easyapi-django 1.3.2__tar.gz → 1.5.0__tar.gz

{easyapi_django-1.3.2/easyapi_django.egg-info → easyapi_django-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: easyapi-django
-Version: 1.3.2
+Version: 1.5.0
 Summary: Zero-effort MCP server (and REST API) generator from Django models.
 Author-email: Stamatios Stamou Jr <bushier.outsets.0c@icloud.com>
 License-Expression: MIT
@@ -170,7 +170,9 @@ REST is mostly a solved problem now. The new pain is MCP — most teams are rebu
 
 **Shared (`CoreResource`)**
 - Bearer + `X-Api-Key` + session-cookie auth.
-- Per-IP rate limit, scanner blocking, 4xx flood detection.
+- Pre-auth per-IP throttling; authenticated abuse blocking by tenant/user or
+  API-key digest (anonymous traffic falls back to IP).
+- Scanner blocking and semantic invalid-request detection.
 - Multi-tenant DB routing. One call switches the connection for the request.
 - Sliding session TTLs via Redis `GETEX`. Configure with `SESSION_TTL` (default 1800s) and `API_SESSION_TTL` (default 300s).
 - Sensitive-field scrubbing (`password`, `api_key`, `token` baseline plus your additions) — applied on both REST and MCP responses.
@@ -233,11 +235,24 @@ Defaults are demo-friendly. Production deployments should:
 - **Per-resource ownership.** Set `owner_field = 'owner_id'` on resources where rows belong to a single user — restricts every CRUD operation to the row's owner. `POST` always forces `owner_id` to the caller (override with `allow_owner_override = True` for admin paths).
 - **Authenticated cache.** If you turn on `cache = True` for an authenticated resource, set `session_cache = True` or `cache_scope_fields = (...)` — otherwise responses can leak across users. The framework warns at runtime when it detects this combination.
 - **Tune session TTLs.** `SESSION_TTL` (cookies, default 1800s) and `API_SESSION_TTL` (api-key cache, default 300s) both slide on use. Pick numbers that match your security/UX trade-off.
-- **Never ship `DEBUG = True`.** Under `DEBUG`, edge security (scanner blocking, 4xx flood detection), rate limiting, credential-path defense and abuse blocking are all bypassed for dev ergonomics. The framework logs a loud startup warning when the bypass is active. To decouple from `DEBUG` — e.g. a staging box mirroring production — set `EASYAPI = {'SECURITY_BYPASS': False}` to force protections on (or `True` to bypass without `DEBUG`).
-- **Trust your proxies explicitly.** IP-based rate limits and abuse blocking key on the client IP. `X-Forwarded-For` / `X-Real-IP` are only honored when `REMOTE_ADDR` is in `TRUSTED_PROXIES = ['10.0.0.0/8', ...]`; otherwise `REMOTE_ADDR` wins. Leave it unset behind a proxy and every request looks like it comes from the proxy.
+- **Never ship `DEBUG = True`.** Under `DEBUG`, edge security (scanner blocking, semantic invalid-request detection), rate limiting, credential-path defense and abuse blocking are all bypassed for dev ergonomics. The framework logs a loud startup warning when the bypass is active. To decouple from `DEBUG` — e.g. a staging box mirroring production — set `EASYAPI = {'SECURITY_BYPASS': False}` to force protections on (or `True` to bypass without `DEBUG`).
+- **Trust your proxies explicitly.** Pre-auth throttles, scanner blocking and anonymous abuse detection key on the client IP. `X-Forwarded-For` / `X-Real-IP` are only honored when `REMOTE_ADDR` is in `TRUSTED_PROXIES = ['10.0.0.0/8', ...]`; otherwise `REMOTE_ADDR` wins. Leave it unset behind a proxy and every request looks like it comes from the proxy.
+- **Authenticated blocks follow the principal.** The fast pre-auth throttle,
+  login defense and path/User-Agent scanner signatures remain IP-based.
