aws-python-helper 1.13.0__tar.gz → 1.14.0__tar.gz

{aws_python_helper-1.13.0 → aws_python_helper-1.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.13.0
+Version: 1.14.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.13.0 → aws_python_helper-1.14.0}/aws_python_helper/api/auth_validators.py

@@ -7,6 +7,7 @@ from typing import Dict, Any, Optional
 import os
 import logging
 from datetime import datetime
+from . import jwt_keys
 from .exceptions import UnauthorizedError
 from ..database.mongo_manager import MongoManager
 
@@ -191,37 +192,17 @@ class JWTValidator(AuthValidator):
     touched. That is what lets any microservice authenticate a request without
     calling the issuer.
 
+    The key comes from core, which publishes it: see `jwt_keys`. A service that
+    pins JWT_PUBLIC_KEY uses that instead and never calls out.
+
     Environment:
-        JWT_PUBLIC_KEY: RSA public key in PEM, raw or base64-encoded.
+        CORE_API_URL: where core answers. How the key is found.
+        JWT_PUBLIC_KEY: pins the key instead of reading it from core.
         JWT_ISSUER: expected `iss`. Defaults to 'constitution-core'.
         JWT_AUDIENCE: expected `aud`. Only verified when set.
         AUTH_BYPASS_TOKEN: still honoured, same as TokenValidator.
     """
 
-    _public_key_cache: Optional[str] = None
-
-    @classmethod
-    def _public_key(cls) -> str:
-        """The configured public key, decoded once per container."""
-        if cls._public_key_cache:
-            return cls._public_key_cache
-
-        raw = os.getenv('JWT_PUBLIC_KEY')
-        if not raw:
-            raise ValueError(
-                "JWT_PUBLIC_KEY environment variable not set. "
-                "Required when AUTH_STRATEGY=jwt."
-            )
-
-        key = raw.strip()
-        if not key.startswith('-----BEGIN'):
-            # PEMs are multi-line, so they travel base64-encoded in env vars.
-            import base64
-            key = base64.b64decode(key).decode('utf-8')
-
-        cls._public_key_cache = key
-        return key
-
     async def validate_token(self, token: str) -> Dict[str, Any]:
         caller = _machine_caller(token)
         if caller:
@@ -234,11 +215,25 @@ class JWTValidator(AuthValidator):
                 "PyJWT is required for AUTH_STRATEGY=jwt. Install aws-python-helper[jwt]."
             ) from exc
 
+        # El kid del header dice con qué clave se firmó. Es dato sin verificar y
+        # sólo se usa para elegir la clave: la firma se comprueba igual, así que
+        # un kid mentido no abre nada, simplemente no encuentra clave.
+        try:
+            kid = jwt.get_unverified_header(token).get('kid')
+        except jwt.InvalidTokenError:
+            raise UnauthorizedError("Invalid token")
+
+        try:
+            key = await jwt_keys.resolve(kid)
+        except ValueError as exc:
+            logger.error("Cannot verify tokens: %s", exc)
+            raise
+
         audience = os.getenv('JWT_AUDIENCE')
         try:
             claims = jwt.decode(
                 token,
-                self._public_key(),
+                key,
                 algorithms=['RS256'],
                 issuer=os.getenv('JWT_ISSUER', 'constitution-core'),
                 audience=audience,

