ebuffer 0.1.5__py3-none-any.whl

ebuffer/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.5"

ebuffer/apiebuffer.py

@@ -0,0 +1,80 @@
+from io import BytesIO
+from asyncio import create_task
+from sqlmodel import Session
+from typing import AsyncGenerator
+from ebuffer.database import get_user_db
+from ebuffer.apiuserobj import Eb_UserObjAPI, Eb_ObjectInvalid
+
+from ebuffer.config import EbConfig, logger
+from ebuffer.models_common import UserId
+from ebuffer.models_buffer import BufferStateEnum
+from ebuffer.database import BufferEntry, Eb_BufferCRUD
+from ebuffer.backends import Eb_DataBackend, Eb_BackendReadError
+
+Eb_BufferInvalid = Eb_ObjectInvalid
+
+class Eb_BufferAPI(Eb_UserObjAPI):
+
+    def __init__(self, config: EbConfig):
+        self.config = config
+        self.bufferCRUD = Eb_BufferCRUD()
+        self.backend = Eb_DataBackend.getBackend(self.config, self.bufferCRUD)
+        super().__init__(BufferEntry, config.base, self.bufferCRUD, self.backend)
+
+    def destroy(self):
+        self.backend.deep_clean()
+        del self.backend
+
+    #
+    # Housekeeping
+    #
+    async def housekeeping(self, session: Session, interval: int, start: bool = False) -> None:
+        grace_time = interval - 1
+
+        for ebuffer in self.bufferCRUD.get_expired(session, interval):
+            if  ebuffer.state == BufferStateEnum.error_deleted or ebuffer.state == BufferStateEnum.deleted:
+                if not start: continue
+
+            if   ebuffer.state == BufferStateEnum.initialized:
+                ebuffer.state = BufferStateEnum.error
+                ebuffer.state_desc = r'Never reached backend initialization.' if not ebuffer.state_desc else ebuffer.state_desc
+            elif ebuffer.state == BufferStateEnum.error:
+                grace_time = self.config.base.error_grace_time
+                if ebuffer.lifetime < grace_time:
+                    ebuffer.state = BufferStateEnum.error_deleted
+            else:
+                if ebuffer.lifetime < grace_time:
+                    ebuffer.state = BufferStateEnum.deleted
+
+            if  ebuffer.state == BufferStateEnum.error_deleted or ebuffer.state == BufferStateEnum.deleted:
+                logger.debug("[housekeeping]: Destroy (%ds < %ds) %s", ebuffer.lifetime, grace_time, ebuffer)
+                await self.bufferCRUD.update(session, ebuffer, commit=False)
+                await self.destroy_after(session, grace_time, ebuffer, commit=False)
+        self.bufferCRUD.commit(session)
+
+    #
+    # I/O operations
+    #
+    async def write(self, stream: AsyncGenerator[bytes, None], uid: str, user: UserId, session: Session) -> object:
+        #userd = get_user_db(session, user, create=False)
+        ebuffer = self.bufferCRUD.get(session, uid, user)  # Warning: the for now, data has to belong to the user.
+        try:
+            await self.backend.write(ebuffer, stream)
+        finally:
+            create_task(self.bufferCRUD.update(session, ebuffer))
+        return ebuffer
+
+    def _generate_bytesio_stream(self, data: BytesIO, chunk_size: int = 4 * 1024 * 1024) -> bytes:
+        while chunk := data.read(chunk_size):
+            yield chunk  # Envoie un morceau au client
+        data.close()
+
+    async def read(self, uid: str, sid: str, seek: int, limit: int, user: UserId, session: Session) -> object:
+        # Warning : 'user' is not used, but shall be in order to check if the data has read policy.
+        # userd : UserIdEntry = get_user_db(session, user, create=False)
+        ebuffer = self.bufferCRUD.get(session, uid)
+        data: BytesIO; clen: int
+        clen, data = self.backend.fetch(ebuffer, sid, seek=seek, limit=limit) if sid else self.backend.fopen(ebuffer, seek=seek, limit=limit)
+        if not data:
+            raise Eb_BackendReadError(ebuffer.uuid, r'Empty data stream')
+        return clen, self._generate_bytesio_stream(data)

