invenio-oauth2server 5.0.1__py3-none-any.whl

invenio_oauth2server/__init__.py

@@ -0,0 +1,119 @@
+# SPDX-FileCopyrightText: 2015-2024 CERN.
+# SPDX-FileCopyrightText: 2023-2026 Graz University of Technology.
+# SPDX-FileCopyrightText: 2025 KTH Royal Institute of Technology.
+# SPDX-License-Identifier: MIT
+
+"""Invenio module that implements OAuth 2 server.
+
+Protecting your REST API with authentication
+--------------------------------------------
+
+If you want to have your REST API endpoints protected using OAuth you
+should register their blueprint inside the API app
+(InvenioOAuth2ServerREST) which by default includes a ``before_request`` hook.
+This hook will, if there is an OAuth token, verify it and set the current user
+accordingly. It is important to highlight that this configuration allows
+either authenticated clients or anonymous clients.
+
+In case you need to allow access to a resource only for authenticated clients,
+you should use the `require_api_auth
+<api.html#invenio_oauth2server.decorators.require_api_auth>`__
+decorator which requires OAuth2 login:
+
+.. code-block:: python
+
+    @app.route('/api/resource', methods=['GET'])
+    @require_api_auth()
+    def index():
+        return 'Protected resource'
+
+However, protecting your resources only with authentication is not
+recommended. Instead, you should add an extra layer using always
+`scopes <api.html#invenio_oauth2server.models.Scope>`__. This is because,
+basically, any client that owns a token has control over every user resource.
+Therefore, using scopes gives a fine-grain control. Here an example using
+the default ``email_scope``:
+
+.. code-block:: python
+
+    from invenio_oauth2server.scopes import email_scope
+    from flask_login import current_user
+
+    @app.route('/api/email', methods=['GET'])
+    @require_api_auth()
+    @require_oauth_scopes(email_scope.id_)
+    def index():
+        return current_user.email
+
+Delegating rights via scopes
+----------------------------
+
+As mentioned before, the recommended way to protect your endpoints is to use
+fine-grain control with scopes. Invenio-OAuth2Server offers the possibility to
+create new ones:
+
+.. code-block:: python
+
+    from invenio_oauth2server.models import Scope
+
+    homepage_read = Scope('homepage:read',
+                          help_text='Access to the homepage',
+                          group='test')
+
+Next, you should add them to ``setup.py`` entrypoints so they get initialized
+at start up:
+
+.. code-block:: python
+
+    setup(
+        ...
+        entry_points={
+            'invenio_oauth2server.scopes': [
+                'homepage_read = path.to.scopes.file:homepage_read',
+            ]
+        }
+        ...
+    )
+
+And then, they can be used in your application:
+
+.. code-block:: python
+
+    from path.to.scopes.file import homepage_read
+
+    @app.route('/', methods=['GET'])
+    @require_api_auth()
+    @require_oauth_scopes(homepage_read.id_)
+    def index():
+        return 'Front page content.'
+
+So, finally, with this example, we would allow any authenticated client with
+rights to use the ``homepage_scope`` to read the homepage but, prevent from
+reading the email if they do not have rights for using the ``email_scope``.
+
+Access control
+--------------
+
+It is important to remember that the usage of authentication and scopes is not
+enough in most of the cases so access control need to be configured as well.
+For more information about access control in Invenio you can visit
+`Invenio-Access
+<http://invenio-access.readthedocs.io/en/latest/>`__ documentation.
+
+
+"""
+
+from .decorators import require_api_auth, require_oauth_scopes
+from .ext import InvenioOAuth2Server, InvenioOAuth2ServerREST
+from .proxies import current_oauth2server
+
+__version__ = "5.0.1"
+
+__all__ = (
+    "__version__",
+    "InvenioOAuth2Server",
+    "InvenioOAuth2ServerREST",
+    "require_api_auth",
+    "require_oauth_scopes",
+    "current_oauth2server",
+)

