dash-auth-plus 0.0.1a1__py3-none-any.whl

dash_auth_plus/__init__.py

@@ -0,0 +1,32 @@
+from .public_routes import add_public_routes, public_callback
+from .basic_auth import BasicAuth
+from .group_protection import (
+    list_groups,
+    check_groups,
+    protected,
+    protected_callback,
+    protect_layouts,
+)
+
+# oidc auth requires authlib, install with `pip install dash-auth-plus[oidc]`
+try:
+    from .oidc_auth import OIDCAuth, get_oauth
+except ModuleNotFoundError:
+    pass
+from .version import __version__, __plotly_dash_auth_version__
+
+
+__all__ = [
+    "add_public_routes",
+    "check_groups",
+    "list_groups",
+    "get_oauth",
+    "protect_layouts",
+    "protected",
+    "protected_callback",
+    "public_callback",
+    "BasicAuth",
+    "OIDCAuth",
+    "__version__",
+    "__plotly_dash_auth_version__",
+]

dash_auth_plus/auth.py

@@ -0,0 +1,134 @@
+from __future__ import absolute_import
+from abc import ABC, abstractmethod
+from typing import Optional, Union
+
+from dash import Dash
+from flask import request
+
+from .public_routes import (
+    add_public_routes,
+    get_public_callbacks,
+    get_public_routes,
+)
+from .group_protection import protect_layouts
+
+
+class Auth(ABC):
+    def __init__(
+        self,
+        app: Dash,
+        public_routes: Optional[list] = None,
+        auth_protect_layouts: Optional[Union[dict, bool]] = False,
+        auth_protect_layouts_kwargs: Optional[dict] = None,
+        page_container: Optional[str] = None,
+        **obsolete,
+    ):
+        """Auth base class for authentication in Dash.
+
+        :param app: Dash app
+        :param public_routes: list of public routes, routes should follow the
+            Flask route syntax
+        :param auth_protect_layouts: bool, defaults to False.
+            If true, runs protect_layout()
+        :param auth_protect_layouts_kwargs: dict, if provided is passed to the
+            protect_layout as kwargs
+        :param page_container: string, id of the page container in the app.
+            If not provided, this will set the page_container_test to True,
+            meaning all pathname callbacks will be judged.
+        """
+
+        # Deprecated arguments
+        if obsolete:
+            raise TypeError(f"Auth got unexpected keyword arguments: {list(obsolete)}")
+
+        self.app = app
+        self._protect()
+        self.auth_protect_layouts = auth_protect_layouts
+        self.page_container = page_container
+        if public_routes is not None:
+            add_public_routes(app, public_routes)
+        if self.auth_protect_layouts:
+            protect_layouts(
+                public_routes=get_public_routes(self.app),
+                **(auth_protect_layouts_kwargs or {}),
+            )
+
+    def _protect(self):
+        """Add a before_request authentication check on all routes.
+
+        The authentication check will pass if either
+            * The endpoint is marked as public via `add_public_routes`
+            * The request is authorised by `Auth.is_authorised`
+        """
+
+        server = self.app.server
+
+        @server.before_request
+        def before_request_auth():
+
+            public_routes = get_public_routes(self.app)
+            public_callbacks = get_public_callbacks(self.app)
+
+            # Handle Dash's callback route:
+            # * Check whether the callback is marked as public
+            # * Check whether the callback is performed on route change in
+            #   which case the path should be checked against the public routes
+            if request.path == "/_dash-update-component":
+                body = request.get_json()
+
+                # Check whether the callback is marked as public
+                if body["output"] in public_callbacks:
+                    return None
+
+                pathname = next(
+                    (
+                        inp.get("value")
+                        for inp in body["inputs"]
+                        if isinstance(inp, dict) and inp.get("property") == "pathname"
+                    ),
+                    None,
+                )
+                if self.page_container:
+                    page_container_test = next(
+                        (
+                            out
+                            for out in body["outputs"]
+                            if isinstance(out, dict)
+                            and out.get("id") == self.page_container
+                            and out.get("property") == "children"
+                        ),
+                        None,
+                    )
+                else:
+                    page_container_test = True
+
+                # Check whether the callback has an input using the pathname,
+                # such a callback will be a routing callback and the pathname
+                # should be checked against the public routes
+                if not self.auth_protect_layouts:
+                    if (
+                        pathname
+                        and page_container_test
