fastapi-ext-pkg 0.4.4__tar.gz → 0.6.0__tar.gz

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-ext-pkg
-Version: 0.4.4
+Version: 0.6.0
 Summary: A well-tailored utility set for FastAPI.
 Author-email: Dotz Developers <devs-dotz@dotz.com>
 Project-URL: Repository, https://github.com/DotzInc/fastapi-ext-pkg
@@ -20,6 +20,8 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: fastapi
 Requires-Dist: httpx
+Provides-Extra: apm
+Requires-Dist: elastic-apm<7,>=6.20; extra == "apm"
 
 # FastAPI Extension Package
 

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/fastapi_ext_pkg.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-ext-pkg
-Version: 0.4.4
+Version: 0.6.0
 Summary: A well-tailored utility set for FastAPI.
 Author-email: Dotz Developers <devs-dotz@dotz.com>
 Project-URL: Repository, https://github.com/DotzInc/fastapi-ext-pkg
@@ -20,6 +20,8 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 Requires-Dist: fastapi
 Requires-Dist: httpx
+Provides-Extra: apm
+Requires-Dist: elastic-apm<7,>=6.20; extra == "apm"
 
 # FastAPI Extension Package
 

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/fastapi_ext_pkg.egg-info/SOURCES.txt

@@ -6,6 +6,14 @@ fastapi_ext_pkg.egg-info/dependency_links.txt
 fastapi_ext_pkg.egg-info/requires.txt
 fastapi_ext_pkg.egg-info/top_level.txt
 fastapi_extras/__init__.py
+fastapi_extras/apm/__init__.py
+fastapi_extras/apm/config.py
+fastapi_extras/apm/constants.py
+fastapi_extras/apm/decorators.py
+fastapi_extras/apm/labels.py
+fastapi_extras/apm/masking.py
+fastapi_extras/apm/middleware.py
+fastapi_extras/apm/processors.py
 fastapi_extras/databases/__init__.py
 fastapi_extras/databases/redis.py
 fastapi_extras/middlewares/__init__.py
@@ -14,4 +22,5 @@ fastapi_extras/middlewares/remove_path.py
 fastapi_extras/orm/__init__.py
 fastapi_extras/orm/sqlalchemy.py
 fastapi_extras/security/__init__.py
-fastapi_extras/security/auth.py
+fastapi_extras/security/auth.py
+fastapi_extras/security/auth_async.py

fastapi_ext_pkg-0.6.0/fastapi_ext_pkg.egg-info/requires.txt

@@ -0,0 +1,5 @@
+fastapi
+httpx
+
+[apm]
+elastic-apm<7,>=6.20

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/__init__.py

@@ -0,0 +1,19 @@
+from fastapi_extras.apm.config import build_apm_config
+from fastapi_extras.apm.constants import DEFAULT_SANITIZE_FIELD_NAMES
+from fastapi_extras.apm.decorators import capture_http_request
+from fastapi_extras.apm.labels import label_transaction
+from fastapi_extras.apm.masking import mask_sensitive_data, normalize_span_value
+from fastapi_extras.apm.middleware import ElasticAPMMiddleware
+from fastapi_extras.apm.processors import ALL_PROCESSORS, PROCESSORS
+
+__all__ = [
+    "ALL_PROCESSORS",
+    "DEFAULT_SANITIZE_FIELD_NAMES",
+    "PROCESSORS",
+    "ElasticAPMMiddleware",
+    "build_apm_config",
+    "capture_http_request",
+    "label_transaction",
+    "mask_sensitive_data",
+    "normalize_span_value",
+]