aws_python_helper-1.14.0/aws_python_helper/api/jwt_keys.py

@@ -0,0 +1,139 @@
+"""Where a service gets the key that verifies core's signatures.
+
+Core signs; everybody else verifies. The key is public —with it you check a
+signature, you cannot produce one— so the only real question is how it travels.
+
+It used to travel as an environment variable, which meant the same public fact
+sat in every service's secret. Five copies of one thing: rotating the key was
+five edits and five deploys, and any one of them could be the stale one, which
+fails as "invalid token" and looks like a problem with the user.
+
+So core publishes it at `GET /jwks` —public, because a service reads it exactly
+when it cannot authenticate anything yet— and the services read it from there.
+Nothing to copy, nothing to keep in sync, and rotation becomes something core
+does alone.
+"""
+
+import base64
+import logging
+import os
+import time
+from typing import Any, Dict, Optional
+
+logger = logging.getLogger(__name__)
+
+PATH = "/jwks"
+
+# Un kid desconocido puede ser una rotación recién hecha o un token inventado.
+# Volver a preguntar cubre lo primero; el piso evita que lo segundo se convierta
+# en una llamada a core por cada request.
+REFETCH_FLOOR_SECONDS = 60
+TIMEOUT_SECONDS = 5
+
+_keys: Dict[str, Any] = {}
+_last_fetch: Optional[float] = None
+
+
+def configured_key() -> Optional[str]:
+    """The key pinned in the environment, if there is one.
+
+    Core holds the pair and verifies its own tokens, so asking it to fetch over
+    HTTP something it already has would be a service calling itself. It is also
+    the way out: set the variable anywhere and that service stops depending on
+    the endpoint.
+    """
+    raw = (os.getenv('JWT_PUBLIC_KEY') or '').strip()
+    if not raw:
+        return None
+    if raw.startswith('-----BEGIN'):
+        return raw
+    # PEMs are multi-line, so they travel base64-encoded in env vars.
+    return base64.b64decode(raw).decode('utf-8')
+
+
+def reset() -> None:
+    """Forget what was fetched. For tests."""
+    global _last_fetch
+    _keys.clear()
+    _last_fetch = None
+
+
+def _core_url() -> str:
+    url = (os.getenv('CORE_API_URL') or '').rstrip('/')
+    if not url:
+        raise ValueError(
+            "Neither JWT_PUBLIC_KEY nor CORE_API_URL is set: this service has no "
+            "way to learn the key that verifies core's tokens."
+        )
+    return url
+
+
+def _lookup(kid: Optional[str]) -> Optional[Any]:
+    if not _keys:
+        return None
+    if kid:
+        return _keys.get(kid)
+    # Sin kid sólo hay una respuesta sensata si core publica una sola clave. Con
+    # dos, elegir una sería aceptar como buena una firma que quizá no lo es.
+    return next(iter(_keys.values())) if len(_keys) == 1 else None
+
+
+async def _refresh() -> None:
+    global _last_fetch
+    _last_fetch = time.monotonic()
+
+    import httpx
+    from jwt.algorithms import RSAAlgorithm
+
+    url = f"{_core_url()}{PATH}"
+    try:
+        async with httpx.AsyncClient(timeout=TIMEOUT_SECONDS) as client:
+            response = await client.get(url)
+        response.raise_for_status()
+        published = response.json()
+    except Exception as exc:
+        raise ValueError(f"Could not read the signing keys from {url}: {exc}") from exc
+
+    found = {}
+    for entry in published.get('keys') or []:
+        kid = entry.get('kid')
+        if not kid:
+            continue
+        try:
+            found[kid] = RSAAlgorithm.from_jwk(entry)
+        except Exception as exc:
+            # Una clave ilegible no invalida a las demás: la que sirve, sirve.
+            logger.warning("Ignoring key %s published by core: %s", kid, exc)
+
+    if not found:
+        raise ValueError(f"{url} published no usable signing key")
+
+    _keys.clear()
+    _keys.update(found)
+    logger.info("Signing keys loaded from core: %s", ", ".join(sorted(_keys)))
+
+
+async def resolve(kid: Optional[str] = None) -> Any:
+    """The key that verifies a token signed with `kid`.
+
+    Cached for the life of the container: one call per cold start, not per
+    request.
+    """
+    pinned = configured_key()
+    if pinned:
+        return pinned
+
+    key = _lookup(kid)
+    if key is not None:
+        return key
+
+    if _last_fetch is None or (time.monotonic() - _last_fetch) >= REFETCH_FLOOR_SECONDS:
+        await _refresh()
+        key = _lookup(kid)
+
+    if key is None:
+        raise ValueError(
+            f"Core published no signing key with kid {kid!r}. "
+            "A token signed with a retired key looks exactly like this."
+        )
+    return key

{aws_python_helper-1.13.0 → aws_python_helper-1.14.0}/aws_python_helper.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-python-helper
-Version: 1.13.0
+Version: 1.14.0
 Summary: AWS Python Helper Framework
 Author-email: Fabian Claros <neufabiae@gmail.com>
 License-Expression: MIT