+                        and public_routes.test(pathname)
+                    ):
+                        return None
+                else:
+                    # protected by layout
+                    if pathname and page_container_test:
+                        return None
+
+            # If the route is not a callback route, check whether the path
+            # matches a public route, or whether the request is authorised
+            if public_routes.test(request.path) or self.is_authorized():
+                return None
+
+            # Otherwise, ask the user to log in
+            return self.login_request()
+
+    @abstractmethod
+    def is_authorized(self):
+        pass
+
+    @abstractmethod
+    def login_request(self):
+        pass

dash_auth_plus/basic_auth.py

@@ -0,0 +1,124 @@
+import base64
+import logging
+from typing import Dict, List, Optional, Union, Callable
+import flask
+from dash import Dash
+
+from .auth import Auth
+
+UserGroups = Dict[str, List[str]]
+
+
+class BasicAuth(Auth):
+    def __init__(
+        self,
+        app: Dash,
+        username_password_list: Union[list, dict] = None,
+        auth_func: Callable = None,
+        public_routes: Optional[list] = None,
+        user_groups: Optional[Union[UserGroups, Callable[[str], UserGroups]]] = None,
+        secret_key: str = None,
+        auth_protect_layouts: Optional[bool] = False,
+        auth_protect_layouts_kwargs: Optional[dict] = None,
+        page_container: Optional[str] = None,
+    ):
+        """Add basic authentication to Dash.
+
+        :param app: Dash app
+        :param username_password_list: username:password list, either as a
+            list of tuples or a dict
+        :param auth_func: python function accepting two string
+            arguments (username, password) and returning a
+            boolean (True if the user has access otherwise False).
+        :param public_routes: list of public routes, routes should follow the
+            Flask route syntax
+        :param user_groups: a dict or a function returning a dict
+            Optional group for each user, allowing to protect routes and
+            callbacks depending on user groups
+        :param secret_key: Flask secret key
+            A string to protect the Flask session, by default None.
+            It is required if you need to store the current user
+            in the session.
+            Generate a secret key in your Python session
+            with the following commands:
+            >>> import os
+            >>> import base64
+            >>> base64.b64encode(os.urandom(30)).decode('utf-8')
+            Note that you should not do this dynamically:
+            you should create a key and then assign the value of
+            that key in your code.
+        :param auth_protect_layouts: bool, defaults to False.
+            If true, runs protect_layout()
+        :param auth_protect_layouts_kwargs: dict, if provided is passed to the
+            protect_layout as kwargs
+        :param page_container: string, id of the page container in the app.
+            If not provided, this will set the page_container_test to True,
+            meaning all pathname callbacks will be judged.
+        """
+        super().__init__(
+            app,
+            public_routes=public_routes,
+            auth_protect_layouts=auth_protect_layouts,
+            auth_protect_layouts_kwargs=auth_protect_layouts_kwargs,
+            page_container=page_container,
+        )
+        self._auth_func = auth_func
+        self._user_groups = user_groups
+        if secret_key is not None:
+            app.server.secret_key = secret_key
+
+        if self._auth_func is not None:
+            if username_password_list is not None:
+                raise ValueError(
+                    "BasicAuth can only use authorization function "
+                    "(auth_func kwarg) or username_password_list, "
+                    "it cannot use both."
+                )
+        else:
+            if username_password_list is None:
+                raise ValueError(
+                    "BasicAuth requires username/password map "
+                    "or user-defined authorization function."
+                )
+            else:
+                self._users = (
+                    username_password_list
+                    if isinstance(username_password_list, dict)
+                    else {k: v for k, v in username_password_list}
+                )
+
+    def is_authorized(self):
+        header = flask.request.headers.get("Authorization", None)
+        if not header:
+            return False
+        username_password = base64.b64decode(header.split("Basic ")[1])
+        username_password_utf8 = username_password.decode("utf-8")
+        username, password = username_password_utf8.split(":", 1)
+        authorized = False
+        if self._auth_func is not None:
+            try:
+                authorized = self._auth_func(username, password)
+            except Exception:
+                logging.exception("Error in authorization function.")
