kiba-core 0.5.3.dev66__tar.gz → 0.5.3.dev67__tar.gz

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/CHANGELOG.md

@@ -8,6 +8,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ## [Unreleased]
 
 ### Added
+- [MINOR] Added `authorize_bearer_jwt_request` for validating bearer JWTs in `RouteAuthResolver` implementations; it and `authorize_bearer_jwt` now only strip the leading `Bearer ` prefix, let cancellation propagate, and log why a JWT was rejected
+- [MINOR] Made the `route` `authResolver` optional for routes without `auth`; setting `auth` without an `authResolver` raises `ValueError` at registration
 - [MAJOR] Replaced `MessageQueue.delete_message` with `complete_message`, and added abstract `retry_message` (reschedule with a delay) and `fail_message` (apply the queue's failure policy); `MessageQueueProcessor` now reschedules `MessageNeedsReprocessingException` messages with `retry_message`
 - [MINOR] Updated `MessageQueueProcessor` to retry messages that raise `LockedException` up to 3 times (30s linear backoff) before failing them
 - [MINOR] Updated `MessageQueueProcessor` to log instead of raise when a failure notification cannot be sent

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kiba-core
-Version: 0.5.3.dev66
+Version: 0.5.3.dev67
 Summary: Kiba Labs' python utilities
 Project-URL: repository, https://github.com/kibalabs/core-py
 Requires-Python: <4,>=3.12

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/core/api/authorizer.py

@@ -10,6 +10,7 @@ from core.api.api_request import KibaApiRequest
 from core.api.route_metadata import OpenApiSecurityScheme
 from core.api.route_metadata import update_route_metadata
 from core.exceptions import ForbiddenException
+from core.exceptions import KibaException
 from core.exceptions import UnauthorizedException
 from core.http.basic_authentication import BasicAuthentication
 from core.http.jwt import Jwt
@@ -27,18 +28,19 @@ class SignatureAuthorizer:
         raise NotImplementedError
 
 
-async def _authorize_bearer_jwt[ApiRequest: BaseModel](request: KibaApiRequest[ApiRequest], authorizer: Authorizer) -> Jwt:
+async def authorize_bearer_jwt_request[ApiRequest: BaseModel](request: KibaApiRequest[ApiRequest], authorizer: Authorizer) -> Jwt:
     authorization = request.headers.get('Authorization')
     if not authorization:
         raise ForbiddenException(message='AUTH_NOT_PROVIDED')
     if not authorization.startswith('Bearer '):
         raise ForbiddenException(message='AUTH_INVALID')
-    jwtString = authorization.replace('Bearer ', '')
     try:
-        jwt = await authorizer.validate_jwt(jwtString=jwtString)
-    except BaseException:  # noqa: BLE001
-        raise ForbiddenException(message='AUTH_INVALID')
-    return jwt
+        return await authorizer.validate_jwt(jwtString=authorization.removeprefix('Bearer '))
+    except Exception as exception:
+        # NOTE(krishan711): only log kiba messages as other exception messages (e.g. json decode errors) can contain parts of the token
+        reason = exception.message if isinstance(exception, KibaException) else type(exception).__name__
+        logging.info(f'Bearer JWT rejected: {reason}')
+        raise ForbiddenException(message='AUTH_INVALID') from exception
 
 
 def authorize_bearer_jwt[ApiRequest: BaseModel](  # type: ignore[explicit-any]
@@ -52,7 +54,7 @@ def authorize_bearer_jwt[ApiRequest: BaseModel](  # type: ignore[explicit-any]
 
         @functools.wraps(func)
         async def async_wrapper(request: KibaApiRequest[ApiRequest]) -> typing.Any:  # type: ignore[explicit-any, misc]
-            request.authJwt = await _authorize_bearer_jwt(request=request, authorizer=authorizer)
+            request.authJwt = await authorize_bearer_jwt_request(request=request, authorizer=authorizer)
             result = func(request)
             # NOTE(krishan711): this is here to support streaming responses which return an async generator
             if hasattr(result, '__aiter__'):

