fastapi-multiauth 0.4.0__tar.gz → 0.4.1__tar.gz

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-multiauth
-Version: 0.4.0
+Version: 0.4.1
 Summary: Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction
 Keywords: fastapi,authentication,security,oauth,api-key,bearer,cookie
 Author: d3vyce
@@ -25,7 +25,7 @@ Classifier: Topic :: Software Development :: Libraries
 Classifier: Typing :: Typed
 Requires-Dist: anyio>=3.7
 Requires-Dist: async-lru>=2.0
-Requires-Dist: fastapi>=0.100.0
+Requires-Dist: fastapi>=0.108.0
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: itsdangerous>=2.1
 Requires-Dist: pyjwt[crypto]>=2.13.0 ; extra == 'jwt'

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-multiauth"
-version = "0.4.0"
+version = "0.4.1"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
@@ -36,7 +36,7 @@ classifiers = [
 dependencies = [
     "anyio>=3.7",
     "async-lru>=2.0",
-    "fastapi>=0.100.0",
+    "fastapi>=0.108.0",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
 ]

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-multiauth"
-version = "0.4.0"
+version = "0.4.1"
 description = "Composable authentication sources for FastAPI: bring your own validator, combine multiple schemes, correct OpenAPI by construction"
 readme = "README.md"
 license = "MIT"
@@ -31,7 +31,7 @@ classifiers = [
 dependencies = [
     "anyio>=3.7",
     "async-lru>=2.0",
-    "fastapi>=0.100.0",
+    "fastapi>=0.108.0",
     "httpx>=0.25.0",
     "itsdangerous>=2.1",
 ]

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/__init__.py

@@ -23,7 +23,7 @@ from .sources import (
 )
 from .utils import hash_token, verify_token_hash
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"
 
 __all__ = [
     "APIKeyCookieAuth",

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/abc.py

@@ -4,9 +4,9 @@ import copy
 import inspect
 from abc import ABC, abstractmethod
 from collections.abc import Callable
-from typing import TYPE_CHECKING, Annotated, Any
+from typing import TYPE_CHECKING, Any
 
-from fastapi import Depends, HTTPException, Request
+from fastapi import HTTPException, Request
 from fastapi.security import SecurityScopes
 from fastapi.security.base import SecurityBase
 
@@ -72,6 +72,24 @@ class _DocOnlyScheme(SecurityBase):
         return None
 
 
+_SCHEME_CLASSES: dict[type, type] = {}
+
+
+def _carry_scheme(dependency: Any, scheme: SecurityBase) -> None:
+    """Make *dependency* itself the security scheme FastAPI puts in OpenAPI."""
+    cls = type(dependency)
+    promoted = _SCHEME_CLASSES.get(cls)
+    if promoted is None:
+        promoted = _SCHEME_CLASSES[cls] = type(
+            cls.__name__,
+            (cls, SecurityBase),
+            {"__module__": cls.__module__, "__doc__": cls.__doc__},
+        )
+    dependency.__class__ = promoted
+    dependency.model = scheme.model
+    dependency.scheme_name = scheme.scheme_name
+
+
 class AuthSource(ABC):
     """Abstract base class for authentication sources.
 
@@ -90,6 +108,8 @@ class AuthSource(ABC):
                 metadata is used, extraction always goes through :meth:`extract`.
         """
         self.scheme = _DocOnlyScheme(scheme) if scheme is not None else None
+        if self.scheme is not None:
+            _carry_scheme(self, self.scheme)
 
         parameters = [
             inspect.Parameter(
@@ -103,17 +123,6 @@ class AuthSource(ABC):
                 annotation=SecurityScopes,
             ),
         ]
-        if self.scheme is not None:
-            # Declared only so the scheme is registered in OpenAPI; the
-            # extracted value is ignored in favor of extract().
-            parameters.append(
-                inspect.Parameter(
-                    "credentials",
-                    inspect.Parameter.POSITIONAL_OR_KEYWORD,
-                    annotation=Annotated[Any, Depends(self.scheme)],
-                    default=None,
-                )
-            )
         self.__signature__ = inspect.Signature(parameters, return_annotation=Any)
 
