minder-cli 0.2.0__py3-none-any.whl

minder/auth/__init__.py

@@ -0,0 +1,12 @@
+from .service import AuthService, AuthError, UserRole, ROLE_HIERARCHY
+from .rbac import require_role
+from .middleware import AuthMiddleware
+
+__all__ = [
+    "AuthService",
+    "AuthError",
+    "UserRole",
+    "ROLE_HIERARCHY",
+    "require_role",
+    "AuthMiddleware",
+]

minder/auth/context.py

@@ -0,0 +1,26 @@
+from contextvars import ContextVar
+from typing import Optional
+
+from minder.auth.principal import Principal
+from minder.models.user import User
+
+_current_user: ContextVar[Optional[User]] = ContextVar("current_user", default=None)
+_current_principal: ContextVar[Optional[Principal]] = ContextVar("current_principal", default=None)
+
+def set_current_user(user: Optional[User]) -> None:
+    _current_user.set(user)
+
+def get_current_user() -> Optional[User]:
+    return _current_user.get()
+
+
+def set_current_principal(principal: Optional[Principal]) -> None:
+    _current_principal.set(principal)
+    if principal is None or not hasattr(principal, "user"):
+        _current_user.set(None)
+    else:
+        _current_user.set(getattr(principal, "user"))
+
+
+def get_current_principal() -> Optional[Principal]:
+    return _current_principal.get()

minder/auth/middleware.py

@@ -0,0 +1,70 @@
+"""
+Auth Middleware — JWT extraction and validation for SSE / HTTP connections.
+
+Usage:
+    middleware = AuthMiddleware(auth_service)
+    user = await middleware.authenticate(request.headers.get("Authorization"))
+"""
+
+from typing import Optional
+
+from minder.auth.principal import Principal
+from minder.auth.service import AuthError, AuthService
+from minder.models.user import User
+
+
+class AuthMiddleware:
+    """
+    Extracts Bearer JWT from the Authorization header and returns the
+    authenticated User.  Raises AuthError on any failure so callers can
+    convert it to the appropriate HTTP/transport error.
+    """
+
+    def __init__(self, auth_service: AuthService) -> None:
+        self._auth = auth_service
+
+    # ------------------------------------------------------------------
+    # Public API
+    # ------------------------------------------------------------------
+
+    def extract_bearer_token(self, authorization: Optional[str]) -> str:
+        """
+        Parse 'Bearer <token>' from the Authorization header value.
+
+        Raises:
+            AuthError(AUTH_MISSING_TOKEN)  — header absent or empty.
+            AuthError(AUTH_INVALID_HEADER) — wrong scheme or malformed.
+        """
+        if not authorization or not authorization.strip():
+            raise AuthError("AUTH_MISSING_TOKEN", "Authorization header is required")
+
+        parts = authorization.strip().split(" ", 1)
+        if len(parts) != 2 or parts[0].lower() != "bearer":
+            raise AuthError(
+                "AUTH_INVALID_HEADER",
+                "Authorization header must use 'Bearer <token>' scheme",
+            )
+        token = parts[1].strip()
+        if not token:
+            raise AuthError("AUTH_MISSING_TOKEN", "Bearer token value is empty")
+        return token
+
+    async def authenticate(self, authorization: Optional[str]) -> User:
+        """
+        Full authentication flow: extract token → validate JWT → return user.
+
+        Raises AuthError on any failure.
+        """
+        token = self.extract_bearer_token(authorization)
+        return await self._auth.get_user_from_jwt(token)
+
+    async def authenticate_principal(
+        self,
+        authorization: Optional[str] = None,
+        *,
+        client_key: Optional[str] = None,
+    ) -> Principal:
+        if client_key and client_key.strip():
+            return await self._auth.get_principal_from_client_key(client_key.strip())
+        token = self.extract_bearer_token(authorization)
+        return await self._auth.get_principal_from_token(token)

minder/auth/principal.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass, field
+from typing import Any
+
+from minder.models.user import User
+
+
+@dataclass(slots=True)
+class Principal:
+    principal_type: str
+    principal_id: uuid.UUID
+    role: str
+    scopes: list[str] = field(default_factory=list)
+    repo_scope: list[str] = field(default_factory=list)
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass(slots=True)
+class AdminUserPrincipal(Principal):
+    user: User | None = None
+
+    def __init__(self, user: User) -> None:
+        super().__init__(
+            principal_type="user",
+            principal_id=user.id,
+            role=user.role,
+            scopes=[],
+            repo_scope=[],
+            metadata={"email": user.email, "username": user.username},
+        )
+        self.user = user
+
+
+@dataclass(slots=True)
+class ClientPrincipal(Principal):
+    client_id: uuid.UUID = field(init=False)
+    client_slug: str = field(init=False)
+
+    def __init__(
+        self,
+        *,
+        client_id: uuid.UUID,
+        client_slug: str,
+        scopes: list[str],
+        repo_scope: list[str],
+        metadata: dict[str, Any] | None = None,
+    ) -> None:
+        super().__init__(
+            principal_type="client",
+            principal_id=client_id,
+            role="client",
+            scopes=scopes,
+            repo_scope=repo_scope,
+            metadata=metadata or {},
+        )
+        self.client_id = client_id
+        self.client_slug = client_slug

