monkeybrain-runtime 1.0.0__py3-none-any.whl

services/auth/helpers/tokens.py

@@ -0,0 +1,71 @@
+from datetime import datetime, timedelta, timezone
+from typing import Any
+
+from jose import JWTError, jwt
+
+from services.common.config import settings
+
+
+def _create_token(data: dict, secret: str, expires_delta: timedelta) -> str:
+    payload = data.copy()
+    payload["exp"] = datetime.now(timezone.utc) + expires_delta
+    return jwt.encode(payload, secret, algorithm=settings.ALGORITHM)
+
+
+def _permission_claim(permission: Any) -> str | None:
+    if hasattr(permission, "model_dump"):
+        permission = permission.model_dump(mode="python")
+    if isinstance(permission, str):
+        return permission
+    if not isinstance(permission, dict):
+        return None
+    permission_id = permission.get("permission_id")
+    return str(permission_id) if permission_id else None
+
+
+def create_access_token(user_id: str, email: str, role: str, permissions: list | None = None) -> str:
+    serialized = sorted({
+        claim
+        for permission in (permissions or [])
+        if (claim := _permission_claim(permission))
+    })
+    return _create_token(
+        {"sub": user_id, "email": email, "role": role, "permissions": serialized},
+        settings.ACCESS_TOKEN_SECRET,
+        timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES),
+    )
+
+def create_refresh_token(user_id: str) -> str:
+    return _create_token(
+        {"sub": user_id},
+        settings.REFRESH_TOKEN_SECRET,
+        timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS),
+    )
+
+
+def create_mfa_challenge_token(user_id: str) -> str:
+    return _create_token(
+        {"sub": user_id, "purpose": "mfa_challenge"},
+        settings.ACCESS_TOKEN_SECRET,
+        timedelta(minutes=5),
+    )
+
+
+def decode_access_token(token: str) -> dict:
+    """Raises JWTError on invalid/expired token."""
+    payload = jwt.decode(token, settings.ACCESS_TOKEN_SECRET, algorithms=[settings.ALGORITHM])
+    if "permissions" not in payload and isinstance(payload.get("perms"), str):
+        payload["permissions"] = [permission for permission in payload["perms"].split(",") if permission]
+    return payload
+
+
+def decode_refresh_token(token: str) -> dict:
+    """Raises JWTError on invalid/expired token."""
+    return jwt.decode(token, settings.REFRESH_TOKEN_SECRET, algorithms=[settings.ALGORITHM])
+
+
+def decode_mfa_challenge_token(token: str) -> dict:
+    payload = jwt.decode(token, settings.ACCESS_TOKEN_SECRET, algorithms=[settings.ALGORITHM])
+    if payload.get("purpose") != "mfa_challenge":
+        raise JWTError("Invalid MFA challenge token")
+    return payload