     @abstractmethod

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/jwt.py

@@ -256,5 +256,10 @@ class JWTValidator:
                 # provider's JWKS must not take down every login.
                 continue
             keys[entry.get("kid") or ""] = key
+        if not keys:
+            raise _JWKSFetchError(
+                f"JWKS document has no usable signing key "
+                f"({len(document['keys'])} entries)"
+            )
         self._keys = keys
         self._fetched_at = time.monotonic()

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/oauth/client.py

@@ -3,6 +3,7 @@
 import contextlib
 import functools
 from typing import Any, Literal, NamedTuple
+from urllib.parse import urlsplit
 
 import httpx
 from async_lru import alru_cache
@@ -41,13 +42,25 @@ class OIDCEndpoints(NamedTuple):
 
 def _validate_issuer(discovery_url: str, issuer: Any) -> None:
     """Check the discovery document claims the issuer it was fetched from."""
-    if not discovery_url.endswith(_DISCOVERY_SUFFIX):
-        return
-    expected = discovery_url.removesuffix(_DISCOVERY_SUFFIX).rstrip("/")
-    if not isinstance(issuer, str) or issuer.rstrip("/") != expected:
+    if not isinstance(issuer, str) or not issuer:
         raise OAuthDiscoveryError(
-            f"discovery document issuer {issuer!r} does not match the "
-            f"expected issuer {expected!r} derived from the discovery URL"
+            f"discovery document has no usable 'issuer' (got {issuer!r})"
+        )
+    claimed = issuer.rstrip("/")
+    parts = urlsplit(discovery_url)
+    origin = f"{parts.scheme}://{parts.netloc}"
+    path = parts.path.rstrip("/")
+    if path.endswith(_DISCOVERY_SUFFIX):
+        expected = (origin + path.removesuffix(_DISCOVERY_SUFFIX)).rstrip("/")
+        if claimed != expected:
+            raise OAuthDiscoveryError(
+                f"discovery document issuer {issuer!r} does not match the "
+                f"expected issuer {expected!r} derived from the discovery URL"
+            )
+    elif claimed != origin and not claimed.startswith(f"{origin}/"):
+        raise OAuthDiscoveryError(
+            f"discovery document issuer {issuer!r} is not served by "
+            f"{origin!r}, the origin the document was fetched from"
         )
 
 

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/sources/basic.py

@@ -13,6 +13,20 @@ from ..abc import ValidatedAuthSource
 from ..utils import authorization_credential
 
 
+def _basic_challenge(realm: str | None) -> str:
+    """Build the ``WWW-Authenticate`` challenge, escaping *realm* (RFC 7230 §3.2.6)."""
+    if realm is None:
+        return "Basic"
+    if not (realm.isascii() and realm.isprintable()):
+        raise ValueError(
+            f"realm must be printable US-ASCII (RFC 7617 §2.1), got {realm!r}: "
+            "control characters have no escaped form in a quoted-string, and "
+            "non-ASCII cannot be carried in a header value"
+        )
+    escaped = realm.replace("\\", "\\\\").replace('"', '\\"')
+    return f'Basic realm="{escaped}"'
+
+
 class HTTPBasicAuth(ValidatedAuthSource):
     """HTTP Basic authentication source (wraps ``HTTPBasic`` for OpenAPI, RFC 7617).
 
@@ -23,7 +37,7 @@ class HTTPBasicAuth(ValidatedAuthSource):
         validator: Sync or async callable receiving ``(username, password)`` and
             returning the identity; raises
             :class:`~fastapi_multiauth.exceptions.UnauthorizedError` on failure.
-        realm: Optional protection-space name for the ``WWW-Authenticate`` challenge.
+        realm: Optional protection-space name for the ``WWW-Authenticate``.
         scheme_name: OpenAPI security scheme name (default ``HTTPBasic``).
         **kwargs: Extra keyword arguments forwarded to the validator on every call.
     """
@@ -36,7 +50,7 @@ class HTTPBasicAuth(ValidatedAuthSource):
         scheme_name: str | None = None,
         **kwargs: Any,
     ) -> None:
-        self._realm = realm
+        self._challenge = _basic_challenge(realm)
         super().__init__(
             validator,
             HTTPBasic(auto_error=False, scheme_name=scheme_name),
@@ -45,9 +59,7 @@ class HTTPBasicAuth(ValidatedAuthSource):
 
