fastapi-rbac-lite 0.1.0__py3-none-any.whl

fastapi_rbac_lite/__init__.py

@@ -0,0 +1,22 @@
+"""fastapi-rbac-lite
+
+Pluggable RBAC permission checking for FastAPI: bring your own token
+verifier and your own permission store, get a clean require_any_permission
+dependency for your routes.
+"""
+from .auth import RBAC
+from .interfaces import PermissionResolver, TokenVerifier
+from .resolvers import HTTPPermissionResolver, StaticPermissionResolver
+from .verifiers import JWKSVerifier, default_jwks_url_resolver
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "RBAC",
+    "TokenVerifier",
+    "PermissionResolver",
+    "JWKSVerifier",
+    "default_jwks_url_resolver",
+    "HTTPPermissionResolver",
+    "StaticPermissionResolver",
+]

fastapi_rbac_lite/auth.py

@@ -0,0 +1,57 @@
+from typing import Callable
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .interfaces import PermissionResolver, TokenVerifier
+
+
+class RBAC:
+    def __init__(
+        self,
+        verifier: TokenVerifier,
+        resolver: PermissionResolver,
+        groups_claim: str = "groups",
+        bypass: Callable[[dict], bool] | None = None,
+    ):
+        self.verifier = verifier
+        self.resolver = resolver
+        self.groups_claim = groups_claim
+        self.bypass = bypass or (lambda payload: False)
+        self._bearer = HTTPBearer()
+
+    async def get_current_user(
+        self, credentials: HTTPAuthorizationCredentials = Depends(HTTPBearer())
+    ) -> dict:
+        """Dependency: verify the bearer token only, no permission check."""
+        return await self.verifier.verify(credentials.credentials)
+
+    def require_any_permission(self, permissions: list[str] | None = None):
+        """Return a FastAPI dependency that grants access if the caller has
+        ANY of the given permissions. Pass no permissions (or an empty list)
+        to require only a valid token, with no permission check.
+        """
+        permissions = permissions or []
+
+        async def _check_permissions(
+            credentials: HTTPAuthorizationCredentials = Depends(self._bearer),
+        ) -> dict:
+            payload = await self.verifier.verify(credentials.credentials)
+            groups = payload.get(self.groups_claim, [])
+
+            if self.bypass(payload):
+                return payload
+
+            if not permissions:
+                return payload
+
+            user_permissions = await self.resolver.resolve(groups)
+            if not any(p in user_permissions for p in permissions):
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=f"Permission denied: one of {permissions} required",
+                )
+
+            return payload
+
+        return _check_permissions

fastapi_rbac_lite/interfaces.py

@@ -0,0 +1,10 @@
+from typing import Protocol
+
+class TokenVerifier(Protocol):
+    async def verify(self, token: str) -> dict:
+        ...
+
+
+class PermissionResolver(Protocol):
+    async def resolve(self, groups: list[str]) -> set[str]:
+        ...

fastapi_rbac_lite/resolvers.py

@@ -0,0 +1,46 @@
+import httpx
+from fastapi import HTTPException, status
+
+
+class StaticPermissionResolver:
+    def __init__(
+            self,
+            mapping:dict[str, set[str]]
+    ):
+        self.mapping = mapping
+
+    async def resolve(self, groups: list[str]) -> set[str]:
+        permissions = set()
+        for group in groups:
+            permissions.update(self.mapping.get(group, []))
+        return permissions
+
+
+class HTTPPermissionResolver:
+    def __init__(
+        self,
+        base_url: str,
+        endpoint: str = "/roles/permissions-bulk",
+        request_key: str = "role_names",
+        response_key: str = "permissions",
+        timeout: float = 5.0,
+    ):
+        self.base_url = base_url
+        self.endpoint = endpoint
+        self.request_key = request_key
+        self.response_key = response_key
+        self.timeout = timeout
+
+    async def resolve(self, groups: list[str]) -> set[str]:
+        if not groups:
+            return set()
+        url = f"{self.base_url.rstrip('/')}{self.endpoint}"
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json={self.request_key: groups})
+                response.raise_for_status()
+                data = response.json()
+                permissions = set(data.get(self.response_key, []))
+                return permissions
+        except httpx.HTTPError as e:
+            raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=f"HTTP error: {e}")

