bazis-authing 2.2.0__py3-none-any.whl

bazis/contrib/authing/__init__.py

@@ -0,0 +1,19 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+try:
+    from importlib.metadata import PackageNotFoundError, version
+    __version__ = version('bazis-authing')
+except PackageNotFoundError:
+    __version__ = 'dev'

bazis/contrib/authing/_version.py

@@ -0,0 +1,34 @@
+# file generated by setuptools-scm
+# don't change, don't track in version control
+
+__all__ = [
+    "__version__",
+    "__version_tuple__",
+    "version",
+    "version_tuple",
+    "__commit_id__",
+    "commit_id",
+]
+
+TYPE_CHECKING = False
+if TYPE_CHECKING:
+    from typing import Tuple
+    from typing import Union
+
+    VERSION_TUPLE = Tuple[Union[int, str], ...]
+    COMMIT_ID = Union[str, None]
+else:
+    VERSION_TUPLE = object
+    COMMIT_ID = object
+
+version: str
+__version__: str
+__version_tuple__: VERSION_TUPLE
+version_tuple: VERSION_TUPLE
+commit_id: COMMIT_ID
+__commit_id__: COMMIT_ID
+
+__version__ = version = '2.2.0'
+__version_tuple__ = version_tuple = (2, 2, 0)
+
+__commit_id__ = commit_id = None

bazis/contrib/authing/apps.py

@@ -0,0 +1,22 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from django.utils.translation import gettext_lazy as _
+
+from bazis.core.utils.apps import BaseConfig
+
+
+class AuthingConfig(BaseConfig):
+    name = 'bazis.contrib.authing'
+    verbose_name = _('Authing')

bazis/contrib/authing/conf.py

@@ -0,0 +1,38 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from django.utils.translation import gettext_lazy as _
+
+from pydantic import Field
+
+from bazis.core.utils.schemas import BazisSettings
+
+
+class Settings(BazisSettings):
+    BAZIS_AUTH_COOKIE_LIFETIME: int = Field(600, title=_('Authorization cookie lifetime'))
+    BAZIS_AUTH_KINDS: list[str] = Field(
+        [
+            'bazis.contrib.authing.services.password',
+        ],
+        title=_('Authorization services'),
+    )
+    AUTHENTICATION_BACKENDS: list[str] = Field(
+        [
+            'django.contrib.auth.backends.ModelBackend',
+        ],
+        title=_('Authentication backends'),
+    )
+
+
+settings = Settings()

bazis/contrib/authing/locale/en/LC_MESSAGES/django.po

@@ -0,0 +1,58 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2024-07-04 07:02+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+#: apps.py:7
+msgid "Authing"
+msgstr ""
+
+#: conf.py:7
+msgid "Name of the authorization cookie"
+msgstr ""
+
+#: conf.py:8
+msgid "Authorization cookie lifetime"
+msgstr ""
+
+#: conf.py:12
+msgid "Authorization services"
+msgstr ""
+
+#: conf.py:15
+msgid "Authentication backends"
+msgstr ""
+
+#: services/password/routes.py:16
+msgid "Authentication"
+msgstr ""
+
+#: routes.py:58 routes.py:61
+msgid "User is not authorized."
+msgstr ""
+
+#: routes.py:76
+msgid "Next action"
+msgstr ""
+
+#: routes.py:88
+msgid "Authentication error"
+msgstr ""
+
+#: services/password/__init__.py:11
+msgid "Login/Password"
+msgstr ""

bazis/contrib/authing/locale/ru/LC_MESSAGES/django.po

@@ -0,0 +1,78 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-03-29 00:27+0300\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=4; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && "
+"n%10<=4 && (n%100<12 || n%100>14) ? 1 : n%10==0 || (n%10>=5 && n%10<=9) || "
+"(n%100>=11 && n%100<=14)? 2 : 3);\n"
+
+#: apps.py:7
+msgid "Authing"
+msgstr "Авторизация"
+
+#: conf.py:7
+msgid "Authorization cookie lifetime"
+msgstr "Время жизни куки авторизации"
+
+#: conf.py:13
+msgid "Authorization services"
+msgstr "Сервисы авторизации"
+
+#: conf.py:19
+msgid "Authentication backends"
+msgstr "Бекенды аутентификации"
+
+#: services/password/routes.py:15
+msgid "Authentication"
+msgstr "Аутентификация"
+
+#: routes.py:58 routes.py:61
+msgid "User is not authorized."
+msgstr "Пользователь не авторизован"
+
+#: routes.py:77
+msgid "Next action"
+msgstr "Следующее действие"
+
+#: routes.py:91
+msgid "Authentication error"
+msgstr "Ошибка аутентификации"
+
+#: services/google/__init__.py:12 services/google/routes.py:24
+#, fuzzy
+#| msgid "Authentication"
+msgid "Google Authentication"
+msgstr "Аутентификация"
+
+#: services/google/conf.py:7
+msgid "Google client ID"
+msgstr ""
+
+#: services/google/conf.py:8
+msgid "Google client secret"
+msgstr ""
+
+#: services/google/conf.py:9
+msgid "Google redirect URI"
+msgstr ""
+
+#: services/password/__init__.py:12
+msgid "Login/Password"
+msgstr "Логин/пароль"
+
+#~ msgid "Name of the authorization cookie"
+#~ msgstr "Наименование авторизационной куки"

