),
+)
+async def auth_access_token(
+    authorized: AuthorizedApikey(),
+    request: AccessTokenRequest,
+) -> AccessTokenResponse:
+    permissions = Permissions.model_validate(request.permissions.model_dump())
+    authorize_grant(authorized.permissions, permissions)
+    access_token, expires_at = generate_access_token(authorized.apikey.id, permissions)
+
+    return AccessTokenResponse(
+        access_token=ACCESS_TOKEN_PREFIX + access_token, expires_at=expires_at
+    )

auditize/auth/authorizer.py

@@ -0,0 +1,204 @@
+import dataclasses
+from typing import Annotated, Callable, Type
+from uuid import UUID
+
+from fastapi import Depends
+from starlette.requests import Request
+
+from auditize.apikey.models import Apikey
+from auditize.apikey.service import get_apikey, get_apikey_by_key
+from auditize.auth.constants import ACCESS_TOKEN_PREFIX, APIKEY_SECRET_PREFIX
+from auditize.auth.jwt import get_access_token_data, get_user_email_from_session_token
+from auditize.exceptions import (
+    AuthenticationFailure,
+    PermissionDenied,
+    UnknownModelException,
+)
+from auditize.permissions.assertions import (
+    PermissionAssertion,
+    can_read_logs,
+    can_write_logs,
+)
+from auditize.permissions.models import Permissions
+from auditize.permissions.operations import authorize_grant
+from auditize.user.models import User
+from auditize.user.service import get_user_by_email
+
+_BEARER_PREFIX = "Bearer "
+
+
+@dataclasses.dataclass
+class AccessToken:
+    apikey: Apikey
+    permissions: Permissions
+
+
+@dataclasses.dataclass
+class Authenticated:
+    name: str
+    user: User = None
+    apikey: Apikey = None
+    access_token: AccessToken = None
+
+    @classmethod
+    def from_user(cls, user: User):
+        return cls(name=user.email, user=user)
+
+    @classmethod
+    def from_apikey(cls, apikey: Apikey):
+        return cls(name=apikey.name, apikey=apikey)
+
+    @classmethod
+    def from_access_token(cls, access_token: AccessToken):
+        return cls(
+            name=f"Access token for API key {access_token.apikey.name!r}",
+            access_token=access_token,
+        )
+
+    @property
+    def permissions(self) -> Permissions:
+        if self.user:
+            return self.user.permissions
+        if self.apikey:
+            return self.apikey.permissions
+        if self.access_token:
+            return self.access_token.permissions
+        raise Exception(
+            "Authenticated is neither a user, an API key nor an access token"
+        )  # pragma: no cover
+
+    def comply(self, assertion: PermissionAssertion) -> bool:
+        return assertion(self.permissions)
+
+    def ensure_user(self):
+        if not self.user:
+            raise PermissionDenied("This operation is only available to users")
+
+    def ensure_apikey(self):
+        if not self.apikey:
+            raise PermissionDenied("This operation is only available to API keys")
+
+
+def _get_authorization_bearer(request: Request) -> str | None:
+    authorization = request.headers.get("Authorization")
+    if not authorization:
+        return None
+    if not authorization.startswith(_BEARER_PREFIX):
+        raise AuthenticationFailure("Authorization header is not a Bearer")
+    return authorization[len(_BEARER_PREFIX) :]
+
+
+async def authenticate_apikey(key: str) -> Authenticated:
+    try:
+        apikey = await get_apikey_by_key(key)
+    except UnknownModelException:
+        raise AuthenticationFailure("Invalid API key")
+
+    return Authenticated.from_apikey(apikey)
+
+
+async def authenticate_access_token(access_token: str) -> Authenticated:
+    jwt_token = access_token[len(ACCESS_TOKEN_PREFIX) :]
