meerschaum 2.9.4__py3-none-any.whl → 3.0.0__py3-none-any.whl

meerschaum/api/_events.py

@@ -8,14 +8,16 @@ Declare FastAPI events in this module (startup, shutdown, etc.).
 
 import sys
 import os
-import time
 from meerschaum.api import (
     app,
     get_api_connector,
     get_cache_connector,
     get_uvicorn_config,
     debug,
+    webterm_port,
     no_dash,
+    _include_dash,
+    _include_webterm,
 )
 from meerschaum.utils.debug import dprint
 from meerschaum.connectors.poll import retry_connect
@@ -25,7 +27,7 @@ from meerschaum.jobs import (
     start_check_jobs_thread,
     stop_check_jobs_thread,
 )
-from meerschaum.config.static import STATIC_CONFIG
+from meerschaum._internal.static import STATIC_CONFIG
 
 TEMP_PREFIX: str = STATIC_CONFIG['api']['jobs']['temp_prefix']
 
@@ -35,10 +37,45 @@ async def startup():
     """
     Connect to the instance database and begin monitoring jobs.
     """
+    app.openapi_schema = app.openapi()
+
+    ### Remove the implicitly added HTTPBearer scheme if it exists.
+    if 'BearerAuth' in app.openapi_schema['components']['securitySchemes']:
+        del app.openapi_schema['components']['securitySchemes']['BearerAuth']
+    elif 'HTTPBearer' in app.openapi_schema['components']['securitySchemes']:
+        del app.openapi_schema['components']['securitySchemes']['HTTPBearer']
+    if 'LoginManager' in app.openapi_schema['components']['securitySchemes']:
+        del app.openapi_schema['components']['securitySchemes']['LoginManager']
+
+    scopes = STATIC_CONFIG['tokens']['scopes']
+    app.openapi_schema['components']['securitySchemes']['OAuth2PasswordBearer'] = {
+        'type': 'oauth2',
+        'flows': {
+            'password': {
+                'tokenUrl': STATIC_CONFIG['api']['endpoints']['login'],
+                'scopes': scopes,
+            },
+        },
+    }
+    app.openapi_schema['components']['securitySchemes']['APIKey'] = {
+        'type': 'http',
+        'scheme': 'bearer',
+        'bearerFormat': 'mrsm-key:{client_id}:{client_secret}',
+        'description': 'Authentication using a Meerschaum API Key.',
+    }
+    app.openapi_schema['security'] = [
+        {
+            'OAuth2PasswordBearer': [],
+        },
+        {
+            'APIKey': [],
+        }
+    ]
+
     try:
-        if not no_dash:
+        if _include_webterm:
             from meerschaum.api.dash.webterm import start_webterm
-            start_webterm()
+            start_webterm(webterm_port=webterm_port)
 
         connected = retry_connect(
             get_api_connector(),
@@ -61,6 +98,11 @@ async def startup():
         await shutdown()
         os._exit(1)
 
+    conn = get_api_connector()
+    if conn.type == 'sql':
+        from meerschaum.connectors.sql.tables import get_tables
+        _ = get_tables(conn, refresh=True, create=True, debug=debug)
+
     start_check_jobs_thread()
 
 

meerschaum/api/_oauth2.py

@@ -7,21 +7,35 @@ Define JWT authorization here.
 """
 
 import os
-from meerschaum.api import app, endpoints, CHECK_UPDATE
+import base64
+import functools
+import inspect
+from typing import List, Optional, Union
+
+from meerschaum.api import endpoints, CHECK_UPDATE, no_auth, debug
+from meerschaum.api._tokens import optional_token, get_token_from_authorization
+from meerschaum._internal.static import STATIC_CONFIG
 from meerschaum.utils.packages import attempt_import
-fastapi = attempt_import('fastapi', lazy=False, check_update=CHECK_UPDATE)
+from meerschaum.core import User, Token
+
+fastapi, starlette = attempt_import('fastapi', 'starlette', lazy=False, check_update=CHECK_UPDATE)
 fastapi_responses = attempt_import('fastapi.responses', lazy=False, check_update=CHECK_UPDATE)
 fastapi_login = attempt_import('fastapi_login', check_update=CHECK_UPDATE)
+jose_jwt, jose_exceptions = attempt_import('jose.jwt', 'jose.exceptions', lazy=False, check_update=CHECK_UPDATE)
+from fastapi import Depends, HTTPException, Request
+from starlette import status
+
 
 class CustomOAuth2PasswordRequestForm:
     def __init__(
         self,
         grant_type: str = fastapi.Form(None, regex="password|client_credentials"),
-        username: str = fastapi.Form(...),
-        password: str = fastapi.Form(...),
-        scope: str = fastapi.Form(""),
-        client_id: str = fastapi.Form(None),
-        client_secret: str = fastapi.Form(None),
+        username: Optional[str] = fastapi.Form(None),
+        password: Optional[str] = fastapi.Form(None),
+        scope: str = fastapi.Form(" ".join(STATIC_CONFIG['tokens']['scopes'])),
+        client_id: Optional[str] = fastapi.Form(None),
+        client_secret: Optional[str] = fastapi.Form(None),
+        authorization: Optional[str] = fastapi.Header(None),
     ):
         self.grant_type = grant_type
         self.username = username
@@ -30,9 +44,144 @@ class CustomOAuth2PasswordRequestForm:
         self.client_id = client_id
         self.client_secret = client_secret
 