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/config.py

@@ -0,0 +1,66 @@
+from typing import Any, Dict, Iterable, List, Optional, Union
+
+import fastapi
+
+from fastapi_extras.apm.constants import (
+    DEFAULT_CAPTURE_BODY,
+    DEFAULT_CLOUD_PROVIDER,
+    DEFAULT_LOG_LEVEL,
+    DEFAULT_SANITIZE_FIELD_NAMES,
+)
+from fastapi_extras.apm.processors import ALL_PROCESSORS
+
+FieldNamesInput = Union[str, Iterable[str]]
+
+
+def parse_field_names(value: FieldNamesInput) -> List[str]:
+    items = value.split(",") if isinstance(value, str) else value
+    return [item.strip() for item in items if item.strip()]
+
+
+def unique(items: Iterable[str]) -> List[str]:
+    return list(dict.fromkeys(items))
+
+
+def has_credentials(server_url: Optional[str], secret_token: Optional[str]) -> bool:
+    return bool((server_url or "").strip() and (secret_token or "").strip())
+
+
+def build_apm_config(
+    service_name: str,
+    *,
+    server_url: Optional[str] = "",
+    secret_token: Optional[str] = "",
+    environment: str = "",
+    enabled: Optional[bool] = None,
+    log_level: str = DEFAULT_LOG_LEVEL,
+    capture_body: str = DEFAULT_CAPTURE_BODY,
+    sanitize_field_names: Optional[FieldNamesInput] = None,
+    extra_sanitize_field_names: FieldNamesInput = (),
+    extra_processors: Iterable[str] = (),
+    **overrides: Any,
+) -> Dict[str, Any]:
+    base_field_names = (
+        DEFAULT_SANITIZE_FIELD_NAMES
+        if sanitize_field_names is None
+        else parse_field_names(sanitize_field_names)
+    )
+    config: Dict[str, Any] = {
+        "ENABLED": has_credentials(server_url, secret_token) if enabled is None else enabled,
+        "SERVICE_NAME": service_name,
+        "SECRET_TOKEN": secret_token or "",
+        "SERVER_URL": server_url or "",
+        "ENVIRONMENT": environment,
+        "LOG_LEVEL": log_level,
+        "CLOUD_PROVIDER": DEFAULT_CLOUD_PROVIDER,
+        "FRAMEWORK_NAME": "fastapi",
+        "FRAMEWORK_VERSION": fastapi.__version__,
+        "CAPTURE_HEADERS": True,
+        "CAPTURE_BODY": capture_body,
+        "SANITIZE_FIELD_NAMES": unique(
+            [*base_field_names, *parse_field_names(extra_sanitize_field_names)]
+        ),
+        "PROCESSORS": (*ALL_PROCESSORS, *extra_processors),
+    }
+    config.update({key.upper(): value for key, value in overrides.items()})
+    return config

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/constants.py

@@ -0,0 +1,46 @@
+EXTERNAL = "external"
+UNKNOWN = "UNKNOWN"
+UNKNOWN_STATUS_CODE = 999
+MAX_FIELD_LENGTH = 500
+MAX_RESPONSE_BODY_BYTES = 64 * 1024
+TRUNCATED_SUFFIX = "… [TRUNCATED]"
+UNREADABLE_RESPONSE = "<could not decode response>"
+RESPONSE_BODY_TOO_LARGE = "<response body too large>"
+RESPONSE_BODY_CONTEXT_KEY = "response_body"
+JSON_MEDIA_TYPE = "application/json"
+JSON_MEDIA_TYPE_SUFFIX = "+json"
+IDENTITY_ENCODING = "identity"
+DEFAULT_SANITIZE_FIELD_NAMES = (
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "*key",
+    "*token*",
+    "*session*",
+    "*credit*",
+    "*card*",
+    "*auth*",
+    "*principal*",
+    "set-cookie",
+    "pin",
+    "otp",
+    "*document*",
+    "*cpf*",
+    "*cnpj*",
+    "*email*",
+    "*phone*",
+    "*mobile*",
+    "*birth*",
+    "mother_name",
+    "rg",
+    "*account_number*",
+    "agency",
+    "pix_key",
+    "*cvv*",
+    "*salary*",
+    "*income*",
+)
+DEFAULT_LOG_LEVEL = "INFO"
+DEFAULT_CAPTURE_BODY = "off"
+DEFAULT_CLOUD_PROVIDER = "gcp"