ebuffer/apiuserobj.py

@@ -0,0 +1,127 @@
+from sqlmodel import Session
+from asyncio import create_task, sleep
+
+from ebuffer.config import logger
+from ebuffer.models_common import UserId
+from ebuffer.database import UserIdEntry, UserObjEntry, get_user_db, get_user_by_email_db
+from ebuffer.database import Eb_UserObjCRUD, Eb_ObjectNotFound
+from ebuffer.errors import Eb_Exception, Eb_TagSyntaxError
+
+#
+# CRUD Management of User's objects
+
+class Eb_ObjectInvalid(Eb_Exception):
+    def __init__(self, uuid: str = r''):
+        super().__init__(430, "ObjectInvalid", "Object is invalid or was destroyed.", r'Id: %s' % uuid)
+
+class Eb_UserObjAPI():
+
+    def __init__(self, Objtype: type, config: object, uobjcrud: Eb_UserObjCRUD, backend: object = None):
+        self.ObjEntry: type = Objtype
+        self.conf = config
+        self.uobjcrud = uobjcrud
+        self.backend = backend
+
+    #
+    # Life cycle management
+
+    def assert_correct_tags(self, tags: list[str]) -> bool:
+        tag_min_size = self.conf.tag_min_size
+        tag_max_size = self.conf.tag_max_size
+        for t in tags:
+            if len(t) < tag_min_size or len(t) > tag_max_size:
+                raise Eb_TagSyntaxError(r'Invalid tag size %d ([%d:%d])' % (len(t), tag_min_size, tag_max_size))
+        return True
+
+    async def _destroy(self, session: Session, uobj: UserObjEntry, commit) -> None:
+        if self.backend: await self.backend.destroy(session, uobj, commit=commit)
+        else:            await self.uobjcrud.destroy(session, uobj, commit=commit)
+
+    async def _destroy_after(self, session: Session, time_s: int, uobj: UserObjEntry, maxcount: int, commit) -> None:
+        try:
+            await sleep(time_s)
+            # session: Session = next(app.g_db.get_session())
+            await self._destroy(session, uobj, commit)
+        except Exception as e:
+            logger.debug(r"Could not finish a destroy operation: %s", str(e))
+            if maxcount > 0:
+                create_task(self._destroy_after(session, time_s, uobj, maxcount-1, commit))
+
+    async def destroy_after(self, session: Session, time_s: int, uobj: UserObjEntry, maxcount: int = 5, commit=True) -> None:
+        #create_task(self._destroy_after(session, time_s, uobj, maxcount, commit=True))
+        if time_s: create_task(self._destroy_after(session, time_s, uobj, maxcount, commit=True))
+        else:      self._destroy(session, uobj, commit)
+
+    #
+    # Main API
+
+    async def create(self, uobj: UserObjEntry, blocking: bool, user: UserId, session: Session) -> UserObjEntry:
+        self.assert_correct_tags(uobj.tags)
+        # Only in order to register the used in the DB.
+        userId: UserIdEntry = get_user_db(session, user, create=True)
+        uobj.user_email = userId.email
+
+        if blocking and self.backend:
+            await self.backend.build(session, uobj)
+        else:
+            await self.uobjcrud.update(session, uobj)
+            if self.backend:
+                create_task(self.backend.build(session, uobj))
+        logger.debug(r'[api] Register %s: %s', self.ObjEntry.__name__, uobj)
+        return uobj
+
+    async def search(self, session: Session = None, user: UserId = None,
+                     limit: int = 0, skip: int = 0,
+                     owner: str = None, tags: list[str] = [], all: bool = False, count: bool = False,
+                     ofilter: callable = None) -> list[UserObjEntry] | int:
+        self.assert_correct_tags(tags)
+        if owner:
+            owner = get_user_by_email_db(session, owner, create=False)
+            if not owner:
+                return 0 if count else []
+        results = []
+
+        # Warning : 'user' is not used, but shall be in order to check if the data has read policy.
+        if count:
+            #logger.debug("[searchObject]------ %s: %s [%s] --------", str(owner), str(tags), str(all))
+            return self.uobjcrud.count(session, limit, skip, owner, tags, all, ofilter=ofilter)
+        else:
+            #logger.debug("[searchObject]------ %s: %s [%s] --------", str(owner), str(tags), str(all))
+            for uobj in self.uobjcrud.search(session, limit, skip, owner, tags, all, ofilter=ofilter):
+                # logger.debug("[searchObject]: found %s" % uobj)
+                results.append(uobj)
+            # logger.debug("[searchObject]+++++++++++++++")
+            return results
+
+    async def get(self, uid: str, owner: str, user: UserId, session: Session) -> UserObjEntry:
+        if owner:
+            owner = get_user_by_email_db(session, owner, create=False)
+            if not owner: raise Eb_ObjectNotFound(uid)
+        # Warning : 'user' is not used, but shall be in order to check if the data has read policy.
+        return self.uobjcrud.get(session, uid, owner)
+
+    async def delete(self, uid: str, user: UserId, session: Session) -> UserObjEntry:
+        #userd = get_user_db(session, user, create=False)
+        uobj = self.uobjcrud.get(session, uid, user)  # Warning: the for now, data has to belong to the user.
+        if uobj.is_deleted(): return uobj
+        uobj.set_deleted()
+        await self.uobjcrud.update(session, uobj)
+        await self.destroy_after(session, self.conf.grace_time, uobj)
+        return uobj
+
+    #
+    # Tag API
+
+    async def getTags(self, uid: str, owner: str, user: UserId, session: Session) -> UserObjEntry:
+        uobj = await self.get(uid, owner, user, session)
+        return uobj.tags if uobj else []
+
+    async def addTag(self, uid: str, tag: str, user: UserId, session: Session) -> UserObjEntry:
+        #userd = get_user_db(session, user, create=False)
+        self.assert_correct_tags((tag,))
+        uobj = self.uobjcrud.get(session, uid, user)  # Warning: the for now, data has to belong to the user.
+        if uobj.is_deleted(): raise Eb_ObjectInvalid(uid)
+        uobj.tags = list(uobj.tags)
+        uobj.tags.append(tag)
+        create_task(self.uobjcrud.update(session, uobj))
+        return uobj