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/core/api/route.py

@@ -42,7 +42,7 @@ def route[ApiRequest: BaseModel, ApiResponse: BaseModel](  # type: ignore[explic
     requestType: typing.Type[ApiRequest],
     responseType: typing.Type[ApiResponse],
     *,
-    authResolver: RouteAuthResolver,
+    authResolver: RouteAuthResolver | None = None,
     isStreaming: bool = False,
     operationId: str | None = None,
     summary: str | None = None,
@@ -52,13 +52,15 @@ def route[ApiRequest: BaseModel, ApiResponse: BaseModel](  # type: ignore[explic
     rateLimit: RateLimitConfig | None = None,
     extensions: Mapping[str, object] | None = None,
 ) -> typing.Callable[[typing.Callable[[KibaApiRequest[ApiRequest]], _AnyReturn]], typing.Callable[[Request], typing.Awaitable[KibaJSONResponse | StreamingResponse]]]:
-    securitySchemeNames = authResolver.get_route_security_schemes(auth=auth) if auth is not None else []
-
     def decorator(func: typing.Callable[[KibaApiRequest[ApiRequest]], _AnyReturn]) -> typing.Callable[[Request], typing.Awaitable[KibaJSONResponse | StreamingResponse]]:  # type: ignore[explicit-any]
         handler: typing.Callable[[KibaApiRequest[ApiRequest]], _AnyReturn] = func
         if rateLimit is not None:
             handler = rate_limit(rateLimit)(handler)
+        securitySchemeNames: list[str] = []
         if auth is not None:
+            if authResolver is None:
+                raise ValueError(f'Auth policy {auth} requires an authResolver')
+            securitySchemeNames = authResolver.get_route_security_schemes(auth=auth)
             handler = _authorize_route(authResolver, auth)(handler)
         endpointDecorator = streaming_json_route if isStreaming else json_route
         endpoint = endpointDecorator(requestType=requestType, responseType=responseType)(handler)  # type: ignore[arg-type, ty:invalid-argument-type]

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/kiba_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kiba-core
-Version: 0.5.3.dev66
+Version: 0.5.3.dev67
 Summary: Kiba Labs' python utilities
 Project-URL: repository, https://github.com/kibalabs/core-py
 Requires-Python: <4,>=3.12

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kiba-core"
-version = "0.5.3.dev66"
+version = "0.5.3.dev67"
 description = "Kiba Labs' python utilities"
 readme = "README.md"
 requires-python = ">=3.12, <4"

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/tests/api/test_authorizer.py

@@ -1,13 +1,15 @@
+import asyncio
 import json
 import pytest
 from collections.abc import AsyncIterator
+from types import SimpleNamespace
 from pydantic import BaseModel
 from starlette.applications import Starlette
 from starlette.routing import Route
 from starlette.testclient import TestClient
 
 from core.api.api_request import KibaApiRequest
-from core.api.authorizer import Authorizer, SignatureAuthorizer, StaticTokenAuthorizer, authorize_bearer_jwt, authorize_signature, authorize_static_header_request, authorize_token
+from core.api.authorizer import Authorizer, SignatureAuthorizer, StaticTokenAuthorizer, authorize_bearer_jwt, authorize_bearer_jwt_request, authorize_signature, authorize_static_header_request, authorize_token
 from core.api.json_route import json_route
 from core.api.middleware.exception_handling_middleware import ExceptionHandlingMiddleware
 from core.api.streaming_json_route import streaming_json_route
@@ -159,6 +161,10 @@ def test_jwt_json_invalid_token_returns_403(jwt_json_client):
     response = jwt_json_client.post('/protected', json={'value': 'hello'}, headers={'Authorization': 'Bearer bad-token'})
     assert response.status_code == 403
 