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/decorators.py

@@ -0,0 +1,127 @@
+import functools
+import inspect
+from typing import Any, Awaitable, Callable, Dict, Mapping, Optional, Tuple, TypeVar
+from urllib.parse import urlparse
+
+import elasticapm
+from elasticapm.conf.constants import MASK
+
+from fastapi_extras.apm.constants import EXTERNAL, UNKNOWN, UNKNOWN_STATUS_CODE, UNREADABLE_RESPONSE
+from fastapi_extras.apm.labels import to_label_value
+from fastapi_extras.apm.masking import (
+    FieldNames,
+    get_sanitize_field_names,
+    is_sensitive_key,
+    mask_sensitive_data,
+    normalize_span_value,
+)
+
+ReturnType = TypeVar("ReturnType")
+
+ERROR_BODY_ATTRIBUTES = ("errors", "content", "detail")
+
+
+def get_span_name(method: str, url: str) -> str:
+    parsed = urlparse(url)
+    path = parsed.path
+    if parsed.query:
+        path = f"{path}?{parsed.query}"
+    return f"{method.upper()} {path}"
+
+
+def is_outgoing_request(value: Any) -> bool:
+    return isinstance(getattr(value, "method", None), str) and isinstance(
+        getattr(value, "url", None), str
+    )
+
+
+def find_outgoing_request(args: Tuple[Any, ...], kwargs: Mapping[str, Any]) -> Any:
+    candidate = kwargs.get("request")
+    if is_outgoing_request(candidate):
+        return candidate
+    return next((arg for arg in args if is_outgoing_request(arg)), None)
+
+
+async def read_response(response: Any) -> Tuple[Optional[int], Any]:
+    status_code = getattr(response, "status", None)
+    if not isinstance(status_code, int):
+        status_code = getattr(response, "status_code", None)
+    if not isinstance(status_code, int):
+        return None, None
+    try:
+        text = response.text
+        body = text() if callable(text) else text
+        if inspect.isawaitable(body):
+            body = await body
+    except Exception:
+        body = UNREADABLE_RESPONSE
+    return status_code, body
+
+
+def read_error(error: Exception) -> Tuple[int, Any]:
+    status_code = getattr(error, "status_code", None)
+    if not isinstance(status_code, int):
+        return UNKNOWN_STATUS_CODE, repr(error)
+    body = {}
+    for attribute in ERROR_BODY_ATTRIBUTES:
+        value = getattr(error, attribute, None)
+        if value:
+            body[attribute] = value
+    return status_code, body
+
+
+def build_span_labels(
+    status_code: Optional[int],
+    response_body: Any,
+    payload: Any,
+    extra_labels: Optional[Mapping[str, Any]] = None,
+    field_names: Optional[FieldNames] = None,
+) -> Dict[str, Any]:
+    names = get_sanitize_field_names() if field_names is None else field_names
+    labels: Dict[str, Any] = {
+        "status_code": status_code,
+        "response_body": normalize_span_value(response_body),
+    }
+    if payload:
+        labels["payload"] = normalize_span_value(payload)
+    if extra_labels:
+        labels.update(extra_labels)
+    return {
+        key: MASK
+        if is_sensitive_key(key, names)
+        else to_label_value(mask_sensitive_data(value, names))
+        for key, value in labels.items()
+    }
+
+
+def capture_http_request(
+    func: Callable[..., Awaitable[ReturnType]],
+) -> Callable[..., Awaitable[ReturnType]]:
+    @functools.wraps(func)
+    async def wrapper(*args: Any, **kwargs: Any) -> ReturnType:
+        request = find_outgoing_request(args, kwargs)
+        method = getattr(request, "method", UNKNOWN)
+        url = getattr(request, "url", UNKNOWN)
+        payload = getattr(request, "payload", None)
+        status_code: Optional[int] = None
+        response_body: Any = None
+
+        async with elasticapm.async_capture_span(
+            get_span_name(method, url), span_type=EXTERNAL
+        ) as span:
+            try:
+                response = await func(*args, **kwargs)
+                status_code, response_body = await read_response(response)
+                return response
+            except Exception as error:
+                status_code, response_body = read_error(error)
+                raise
+            finally:
+                if span:
+                    span.label(
+                        **build_span_labels(
+                            status_code, response_body, payload, kwargs.get("labels")
+                        )
+                    )
+
+    return wrapper

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/labels.py

@@ -0,0 +1,20 @@
+import json
+from typing import Any, Iterable, Mapping
+
+import elasticapm
+
+from fastapi_extras.apm.masking import get_sanitize_field_names, sanitize, truncate
+
+
+def to_label_value(value: Any) -> Any:
+    if isinstance(value, (dict, list)):
+        return json.dumps(value, ensure_ascii=False, default=str)
+    return value
+
+
+def label_transaction(data: Mapping[str, Any], keys: Iterable[str]) -> None:
+    labels = {key: data[key] for key in keys if data.get(key) is not None}
+    if not labels:
+        return
+    safe_labels = truncate(sanitize(labels, get_sanitize_field_names()))
+    elasticapm.label(**{key: to_label_value(value) for key, value in safe_labels.items()})

