iaptoolkit 0.3.7a1__tar.gz → 0.3.7a2__tar.gz

{iaptoolkit-0.3.7a1 → iaptoolkit-0.3.7a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: iaptoolkit
-Version: 0.3.7a1
+Version: 0.3.7a2
 Summary: Library of common utils for interacting with Identity-Aware Proxies
 Author: Rob Voigt
 Author-email: code@ravoigt.com

{iaptoolkit-0.3.7a1 → iaptoolkit-0.3.7a2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "iaptoolkit"
-version = "0.3.7-a1"
+version = "0.3.7-a2"
 description = "Library of common utils for interacting with Identity-Aware Proxies"
 authors = [
     {name = "Rob Voigt", email = "code@ravoigt.com"}
@@ -35,6 +35,10 @@ requests = "^2.31.0"
 toml = "^0.10.2"
 kvcommon = {extras = ["k8s"], version = "^0.2.12"}
 
+# flask = { version = "^0.20.0", optional = true }
+# quart = { version = "^0.20.0", optional = true }
+# prometheus-client = { version = "^0.20.0", optional = true }
+
 [tool.poetry.group.dev.dependencies]
 black = "*"
 ipdb = "*"
@@ -45,3 +49,7 @@ pytest = "*"
 pytest-cov = "*"
 pytest-socket = "*"
 pyfakefs = "^5.3.2"
+
+flask = "*"
+quart = "*"
+prometheus_client = "*"

iaptoolkit-0.3.7a2/src/iaptoolkit/jwt/constants.py

@@ -0,0 +1,9 @@
+from enum import StrEnum
+
+class JWT_Event(StrEnum):
+    SUCCESS = "success"
+    FAIL_NO_HEADER = "fail_no_header"
+    FAIL_INVALID_JWT = "fail_invalid"
+    FAIL_NO_EMAIL = "fail_no_email"
+    FAIL_WRONG_USER = "fail_wrong_user"
+    FAIL_WRONG_AUDIENCE = "fail_wrong_audience"

