karrio-server-core 2025.5rc1__py3-none-any.whl

karrio/server/core/models/metafield.py

@@ -0,0 +1,144 @@
+import json
+import re
+import functools
+from datetime import datetime, date
+import django.conf as conf
+import django.db.models as models
+import django.utils.translation as translation
+from django.core.exceptions import ValidationError
+
+import karrio.server.core.models.base as core
+import karrio.server.core.models.entity as entity
+
+_ = translation.gettext_lazy
+
+
+@core.register_model
+class Metafield(entity.OwnedEntity):
+    class Meta:
+        db_table = "metafield"
+        verbose_name = "Metafield"
+        verbose_name_plural = "Metafields"
+
+    id = models.CharField(
+        max_length=50,
+        editable=False,
+        primary_key=True,
+        default=functools.partial(core.uuid, prefix="metaf_"),
+    )
+    key = models.CharField(_("name"), max_length=50, db_index=True)
+    value = models.JSONField(null=True, blank=True)
+    type = models.CharField(
+        _("type"),
+        max_length=50,
+        choices=core.METAFIELD_TYPE,
+        default=core.METAFIELD_TYPE[0][0],
+        db_index=True,
+    )
+    is_required = models.BooleanField(null=False, default=False)
+
+    # Related fields
+    created_by = models.ForeignKey(
+        conf.settings.AUTH_USER_MODEL,
+        blank=True,
+        null=True,
+        on_delete=models.CASCADE,
+        editable=False,
+    )
+
+    @property
+    def object_type(self):
+        return "metafield"
+
+    def clean(self):
+        """Validate the value based on the metafield type."""
+        super().clean()
+        if self.value is not None:
+            self._validate_value()
+
+    def _validate_value(self):
+        """Validate value based on metafield type."""
+        if self.type == core.MetafieldType.text:
+            if not isinstance(self.value, str):
+                raise ValidationError(f"Value must be a string for type 'text'")
+
+        elif self.type == core.MetafieldType.number:
+            if not isinstance(self.value, (int, float)):
+                raise ValidationError(f"Value must be a number for type 'number'")
+
+        elif self.type == core.MetafieldType.boolean:
+            if not isinstance(self.value, bool):
+                raise ValidationError(f"Value must be a boolean for type 'boolean'")
+
+        elif self.type == core.MetafieldType.json:
+            # JSON can be any valid JSON value (dict, list, string, number, boolean, null)
+            try:
+                if isinstance(self.value, str):
+                    json.loads(self.value)
+            except (json.JSONDecodeError, TypeError):
+                raise ValidationError(f"Value must be valid JSON for type 'json'")
+
+        elif self.type == core.MetafieldType.date:
+            if isinstance(self.value, str):
+                try:
+                    datetime.strptime(self.value, '%Y-%m-%d')
+                except ValueError:
+                    raise ValidationError(f"Value must be a valid date (YYYY-MM-DD) for type 'date'")
+            else:
+                raise ValidationError(f"Value must be a date string (YYYY-MM-DD) for type 'date'")
+
+        elif self.type == core.MetafieldType.date_time:
+            if isinstance(self.value, str):
+                try:
+                    datetime.fromisoformat(self.value.replace('Z', '+00:00'))
+                except ValueError:
+                    raise ValidationError(f"Value must be a valid ISO datetime for type 'date_time'")
+            else:
+                raise ValidationError(f"Value must be a datetime string for type 'date_time'")
+
+        elif self.type == core.MetafieldType.password:
+            if not isinstance(self.value, str):
+                raise ValidationError(f"Value must be a string for type 'password'")
+
+    def get_parsed_value(self):
+        """Return the value parsed according to its type."""
+        if self.value is None:
+            return None
+
+        if self.type == core.MetafieldType.text:
+            return str(self.value)
+
+        elif self.type == core.MetafieldType.number:
+            return self.value
+
+        elif self.type == core.MetafieldType.boolean:
+            return bool(self.value)
+
+        elif self.type == core.MetafieldType.json:
+            if isinstance(self.value, str):
+                try:
+                    return json.loads(self.value)
+                except json.JSONDecodeError:
+                    return self.value
+            return self.value
+
+        elif self.type == core.MetafieldType.date:
+            if isinstance(self.value, str):
+                try:
+                    return datetime.strptime(self.value, '%Y-%m-%d').date()
+                except ValueError:
+                    return self.value
+            return self.value
+
+        elif self.type == core.MetafieldType.date_time:
+            if isinstance(self.value, str):
+                try:
+                    return datetime.fromisoformat(self.value.replace('Z', '+00:00'))
+                except ValueError:
+                    return self.value
+            return self.value
+
+        elif self.type == core.MetafieldType.password:
+            return str(self.value)
+
+        return self.value