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/masking.py

@@ -0,0 +1,87 @@
+import base64
+import json
+import logging
+from typing import Any, Optional, Pattern, Sequence
+
+import elasticapm
+from elasticapm.conf.constants import BASE_SANITIZE_FIELD_NAMES, MASK
+from pydantic import BaseModel
+
+from fastapi_extras.apm.constants import MAX_FIELD_LENGTH, TRUNCATED_SUFFIX
+
+logger = logging.getLogger(__name__)
+
+FieldNames = Sequence[Pattern]
+
+
+def get_sanitize_field_names() -> FieldNames:
+    client = elasticapm.get_client()
+    if client is None:
+        return BASE_SANITIZE_FIELD_NAMES
+    return client.config.sanitize_field_names
+
+
+def is_sensitive_key(key: Any, field_names: FieldNames) -> bool:
+    if not isinstance(key, str):
+        return False
+    normalized = key.strip().lower()
+    return any(pattern.match(normalized) for pattern in field_names)
+
+
+def sanitize(data: Any, field_names: FieldNames) -> Any:
+    if isinstance(data, dict):
+        return {
+            key: MASK if is_sensitive_key(key, field_names) else sanitize(value, field_names)
+            for key, value in data.items()
+        }
+    if isinstance(data, (list, tuple)):
+        return [sanitize(item, field_names) for item in data]
+    return data
+
+
+def truncate(data: Any, max_length: int = MAX_FIELD_LENGTH) -> Any:
+    if isinstance(data, dict):
+        return {key: truncate(value, max_length) for key, value in data.items()}
+    if isinstance(data, (list, tuple)):
+        return [truncate(item, max_length) for item in data]
+    if data is None or isinstance(data, (bool, int, float)):
+        return data
+    text = data if isinstance(data, str) else str(data)
+    if len(text) > max_length:
+        return text[:max_length] + TRUNCATED_SUFFIX
+    return text
+
+
+def normalize_span_value(value: Any) -> Any:
+    if isinstance(value, BaseModel):
+        dump = getattr(value, "model_dump", None) or value.dict
+        return dump()
+    if isinstance(value, (bytes, bytearray)):
+        try:
+            return bytes(value).decode("utf-8")
+        except UnicodeDecodeError:
+            return base64.b64encode(bytes(value)).decode("ascii")
+    return value
+
+
+def parse_json(value: str) -> Any:
+    try:
+        return json.loads(value)
+    except ValueError:
+        return value
+
+
+def mask_sensitive_data(
+    data: Any,
+    field_names: Optional[FieldNames] = None,
+    max_length: int = MAX_FIELD_LENGTH,
+) -> Any:
+    names = get_sanitize_field_names() if field_names is None else field_names
+    try:
+        value = normalize_span_value(data)
+        if isinstance(value, str):
+            value = parse_json(value)
+        return truncate(sanitize(value, names), max_length)
+    except Exception:
+        logger.exception("Could not mask APM data")
+        return MASK