+    apikey_id, permissions = get_access_token_data(jwt_token)
+    try:
+        apikey = await get_apikey(apikey_id)
+    except UnknownModelException:
+        raise AuthenticationFailure(
+            "Invalid API key corresponding to access token is no longer valid"
+        )
+
+    # Make sure the permissions once granted do not exceed the ones of the original API key
+    try:
+        authorize_grant(apikey.permissions, permissions)
+    except PermissionDenied:
+        raise AuthenticationFailure(
+            "The access token has more permissions than the original API key"
+        )
+
+    return Authenticated.from_access_token(
+        AccessToken(apikey=apikey, permissions=permissions)
+    )
+
+
+async def authenticate_user(request: Request) -> Authenticated:
+    if not request.cookies:
+        raise AuthenticationFailure()
+
+    session_token = request.cookies.get("session")
+    if not session_token:
+        raise AuthenticationFailure()
+
+    user_email = get_user_email_from_session_token(session_token)
+    try:
+        user = await get_user_by_email(user_email)
+    except UnknownModelException:
+        raise AuthenticationFailure("User does no longer exist")
+
+    # to be used by the lang detection mechanism
+    request.state.auditize_lang = str(user.lang.value)
+
+    return Authenticated.from_user(user)
+
+
+async def get_authenticated(request: Request) -> Authenticated:
+    bearer = _get_authorization_bearer(request)
+    if bearer:
+        if bearer.startswith(APIKEY_SECRET_PREFIX):
+            return await authenticate_apikey(bearer)
+        if bearer.startswith(ACCESS_TOKEN_PREFIX):
+            return await authenticate_access_token(bearer)
+        raise AuthenticationFailure("Invalid bearer token")
+
+    return await authenticate_user(request)
+
+
+class _Authorized:
+    def __init__(self, assertion: PermissionAssertion = None):
+        self.assertion = assertion
+
+    def __call__(self, authenticated: Authenticated = Depends(get_authenticated)):
+        if self.assertion and not authenticated.comply(self.assertion):
+            raise PermissionDenied()
+        return authenticated
+
+
+class _AuthorizedUser(_Authorized):
+    def __call__(self, authenticated: Authenticated = Depends(get_authenticated)):
+        authenticated.ensure_user()
+        return super().__call__(authenticated)
+
+
+class _AuthorizedApikey(_Authorized):
+    def __call__(self, authenticated: Authenticated = Depends(get_authenticated)):
+        authenticated.ensure_apikey()
+        return super().__call__(authenticated)
+
+
+def _authorized_on_logs(assertion_func: Callable[[UUID], PermissionAssertion]):
+    def func(repo_id: UUID, authenticated: Authenticated = Depends(get_authenticated)):
+        assertion = assertion_func(repo_id)
+        if not authenticated.comply(assertion):
+            raise PermissionDenied()
+        return authenticated
+
+    return func
+
+
+def Authorized(assertion: PermissionAssertion = None) -> Type[Authenticated]:  # noqa
+    return Annotated[Authenticated, Depends(_Authorized(assertion))]
+
+
+def AuthorizedUser(assertion: PermissionAssertion = None) -> Type[Authenticated]:  # noqa
+    return Annotated[Authenticated, Depends(_AuthorizedUser(assertion))]
+
+
+def AuthorizedApikey(assertion: PermissionAssertion = None) -> Type[Authenticated]:  # noqa
+    return Annotated[Authenticated, Depends(_AuthorizedApikey(assertion))]
+
+
+def AuthorizedForLogRead() -> Type[Authenticated]:  # noqa
+    return Annotated[Authenticated, Depends(_authorized_on_logs(can_read_logs))]
+
+
+def AuthorizedForLogWrite() -> Type[Authenticated]:  # noqa
+    return Annotated[Authenticated, Depends(_authorized_on_logs(can_write_logs))]