{aws_python_helper-1.13.0 → aws_python_helper-1.14.0}/aws_python_helper.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ aws_python_helper/api/dispatcher.py
 aws_python_helper/api/exceptions.py
 aws_python_helper/api/fetcher.py
 aws_python_helper/api/handler.py
+aws_python_helper/api/jwt_keys.py
 aws_python_helper/context/__init__.py
 aws_python_helper/context/session.py
 aws_python_helper/context/state_validator.py
@@ -57,4 +58,5 @@ aws_python_helper/utils/json_encoder.py
 aws_python_helper/utils/response.py
 aws_python_helper/utils/serializer.py
 tests/test_audit_stamp.py
+tests/test_jwt_keys.py
 tests/test_sns_publisher.py

{aws_python_helper-1.13.0 → aws_python_helper-1.14.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aws-python-helper"
-version = "1.13.0"
+version = "1.14.0"
 description = "AWS Python Helper Framework"
 readme = "README.md"
 requires-python = ">=3.9"

aws_python_helper-1.14.0/tests/test_jwt_keys.py

@@ -0,0 +1,185 @@
+"""A real key, a real token, and core's own code publishing it.
+
+The point of testing it this way: every part of this chain has a mockable seam,
+and mocking any of them would have hidden the bug it was written to catch. The
+key is generated here, core's controller turns it into JWKS, the transport is
+faked one layer below httpx, and PyJWT verifies the signature for real.
+
+Runs with plain `python tests/test_jwt_keys.py`.
+"""
+
+import asyncio
+import base64
+import importlib.util
+import json
+import os
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import httpx
+import jwt as pyjwt
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+from aws_python_helper.api import jwt_keys
+
+# El controlador de core vive en otro repo, al lado de éste. Si no está, la
+# parte que lo usa se saltea en vez de dar una falla que no es del framework.
+CORE_SRC = os.path.abspath(os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
+    "..", "constitution-core", "src"))
+CORE = os.path.join(CORE_SRC, "api", "jwks", "list.py")
+
+failures = []
+
+
+def check(label, condition):
+    print(f"  {'ok  ' if condition else 'FALLA'} {label}")
+    if not condition:
+        failures.append(label)
+
+
+def load_core_controller():
+    """Se carga por ruta, que es como lo carga el fetcher en la lambda."""
+    # En la lambda el cwd es la raíz del paquete, así que `helpers` se importa
+    # por nombre absoluto. Acá hay que ponerla a mano.
+    if CORE_SRC not in sys.path:
+        sys.path.insert(0, CORE_SRC)
+    spec = importlib.util.spec_from_file_location("core_jwt_keys", os.path.abspath(CORE))
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def make_key():
+    private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    pem_private = private.private_bytes(
+        serialization.Encoding.PEM,
+        serialization.PrivateFormat.PKCS8,
+        serialization.NoEncryption()).decode()
+    pem_public = private.public_key().public_bytes(
+        serialization.Encoding.PEM,
+        serialization.PublicFormat.SubjectPublicKeyInfo).decode()
+    return pem_private, pem_public
+
+
+class FakeCore:
+    """Habla el idioma de httpx, no el de nuestro código."""
+
+    def __init__(self, body, status=200):
+        self.body, self.status, self.calls = body, status, 0
+
+    def install(self):
+        fake = self
+
+        class Client:
+            def __init__(self, **kwargs): pass
+            async def __aenter__(self): return self
+            async def __aexit__(self, *a): return False
+            async def get(self, url):
+                fake.calls += 1
+                if fake.status >= 400:
+                    raise httpx.ConnectError("core no responde")
+                return httpx.Response(fake.status, json=fake.body,
+                                      request=httpx.Request("GET", url))
+
+        httpx.AsyncClient = Client
+
+
+original_client = httpx.AsyncClient
+pem_private, pem_public = make_key()
