auth 2.3.1__tar.gz → 2.4.1__tar.gz

{auth-2.3.1 → auth-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth
-Version: 2.3.1
+Version: 2.4.1
 Summary: Authorization for humans
 Author-email: Farshid Ashouri <farsheed.ashouri@gmail.com>
 License-Expression: MIT
@@ -40,11 +40,11 @@ Requires-Dist: python-json-logger<4,>=3.1.0
 Provides-Extra: ratelimit
 Requires-Dist: flask-limiter>=3.0.0; extra == "ratelimit"
 Provides-Extra: migrations
-Requires-Dist: alembic>=1.13.0; extra == "migrations"
+Requires-Dist: migretti>=0.10.0; extra == "migrations"
 Provides-Extra: dev
 Requires-Dist: pytest>=6.0; extra == "dev"
 Requires-Dist: pytest-cov>=2.0; extra == "dev"
-Requires-Dist: alembic>=1.13.0; extra == "dev"
+Requires-Dist: migretti>=0.10.0; extra == "dev"
 Requires-Dist: ruff>=0.0.260; extra == "dev"
 Requires-Dist: mypy>=1.0; extra == "dev"
 Requires-Dist: types-requests; extra == "dev"
@@ -104,9 +104,27 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
 - **Two response shapes** — bare `{"result": ...}` and wrapped
   `{"success", "data", ...}`. The API reference says which per endpoint.
 - **Errors below 2xx are HTML**, not JSON. Branch on the status code first.
+- **Python client: check `success` before reading `data`.** On transport
+  failure the client does not raise by default — it returns
+  `{"error", "success": False, "transport_error": True, "data": {...}}` where
+  `data` only echoes your inputs and does NOT contain the answer field
+  (`has_permission`, `count`, ...). Reading `data` blindly turns an outage into
+  a false "no". Pass `Client(..., raise_on_error=True)` to get an
+  `AuthTransportError` exception instead of the error dict.
 - **Reuse one key.** A new key is a new empty namespace, not an error. Keep the
   key out of source control, logs, and URLs — it is the only thing protecting
   your data. Rotate it with `POST /api/keys/rotate` if it leaks.
+- **Per-user API keys** (2.4.0): `/api/apikeys/user/<user>` (create/list),
+  `/api/apikeys/user/<user>/<key_id>` (revoke), `/api/apikeys/validate`. auth
+  mints `rak_...` secrets for *your users*, shows each exactly once, stores only
+  a hash, and validates them inside your namespace — an identity UI fronts the
+  lifecycle, backends validate then use the RBAC checks. Client methods:
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission: 2.5.0 adds opt-in per-tenant strict
+  mode, **3.0.0 makes key-backed users mandatory** (each phase ships only after
+  every consuming platform confirms). Migrate backends to
+  `validate → user → has_permission` now. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.3.1 → auth-2.4.1}/README.md

@@ -48,9 +48,27 @@ with Client(api_key=KEY, service_url="https://auth.rodmena.app") as c:
 - **Two response shapes** — bare `{"result": ...}` and wrapped
   `{"success", "data", ...}`. The API reference says which per endpoint.
 - **Errors below 2xx are HTML**, not JSON. Branch on the status code first.
+- **Python client: check `success` before reading `data`.** On transport
+  failure the client does not raise by default — it returns
+  `{"error", "success": False, "transport_error": True, "data": {...}}` where
+  `data` only echoes your inputs and does NOT contain the answer field
+  (`has_permission`, `count`, ...). Reading `data` blindly turns an outage into
+  a false "no". Pass `Client(..., raise_on_error=True)` to get an
+  `AuthTransportError` exception instead of the error dict.
 - **Reuse one key.** A new key is a new empty namespace, not an error. Keep the
   key out of source control, logs, and URLs — it is the only thing protecting
   your data. Rotate it with `POST /api/keys/rotate` if it leaks.
+- **Per-user API keys** (2.4.0): `/api/apikeys/user/<user>` (create/list),
+  `/api/apikeys/user/<user>/<key_id>` (revoke), `/api/apikeys/validate`. auth
+  mints `rak_...` secrets for *your users*, shows each exactly once, stores only
+  a hash, and validates them inside your namespace — an identity UI fronts the
+  lifecycle, backends validate then use the RBAC checks. Client methods:
+  `create_api_key`, `list_api_keys`, `revoke_api_key`, `validate_api_key`.
+- **DEPRECATED — bare user strings.** Asserting a `<user>` that no validated API
+  key backs is scheduled for decommission: 2.5.0 adds opt-in per-tenant strict
+  mode, **3.0.0 makes key-backed users mandatory** (each phase ships only after
+  every consuming platform confirms). Migrate backends to
+  `validate → user → has_permission` now. Details: [docs/DEPRECATIONS.md](docs/DEPRECATIONS.md).
 
