mdb-engine 0.4.14__tar.gz → 0.5.1__tar.gz

{mdb_engine-0.4.14/mdb_engine.egg-info → mdb_engine-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.14
+Version: 0.5.1
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/mdb_engine/__init__.py

@@ -82,12 +82,15 @@ from .repositories import Entity, MongoRepository, Repository, UnitOfWork
 from .utils import clean_mongo_doc, clean_mongo_docs
 
 __version__ = (
-    "0.4.14"  # WebSocket security documentation and test updates
+    "0.5.0"  # Major WebSocket security overhaul - cookie-based authentication
+    # - BREAKING CHANGE: Removed subprotocol tunneling support
+    # - NEW: Exclusive httpOnly cookie-based WebSocket authentication
     # - Comprehensive security guide (WEBSOCKET_SECURITY_MULTI_APP_SSO.md)
-    # - Updated all documentation to reflect subprotocol-only authentication
-    # - Added integration tests for subprotocol authentication in multi-app SSO
-    # - Enhanced unit test documentation with security-focused explanations
+    # - Updated all documentation to reflect cookie-based authentication
+    # - Enhanced CSRF protection for WebSocket upgrades
+    # - Added integration tests for cookie-based WebSocket authentication
     # - Complete test coverage for WebSocket security scenarios
+    # - Multi-app SSO compatibility with path="/" cookies
 )
 
 __all__ = [

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/mdb_engine/auth/cookie_utils.py

@@ -116,8 +116,14 @@ def set_auth_cookies(
         refresh_token_ttl = 604800  # Default 7 days
 
     # Set access token cookie
+    # CRITICAL: path="/" ensures cookie is available to all mounted sub-apps
+    # Without explicit path, cookies default to request path and won't work with app.mount()
     response.set_cookie(
-        key="token", value=access_token, max_age=access_token_ttl, **cookie_settings
+        key="token",
+        value=access_token,
+        max_age=access_token_ttl,
+        path="/",  # Required for FastAPI mounted apps
+        **cookie_settings,
     )
 
     # Set refresh token cookie if provided
@@ -126,6 +132,7 @@ def set_auth_cookies(
             key="refresh_token",
             value=refresh_token,
             max_age=refresh_token_ttl,
+            path="/",  # Required for FastAPI mounted apps
             **cookie_settings,
         )
 
@@ -148,7 +155,10 @@ def clear_auth_cookies(response, request: Request | None = None):
         secure = os.getenv("G_NOME_ENV") == "production"
 
     # Delete access token cookie
-    response.delete_cookie(key="token", httponly=True, secure=secure, samesite=samesite)
+    # CRITICAL: path="/" ensures cookie deletion works across all mounted sub-apps
+    response.delete_cookie(key="token", httponly=True, secure=secure, samesite=samesite, path="/")
 
     # Delete refresh token cookie
-    response.delete_cookie(key="refresh_token", httponly=True, secure=secure, samesite=samesite)
+    response.delete_cookie(
+        key="refresh_token", httponly=True, secure=secure, samesite=samesite, path="/"
+    )

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/mdb_engine/auth/csrf.py

@@ -299,9 +299,9 @@ class CSRFMiddleware(BaseHTTPMiddleware):
         method = request.method
 