+  After successful authentication, semantic events and sustained abuse use a
+  tenant-scoped user digest or API-key digest; anonymous requests keep using
+  IP. This prevents one authenticated user behind a shared NAT from blocking
+  everyone else while still stopping the same principal after an IP change.
+- **Bound external Bearer resolvers.** Query-contract failures are attributed
+  after authentication, so an unknown/protected parameter carrying a Bearer
+  token can invoke `BEARER_RESOLVER` before the request is rejected. The
+  default `NO_RESOLVER` path performs no external call. Custom network-backed
+  resolvers should enforce a short timeout, cache safely where appropriate,
+  and be latency/load-tested behind the pre-auth IP throttle.
 - **`/metrics` is opt-in.** `get_routes` doesn't mount it unless you pass `metrics_view=Metrics` (the generic, unscoped resource — `from easyapi import Metrics`) or a custom row-scoped subclass. Once mounted, bound which models it can query: set `METRICS_MODELS = ['app_Model', ...]` to allowlist them. References to credential-named columns (in filters, groups, order or calc) are always rejected regardless — the per-resource escape hatch does not reach `/metrics`.
 - **Bound the metrics fields, per model.** `METRICS_MODELS` only gates *which models* — every non-credential field on an allowed model is still fair game for `/metrics` (filter, group, order, calc), including arbitrary FK traversal. Set `METRICS_FIELDS = {'app_Model': ['status', 'owner__name', ...]}` to also allowlist *which field paths*, per model. Unlike REST's `filter_fields` (root-segment match), this checks the **full** `__`-joined path — `'owner'` in the list does not imply `'owner__anything'` is allowed. `filter_by` references tolerate one trailing Django lookup (`owner__name__icontains` matches an allowed `owner__name`) since those reach `Q(**kwargs)` directly; `calc`/`group_by`/`order`/`additional_fields`/`conditions` don't take lookups and are matched literally. A model absent from the dict, or the setting left unset, stays unrestricted — opt-in, same as `METRICS_MODELS`. If you already maintain a `bi_fields`/`related_fields` map for a frontend field picker, `easyapi.util.flatten_include_fields(model, bag)` turns that same data into the flat path list this setting expects, so there's one source of truth instead of two.
 - **Keep the escape hatch narrow.** Columns whose names look like credentials (`password`, `api_key`, `token`, `otp`, `secret`, …) are masked as `'*********'` on every response, on top of whatever `sensitive_fields` lists. When the heuristic catches a false positive, opt it out per surface: `edit_allow_sensitive_fields = ['token_count']` returns it verbatim on `GET /resource/<id>/` while LIST still masks it. `list_allow_sensitive_fields` does the same for LIST, where every row carries the value — reach for the detail-only form first.
+- **Keep query capabilities separate.** Query-string names outside the framework contract are rejected. Declare custom names in `extra_query_params`. A protected name allowed in a LIST response through `list_allow_sensitive_fields` is still forbidden as a direct/JSON filter; add it separately to `allow_protected_query_fields` only when filtering by that value is intentional. Existing resources using the response escape hatch may need this explicit filter capability after upgrading.
 - **OAuth clients are public by default.** MCP clients (Claude.ai, ChatGPT, ...) authenticate with PKCE — list them under `EASYAPI['OAUTH_CLIENTS']` with no `client_secret`. A client becomes confidential only with an explicit secret; `/register` never hands out a confidential secret (provision those out of band).
 
