fastapi-admin-kit 0.1.0__py3-none-any.whl

fastapi_admin_kit/auth/csrf.py

@@ -0,0 +1,240 @@
+"""CSRF protection — double-submit cookie pattern with HMAC signing."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import os
+import time
+
+from fastapi import HTTPException, Request, Response
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import JSONResponse, RedirectResponse
+
+CSRF_COOKIE_NAME = "admin_csrf_token"
+CSRF_FORM_FIELD = "csrf_token"
+CSRF_HEADER = "X-CSRF-Token"
+CSRF_TOKEN_MAX_AGE = 3600  # 1 hour
+
+
+def _get_secret_key(request: Request) -> str | None:
+    """Resolve the CSRF signing key from app state.
+
+    Prefers an explicit ``app.state.admin_secret_key`` (the unified signing-key
+    source shared with sessions and JWT); falls back to the session backend's
+    public ``secret_key``. Returns ``None`` only when neither is configured.
+    """
+    explicit = getattr(request.app.state, "admin_secret_key", None)
+    if explicit:
+        return explicit
+    session_backend = getattr(request.app.state, "admin_session_backend", None)
+    if session_backend is None:
+        return None
+    return getattr(session_backend, "secret_key", None)
+
+
+def generate_csrf_token(secret_key: str) -> str:
+    """Generate a signed CSRF token: ``timestamp.random_hex.signature``."""
+    random_bytes = os.urandom(16)
+    timestamp = str(int(time.time()))
+    payload = f"{timestamp}.{random_bytes.hex()}"
+    signature = hmac.new(
+        secret_key.encode(), payload.encode(), hashlib.sha256
+    ).hexdigest()[:32]
+    return f"{payload}.{signature}"
+
+
+def _verify_csrf_token(secret_key: str, token: str) -> bool:
+    """Verify the HMAC signature and check token freshness."""
+    parts = token.rsplit(".", 2)
+    if len(parts) != 3:
+        return False
+    timestamp_str, random_hex, provided_sig = parts
+    payload = f"{timestamp_str}.{random_hex}"
+    expected_sig = hmac.new(
+        secret_key.encode(), payload.encode(), hashlib.sha256
+    ).hexdigest()[:32]
+    if not hmac.compare_digest(provided_sig, expected_sig):
+        return False
+    try:
+        token_time = int(timestamp_str)
+    except ValueError:
+        return False
+    if time.time() - token_time > CSRF_TOKEN_MAX_AGE:
+        return False
+    return True
+
+
+def set_csrf_cookie(response: Response, secret_key: str) -> str:
+    """Generate and set the CSRF cookie on a response. Returns the token."""
+    token = generate_csrf_token(secret_key)
+    response.set_cookie(
+        key=CSRF_COOKIE_NAME,
+        value=token,
+        max_age=CSRF_TOKEN_MAX_AGE,
+        path="/",
+        secure=False,
+        httponly=False,
+        samesite="strict",
+    )
+    return token
+
+
+def validate_csrf_token(
+    request: Request, csrf_token: str | None = None
+) -> None:
+    """Validate CSRF token from form body or header against the cookie.
+
+    Raises ``HTTPException(403)`` if the token is missing or invalid.
+    Fails *closed*: if no signing key is configured (the admin was not
+    set up properly), raises ``HTTPException(500)`` rather than silently
+    disabling CSRF protection — a missing key must never mean "protection off".