         # CRITICAL: Handle WebSocket upgrade requests BEFORE other CSRF checks
-        # WebSocket upgrades don't use CSRF tokens, but need origin validation
+        # WebSocket upgrades use cookie-based authentication and require CSRF validation
         if self._is_websocket_upgrade(request):
-            # Validate origin for WebSocket connections (CSWSH protection)
+            # Always validate origin for WebSocket connections (CSWSH protection)
             if not self._validate_websocket_origin(request):
                 logger.warning(
                     f"WebSocket origin validation failed for {path}: "
@@ -312,8 +312,61 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                     status_code=status.HTTP_403_FORBIDDEN,
                     content={"detail": "Invalid origin for WebSocket connection"},
                 )
-            # Origin validated - allow WebSocket upgrade to proceed
-            # No CSRF token check needed for WebSocket upgrades
+
+            # Cookie-based authentication requires CSRF protection
+            # Check if authentication token cookie is present
+            # Use same cookie name as SharedAuthMiddleware for consistency
+            from .shared_middleware import AUTH_COOKIE_NAME
+
+            auth_token_cookie = request.cookies.get(AUTH_COOKIE_NAME)
+            if auth_token_cookie:
+                # For WebSocket upgrades, CSRF protection relies on:
+                # 1. Origin validation (already done above) - primary defense
+                # 2. SameSite cookies - prevents cross-site cookie sending
+                # 3. CSRF cookie presence - ensures session is established
+                #
+                # Note: JavaScript WebSocket API cannot set custom headers,
+                # so we cannot use double-submit cookie pattern (cookie + header).
+                # Instead, we rely on Origin validation + SameSite cookies for CSRF protection.
+                csrf_cookie_token = request.cookies.get(self.cookie_name)
+                if not csrf_cookie_token:
+                    logger.warning(f"WebSocket upgrade missing CSRF cookie for {path}")
+                    return JSONResponse(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        content={"detail": "CSRF token missing for WebSocket authentication"},
+                    )
+
+                # Validate CSRF token signature if secret is used
+                if self.secret and not validate_csrf_token(
+                    csrf_cookie_token, self.secret, self.token_ttl
+                ):
+                    logger.warning(f"WebSocket CSRF token validation failed for {path}")
+                    return JSONResponse(
+                        status_code=status.HTTP_403_FORBIDDEN,
+                        content={
+                            "detail": "CSRF token expired or invalid for WebSocket connection"
+                        },
+                    )
+
+                # Optional: If CSRF header is provided, validate it matches cookie
+                # (Some clients may send it, but it's not required for WebSocket upgrades)
+                header_token = request.headers.get(self.header_name)
+                if header_token:
+                    # If header is provided, validate it matches cookie (double-submit pattern)
+                    if not hmac.compare_digest(csrf_cookie_token, header_token):
+                        logger.warning(f"WebSocket CSRF token mismatch for {path}")
+                        return JSONResponse(
+                            status_code=status.HTTP_403_FORBIDDEN,
+                            content={"detail": "CSRF token invalid for WebSocket connection"},
+                        )
+
+                logger.debug(
+                    f"WebSocket upgrade CSRF validation passed for {path} "
+                    f"(Origin validated, CSRF cookie present)"
+                )
+
+            # Origin validated (and CSRF validated if authenticated)
+            # Allow WebSocket upgrade to proceed
             return await call_next(request)
 
         if self._is_exempt(path):

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/mdb_engine/routing/websockets.py

@@ -307,16 +307,70 @@ def get_websocket_manager_sync(app_slug: str) -> WebSocketConnectionManager:
     return _websocket_managers[app_slug]
 
 
+def _get_cookies_from_websocket(websocket: Any) -> dict[str, str]:
+    """
+    Extract cookies from WebSocket request.
+
+    Supports both FastAPI WebSocket .cookies attribute and ASGI scope Cookie header.
+
+    Args:
+        websocket: FastAPI WebSocket instance
+
+    Returns:
+        Dictionary of cookie name -> cookie value
+    """
+    cookies: dict[str, str] = {}
+
+    try:
+        # Try FastAPI WebSocket .cookies attribute (if available)
+        if hasattr(websocket, "cookies") and websocket.cookies is not None:
+            # FastAPI WebSocket.cookies is a dict-like object
+            cookies = dict(websocket.cookies)
+            logger.debug(f"Extracted {len(cookies)} cookies from WebSocket.cookies attribute")
+            return cookies
+    except (AttributeError, TypeError) as e:
+        logger.debug(f"Could not access WebSocket.cookies attribute: {e}")
+
+    try:
+        # Fallback: Extract from Cookie header in ASGI scope
+        if hasattr(websocket, "scope") and "headers" in websocket.scope:
+            headers_dict = dict(websocket.scope["headers"])
+            cookie_header_bytes = headers_dict.get(b"cookie")
+            if not cookie_header_bytes:
+                # Try case-insensitive lookup
+                for key, value in headers_dict.items():
+                    if isinstance(key, bytes) and key.lower() == b"cookie":
+                        cookie_header_bytes = value
+                        break
+
+            if cookie_header_bytes:
+                cookie_header = cookie_header_bytes.decode("utf-8")
+                # Parse cookie string: "name1=value1; name2=value2"
+                for cookie_pair in cookie_header.split(";"):
+                    cookie_pair = cookie_pair.strip()
+                    if "=" in cookie_pair:
+                        name, value = cookie_pair.split("=", 1)
+                        cookies[name.strip()] = value.strip()
+                logger.debug(f"Extracted {len(cookies)} cookies from Cookie header in ASGI scope")
+                return cookies
+    except (AttributeError, TypeError, KeyError, UnicodeDecodeError, ValueError) as e:
+        logger.debug(f"Could not extract cookies from ASGI scope: {e}")
+
+    return cookies
+
+
 async def authenticate_websocket(
-    websocket: Any, app_slug: str, require_auth: bool = True
+    websocket: Any,
+    app_slug: str,
+    require_auth: bool = True,
 ) -> tuple[str | None, str | None]:
     """
-    Authenticate a WebSocket connection via Sec-WebSocket-Protocol header.
+    Authenticate a WebSocket connection via httpOnly cookies.
 