 ---
@@ -262,4 +277,3 @@ There's no CLA, no contributor matrix, no roadmap voting. Just open an issue and
 - **Python** — 3.10+
 - **Django** — 5.0+
 - **Repo** — github.com/ssjunior/easyapi-django
-

{easyapi_django-1.3.2 → easyapi_django-1.5.0}/README.md

@@ -126,7 +126,9 @@ REST is mostly a solved problem now. The new pain is MCP — most teams are rebu
 
 **Shared (`CoreResource`)**
 - Bearer + `X-Api-Key` + session-cookie auth.
-- Per-IP rate limit, scanner blocking, 4xx flood detection.
+- Pre-auth per-IP throttling; authenticated abuse blocking by tenant/user or
+  API-key digest (anonymous traffic falls back to IP).
+- Scanner blocking and semantic invalid-request detection.
 - Multi-tenant DB routing. One call switches the connection for the request.
 - Sliding session TTLs via Redis `GETEX`. Configure with `SESSION_TTL` (default 1800s) and `API_SESSION_TTL` (default 300s).
 - Sensitive-field scrubbing (`password`, `api_key`, `token` baseline plus your additions) — applied on both REST and MCP responses.
@@ -189,11 +191,24 @@ Defaults are demo-friendly. Production deployments should:
 - **Per-resource ownership.** Set `owner_field = 'owner_id'` on resources where rows belong to a single user — restricts every CRUD operation to the row's owner. `POST` always forces `owner_id` to the caller (override with `allow_owner_override = True` for admin paths).
 - **Authenticated cache.** If you turn on `cache = True` for an authenticated resource, set `session_cache = True` or `cache_scope_fields = (...)` — otherwise responses can leak across users. The framework warns at runtime when it detects this combination.
 - **Tune session TTLs.** `SESSION_TTL` (cookies, default 1800s) and `API_SESSION_TTL` (api-key cache, default 300s) both slide on use. Pick numbers that match your security/UX trade-off.
-- **Never ship `DEBUG = True`.** Under `DEBUG`, edge security (scanner blocking, 4xx flood detection), rate limiting, credential-path defense and abuse blocking are all bypassed for dev ergonomics. The framework logs a loud startup warning when the bypass is active. To decouple from `DEBUG` — e.g. a staging box mirroring production — set `EASYAPI = {'SECURITY_BYPASS': False}` to force protections on (or `True` to bypass without `DEBUG`).
-- **Trust your proxies explicitly.** IP-based rate limits and abuse blocking key on the client IP. `X-Forwarded-For` / `X-Real-IP` are only honored when `REMOTE_ADDR` is in `TRUSTED_PROXIES = ['10.0.0.0/8', ...]`; otherwise `REMOTE_ADDR` wins. Leave it unset behind a proxy and every request looks like it comes from the proxy.
+- **Never ship `DEBUG = True`.** Under `DEBUG`, edge security (scanner blocking, semantic invalid-request detection), rate limiting, credential-path defense and abuse blocking are all bypassed for dev ergonomics. The framework logs a loud startup warning when the bypass is active. To decouple from `DEBUG` — e.g. a staging box mirroring production — set `EASYAPI = {'SECURITY_BYPASS': False}` to force protections on (or `True` to bypass without `DEBUG`).
+- **Trust your proxies explicitly.** Pre-auth throttles, scanner blocking and anonymous abuse detection key on the client IP. `X-Forwarded-For` / `X-Real-IP` are only honored when `REMOTE_ADDR` is in `TRUSTED_PROXIES = ['10.0.0.0/8', ...]`; otherwise `REMOTE_ADDR` wins. Leave it unset behind a proxy and every request looks like it comes from the proxy.
+- **Authenticated blocks follow the principal.** The fast pre-auth throttle,
+  login defense and path/User-Agent scanner signatures remain IP-based.
+  After successful authentication, semantic events and sustained abuse use a
+  tenant-scoped user digest or API-key digest; anonymous requests keep using
+  IP. This prevents one authenticated user behind a shared NAT from blocking
+  everyone else while still stopping the same principal after an IP change.
+- **Bound external Bearer resolvers.** Query-contract failures are attributed
+  after authentication, so an unknown/protected parameter carrying a Bearer
+  token can invoke `BEARER_RESOLVER` before the request is rejected. The
+  default `NO_RESOLVER` path performs no external call. Custom network-backed
+  resolvers should enforce a short timeout, cache safely where appropriate,
+  and be latency/load-tested behind the pre-auth IP throttle.
 - **`/metrics` is opt-in.** `get_routes` doesn't mount it unless you pass `metrics_view=Metrics` (the generic, unscoped resource — `from easyapi import Metrics`) or a custom row-scoped subclass. Once mounted, bound which models it can query: set `METRICS_MODELS = ['app_Model', ...]` to allowlist them. References to credential-named columns (in filters, groups, order or calc) are always rejected regardless — the per-resource escape hatch does not reach `/metrics`.
 - **Bound the metrics fields, per model.** `METRICS_MODELS` only gates *which models* — every non-credential field on an allowed model is still fair game for `/metrics` (filter, group, order, calc), including arbitrary FK traversal. Set `METRICS_FIELDS = {'app_Model': ['status', 'owner__name', ...]}` to also allowlist *which field paths*, per model. Unlike REST's `filter_fields` (root-segment match), this checks the **full** `__`-joined path — `'owner'` in the list does not imply `'owner__anything'` is allowed. `filter_by` references tolerate one trailing Django lookup (`owner__name__icontains` matches an allowed `owner__name`) since those reach `Q(**kwargs)` directly; `calc`/`group_by`/`order`/`additional_fields`/`conditions` don't take lookups and are matched literally. A model absent from the dict, or the setting left unset, stays unrestricted — opt-in, same as `METRICS_MODELS`. If you already maintain a `bi_fields`/`related_fields` map for a frontend field picker, `easyapi.util.flatten_include_fields(model, bag)` turns that same data into the flat path list this setting expects, so there's one source of truth instead of two.
 - **Keep the escape hatch narrow.** Columns whose names look like credentials (`password`, `api_key`, `token`, `otp`, `secret`, …) are masked as `'*********'` on every response, on top of whatever `sensitive_fields` lists. When the heuristic catches a false positive, opt it out per surface: `edit_allow_sensitive_fields = ['token_count']` returns it verbatim on `GET /resource/<id>/` while LIST still masks it. `list_allow_sensitive_fields` does the same for LIST, where every row carries the value — reach for the detail-only form first.
+- **Keep query capabilities separate.** Query-string names outside the framework contract are rejected. Declare custom names in `extra_query_params`. A protected name allowed in a LIST response through `list_allow_sensitive_fields` is still forbidden as a direct/JSON filter; add it separately to `allow_protected_query_fields` only when filtering by that value is intentional. Existing resources using the response escape hatch may need this explicit filter capability after upgrading.
 - **OAuth clients are public by default.** MCP clients (Claude.ai, ChatGPT, ...) authenticate with PKCE — list them under `EASYAPI['OAUTH_CLIENTS']` with no `client_secret`. A client becomes confidential only with an explicit secret; `/register` never hands out a confidential secret (provision those out of band).
 
