cms-jwt 0.2.0__py3-none-any.whl

cms_jwt-0.2.0.dist-info/METADATA

@@ -0,0 +1,5 @@
+Metadata-Version: 2.4
+Name: cms-jwt
+Version: 0.2.0
+Requires-Python: >=3.10
+Dynamic: requires-python

cms_jwt-0.2.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+cms_jwt_import_auth/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cms_jwt_import_auth/apps.py,sha256=MN-6wJb6hogjkdNitK73eJAFJTxeWNeMF1RvOtt2zwU,421
+cms_jwt_import_auth/bkp_tutor.py,sha256=WG-jmUJri2HqQEB0VNHGr7SW-omj2e47qdrf90V2SVg,1138
+cms_jwt_import_auth/middleware.py,sha256=sGr0yoTcvzj7fJmZPAxZP7EmeiMIPTLLXGlKb5r4o38,1968
+cms_jwt-0.2.0.dist-info/METADATA,sha256=o3LiNAipgA--CCtrX58s8L7uD7cDxLCMr8jNMt-iVVY,100
+cms_jwt-0.2.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+cms_jwt-0.2.0.dist-info/entry_points.txt,sha256=dLKqSjEXCuwF40XdxvhDeDDWqp8hKiJoSs2cmJFZ5oU,74
+cms_jwt-0.2.0.dist-info/top_level.txt,sha256=0EQPRrTo85_1lQvSWaaqeOZC-JSn-Igm_R1Gs5dQ6oI,20
+cms_jwt-0.2.0.dist-info/RECORD,,

cms_jwt-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.9.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

cms_jwt-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[cms.djangoapp]
+cms_jwt = cms_jwt_import_auth.apps:CMSJWTImportAuthConfig

cms_jwt-0.2.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+cms_jwt_import_auth

cms_jwt_import_auth/apps.py

@@ -0,0 +1,15 @@
+from django.apps import AppConfig
+
+class CMSJWTImportAuthConfig(AppConfig):
+    name = "cms_jwt_import_auth"
+    verbose_name = "CMS JWT-or-Session auth for course import"
+
+    plugin_app = {
+        'settings_config': {
+            'cms.djangoapp': {
+                'common': {'relative_path': 'settings.common'},
+                'production': {'relative_path': 'settings.production'},
+            },
+        },
+    }
+

cms_jwt_import_auth/bkp_tutor.py

@@ -0,0 +1,28 @@
+from tutor import hooks
+
+def register():
+    # Ensure the Django app is present in the image
+    hooks.Filters.CMS_EXTRA_REQUIREMENTS.add_item("edx-drf-extensions")
+    # If your Django app is published to pip, add it here too:
+    # hooks.Filters.CMS_EXTRA_REQUIREMENTS.add_item("cms-jwt-import-auth>=0.1.0")
+
+    # Load the Django app + middleware
+    hooks.Filters.CMS_EXTRA_APPS.add_item("cms_jwt_import_auth")
+    hooks.Filters.CMS_EXTRA_MIDDLEWARE.add_item(
+        "cms_jwt_import_auth.middleware.ImportJWTOrSessionMiddleware"
+    )
+
+    # Optional settings patch
+    def _patch(settings):
+        settings.setdefault("REST_FRAMEWORK", {})
+        settings["REST_FRAMEWORK"]["DEFAULT_AUTHENTICATION_CLASSES"] = (
+            "edx_rest_framework_extensions.auth.jwt.authentication.JwtAuthentication",
+            "rest_framework.authentication.SessionAuthentication",
+        )
+        settings.setdefault("JWT_AUTH", {})
+        settings["JWT_AUTH"].update({
+            "JWT_ISSUER": "https://campus-dev.nextere.com/oauth2",
+            "JWT_AUDIENCE": "openedx",
+        })
+    hooks.Filters.CMS_EXTRA_SETTINGS.add_item(_patch)
+

cms_jwt_import_auth/middleware.py

@@ -0,0 +1,56 @@
+from __future__ import annotations
+import re
+from typing import Optional
+
+from django.http import JsonResponse
+from django.utils.deprecation import MiddlewareMixin
+from django.contrib.auth.models import AnonymousUser
+
+from rest_framework.request import Request as DRFRequest
+from edx_rest_framework_extensions.auth.jwt.authentication import JwtAuthentication
+
+class ImportJWTOrSessionMiddleware(MiddlewareMixin):
+    """
+    Enforce authentication for the course import endpoint in CMS:
+      /api/courses/v1/<course_id>/import/
+    Accept either:
+      - existing logged-in Studio session, OR
+      - JWT in Authorization header (JWT or Bearer)
+    If neither present/valid -> 401 JSON.
+
+    NOTE:
+    - Keep this middleware scoped to just the import route to avoid overhead.
+    """
+
+    # Path matcher (strict, trailing slash optional)
+    # Example: /api/courses/v1/course-v1:ACME+ONB101+2025_T1/import/
+    PATTERN = re.compile(
+        r"^/api/courses/v1/[^/]+/import/?$"
+    )
+
+    def process_request(self, request):
+        path = request.path or ""
+        if not self.PATTERN.match(path):
+            return None  # ignore all other routes
+
+        # If session-authenticated, allow through
+        user = getattr(request, "user", None)
+        if user is not None and user.is_authenticated:
+            return None
+
+        # Try JWT auth (accept JWT or Bearer header schemes)
+        auth = JwtAuthentication()
+        drf_request = DRFRequest(request)
+        try:
+            user_auth_tuple: Optional[tuple] = auth.authenticate(drf_request)
+        except Exception as e:
+            # Invalid token format / signature, return 401
+            return JsonResponse({"detail": f"Invalid JWT: {str(e)}"}, status=401)
+
+        if user_auth_tuple:
+            request.user, _ = user_auth_tuple
+            return None  # authenticated via JWT
+
+        # Neither session nor JWT
+        return JsonResponse({"detail": "Authentication required"}, status=401)
+