-    Uses subprotocol tunneling to pass JWT tokens securely:
-    - Client: new WebSocket(url, [token])
-    - Server: Extracts token from sec-websocket-protocol header
-    - Bypasses CSRF issues and avoids URL logging risks
+    Uses cookie-based authentication with CSRF protection:
+    - Token stored in httpOnly cookie (not accessible to JavaScript)
+    - CSRF token validated via double-submit cookie pattern
+    - Origin validation provides additional protection
 
     Args:
         websocket: FastAPI WebSocket instance (can access headers before accept)
@@ -340,56 +394,28 @@ async def authenticate_websocket(
         return None, None
 
     try:
-        token = None
-        selected_subprotocol = None
+        # Extract token from httpOnly cookie
+        # Use same cookie name as SharedAuthMiddleware for consistency
+        from ..auth.shared_middleware import AUTH_COOKIE_NAME
 
-        # Sec-WebSocket-Protocol (Subprotocol Tunneling)
-        # Browsers allow: new WebSocket(url, ["token", "THE_JWT_STRING"])
-        # This bypasses CSRF issues and avoids URL logging risks
-        try:
-            protocol_header = None
-            # Try multiple ways to access headers (FastAPI WebSocket compatibility)
-            if hasattr(websocket, "headers") and websocket.headers is not None:
-                # FastAPI WebSocket.headers is case-insensitive dict-like
-                protocol_header = websocket.headers.get("sec-websocket-protocol")
-
-            # Fallback: access via scope (ASGI standard) if headers not available
-            if not protocol_header and hasattr(websocket, "scope") and "headers" in websocket.scope:
-                headers_dict = dict(websocket.scope["headers"])
-                # Headers are bytes in ASGI, need to decode
-                protocol_header_bytes = headers_dict.get(b"sec-websocket-protocol")
-                if protocol_header_bytes:
-                    protocol_header = protocol_header_bytes.decode("utf-8")
-
-            if protocol_header:
-                # Header format: "protocol1, protocol2, ..." or just "token"
-                protocols = [p.strip() for p in protocol_header.split(",")]
-                logger.debug(f"WebSocket subprotocols for app '{app_slug}': {protocols}")
-
-                # Look for a JWT-like token in the protocols
-                # JWTs are typically long (>20 chars) and don't contain spaces
-                for protocol in protocols:
-                    if len(protocol) > 20 and " " not in protocol:
-                        token = protocol
-                        selected_subprotocol = protocol
-                        logger.info(
-                            f"WebSocket token found in subprotocol for app '{app_slug}' "
-                            f"(length: {len(protocol)})"
-                        )
-                        break
-        except (AttributeError, TypeError, KeyError, UnicodeDecodeError) as e:
-            logger.debug(f"Could not access WebSocket headers for subprotocol check: {e}")
+        cookies = _get_cookies_from_websocket(websocket)
+        token = cookies.get(AUTH_COOKIE_NAME)  # Use mdb_auth_token (same as shared middleware)
 
         if not token:
-            logger.warning(
-                f"No token found in subprotocol header for WebSocket connection to app "
-                f"'{app_slug}' (require_auth={require_auth}). "
-                f"Use: new WebSocket(url, [token]) to pass JWT token as subprotocol."
+            logger.error(
+                f"❌ No token cookie found for WebSocket connection to app '{app_slug}' "
+                f"(require_auth={require_auth}). "
+                f"Available cookies: {list(cookies.keys()) if cookies else 'none'}. "
+                f"Ensure httpOnly cookie is set during authentication."
             )
             if require_auth:
                 return None, None  # Signal auth failure
             return None, None
 
+        logger.info(
+            f"WebSocket token found in cookie for app '{app_slug}' " "(cookie-based authentication)"
+        )
+
         # Decode and validate token
         import jwt
 
@@ -401,17 +427,16 @@ async def authenticate_websocket(
             user_id = payload.get("sub") or payload.get("user_id")
             user_email = payload.get("email")
 