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/middleware.py

@@ -0,0 +1,105 @@
+import functools
+from typing import Any, List, Optional
+
+import elasticapm
+from elasticapm.base import Client
+from elasticapm.contrib.starlette import ElasticAPM
+from starlette.datastructures import Headers
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+from fastapi_extras.apm.constants import (
+    IDENTITY_ENCODING,
+    JSON_MEDIA_TYPE,
+    JSON_MEDIA_TYPE_SUFFIX,
+    MAX_RESPONSE_BODY_BYTES,
+    RESPONSE_BODY_CONTEXT_KEY,
+    RESPONSE_BODY_TOO_LARGE,
+)
+from fastapi_extras.apm.masking import mask_sensitive_data
+
+
+def is_json(headers: Headers) -> bool:
+    media_type = headers.get("content-type", "").split(";")[0].strip().lower()
+    return media_type == JSON_MEDIA_TYPE or media_type.endswith(JSON_MEDIA_TYPE_SUFFIX)
+
+
+def is_encoded(headers: Headers) -> bool:
+    encoding = headers.get("content-encoding", IDENTITY_ENCODING).strip().lower()
+    return encoding not in ("", IDENTITY_ENCODING)
+
+
+class ResponseBodyRecorder:
+    def __init__(self, max_bytes: int) -> None:
+        self.max_bytes = max_bytes
+        self.chunks: List[bytes] = []
+        self.size = 0
+        self.readable = False
+        self.too_large = False
+
+    def start(self, message: Message) -> None:
+        headers = Headers(raw=message.get("headers", []))
+        content_length = headers.get("content-length", "")
+        self.readable = is_json(headers) and not is_encoded(headers)
+        self.too_large = content_length.isdigit() and int(content_length) > self.max_bytes
+
+    def feed(self, message: Message) -> bool:
+        if self.readable and not self.too_large:
+            self._append(message.get("body", b""))
+        return not message.get("more_body", False)
+
+    def _append(self, chunk: bytes) -> None:
+        self.size += len(chunk)
+        if self.size > self.max_bytes:
+            self.too_large = True
+            self.chunks.clear()
+        elif chunk:
+            self.chunks.append(chunk)
+
+
+class ElasticAPMMiddleware(ElasticAPM):
+    def __init__(
+        self,
+        app: ASGIApp,
+        client: Optional[Client] = None,
+        capture_response_body: bool = True,
+        max_response_body_bytes: int = MAX_RESPONSE_BODY_BYTES,
+        **kwargs: Any,
+    ) -> None:
+        super().__init__(app, client, **kwargs)
+        self.capture_response_body = capture_response_body
+        self.max_response_body_bytes = max_response_body_bytes
+
+    def _record_response_body(self, recorder: ResponseBodyRecorder) -> None:
+        if not recorder.readable:
+            return
+        if recorder.too_large:
+            body = RESPONSE_BODY_TOO_LARGE
+        else:
+            body = mask_sensitive_data(
+                b"".join(recorder.chunks), self.client.config.sanitize_field_names
+            )
+        elasticapm.set_custom_context({RESPONSE_BODY_CONTEXT_KEY: body})
+
+    def _should_record(self, scope: Scope) -> bool:
+        return (
+            scope["type"] == "http"
+            and self.capture_response_body
+            and not self.client.should_ignore_url(scope["path"])
+        )
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if not self._should_record(scope):
+            await super().__call__(scope, receive, send)
+            return
+
+        recorder = ResponseBodyRecorder(self.max_response_body_bytes)
+
+        @functools.wraps(send)
+        async def recording_send(message: Message) -> None:
+            if message.get("type") == "http.response.start":
+                recorder.start(message)
+            elif message.get("type") == "http.response.body" and recorder.feed(message):
+                self._record_response_body(recorder)
+            await send(message)
+
+        await super().__call__(scope, receive, recording_send)

fastapi_ext_pkg-0.6.0/fastapi_extras/apm/processors.py

@@ -0,0 +1,80 @@
+import json
+from typing import Any, Dict, Optional
+
+from elasticapm.conf.constants import ERROR, MASK, SPAN, TRANSACTION
+from elasticapm.processors import for_events
+
+from fastapi_extras.apm.masking import FieldNames, is_sensitive_key, sanitize
+
+PROCESSORS = (
+    "fastapi_extras.apm.processors.sanitize_http_request_json_body",
+    "fastapi_extras.apm.processors.sanitize_custom_context",
+    "fastapi_extras.apm.processors.sanitize_labels",
+)
+AGENT_PROCESSORS = (
+    "elasticapm.processors.sanitize_stacktrace_locals",
+    "elasticapm.processors.sanitize_http_request_cookies",
+    "elasticapm.processors.sanitize_http_response_cookies",
+    "elasticapm.processors.sanitize_http_headers",
+    "elasticapm.processors.sanitize_http_wsgi_env",
+    "elasticapm.processors.sanitize_http_request_body",
+)
+ALL_PROCESSORS = (*PROCESSORS, *AGENT_PROCESSORS)
+
+
+def load_json_structure(value: Any) -> Optional[Any]:
+    if isinstance(value, (dict, list)):
+        return value
+    if not isinstance(value, (str, bytes, bytearray)):
+        return None
+    try:
+        parsed = json.loads(value)
+    except ValueError:
+        return None
+    return parsed if isinstance(parsed, (dict, list)) else None
+
+
+def sanitize_label(key: str, value: Any, field_names: FieldNames) -> Any:
+    if is_sensitive_key(key, field_names):
+        return MASK
+    if not isinstance(value, str):
+        return value
+    parsed = load_json_structure(value)
+    if parsed is None:
+        return value
+    return json.dumps(sanitize(parsed, field_names), ensure_ascii=False)
+
+
+@for_events(ERROR, TRANSACTION)
+def sanitize_http_request_json_body(client: Any, event: Dict[str, Any]) -> Dict[str, Any]:
+    try:
+        body = event["context"]["request"]["body"]
+    except (KeyError, TypeError):
+        return event
+    parsed = load_json_structure(body)
+    if parsed is None:
+        return event
+    event["context"]["request"]["body"] = json.dumps(
+        sanitize(parsed, client.config.sanitize_field_names)
+    )
+    return event
+
+
+@for_events(ERROR, TRANSACTION)
+def sanitize_custom_context(client: Any, event: Dict[str, Any]) -> Dict[str, Any]:
+    custom = (event.get("context") or {}).get("custom")
+    if isinstance(custom, dict):
+        event["context"]["custom"] = sanitize(custom, client.config.sanitize_field_names)
+    return event
+
+
+@for_events(SPAN, TRANSACTION)
+def sanitize_labels(client: Any, event: Dict[str, Any]) -> Dict[str, Any]:
+    tags = (event.get("context") or {}).get("tags")
+    if not isinstance(tags, dict):
+        return event
+    field_names = client.config.sanitize_field_names
+    event["context"]["tags"] = {
+        key: sanitize_label(key, value, field_names) for key, value in tags.items()
+    }
+    return event