bazis/contrib/authing/router.py

@@ -0,0 +1,15 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from bazis.contrib.authing.routes import router  # noqa: F401

bazis/contrib/authing/routes.py

@@ -0,0 +1,113 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from django.conf import settings
+from django.utils.translation import gettext as _
+
+from fastapi import Depends
+
+from starlette.status import HTTP_100_CONTINUE, HTTP_401_UNAUTHORIZED, HTTP_422_UNPROCESSABLE_ENTITY
+
+from bazis.contrib.users import get_user_model
+from bazis.contrib.users.service import get_token_data, get_user_optional
+from bazis.core.errors import JsonApiBazisError, JsonApiBazisException
+from bazis.core.routing import BazisRouter
+from bazis.core.utils.imp import import_module
+
+from .schemas import AuthResponse
+from .service import AuthStore
+
+
+User = get_user_model()
+
+router = BazisRouter(tags=[_('Authentication')])
+
+
+@router.get('/auth/', response_model=AuthResponse)
+def auth(
+    auth_store: AuthStore = Depends(),
+    user: User = Depends(get_user_optional),
+    token_data: dict = Depends(get_token_data),
+):
+    if user.is_anonymous:
+        if user_id := auth_store.user_id:
+            user = User.objects.filter(id=user_id).first()
+
+    services = []
+    for service_path in settings.BAZIS_AUTH_KINDS:
+        try:
+            services.append(import_module(service_path))
+        except ImportError:
+            pass
+
+    if user and not user.is_anonymous:
+        auth_type = auth_store.auth_type or token_data.get('auth_type')
+
+        return AuthResponse(
+            user_id=user.id,
+            username=user.username,
+            first_name=user.first_name,
+            last_name=user.last_name,
+            email=user.email,
+            token=user.jwt_build(auth_type=auth_type),
+            logout_actions=(
+                [
+                    s.get_logout_actions()
+                    for s in services
+                    if s.AUTH_CODE == auth_type and hasattr(s, 'get_logout_actions')
+                ]
+                + [None]
+            )[0],
+        )
+
+    errors = [
+        JsonApiBazisError(
+            _('User is not authorized.'),
+            status=HTTP_401_UNAUTHORIZED,
+            code='UNAUTHORIZED',
+            title=_('User is not authorized.'),
+            meta_data={
+                'actions': [
+                    s.get_login_action() for s in services if hasattr(s, 'get_login_action')
+                ],
+                'token': auth_store.token.value,
+            },
+        )
+    ]
+
+    if auth_store.actions:
+        errors.append(
+            JsonApiBazisError(
+                auth_store.actions.name,
+                status=HTTP_100_CONTINUE,
+                code=auth_store.actions.code,
+                title=_('Next action'),
+                meta_data={
+                    'actions': auth_store.actions.values,
+                },
+            )
+        )
+
+    if auth_store.errors:
+        for err in auth_store.errors:
+            errors.append(
+                JsonApiBazisError(
+                    err.detail,
+                    status=HTTP_422_UNPROCESSABLE_ENTITY,
+                    code=err.code,
+                    title=_('Authentication error'),
+                )
+            )
+
+    raise JsonApiBazisException(errors, cookies=[auth_store.cookie])

bazis/contrib/authing/schemas.py

@@ -0,0 +1,27 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from uuid import UUID
+
+from pydantic import BaseModel
+
+
+class AuthResponse(BaseModel):
+    user_id: UUID | int
+    username: str
+    first_name: str | None = None
+    last_name: str | None = None
+    email: str | None = None
+    token: str
+    logout_actions: list[dict] | None = None

