bazimya 0.2.0__py3-none-any.whl

bazimya/__init__.py

@@ -0,0 +1,146 @@
+"""Bazimya — a Python web framework with Laravel's structure.
+
+Everything an application needs is importable from here:
+
+    from bazimya import Route, Controller, Model, Schema, Migration, Response
+
+The layout, the vocabulary and the lifecycle follow Laravel 10; the language
+is Python, and templates are .baz.html.
+"""
+
+from .database.migration import Migration, Migrator
+from .database.model import Model, ModelNotFound
+from .database.query import QueryBuilder
+from .database.schema import Blueprint, Schema
+from .console.command import Command
+from .console.registry import Console
+from .extensions.extension import Extension
+from .facades import (
+    App,
+    Auth,
+    Cache,
+    Config,
+    DB,
+    Event,
+    Extensions,
+    Hash,
+    Mail,
+    Notify,
+    Route,
+    Session,
+    Storage,
+    View,
+    app,
+    auth,
+    back,
+    csrf_token,
+    old,
+    base_path,
+    config,
+    database_path,
+    public_path,
+    redirect,
+    resource_path,
+    route,
+    storage_path,
+    view,
+)
+from .foundation.application import VERSION, Application
+from .foundation.container import Container
+from .foundation.provider import ServiceProvider
+from .http.controller import Controller
+from .http.form_request import FormRequest
+from .http.exceptions import (
+    BadRequest,
+    Forbidden,
+    HttpException,
+    NotFound,
+    Unauthorized,
+    ValidationException,
+    abort,
+    abort_if,
+    abort_unless,
+)
+from .auth.middleware import Authenticate, RedirectIfAuthenticated
+from .http.middleware import Middleware
+from .notifications.notification import Notification
+from .session.middleware import ShareErrorsFromSession, StartSession, VerifyCsrfToken
+from .view.components import Component
+from .http.request import Request
+from .http.response import Response
+from .support.env import Env, env
+from .validation import Validator, validate
+from .validation_rule import Rule
+from .view.view import markup
+
+__version__ = VERSION
+
+__all__ = [
+    "App",
+    "Application",
+    "Auth",
+    "Authenticate",
+    "BadRequest",
+    "Cache",
+    "Blueprint",
+    "Command",
+    "Component",
+    "Config",
+    "Console",
+    "Container",
+    "Controller",
+    "DB",
+    "Env",
+    "Event",
+    "Extension",
+    "Extensions",
+    "Forbidden",
+    "Hash",
+    "FormRequest",
+    "HttpException",
+    "Middleware",
+    "Migration",
+    "Migrator",
+    "Model",
+    "ModelNotFound",
+    "NotFound",
+    "Notification",
+    "Notify",
+    "QueryBuilder",
+    "Request",
+    "RedirectIfAuthenticated",
+    "Response",
+    "Route",
+    "Rule",
+    "Schema",
+    "Session",
+    "ServiceProvider",
+    "ShareErrorsFromSession",
+    "StartSession",
+    "Storage",
+    "Unauthorized",
+    "ValidationException",
+    "VerifyCsrfToken",
+    "Validator",
+    "View",
+    "abort",
+    "abort_if",
+    "abort_unless",
+    "app",
+    "auth",
+    "back",
+    "base_path",
+    "config",
+    "csrf_token",
+    "database_path",
+    "env",
+    "markup",
+    "old",
+    "public_path",
+    "redirect",
+    "resource_path",
+    "route",
+    "storage_path",
+    "validate",
+    "view",
+]

bazimya/__main__.py

@@ -0,0 +1,8 @@
+"""`python -m bazimya` — the same entry point as the `bazimya` script."""
+
+import sys
+
+from .console.kernel import Kernel
+
+if __name__ == "__main__":
+    sys.exit(Kernel().run(sys.argv))

bazimya/auth/__init__.py

@@ -0,0 +1,12 @@
+"""Authentication: the session guard and its middleware."""
+
+from .guard import AuthenticationError, SessionGuard
+from .middleware import Authenticate, RedirectIfAuthenticated, ResolveUser
+
+__all__ = [
+    "Authenticate",
+    "AuthenticationError",
+    "RedirectIfAuthenticated",
+    "ResolveUser",
+    "SessionGuard",
+]