invenio_oauth2server/admin.py

@@ -0,0 +1,81 @@
+# SPDX-FileCopyrightText: 2016-2018 CERN.
+# SPDX-FileCopyrightText: 2024 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""Admin views for managing access to actions."""
+
+from flask_admin.contrib.sqla import ModelView
+from invenio_db import db
+
+from .models import Client, Token
+
+
+def _(x):
+    """Identity."""
+    return x
+
+
+class ClientView(ModelView):
+    """View for managing access to actions by users."""
+
+    can_delete = True
+    can_create = False
+    can_view_details = True
+    column_display_all_relations = True
+
+    list_all = (
+        "name",
+        "description",
+        "website",
+        "user_id",
+        "client_id",
+    )
+
+    column_list = column_searchable_list = column_sortable_list = (
+        column_details_list
+    ) = list_all
+
+    column_list = list_all
+    column_default_sort = ("client_id", True)
+
+
+class TokenView(ModelView):
+    """View for managing access to actions by users with given role."""
+
+    can_delete = True
+    can_create = False
+    can_view_details = True
+    list_all = (
+        "id",
+        "client_id",
+        "user_id",
+        "token_type",
+        "expires",
+    )
+    column_list = column_searchable_list = column_sortable_list = (
+        column_details_list
+    ) = list_all
+
+
+oauth2server_clients_adminview = {
+    "view_class": ClientView,
+    "args": [Client, db.session],
+    "kwargs": {
+        "name": _("OAuth Applications"),
+        "category": _("User Management"),
+    },
+}
+
+oauth2server_tokens_adminview = {
+    "view_class": TokenView,
+    "args": [Token, db.session],
+    "kwargs": {
+        "name": _("OAuth Application Tokens"),
+        "category": _("User Management"),
+    },
+}
+
+__all__ = (
+    "oauth2server_clients_adminview",
+    "oauth2server_tokens_adminview",
+)

invenio_oauth2server/alembic/12a88921ada2_create_oauth2server_tables.py

@@ -0,0 +1,96 @@
+# SPDX-FileCopyrightText: 2016-2018 CERN.
+# SPDX-FileCopyrightText: 2024 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""Create oauth2server tables."""
+
+import sqlalchemy as sa
+import sqlalchemy_utils
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "12a88921ada2"
+down_revision = "aa546f2a8d2f"
+branch_labels = ()
+depends_on = "9848d0149abd"
+
+
+def upgrade():
+    """Upgrade database."""
+    op.create_table(
+        "oauth2server_client",
+        sa.Column("name", sa.String(length=40), nullable=True),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("website", sqlalchemy_utils.types.url.URLType(), nullable=True),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("client_id", sa.String(length=255), nullable=False),
+        sa.Column("client_secret", sa.String(length=255), nullable=False),
+        sa.Column("is_confidential", sa.Boolean(name="is_confidential"), nullable=True),
+        sa.Column("is_internal", sa.Boolean(name="is_internal"), nullable=True),
+        sa.Column("_redirect_uris", sa.Text(), nullable=True),
+        sa.Column("_default_scopes", sa.Text(), nullable=True),
+        sa.ForeignKeyConstraint(
+            ["user_id"],
+            ["accounts_user.id"],
+        ),
+        sa.PrimaryKeyConstraint("client_id"),
+    )
+    op.create_index(
+        op.f("ix_oauth2server_client_client_secret"),
+        "oauth2server_client",
+        ["client_secret"],
+        unique=True,
+    )
+    op.create_table(
+        "oauth2server_token",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("client_id", sa.String(length=255), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("token_type", sa.String(length=255), nullable=True),
+        sa.Column(
+            "access_token", sqlalchemy_utils.StringEncryptedType(), nullable=True
+        ),
+        sa.Column(
+            "refresh_token", sqlalchemy_utils.StringEncryptedType(), nullable=True
+        ),
+        sa.Column("expires", sa.DateTime(), nullable=True),
+        sa.Column("_scopes", sa.Text(), nullable=True),
+        sa.Column("is_personal", sa.Boolean(name="is_personal"), nullable=True),
+        sa.Column("is_internal", sa.Boolean(name="is_internal"), nullable=True),
+        sa.ForeignKeyConstraint(
+            ["client_id"],
+            ["oauth2server_client.client_id"],
+        ),
+        sa.ForeignKeyConstraint(
+            ["user_id"],
+            ["accounts_user.id"],
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        "ix_oauth2server_token_access_token",
+        "oauth2server_token",
+        ["access_token"],
+        unique=True,
+        mysql_length=255,
+    )
+    op.create_index(
+        "ix_oauth2server_token_refresh_token",
+        "oauth2server_token",
+        ["refresh_token"],
+        unique=True,
+        mysql_length=255,
+    )
+
+
+def downgrade():
+    """Downgrade database."""
+    op.drop_index(
+        "ix_oauth2server_token_refresh_token", table_name="oauth2server_token"
+    )
+    op.drop_index("ix_oauth2server_token_access_token", table_name="oauth2server_token")
+    op.drop_table("oauth2server_token")
+    op.drop_index(
+        op.f("ix_oauth2server_client_client_secret"), table_name="oauth2server_client"
+    )
+    op.drop_table("oauth2server_client")