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/fastapi_extras/databases/redis.py

@@ -15,8 +15,19 @@ class Redis(redis.Redis):
 
 
 class RedisManager:
-    def __init__(self, url: Union[RedisDsn, str]):
-        self.pool = redis.ConnectionPool.from_url(str(url))
+    def __init__(
+        self,
+        url: Union[RedisDsn, str],
+        socket_timeout: float = 2.0,
+        socket_connect_timeout: float = 2.0,
+        health_check_interval: int = 30,
+    ):
+        self.pool = redis.ConnectionPool.from_url(
+            str(url),
+            socket_timeout=socket_timeout,
+            socket_connect_timeout=socket_connect_timeout,
+            health_check_interval=health_check_interval,
+        )
 
     async def __call__(self) -> AsyncGenerator[Redis, None]:
         cli = Redis(connection_pool=self.pool)

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/fastapi_extras/security/auth.py

@@ -2,7 +2,7 @@ import hashlib
 import json
 import logging
 import typing
-from typing import Any, AsyncGenerator, Awaitable, Callable, Optional, Protocol, Union
+from typing import Any, AsyncGenerator, Awaitable, Callable, Optional, Protocol, Tuple, Union
 
 import httpx
 from fastapi import Depends, HTTPException, Request, status
@@ -14,6 +14,12 @@ logger = logging.getLogger(__name__)
 ssl_context = httpx.create_ssl_context()
 
 UNAUTHORIZED = HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+SERVICE_UNAVAILABLE = HTTPException(
+    status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail="Authorization service unavailable"
+)
+DENIED_STATUS_CODES = frozenset(
+    {status.HTTP_400_BAD_REQUEST, status.HTTP_401_UNAUTHORIZED, status.HTTP_403_FORBIDDEN}
+)
 DEFAULT_SCHEME = APIKeyHeader(name="Authorization")
 DEFAULT_CACHE_TTL = 60  # seconds
 
@@ -38,6 +44,21 @@ def keygen(seed: str, prefix: str = "") -> str:
     return f"{prefix}{hash}"
 
 
+def parse_response(response: httpx.Response) -> Tuple[bool, Any]:
+    if response.status_code in DENIED_STATUS_CODES:
+        return False, None
+
+    if response.status_code != status.HTTP_200_OK:
+        logger.error(f"Authorization service returned unexpected status {response.status_code}")
+        raise SERVICE_UNAVAILABLE
+
+    try:
+        return True, response.json()
+    except ValueError:
+        logger.error(f"Authorization service returned a non-JSON body: {response.text}")
+        raise SERVICE_UNAVAILABLE
+
+
 def remote_authorization(
     url: Union[str, AnyHttpUrl],
     *,
@@ -60,7 +81,7 @@ def remote_authorization(
         try:
             cached = await cache.get(key)
         except Exception as cache_error:
-            logger.warning("Cache get failed, proceeding without cache: %s", cache_error)
+            logger.warning(f"Cache get failed, proceeding without cache: {cache_error}")
 
         if cached:
             cached = json.loads(cached)
@@ -84,22 +105,23 @@ def remote_authorization(
             try:
                 response = await client.post(str(url), json=info, **kwargs)
             except httpx.HTTPError as http_error:
-                logger.error(http_error)
-                raise UNAUTHORIZED
-            else:
-                authorized = response.status_code == status.HTTP_200_OK
-                context = response.json()
+                logger.error(
+                    f"Authorization request failed: {type(http_error).__name__}: {http_error}"
+                )
+                raise SERVICE_UNAVAILABLE
+
+        authorized, context = parse_response(response)
 
