aws-python-helper 1.0.3__tar.gz → 1.1.0__tar.gz

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.0.3
+Version: 1.1.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT
@@ -17,6 +17,8 @@ Requires-Dist: motor==3.3.2
 Requires-Dist: pymongo==4.6.1
 Requires-Dist: pydantic>=2.0
 Requires-Dist: httpx>=0.27.0
+Provides-Extra: jwt
+Requires-Dist: PyJWT[crypto]>=2.9.0; extra == "jwt"
 
 # AWS Python Framework
 

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/aws_python_helper/api/auth_validators.py

@@ -141,3 +141,112 @@ class TokenValidator(AuthValidator):
             'token_data': token_doc,
             'is_bypass': False
         }
+
+
+class JWTValidator(AuthValidator):
+    """
+    Validates RS256 JWTs issued by constitution-core.
+
+    Stateless: the signature and the claims are enough, so no database is
+    touched. That is what lets any microservice authenticate a request without
+    calling the issuer.
+
+    Environment:
+        JWT_PUBLIC_KEY: RSA public key in PEM, raw or base64-encoded.
+        JWT_ISSUER: expected `iss`. Defaults to 'constitution-core'.
+        JWT_AUDIENCE: expected `aud`. Only verified when set.
+        AUTH_BYPASS_TOKEN: still honoured, same as TokenValidator.
+    """
+
+    _public_key_cache: Optional[str] = None
+
+    @classmethod
+    def _public_key(cls) -> str:
+        """The configured public key, decoded once per container."""
+        if cls._public_key_cache:
+            return cls._public_key_cache
+
+        raw = os.getenv('JWT_PUBLIC_KEY')
+        if not raw:
+            raise ValueError(
+                "JWT_PUBLIC_KEY environment variable not set. "
+                "Required when AUTH_STRATEGY=jwt."
+            )
+
+        key = raw.strip()
+        if not key.startswith('-----BEGIN'):
+            # PEMs are multi-line, so they travel base64-encoded in env vars.
+            import base64
+            key = base64.b64decode(key).decode('utf-8')
+
+        cls._public_key_cache = key
+        return key
+
+    async def validate_token(self, token: str) -> Dict[str, Any]:
+        bypass_token = os.getenv('AUTH_BYPASS_TOKEN')
+        if bypass_token and token == bypass_token:
+            logger.info("Bypass token used - skipping JWT validation")
+            return {
+                'user_id': 'bypass',
+                'user': {
+                    'email': 'bypass@system',
+                    'role': 'admin',
+                    'name': 'Bypass User',
+                    '_id': 'bypass'
+                },
+                'is_bypass': True,
+                'token_data': None
+            }
+
+        try:
+            import jwt
+        except ImportError as exc:
+            raise RuntimeError(
+                "PyJWT is required for AUTH_STRATEGY=jwt. Install aws-python-helper[jwt]."
+            ) from exc
+
+        audience = os.getenv('JWT_AUDIENCE')
+        try:
+            claims = jwt.decode(
+                token,
+                self._public_key(),
+                algorithms=['RS256'],
+                issuer=os.getenv('JWT_ISSUER', 'constitution-core'),
+                audience=audience,
+                options={'verify_aud': bool(audience)},
+            )
+        except jwt.ExpiredSignatureError:
+            logger.warning("JWT expired")
+            raise UnauthorizedError("Token has expired")
+        except jwt.InvalidTokenError as exc:
+            logger.warning("JWT rejected: %s", exc)
+            raise UnauthorizedError("Invalid token")
+
+        if not claims.get('sub'):
+            raise UnauthorizedError("Invalid token")
+
+        # Same shape TokenValidator returns, so nothing downstream changes.
+        return {
+            'user_id': str(claims['sub']),
+            'user': {
+                '_id': claims['sub'],
+                'email': claims.get('email'),
+                'name': claims.get('name', ''),
+                'role': claims.get('role', 'user'),
+                **(claims.get('extra') or {}),
+            },
+            'token_data': claims,
+            'is_bypass': False,
+        }
+
+
+def get_auth_validator() -> AuthValidator:
+    """The validator this service is configured to use.
+
+    AUTH_STRATEGY=jwt switches to stateless validation. Anything else keeps the
+    database lookup, so a service only migrates when its environment says so.
+    """
+    strategy = (os.getenv('AUTH_STRATEGY') or 'db').strip().lower()
+    if strategy == 'jwt':
+        return JWTValidator()
+    return TokenValidator()

