meerschaum 2.9.4__py3-none-any.whl → 3.0.0__py3-none-any.whl

meerschaum/api/routes/_login.py

@@ -6,29 +6,79 @@
 Manage access and refresh tokens.
 """
 
+import uuid
 from datetime import datetime, timedelta, timezone
+from typing import Union
 
 import fastapi
-from fastapi import Request, status
+from fastapi import Request, status, Response
 from fastapi_login.exceptions import InvalidCredentialsException
 from fastapi.exceptions import RequestValidationError
 from starlette.responses import JSONResponse
 
-from meerschaum.api import endpoints, get_api_connector, app, debug, manager, no_auth
+import meerschaum as mrsm
+from meerschaum.api import (
+    endpoints,
+    get_api_connector,
+    get_cache_connector,
+    app,
+    debug,
+    manager,
+    no_auth,
+)
 from meerschaum.core import User
-from meerschaum.config.static import STATIC_CONFIG
+from meerschaum._internal.static import STATIC_CONFIG
 from meerschaum.utils.typing import Dict, Any
-from meerschaum.core.User._User import verify_password
+from meerschaum.utils.misc import is_uuid, is_int
+from meerschaum.core.User import verify_password
 from meerschaum.utils.warnings import warn
 from meerschaum.api._oauth2 import CustomOAuth2PasswordRequestForm
 
 
+USER_ID_CACHE_EXPIRES_SECONDS: int = mrsm.get_config('system', 'api', 'cache', 'session_expires_minutes') * 60
+_active_user_ids = {}
+
+
 @manager.user_loader()
-def load_user(username: str) -> User:
+def load_user_or_token_from_manager(username_or_token_id: str) -> User:
     """
     Create the `meerschaum.core.User` object from the username.
     """
-    return User(username, instance=get_api_connector())
+    cache_conn = get_cache_connector()
+    api_conn = get_api_connector()
+
+    is_token = is_uuid(username_or_token_id)
+
+    if is_token:
+        return api_conn.get_token(username_or_token_id)
+
+    username = username_or_token_id
+
+    cached_user_id = (
+        _active_user_ids.get(username)
+        if cache_conn is None
+        else cache_conn.get(f'mrsm:users:{username}:id')
+    )
+    if isinstance(cached_user_id, str):
+        if is_int(cached_user_id):
+            cached_user_id = int(cached_user_id)
+        elif is_uuid(cached_user_id):
+            cached_user_id = uuid.UUID(cached_user_id)
+
+    user = User(username, instance=api_conn, user_id=cached_user_id)
+
+    if cached_user_id is not None:
+        return user
+
+    user_id = api_conn.get_user_id(user)
+    if user_id is not None:
+        user._user_id = user_id
+        if cache_conn is not None:
+            cache_conn.set(f'mrsm:users:{username}:id', str(user_id), ex=USER_ID_CACHE_EXPIRES_SECONDS)
+        else:
+            _active_user_ids[username] = user_id
+    return user
+
 
 
 @app.post(endpoints['login'], tags=['Users'])
@@ -39,26 +89,81 @@ def login(
     Login and set the session token.
     """
     username, password = (
-        (data['username'], data['password'])
+        (data.get('username', None), data.get('password', None))
         if isinstance(data, dict)
         else (data.username, data.password)
-    ) if not no_auth else ('no-auth', 'no-auth')
-
-    user = User(username, password)
-    correct_password = no_auth or verify_password(
-        password,
-        get_api_connector().get_user_password_hash(user, debug=debug)
     )
-    if not correct_password:
+    client_id, client_secret = (
+        (data.get('client_id', None), data.get('client_secret', None))
+        if isinstance(data, dict)
+        else (data.client_id, data.client_secret)
+    )
+    grant_type = (
+        data.get('grant_type', None)
+        if isinstance(data, dict)
+        else data.grant_type
+    )
+    if not grant_type:
+        grant_type = (
+            'password'
+            if username and password
+            else 'client_credentials'
+        )
+
+    allowed_scopes = []
+    type_ = None
+    expires_dt: Union[datetime, None] = None
+    sub_id = None
+    if grant_type == 'password':
+        user = User(str(username), str(password), instance=get_api_connector())
+        correct_password = no_auth or verify_password(
+            str(password),
+            get_api_connector().get_user_password_hash(user, debug=debug)
+        )
+        if not correct_password:
+            raise InvalidCredentialsException
+
+        allowed_scopes = user.get_scopes(debug=debug)
+        type_ = get_api_connector().get_user_type(user, debug=debug)
+        sub_id = username
+
+    elif grant_type == 'client_credentials':
+        if not is_uuid(str(client_id)):
+            raise InvalidCredentialsException
+        token_id = uuid.UUID(client_id)
+        correct_password = no_auth or verify_password(
+            str(client_secret),
+            str(get_api_connector().get_token_secret_hash(token_id, debug=debug))
+        )
+        if not correct_password:
+            raise InvalidCredentialsException
+
+        allowed_scopes = get_api_connector().get_token_scopes(token_id, debug=debug)
+        sub_id = client_id
+
+    else:
         raise InvalidCredentialsException
 
+    requested_scopes = data.scope.split()
+    if '*' in allowed_scopes:
+        final_scopes = requested_scopes or ['*']
+    else:
+        final_scopes = [
+            s for s in requested_scopes if s in allowed_scopes
+        ] if requested_scopes else allowed_scopes
+
     expires_minutes = STATIC_CONFIG['api']['oauth']['token_expires_minutes']
     expires_delta = timedelta(minutes=expires_minutes)
     expires_dt = datetime.now(timezone.utc).replace(tzinfo=None) + expires_delta
     access_token = manager.create_access_token(
-        data={'sub': username},
+        data={
+            'sub': sub_id,
+            'scopes': final_scopes,
+            'type': type_,
+        },
         expires=expires_delta
     )
+
     return {
         'access_token': access_token,
         'token_type': 'bearer',

meerschaum/api/routes/_misc.py

@@ -19,7 +19,8 @@ from meerschaum.api import (
     debug,
     get_api_connector,
     private,
-    manager
+    manager,
+    ScopedAuth,
 )
 from meerschaum.config.paths import API_STATIC_PATH
 from meerschaum import __version__ as version
@@ -38,9 +39,7 @@ def get_favicon() -> Any:
 
 @app.get(endpoints['chaining'], tags=['Misc'])
 def get_chaining_status(
-    curr_user = (
-        fastapi.Depends(manager) if private else None
-    ),
+    curr_user = fastapi.Depends(ScopedAuth(['instance:read'])) if private else None,
 ) -> bool:
     """
     Return whether this API instance may be chained.
@@ -50,9 +49,7 @@ def get_chaining_status(
 
 @app.get(endpoints['info'], tags=['Misc'])
 def get_instance_info(
-    curr_user = (
-        fastapi.Depends(manager) if private else None
-    ),
+    curr_user = fastapi.Depends(ScopedAuth(['instance:read'])) if private else None,
     instance_keys: Optional[str] = None,
 ) -> Dict[str, Union[str, int]]:
     """
@@ -87,9 +84,7 @@ def get_healtheck(instance_keys: Optional[str] = None) -> Dict[str, Any]:
 if debug:
     @app.get('/id', tags=['Misc'])
     def get_ids(
-        curr_user = (
-            fastapi.Depends(manager) if private else None
-        ),
+        curr_user = fastapi.Depends(ScopedAuth(['instance:read'])) if private else None,
     ) -> Dict[str, Union[int, str]]:
         return {
             'server': SERVER_ID,