ebuffer/application.py

@@ -0,0 +1,45 @@
+from os import getenv
+from asyncio import create_task, sleep
+from traceback import format_exc
+from ebuffer.config import EbConfig, logger
+from ebuffer.database import Eb_Database
+from ebuffer.auth import Eb_Auth
+from ebuffer.apiebuffer import Eb_BufferAPI
+from fastapi.security import HTTPBearer, HTTPBasic
+
+class Eb_Application():
+
+    def __init__(self):
+        self.regexp_email = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
+        self.config = EbConfig(inifile=getenv(r'EBUFFER_INI', r'eb.ini'), secretfile=getenv(r'EBUFFER_SECRET_INI', r'.eb-secret.ini'))
+        self.db = Eb_Database(self.config)
+        self.bufferAPI = Eb_BufferAPI(self.config)
+        self.auth = Eb_Auth.getAuth(self.config)
+        self.security_token = HTTPBearer(auto_error=False)
+        self.security_cred = HTTPBasic(auto_error=False)
+
+    #
+    # Housekeeping
+    #
+    async def housekeeping(self, start: bool = False) -> None:
+        interval = self.config.base.housekeeping_interval
+        await sleep(interval)
+        #logger.debug(r"Start housekeeping (%ds) %s", interval, r'Initial' if start else r'')
+        try:
+            session = next(self.db.get_session())
+            await self.bufferAPI.housekeeping(session, interval, start)
+        except Exception as e:
+            logger.error(r"Could not finish a housekeeping session %s: %s", str(e), format_exc())
+            # raise Eb_HouseKeepingError(e)
+        finally:
+            create_task(self.housekeeping())
+
+    def start(self):
+        create_task(self.housekeeping(start=True))
+
+    def destroy(self):
+        self.bufferAPI.destroy()
+        del self.db
+        self.db = None
+
+app_g = Eb_Application()