invenio_oauth2server/alembic/3d7f57a61d67_change_expires_at_type.py

@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: 2017-2018 CERN.
+# SPDX-FileCopyrightText: 2026 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""Change expires_at type to utc aware datetime."""
+
+from alembic import op
+from invenio_db import db
+
+# revision identifiers, used by Alembic.
+revision = "3d7f57a61d67"
+down_revision = "4e57407b8e4a"
+branch_labels = ()
+depends_on = None
+
+
+def upgrade():
+    """Upgrade database."""
+    op.alter_column(
+        "oauth2server_token",
+        "expires",
+        type_=db.UTCDateTime(),
+        existing_type=db.DateTime(),
+        existing_nullable=True,
+    )
+
+
+def downgrade():
+    """Downgrade database."""
+    op.alter_column(
+        "oauth2server_token",
+        "expires",
+        type_=db.DateTime(),
+        existing_type=db.UTCDateTime(),
+        existing_nullable=True,
+    )

invenio_oauth2server/alembic/4e57407b8e4a_add_on_delete_cascade.py

@@ -0,0 +1,122 @@
+# SPDX-FileCopyrightText: 2017-2018 CERN.
+# SPDX-License-Identifier: MIT
+
+"""Add on delete cascade."""
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "4e57407b8e4a"
+down_revision = "12a88921ada2"
+branch_labels = ()
+depends_on = None
+
+
+def upgrade():
+    """Upgrade database."""
+    op.drop_constraint(
+        "fk_oauth2server_client_user_id_accounts_user",
+        "oauth2server_client",
+        type_="foreignkey",
+    )
+    op.create_foreign_key(
+        op.f("fk_oauth2server_client_user_id_accounts_user"),
+        "oauth2server_client",
+        "accounts_user",
+        ["user_id"],
+        ["id"],
+        ondelete="CASCADE",
+    )
+    op.create_index(
+        op.f("ix_oauth2server_client_user_id"),
+        "oauth2server_client",
+        ["user_id"],
+        unique=False,
+    )
+    op.drop_constraint(
+        "fk_oauth2server_token_user_id_accounts_user",
+        "oauth2server_token",
+        type_="foreignkey",
+    )
+    op.create_foreign_key(
+        op.f("fk_oauth2server_token_user_id_accounts_user"),
+        "oauth2server_token",
+        "accounts_user",
+        ["user_id"],
+        ["id"],
+        ondelete="CASCADE",
+    )
+    op.create_index(
+        op.f("ix_oauth2server_token_user_id"),
+        "oauth2server_token",
+        ["user_id"],
+        unique=False,
+    )
+    op.drop_constraint(
+        "fk_oauth2server_token_client_id_oauth2server_client",
+        "oauth2server_token",
+        type_="foreignkey",
+    )
+    op.create_foreign_key(
+        op.f("fk_oauth2server_token_client_id_oauth2server_client"),
+        "oauth2server_token",
+        "oauth2server_client",
+        ["client_id"],
+        ["client_id"],
+        ondelete="CASCADE",
+    )
+    op.create_index(
+        op.f("ix_oauth2server_token_client_id"),
+        "oauth2server_token",
+        ["client_id"],
+        unique=False,
+    )
+
+
+def downgrade():
+    """Downgrade database."""
+    op.drop_constraint(
+        op.f("fk_oauth2server_token_user_id_accounts_user"),
+        "oauth2server_token",
+        type_="foreignkey",
+    )
+    op.drop_index(
+        op.f("ix_oauth2server_token_user_id"), table_name="oauth2server_token"
+    )
+    op.create_foreign_key(
+        "fk_oauth2server_token_user_id_accounts_user",
+        "oauth2server_token",
+        "accounts_user",
+        ["user_id"],
+        ["id"],
+    )
+    op.drop_constraint(
+        op.f("fk_oauth2server_token_client_id_oauth2server_client"),
+        "oauth2server_token",
+        type_="foreignkey",
+    )
+    op.drop_index(
+        op.f("ix_oauth2server_token_client_id"), table_name="oauth2server_token"
+    )
+    op.create_foreign_key(
+        "fk_oauth2server_token_client_id_oauth2server_client",
+        "oauth2server_token",
+        "oauth2server_client",
+        ["client_id"],
+        ["client_id"],
+    )
+    op.drop_constraint(
+        op.f("fk_oauth2server_client_user_id_accounts_user"),
+        "oauth2server_client",
+        type_="foreignkey",
+    )
+    op.drop_index(
+        op.f("ix_oauth2server_client_user_id"), table_name="oauth2server_client"
+    )
+    op.create_foreign_key(
+        "fk_oauth2server_client_user_id_accounts_user",
+        "oauth2server_client",
+        "accounts_user",
+        ["user_id"],
+        ["id"],
+    )