-                try:
-                    value = json.dumps({"authorized": authorized, "context": context})
-                    await cache.set(key, value, cache_ttl)
-                except Exception as cache_error:
-                    logger.warning("Cache set failed, proceeding without cache: %s", cache_error)
+        try:
+            value = json.dumps({"authorized": authorized, "context": context})
+            await cache.set(key, value, cache_ttl)
+        except Exception as cache_error:
+            logger.warning(f"Cache set failed, proceeding without cache: {cache_error}")
 
-                if not authorized:
-                    raise UNAUTHORIZED
+        if not authorized:
+            raise UNAUTHORIZED
 
-                request.scope["authorizer"] = context
-                return request.scope["authorizer"]
+        request.scope["authorizer"] = context
+        return request.scope["authorizer"]
 
     return authorizer

fastapi_ext_pkg-0.6.0/fastapi_extras/security/auth_async.py

@@ -0,0 +1,180 @@
+import hashlib
+import json
+import logging
+from typing import Any, AsyncGenerator, Callable, Optional, Protocol, Union
+
+import httpx
+from fastapi import Depends, HTTPException, Request, status
+from fastapi.security import APIKeyCookie, APIKeyHeader, APIKeyQuery
+from pydantic import AnyHttpUrl, RedisDsn
+from redis.asyncio import ConnectionPool, Redis
+from redis.asyncio.retry import Retry
+from redis.backoff import ExponentialBackoff
+from redis.exceptions import ConnectionError as RedisConnectionError
+from redis.exceptions import RedisError
+from typing_extensions import Annotated
+
+from fastapi_extras.security.auth import SERVICE_UNAVAILABLE, parse_response
+
+logger = logging.getLogger(__name__)
+ssl_context = httpx.create_ssl_context()
+
+UNAUTHORIZED = HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
+DEFAULT_SCHEME = APIKeyHeader(name="Authorization")
+DEFAULT_CACHE_TTL = 60  # seconds
+
+# Redis client bounds: keep a stuck connection from a Redis outage from being
+# reused forever instead of getting discarded and replaced.
+DEFAULT_SOCKET_TIMEOUT = 2.0
+DEFAULT_SOCKET_CONNECT_TIMEOUT = 2.0
+DEFAULT_HEALTH_CHECK_INTERVAL = 30
+DEFAULT_HTTP_TIMEOUT = 5.0
+DEFAULT_HTTP_CONNECT_TIMEOUT = 2.0
+
+APIKeyScheme = Union[APIKeyCookie, APIKeyHeader, APIKeyQuery]
+
+CacheDependency = Callable[..., Union[Redis, AsyncGenerator[Redis, None]]]
+HTTPClientDependency = Callable[..., httpx.AsyncClient]
+
+
+def keygen(seed: str, prefix: str = "") -> str:
+    hash = hashlib.sha256(seed.encode()).hexdigest()
+    return f"{prefix}{hash}"
+
+
+class AsyncRedisCache:
+    """FastAPI dependency yielding a redis.asyncio.Redis bound to a shared
+    pool with bounded timeouts + health checks, so stuck connections from a
+    Redis outage get discarded instead of reused forever."""
+
+    def __init__(
+        self,
+        url: Union[RedisDsn, str],
+        *,
+        socket_timeout: float = DEFAULT_SOCKET_TIMEOUT,
+        socket_connect_timeout: float = DEFAULT_SOCKET_CONNECT_TIMEOUT,
+        health_check_interval: int = DEFAULT_HEALTH_CHECK_INTERVAL,
+    ) -> None:
+        self.pool = ConnectionPool.from_url(
+            str(url),
+            decode_responses=True,
+            socket_timeout=socket_timeout,
+            socket_connect_timeout=socket_connect_timeout,
+            health_check_interval=health_check_interval,
+            retry_on_error=[RedisConnectionError],
+            retry=Retry(ExponentialBackoff(cap=1.0, base=0.05), retries=1),
+        )
+
+    async def __call__(self) -> AsyncGenerator[Redis, None]:
+        cli = Redis(connection_pool=self.pool)
+        try:
+            yield cli
+        finally:
+            await cli.aclose()
+
+
+class Authorizer(Protocol):
+    """Structural type for what remote_authorization_async returns: a FastAPI
+    dependency callable that also owns a closeable httpx client."""
+
+    async def __call__(
+        self, request: Request, token: str, cache: Redis, http_client: httpx.AsyncClient
+    ) -> Any: ...
+    async def aclose(self) -> None: ...
+
+