minder/auth/rate_limiter.py

@@ -0,0 +1,89 @@
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass
+
+from minder.auth.principal import Principal
+from minder.auth.service import AuthError
+from minder.config import MinderConfig
+from minder.store.interfaces import ICacheProvider
+
+
+class RateLimitError(AuthError):
+    def __init__(self, message: str) -> None:
+        super().__init__("AUTH_RATE_LIMITED", message)
+
+
+@dataclass(slots=True)
+class RateLimitDecision:
+    limit: int
+    count: int
+    remaining: int
+    reset_at: int
+
+
+class RateLimiter:
+    def __init__(
+        self,
+        *,
+        cache: ICacheProvider,
+        config: MinderConfig,
+    ) -> None:
+        self._cache = cache
+        self._config = config
+
+    def enabled(self) -> bool:
+        return self._config.rate_limit.enabled
+
+    def _limit_for_principal(self, principal: Principal) -> int:
+        if principal.principal_type == "client":
+            return self._config.rate_limit.client_limit
+        role = principal.role
+        if role == "admin":
+            return self._config.rate_limit.admin_limit
+        if role == "readonly":
+            return self._config.rate_limit.readonly_limit
+        return self._config.rate_limit.member_limit
+
+    def _key(self, principal: Principal, tool_name: str, window_start: int) -> str:
+        return f"rate_limit:{principal.principal_type}:{principal.principal_id}:{tool_name}:{window_start}"
+
+    async def enforce(self, *, principal: Principal, tool_name: str) -> RateLimitDecision:
+        limit = self._limit_for_principal(principal)
+        now = int(time.time())
+        window = self._config.rate_limit.window_seconds
+        window_start = now - (now % window)
+        reset_at = window_start + window
+        key = self._key(principal, tool_name, window_start)
+
+        count = await self._cache.incr(key)
+        if count == 1:
+            await self._cache.expire(key, window)
+
+        if count > limit:
+            raise RateLimitError(
+                f"Rate limit exceeded for {principal.principal_type} '{principal.principal_id}' on tool '{tool_name}'"
+            )
+
+        return RateLimitDecision(
+            limit=limit,
+            count=count,
+            remaining=max(limit - count, 0),
+            reset_at=reset_at,
+        )
+
+    async def get_usage(self, *, principal: Principal, tool_name: str) -> dict[str, int]:
+        limit = self._limit_for_principal(principal)
+        now = int(time.time())
+        window = self._config.rate_limit.window_seconds
+        window_start = now - (now % window)
+        reset_at = window_start + window
+        key = self._key(principal, tool_name, window_start)
+        raw = await self._cache.get(key)
+        count = int(raw or "0")
+        return {
+            "count": count,
+            "limit": limit,
+            "remaining": max(limit - count, 0),
+            "reset_at": reset_at,
+        }

minder/auth/rbac.py

@@ -0,0 +1,60 @@
+"""
+RBAC — role-based access control decorator.
+
+Usage:
+    @require_role(UserRole.ADMIN)
+    async def admin_only_handler(*args, user: User, **kwargs):
+        ...
+
+The decorated function must receive the authenticated `user` as a keyword arg.
+"""
+
+import functools
+from typing import Any, Callable
+
+from minder.auth.service import AuthError, ROLE_HIERARCHY, UserRole
+from minder.models.user import User
+
+
+def require_role(min_role: UserRole) -> Callable:
+    """
+    Decorator that enforces a minimum role on an async handler.
+
+    Raises:
+        AuthError(AUTH_NO_USER)            — if `user` kwarg is absent.
+        AuthError(AUTH_INSUFFICIENT_ROLE)  — if user's role is below min_role.
+    """
+
+    def decorator(func: Callable) -> Callable:
+        @functools.wraps(func)
+        async def wrapper(*args: Any, **kwargs: Any) -> Any:
+            user: User | None = kwargs.get("user")
+            if user is None:
+                raise AuthError(
+                    "AUTH_NO_USER",
+                    "No authenticated user provided to role-guarded handler",
+                )
+            try:
+                user_role = UserRole(user.role)
+            except ValueError:
+                raise AuthError(
+                    "AUTH_UNKNOWN_ROLE",
+                    f"Unrecognised role value: {user.role!r}",
+                )
+
+            user_level = ROLE_HIERARCHY.get(user_role, 0)
+            required_level = ROLE_HIERARCHY.get(min_role, 0)
+
+            if user_level < required_level:
+                raise AuthError(
+                    "AUTH_INSUFFICIENT_ROLE",
+                    (
+                        f"Role '{user_role.value}' is insufficient. "
+                        f"Required: '{min_role.value}' or higher."
+                    ),
+                )
+            return await func(*args, **kwargs)
+
+        return wrapper
+
+    return decorator