+    """
+    secret_key = _get_secret_key(request)
+    if secret_key is None:
+        raise HTTPException(
+            status_code=500,
+            detail="CSRF secret not configured — admin session backend not initialised.",
+        )
+
+    # Read token from argument, header, or request state (set by middleware)
+    form_token = csrf_token
+    if form_token is None:
+        form_token = request.headers.get(CSRF_HEADER)
+    if form_token is None:
+        form_token = getattr(request.state, "_csrf_token", None)
+    if not form_token:
+        raise HTTPException(
+            status_code=403,
+            detail="CSRF token missing. Please refresh the page and try again.",
+        )
+
+    # Read the cookie token
+    cookie_token = request.cookies.get(CSRF_COOKIE_NAME)
+    if not cookie_token:
+        raise HTTPException(
+            status_code=403,
+            detail="CSRF session cookie missing. Please refresh the page and try again.",
+        )
+
+    # Verify both tokens have valid HMAC signatures
+    if not _verify_csrf_token(secret_key, form_token):
+        raise HTTPException(
+            status_code=403,
+            detail="Invalid CSRF token. Please refresh the page and try again.",
+        )
+    if not _verify_csrf_token(secret_key, cookie_token):
+        raise HTTPException(
+            status_code=403,
+            detail="Invalid CSRF cookie. Please refresh the page and try again.",
+        )
+    # Compare the inner payloads (timestamp + random)
+    form_parts = form_token.rsplit(".", 2)
+    cookie_parts = cookie_token.rsplit(".", 2)
+    if form_parts[0] != cookie_parts[0] or form_parts[1] != cookie_parts[1]:
+        raise HTTPException(
+            status_code=403,
+            detail="CSRF token mismatch. Please refresh the page and try again.",
+        )
+
+
+async def require_csrf_token(request: Request) -> None:
+    """FastAPI dependency that enforces CSRF validation on state-changing requests.
+
+    Reads the CSRF token from ``X-CSRF-Token`` header or from the form body
+    (extracted by :class:`CSRFMiddleware` and stored in ``request.state``).
+    """
+    validate_csrf_token(request)
+
+
+# ---------------------------------------------------------------------------
+# CSRF Middleware — extracts form CSRF token + generates per-request token
+# ---------------------------------------------------------------------------
+
+
+class CSRFMiddleware(BaseHTTPMiddleware):
+    """Middleware that:
+    1. Generates a CSRF token per request and stores it in ``request.state.csrf_token``
+       for templates to render as a hidden field or meta tag.
+    2. Sets the CSRF cookie on GET requests if not already present.
+    3. Extracts the CSRF token from form bodies on POST/PUT/PATCH/DELETE requests
+       and stores it in ``request.state._csrf_token`` for the dependency to validate.
+    """
+
+    async def dispatch(self, request: Request, call_next) -> Response:
+        # Generate per-request CSRF token for templates
+        secret_key = _get_secret_key(request)
+        if secret_key is not None:
+            existing_cookie = request.cookies.get(CSRF_COOKIE_NAME)
+            if existing_cookie and _verify_csrf_token(secret_key, existing_cookie):
+                csrf_token = existing_cookie
+            else:
+                csrf_token = generate_csrf_token(secret_key)
+            request.state.csrf_token = csrf_token
+        else:
+            secret_key = ""
+            csrf_token = ""
+            request.state.csrf_token = ""
+
+        # On state-changing requests, extract CSRF token from form body
+        if request.method in ("POST", "PUT", "PATCH", "DELETE"):
+            content_type = request.headers.get("content-type", "")
+            is_form = (
+                "application/x-www-form-urlencoded" in content_type
+                or "multipart/form-data" in content_type
+            )
+            if is_form:
+                try:
+                    body = await request.body()
+                    from urllib.parse import parse_qs
+
+                    form_data = parse_qs(body.decode("utf-8", errors="replace"))
+                    csrf_values = form_data.get(CSRF_FORM_FIELD)
+                    if csrf_values:
+                        request.state._csrf_token = csrf_values[0]
+                except Exception:
+                    pass  # Let the dependency handle missing token
+
+        response = await call_next(request)
+
+        # Set CSRF cookie on all responses so it's always present
+        if secret_key:
+            response.set_cookie(
+                key=CSRF_COOKIE_NAME,
+                value=csrf_token,
+                max_age=CSRF_TOKEN_MAX_AGE,
+                path="/",
+                secure=False,
+                httponly=False,
+                samesite="strict",
+            )
+
+        return response
+
+
+# ---------------------------------------------------------------------------
+# Auth Redirect Exception Handler — redirects HTML requests to login on 401
+# ---------------------------------------------------------------------------
+
+
+async def auth_redirect_handler(request: Request, exc: HTTPException) -> Response:
+    """Exception handler that catches 401 HTTPExceptions and redirects
+    HTML requests to the login page instead of returning a JSON error.