bazimya/auth/guard.py

@@ -0,0 +1,251 @@
+"""Authentication.
+
+Laravel's Auth facade over a session guard:
+
+    if Auth.attempt({'email': email, 'password': password}):
+        request.session().regenerate()
+
+        return redirect('/dashboard')
+
+    Auth.user()      the logged-in model, or None
+    Auth.check()     True when someone is logged in
+    Auth.logout()
+
+The guard reads its user model from config/auth.py, so it works with whatever
+model you point it at rather than assuming `User`.
+"""
+
+
+class AuthenticationError(RuntimeError):
+    pass
+
+
+class SessionGuard:
+    """Keeps the authenticated user's id in the session."""
+
+    SESSION_KEY = "_auth_id"
+    PASSWORD_HASH_KEY = "_auth_password"
+
+    def __init__(self, application, config=None):
+        self.app = application
+        self.config = dict(config or {})
+        self._user = None
+        self._resolved = False
+        self._session = None
+
+    # -- wiring -----------------------------------------------------------
+
+    def set_session(self, session):
+        """Called by StartSession, once per request."""
+        self._session = session
+        self._user = None
+        self._resolved = False
+
+        return self
+
+    def session(self):
+        return self._session
+
+    def provider_model(self):
+        """The model this guard authenticates, named in config/auth.py."""
+        reference = self.config.get("model", "app.Models.User.User")
+
+        if not isinstance(reference, str):
+            return reference
+
+        import importlib
+
+        module_name, _, class_name = reference.rpartition(".")
+
+        try:
+            module = importlib.import_module(module_name)
+        except ImportError as error:
+            raise AuthenticationError(
+                "The auth model [{}] could not be imported. Check "
+                "auth.providers.users.model in config/auth.py.".format(reference)
+            ) from error
+
+        model = getattr(module, class_name, None)
+
+        if model is None:
+            raise AuthenticationError(
+                "The auth model [{}] was not found.".format(reference)
+            )
+
+        return model
+
+    def hasher(self):
+        return self.app.make("hash")
+
+    # -- reading the current user -----------------------------------------
+
+    def user(self):
+        if self._resolved:
+            return self._user
+
+        self._resolved = True
+
+        if self._session is None:
+            return None
+
+        identifier = self._session.get(self.SESSION_KEY)
+
+        if identifier is None:
+            return None
+
+        model = self.provider_model()
+        user = model.find(identifier)
+
+        # A password change should end other sessions. The stored fragment is
+        # compared, so an old cookie stops working once the hash changes.
+        if user is not None and not self._password_still_valid(user):
+            self._session.forget(self.SESSION_KEY, self.PASSWORD_HASH_KEY)
+
+            return None
+
+        self._user = user
+
+        return user
+
+    def _password_still_valid(self, user):
+        remembered = self._session.get(self.PASSWORD_HASH_KEY)
+
+        if remembered is None:
+            return True
+
+        return remembered == self._password_fingerprint(user)
+
+    @staticmethod
+    def _password_fingerprint(user):
+        import hashlib
+
+        password = user.attributes().get("password") or ""
+
+        return hashlib.sha256(str(password).encode("utf-8")).hexdigest()[:32]
+
+    def id(self):
+        user = self.user()
+
+        return user.key() if user is not None else None
+
+    def check(self):
+        return self.user() is not None
+
+    def guest(self):
+        return not self.check()
+
+    # -- logging in and out -----------------------------------------------
+
+    def attempt(self, credentials, remember=False):
+        """Find a matching user and verify the password.
+
+        Returns True on success. The password is verified even when no user
+        matched, so that a wrong email and a wrong password take the same time
+        and the response cannot be used to enumerate accounts.
+        """
+        credentials = dict(credentials or {})
+        password = credentials.pop("password", None)
+
+        user = self.retrieve_by_credentials(credentials)
+
+        if user is None:
+            self.hasher().check(str(password or ""), _DUMMY_HASH)
+
+            return False
+
+        if not self.validate_password(user, password):
+            return False
+
+        self.login(user, remember)
+
+        return True
+
+    def retrieve_by_credentials(self, credentials):
+        if not credentials:
+            return None
+
+        model = self.provider_model()
+        query = model.query()
+
+        for column, value in credentials.items():
+            query = query.where(column, value)
+
+        return query.first()
+
+    def validate_password(self, user, password):
+        stored = user.attributes().get("password")
+
+        if not stored:
+            return False
+
+        if not self.hasher().check(str(password or ""), stored):
+            return False
+
+        # Upgrade the stored hash when the configured cost has moved on. This
+        # is the only moment the plaintext is available to do it.
+        if self.hasher().needs_rehash(stored):
+            user.force_fill({"password": self.hasher().make(password)})
+            user.save()
+
+        return True
+
+    def login(self, user, remember=False):
+        if self._session is None:
+            raise AuthenticationError(
+                "There is no session to log in to. Add StartSession to the "
+                "middleware group for this route."
+            )
+
+        # A new session id on login is what closes off session fixation: any
+        # id an attacker planted before login stops being the one in use.
+        self._session.regenerate()
+        self._session.put(self.SESSION_KEY, user.key())
+        self._session.put(self.PASSWORD_HASH_KEY, self._password_fingerprint(user))
+
+        self._user = user
+        self._resolved = True
+
+        return user
+
+    def login_using_id(self, identifier):
+        user = self.provider_model().find(identifier)
+
+        return self.login(user) if user is not None else None
+
+    def once(self, credentials):
+        """Verify credentials without touching the session."""
+        user = self.retrieve_by_credentials(
+            {k: v for k, v in credentials.items() if k != "password"}
+        )
+
+        if user is None or not self.validate_password(user, credentials.get("password")):
+            return False
+
+        self._user = user
+        self._resolved = True
+
+        return True
+
+    def logout(self):
+        if self._session is not None:
+            self._session.forget(self.SESSION_KEY, self.PASSWORD_HASH_KEY)
+            self._session.invalidate()
+
+        self._user = None
+        self._resolved = True
+
+        return self
+
+    def set_user(self, user):
+        self._user = user
+        self._resolved = True
+
+        return self
+
+
+#: A real hash of a random value, so a failed lookup still costs one
+#: verification and the timing of "no such user" matches "wrong password".
+_DUMMY_HASH = (
+    "pbkdf2$480000$AAAAAAAAAAAAAAAAAAAAAA$"
+    "cGxhY2Vob2xkZXJwbGFjZWhvbGRlcnBsYWNlaG9sZGVy"
+)