     def www_authenticate(self) -> str:
         """``Basic`` challenge, with the realm when configured (RFC 7617 §2)."""
-        if self._realm is not None:
-            return f'Basic realm="{self._realm}"'
-        return "Basic"
+        return self._challenge
 
     async def extract(self, request: Request) -> str | None:
         """Return the base64 credentials blob, or ``None`` when absent or empty.

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/sources/cookie.py

@@ -36,6 +36,16 @@ def _normalize_secret_keys(secret_key: str | Sequence[str] | None) -> list[str]:
     return keys
 
 
+def _precomputed_signer(keys: list[str], salt: str) -> TimestampSigner:
+    """A ``TimestampSigner`` deriving its keys once here instead of per ``unsign``."""
+    probe = TimestampSigner(keys, salt=salt, digest_method=hashlib.sha256)
+    return TimestampSigner(
+        [probe.derive_key(key) for key in keys],
+        digest_method=hashlib.sha256,
+        key_derivation="none",
+    )
+
+
 class APIKeyCookieAuth(ValidatedAuthSource):
     """Cookie-based authentication source (wraps ``APIKeyCookie`` for OpenAPI).
 
@@ -98,10 +108,9 @@ class APIKeyCookieAuth(ValidatedAuthSource):
         # the last one — reverse so the first configured key is the signer.
         # The salt also separates the two payload layouts.
         self._signer = (
-            TimestampSigner(
+            _precomputed_signer(
                 list(reversed(self._secret_keys)),
-                salt=f"{_SALT_PREFIX}{name}{'.sid' if session_id else ''}",
-                digest_method=hashlib.sha256,
+                f"{_SALT_PREFIX}{name}{'.sid' if session_id else ''}",
             )
             if self._secret_keys
             else None

{fastapi_multiauth-0.4.0 → fastapi_multiauth-0.4.1}/src/fastapi_multiauth/sources/multi.py

@@ -1,14 +1,14 @@
 """MultiAuth: combine multiple authentication sources into a single callable."""
 
 import inspect
-from typing import Any, cast
+from typing import Annotated, Any, cast
 
-from fastapi import Request
+from fastapi import Depends, Request
 from fastapi.security import SecurityScopes
 
 from fastapi_multiauth.exceptions import UnauthorizedError
 
-from ..abc import AuthSource
+from ..abc import AuthSource, _carry_scheme
 from ..utils import challenge_headers
 
 
@@ -39,10 +39,6 @@ class MultiAuth:
                 )
         self._sources = sources
 
-        # Build a merged signature that includes the security-scheme Depends()
-        # parameters from every source so FastAPI registers them in OpenAPI
-        # docs. Parameters are renamed `_s{i}_{name}` — unique per source
-        # index — so two sources of the same type both keep their scheme.
         merged: list[inspect.Parameter] = [
             inspect.Parameter(
                 "request",
@@ -55,11 +51,20 @@ class MultiAuth:
                 annotation=SecurityScopes,
             ),
         ]
+        carried = sources[0].scheme if sources else None
+        if carried is not None:
+            _carry_scheme(self, carried)
         for i, source in enumerate(sources):
-            for name, param in inspect.signature(source).parameters.items():
-                if name in ("request", "security_scopes"):
-                    continue
-                merged.append(param.replace(name=f"_s{i}_{name}"))
+            if source.scheme is None or (i == 0 and carried is not None):
+                continue
+            merged.append(
+                inspect.Parameter(
+                    f"_s{i}_credentials",
+                    inspect.Parameter.POSITIONAL_OR_KEYWORD,
+                    annotation=Annotated[Any, Depends(cast(Any, source.scheme))],
+                    default=None,
+                )
+            )
         self.__signature__ = inspect.Signature(merged, return_annotation=Any)
 
         # The combined challenge is fixed once the sources are known; build it