+
+if not os.path.exists(CORE):
+    print(f"constitution-core no está en {CORE_SRC}: se saltea la parte de core")
+    sys.exit(0)
+
+print("== core arma el JWKS con su propio código ==")
+os.environ["JWT_PRIVATE_KEY"] = pem_private
+os.environ["JWT_KID"] = "core-2026"
+load_core_controller()
+from helpers import jwt_issuer
+jwks = {"keys": [jwt_issuer.public_jwk()]}
+check("publica un kid", jwks["keys"][0]["kid"] == "core-2026")
+check("es una clave RSA para firmar", jwks["keys"][0]["kty"] == "RSA" and jwks["keys"][0]["alg"] == "RS256")
+check("no filtra la clave privada", "PRIVATE" not in json.dumps(jwks))
+
+print("\n== un servicio sin la clave la baja de core ==")
+os.environ["CORE_API_URL"] = "https://core.example"
+jwt_keys.reset()
+fake = FakeCore(jwks)
+fake.install()
+
+token = pyjwt.encode({"sub": "u1", "email": "a@b.c", "iss": "constitution-core"},
+                     pem_private, algorithm="RS256", headers={"kid": "core-2026"})
+
+from aws_python_helper.api.auth_validators import JWTValidator
+auth = asyncio.run(JWTValidator().validate_token(token))
+check("verifica un token real firmado por core", auth["user_id"] == "u1")
+check("una sola llamada a core", fake.calls == 1)
+
+asyncio.run(JWTValidator().validate_token(token))
+check("el segundo request no vuelve a preguntar", fake.calls == 1)
+
+print("\n== una firma que no es de core no pasa ==")
+_, otro_public = make_key()
+otro_private, _ = make_key()
+falso = pyjwt.encode({"sub": "u1", "iss": "constitution-core"}, otro_private,
+                     algorithm="RS256", headers={"kid": "core-2026"})
+try:
+    asyncio.run(JWTValidator().validate_token(falso))
+    check("rechaza una firma ajena", False)
+except Exception as exc:
+    check(f"rechaza una firma ajena ({type(exc).__name__})", True)
+
+print("\n== rotación: un kid nuevo hace preguntar de nuevo ==")
+nuevo_private, nuevo_public = make_key()
+os.environ["JWT_PRIVATE_KEY"] = nuevo_private
+os.environ["JWT_KID"] = "core-2027"
+# Core cachea la clave por contenedor, que es lo correcto en una lambda. Acá hay
+# que soltarla para poder simular una rotación en el mismo proceso.
+jwt_issuer._private_key_cache = None
+jwks_rotado = {"keys": [jwt_issuer.public_jwk()]}
+fake.body = jwks_rotado
+jwt_keys._last_fetch = time.monotonic() - jwt_keys.REFETCH_FLOOR_SECONDS - 1
+rotado = pyjwt.encode({"sub": "u2", "iss": "constitution-core"}, nuevo_private,
+                      algorithm="RS256", headers={"kid": "core-2027"})
+auth = asyncio.run(JWTValidator().validate_token(rotado))
+check("acepta el token de la clave nueva", auth["user_id"] == "u2")
+check("volvió a preguntar una sola vez", fake.calls == 2)
+
+print("\n== un kid inventado no dispara una llamada por request ==")
+antes = fake.calls
+inventado = pyjwt.encode({"sub": "x", "iss": "constitution-core"}, nuevo_private,
+                         algorithm="RS256", headers={"kid": "no-existe"})
+for _ in range(3):
+    try:
+        asyncio.run(JWTValidator().validate_token(inventado))
+    except Exception:
+        pass
+check("el piso de tiempo aguanta", fake.calls == antes)
+
+print("\n== la clave fijada gana, y core no se llama a sí mismo ==")
+os.environ["JWT_PUBLIC_KEY"] = nuevo_public
+antes = fake.calls
+auth = asyncio.run(JWTValidator().validate_token(rotado))
+check("usa la del ambiente", auth["user_id"] == "u2")
+check("no llamó a core", fake.calls == antes)
+
+print("\n== sin clave y sin CORE_API_URL, el error dice qué falta ==")
+del os.environ["JWT_PUBLIC_KEY"]
+del os.environ["CORE_API_URL"]
+jwt_keys.reset()
+try:
+    asyncio.run(JWTValidator().validate_token(rotado))
+    check("explica el problema", False)
+except ValueError as exc:
+    check(f"explica el problema: {exc}"[:90], "CORE_API_URL" in str(exc))
+
+httpx.AsyncClient = original_client
+print()
+if failures:
+    print(f"{len(failures)} fallas")
+    sys.exit(1)
+print("all good")