iaptoolkit-0.3.7a2/src/iaptoolkit/jwt/flask.py

@@ -0,0 +1,142 @@
+import typing as t
+from functools import wraps
+
+from flask import request
+from flask.wrappers import Request
+from flask.wrappers import Response
+
+from iaptoolkit.constants import GOOGLE_IAP_JWT_HEADER_KEY
+from iaptoolkit.exceptions import JWTDisallowedUser
+from iaptoolkit.exceptions import JWTInvalidAudience
+from iaptoolkit.exceptions import JWTInvalidData
+from iaptoolkit.exceptions import JWTMalformed
+
+from .constants import JWT_Event
+from .metrics import Counter
+from .metrics import default_metric
+from .metrics import inc_metric
+from .verify import verify_iap_jwt
+
+
+def _verify_jwt(
+        request: Request,
+        jwt_header_key: str,
+        jwt_audience: str,
+        allowed_users: set[str] | None = None,
+        response_cls: t.Type[Response] = Response,
+        metric: Counter | None = default_metric
+    ) -> Response | None:
+    jwt_header: str = request.headers.get(jwt_header_key.lower(), "")
+    if not jwt_header:
+        inc_metric(metric, event=JWT_Event.FAIL_NO_HEADER)
+        return response_cls(f"No Google IAP JWT header in request at key: '{jwt_header_key}'", status=401)
+
+    try:
+        user_email = verify_iap_jwt(iap_jwt=jwt_header, expected_audience=jwt_audience)
+        if not user_email:
+            raise JWTInvalidData("No user_email in decoded JWT")
+
+        if allowed_users and user_email not in allowed_users:
+            raise JWTDisallowedUser(message=f"User '{user_email}' from JWT not allowed for route")
+
+    except (JWTInvalidData, JWTMalformed) as ex:
+        inc_metric(metric, event=JWT_Event.FAIL_INVALID_JWT)
+        return response_cls(f"Forbidden: '{ex.message}'", status=401)
+
+    except JWTInvalidAudience as ex:
+        inc_metric(metric, event=JWT_Event.FAIL_WRONG_AUDIENCE)
+        return response_cls(f"Forbidden: '{ex.message}'", status=403)
+
+    except JWTDisallowedUser as ex:
+        inc_metric(metric, event=JWT_Event.FAIL_WRONG_USER)
+        return response_cls(f"Forbidden: '{ex.message}'", status=403)
+
+    return None
+
+
+def requires_iap_jwt(
+        jwt_audience: str,
+        response_cls: t.Type[Response] = Response,
+        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY,
+        metric: Counter | None = default_metric
+    ):
+    """
+    A decorator that ensures the incoming request has a valid IAP JWT for a Flask route,
+    and that the user in the JWT has permission for the route.
+
+    Params:
+        jwt_audience: JWT Audience string (or IAP Client ID) to verify JWT against
+        response_cls: Flask response class or subclass thereof to return from decorator
+        jwt_header_key: request header key from which to retrieve the JWT (Default: 'x-goog-iap-jwt-assertion')
+        metric:
+            prometheus_client.Counter object (or None) to inc() for different outcomes.
+            Must have a single label: 'event'.
+            Set metric param to 'None' to disable metrics.
+
+    Returns:
+        Flask response of type determined by response_cls param on JWT Failure, else result of decorated view function
+    """
+    def decorator(f: t.Callable) -> t.Callable:
+
+        @wraps(f)
+        def decorated_function(*args, **kwargs) -> Response:
+            resp: Response | None = _verify_jwt(
+                request,
+                jwt_header_key=jwt_header_key,
+                jwt_audience=jwt_audience,
+                allowed_users=None,
+                response_cls=response_cls,
+                metric=metric
+            )
+            if resp is not None:
+                return resp
+            return f(*args, **kwargs)
+
+        return decorated_function
+
+    return decorator
+
+
+def requires_iap_jwt_valid_user(
+        jwt_audience: str,
+        allowed_users: set[str],
+        response_cls: t.Type[Response] = Response,
+        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY,
+        metric: Counter | None = default_metric
+    ):
+    """
+    A decorator that ensures the incoming request has a valid IAP JWT for a Flask route,
+    and that the user in the JWT has permission for the route
+
+    Params:
+        jwt_audience: JWT Audience string (or IAP Client ID) to verify JWT against
+        allowed_users: set of email strings to check against user_email in JWT for permission to access decorated view func
+        response_cls: Flask response class or subclass thereof to return from decorator
+        jwt_header_key: request header key from which to retrieve the JWT (Default: 'x-goog-iap-jwt-assertion')
+        metric:
+            prometheus_client.Counter object (or None) to inc() for different outcomes.
+            Must have a single label: 'event'.
+            Set metric param to 'None' to disable metrics.
+
+    Returns:
+        Flask response of type determined by response_cls param on JWT Failure, else result of decorated view function
+    """
+    def decorator(f: t.Callable) -> t.Callable:
+
+        @wraps(f)
+        def decorated_function(*args, **kwargs) -> Response:
+            resp: Response | None = _verify_jwt(
+                request,
+                jwt_header_key=jwt_header_key,
+                jwt_audience=jwt_audience,
+                allowed_users=allowed_users,
+                response_cls=response_cls,
+                metric=metric
+            )
+            if resp is not None:
+                return resp
+            return f(*args, **kwargs)
+
+        return decorated_function
+
+    return decorator

iaptoolkit-0.3.7a2/src/iaptoolkit/jwt/metrics.py

@@ -0,0 +1,34 @@
+import asyncio
+import typing as t
+
+try:
+    from prometheus_client import Counter
+    # TODO move to constants
+    default_metric = Counter(
+        "iaptoolkit_jwt_event_total",
+        "Count of JWT verification events",
+        labelnames=["event"]
+    )
+except ImportError:
+    Counter = t.TypeVar("Counter")
+    default_metric = None
+
+
+def inc_metric(metric: Counter | None, event: str):
+    if not metric:
+        return
+    metric.labels(event=event).inc()
+
+
+async def inc_metric_async(metric: Counter | None, event: str):
+    if not metric:
+        return
+    # TODO: Does prometheus_client have built-in async support?
+    await asyncio.to_thread(metric.labels(event=event).inc)
+
+__all__ = [
+    "default_metric",
+    "Counter",
+    "inc_metric",
+    "inc_metric_async"
+]