ebuffer/auth/__init__.py

@@ -0,0 +1,15 @@
+from ebuffer.auth.auth import Eb_Auth
+
+from ebuffer.auth.auth import Eb_AuthDuplicatedError, Eb_AuthMissingError
+from ebuffer.auth.auth import Eb_AuthError, Eb_AuthExpired
+from ebuffer.auth.openid import Eb_OI_ConnectError, Eb_OI_InternalError, Eb_OI_LoginError
+from ebuffer.auth.passfile import Eb_AuthFile_LoginError
+
+from ebuffer.auth.openid import OIDLoginExceptionList
+from ebuffer.auth.openid import OIDAuthExceptionList
+
+from ebuffer.auth.passfile import PassFileLoginExceptionList
+from ebuffer.auth.passfile import PassFileAuthExceptionList
+
+LoginExceptionList = {} | OIDLoginExceptionList | PassFileLoginExceptionList
+AuthExceptionList = {} | OIDAuthExceptionList | PassFileAuthExceptionList

ebuffer/auth/auth.py

@@ -0,0 +1,51 @@
+from ebuffer.config import EbConfig
+from ebuffer.models_common import UserCred, UserId, MessageLogin
+from ebuffer.errors import Eb_Exception
+
+class Eb_AuthError(Eb_Exception):
+    def __init__(self, code: int = -1):
+        super().__init__(401, "AuthError", "Invalid credentials.", r'Code: %d' % code)
+
+class Eb_AuthExpired(Eb_Exception):
+    def __init__(self, status: str = r''):
+        super().__init__(401, "AuthExpired", "Invalid or expired token.", r'Status: %s' % status)
+
+class Eb_AuthDuplicatedError(Eb_Exception):
+    def __init__(self, scheme: str):
+        super().__init__(440, "AuthDuplicatedError", "Multiple authentication defined with the same scheme (%s)." % scheme, "Check authentication installation.")
+
+class Eb_AuthMissingError(Eb_Exception):
+    def __init__(self, scheme: str):
+        super().__init__(440, "AuthMissingError", "Authentication '%s' not found." % scheme, "Check authentication installation.")
+
+class Eb_Auth():
+    g_auths: dict = {}
+
+    def __init__(self, config: EbConfig, name : str = r'none'):
+        self.config = config
+        self.name : str = name
+
+    @staticmethod
+    def addAuth(name, auth_class):
+        if name in Eb_Auth.g_auths: raise Eb_AuthDuplicatedError(name)
+        Eb_Auth.g_auths[name] = auth_class
+
+    @staticmethod
+    def getAuth(config: EbConfig):
+        name = config.base.auth_backend
+        if name not in Eb_Auth.g_auths: raise Eb_AuthMissingError(name)
+        return Eb_Auth.g_auths[name](config, name)
+
+    def login(self, user: UserCred | None, headers: dict) -> MessageLogin:
+        return MessageLogin(access_token=r'b3BlbmJhcg==')
+
+    def verify_token(self, scheme: str, token: str) -> UserId:
+        return UserId(name=self.config.base.default_user, email=self.config.base.default_email)
+
+    def verify_basic(self, user: str, password: str) -> UserId:
+        return UserId(name=self.config.base.default_user, email=self.config.base.default_email)
+
+    def getRealmHeader(self) -> dict:
+        return {}
+
+Eb_Auth.addAuth(r'none', Eb_Auth)

