clear-skies 1.19.22__py3-none-any.whl → 2.0.23__py3-none-any.whl

clearskies/authentication/jwks.py

@@ -1,88 +1,165 @@
-from clearskies.authentication import Auth0JWKS
-from clearskies.handlers.exceptions import ClientError
+from __future__ import annotations
+
 import datetime
+import json
+from typing import TYPE_CHECKING, Any
+
+from clearskies import configs, decorators, di
+from clearskies.authentication.authentication import Authentication
+from clearskies.exceptions import ClientError
+from clearskies.security_headers.cors import Cors
+
+if TYPE_CHECKING:
+    from clearskies.input_outputs.input_output import InputOutput
+
+
+class Jwks(Authentication, di.InjectableProperties):
+    """Validate a JWT against a JWKS (JSON Web Key Set)."""
+
+    """
+    The URL of the JWKS
+    """
+    jwks_url = configs.String(required=True)
+
+    """
+    The audience to accept JWTs for.
+    """
+    audience = configs.StringList(default=[])
+
+    """
+    The expected issuer of the JWTs.
+    """
+    issuer = configs.String(default="")
+
+    """
+    The allowed algorithms
+    """
+    algorithms = configs.StringList(default=["RS256"])
+
+    """
+    The number of seconds for which the JWKS URL contents can be cached
+    """
+    jwks_cache_time = configs.Integer(default=86400)
+
+    """
+    The Authorization URL (used in the auto-generated documentation)
+    """
+    authorization_url = configs.String()
+
+    """
+    The name of the security scheme in the auto-generated documentation.
+    """
+    documentation_security_name = configs.String(default="jwt")
+
+    """
+    The environment helper.
+    """
+    environment = di.inject.Environment()
 
+    """
+    The requests object.
+    """
+    requests = di.inject.Requests()
 
-class JWKS(Auth0JWKS):
-    _audience = None
-    _jwks_url = None
-    _jwks_cache_time = None
-    _authorization_url = None
+    """
+    The JoseJwt library
+    """
+    jose_jwt = di.inject.ByName("jose_jwt")
 
-    def __init__(self, environment, requests, jose_jwt):
-        super().__init__(environment, requests, jose_jwt)
+    """
+    The current time
+    """
+    now = di.inject.Now()
 
-    def configure(
+    """
+    Local cache of the JWKS
+    """
+    _jwks = None
+
+    """
+    The time when the JWKS was last fetched
+    """
+    _jwks_fetched: datetime.datetime
+
+    @decorators.parameters_to_properties
+    def __init__(
         self,
-        jwks_url=None,
-        algorithms=None,
-        audience=None,
-        issuer=None,
-        documentation_security_name=None,
-        authorization_url=None,
-        jwks_cache_time=86400,
+        jwks_url: str,
+        audience: str = "",
+        issuer: str = "",
+        algorithms: list[str] = ["RS256"],
+        jwks_cache_time: int = 86400,
+        authorization_url: str = "",
+        documentation_security_name: str = "jwt",
     ):
-        self._audience = audience
-        self._issuer = issuer
-        self._jwks_url = jwks_url
-        self._jwks_cache_time = jwks_cache_time
-        if not self._jwks_url:
-            raise ValueError("Must provide 'jwks_url' when using JWKS authentication")
-        self._algorithms = ["RS256"] if algorithms is None else algorithms
-        self._documentation_security_name = documentation_security_name
-        self._authorization_url = authorization_url if authorization_url else ""
-
-    def authenticate(self, input_output):
-        auth_header = input_output.get_request_header("authorization", True)
+        self.finalize_and_validate_configuration()
+
+    def authenticate(self, input_output: InputOutput) -> bool:
+        auth_header = input_output.request_headers.get("authorization", None)
         if not auth_header:
             raise ClientError("Missing 'Authorization' header in request")
         if auth_header[:7].lower() != "bearer ":
             raise ClientError("Missing 'Bearer ' prefix in authorization header")
         self.validate_jwt(auth_header[7:])
-        input_output.set_authorization_data(self.jwt_claims)
+        input_output.authorization_data = self.jwt_claims
         return True
 