-            # Store selected subprotocol on websocket scope for accept() to use
-            if selected_subprotocol:
-                # Store in scope so _accept_websocket_connection can access it
-                if hasattr(websocket, "scope"):
-                    websocket.scope["_selected_subprotocol"] = selected_subprotocol
-                logger.debug(f"Stored subprotocol '{selected_subprotocol}' for WebSocket accept")
-
-            logger.info(f"WebSocket authenticated successfully for app '{app_slug}': {user_email}")
+            logger.info(
+                f"WebSocket authenticated successfully for app '{app_slug}': {user_email} "
+                f"(method: cookie)"
+            )
             return user_id, user_email
-        except (jwt.ExpiredSignatureError, jwt.InvalidTokenError) as decode_error:
-            logger.error(f"JWT decode error for app '{app_slug}': {decode_error}", exc_info=True)
+        except (jwt.ExpiredSignatureError, jwt.InvalidTokenError):
+            logger.exception(
+                f"❌ JWT decode error for app '{app_slug}'. "
+                f"Token present: {bool(token)}, Token length: {len(token) if token else 0}"
+            )
             raise
 
     except WebSocketDisconnect:
@@ -480,29 +505,13 @@ def get_message_handler(
 
 async def _accept_websocket_connection(websocket: Any, app_slug: str) -> None:
     """
-    Accept WebSocket connection with subprotocol support.
+    Accept WebSocket connection.
 
-    If authentication found a token in the Sec-WebSocket-Protocol header,
-    we must accept with that specific subprotocol or the browser will reject
-    the connection.
+    Cookie-based authentication uses httpOnly cookies automatically sent by the browser.
     """
     try:
-        # Check if auth stored a selected subprotocol
-        selected_subprotocol = None
-        if hasattr(websocket, "scope"):
-            selected_subprotocol = websocket.scope.get("_selected_subprotocol")
-
-        if selected_subprotocol:
-            # Accept with the specific subprotocol the client requested
-            await websocket.accept(subprotocol=selected_subprotocol)
-            logger.info(
-                f"✅ WebSocket accepted for app '{app_slug}' "
-                f"with subprotocol '{selected_subprotocol}'"
-            )
-        else:
-            # Standard accept without subprotocol
-            await websocket.accept()
-            logger.info(f"✅ WebSocket accepted for app '{app_slug}'")
+        await websocket.accept()
+        logger.info(f"✅ WebSocket accepted for app '{app_slug}'")
 
         print(f"✅ [WEBSOCKET ACCEPTED] App: '{app_slug}'")
     except (RuntimeError, ConnectionError, OSError) as accept_error:
@@ -687,19 +696,33 @@ def create_websocket_endpoint(
             # CRITICAL: Authenticate BEFORE accepting connection
             # This prevents CSRF middleware from rejecting established connections
             # We can access headers/query_params before accept() is called
+
+            # Debug: Log cookies before authentication
+            try:
+                cookies = _get_cookies_from_websocket(websocket)
+                cookie_names = list(cookies.keys()) if cookies else []
+                logger.info(
+                    f"🔍 WebSocket cookies for app '{app_slug}': {cookie_names} "
+                    f"(require_auth={require_auth})"
+                )
+            except (AttributeError, TypeError, KeyError, RuntimeError) as cookie_error:
+                logger.warning(f"Could not extract cookies for debugging: {cookie_error}")
+
             user_id, user_email = await authenticate_websocket(websocket, app_slug, require_auth)
 
             # Handle authentication failure
             if require_auth and not user_id:
-                logger.warning(
-                    f"WebSocket authentication failed for app '{app_slug}' - rejecting connection"
+                logger.error(
+                    f"❌ WebSocket authentication FAILED for app '{app_slug}' - "
+                    f"rejecting connection. require_auth={require_auth}, "
+                    f"user_id={user_id}, user_email={user_email}"
                 )
                 # Reject without accepting - FastAPI will send 403 if accept() not called
                 # We can't call websocket.close() before accept(), so we just return
                 # The connection will be rejected by the server
                 return
 
-            # Accept connection (with subprotocol if token was in protocol header)
+            # Accept connection
             await _accept_websocket_connection(websocket, app_slug)
 
             # Connect with metadata (websocket already accepted)

{mdb_engine-0.4.14 → mdb_engine-0.5.1/mdb_engine.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mdb-engine
-Version: 0.4.14
+Version: 0.5.1
 Summary: MongoDB Engine
 Home-page: https://github.com/ranfysvalle02/mdb-engine
 Author: Fabian Valle

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mdb-engine"
-version = "0.4.14"
+version = "0.5.1"
 description = "MongoDB Engine"
 readme = "README.md"
 requires-python = ">=3.10"

{mdb_engine-0.4.14 → mdb_engine-0.5.1}/setup.py

@@ -14,7 +14,7 @@ if readme_file.exists():
 
 setup(
     name="mdb-engine",
-    version="0.4.14",
+    version="0.5.1",
     description="MongoDB Engine",
     long_description=long_description,
     long_description_content_type="text/markdown",