 ---
@@ -218,4 +233,3 @@ There's no CLA, no contributor matrix, no roadmap voting. Just open an issue and
 - **Python** — 3.10+
 - **Django** — 5.0+
 - **Repo** — github.com/ssjunior/easyapi-django
-

{easyapi_django-1.3.2 → easyapi_django-1.5.0}/easyapi/base.py

@@ -98,6 +98,14 @@ RATE_LIMITS = get_setting('RATE_LIMITS', default={
     ],
 })
 
+_STANDARD_QUERY_PARAMS = frozenset({
+    'search', 'fields', 'page', 'limit', 'order_by', 'filter', 'count',
+    'normalize', 'normalize_list', 'context', 'tags', 'tags_operator',
+})
+_PRIVILEGED_QUERY_FIELDS = frozenset({
+    'is_staff', 'is_superuser', 'groups', 'user_permissions', 'permissions',
+})
+
 
 logger = logging.getLogger(__name__)
 _WARNED_UNSCOPED_AUTH_CACHE = set()
@@ -239,6 +247,15 @@ class BaseResource(CoreResource):
     filter_fields = None
     queryset_filter = None
 
+    # Query-string contract. Framework-owned parameters and ``filter_fields``
+    # are accepted automatically; custom routes/resources must declare any
+    # additional names here. Protected credential/privilege fields remain
+    # denied as direct filters unless explicitly listed in
+    # ``allow_protected_query_fields``. Response projection via ``fields=``
+    # has a separate capability: ``list_allow_sensitive_fields``.
+    extra_query_params = None
+    allow_protected_query_fields = None
+
     # Querystring param that resolves to a server-side stored filter
     # expression (e.g. ``'segment_id'``, ``'view_id'``). When set, the
     # framework reads ``request.GET[stored_filter_param]`` and calls
@@ -293,6 +310,8 @@ class BaseResource(CoreResource):
     user = None
     account = None
     body = None
+    auth_method = None
+    security_identifier = None
 
     def __init__(self):
 
@@ -304,6 +323,13 @@ class BaseResource(CoreResource):
         self.list_related_fields = dict(self.list_related_fields) if self.list_related_fields else {}
         self.many_to_many_models = dict(self.many_to_many_models) if self.many_to_many_models else {}
         self.filter_fields = list(self.filter_fields) if self.filter_fields else []
+        self.extra_query_params = (
+            set(self.extra_query_params) if self.extra_query_params else set()
+        )
+        self.allow_protected_query_fields = (
+            set(self.allow_protected_query_fields)
+            if self.allow_protected_query_fields else set()
+        )
         self.queryset_filter = dict(self.queryset_filter) if self.queryset_filter else {}
         self.search_fields = list(self.search_fields) if self.search_fields else []
         self.order_fields = list(self.order_fields) if self.order_fields else []
@@ -329,6 +355,8 @@ class BaseResource(CoreResource):
             self.cache_scope_fields
         )
         self.diff = {}
+        self.auth_method = None
+        self.security_identifier = None
 
         if self.model:
             fields = []
@@ -400,10 +428,10 @@ class BaseResource(CoreResource):
 
         raise HTTPException(403, 'Not allowed')
 