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/aws_python_helper/api/dispatcher.py

@@ -11,7 +11,7 @@ from .fetcher import Fetcher
 from .base import API
 from .exceptions import UnauthorizedError, ForbiddenError, AuthenticationError
 from .auth_middleware import AuthMiddleware
-from .auth_validators import TokenValidator
+from .auth_validators import get_auth_validator
 from ..context.session import get_session
 from ..context.state_validator import StateValidator, InvalidStateError
 
@@ -240,8 +240,8 @@ class Dispatcher:
         """
         Execute authentication middleware
         
-        Uses TokenValidator to validate tokens against AUTH_BYPASS_TOKEN
-        or MongoDB database.
+        The validator is chosen by AUTH_STRATEGY: stateless JWT, or the
+        database lookup used so far.
         
         Args:
             api: API instance to inject authentication data into
@@ -249,8 +249,8 @@ class Dispatcher:
         Raises:
             UnauthorizedError: If authentication fails
         """
-        # Use unified token validator
-        validator = TokenValidator()
+        # Strategy comes from configuration, per service
+        validator = get_auth_validator()
         
         # Create middleware and authenticate
         middleware = AuthMiddleware(validator)

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/aws_python_helper/api/fetcher.py

@@ -91,7 +91,7 @@ class Fetcher:
     
     def _looks_like_id(self, part: str) -> bool:
         """
-        Check if a URL part looks like an ID (numeric or UUID format)
+        Check if a URL part looks like an ID (numeric, ObjectId or UUID format)
         
         Args:
             part: URL part to check
@@ -105,6 +105,15 @@ class Fetcher:
         # Check if it's numeric
         if part.isdigit():
             return True
+
+        # ObjectId de MongoDB: 24 caracteres hexadecimales. Sin esto, un
+        # PATCH /users/<oid> busca un directorio con el id como nombre.
+        if len(part) == 24:
+            try:
+                int(part, 16)
+                return True
+            except ValueError:
+                pass
         
         # Check if it's a UUID format (8-4-4-4-12 hex digits)
         if len(part) == 36 and part.count('-') == 4:

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.0.3
+Version: 1.1.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT
@@ -17,6 +17,8 @@ Requires-Dist: motor==3.3.2
 Requires-Dist: pymongo==4.6.1
 Requires-Dist: pydantic>=2.0
 Requires-Dist: httpx>=0.27.0
+Provides-Extra: jwt
+Requires-Dist: PyJWT[crypto]>=2.9.0; extra == "jwt"
 
 # AWS Python Framework
 

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/aws_python_helper.egg-info/requires.txt

@@ -2,3 +2,6 @@ motor==3.3.2
 pymongo==4.6.1
 pydantic>=2.0
 httpx>=0.27.0
+
+[jwt]
+PyJWT[crypto]>=2.9.0

{aws_python_helper-1.0.3 → aws_python_helper-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.0.3"
+version = "1.1.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -31,6 +31,10 @@ keywords = [
     "aws", "python", "framework", "helper", "mongodb", "sqs", "sns", "fargate", "lambda"
 ]
 
+# Only needed by services running AUTH_STRATEGY=jwt.
+[project.optional-dependencies]
+jwt = ["PyJWT[crypto]>=2.9.0"]
+
 [project.urls]
 "Homepage" = "https://github.com/fabiae/aws-python-framework"
 "Source Code" = "https://github.com/fabiae/aws-python-framework"