ebuffer/auth/openid.py

@@ -0,0 +1,101 @@
+import requests
+from pydantic import BaseModel
+from ebuffer.models_common import UserCred, UserId, MessageLogin
+from ebuffer.config import EbConfig, logger
+from ebuffer.errors import Eb_Exception
+from ebuffer.auth import Eb_Auth, Eb_AuthError, Eb_AuthExpired
+
+class Eb_OI_ConnectError(Eb_Exception):
+    def __init__(self, srv: str = r'', exc: Exception = None):
+        super().__init__(501, "OIDConnErr", "Could not connect to the OpenID server.", r'Server: %s' % srv, exc)
+
+class Eb_OI_InternalError(Eb_Exception):
+    def __init__(self, exc: Exception = None):
+        super().__init__(500, "OIDInternalError", "OIDC Internal error.", "Check server configuration.", exc)
+
+class Eb_OI_LoginError(Eb_Exception):
+    def __init__(self, code: int = -1):
+        super().__init__(401, "OIDLoginErr", "Could not login with OIDC credentials.", r'Code: %d' % code)
+
+OIDLoginExceptionList = \
+    Eb_OI_InternalError().model() | \
+    Eb_OI_ConnectError().model() | \
+    Eb_OI_LoginError().model()
+
+OIDAuthExceptionList = \
+    Eb_OI_InternalError().model() | \
+    Eb_AuthError().model() | \
+    Eb_AuthExpired().model()
+
+class EbConfigOpenID(BaseModel):
+    openid_base_url: str = r''
+    openid_client_id: str = r''
+    openid_client_secret: str = r''
+    access_token_url: str
+    introspect_url: str
+    user_info_url: str
+    logout_url: str
+
+    def __init__(self, **kw):
+        url = kw[r'openid_base_url'] if r'openid_base_url' in kw else r'https://localhost/realms'
+        kw[r'access_token_url'] = f"{url}/protocol/openid-connect/token"
+        kw[r'introspect_url'] = f"{url}/protocol/openid-connect/token/introspect"
+        kw[r'user_info_url'] = f"{url}/protocol/openid-connect/userinfo"
+        kw[r'logout_url'] = f"{url}/protocol/openid-connect/logout"
+        super().__init__(**kw)
+
+class Eb_AuthOpenID(Eb_Auth):
+
+    def __init__(self, config: EbConfig, name : str):
+        config = config.open_section(name, EbConfigOpenID)
+        super().__init__(config, name)
+
+    def login(self, user: UserCred | None, headers: dict) -> MessageLogin:
+        logger.debug(r"----- OpenID %s ------", str(user))
+        payload = {
+            "client_id": self.config.openid_client_id,
+            "client_secret": self.config.openid_client_secret,
+            "grant_type": "password",
+            "username": user.username,
+            "password": user.password,
+            "scope": "openid",
+        }
+
+        headers = {"Content-Type": "application/x-www-form-urlencoded"}
+        try:
+            response = requests.post(self.config.access_token_url, data=payload, headers=headers)
+        except requests.exceptions.ConnectionError as e:
+            raise Eb_OI_ConnectError(self.config.access_token_url, e)
+
+        if response.status_code != 200:
+            raise Eb_OI_LoginError(response.status_code)
+
+        result = response.json()
+        return MessageLogin(result["access_token"])
+
+    def verify_token(self, scheme: str, token: str) -> UserId:
+        headers = {"Content-Type": "application/x-www-form-urlencoded"}
+        payloads = {
+            "token": token,
+            "client_id": self.config.openid_client_id,
+            "client_secret": self.config.openid_client_secret,
+        }
+
+        try:
+            response = requests.post(self.config.introspect_url, data=payloads, headers=headers)
+            if response.status_code != 200:
+                raise Eb_AuthError(response.status_code)
+
+            token_info = response.json()
+            if not token_info.get("active"):
+                raise Eb_AuthExpired(str(token_info))
+
+            return UserId(**token_info)
+
+        except requests.RequestException as e:
+            raise Eb_OI_InternalError(e)
+
+    def verify_basic(self, user: str, password: str) -> UserId:
+        raise Eb_AuthError(-1)
+
+Eb_Auth.addAuth(r'auth::openid', Eb_AuthOpenID)