-    async def block(self, identifier):
+    async def block(self, identifier, reason='api_rate_limit'):
         logger.warning('Blocking %s', identifier)
         redis = get_redis()
-        await block_identifier(redis, identifier, 'api_rate_limit', ttl=86400)
+        await block_identifier(redis, identifier, reason, ttl=86400)
         raise HTTPException(403, 'Blocked due to misbehavior')
 
     async def check_is_blocked(self, identifier):
@@ -411,6 +439,92 @@ class BaseResource(CoreResource):
         if await is_blocked(redis, identifier):
             raise HTTPException(403, 'Blocked due to misbehavior')
 
+    @staticmethod
+    def _safe_log_values(values):
+        """Bound and strip control characters from attacker-owned log data."""
+        safe = []
+        for value in values:
+            value = re.sub(r'[\x00-\x1f\x7f]', '?', str(value))
+            safe.append(value[:128])
+        return tuple(safe)
+
+    def _log_security_event(self, event, request, values):
+        # SecurityMiddleware consumes one principal event after the response
+        # is rendered. Store only classification/count on the request; raw
+        # attacker-controlled values remain in the sanitized application log.
+        request._easyapi_security_event = {
+            'event': event,
+            'count': max(len(values), 1),
+        }
+        logger.warning(
+            'security_event=%s ip=%s identity=%s method=%s path=%r values=%r',
+            event,
+            getattr(self, 'identifier', ''),
+            getattr(self, 'security_identifier', ''),
+            getattr(request, 'method', ''),
+            self._safe_log_values([getattr(request, 'path', '')])[0],
+            self._safe_log_values(values),
+        )
+
+    def _query_filter_field(self, key):
+        """Mirror the legacy query-filter lookup normalization."""
+        if search_regex.search(key):
+            keys = key.split('__')
+            if len(keys) == 3:
+                return f'{keys[0]}__{keys[1]}'
+            return keys[0]
+        return key
+
+    def _is_protected_field(self, field, allowed_fields):
+        root = field.split('__', 1)[0]
+        if field in allowed_fields or root in allowed_fields:
+            return False
+        return (
+            is_sensitive(field, self.sensitive_fields)
+            or is_sensitive(root, self.sensitive_fields)
+            or root.lower() in _PRIVILEGED_QUERY_FIELDS
+        )
+
+    def _is_protected_query_field(self, field):
+        """Whether a field is forbidden as a direct query-string filter."""
+        return self._is_protected_field(
+            field, self.allow_protected_query_fields,
+        )
+
+    def _is_protected_response_field(self, field):
+        """Whether ``fields=`` may project a field into a list response."""
+        return self._is_protected_field(
+            field, self.list_allow_sensitive_fields,
+        )
+
+    def _validate_query_parameters(self, request):
+        """Reject query-string names outside the resource's public contract."""
+        invalid = []
+        protected = []
+        allowed = _STANDARD_QUERY_PARAMS | self.extra_query_params
+        if self.stored_filter_param:
+            allowed = allowed | {self.stored_filter_param}
+
+        for key in request.GET:
+            field = self._query_filter_field(key)
+            if self._is_protected_query_field(field):
+                protected.append(key)
+                continue
+            if key in allowed or field in self.filter_fields:
+                continue
+            invalid.append(key)
+
+        if protected:
+            self._log_security_event(
+                'protected_query_field', request, protected,
+            )
+        elif invalid:
+            self._log_security_event(
+                'unknown_query_parameter', request, invalid,
+            )
+        if protected or invalid:
+            raise HTTPException(400, 'Invalid query parameters')
+
     async def _enforce_rate_limit(self, request):
         # Local development bypasses rate limiting and abuse blocking.
         # Hammering ``/docs`` while wiring up auth would otherwise trigger
@@ -441,12 +555,30 @@ class BaseResource(CoreResource):
                 await self.block(self.identifier)
             return
 
-        result = await RateLimiter.api_limited(self.identifier, RATE_LIMITS)
-        if result['abuse']:
-            await self.block(self.identifier)
+        # Cheap pre-auth pass: only the short API windows use IP. The
+        # sustained abuse windows run after authentication with the real
+        # principal, preventing one user behind a shared NAT from blocking
+        # everyone on that IP.
+        result = await RateLimiter.api_limited(
+            self.identifier, RATE_LIMITS, include_abuse=False,
+        )
         if result['rate_limited']:
             raise HTTPException(429, 'Slow down, too many requests. You will be blocked.')
 