+def test_jwt_json_repeated_bearer_prefix_returns_403(jwt_json_client):
+    response = jwt_json_client.post('/protected', json={'value': 'hello'}, headers={'Authorization': f'Bearer Bearer {VALID_JWT_TOKEN}'})
+    assert response.status_code == 403
+
 
 def test_jwt_json_sets_auth_jwt_on_request(jwt_json_client):
     response = jwt_json_client.post('/protected', json={'value': 'hello'}, headers={'Authorization': f'Bearer {VALID_JWT_TOKEN}'})
@@ -186,6 +192,31 @@ def test_jwt_streaming_valid_token_streams_data(jwt_streaming_client):
     assert data['user_id'] == VALID_USER_ID
 
 
+# --- authorize_bearer_jwt_request ---
+
+class RaisingJwtAuthorizer(Authorizer):
+    def __init__(self, exception: BaseException) -> None:
+        self.exception = exception
+
+    async def validate_jwt(self, jwtString: str) -> Jwt:
+        raise self.exception
+
+
+@pytest.mark.asyncio
+async def test_bearer_jwt_request_maps_unexpected_validation_errors_to_auth_invalid():
+    request = SimpleNamespace(headers={'Authorization': 'Bearer token'})
+    with pytest.raises(ForbiddenException) as exceptionInfo:
+        await authorize_bearer_jwt_request(request=request, authorizer=RaisingJwtAuthorizer(exception=ValueError('bad token')))
+    assert exceptionInfo.value.message == 'AUTH_INVALID'
+
+
+@pytest.mark.asyncio
+async def test_bearer_jwt_request_propagates_cancellation():
+    request = SimpleNamespace(headers={'Authorization': 'Bearer token'})
+    with pytest.raises(asyncio.CancelledError):
+        await authorize_bearer_jwt_request(request=request, authorizer=RaisingJwtAuthorizer(exception=asyncio.CancelledError()))
+
+
 # --- authorize_signature + json_route ---
 
 def test_sig_json_no_auth_header_returns_403(sig_json_client):

{kiba_core-0.5.3.dev66 → kiba_core-0.5.3.dev67}/tests/api/test_route.py

@@ -176,9 +176,27 @@ def test_route_static_token_policy_accepts_valid_credentials() -> None:
 
 def test_route_rejects_unknown_auth_policy_during_registration() -> None:
     with pytest.raises(ValueError, match='Unknown auth policy: unknown'):
-        api_route(
-            requestType=ExampleRequest,
-            responseType=ExampleResponse,
-            authResolver=ExampleRouteAuthResolver(),
-            auth='unknown',
-        )
+
+        @api_route(requestType=ExampleRequest, responseType=ExampleResponse, authResolver=ExampleRouteAuthResolver(), auth='unknown')
+        async def endpoint(request: KibaApiRequest[ExampleRequest]) -> ExampleResponse:
+            return ExampleResponse(result=request.data.value)
+
+
+def test_route_without_auth_does_not_require_an_auth_resolver() -> None:
+    @api_route(requestType=ExampleRequest, responseType=ExampleResponse)
+    async def endpoint(request: KibaApiRequest[ExampleRequest]) -> ExampleResponse:
+        return ExampleResponse(result=request.data.value)
+
+    client = TestClient(Starlette(routes=[Route('/example', endpoint, methods=['POST'])]), raise_server_exceptions=False)
+    response = client.post('/example', json={'value': 'hello'})
+
+    assert response.status_code == 200
+    assert response.json() == {'result': 'hello'}
+
+
+def test_route_rejects_auth_policy_without_auth_resolver_during_registration() -> None:
+    with pytest.raises(ValueError, match='Auth policy signature requires an authResolver'):
+
+        @api_route(requestType=ExampleRequest, responseType=ExampleResponse, auth='signature')
+        async def endpoint(request: KibaApiRequest[ExampleRequest]) -> ExampleResponse:
+            return ExampleResponse(result=request.data.value)