+    """
+    if exc.status_code == 401:
+        accept = request.headers.get("accept", "")
+        if "text/html" in accept:
+            login_url = "/admin/login"
+            current_path = request.url.path
+            if current_path != "/admin/login":
+                if request.url.query:
+                    login_url += f"?next={current_path}%3F{request.url.query}"
+                else:
+                    login_url += f"?next={current_path}"
+            return RedirectResponse(url=login_url, status_code=302)
+        from starlette.responses import JSONResponse
+        return JSONResponse(
+            status_code=401,
+            content={"detail": exc.detail or "Not authenticated"},
+        )
+    raise exc

fastapi_admin_kit/auth/dependencies.py

@@ -0,0 +1,150 @@
+"""FastAPI dependencies — session, current user, permission checker."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Depends, HTTPException, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from fastapi_admin_kit.auth.csrf import require_csrf_token  # noqa: F401
+from fastapi_admin_kit.auth.protocol import AdminUserProtocol
+from fastapi_admin_kit.auth.session import SignedCookieSessionBackend
+
+# ---------------------------------------------------------------------------
+# Session helpers
+# ---------------------------------------------------------------------------
+
+
+def _get_session_backend(request: Request) -> SignedCookieSessionBackend:
+    """Resolve the session backend from app state (set during admin setup)."""
+    backend: SignedCookieSessionBackend | None = getattr(
+        request.app.state, "admin_session_backend", None
+    )
+    if backend is None:
+        raise HTTPException(
+            status_code=500,
+            detail="Admin session backend not initialised.",
+        )
+    return backend
+
+
+async def _get_db_session(request: Request) -> AsyncSession:
+    """Yield the async SQLAlchemy session from app.state."""
+    from fastapi_admin_kit.db import get_db_session
+
+    session: AsyncSession = get_db_session(request)
+    yield session
+
+
+# ---------------------------------------------------------------------------
+# Per-request dependencies
+# ---------------------------------------------------------------------------
+
+
+def get_session(request: Request) -> dict[str, Any] | None:
+    """Read and decode the admin session cookie from the current request."""
+    session_backend = _get_session_backend(request)
+    token = request.cookies.get(session_backend.cookie_name)
+    return session_backend.decode(token)
+
+
+async def get_current_admin_user(
+    request: Request,
+    session_payload: dict[str, Any] | None = Depends(get_session),
+) -> AdminUserProtocol:
+    """Resolve the logged-in admin user from the session cookie.
+
+    Raises ``401`` if the session is missing, invalid, the user is
+    no longer active, or the password was changed after the session was issued.
+    """
+    if session_payload is None:
+        raise HTTPException(
+            status_code=401,
+            detail="Not authenticated. Please log in.",
+        )
+
+    user_id = session_payload.get("user_id")
+    if user_id is None:
+        raise HTTPException(status_code=401, detail="Invalid session payload.")
+
+    # request.state.admin_user is populated as a side effect.
+    from fastapi_admin_kit.auth.identity import resolve_user
+
+    user = await resolve_user(request, user_id)
+    if user is None:
+        raise HTTPException(
+            status_code=401, detail="User not found or inactive."
+        )
+
+    # Check session invalidation: reject if password changed after session iat
+    password_changed_at = getattr(user, "password_changed_at", None)
+    session_iat = session_payload.get("iat")
+    if password_changed_at is not None and session_iat is not None:
+        from datetime import UTC, datetime
+
+        if isinstance(password_changed_at, datetime):
+            if password_changed_at.tzinfo is None:
+                password_changed_at = password_changed_at.replace(tzinfo=UTC)
+            if isinstance(session_iat, (int, float)):
+                session_time = datetime.fromtimestamp(session_iat, tz=UTC)
+                if password_changed_at > session_time:
+                    raise HTTPException(
+                        status_code=401,
+                        detail="Session invalidated. Password was changed. Please log in again.",
+                    )
+
+    return user
+
+
+async def get_permission_checker(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    session: AsyncSession = Depends(_get_db_session),
+) -> Any:
+    """Build a ``PermissionChecker`` for the current user.