invenio_oauth2server/alembic/aa546f2a8d2f_create_oauth2server_branch.py

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2016-2018 CERN.
+# SPDX-FileCopyrightText: 2023 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""Create oauth2server branch."""
+
+# revision identifiers, used by Alembic.
+revision = "aa546f2a8d2f"
+down_revision = None
+branch_labels = ("invenio_oauth2server",)
+depends_on = "dbdbc1b19cf2"
+
+
+def upgrade():
+    """Upgrade database."""
+    pass
+
+
+def downgrade():
+    """Downgrade database."""
+    pass

invenio_oauth2server/cli.py

@@ -0,0 +1,96 @@
+# SPDX-FileCopyrightText: 2018 CERN.
+# SPDX-FileCopyrightText: 2024 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""CLI commands for managing the OAuth server."""
+
+from functools import wraps
+
+import click
+from flask.cli import with_appcontext
+from invenio_accounts.models import User
+from invenio_db import db
+from werkzeug.local import LocalProxy
+
+from .models import Client, Token
+from .validators import validate_scopes
+
+
+def lazy_result(f):
+    """Decorate function to return LazyProxy."""
+
+    @wraps(f)
+    def decorated(ctx, param, value):
+        return LocalProxy(lambda: f(ctx, param, value))
+
+    return decorated
+
+
+@lazy_result
+def process_user(ctx, param, value):
+    """Return a user if exists."""
+    if value:
+        if value.isdigit():
+            user = db.session.get(User, str(value))
+        else:
+            user = User.query.filter(User.email == value).one_or_none()
+        return user
+
+
+@lazy_result
+def process_scopes(ctx, param, values):
+    """Return a user if exists."""
+    validate_scopes(values)
+    return values
+
+
+@click.group()
+def tokens():
+    """OAuth2 server token commands."""
+
+
+@tokens.command("create")
+@click.option("-n", "--name", required=True)
+@click.option(
+    "-u", "--user", required=True, callback=process_user, help="User ID or email."
+)
+@click.option("-s", "--scope", "scopes", multiple=True, callback=process_scopes)
+@click.option("-i", "--internal", is_flag=True)
+@with_appcontext
+def tokens_create(name, user, scopes, internal):
+    """Create a personal OAuth token."""
+    token = Token.create_personal(name, user.id, scopes=scopes, is_internal=internal)
+    db.session.commit()
+    click.secho(token.access_token, fg="blue")
+
+
+@tokens.command("delete")
+@click.option("-n", "--name")
+@click.option("-u", "--user", callback=process_user, help="User ID or email.")
+@click.option("--token", "read_access_token", is_flag=True)
+@click.option("--force", is_flag=True)
+@with_appcontext
+def tokens_delete(name=None, user=None, read_access_token=None, force=False):
+    """Delete a personal OAuth token."""
+    if not (name or user) and not read_access_token:
+        click.get_current_context().fail(
+            'You have to pass either a "name" and "user" or the "token"'
+        )
+    if name and user:
+        client = Client.query.filter(
+            Client.user_id == user.id, Client.name == name, Client.is_internal.is_(True)
+        ).one()
+        token = Token.query.filter(
+            Token.user_id == user.id,
+            Token.is_personal.is_(True),
+            Token.client_id == client.client_id,
+        ).one()
+    elif read_access_token:
+        access_token = click.prompt("Token", hide_input=True)
+        token = Token.query.filter(Token.access_token == access_token).one()
+    else:
+        click.get_current_context().fail("No token was found with provided")
+    if force or click.confirm("Are you sure you want to delete the token?"):
+        db.session.delete(token)
+        db.session.commit()
+        click.secho('Token "{}" deleted.'.format(token.access_token), fg="yellow")