bazimya/auth/middleware.py

@@ -0,0 +1,76 @@
+"""Authentication middleware — Laravel's Authenticate and RedirectIfAuthenticated."""
+
+from ..http.exceptions import Unauthorized
+from ..http.middleware import Middleware
+from ..http.response import Response
+
+
+class Authenticate(Middleware):
+    """Stop guests. Registered as the `auth` alias.
+
+    Browsers get a redirect to the login page; anything asking for JSON gets a
+    401, because redirecting an API client to an HTML form is never useful.
+    """
+
+    redirect_to = "/login"
+
+    def handle(self, request, next):
+        from ..facades import Auth
+
+        session = request.get("session")
+
+        if session is not None:
+            Auth.set_session(session)
+
+        user = Auth.user()
+
+        if user is None:
+            if request.wants_json():
+                raise Unauthorized("Unauthenticated.")
+
+            if session is not None:
+                # Remember where they were headed, so login can send them back.
+                session.put("_intended", request.full_url())
+
+            return Response.redirect(self.redirect_to)
+
+        request.set("user", user)
+
+        return next(request)
+
+
+class RedirectIfAuthenticated(Middleware):
+    """Keep logged-in users off the login and register pages. Alias: `guest`."""
+
+    redirect_to = "/"
+
+    def handle(self, request, next):
+        from ..facades import Auth
+
+        session = request.get("session")
+
+        if session is not None:
+            Auth.set_session(session)
+
+        if Auth.check():
+            return Response.redirect(self.redirect_to)
+
+        return next(request)
+
+
+class ResolveUser(Middleware):
+    """Attach the authenticated user to the request without requiring one.
+
+    For pages that show a name when signed in and a login link otherwise.
+    """
+
+    def handle(self, request, next):
+        from ..facades import Auth
+
+        session = request.get("session")
+
+        if session is not None:
+            Auth.set_session(session)
+            request.set("user", Auth.user())
+
+        return next(request)

bazimya/cache/__init__.py

@@ -0,0 +1,5 @@
+"""Caching."""
+
+from .repository import ArrayStore, CacheRepository, FileStore, NullStore
+
+__all__ = ["ArrayStore", "CacheRepository", "FileStore", "NullStore"]