+
+    The concrete ``PermissionChecker`` class is imported here to avoid
+    circular imports.
+    """
+    from fastapi_admin_kit.auth.permissions import PermissionChecker
+
+    snapshot = getattr(request.state, "admin_user_snapshot", None)
+    return PermissionChecker(session=session, user=user, user_snapshot=snapshot)
+
+
+def require_permission(table_name: str, action: str):  # type: ignore[no-untyped-def]
+    """Return a FastAPI dependency that enforces a permission check.
+
+    Usage::
+
+        @router.get("/")
+        async def list_view(_=Depends(require_permission("products", "view"))):
+            ...
+    """
+
+    async def _check(
+        checker: Any = Depends(get_permission_checker),
+    ) -> None:
+        if not await checker.has_permission(table_name, action):
+            raise HTTPException(
+                status_code=403,
+                detail=f"You do not have permission to {action} {table_name}.",
+            )
+
+    return _check
+
+
+async def require_superuser(
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+) -> AdminUserProtocol:
+    """FastAPI dependency that enforces superuser access.
+
+    The single source of the "must be superuser" rule, shared by the roles
+    and audit views (previously copy-pasted in each).
+    """
+    if not getattr(user, "is_superuser", False):
+        raise HTTPException(
+            status_code=403, detail="Superuser access required."
+        )
+    return user

fastapi_admin_kit/auth/identity.py

@@ -0,0 +1,181 @@
+"""Request-authentication — the single place that resolves "the current user".
+
+The admin framework historically had *three* parallel implementations of
+"decode a credential, then SELECT the active user it belongs to":
+
+1. :func:`fastapi_admin_kit.auth.dependencies.get_current_admin_user` (cookie)
+2. :func:`fastapi_admin_kit.views.factory._resolve_permission_checker` (cookie,
+   with a process-global cache on ``app.state`` that leaked identity across
+   requests)
+3. :func:`fastapi_admin_kit.api.crud._get_current_user` (bearer JWT, hardcoded to
+   the built-in ``AdminUser`` model and so bypassing the ``AuthBackend`` seam)
+
+This module is the deep seam they all delegate to. The two credential
+transports (signed cookie, bearer JWT) become thin internal adapters; the
+"load the active user and remember it for this request" rule lives in
+:func:`resolve_user` exactly once.
+
+The only request-scoped side effect is writing ``request.state.admin_user``
+once per request, which the audit middleware, sidebar, and templates read.
+Nothing is ever cached on ``app.state``.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from fastapi import Request
+
+if TYPE_CHECKING:
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+    from fastapi_admin_kit.auth.protocol import AdminUserProtocol
+
+
+def _get_session_backend(request: Request) -> Any:
+    """Return the configured session backend, or ``None`` if not initialised."""
+    return getattr(request.app.state, "admin_session_backend", None)
+
+
+def _get_auth_backend(request: Request) -> Any:
+    """Return the configured auth backend, or ``None`` if not initialised."""
+    return getattr(request.app.state, "admin_auth_backend", None)
+
+
+def _get_db_session(request: Request) -> AsyncSession | None:
+    """Return the per-request DB session, falling back to app.state."""
+    from fastapi_admin_kit.db import get_db_session
+
+    try:
+        return get_db_session(request)
+    except AttributeError:
+        return None
+
+
+async def resolve_user(
+    request: Request, user_id: int | str | None
+) -> AdminUserProtocol | None:
+    """Resolve *user_id* to an active user and cache it on the request.
+
+    Idempotent for a given request: if ``request.state.admin_user`` is already
+    populated, it is returned without another DB hit. Returns ``None`` when the
+    user is absent or no longer active — callers decide whether that is an
+    error (views raise 401) or a soft miss (list/form views render unauthed).
+
+    Always honours the configured ``AuthBackend.get_user`` seam, so BYO user
+    models are supported on every transport (cookie *and* JWT), not just the
+    built-in one.
