fastapi-rbac-lite 0.1.0__tar.gz

fastapi_rbac_lite-0.1.0/PKG-INFO

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: fastapi-rbac-lite
+Version: 0.1.0
+Summary: Pluggable RBAC permission checking for FastAPI -- bring your own token verifier and permission store.
+Author-email: Athul A <athulbabu.a@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Repository, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Issues, https://github.com/athul2346/fastapi-rbac-lite/issues
+Keywords: fastapi,rbac,jwt,jwks,authorization,authentication,permissions
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Framework :: FastAPI
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: fastapi>=0.100
+Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: httpx>=0.24
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.21; extra == "dev"
+Requires-Dist: httpx>=0.24; extra == "dev"
+Requires-Dist: cryptography>=41.0; extra == "dev"
+Requires-Dist: uvicorn>=0.23; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=4.0; extra == "dev"

fastapi_rbac_lite-0.1.0/pyproject.toml

@@ -0,0 +1,54 @@
+[build-system]
+requires = ["setuptools>=68.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "fastapi-rbac-lite"
+version = "0.1.0"
+description = "Pluggable RBAC permission checking for FastAPI -- bring your own token verifier and permission store."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [
+    { name = "Athul A", email = "athulbabu.a@gmail.com" }
+]
+keywords = ["fastapi", "rbac", "jwt", "jwks", "authorization", "authentication", "permissions"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Framework :: FastAPI",
+    "Topic :: Security",
+]
+dependencies = [
+    "fastapi>=0.100",
+    "pyjwt[crypto]>=2.8",
+    "httpx>=0.24",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4",
+    "pytest-asyncio>=0.21",
+    "httpx>=0.24",
+    "cryptography>=41.0",
+    "uvicorn>=0.23",
+    "build>=1.0",
+    "twine>=4.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/athul2346/fastapi-rbac-lite"
+Repository = "https://github.com/athul2346/fastapi-rbac-lite"
+Issues = "https://github.com/athul2346/fastapi-rbac-lite/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]

fastapi_rbac_lite-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite/__init__.py

@@ -0,0 +1,22 @@
+"""fastapi-rbac-lite
+
+Pluggable RBAC permission checking for FastAPI: bring your own token
+verifier and your own permission store, get a clean require_any_permission
+dependency for your routes.
+"""
+from .auth import RBAC
+from .interfaces import PermissionResolver, TokenVerifier
+from .resolvers import HTTPPermissionResolver, StaticPermissionResolver
+from .verifiers import JWKSVerifier, default_jwks_url_resolver
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "RBAC",
+    "TokenVerifier",
+    "PermissionResolver",
+    "JWKSVerifier",
+    "default_jwks_url_resolver",
+    "HTTPPermissionResolver",
+    "StaticPermissionResolver",
+]

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite/auth.py

@@ -0,0 +1,57 @@
+from typing import Callable
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from .interfaces import PermissionResolver, TokenVerifier
+
+
+class RBAC:
+    def __init__(
+        self,
+        verifier: TokenVerifier,
+        resolver: PermissionResolver,
+        groups_claim: str = "groups",
+        bypass: Callable[[dict], bool] | None = None,
+    ):
+        self.verifier = verifier
+        self.resolver = resolver
+        self.groups_claim = groups_claim
+        self.bypass = bypass or (lambda payload: False)
+        self._bearer = HTTPBearer()
+
+    async def get_current_user(
+        self, credentials: HTTPAuthorizationCredentials = Depends(HTTPBearer())
+    ) -> dict:
+        """Dependency: verify the bearer token only, no permission check."""
+        return await self.verifier.verify(credentials.credentials)
+
+    def require_any_permission(self, permissions: list[str] | None = None):
+        """Return a FastAPI dependency that grants access if the caller has
+        ANY of the given permissions. Pass no permissions (or an empty list)
+        to require only a valid token, with no permission check.
+        """
+        permissions = permissions or []
+
+        async def _check_permissions(
+            credentials: HTTPAuthorizationCredentials = Depends(self._bearer),
+        ) -> dict:
+            payload = await self.verifier.verify(credentials.credentials)
+            groups = payload.get(self.groups_claim, [])
+
+            if self.bypass(payload):
+                return payload
+
+            if not permissions:
+                return payload
+
+            user_permissions = await self.resolver.resolve(groups)
+            if not any(p in user_permissions for p in permissions):
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=f"Permission denied: one of {permissions} required",
+                )
+
+            return payload
+
+        return _check_permissions

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite/interfaces.py

@@ -0,0 +1,10 @@
+from typing import Protocol
+
+class TokenVerifier(Protocol):
+    async def verify(self, token: str) -> dict:
+        ...
+
+
+class PermissionResolver(Protocol):
+    async def resolve(self, groups: list[str]) -> set[str]:
+        ...

