howler-api 3.2.0.dev532__tar.gz → 3.2.0.dev554__tar.gz

{howler_api-3.2.0.dev532 → howler_api-3.2.0.dev554}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.2.0.dev532
+Version: 3.2.0.dev554
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.2.0.dev532 → howler_api-3.2.0.dev554}/howler/api/v1/auth.py

@@ -144,6 +144,7 @@ def add_apikey(**kwargs):  # noqa: C901
     except HowlerException as e:
         return bad_request(err=e.message)
 
+    auth_service.invalidate_apikey_cache(user["uname"], key_name)
     storage.user.save(user["uname"], user_data)
 
     return ok({"apikey": f"{key_name}:{random_pass}"})
@@ -173,6 +174,7 @@ def delete_apikey(name, **kwargs):
         return not_found("Api key does not exist")
 
     user_data.apikeys.pop(name)
+    auth_service.invalidate_apikey_cache(user["uname"], name)
     storage.user.save(user["uname"], user_data)
 
     return no_content()

{howler_api-3.2.0.dev532 → howler_api-3.2.0.dev554}/howler/odm/models/config.py

@@ -284,6 +284,10 @@ class Auth(BaseModel):
 
     allow_apikeys: bool = Field(default=True, description="Allow API keys?")
     allow_extended_apikeys: bool = Field(default=True, description="Allow extended API keys?")
+    hmac_secret_key: str = Field(
+        default=os.environ.get("HMAC_SECRET_KEY", "changeme"),
+        description="HMAC secret used in auth hash operations. Change this in production!",
+    )
     max_apikey_duration_amount: Optional[int] = Field(
         default=None, description="Amount of unit of maximum duration for API keys"
     )

{howler_api-3.2.0.dev532 → howler_api-3.2.0.dev554}/howler/services/auth_service.py

@@ -1,5 +1,6 @@
 import base64
 import hashlib
+import hmac
 from datetime import datetime
 from typing import Optional, Union
 
@@ -18,6 +19,7 @@ from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.config import config, redis
 from howler.odm.models.user import User
+from howler.remote.datatypes import retry_call
 from howler.remote.datatypes.queues.named import NamedQueue
 from howler.remote.datatypes.set import ExpiringSet
 from howler.security.utils import generate_random_secret, verify_password
@@ -30,6 +32,93 @@ nonpersistent_config: dict[str, Union[str, int]] = {
     "ttl": config.auth.internal.failure_ttl,
 }
 
+# TTL for the apikey verification cache (seconds)
+_APIKEY_CACHE_TTL: int = 600  # 10 minutes
+
+# Derive the HMAC key from the configured secret
+_HMAC_KEY: bytes = hashlib.sha256(config.auth.hmac_secret_key.encode()).digest()
+
+
+def _apikey_cache_key(username: str, key_name: str) -> str:
+    """Build the Redis key that identifies a cached apikey verification.
+
+    Args:
+        username (str): The authenticating username.
+        key_name (str): The name portion of the apikey.
+
+    Returns:
+        str: The Redis cache key.
+    """
+    return f"apikey_cache:{username}:{key_name}"
+
+
+def _hash_secret(username: str, key_name: str, secret: str) -> str:
+    """Return an HMAC-SHA256 hex digest of an apikey secret.
+
+    Uses a derived HMAC key so that cached hashes are useless without
+    access to the application's configured secret.
+
+    Args:
+        username (str): The authenticating username.
+        key_name (str): The name portion of the apikey.
+        secret (str): The raw apikey secret.
+
+    Returns:
+        str: The HMAC hex digest.
+    """
+    return hmac.new(_HMAC_KEY, f"{username}:{key_name}:{secret}".encode(), hashlib.sha256).hexdigest()
+
+
+def _is_apikey_cached(username: str, key_name: str, secret: str) -> bool:
+    """Check whether a previous bcrypt verification for this apikey is cached.
+
+    The Redis key identifies the apikey (username + key name) and the stored
+    value is the HMAC-SHA256 digest of the apikey secret (as computed by
+    :func:`_hash_secret` from the username, key name, and secret).
+
+    Args:
+        username (str): The authenticating username.
+        key_name (str): The name portion of the apikey.
+        secret (str): The raw apikey secret to compare against the cache.
+
+    Returns:
+        bool: True if the cache holds a matching hash for this secret.
+    """
+    raw = retry_call(redis.get, _apikey_cache_key(username, key_name))
+    if raw is None:
+        return False
+    cached_hash = raw.decode() if isinstance(raw, bytes) else raw
+    return hmac.compare_digest(cached_hash, _hash_secret(username, key_name, secret))
+
+
+def _cache_apikey_verification(username: str, key_name: str, secret: str) -> None:
+    """Store a successful bcrypt verification in Redis.
+
+    Args:
+        username (str): The authenticating username.
+        key_name (str): The name portion of the apikey.
+        secret (str): The raw apikey secret whose hash will be stored.
+    """
+    retry_call(
+        redis.setex,
+        _apikey_cache_key(username, key_name),
+        _APIKEY_CACHE_TTL,
+        _hash_secret(username, key_name, secret),
+    )
+
+
+def invalidate_apikey_cache(username: str, key_name: str) -> None:
+    """Remove a cached apikey verification from Redis.
+
+    Call this whenever an API key is created, modified, or deleted so that
+    stale cache entries do not allow authentication with an old secret.
+
+    Args:
+        username (str): The authenticating username.
+        key_name (str): The name portion of the apikey.
+    """
+    retry_call(redis.delete, _apikey_cache_key(username, key_name))
+
 
 def _get_token_store(user: str) -> ExpiringSet:
     """Get an expiring redis set in which to add a token
@@ -169,7 +258,7 @@ def bearer_auth(
 
 
 @capture_span(span_type="authentication")
-def validate_apikey(
+def validate_apikey(  # noqa: C901
     username: str, apikey: str, impersonator: Optional[User] = None
 ) -> tuple[Optional[User], Optional[list[str]]]:
     """This function identifies the user via the internal API key functionality.
@@ -214,8 +303,15 @@ def validate_apikey(
                         + "Provide your credentials and supply it in the X-Impersonating header instead."
                     )
 
+                # Check the cache to avoid the expensive bcrypt verification.
+                # Key = username:key_name, Value = HMAC-SHA256(username:key_name:secret) via _hash_secret
+                if _is_apikey_cached(username, name, apikey_password):
+                    logger.debug("API key validated from cache for user %s", username)
+                    return user_data, key.acl
+
                 # If the key can be used for whichever purpose, actually validate the secret data
                 if verify_password(apikey_password, key.password):
+                    _cache_apikey_verification(username, name, apikey_password)
                     return user_data, key.acl
             except ValueError:
                 pass

{howler_api-3.2.0.dev532 → howler_api-3.2.0.dev554}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.2.0.dev532"
+version = "3.2.0.dev554"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",