+    async def _enforce_identity_abuse_limit(self, request):
+        """Apply abuse windows to an authenticated principal or anonymous IP."""
+        if security_bypassed() or request.path.startswith('/login'):
+            return
+        result = await RateLimiter.abuse_limited(
+            self.security_identifier, RATE_LIMITS,
+        )
+        if result.get('blocked'):
+            raise HTTPException(403, 'Blocked due to misbehavior')
+        if result['abuse']:
+            await self.block(
+                self.security_identifier, reason='identity_abuse_rate_limit',
+            )
+
     async def _enforce_resource_rate_limits(self):
         """Declarative ``self.rate_limits`` buckets — runs after auth so
         keys derived from ``self.user`` resolve. Keys returning ``None``
@@ -496,6 +628,7 @@ class BaseResource(CoreResource):
             request.headers.get('Authorization'),
         )
         if code == _bearer.OK:
+            self.auth_method = 'bearer'
             self._activate_session(session)
             await apply_session_to_request(request, session)
             return session, None
@@ -517,6 +650,7 @@ class BaseResource(CoreResource):
         if request.headers.get('X-Api-Key'):
             session = await get_api_session(request.headers.get('X-Api-Key'))
             if session:
+                self.auth_method = 'api_key'
                 self._activate_session(session)
                 await apply_session_to_request(request, session)
             return session, None
@@ -527,6 +661,7 @@ class BaseResource(CoreResource):
 
         existing = getattr(request, 'session', None)
         if existing:
+            self.auth_method = 'session'
             self._activate_session(existing)
             return existing, session_key
 
@@ -538,10 +673,55 @@ class BaseResource(CoreResource):
             return None, None
 
         session = json.loads(raw)
+        self.auth_method = 'session'
         self._activate_session(session)
         await apply_session_to_request(request, session)
         return session, session_key
 
+    @staticmethod
+    def _identity_digest(value):
+        return hashlib.sha256(str(value).encode('utf-8')).hexdigest()[:32]
+
+    def _set_security_identifier(self, request, session, session_key):
+        """Derive the stable Redis identity after authentication.
+
+        API keys stay independent; Bearer/cookie sessions converge on the
+        tenant-scoped user so token/session rotation cannot bypass a block.
+        Raw credentials and session ids never enter Redis keys.
+        """
+        kind = 'ip'
+        identifier = self.identifier
+
+        if session and self.auth_method == 'api_key':
+            api_key = request.headers.get('X-Api-Key', '')
+            kind = 'api_key'
+            identifier = f'apikey:{self._identity_digest(api_key)}'
+        elif session:
+            user = session.get('user') if isinstance(session, dict) else None
+            account = session.get('account') if isinstance(session, dict) else None
+            user_id = user.get('id') if isinstance(user, dict) else None
+            account_id = account.get('id') if isinstance(account, dict) else 'single'
+            if user_id is not None:
+                kind = 'user'
+                principal = json.dumps(
+                    [account_id, user_id],
+                    separators=(',', ':'),
+                    default=str,
+                )
+                identifier = f'user:{self._identity_digest(principal)}'
+            elif session_key:
+                kind = 'session'
+                identifier = f'session:{self._identity_digest(session_key)}'
+            elif self.auth_method == 'bearer':
+                kind = 'bearer'
+                auth_header = request.headers.get('Authorization', '')
+                identifier = f'bearer:{self._identity_digest(auth_header)}'
+
+        self.security_identifier = identifier
+        request._easyapi_security_identifier = identifier
+        request._easyapi_security_identity_kind = kind
+        return identifier
+
     def _activate_session(self, session):
         self.user = session['user']
         self.tz = get_tz(self.user.get('timezone', 'UTC'))
@@ -834,6 +1014,15 @@ class BaseResource(CoreResource):
         await self._enforce_rate_limit(request)
 