+        if (
+            not username
+            and not password
+            and not self.client_id
+            and not self.client_secret
+            and authorization
+        ):
+            try:
+                scheme, credentials = authorization.split()
+                if credentials.startswith('mrsm-key:'):
+                    credentials = credentials[len('mrsm-key:'):]
+                if scheme.lower() in ('basic', 'bearer'):
+                    decoded_credentials = base64.b64decode(credentials).decode('utf-8')
+                    _client_id, _client_secret = decoded_credentials.split(':', 1)
+                    self.client_id = _client_id
+                    self.client_secret = _client_secret
+                    self.grant_type = 'client_credentials'
+            except ValueError:
+                pass
+
+
+async def optional_user(request: Request) -> Optional[User]:
+    """
+    FastAPI dependency that returns a User if logged in, otherwise None.
+    """
+    if no_auth:
+        return None
+    return await manager(request)
+    try:
+        return await manager(request)
+    except HTTPException:
+        return None
+
+
+async def load_user_or_token(
+    request: Request,
+    users: bool = True,
+    tokens: bool = True,
+) -> Union[User, Token, None]:
+    """
+    Load the current user or token.
+    """
+    authorization = request.headers.get('authorization', request.headers.get('Authorization', None))
+    if not authorization:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated.",
+        )
+
+    authorization = authorization.replace('Basic ', '').replace('Bearer ', '')
+    if not authorization.startswith('mrsm-key:'):
+        if not users:
+            raise HTTPException(
+                status=status.HTTP_401_UNAUTHORIZED,
+                detail="Users not authenticated for this endpoint.",
+            )
+
+        return await manager(request)
+
+    if not tokens:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Tokens not authenticated for this endpoint.",
+        )
+
+    return get_token_from_authorization(authorization)
+
+
+def ScopedAuth(scopes: List[str]):
+    """
+    Dependency factory for authenticating with either a user session or a scoped token.
+    """
+    async def _authenticate(
+        request: Request,
+        user_or_token: Union[User, Token, None] = Depends(
+            load_user_or_token,
+        ),
+    ) -> Union[User, Token, None]:
+        if no_auth:
+            return None
+
+        if not user_or_token:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Not authenticated.",
+                headers={"WWW-Authenticate": "Basic"},
+            )
+
+        authorization = request.headers.get('authorization', request.headers.get('Authorization', None))
+        is_long_lived = authorization and 'mrsm-key:' in authorization
+
+        current_scopes = []
+        ### For long-lived API tokens, always hit the database.
+        if is_long_lived:
+            current_scopes = user_or_token.get_scopes(refresh=True, debug=debug)
+        
+        ### For JWTs, trust the scopes in the token.
+        else:
+            if not authorization:
+                # This should be caught by `load_user_or_token` but we can be safe.
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Not authenticated.",
+                )
+            
+            scheme, _, token_str = authorization.partition(' ')
+            if not token_str or scheme.lower() != 'bearer':
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Unsupported authentication scheme.",
+                )
+
+            try:
+                payload = jose_jwt.decode(token_str, SECRET, algorithms=['HS256'])
+                current_scopes = payload.get('scopes', [])
+            except jose_exceptions.JWTError:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Invalid access token.",
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
+
+        if '*' in current_scopes:
+            return user_or_token
+
+        for scope in scopes:
+            if scope not in current_scopes:
+                raise HTTPException(
+                    status_code=status.HTTP_403_FORBIDDEN,
+                    detail=f"Missing required scope: '{scope}'",
+                )
+        
+        return user_or_token
+    return _authenticate
+
 
 LoginManager = fastapi_login.LoginManager
-def generate_secret_key() -> str:
+def generate_secret_key() -> bytes:
     """
     Read or generate the secret keyfile.
     """
@@ -49,4 +198,8 @@ def generate_secret_key() -> str:
 