auditize/auth/constants.py

@@ -0,0 +1,2 @@
+APIKEY_SECRET_PREFIX = "aak-"
+ACCESS_TOKEN_PREFIX = "aat-"

auditize/auth/jwt.py

@@ -0,0 +1,102 @@
+import json
+from datetime import datetime, timedelta
+from uuid import UUID
+
+from authlib.jose import JsonWebToken
+from authlib.jose.errors import ExpiredTokenError, JoseError
+
+from auditize.config import get_config
+from auditize.exceptions import AuthenticationFailure
+from auditize.helpers.datetime import now
+from auditize.permissions.models import Permissions
+
+_SUB_PREFIX_SESSION_TOKEN = "user_email:"
+_SUB_PREFIX_ACCESS_TOKEN = "apikey_id:"
+
+jwt = JsonWebToken(["HS256"])
+
+
+def _generate_jwt_payload(data, lifetime) -> tuple[dict, datetime]:
+    expires_at = now() + timedelta(seconds=lifetime)
+    return {**data, "exp": expires_at}, expires_at
+
+
+def _sign_jwt_token(payload: dict) -> str:
+    value = jwt.encode({"alg": "HS256"}, payload, key=get_config().jwt_signing_key)
+    return value.decode()
+
+
+def _get_jwt_token_payload(token: str) -> dict:
+    # Load JWT token
+    try:
+        claims = jwt.decode(token, get_config().jwt_signing_key)
+        claims.validate()
+    except ExpiredTokenError:
+        raise AuthenticationFailure("JWT token expired")
+    except JoseError:
+        raise AuthenticationFailure("Cannot decode JWT token")
+
+    # Ensure the token has a 'sub' field
+    if "sub" not in claims:
+        raise AuthenticationFailure("Missing 'sub' field in JWT token")
+
+    return claims
+
+
+# NB: make this function public so we can test valid JWT tokens but signed with another key
+def generate_session_token_payload(user_email: str) -> tuple[dict, datetime]:
+    return _generate_jwt_payload(
+        {"sub": f"{_SUB_PREFIX_SESSION_TOKEN}{user_email}"},
+        get_config().user_session_token_lifetime,
+    )
+
+
+def generate_session_token(user_email) -> tuple[str, datetime]:
+    payload, expires_at = generate_session_token_payload(user_email)
+    return _sign_jwt_token(payload), expires_at
+
+
+def get_user_email_from_session_token(token: str) -> str:
+    payload = _get_jwt_token_payload(token)
+    sub = payload["sub"]
+
+    if not sub.startswith(_SUB_PREFIX_SESSION_TOKEN):
+        raise AuthenticationFailure("Invalid 'sub' field in JWT token")
+    email = sub[len(_SUB_PREFIX_SESSION_TOKEN) :]
+
+    return email
+
+
+def generate_access_token_payload(
+    apikey_id: UUID, permissions: Permissions
+) -> tuple[dict, datetime]:
+    return _generate_jwt_payload(
+        {
+            "sub": _SUB_PREFIX_ACCESS_TOKEN + str(apikey_id),
+            # NB: this data will be serialized to JSON by authlib.jose using json.dumps internally,
+            # unfortunately json.dumps does not support UUID serialization, that's why we
+            # have to do this dump->load extra step to get UUID instances turned into strings
+            "permissions": json.loads(permissions.model_dump_json()),
+        },
+        get_config().access_token_lifetime,
+    )
+
+
+def generate_access_token(
+    apikey_id: UUID, permissions: Permissions
+) -> tuple[str, datetime]:
+    payload, expires_at = generate_access_token_payload(apikey_id, permissions)
+    return _sign_jwt_token(payload), expires_at
+
+
+def get_access_token_data(token: str) -> tuple[UUID, Permissions]:
+    payload = _get_jwt_token_payload(token)
+    sub = payload["sub"]
+
+    if not sub.startswith(_SUB_PREFIX_ACCESS_TOKEN):
+        raise AuthenticationFailure("Invalid 'sub' field in JWT token")
+    apikey_id = sub[len(_SUB_PREFIX_ACCESS_TOKEN) :]
+
+    permissions = Permissions.model_validate(payload["permissions"])
+
+    return UUID(apikey_id), permissions