+                return False
+        else:
+            authorized = self._users.get(username) == password
+        if authorized:
+            try:
+                flask.session["user"] = {"email": username, "groups": []}
+                if callable(self._user_groups):
+                    flask.session["user"]["groups"] = self._user_groups(username)
+                elif self._user_groups:
+                    flask.session["user"]["groups"] = self._user_groups.get(
+                        username, []
+                    )
+            except RuntimeError:
+                logging.warning("Session is not available. Have you set a secret key?")
+        return authorized
+
+    def login_request(self):
+        return flask.Response(
+            "Login Required",
+            headers={"WWW-Authenticate": 'Basic realm="User Visible Realm"'},
+            status=401,
+        )

dash_auth_plus/group_protection.py

@@ -0,0 +1,325 @@
+import logging
+import re
+from typing import Any, Callable, List, Literal, Optional, Union
+from werkzeug.routing import MapAdapter
+
+import dash
+from dash.exceptions import PreventUpdate
+from flask import session, has_request_context
+from dash import html
+
+
+OutputVal = Union[Callable[[], Any], Any]
+CheckType = Literal["one_of", "all_of", "none_of"]
+
+
+def list_groups(
+    *,
+    groups_key: str = "groups",
+    groups_str_split: str = None,
+) -> Optional[List[str]]:
+    """List all the groups the user belongs to.
+
+    :param groups_key: Groups key in the user data saved in the Flask session
+        e.g. session["user"] == {"email": "a.b@mail.com", "groups": ["admin"]}
+    :param groups_str_split: Used to split groups if provided as a string
+    :return: None or list[str]:
+        * None if the user is not authenticated
+        * list[str] otherwise
+    """
+    if not has_request_context() or "user" not in session:
+        return None
+
+    user_groups = session.get("user", {}).get(groups_key, [])
+    # Handle cases where groups are ,- or ;-separated string,
+    # may depend on OIDC provider
+    if isinstance(user_groups, str) and groups_str_split is not None:
+        user_groups = re.split(groups_str_split, user_groups)
+    return user_groups
+
+
+def check_groups(
+    groups: Optional[Union[Callable, List[str]]] = None,
+    *,
+    groups_key: str = "groups",
+    groups_str_split: str = None,
+    check_type: CheckType = "one_of",
+    group_lookup: dict = None,
+    restricted_users: Optional[Union[Callable, List[str]]] = None,
+    restricted_users_lookup: dict = None,
+    user_session_key: str = "email",
+) -> Optional[bool]:
+    """Check whether the current user is authenticated
+    and has the specified groups.
+
+    :param groups: List of groups or a python function
+        to return a list of groups.
+        If this is a function, will be called with group_lookup dict as kwargs.
+        The result is used to check for with check_type
+    :param groups_key: Groups key in the user data saved in the Flask session
+        e.g. session["user"] == {"email": "a.b@mail.com", "groups": ["admin"]}
+    :param groups_str_split: Used to split groups if provided as a string
+    :param check_type: Type of check to perform.
+        Either "one_of", "all_of" or "none_of"
+    :param group_lookup: A dictionary of kwargs to be passed
+        if groups is a function.
+        e.g. {"path": "/test"} will work with this as a
+        groups function: check_path(path)
+    :param restricted_users: List of restricted users or a python function
+        to return a list of users.
+         If this is a function, will be called with
+         restricted_users_lookup dict as kwargs.
+    :param restricted_users_lookup: A dictionary of kwargs to be passed
+        if restricted_users is a function.
+        e.g. {"path": "/test"} will work with this as a
+        restricted_users function: check_users_path(path)
+    :param user_session_key: String of a key in the session["user"] cookie
+        where the user will be used to determine whether they are
+        in the list of restricted_users. Defaults to "email".