bazis/contrib/authing/service.py

@@ -0,0 +1,212 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import logging
+from collections import UserDict
+from dataclasses import asdict, dataclass
+from secrets import token_hex
+
+from django.conf import settings
+from django.contrib.auth.signals import user_logged_in
+from django.core.cache import cache
+from django.utils.functional import cached_property
+
+from fastapi import Cookie, Depends, Header, Query
+from fastapi.security.utils import get_authorization_scheme_param
+
+from starlette.requests import Request
+
+from jose import jwt
+
+from bazis.contrib.users.service import get_anonymous_user_model, get_user_model
+from bazis.core.errors import JsonApi401Exception
+from bazis.core.utils.functools import CtxToggle
+
+
+LOG = logging.getLogger()
+User = get_user_model()
+AnonymousUser = get_anonymous_user_model()
+
+
+@dataclass
+class AuthToken:
+    key: str = None
+
+    @classmethod
+    def parse(cls, data, required=False):
+        if not data:
+            if required:
+                raise JsonApi401Exception(detail='Token required')
+            return None
+
+        try:
+            token_data = jwt.decode(
+                data, settings.SECRET_KEY, algorithms=settings.BAZIS_JWT_SESSION_ALG
+            )
+        except Exception:
+            raise JsonApi401Exception(detail='Token is invalid') from None
+
+        return cls(
+            key=token_data['sub'],
+        )
+
+    @classmethod
+    def new(cls):
+        return cls(
+            key=token_hex(),
+        )
+
+    @cached_property
+    def value(self):
+        return jwt.encode(
+            {
+                'sub': self.key,
+            },
+            settings.SECRET_KEY,
+            algorithm=settings.BAZIS_JWT_SESSION_ALG,
+        )
+
+
+@dataclass
+class AuthActions:
+    values: list
+    code: str
+    name: str
+
+
+@dataclass
+class AuthError:
+    code: str
+    detail: str
+
+
+def get_token_header(authorization: str | None = Header(default=None, alias='Authorization')):
+    scheme, param = get_authorization_scheme_param(authorization)
+    if authorization and scheme.lower() == 'bearer':
+        return param
+
+
+class AuthStore(UserDict):
+    token = None
+    cache_prefix = 'auth_store_'
+    token_required = False
+
+    def __init__(
+        self,
+        token_param: str | None = Query(default=None, alias=settings.BAZIS_AUTH_COOKIE_NAME),
+        token_cookie: str | None = Cookie(default=None, alias=settings.BAZIS_AUTH_COOKIE_NAME),
+        token_header: str | None = Depends(get_token_header),
+    ):
+        super().__init__()
+        self.push_toggle = CtxToggle()
+        self.token = AuthToken.parse(
+            token_param or token_header or token_cookie, required=self.token_required
+        )
+
+        if self.token:
+            self.data = cache.get(f'{self.cache_prefix}{self.token.key}')
+            if self.data is None:
+                if self.token_required:
+                    raise JsonApi401Exception(detail='Token has been expired')
+                else:
+                    self.token = None
+
+        if not self.token:
+            self.token = AuthToken.new()
+            self.data_reset()
+
+    @cached_property
+    def cookie(self):
+        # the authorization cookie is set indefinitely
+        return settings.BAZIS_AUTH_COOKIE_NAME, self.token.value, 31536000
+
+    @cached_property
+    def as_param(self):
+        return f'{settings.BAZIS_AUTH_COOKIE_NAME}={self.token.value}'
+
+    def response_set_cookie(self, response):
+        key, value, max_age = self.cookie
+        # set the cookie
+        response.set_cookie(key=key, value=value, max_age=max_age)
+        return response
+
+    def _push_data(self):
+        if self.push_toggle.allow:
+            cache.set(
+                f'{self.cache_prefix}{self.token.key}',
+                self.data,
+                settings.BAZIS_AUTH_COOKIE_LIFETIME,
+            )
+
+    def data_reset(self):
+        self.data = {}
+        self._push_data()
+
+    def __setitem__(self, k, v) -> None:
+        super().__setitem__(k, v)
+        self._push_data()
+
+    def update(self, d, **kwargs) -> None:
+        with self.push_toggle:
+            super().update(d, **kwargs)
+        self._push_data()
+
+    def __delitem__(self, v) -> None:
+        super().__delitem__(v)
+        self._push_data()
+
+    def clear(self) -> None:
+        with self.push_toggle:
+            super().clear()
+        self._push_data()
+
+    def login(self, user, request: Request, auth_type: str):
+        user_logged_in.send(sender=user.__class__, request=request, user=user)
+        self.data['_user_id'] = user.id
+        self.data['_auth_type'] = auth_type
+        self._push_data()
+
+    @property
+    def user_id(self):
+        return self.data.get('_user_id')
+
+    @property
+    def auth_type(self):
+        return self.data.get('_auth_type')
+
+    @property
+    def errors(self) -> list[AuthError]:
+        if errors := self.data.get('_errors'):
+            return [AuthError(**err) for err in errors]
+
+    def set_error(self, code, detail=None):
+        LOG.info('AuthStore set_error: %s, %s', code, detail)
+        err = AuthError(code, detail)
+        errors = self.data.get('errors', [])
+        errors.append(asdict(err))
+        self.data['_errors'] = errors
+        self._push_data()
+
+    @property
+    def actions(self) -> AuthActions:
+        if actions := self.data.get('_actions'):
+            return AuthActions(**actions)
+
+    def set_actions(self, values: list, code: str, name: str = None):
+        self.data['_actions'] = asdict(AuthActions(values, code, name))
+        self._push_data()
+
+
+class AuthStoreTokenRequired(AuthStore):
+    token_required = True

bazis/contrib/authing/services/__init__.py

@@ -0,0 +1,14 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+

bazis/contrib/authing/services/google/__init__.py

@@ -0,0 +1,29 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from django.utils.translation import gettext_lazy as _
+
+
+AUTH_CODE = 'google'
+
+
+def get_login_action():
+    from bazis.core.app import app
+
+    return {
+        'code': AUTH_CODE,
+        'name': _('Google Authentication'),
+        'url': app.router.url_path_for('google_auth_init'),
+        'method': 'GET',
+    }