ebuffer/auth/passfile.py

@@ -0,0 +1,140 @@
+from json import loads as jsloads
+from re import compile as re_compile
+from pydantic import BaseModel
+from ebuffer.models_common import UserCred, UserId, MessageLogin
+from ebuffer.config import EbConfig, logger
+from ebuffer.errors import Eb_Exception
+from ebuffer.auth import Eb_Auth, Eb_AuthError, Eb_AuthExpired
+from base64 import b64encode, b64decode
+from os import urandom
+from hashlib import sha256 as digest_method
+import hmac
+
+class Eb_AuthFile_LoginError(Eb_Exception):
+    def __init__(self, details: str = r''):
+        super().__init__(401, "AuthFileLoginError", "Could not login with local credentials.", details)
+
+class Eb_AuthFile_InternalError(Eb_Exception):
+    def __init__(self, exc : Exception = None):
+        super().__init__(401, "AuthFileInternalError", "File based password error.", r'Invalid configuration', exc)
+
+PassFileLoginExceptionList = \
+    Eb_AuthFile_LoginError().model()
+
+PassFileAuthExceptionList = \
+    Eb_AuthError().model() | \
+    Eb_AuthExpired().model()
+
+class EbConfigPassFile(BaseModel):
+    header_pass_through : bool = False
+    header_check_kw: str = r'shib-authentication-method'
+    header_check_val: str = r'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+    header_uid_kw: str = r'mail'
+    header_name_kw: str = r'displayname'
+    server_key: str = b'example'
+    user_list : str = []  # Json
+
+class Eb_AutPassFile(Eb_Auth):
+    g_reEmail = re_compile(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')
+
+    def __init__(self, config: EbConfig, name : str):
+        config = config.open_section(name, EbConfigPassFile)
+        super().__init__(config, name)
+        self.passdb = {}
+        self.bearerdb = {}
+        self.session_key : bytes = self._generate_hmac_key()
+        try:
+            user_list = config.user_list if isinstance(config.user_list, list) else jsloads(config.user_list)
+            for (user, pasw, info) in user_list:
+                self._add_user(user, pasw, info)
+        except Exception as exc:
+            raise Eb_AuthFile_InternalError(exc)
+
+    def _generate_hmac_key(self, length=256) -> bytes:
+        return self.config.server_key if self.config.server_key else urandom(length)
+
+    def _get_msgkey(self, user: str) -> bytes:
+        return f'Ebuffer for {user}'.encode('utf-8')
+
+    def _sign_hmac(self, user: str) -> str:
+        mac = hmac.new(self.session_key, msg=self._get_msgkey(user), digestmod=digest_method)
+        return b64encode(mac.digest()).decode('utf-8')
+
+    def _verify_hmac(self, user: str, signature_b64: str) -> bool:
+        mac = hmac.new(self.session_key, msg=self._get_msgkey(user), digestmod=digest_method)
+        signature = b64decode(signature_b64)
+        return hmac.compare_digest(mac.digest(), signature)
+
+    def _add_user(self, user: str , pasw: str, info: dict):
+        if r'email' not in info: raise RuntimeError(r'Missing email')
+        email = info[r'email']
+        if not self.g_reEmail.match(email): raise RuntimeError(r'Invalid email')
+        if r'name' not in info: info[r'name'] = user
+
+        if not pasw:
+            pasw = self._sign_hmac(user)
+
+        bearer = b64encode(f"{user}:{pasw}".encode()).decode()
+        self.passdb[user] = (pasw, info)
+        logger.info(f'New user: {user}: {pasw} [{info}]' )
+
+        info[r'access_token'] = bearer
+        self.bearerdb[bearer] = info
+
+    def login(self, user: UserCred | None, headers: dict) -> MessageLogin:
+        userInfo = None
+        if self.config.header_pass_through:
+            check = self.config.header_check_kw
+            content = self.config.header_check_val
+            check = check.strip().lower()
+            content = content.strip().lower()
+            activated, h_uid, h_name = False, None, None
+            for h, v in headers.items():
+                hs = h.strip().lower()
+                vs = v.strip().lower()
+                if hs == check and content == vs: activated = True
+                if hs == self.config.header_uid_kw: h_uid = v
+                if hs == self.config.header_name_kw: h_name = v
+            if activated:
+                if not h_uid or not h_name: raise Eb_AuthFile_LoginError(r'Missing data for SSO login.')
+                logger.debug(r"----- Header  %s ------", str(h_uid))
+                if h_uid not in self.passdb:
+                    self._add_user(h_uid, None, {r'name': h_name, r'email' : f'{user}@aqmo.org'})
+                password, userInfo = self.passdb[h_uid]
+                return MessageLogin(access_token=userInfo['access_token'])
+
+        if user:
+            logger.debug(r"----- PassFile %s ------", str(user))
+            name = user.username
+            if name not in self.passdb: raise Eb_AuthFile_LoginError(r'User %s not found.' % name)
+            password, userInfo = self.passdb[name]
+            if user.password != password: raise Eb_AuthFile_LoginError(r'Invalid password.')
+        else:
+            raise Eb_AuthFile_LoginError(r'Missing credential data for login.')
+
+        return MessageLogin(access_token=userInfo['access_token'])
+
+    def verify_token(self, scheme: str, token: str) -> UserId:
+        if token in self.bearerdb: return UserId(**self.bearerdb[token])
+        elif token.find(r':') == 1:
+            (user, pasw) = token.split(r':')
+            if self._verify_hmac(self, user, pasw):
+                logger.warning(r"----- lost user recovered %s ------", str(user))
+                if user not in self.passdb:
+                    self._add_user(user, None, {r'name': r'<lost>', r'email' : f'{user}@aqmo.org'})
+                return UserId(**self.bearerdb[token])
+            else:
+                raise Eb_AuthFile_LoginError(r' Unauthorized token.')
+        else: raise Eb_AuthFile_LoginError(r'Invalid token.')
+
+    def verify_basic(self, user: str, password: str) -> UserId:
+        token = b64encode(f"{user}:{password}".encode()).decode()
+        if token not in self.bearerdb: raise Eb_AuthError(-1)
+        return UserId(**self.bearerdb[token])
+
+    def getRealmHeader(self) -> dict:
+        return {
+            "WWW-Authenticate": 'Basic realm="Access to the secure endpoint", charset="UTF-8", Bearer'
+        }
+
+Eb_Auth.addAuth(r'auth::passfile', Eb_AutPassFile)