+    :return: None or boolean:
+        * None if the user is not authenticated
+        * True if the user is authenticated and has the right permissions
+        * False if the user is authenticated but does not have
+          the right permissions
+    """
+    user_groups = list_groups(
+        groups_key=groups_key,
+        groups_str_split=groups_str_split,
+    )
+
+    if user_groups is None:
+        # User is not authenticated
+        return None
+
+    if restricted_users:
+        if callable(restricted_users):
+            restricted_users = restricted_users(**(restricted_users_lookup or {}))
+        if session["user"][user_session_key] in restricted_users:
+            # User is restricted
+            return False
+    if callable(groups):
+        groups = groups(**(group_lookup or {}))
+    if groups is None:
+        return True
+
+    if check_type == "one_of":
+        return bool(set(user_groups).intersection(groups))
+    if check_type == "all_of":
+        return all(group in user_groups for group in groups)
+    if check_type == "none_of":
+        return not any(group in user_groups for group in groups)
+
+    raise ValueError(f"Invalid check_type: {check_type}")
+
+
+def protected(
+    unauthenticated_output: OutputVal,
+    *,
+    missing_permissions_output: Optional[OutputVal] = None,
+    groups: Optional[Union[Callable, List[str]]] = None,
+    groups_key: str = "groups",
+    groups_str_split: str = None,
+    check_type: CheckType = "one_of",
+    group_lookup: dict = None,
+    restricted_users: Optional[Union[Callable, List[str]]] = None,
+    restricted_users_lookup: dict = None,
+    user_session_key: str = "email",
+    **_kwargs,
+) -> Callable:
+    """Decorate a function or output to alter it depending on the state
+    of authentication and permissions.
+
+    :param unauthenticated_output: Output when the user is not authenticated.
+        Note: needs to be a function with no argument or static outputs.
+    :param missing_permissions_output: Output when the user is authenticated
+        but does not have the right permissions.
+        It defaults to unauthenticated_output when not set.
+        Note: needs to be a function with no argument or static outputs.
+    :param groups: List of authorized user groups
+        or a python function to return a list of groups.
+        If this is a function, will be called with group_lookup dict as kwargs.
+        If no groups are passed,
+        the decorator will only check whether the user is authenticated.
+    :param groups_key: Groups key in the user data saved in the Flask session
+        e.g. session["user"] == {"email": "a.b@mail.com", "groups": ["admin"]}
+    :param groups_str_split: Used to split groups if provided as a string
+    :param check_type: Type of check to perform.
+        Either "one_of", "all_of" or "none_of"
+    :param group_lookup: A dictionary of kwargs to be passed
+        if groups is a function.
+        e.g. {"path": "/test"} will work with this as a
+        groups function: check_path(path)
+    :param restricted_users: List of restricted users or a python function
+        to return a list of users.
+         If this is a function, will be called with
+         restricted_users_lookup dict as kwargs.
+    :param restricted_users_lookup: A dictionary of kwargs to be passed
+        if restricted_users is a function.
+        e.g. {"path": "/test"} will work with this as a
+        restricted_users function: check_users_path(path)
+    :param user_session_key: String of a key in the session["user"] cookie
+        where the user will be used to determine whether they are
+        in the list of restricted_users. Defaults to "email".
+    """
+
+    if missing_permissions_output is None:
+        missing_permissions_output = unauthenticated_output
+
+    def decorator(output: OutputVal):
+        def wrap(*args, **kwargs):
+            def process_output(output, *args, **kwargs):
+                if isinstance(output, Callable):
+                    return output(*args, **kwargs)
+                return output
+
+            authorized = check_groups(
+                groups=groups,
+                groups_key=groups_key,
+                groups_str_split=groups_str_split,
+                check_type=check_type,
+                group_lookup=group_lookup,
+                restricted_users=restricted_users,
+                restricted_users_lookup=restricted_users_lookup,
+                user_session_key=user_session_key,
+            )
+            if authorized is None:
+                return process_output(unauthenticated_output)
+            if authorized:
+                return process_output(output, *args, **kwargs)
+            return process_output(missing_permissions_output)
+
+        if isinstance(output, Callable):
+            return wrap
+        return wrap()
+
+    return decorator
+
+
+def protected_callback(
+    *callback_args,
+    unauthenticated_output: Optional[OutputVal] = None,
+    missing_permissions_output: Optional[OutputVal] = None,
+    groups: Optional[Union[Callable, List[str]]] = None,
+    groups_key: str = "groups",
+    groups_str_split: str = None,
+    check_type: CheckType = "one_of",
+    group_lookup: dict = None,
+    restricted_users: Optional[Union[Callable, List[str]]] = None,
+    restricted_users_lookup: dict = None,
+    user_session_key: str = "email",
+    **callback_kwargs,
+) -> Callable:
+    """Protected Dash callback.