         session, session_key = await self._authenticate(request)
+        self._set_security_identifier(request, session, session_key)
+
+        # IP blocks are checked before authentication; principal blocks can
+        # only be checked after the real identity is known. This second gate
+        # prevents a blocked user/API key from bypassing via a new IP.
+        if self.security_identifier != self.identifier:
+            await self.check_is_blocked(self.security_identifier)
+
+        self._validate_query_parameters(request)
 
         if self.authenticated and not session:
             raise HTTPException(401, 'Not authorized')
@@ -843,6 +1032,7 @@ class BaseResource(CoreResource):
         if ALLOWED_ORIGINS:
             self.get_allowed_domain(request)
 
+        await self._enforce_identity_abuse_limit(request)
         await self._enforce_resource_rate_limits()
 
         if session and session.get('account'):
@@ -1144,8 +1334,43 @@ class BaseResource(CoreResource):
 
         self.count_results = {'count': count}
 
-    def _validate_filter_fields(self, conditions):
-        validate_conditions(conditions, self.filter_fields)
+    @staticmethod
+    def _condition_field_names(conditions):
+        fields = []
+
+        def collect(node):
+            if isinstance(node, dict):
+                field = node.get('field')
+                if field:
+                    fields.append(field)
+                for rule in node.get('rules') or []:
+                    collect(rule)
+            elif isinstance(node, list):
+                for item in node:
+                    collect(item)
+
+        collect(conditions)
+        return fields
+
+    def _validate_filter_fields(self, conditions, request):
+        fields = self._condition_field_names(conditions)
+        protected = [
+            field for field in fields
+            if self._is_protected_query_field(field)
+        ]
+        if protected:
+            self._log_security_event(
+                'protected_filter_field', request, protected,
+            )
+            raise HTTPException(403, 'Filtering not allowed')
+
+        try:
+            validate_conditions(conditions, self.filter_fields)
+        except HTTPException as exc:
+            self._log_security_event(
+                'forbidden_filter_field', request, fields or ['filter'],
+            )
+            raise HTTPException(403, 'Filtering not allowed') from exc
 
     async def resolve_stored_filter(self, value, **kwargs):
         """Hook: turn a stored-filter id into a Layer-2 conditions dict.
@@ -1186,12 +1411,18 @@ class BaseResource(CoreResource):
                 groups.append(stored_conditions)
 
         if filter_:
-            url_conditions = json.loads(filter_)
+            try:
+                url_conditions = json.loads(filter_)
+            except (json.JSONDecodeError, TypeError):
+                self._log_security_event(
+                    'invalid_filter_syntax', request, ['filter'],
+                )
+                raise HTTPException(400, 'Invalid filter') from None
             if url_conditions:
                 # ``?filter=`` is caller-controlled — must pass the
                 # whitelist. Stored filters are trusted because the hook
                 # owns the lookup (and any validation, scoping, RBAC).
-                self._validate_filter_fields(url_conditions)
+                self._validate_filter_fields(url_conditions, request)
                 groups.append(url_conditions)
 
         if not groups:
@@ -1318,10 +1549,36 @@ class BaseResource(CoreResource):
         results = []
 
         fields = request.GET.get('fields')
-        if fields:
+        if 'fields' in request.GET:
             requested = [f.strip() for f in fields.split(',') if f.strip()]
             allowed = set(self.list_fields or [])
-            list_fields = [f for f in requested if f in allowed]
+            wildcard = [
+                f for f in requested
+                if f.lower() in {'*', 'all', '__all__'}
+            ]
+            protected = [
+                f for f in requested
+                if f not in wildcard and self._is_protected_response_field(f)
+            ]
+            unknown = [
+                f for f in requested
+                if f not in wildcard and f not in protected and f not in allowed
+            ]
+            if not requested:
+                self._log_security_event(
+                    'invalid_fields_syntax', request, ['fields'],
+                )
+            elif wildcard:
+                self._log_security_event('wildcard_field_probe', request, wildcard)
+            elif protected:
+                self._log_security_event('protected_field_probe', request, protected)
+            elif unknown:
+                self._log_security_event('unknown_response_field', request, unknown)
+            if not requested or wildcard or protected or unknown:
+                raise HTTPException(400, 'Invalid fields')
+            list_fields = requested
+            if self.normalize_list and 'id' not in list_fields:
+                list_fields = ['id'] + list_fields
             related = False
         else:
             list_fields = self.list_fields