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite/resolvers.py

@@ -0,0 +1,46 @@
+import httpx
+from fastapi import HTTPException, status
+
+
+class StaticPermissionResolver:
+    def __init__(
+            self,
+            mapping:dict[str, set[str]]
+    ):
+        self.mapping = mapping
+
+    async def resolve(self, groups: list[str]) -> set[str]:
+        permissions = set()
+        for group in groups:
+            permissions.update(self.mapping.get(group, []))
+        return permissions
+
+
+class HTTPPermissionResolver:
+    def __init__(
+        self,
+        base_url: str,
+        endpoint: str = "/roles/permissions-bulk",
+        request_key: str = "role_names",
+        response_key: str = "permissions",
+        timeout: float = 5.0,
+    ):
+        self.base_url = base_url
+        self.endpoint = endpoint
+        self.request_key = request_key
+        self.response_key = response_key
+        self.timeout = timeout
+
+    async def resolve(self, groups: list[str]) -> set[str]:
+        if not groups:
+            return set()
+        url = f"{self.base_url.rstrip('/')}{self.endpoint}"
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json={self.request_key: groups})
+                response.raise_for_status()
+                data = response.json()
+                permissions = set(data.get(self.response_key, []))
+                return permissions
+        except httpx.HTTPError as e:
+            raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=f"HTTP error: {e}")

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite/verifiers.py

@@ -0,0 +1,65 @@
+from typing import Callable
+import jwt
+from fastapi import HTTPException, status
+
+def default_jwks_url_resolver(issuer: str) -> str:
+    return f"{issuer.rstrip('/')}/.well-known/jwks.json"
+
+
+class JWKSVerifier:
+    def __init__(
+        self,
+        trusted_issuers: list[str],
+        audiences: list[str],
+        jwks_url_resolver: Callable[[str], str] = default_jwks_url_resolver,
+        algorithms: list[str] | None = None,
+    ):
+        self.trusted_issuers = trusted_issuers
+        self.audiences = audiences
+        self.jwks_url_resolver = jwks_url_resolver
+        self.algorithms = algorithms or ["RS256"]
+        self._jwks_clients: dict[str, jwt.PyJWKClient] = {}
+
+
+    def _get_jwks_client(self, issuer:str) -> jwt.PyJWKClient:
+        if issuer not in self._jwks_clients:
+            jwks_url = self.jwks_url_resolver(issuer)
+            self._jwks_clients[issuer] = jwt.PyJWKClient(jwks_url)
+        return self._jwks_clients[issuer]
+
+    async def verify(self, token: str) -> dict:
+        try:
+            unverified = jwt.decode(token, options={"verify_signature": False})
+        except jwt.InvalidTokenError as e:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=f"Malformed token: {e}")
+        iss = unverified.get("iss")
+        aud = unverified.get("aud")
+        if not iss or not aud:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token")
+        if iss not in self.trusted_issuers:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Untrusted token issuer")
+        try:
+            jwks_client = self._get_jwks_client(iss)
+            signing_key = jwks_client.get_signing_key_from_jwt(token)
+        except Exception as e:
+            raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail=f"JWKS fetch failed: {e}")
+        try:
+            payload = jwt.decode(
+                token,
+                signing_key.key,
+                algorithms=self.algorithms,
+                audience=self.audiences,
+                issuer=iss,
+            )
+            return payload
+        except jwt.ExpiredSignatureError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Token expired")
+        except jwt.InvalidAudienceError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid audience")
+        except jwt.InvalidIssuerError:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid issuer")
+        except jwt.InvalidTokenError as e:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=f"Malformed token: {e}")
+
+
+    

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite.egg-info/PKG-INFO

@@ -0,0 +1,32 @@
+Metadata-Version: 2.4
+Name: fastapi-rbac-lite
+Version: 0.1.0
+Summary: Pluggable RBAC permission checking for FastAPI -- bring your own token verifier and permission store.
+Author-email: Athul A <athulbabu.a@gmail.com>
+License: MIT
+Project-URL: Homepage, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Repository, https://github.com/athul2346/fastapi-rbac-lite
+Project-URL: Issues, https://github.com/athul2346/fastapi-rbac-lite/issues
+Keywords: fastapi,rbac,jwt,jwks,authorization,authentication,permissions
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Framework :: FastAPI
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: fastapi>=0.100
+Requires-Dist: pyjwt[crypto]>=2.8
+Requires-Dist: httpx>=0.24
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.21; extra == "dev"
+Requires-Dist: httpx>=0.24; extra == "dev"
+Requires-Dist: cryptography>=41.0; extra == "dev"
+Requires-Dist: uvicorn>=0.23; extra == "dev"
+Requires-Dist: build>=1.0; extra == "dev"
+Requires-Dist: twine>=4.0; extra == "dev"