karrio/server/core/models/third_party.py

@@ -0,0 +1,21 @@
+from django.db import models
+from rest_framework_tracking.models import APIRequestLog
+
+from karrio.server.core.models.base import ControlledAccessModel
+
+
+class APILog(APIRequestLog, ControlledAccessModel):
+    class Meta:
+        ordering = ["-requested_at"]
+        proxy = True
+
+    @property
+    def object_type(self):
+        return "log"
+
+
+class APILogIndex(APILog):
+    entity_id = models.CharField(max_length=50, null=True, db_index=True)
+    test_mode = models.BooleanField(
+        default=True, null=True, help_text="execution context"
+    )

karrio/server/core/oauth_validators.py

@@ -0,0 +1,171 @@
+import hashlib
+import base64
+from oauth2_provider.oauth2_validators import OAuth2Validator
+from django.contrib.auth import get_user_model
+
+
+class CustomOAuth2Validator(OAuth2Validator):
+    oidc_claim_scope = None
+
+    def get_additional_claims(self):
+        return {
+            "name": lambda request: getattr(request.user, 'full_name', '') if request.user else '',
+            "email": lambda request: getattr(request.user, 'email', '') if request.user else '',
+        }
+
+    def validate_grant_type(self, client_id, grant_type, client, request, *args, **kwargs):
+        """
+        Validate grant type with proper format conversion.
+
+        django-oauth-toolkit stores grant types with hyphens (e.g., 'authorization-code')
+        but OAuth2 spec uses underscores (e.g., 'authorization_code').
+        This method handles the conversion.
+        """
+        # Convert OAuth2 spec format to django-oauth-toolkit format
+        grant_type_mapping = {
+            'authorization_code': 'authorization-code',
+            'client_credentials': 'client-credentials',
+            'refresh_token': 'refresh-token',
+            'password': 'password',
+        }
+
+        # Get the stored grant type format
+        stored_grant_type = grant_type_mapping.get(grant_type, grant_type)
+
+        # Check if the client supports this grant type
+        if client and hasattr(client, 'authorization_grant_type'):
+            is_valid = client.authorization_grant_type == stored_grant_type
+            if is_valid:
+                return True
+
+        # Fall back to parent implementation
+        return super().validate_grant_type(client_id, grant_type, client, request, *args, **kwargs)
+
+    def validate_code(self, client_id, code, client, request, *args, **kwargs):
+        """
+        Override validate_code to ensure proper grant type handling for authorization code flow.
+        """
+        # First validate the code using parent implementation
+        is_valid = super().validate_code(client_id, code, client, request, *args, **kwargs)
+
+        if is_valid and client:
+            # Ensure the client supports authorization code flow
+            # Convert the request grant type to stored format for comparison
+            if request.grant_type == 'authorization_code':
+                return client.authorization_grant_type == 'authorization-code'
+
+        return is_valid
+
+    def validate_client_id(self, client_id, request, *args, **kwargs):
+        """
+        Validate the client_id and set the user context for different flows.
+        """
+        is_valid = super().validate_client_id(client_id, request, *args, **kwargs)
+
+        if is_valid:
+            try:
+                from oauth2_provider.models import Application
+                application = Application.objects.get(client_id=client_id)
+
+                # Set application on request for later use
+                request.oauth_application = application
+
+                # For client credentials flow, set the user from the OAuth application owner
+                if request.grant_type == 'client_credentials' and application.user:
+                    request.user = application.user
+
+            except Application.DoesNotExist:
+                pass
+
+        return is_valid
+
+    def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
+        """
+        Validate redirect URI for Authorization Code Flow with enhanced security.
+        """
+        is_valid = super().validate_redirect_uri(client_id, redirect_uri, request, *args, **kwargs)
+
+        if is_valid and redirect_uri:
+            # Additional security: ensure HTTPS in production
+            from django.conf import settings
+            if not settings.DEBUG and not redirect_uri.startswith('https://'):
+                return False
+
+        return is_valid
+
+    def validate_code_challenge(self, challenge, request, *args, **kwargs):
+        """
+        Validate PKCE code challenge for enhanced security.
+        """
+        # This is called when PKCE is enabled
+        if challenge:
+            # Validate that the challenge is base64url encoded and has proper length
+            try:
+                decoded = base64.urlsafe_b64decode(challenge + '==')  # Add padding
+                return len(decoded) >= 32  # At least 256 bits
+            except Exception:
+                return False
+
+        # If PKCE is required but no challenge provided, reject
+        from django.conf import settings
+        oauth_settings = getattr(settings, 'OAUTH2_PROVIDER', {})
+        if oauth_settings.get('PKCE_REQUIRED', False):
+            return False
+
+        return True
+
+    def validate_code_verifier(self, verifier, challenge, challenge_method, request, *args, **kwargs):
+        """
+        Validate PKCE code verifier against the challenge.
+        """
+        if challenge_method == 'S256':
+            # SHA256 challenge method
+            verifier_hash = hashlib.sha256(verifier.encode('ascii')).digest()
+            verifier_challenge = base64.urlsafe_b64encode(verifier_hash).decode('ascii').rstrip('=')
+            return verifier_challenge == challenge
+        elif challenge_method == 'plain':
+            # Plain text challenge method (less secure, but allowed)
+            return verifier == challenge
+
+        return False
+
+    def get_default_scopes(self, client_id, request, *args, **kwargs):
+        """
+        Return default scopes for the application.
+        """
+        try:
+            from oauth2_provider.models import Application
+            application = Application.objects.get(client_id=client_id)
+
+            # For Karrio apps, default to read scope
+            if hasattr(application, 'oauth_app'):
+                return ['read']
+
+        except Application.DoesNotExist:
+            pass
+
+        return super().get_default_scopes(client_id, request, *args, **kwargs)
+
+    def save_authorization_code(self, client_id, code, request, *args, **kwargs):
+        """
+        Store authorization code with additional security measures.
+        """
+        # Store the authorization code with enhanced security
+        super().save_authorization_code(client_id, code, request, *args, **kwargs)
+
+        # Log OAuth events for audit purposes
+        import logging
+        logger = logging.getLogger('karrio.server.oauth')
+        logger.info(f"Authorization code granted for client {client_id}")
+
+    def authenticate_user(self, request):
+        """
+        Authenticate user for Authorization Code Flow.
+        """
+        user = super().authenticate_user(request)
+
+        if user:
+            # Set additional user context
+            request.oauth_user = user
+
+        return user