 
 SECRET = generate_secret_key()
-manager = LoginManager(SECRET, token_url=endpoints['login'])
+manager = LoginManager(
+    SECRET,
+    token_url=endpoints['login'],
+    scopes=STATIC_CONFIG['tokens']['scopes'],
+)

meerschaum/api/_tokens.py

@@ -0,0 +1,102 @@
+#! /usr/bin/env python3
+# vim:fenc=utf-8
+
+"""
+Define the authentication logic for Meerschaum Tokens.
+"""
+
+import base64
+import uuid
+from typing import Optional, Union, List
+from datetime import datetime, timezone
+
+from fastapi import Depends, HTTPException, Request
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from starlette import status
+
+import meerschaum as mrsm
+from meerschaum.api import (
+    get_api_connector,
+    debug,
+)
+from meerschaum.core import Token, User
+from meerschaum.core.User import verify_password
+
+
+http_bearer = HTTPBearer(auto_error=False, scheme_name="APIKey")
+
+
+def get_token_from_authorization(authorization: str) -> Token:
+    """
+    Helper function to decode and verify a token from credentials.
+    Raises HTTPException on failure.
+    """
+    if authorization.startswith('mrsm-key:'):
+        authorization = authorization[len('mrsm-key:'):]
+    try:
+        credential_string = base64.b64decode(authorization).decode('utf-8')
+        token_id_str, secret = credential_string.split(':', 1)
+        token_id = uuid.UUID(token_id_str)
+    except Exception:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token format. Expected Base64-encoded 'token_id:secret'.",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    conn = get_api_connector()
+    token = conn.get_token(token_id)
+
+    if not token or not token.is_valid:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or revoked token.",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    if token.get_expiration_status(debug=debug):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Token has expired.",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    if not verify_password(secret, token.secret_hash):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid secret.",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    return token
+
+
+def get_current_token(
+    auth_creds: Optional[HTTPAuthorizationCredentials] = Depends(http_bearer),
+) -> Token:
+    """
+    FastAPI dependency to authenticate a request with a Meerschaum Token.
+    This dependency will fail if no token is provided.
+    """
+    if auth_creds is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated.",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return get_token_from_authorization(auth_creds.credentials)
+
+
+async def optional_token(
+    auth_creds: Optional[HTTPAuthorizationCredentials] = Depends(http_bearer),
+) -> Optional[Token]:
+    """
+    FastAPI dependency that returns a Token if provided, otherwise None.
+    """
+    if not auth_creds:
+        return None
+
+    try:
+        return get_token_from_authorization(auth_creds.credentials)
+    except HTTPException as e:
+        return None

meerschaum/api/dash/__init__.py

@@ -12,14 +12,11 @@ from meerschaum.utils.packages import (
     attempt_import,
     import_dcc,
     import_html,
-    _monkey_patch_get_distribution,
 )
 flask_compress = attempt_import('flask_compress', lazy=False)
-_monkey_patch_get_distribution('flask-compress', flask_compress.__version__)
 dash = attempt_import('dash', lazy=False)
 
 from meerschaum.utils.typing import List, Optional
-from meerschaum.config.static import _static_config
 from meerschaum.api import (
     app as fastapi_app,
     debug,

meerschaum/api/dash/callbacks/__init__.py

@@ -10,6 +10,7 @@ from meerschaum.api import debug as _debug
 import meerschaum.api.dash.callbacks.dashboard
 import meerschaum.api.dash.callbacks.login
 import meerschaum.api.dash.callbacks.plugins
+import meerschaum.api.dash.callbacks.tokens
 import meerschaum.api.dash.callbacks.jobs
 import meerschaum.api.dash.callbacks.register
 import meerschaum.api.dash.callbacks.pipes

meerschaum/api/dash/callbacks/custom.py

@@ -7,7 +7,6 @@ Import custom callbacks created by plugins.
 """
 
 import traceback
-from typing import Any, Dict
 
 from meerschaum.api.dash import dash_app
 from meerschaum.plugins import _dash_plugins, _plugin_endpoints_to_pages
@@ -36,9 +35,9 @@ def add_plugin_pages(debug: bool = False):
     """
     Allow users to add pages via the `@web_page` decorator.
     """
-    for plugin_name, pages_dicts in _plugin_endpoints_to_pages.items():
+    for page_group, pages_dicts in _plugin_endpoints_to_pages.items():
         if debug:
-            dprint(f"Adding pages from plugin '{plugin_name}'...")
+            dprint(f"Adding pages for group '{page_group}'...")
         for _endpoint, _page_dict in pages_dicts.items():
             page_layout = _page_dict['function']()
             if not _page_dict['skip_navbar']:
@@ -47,6 +46,8 @@ def add_plugin_pages(debug: bool = False):
                 else:
                     page_layout = [pages_navbar, page_layout]
             _pages[_page_dict['page_key']] = _endpoint
+            if not _endpoint.lstrip('/').startswith('dash'):
+                _endpoint = '/dash/' + _endpoint.lstrip('/')
             _paths[_endpoint] = page_layout
             if _page_dict['login_required']:
                 _required_login.add(_endpoint)