 ## Documentation
 

{auth-2.3.1 → auth-2.4.1}/auth/__init__.py

@@ -3,7 +3,11 @@ __author__ = "Farshid Ashouri"
 from importlib.metadata import PackageNotFoundError, version
 from typing import Optional
 
-from auth.client import Client, EnhancedAuthClient  # Import the new client
+from auth.client import (  # Import the new client
+    AuthTransportError,
+    Client,
+    EnhancedAuthClient,
+)
 from auth.database import SessionLocal
 from auth.services.service import AuthorizationService
 
@@ -94,6 +98,7 @@ class Authorization:
 # Export the new client for users who want enhanced features
 __all__ = [
     "Authorization",
+    "AuthTransportError",
     "Client",
     "EnhancedAuthClient",
     "SessionLocal",

auth-2.4.1/auth/api_keys.py

@@ -0,0 +1,50 @@
+"""Per-user API key generation and hashing (SPEC 0004).
+
+Secrets are ``rak_`` + 43 base62 characters carrying the full 256 bits of
+``secrets.token_bytes(32)``. Only the SHA-256 hex digest is stored; the raw
+secret is returned once at creation and never persisted, logged, or audited.
+The digest deliberately excludes the tenant and any server pepper: at this
+entropy an offline attack on a leaked hash is not a threat, and neither a
+client-key rotation nor a pepper change may invalidate issued keys.
+"""
+
+import hashlib
+import re
+import secrets
+import uuid
+from typing import Tuple
+
+API_KEY_PREFIX = "rak_"
+API_KEY_PATTERN = re.compile(r"^rak_[0-9A-Za-z]{43}$")
+
+# "rak_" + first 8 payload chars — safe to store and display in listings.
+KEY_PREFIX_LEN = 12
+
+_PAYLOAD_LEN = 43
+_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+
+
+def _base62(data: bytes) -> str:
+    number = int.from_bytes(data, "big")
+    chars = []
+    while number:
+        number, rem = divmod(number, 62)
+        chars.append(_ALPHABET[rem])
+    return "".join(reversed(chars)) or _ALPHABET[0]
+
+
+def generate_api_key() -> Tuple[str, str, str, str]:
+    """Mint a fresh key: returns ``(secret, key_id, key_hash, key_prefix)``.
+
+    ``secret`` is shown to the caller exactly once; ``key_id`` is the public
+    UUID4 handle used in revoke paths; ``key_hash``/``key_prefix`` are what
+    gets stored.
+    """
+    payload = _base62(secrets.token_bytes(32)).rjust(_PAYLOAD_LEN, _ALPHABET[0])
+    secret = API_KEY_PREFIX + payload
+    return secret, str(uuid.uuid4()), hash_api_key(secret), secret[:KEY_PREFIX_LEN]
+
+
+def hash_api_key(secret: str) -> str:
+    """SHA-256 hex digest of the full secret string (equality-queryable)."""
+    return hashlib.sha256(secret.encode()).hexdigest()

{auth-2.3.1 → auth-2.4.1}/auth/audit.py

@@ -38,6 +38,10 @@ class AuditAction(Enum):
     LIST_MEMBERSHIPS = "LIST_MEMBERSHIPS"
     USER_PERMISSIONS = "USER_PERMISSIONS"
     ROTATE_KEY = "ROTATE_KEY"
+    CREATE_API_KEY = "CREATE_API_KEY"
+    LIST_API_KEYS = "LIST_API_KEYS"
+    REVOKE_API_KEY = "REVOKE_API_KEY"
+    VALIDATE_API_KEY = "VALIDATE_API_KEY"
 
 
 class AuditLog(Base):