karrio/server/core/permissions.py

@@ -0,0 +1,37 @@
+import logging
+import pydoc
+import typing
+from rest_framework import permissions, exceptions
+
+import karrio.server.conf as conf
+
+logger = logging.getLogger(__name__)
+PERMISSION_CHECKS = getattr(
+    conf.settings, "PERMISSION_CHECKS", ["karrio.server.core.permissions.check_feature_flags"]
+)
+
+
+class AllowEnabledAPI(permissions.BasePermission):
+    """
+    Global permission check for blocked IPs.
+    """
+
+    def has_permission(self, request, view):
+        if ("/v1/data" in request.path) and (conf.settings.DATA_IMPORT_EXPORT is False):
+            raise exceptions.PermissionDenied()
+
+        if ("/v1/orders" in request.path) and (conf.settings.ORDERS_MANAGEMENT is False):
+            raise exceptions.PermissionDenied()
+
+        return super().has_permission(request, view)
+
+
+def check_permissions(context, keys: typing.List[str]):
+    for check in PERMISSION_CHECKS:
+        pydoc.locate(check)(context=context, keys=keys) # type: ignore
+
+
+def check_feature_flags(keys: typing.List[str] = [], **kwargs):
+    flags = [flag for flag in keys if flag in conf.FEATURE_FLAGS]
+    if any([conf.settings.get(flag) is False for flag in flags]):
+        raise exceptions.PermissionDenied()

karrio/server/core/renderers.py

@@ -0,0 +1,11 @@
+from rest_framework.renderers import BaseRenderer
+
+
+class BinaryFileRenderer(BaseRenderer):
+    media_type = 'application/octet-stream'
+    format = None
+    charset = None
+    render_style = 'binary'
+
+    def render(self, data, media_type=None, renderer_context=None):
+        return data

karrio/server/core/router.py

@@ -0,0 +1,3 @@
+from rest_framework.routers import DefaultRouter
+
+router = DefaultRouter(trailing_slash=False)