{easyapi_django-1.3.2 → easyapi_django-1.5.0}/easyapi/blocking.py

@@ -5,6 +5,8 @@ key, so ``SecurityMiddleware`` and ``BaseResource`` agree on format and
 TTL semantics.
 """
 
+from redis.exceptions import WatchError
+
 from .redis_config import KEY_PREFIX
 
 
@@ -27,6 +29,29 @@ async def block(redis, identifier, reason=None, ttl=86400):
     await redis.setex(block_key(identifier), ttl, reason or '1')
 
 
+async def block_at_least(redis, identifier, reason=None, ttl=86400):
+    """Block without ever replacing a longer existing block with a shorter one.
+
+    ``WATCH`` keeps concurrent short/long escalation decisions from racing in
+    a way that accidentally reduces a 24-hour block to one hour.
+    """
+    key = block_key(identifier)
+    while True:
+        async with redis.pipeline(transaction=True) as pipeline:
+            try:
+                await pipeline.watch(key)
+                current_ttl = await pipeline.ttl(key)
+                if current_ttl >= ttl:
+                    await pipeline.unwatch()
+                    return
+                pipeline.multi()
+                pipeline.setex(key, ttl, reason or '1')
+                await pipeline.execute()
+                return
+            except WatchError:
+                continue
+
+
 async def get_block_reason(redis, identifier):
     """Return the stored block reason, or ``None`` when not blocked."""
     return await redis.get(block_key(identifier))

{easyapi_django-1.3.2 → easyapi_django-1.5.0}/easyapi/gen/templates/settings/settings.py.j2

@@ -128,10 +128,10 @@ MCP = {
     # 'CREDENTIAL_RATE_LIMIT': {'limit': 5, 'window': 30},   # 5 hits / 30s per IP
 
     # ── Rate limit & abuse blocking ──────────────────────────────────
-    # Per-IP windows. Each list is "if more than ``limit`` requests in
-    # ``interval`` ms, slow down or block". ``api`` covers regular
-    # endpoints, ``login`` is the auth endpoint (tighter), ``abuse``
-    # triggers the IP block when exceeded.
+    # ``api`` is the cheap pre-auth IP throttle; ``login`` stays per-IP.
+    # ``abuse`` runs after authentication and keys on tenant+user, API-key
+    # digest, or IP only for anonymous requests. Each list is "if more than
+    # ``limit`` requests in ``interval`` ms, slow down or block".
     # 'RATE_LIMITS': {
     #     'api':   [{'interval': 1000, 'limit': 4},
     #               {'interval': 5000, 'limit': 20}],
@@ -140,11 +140,16 @@ MCP = {
     #     'abuse': [{'interval': 5000, 'limit': 20},
     #               {'interval': 3600000, 'limit': 200}],
     # },
-    # Anti-scanner: count 4xx responses per IP. Crossing either
-    # threshold parks the IP in the block list for ``BLOCK_DURATION_SECONDS``.
-    # 'MAX_4XX_PER_MINUTE': 10,
-    # 'MAX_4XX_PER_HOUR': 30,
-    # 'BLOCK_DURATION_SECONDS': 86400,      # 24h
+    # Semantic abuse detection. Protected-field/wildcard probes block
+    # immediately for BLOCK_DURATION_SECONDS. Generic invalid requests
+    # tolerate one occurrence; the second inside the low-event window
+    # blocks briefly, and a recurrence during the escalation window
+    # receives the full block.
+    # 'SECURITY_LOW_EVENT_LIMIT': 2,
+    # 'SECURITY_LOW_EVENT_WINDOW_SECONDS': 900,   # 15 min
+    # 'SECURITY_SHORT_BLOCK_SECONDS': 3600,       # 1h
+    # 'SECURITY_ESCALATION_WINDOW_SECONDS': 86400,
+    # 'BLOCK_DURATION_SECONDS': 86400,             # 24h
     # Pre-emptive bans by URL path or User-Agent regex (vulnerability
     # scanners, known bad bots). ``None`` keeps the framework's
     # baseline list; pass ``[...]`` to replace, ``[]`` to disable.