auditize/config.py

@@ -0,0 +1,191 @@
+import dataclasses
+import os
+
+from apscheduler.triggers.cron import CronTrigger
+
+from auditize.exceptions import (
+    ConfigAlreadyInitialized,
+    ConfigError,
+    ConfigNotInitialized,
+)
+
+_DEFAULT_ATTACHMENT_MAX_SIZE = 1024 * 1024 * 5  # 5MB
+_DEFAULT_CSV_MAX_ROWS = 10_000
+_DEFAULT_USER_SESSION_TOKEN_LIFETIME = 60 * 60 * 12  # 12 hours
+_DEFAULT_ACCESS_TOKEN_LIFETIME = 10 * 60  # 10 minutes
+_DEFAULT_LOG_EXPIRATION_SCHEDULE = "0 1 * * *"
+
+
+@dataclasses.dataclass
+class Config:
+    base_url: str
+    jwt_signing_key: str
+    user_session_token_lifetime: int
+    access_token_lifetime: int
+    attachment_max_size: int
+    csv_max_rows: int
+    mongodb_uri: str
+    smtp_server: str
+    smtp_port: int
+    smtp_username: str
+    smtp_password: str
+    _smtp_sender: str
+    cors_allow_origins: list[str]
+    cookie_secure: bool
+    test_mode: bool
+    online_doc: bool
+    log_expiration_schedule: str
+
+    @staticmethod
+    def _validate_list(value):
+        return value.split(",")
+
+    @staticmethod
+    def _validate_bool(value):
+        if value == "true":
+            return True
+        if value == "false":
+            return False
+        raise ValueError(f"must be either 'true' or 'false'")
+
+    @staticmethod
+    def _validate_cron_expr(value):
+        try:
+            CronTrigger.from_crontab(value)
+        except ValueError as exc:
+            raise ValueError(f"not a valid cron expression ({exc})")
+        return value
+
+    def _validate(self):
+        smtp_values_required = (
+            self.smtp_server,
+            self.smtp_port,
+            self.smtp_username,
+            self.smtp_password,
+        )
+        smtp_values = smtp_values_required + (self._smtp_sender,)
+
+        if any(smtp_values) and not all(smtp_values_required):
+            raise ConfigError(
+                "SMTP configuration is incomplete, please provide all of the following environment variables:\n"
+                "- AUDITIZE_SMTP_SERVER\n"
+                "- AUDITIZE_SMTP_PORT\n"
+                "- AUDITIZE_SMTP_USERNAME\n"
+                "- AUDITIZE_SMTP_PASSWORD\n"
+            )
+
+    @classmethod
+    def load_from_env(cls, env=None):
+        if env is None:
+            env = os.environ
+
+        def required(key, validator=None):
+            value = env[key]
+            if validator:
+                try:
+                    value = validator(value)
+                except ValueError as exc:
+                    raise ConfigError(
+                        f"Could not load configuration, invalid value {value!r} for {key!r}: {exc}"
+                    )
+            return value
+
+        def optional(key, default=None, validator=None):
+            try:
+                return required(key, validator)
+            except KeyError:
+                return default
+
+        try:
+            config = cls(
+                base_url=required("AUDITIZE_BASE_URL"),
+                jwt_signing_key=required("AUDITIZE_JWT_SIGNING_KEY"),
+                user_session_token_lifetime=optional(
+                    "AUDITIZE_USER_SESSION_TOKEN_LIFETIME",
+                    _DEFAULT_USER_SESSION_TOKEN_LIFETIME,
+                    validator=int,
+                ),
+                access_token_lifetime=optional(
+                    "AUDITIZE_ACCESS_TOKEN_LIFETIME",
+                    _DEFAULT_ACCESS_TOKEN_LIFETIME,
+                    validator=int,
+                ),
+                attachment_max_size=optional(
+                    "AUDITIZE_ATTACHMENT_MAX_SIZE",
+                    default=_DEFAULT_ATTACHMENT_MAX_SIZE,
+                    validator=int,
+                ),
+                csv_max_rows=optional(
+                    "AUDITIZE_CSV_MAX_ROWS",
+                    default=_DEFAULT_CSV_MAX_ROWS,
+                    validator=int,
+                ),
+                mongodb_uri=optional("AUDITIZE_MONGODB_URI"),
+                smtp_server=optional("AUDITIZE_SMTP_SERVER"),
+                smtp_port=optional("AUDITIZE_SMTP_PORT", validator=int),
+                smtp_username=optional("AUDITIZE_SMTP_USERNAME"),
+                smtp_password=optional("AUDITIZE_SMTP_PASSWORD"),
+                _smtp_sender=optional("AUDITIZE_SMTP_SENDER"),
+                cors_allow_origins=optional(
+                    "AUDITIZE_CORS_ALLOW_ORIGINS",
+                    validator=cls._validate_list,
+                    default=[],
+                ),
+                log_expiration_schedule=optional(
+                    "AUDITIZE_LOG_EXPIRATION_SCHEDULE",
+                    validator=cls._validate_cron_expr,
+                    default=_DEFAULT_LOG_EXPIRATION_SCHEDULE,
+                ),
+                ###
+                # "Private" configuration
+                ###
+                cookie_secure=optional(
+                    # Needed to disable Secure Cookies for Safari on localhost
+                    # (see https://flaviocopes.com/cookie-not-being-set-in-safari/)
+                    "_AUDITIZE_COOKIE_SECURE",
+                    validator=cls._validate_bool,
+                    default=True,
+                ),
+                test_mode=optional(
+                    "_AUDITIZE_TEST_MODE", validator=cls._validate_bool, default=False
+                ),
+                online_doc=optional(
+                    "_AUDITIZE_ONLINE_DOC", validator=cls._validate_bool, default=False
+                ),
+            )
+        except KeyError as e:
+            var_name = str(e)
+            raise ConfigError(
+                f"Could not load configuration, variable {var_name} is missing"
+            )
+
+        config._validate()
+
+        return config
+
+    @property
+    def smtp_sender(self):
+        return self._smtp_sender or self.smtp_username
+
+    def is_smtp_enabled(self):
+        return self.smtp_sender is not None
+
+    def to_dict(self):
+        return dataclasses.asdict(self)
+
+
+_config: Config | None = None
+
+
+def init_config(env=None) -> Config:
+    global _config
+    if _config:
+        raise ConfigAlreadyInitialized()
+    _config = Config.load_from_env(env)
+    return _config
+
+
+def get_config() -> Config:
+    if not _config:
+        raise ConfigNotInitialized()
+    return _config