iaptoolkit-0.3.7a2/src/iaptoolkit/jwt/quart.py

@@ -0,0 +1,143 @@
+import typing as t
+from functools import wraps
+
+from quart import request
+from quart.wrappers import Request
+from quart.wrappers import Response
+
+from iaptoolkit.constants import GOOGLE_IAP_JWT_HEADER_KEY
+from iaptoolkit.exceptions import JWTDisallowedUser
+from iaptoolkit.exceptions import JWTInvalidAudience
+from iaptoolkit.exceptions import JWTInvalidData
+from iaptoolkit.exceptions import JWTMalformed
+from iaptoolkit.jwt.constants import JWT_Event
+from .constants import JWT_Event
+from .metrics import Counter
+from .metrics import default_metric
+from .metrics import inc_metric_async
+from .verify_async import verify_iap_jwt_async
+
+
+async def _verify_jwt_async(
+        request: Request,
+        jwt_header_key: str,
+        jwt_audience: str,
+        allowed_users: set[str] | None = None,
+        response_cls: t.Type[Response] = Response,
+        metric: Counter | None = default_metric
+    ) -> Response | None:
+
+    jwt_header: str = request.headers.get(jwt_header_key.lower(), "")
+    if not jwt_header:
+        await inc_metric_async(metric, event=JWT_Event.FAIL_NO_HEADER)
+        return response_cls(f"No Google IAP JWT header in request at key: '{jwt_header_key}'", status=401)
+
+    try:
+        user_email = await verify_iap_jwt_async(iap_jwt=jwt_header, expected_audience=jwt_audience)
+        if not user_email:
+            raise JWTInvalidData("No user_email in decoded JWT")
+
+        if allowed_users and user_email not in allowed_users:
+            raise JWTDisallowedUser(message=f"User '{user_email}' from JWT not allowed for route")
+
+    except (JWTInvalidData, JWTMalformed) as ex:
+        await inc_metric_async(metric, event=JWT_Event.FAIL_INVALID_JWT)
+        return response_cls(f"Forbidden: '{ex.message}'", status=401)
+
+    except JWTInvalidAudience as ex:
+        await inc_metric_async(metric, event=JWT_Event.FAIL_WRONG_AUDIENCE)
+        return response_cls(f"Forbidden: '{ex.message}'", status=403)
+
+    except JWTDisallowedUser as ex:
+        await inc_metric_async(metric, event=JWT_Event.FAIL_WRONG_USER)
+        return response_cls(f"Forbidden: '{ex.message}'", status=403)
+
+    return None
+
+
+def requires_iap_jwt(
+        jwt_audience: str,
+        response_cls: t.Type[Response] = Response,
+        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY,
+        metric: Counter | None = default_metric
+    ):
+    """
+    A decorator that ensures the incoming request has a valid IAP JWT for a Quart route,
+    and that the user in the JWT has permission for the route.
+
+    Params:
+        jwt_audience: JWT Audience string (or IAP Client ID) to verify JWT against
+        response_cls: Quart response class or subclass thereof to return from decorator
+        jwt_header_key: request header key from which to retrieve the JWT (Default: 'x-goog-iap-jwt-assertion')
+        metric:
+            prometheus_client.Counter object (or None) to inc() for different outcomes.
+            Must have a single label: 'event'.
+            Set metric param to 'None' to disable metrics.
+
+    Returns:
+        Quart response of type determined by response_cls param on JWT Failure, else result of decorated view function
+    """
+    def decorator(f: t.Callable) -> t.Callable:
+
+        @wraps(f)
+        async def decorated_function(*args, **kwargs) -> Response:
+            resp: Response | None = await _verify_jwt_async(
+                request,
+                jwt_header_key=jwt_header_key,
+                jwt_audience=jwt_audience,
+                allowed_users=None,
+                response_cls=response_cls,
+                metric=metric
+            )
+            if resp is not None:
+                return resp
+            return await f(*args, **kwargs)
+
+        return decorated_function
+
+    return decorator
+
+
+def requires_iap_jwt_valid_user_async(
+        jwt_audience: str,
+        allowed_users: set[str],
+        response_cls: t.Type[Response] = Response,
+        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY,
+        metric: Counter | None = default_metric
+    ):
+    """
+    A decorator that ensures the incoming request has a valid IAP JWT for a Quart route,
+    and that the user in the JWT has permission for the route.
+
+    Params:
+        jwt_audience: JWT Audience string (or IAP Client ID) to verify JWT against
+        allowed_users: set of email strings to check against user_email in JWT for permission to access decorated view func
+        response_cls: Quart response class or subclass thereof to return from decorator
+        jwt_header_key: request header key from which to retrieve the JWT (Default: 'x-goog-iap-jwt-assertion')
+        metric:
+            prometheus_client.Counter object (or None) to inc() for different outcomes.
+            Must have a single label: 'event'.
+            Set metric param to 'None' to disable metrics.
+
+    Returns:
+        Quart response of type determined by response_cls param on JWT Failure, else result of decorated view function
+    """
+    def decorator(f: t.Callable) -> t.Callable:
+
+        @wraps(f)
+        async def decorated_function(*args, **kwargs) -> Response:
+            resp: Response | None = await _verify_jwt_async(
+                request,
+                jwt_header_key=jwt_header_key,
+                jwt_audience=jwt_audience,
+                allowed_users=allowed_users,
+                response_cls=response_cls,
+                metric=metric
+            )
+            if resp is not None:
+                return resp
+            return await f(*args, **kwargs)
+
+        return decorated_function
+
+    return decorator