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+README.md
+pyproject.toml
+src/fastapi_rbac_lite/__init__.py
+src/fastapi_rbac_lite/auth.py
+src/fastapi_rbac_lite/interfaces.py
+src/fastapi_rbac_lite/resolvers.py
+src/fastapi_rbac_lite/verifiers.py
+src/fastapi_rbac_lite.egg-info/PKG-INFO
+src/fastapi_rbac_lite.egg-info/SOURCES.txt
+src/fastapi_rbac_lite.egg-info/dependency_links.txt
+src/fastapi_rbac_lite.egg-info/requires.txt
+src/fastapi_rbac_lite.egg-info/top_level.txt
+tests/test_rbac.py
+tests/test_verifiers.py

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite.egg-info/requires.txt

@@ -0,0 +1,12 @@
+fastapi>=0.100
+pyjwt[crypto]>=2.8
+httpx>=0.24
+
+[dev]
+pytest>=7.4
+pytest-asyncio>=0.21
+httpx>=0.24
+cryptography>=41.0
+uvicorn>=0.23
+build>=1.0
+twine>=4.0

fastapi_rbac_lite-0.1.0/src/fastapi_rbac_lite.egg-info/top_level.txt

@@ -0,0 +1 @@
+fastapi_rbac_lite

fastapi_rbac_lite-0.1.0/tests/test_rbac.py

@@ -0,0 +1,73 @@
+import pytest
+from fastapi import HTTPException
+from src.fastapi_rbac_lite.auth import RBAC
+from src.fastapi_rbac_lite.resolvers import StaticPermissionResolver
+
+
+class FakeVerifier:
+    def __init__(self, tokens: dict[str, dict]):
+        self.tokens = tokens
+
+    async def verify(self, token: str) -> dict:
+        if token not in self.tokens:
+            raise HTTPException(401, detail="invalid token")
+        return self.tokens[token]
+
+
+class FakeCredentials:
+    def __init__(self, token: str):
+        self.credentials = token
+
+
+@pytest.fixture
+def rbac():
+    verifier = FakeVerifier({
+        "admin-token": {"sub": "u1", "groups": ["admins"]},
+        "viewer-token": {"sub": "u2", "groups": ["viewers"]},
+        "m2m-token": {"sub": "svc", "groups": [], "preferred_username": "internal-svc"},
+    })
+    resolver = StaticPermissionResolver({
+        "admins": {"invoice:read", "invoice:approve"},
+        "viewers": {"invoice:read"},
+    })
+    return RBAC(
+        verifier=verifier,
+        resolver=resolver,
+        bypass=lambda payload: payload.get("preferred_username") == "internal-svc",
+    )
+
+
+@pytest.mark.asyncio
+async def test_admin_has_permission(rbac):
+    dep = rbac.require_any_permission(["invoice:approve"])
+    payload = await dep(FakeCredentials("admin-token"))
+    assert payload["sub"] == "u1"
+
+
+@pytest.mark.asyncio
+async def test_viewer_denied_for_approve(rbac):
+    dep = rbac.require_any_permission(["invoice:approve"])
+    with pytest.raises(HTTPException) as exc_info:
+        await dep(FakeCredentials("viewer-token"))
+    assert exc_info.value.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_viewer_allowed_for_read(rbac):
+    dep = rbac.require_any_permission(["invoice:read"])
+    payload = await dep(FakeCredentials("viewer-token"))
+    assert payload["sub"] == "u2"
+
+
+@pytest.mark.asyncio
+async def test_m2m_bypass_skips_permission_check(rbac):
+    dep = rbac.require_any_permission(["invoice:approve"])
+    payload = await dep(FakeCredentials("m2m-token"))
+    assert payload["sub"] == "svc"
+
+
+@pytest.mark.asyncio
+async def test_no_permissions_required(rbac):
+    dep = rbac.require_any_permission([])
+    payload = await dep(FakeCredentials("viewer-token"))
+    assert payload["sub"] == "u2"

fastapi_rbac_lite-0.1.0/tests/test_verifiers.py

@@ -0,0 +1,32 @@
+import pytest
+from fastapi import HTTPException
+from src.fastapi_rbac_lite.verifiers import JWKSVerifier
+from fixtures.sign_test_token import sign_test_token
+
+@pytest.mark.asyncio
+async def test_valid_token_verifies(fake_idp_url):
+    verifier = JWKSVerifier(trusted_issuers=[fake_idp_url], audiences=["test-audience"])
+    payload = {
+        "sub": "test-user",
+        "groups": ["test-user"],
+        "iss": fake_idp_url,
+        "aud": "test-audience"    
+    }
+    token = sign_test_token(payload)
+    result = await verifier.verify(token)
+    assert result == payload
+
+
+@pytest.mark.asyncio
+async def test_wrong_audience_rejected(fake_idp_url):
+    verifier = JWKSVerifier(trusted_issuers=[fake_idp_url], audiences=["test-audience"])
+    payload = {
+        "sub": "test-user",
+        "groups": ["admins"],
+        "iss": fake_idp_url,
+        "aud": "fake-aud"
+    }
+    token = sign_test_token(payload)
+    with pytest.raises(HTTPException) as exc_info:
+        await verifier.verify(token)
+    assert exc_info.value.status_code == 401