+    """
+    cached = getattr(request.state, "admin_user", None)
+    if cached is not None:
+        if not hasattr(request.state, "admin_user_snapshot"):
+            try:
+                role_ids = list(getattr(cached, "role_ids", []))
+            except Exception:
+                role_ids = []
+            request.state.admin_user_snapshot = {
+                "id": getattr(cached, "id", None),
+                "email": getattr(cached, "email", None),
+                "is_superuser": bool(getattr(cached, "is_superuser", False)),
+                "role_ids": role_ids,
+            }
+        return cached
+
+    if user_id is None:
+        return None
+
+    auth_backend = _get_auth_backend(request)
+    session = _get_db_session(request)
+    if auth_backend is None or session is None:
+        return None
+
+    user = await auth_backend.get_user(user_id, session)
+    if user is None or not getattr(user, "is_active", False):
+        return None
+
+    # Per-request memoisation. This is request-scoped state, never app-scoped:
+    # two concurrent requests on the same Admin instance resolve independently.
+    request.state.admin_user = user
+
+    # Snapshot scalar fields into a plain dict so sync code can read them
+    # without touching the ORM object (which may be expired after a rollback).
+    # Use getattr with [] default — role_ids may not be loaded yet for BYO models.
+    try:
+        role_ids = list(getattr(user, "role_ids", []))
+    except Exception:
+        role_ids = []
+    request.state.admin_user_snapshot = {
+        "id": getattr(user, "id", None),
+        "email": getattr(user, "email", None),
+        "is_superuser": bool(getattr(user, "is_superuser", False)),
+        "role_ids": role_ids,
+    }
+
+    # Inject user identity into the audit context so audit listeners can
+    # record who performed the action.  The middleware already set IP and
+    # user-agent; this merges the user fields in.
+    from fastapi_admin_kit.audit.context import set_audit_context
+
+    set_audit_context({
+        "user_id": request.state.admin_user_snapshot["id"],
+        "user_email": request.state.admin_user_snapshot["email"],
+    })
+
+    return user
+
+
+def _decode_cookie_payload(request: Request) -> dict[str, Any] | None:
+    """Read and decode the signed admin session cookie. Returns ``None`` if absent/invalid."""
+    backend = _get_session_backend(request)
+    if backend is None:
+        return None
+    token = request.cookies.get(
+        getattr(backend, "cookie_name", "admin_session")
+    )
+    return backend.decode(token) if token else None
+
+
+async def get_current_user_from_cookie(
+    request: Request,
+) -> AdminUserProtocol | None:
+    """Resolve the current user from the signed ``admin_session`` cookie.
+
+    Returns ``None`` when there is no valid session. Does not raise — callers
+    (dependencies, view factories) decide whether a missing user is a 401.
+    """
+    payload = _decode_cookie_payload(request)
+    if payload is None:
+        return None
+    return await resolve_user(request, payload.get("user_id"))
+
+
+async def get_current_user_from_bearer(
+    request: Request,
+) -> AdminUserProtocol | None:
+    """Resolve the current user from an ``Authorization: Bearer <jwt>`` header.
+
+    Returns ``None`` when the header is absent or the token is invalid/expired.
+    The DB lookup is delegated to :func:`resolve_user`, so the JWT API now
+    honours the ``AuthBackend.get_user`` seam just like the cookie path.
+    """
+    # Imported lazily to avoid a circular import at module load time.
+    from fastapi_admin_kit.api.auth import _get_secret_key, decode_access_token
+
+    auth_header = request.headers.get("Authorization", "")
+    if not auth_header.startswith("Bearer "):
+        return None
+
+    token = auth_header[len("Bearer ") :]
+    secret_key = _get_secret_key(request)
+    payload = decode_access_token(token, secret_key)
+    if payload is None:
+        return None
+
+    sub = payload.get("sub")
+    if sub is None:
+        return None
+    try:
+        user_id: int | str = int(sub)  # type: ignore[assignment]
+    except (TypeError, ValueError):
+        return None
+    return await resolve_user(request, user_id)