iaptoolkit-0.3.7a1/src/iaptoolkit/utils/flask.py

@@ -1,52 +0,0 @@
-import typing as t
-from functools import wraps
-
-from flask import request
-from flask.wrappers import Response
-
-from iaptoolkit.constants import GOOGLE_IAP_JWT_HEADER_KEY
-from iaptoolkit.exceptions import JWTDisallowedUser
-from iaptoolkit.exceptions import JWTInvalidAudience
-from iaptoolkit.exceptions import JWTInvalidData
-from iaptoolkit.exceptions import JWTMalformed
-from iaptoolkit.utils.verify import verify_iap_jwt
-
-
-def requires_iap_jwt(
-        jwt_audience: str,
-        allowed_users: set[str],
-        response_cls: Response = Response,
-        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY
-    ):
-    """
-    A decorator that ensures the incoming request has a valid IAP JWT for a Flask route,
-    and that the user in the JWT has permission for the route
-    """
-    def decorator(f):
-
-        @wraps(f)
-        def decorated_function(*args, **kwargs):
-
-            jwt_header: str = request.headers.get(jwt_header_key.lower(), None)
-            if not jwt_header:
-                return response_cls(f"No Google IAP JWT header in request at key: '{jwt_header_key}'", status=401)
-
-            try:
-                user_email = verify_iap_jwt(iap_jwt=jwt_header, expected_audience=jwt_audience)
-                if not user_email:
-                    raise JWTInvalidData("No user_email in decoded JWT")
-
-                if allowed_users and user_email not in allowed_users:
-                    raise JWTDisallowedUser(message=f"User '{user_email}' from JWT not allowed on route")
-
-            except (JWTInvalidData, JWTMalformed) as ex:
-                return response_cls(f"Forbidden: '{ex.message}'", status=401)
-
-            except (JWTInvalidAudience, JWTDisallowedUser) as ex:
-                return response_cls(f"Forbidden: '{ex.message}'", status=403)
-
-            return f(*args, **kwargs)
-
-        return decorated_function
-
-    return decorator

iaptoolkit-0.3.7a1/src/iaptoolkit/utils/quart.py

@@ -1,52 +0,0 @@
-import typing as t
-from functools import wraps
-
-from quart import request
-from quart.wrappers import Response
-
-from iaptoolkit.constants import GOOGLE_IAP_JWT_HEADER_KEY
-from iaptoolkit.exceptions import JWTDisallowedUser
-from iaptoolkit.exceptions import JWTInvalidAudience
-from iaptoolkit.exceptions import JWTInvalidData
-from iaptoolkit.exceptions import JWTMalformed
-from iaptoolkit.utils.verify_async import verify_iap_jwt_async
-
-
-def requires_iap_jwt_async(
-        jwt_audience: str,
-        allowed_users: set[str],
-        response_cls: Response = Response,
-        jwt_header_key: str = GOOGLE_IAP_JWT_HEADER_KEY
-    ):
-    """
-    A decorator that ensures the incoming request has a valid IAP JWT for a Quart route,
-    and that the user in the JWT has permission for the route
-    """
-    def decorator(f):
-
-        @wraps(f)
-        async def decorated_function(*args, **kwargs):
-
-            jwt_header: str = request.headers.get(jwt_header_key.lower(), None)
-            if not jwt_header:
-                return response_cls(f"No Google IAP JWT header in request at key: '{jwt_header_key}'", status=401)
-
-            try:
-                user_email = await verify_iap_jwt_async(iap_jwt=jwt_header, expected_audience=jwt_audience)
-                if not user_email:
-                    raise JWTInvalidData("No user_email in decoded JWT")
-
-                if allowed_users and user_email not in allowed_users:
-                    raise JWTDisallowedUser(message=f"User '{user_email}' from JWT not allowed on route")
-
-            except (JWTInvalidData, JWTMalformed) as ex:
-                return response_cls(f"Forbidden: '{ex.message}'", status=401)
-
-            except (JWTInvalidAudience, JWTDisallowedUser) as ex:
-                return response_cls(f"Forbidden: '{ex.message}'", status=403)
-
-            return await f(*args, **kwargs)
-
-        return decorated_function
-
-    return decorator