bazimya/cache/repository.py

@@ -0,0 +1,206 @@
+"""The cache.
+
+Laravel's Cache facade, with a file store under storage/framework/cache. No
+Redis, no Memcached — the file store needs nothing installed, which is the
+whole point on shared hosting.
+
+    Cache.put('key', value, seconds=600)
+    Cache.get('key', default)
+    Cache.remember('key', 600, lambda: expensive())
+"""
+
+import hashlib
+import json
+import os
+import time
+
+
+class FileStore:
+    def __init__(self, directory):
+        self.directory = directory
+
+    def _file(self, key):
+        safe = hashlib.sha256(str(key).encode("utf-8")).hexdigest()
+
+        # Two levels of subdirectory, so a large cache does not put tens of
+        # thousands of files in one directory.
+        return os.path.join(self.directory, safe[:2], safe[2:4], safe)
+
+    def get(self, key, default=None):
+        path = self._file(key)
+
+        try:
+            with open(path, "r", encoding="utf-8") as handle:
+                payload = json.load(handle)
+        except (OSError, ValueError):
+            return default
+
+        expires = payload.get("expires")
+
+        if expires is not None and expires < time.time():
+            self.forget(key)
+
+            return default
+
+        return payload.get("value", default)
+
+    def put(self, key, value, seconds=None):
+        path = self._file(key)
+
+        try:
+            os.makedirs(os.path.dirname(path), exist_ok=True)
+
+            payload = {
+                "value": value,
+                "expires": time.time() + seconds if seconds else None,
+            }
+
+            temporary = "{}.{}.tmp".format(path, os.getpid())
+
+            with open(temporary, "w", encoding="utf-8") as handle:
+                json.dump(payload, handle, default=str)
+
+            os.replace(temporary, path)
+
+            return True
+        except (OSError, TypeError, ValueError):
+            # A cache that cannot write is slow, not broken.
+            return False
+
+    def forget(self, key):
+        try:
+            os.remove(self._file(key))
+
+            return True
+        except OSError:
+            return False
+
+    def flush(self):
+        import shutil
+
+        try:
+            shutil.rmtree(self.directory)
+            os.makedirs(self.directory, exist_ok=True)
+
+            return True
+        except OSError:
+            return False
+
+
+class ArrayStore:
+    """In-memory, per-process. The default while testing."""
+
+    def __init__(self):
+        self._items = {}
+
+    def get(self, key, default=None):
+        entry = self._items.get(key)
+
+        if entry is None:
+            return default
+
+        value, expires = entry
+
+        if expires is not None and expires < time.time():
+            self._items.pop(key, None)
+
+            return default
+
+        return value
+
+    def put(self, key, value, seconds=None):
+        self._items[key] = (value, time.time() + seconds if seconds else None)
+
+        return True
+
+    def forget(self, key):
+        return self._items.pop(key, None) is not None
+
+    def flush(self):
+        self._items = {}
+
+        return True
+
+
+class NullStore:
+    """Stores nothing. Useful for turning caching off without code changes."""
+
+    def get(self, key, default=None):
+        return default
+
+    def put(self, key, value, seconds=None):
+        return True
+
+    def forget(self, key):
+        return True
+
+    def flush(self):
+        return True
+
+
+class CacheRepository:
+    def __init__(self, store):
+        self.store = store
+
+    def get(self, key, default=None):
+        return self.store.get(key, default)
+
+    def put(self, key, value, seconds=None):
+        return self.store.put(key, value, seconds)
+
+    def add(self, key, value, seconds=None):
+        """Store it only if it is not there already."""
+        sentinel = object()
+
+        if self.store.get(key, sentinel) is not sentinel:
+            return False
+
+        return self.store.put(key, value, seconds)
+
+    def forever(self, key, value):
+        return self.store.put(key, value, None)
+
+    def has(self, key):
+        sentinel = object()
+
+        return self.store.get(key, sentinel) is not sentinel
+
+    def missing(self, key):
+        return not self.has(key)
+
+    def pull(self, key, default=None):
+        value = self.get(key, default)
+        self.forget(key)
+
+        return value
+
+    def remember(self, key, seconds, callback):
+        """Return the cached value, computing and storing it when absent."""
+        sentinel = object()
+        value = self.store.get(key, sentinel)
+
+        if value is not sentinel:
+            return value
+
+        value = callback()
+        self.store.put(key, value, seconds)
+
+        return value
+
+    def remember_forever(self, key, callback):
+        return self.remember(key, None, callback)
+
+    def increment(self, key, amount=1):
+        value = int(self.get(key, 0) or 0) + amount
+        self.forever(key, value)
+
+        return value
+
+    def decrement(self, key, amount=1):
+        return self.increment(key, -amount)
+
+    def forget(self, key):
+        return self.store.forget(key)
+
+    def flush(self):
+        return self.store.flush()

bazimya/console/__init__.py

@@ -0,0 +1,7 @@
+"""The command line."""
+
+from .command import Command
+from .kernel import Kernel, main
+from .output import Output
+
+__all__ = ["Command", "Kernel", "Output", "main"]