invenio_oauth2server/config.py

@@ -0,0 +1,78 @@
+# SPDX-FileCopyrightText: 2015-2018 CERN.
+# SPDX-FileCopyrightText: 2023 Graz University of Technology.
+# SPDX-License-Identifier: MIT
+
+"""OAuth2Server configuration variables."""
+
+OAUTH2_CACHE_TYPE = "redis"
+"""Type of cache to use for storing the temporary grant token."""
+
+OAUTH2_PROVIDER_ERROR_ENDPOINT = "invenio_oauth2server.errors"
+"""Error view endpoint."""
+
+OAUTH2SERVER_CLIENT_ID_SALT_LEN = 40
+"""Length of client id."""
+
+OAUTH2SERVER_CLIENT_SECRET_SALT_LEN = 60
+"""Length of the client secret."""
+
+OAUTH2SERVER_TOKEN_PERSONAL_SALT_LEN = 60
+"""Length of the personal access token."""
+
+OAUTH2SERVER_ALLOWED_GRANT_TYPES = {
+    "authorization_code",
+    "client_credentials",
+    "refresh_token",
+}
+"""A set of allowed grant types.
+
+The allowed values are ``authorization_code``, ``password``,
+``client_credentials``, ``refresh_token``). By default password is disabled,
+as it requires the client application to gain access to the username and
+password of the resource owner.
+"""
+
+OAUTH2SERVER_ALLOWED_RESPONSE_TYPES = {
+    "code",
+    "token",
+}
+"""A set of allowed response types.
+
+The allowed values are ``code`` and ``token``.
+
+- ``code`` is used for authorization_code grant types
+- ``token`` is used for implicit grant types
+"""
+
+OAUTH2SERVER_ALLOWED_URLENCODE_CHARACTERS = "=&;:%+~,*@!()/?"
+"""A string of special characters that should be valid inside a query string.
+
+.. seealso::
+
+    See :py:func:`monkeypatch_oauthlib_urlencode_chars
+    <invenio_oauth2server.ext.InvenioOAuth2ServerREST.monkeypatch_oauthlib_urlencode_chars>`
+    for a full explanation.
+"""
+
+OAUTH2SERVER_JWT_AUTH_HEADER = "Authorization"
+"""Header for the JWT.
+
+.. note::
+
+    Authorization: Bearer xxx
+"""
+
+OAUTH2SERVER_JWT_AUTH_HEADER_TYPE = "Bearer"
+"""Header Authorization type.
+
+.. note::
+
+    By default the authorization type is ``Bearer`` as recommented by
+    `JWT  <https://jwt.io>`_
+"""
+
+OAUTH2SERVER_JWT_VERIFICATION_FACTORY = "invenio_oauth2server.utils:" "jwt_verify_token"
+"""Import path of factory used to verify JWT.
+
+The ``request.headers`` should be passed as parameter.
+"""