+def remote_authorization_async(
+    url: Union[str, AnyHttpUrl],
+    *,
+    scheme: APIKeyScheme = DEFAULT_SCHEME,
+    cache_gen: CacheDependency,
+    http_client_gen: Optional[HTTPClientDependency] = None,
+    cache_ttl: int = DEFAULT_CACHE_TTL,
+    http_timeout: float = DEFAULT_HTTP_TIMEOUT,
+    http_connect_timeout: float = DEFAULT_HTTP_CONNECT_TIMEOUT,
+    **kwargs: Any,
+) -> Authorizer:
+    if not isinstance(scheme, (APIKeyCookie, APIKeyHeader, APIKeyQuery)):
+        raise TypeError("Invalid APIKeyScheme")
+
+    request_timeout = httpx.Timeout(http_timeout, connect=http_connect_timeout)
+
+    # Only built when the caller has no httpx client of its own to inject.
+    _owned_client: Optional[httpx.AsyncClient] = None
+
+    def _get_owned_client() -> httpx.AsyncClient:
+        nonlocal _owned_client
+        if _owned_client is None:
+            _owned_client = httpx.AsyncClient(verify=ssl_context, timeout=request_timeout)
+        return _owned_client
+
+    async def _default_http_client_gen() -> httpx.AsyncClient:
+        return _get_owned_client()
+
+    async def aclose() -> None:
+        nonlocal _owned_client
+        if _owned_client is not None:
+            await _owned_client.aclose()
+            _owned_client = None
+
+    async def authorizer(
+        request: Request,
+        token: Annotated[str, Depends(scheme)],
+        cache: Annotated[Redis, Depends(cache_gen)],
+        http_client: Annotated[
+            httpx.AsyncClient, Depends(http_client_gen or _default_http_client_gen)
+        ],
+    ) -> Any:
+        key = keygen(token, prefix="authorizer:")
+
+        cached = None
+        try:
+            cached = await cache.get(key)
+        except RedisError as cache_error:
+            logger.warning("Cache get failed, proceeding without cache: %s", cache_error)
+
+        if cached:
+            cached = json.loads(cached)
+
+        if cached and isinstance(cached, dict):
+            if not cached.get("authorized"):
+                raise UNAUTHORIZED
+
+            request.scope["authorizer"] = cached.get("context")
+            return request.scope["authorizer"]
+
+        info = {
+            "method": request.method,
+            "path": request.url.path,
+            "query_params": dict(request.query_params),
+            "headers": dict(request.headers),
+            "cookies": request.cookies,
+        }
+
+        # Explicit per-call timeout so it applies even when http_client is an
+        # externally-shared client whose own default timeout differs.
+        request_kwargs = {**kwargs, "timeout": request_timeout}
+        try:
+            response = await http_client.post(str(url), json=info, **request_kwargs)
+        except httpx.HTTPError as http_error:
+            logger.error(
+                "Authorization request failed: %s: %s", type(http_error).__name__, http_error
+            )
+            raise SERVICE_UNAVAILABLE
+
+        authorized, context = parse_response(response)
+
+        try:
+            value = json.dumps({"authorized": authorized, "context": context})
+            await cache.set(key, value, ex=cache_ttl)
+        except RedisError as cache_error:
+            logger.warning("Cache set failed, proceeding without cache: %s", cache_error)
+
+        if not authorized:
+            raise UNAUTHORIZED
+
+        request.scope["authorizer"] = context
+        return request.scope["authorizer"]
+
+    authorizer.aclose = aclose
+    return authorizer

{fastapi_ext_pkg-0.4.4 → fastapi_ext_pkg-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fastapi-ext-pkg"
-version = "0.4.4"
+version = "0.6.0"
 description = "A well-tailored utility set for FastAPI."
 readme = {file = "README.md", content-type = "text/markdown"}
 authors = [
@@ -27,6 +27,9 @@ classifiers = [
 requires-python = ">=3.8"
 dependencies = ["fastapi", "httpx"]
 
+[project.optional-dependencies]
+apm = ["elastic-apm>=6.20,<7"]
+
 [project.urls]
 Repository = "https://github.com/DotzInc/fastapi-ext-pkg"
 

fastapi_ext_pkg-0.4.4/fastapi_ext_pkg.egg-info/requires.txt

@@ -1,2 +0,0 @@
-fastapi
-httpx