ebuffer/backends/__init__.py

@@ -0,0 +1,15 @@
+from ebuffer.backends.backends import Eb_DataBackend, Eb_Data
+
+from ebuffer.backends.backends import Eb_BackendDuplicatedError, Eb_BackendMissingError
+from ebuffer.backends.backends import Eb_BackendMissingBufferError, Eb_BackendWriteError, Eb_BackendReadError
+from ebuffer.backends.memory import Eb_BackendMemoryMaxSizeError
+from ebuffer.backends.mmap import Eb_BackendFileMaxSizeError
+
+DataAllocExceptionList = {}
+DataWriteExceptionList = \
+    Eb_BackendMissingBufferError().model() | \
+    Eb_BackendMemoryMaxSizeError().model() | \
+    Eb_BackendFileMaxSizeError().model()
+
+DataReadExceptionList = \
+    Eb_BackendMissingBufferError().model()

ebuffer/backends/acl.py

@@ -0,0 +1,35 @@
+# https://gridcf.org/gct-docs/
+# https://pylibacl.k1024.org/index.html
+# https://github.com/gridcf/gct
+
+
+from typing import Optional
+from pydantic import BaseModel
+
+class ACL_V(BaseModel):
+    rwx : bytes[3]
+    def __str__(self): return r'%c%c%c' % (self.rwx[0],self.rwx[1],self.rwx[2])
+
+class ACL_U(BaseModel):
+    ug: bool
+    name: str
+    value: ACL_V
+    def __str__(self): return r'%s:%s:%s' % (r'user' if self.ug else r'group', self.name, self.value)
+
+class ACL(BaseModel):
+    user: str
+    group: str
+    vuser: ACL_V
+    vgroup: ACL_V
+    vother: ACL_V
+    vmask: ACL_V
+    aclist: [ ACL_U ]
+    vattr: dict
+    def __str__(self): return r'%s:%s:%s' % (r'user' if self.ug else r'group', self.name, self.value)
+
+class Eb_Data(BaseModel):
+    path: str
+
+    def open(self): pass
+    def write(self): pass
+    def close(self): pass