     def validate_jwt(self, raw_jwt):
         try:
-            unverified_header = self._jose_jwt.get_unverified_header(raw_jwt)
-        except self._jose_jwt.JWTError as e:
+            from jwcrypto import jwk, jwt  # type: ignore
+            from jwcrypto.common import JWException  # type: ignore
+        except:
+            raise ValueError(
+                "The JWKS authentication method requires the jwcrypto libraries to be installed.  These are optional dependencies of clearskies, so to include them do a `pip install 'clear-skies[jwcrypto]'`"
+            )
+
+        keys = jwk.JWKSet()
+        keys.import_keyset(json.dumps(self._get_jwks()))
+
+        client_jwt = jwt.JWT()
+        try:
+            client_jwt.deserialize(raw_jwt)
+        except Exception as e:
             raise ClientError(str(e))
-        jwks = self._get_jwks()
-        # find a matching key in the JWKS for the key in the JWT
-        rsa_key = next((key for key in jwks["keys"] if key["kid"] == unverified_header["kid"]), False)
-        if not rsa_key:
-            raise ClientError("No matching keys found")
 
         try:
-            self.jwt_claims = self._jose_jwt.decode(
-                raw_jwt,
-                rsa_key,
-                audience=self._audience,
-                issuer=self._issuer,
-                algorithms=self._algorithms,
-            )
-        except self._jose_jwt.ExpiredSignatureError:
-            raise ClientError("JWT is expired")
-        except self._jose_jwt.JWTClaimsError:
-            raise ClientError("JWT has incorrect claims: double check the audience and issuer")
-        except Exception:
-            raise ClientError("Unable to parse JWT")
+            client_jwt.validate(keys)
+            self.jwt_claims = json.loads(client_jwt.claims)
+        except JWException as e:
+            raise ClientError(str(e))
+
+        if self.issuer and self.jwt_claims.get("iss") != self.issuer:
+            raise ClientError("Issuer does not match")
+
+        if self.audience:
+            jwt_audience = self.jwt_claims.get("aud")
+            if not jwt_audience:
+                raise ClientError("Audience required, but missing in JWT")
+            has_match = False
+            for audience in jwt_audience:
+                if audience == self.audience:
+                    has_match = True
+            if not has_match:
+                raise ClientError("Audience does not match")
+
         return True
 
     def _get_jwks(self):
-        now = datetime.datetime.now()
-        if self._jwks is None or ((now - self._jwks_fetched).total_seconds() > self._jwks_cache_time):
-            self._jwks = self._requests.get(self._jwks_url).json()
-            self._jwks_fetched = now
+        if self._jwks is None or ((self.now - self._jwks_fetched).total_seconds() > self.jwks_cache_time):
+            self._jwks = self.requests.get(self.jwks_url).json()
+            self._jwks_fetched = self.now
 
         return self._jwks
 
-    def documentation_security_scheme(self):
+    def documentation_security_scheme(self) -> dict[str, Any]:
         return {
             "type": "oauth2",
             "description": "JWT based authentication",
-            "flows": {"implicit": {"authorizationUrl": self._authorization_url, "scopes": {}}},
+            "flows": {"implicit": {"authorizationUrl": self.authorization_url, "scopes": {}}},
         }
 
-    def documentation_security_scheme_name(self):
-        return self._documentation_security_name if self._documentation_security_name is not None else "jwt"
+    def documentation_security_scheme_name(self) -> str:
+        return self.documentation_security_name
+
+    def set_headers_for_cors(self, cors: Cors):
+        cors.add_header("Authorization")

clearskies/authentication/public.py

@@ -1,28 +1,5 @@
-class Public:
-    is_public = True
-    can_authorize = False
-    has_dynamic_credentials = False
+from .authentication import Authentication
 
-    def headers(self, retry_auth=False):
-        return {}
 
-    def configure(self):
-        pass
-
-    def authenticate(self, input_output):
-        return True
-
-    def authorize(self, authorization):
-        raise ValueError("Public endpoints do not support authorization")
-
-    def set_headers_for_cors(self, cors):
-        pass
-
-    def documentation_request_parameters(self):
-        return []
-
-    def documentation_security_scheme(self):
-        return {}
-
-    def documentation_security_scheme_name(self):
-        return ""
+class Public(Authentication):
+    pass