+
+    :param **: all args and kwargs passed to a Dash callback
+    :param unauthenticated_output: Output when the user is not authenticated.
+        **Note**: Needs to be a function with no argument or static outputs.
+        You can access the Dash callback context within the function call if
+        you need to use some of the inputs/states of the callback.
+        If left as None, it will simply raise PreventUpdate, stopping the
+        callback from processing.
+    :param missing_permissions_output: Output when the user is authenticated
+        but does not have the right permissions.
+        It defaults to unauthenticated_output when not set.
+        **Note**: Needs to be a function with no argument or static outputs.
+        You can access the Dash callback context within the function call if
+        you need to use some of the inputs/states of the callback.
+        If left as None, it will simply raise PreventUpdate, stopping the
+        callback from processing.
+    :param groups: List of authorized user groups
+        or a python function to return a list of groups.
+        If this is a function, will be called with group_lookup dict as kwargs.
+    :param groups_key: Groups key in the user data saved in the Flask session
+        e.g. session["user"] == {"email": "a.b@mail.com", "groups": ["admin"]}
+    :param groups_str_split: Used to split groups if provided as a string
+    :param check_type: Type of check to perform.
+        Either "one_of", "all_of" or "none_of"
+    :param group_lookup: A dictionary of kwargs to be passed
+        if groups is a function.
+        e.g. {"path": "/test"} will work with this as a
+        groups function: check_path(path)
+    :param restricted_users: List of restricted users or a python function
+        to return a list of users.
+         If this is a function, will be called with
+         restricted_users_lookup dict as kwargs.
+    :param restricted_users_lookup: A dictionary of kwargs to be passed
+        if restricted_users is a function.
+        e.g. {"path": "/test"} will work with this as a
+        restricted_users function: check_users_path(path)
+    :param user_session_key: String of a key in the session["user"] cookie
+        where the user will be used to determine whether they are
+        in the list of restricted_users. Defaults to "email".
+    """
+
+    def decorator(func):
+        def prevent_unauthenticated():
+            logging.info(
+                "A user tried to run %s without being authenticated.",
+                func.__name__,
+            )
+            raise PreventUpdate
+
+        def prevent_unauthorised():
+            logging.info(
+                "%s tried to run %s but did not have the right permissions.",
+                session["user"]["email"],
+                func.__name__,
+            )
+            raise PreventUpdate
+
+        wrapped_func = dash.callback(*callback_args, **callback_kwargs)(
+            protected(
+                unauthenticated_output=(
+                    unauthenticated_output
+                    if unauthenticated_output is not None
+                    else prevent_unauthenticated
+                ),
+                missing_permissions_output=(
+                    missing_permissions_output
+                    if missing_permissions_output is not None
+                    else prevent_unauthorised
+                ),
+                groups=groups,
+                groups_key=groups_key,
+                groups_str_split=groups_str_split,
+                check_type=check_type,
+                group_lookup=group_lookup,
+                restricted_users=restricted_users,
+                restricted_users_lookup=restricted_users_lookup,
+                user_session_key=user_session_key,
+            )(func)
+        )
+
+        def wrap(*args, **kwargs):
+            return wrapped_func(*args, **kwargs)
+
+        return wrap
+
+    return decorator
+
+
+def protect_layouts(
+    public_routes: Union[List[str], MapAdapter] = None, **kwargs
+) -> str:
+    if "pages_folder" in dash.get_app().config:
+        for pg in dash.page_registry.values():
+            new_kwargs = {**kwargs, **pg}
+            if new_kwargs.get("unauthenticated_output") is None:
+                new_kwargs["unauthenticated_output"] = html.Div(
+                    "You do not have access to this content."
+                )
+            if public_routes:
+                if isinstance(public_routes, list):
+                    if not (
+                        pg["path"] in public_routes
+                        or pg.get("path_template") in public_routes
+                    ):
+                        pg["layout"] = protected(**new_kwargs)(pg["layout"])
+                elif not (
+                    public_routes.test(pg.get("path_template"))
+                    or public_routes.test(pg["path"])
+                ):
+                    pg["layout"] = protected(**new_kwargs)(pg["layout"])
+            else:
+                pg["layout"] = protected(**new_kwargs)(pg["layout"])
+        return "your layouts are now protected"