fastapi_rbac_lite/verifiers.py

@@ -0,0 +1,65 @@
+from typing import Callable
+import jwt
+from fastapi import HTTPException, status
+
+def default_jwks_url_resolver(issuer: str) -> str:
+    return f"{issuer.rstrip('/')}/.well-known/jwks.json"
+
+
+class JWKSVerifier:
+    def __init__(
+        self,
+        trusted_issuers: list[str],
+        audiences: list[str],
+        jwks_url_resolver: Callable[[str], str] = default_jwks_url_resolver,
+        algorithms: list[str] | None = None,
+    ):
+        self.trusted_issuers = trusted_issuers
+        self.audiences = audiences
+        self.jwks_url_resolver = jwks_url_resolver
+        self.algorithms = algorithms or ["RS256"]
+        self._jwks_clients: dict[str, jwt.PyJWKClient] = {}
+
+
+    def _get_jwks_client(self, issuer:str) -> jwt.PyJWKClient:
+        if issuer not in self._jwks_clients:
+            jwks_url = self.jwks_url_resolver(issuer)
+            self._jwks_clients[issuer] = jwt.PyJWKClient(jwks_url)
+        return self._jwks_clients[issuer]
+
+    async def verify(self, token: str) -> dict:
+        try:
+            unverified = jwt.decode(token, options={"verify_signature": False})
+        except jwt.InvalidTokenError as e:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=f"Malformed token: {e}")
+        iss = unverified.get("iss")
+        aud = unverified.get("aud")
+        if not iss or not aud:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
+        if iss not in self.trusted_issuers:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Untrusted token issuer")
+        try:
+            jwks_client = self._get_jwks_client(iss)
+            signing_key = jwks_client.get_signing_key_from_jwt(token)
+        except Exception as e:
+            raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=f"JWKS fetch failed: {e}")
+        try:
+            payload = jwt.decode(
+                token,
+                signing_key.key,
+                algorithms=self.algorithms,
+                audience=self.audiences,
+                issuer=iss,
+            )
+            return payload
+        except jwt.ExpiredSignatureError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token expired")
+        except jwt.InvalidAudienceError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid audience")
+        except jwt.InvalidIssuerError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid issuer")
+        except jwt.InvalidTokenError as e:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=f"Malformed token: {e}")
+
+
+    

fastapi_rbac_lite-0.1.0.dist-info/METADATA

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: fastapi-rbac-lite
+Version: 0.1.0
+Summary: Pluggable RBAC permission checking for FastAPI -- bring your own token verifier and permission store.
+Author-email: Athul A <athulbabu.a@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Repository, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Issues, https://github.com/athul2346/fastapi-rbac-lite/issues
+Keywords: fastapi,rbac,jwt,jwks,authorization,authentication,permissions
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Framework :: FastAPI
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: fastapi>=0.100
+Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: httpx>=0.24
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.21; extra == "dev"
+Requires-Dist: httpx>=0.24; extra == "dev"
+Requires-Dist: cryptography>=41.0; extra == "dev"
+Requires-Dist: uvicorn>=0.23; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=4.0; extra == "dev"

fastapi_rbac_lite-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+fastapi_rbac_lite/__init__.py,sha256=Y0uhn0NGkmmIhyEz0oGrb8A-jy0E1t5ri1iHMFL8wbg,625
+fastapi_rbac_lite/auth.py,sha256=qWUxsiIA3ngt4AJO0id1LHGjSX0M8O2VYWwFBhgCf-k,2035
+fastapi_rbac_lite/interfaces.py,sha256=v0F9nkWep7VpIfveKFSPVH3bTqb9BeAQ1D4bfPV2PVQ,229
+fastapi_rbac_lite/resolvers.py,sha256=tNbJ_Oy96soJHRRWyBbdSkPy4I53EMVTO87qSnqW53Y,1504
+fastapi_rbac_lite/verifiers.py,sha256=-eUkpDCXTjQ3BQaZOHVkrCae8663ZIPGCqmXtOQWxF8,2704
+fastapi_rbac_lite-0.1.0.dist-info/METADATA,sha256=lxIDrGHNlOLYczScrft4jnqNkLqvXoGQeYm1N1PLfc0,1416
+fastapi_rbac_lite-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+fastapi_rbac_lite-0.1.0.dist-info/top_level.txt,sha256=zMGwtG45TRXIJroIcqZhNYWt60tAvm1dDtTq_zzfn-c,18
+fastapi_rbac_lite-0.1.0.dist-info/RECORD,,

fastapi_rbac_lite-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

fastapi_rbac_lite-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+fastapi_rbac_lite