services/auth/helpers/users.py

@@ -0,0 +1,119 @@
+from typing import Optional
+import bcrypt
+import re
+from motor.motor_asyncio import AsyncIOMotorDatabase
+from services.auth.models.users import UserEntryCreate, UserEntryResponse, UserEntryUpdate
+
+COLLECTION = "users"
+
+def _serialize(doc: dict) -> dict:
+    doc = dict(doc)
+    doc.pop("_id", None)
+    return doc
+
+
+# ── Read ──────────────────────────────────────────────────────────────────────
+
+async def get_all(
+    db: AsyncIOMotorDatabase,
+    page: int = 1,
+    page_size: int = 20,
+) -> tuple[list[dict], int]:
+    query: dict = {}
+    total = await db[COLLECTION].count_documents(query)
+    cursor = db[COLLECTION].find(query).skip((page - 1) * page_size).limit(page_size)
+    results = [_serialize(d) async for d in cursor]
+    return results, total
+
+
+async def get_by_id(db: AsyncIOMotorDatabase, user_id: str) -> Optional[dict]:
+    doc = await db[COLLECTION].find_one({"user_id": user_id})
+    return _serialize(doc) if doc else None
+
+
+async def get_by_employee_id(db: AsyncIOMotorDatabase, employee_id: str) -> Optional[dict]:
+    doc = await db[COLLECTION].find_one({"employee_id": employee_id})
+    return _serialize(doc) if doc else None
+
+
+async def get_by_department(db: AsyncIOMotorDatabase, department: str) -> list[dict]:
+    cursor = db[COLLECTION].find({"department": department})
+    return [_serialize(d) async for d in cursor]
+
+
+async def get_by_team(db: AsyncIOMotorDatabase, team: str) -> list[dict]:
+    cursor = db[COLLECTION].find({"team": team})
+    return [_serialize(d) async for d in cursor]
+
+async def get_by_email(db: AsyncIOMotorDatabase, email: str) -> list[dict]:
+    normalized_email = email.strip().lower()
+    cursor = db[COLLECTION].find({"email": normalized_email})
+    return [_serialize(d) async for d in cursor]
+
+async def get_by_username(db: AsyncIOMotorDatabase, username: str):
+    cursor = db[COLLECTION].find({"name": username})
+    return [_serialize(d) async for d in cursor]
+
+# ── Create ────────────────────────────────────────────────────────────────────
+
+async def create(db: AsyncIOMotorDatabase, data: UserEntryCreate) -> dict:
+    doc = data.model_dump()
+    password = data.password.get_secret_value()
+    validate_password_policy(password)
+    doc["password"] = _hash(password)
+    await db[COLLECTION].insert_one(doc)
+    return _serialize(doc)
+
+# ── Update ────────────────────────────────────────────────────────────────────
+
+async def update(
+    db: AsyncIOMotorDatabase,
+    user_id: str,
+    data: UserEntryUpdate,
+) -> Optional[dict]:
+    fields = data.model_dump(exclude_unset=True)
+    if not fields:
+        return await get_by_id(db, user_id)
+    password = fields.get("password")
+    if password is None:
+        fields.pop("password", None)
+    else:
+        password_value = password.get_secret_value() if hasattr(password, "get_secret_value") else str(password)
+        validate_password_policy(password_value)
+        fields["password"] = _hash(password_value)
+    if not fields:
+        return await get_by_id(db, user_id)
+    result = await db[COLLECTION].find_one_and_update(
+        {"user_id": user_id},
+        {"$set": fields},
+        return_document=True,
+    )
+    return _serialize(result) if result else None
+
+
+# ── Delete ────────────────────────────────────────────────────────────────────
+
+async def delete(db: AsyncIOMotorDatabase, user_id: str) -> bool:
+    result = await db[COLLECTION].delete_one({"user_id": user_id})
+    return result.deleted_count == 1
+
+
+def _hash(password: str) -> str:
+    return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return bcrypt.checkpw(plain.encode(), hashed.encode())
+
+
+def validate_password_policy(password: str) -> None:
+    checks = [
+        (len(password) >= 12, "at least 12 characters"),
+        (re.search(r"[A-Z]", password), "an uppercase letter"),
+        (re.search(r"[a-z]", password), "a lowercase letter"),
+        (re.search(r"\d", password), "a number"),
+        (re.search(r"[^A-Za-z0-9]", password), "a special character"),
+    ]
+    missing = [message for ok, message in checks if not ok]
+    if missing:
+        raise ValueError("Password must contain " + ", ".join(missing))

services/auth/helpers/websocket_broadcast.py

@@ -0,0 +1,41 @@
+import asyncio
+import logging
+
+from fastapi import WebSocket
+from starlette.websockets import WebSocketState
+
+
+log = logging.getLogger(__name__)
+_connections: set[WebSocket] = set()
+_lock = asyncio.Lock()
+
+
+async def add_connection(websocket: WebSocket) -> None:
+    async with _lock:
+        _connections.add(websocket)
+
+
+async def remove_connection(websocket: WebSocket) -> None:
+    async with _lock:
+        _connections.discard(websocket)
+
+
+async def broadcast_event(event: dict) -> None:
+    async with _lock:
+        connections = list(_connections)
+
+    stale_connections: list[WebSocket] = []
+    for websocket in connections:
+        if websocket.application_state != WebSocketState.CONNECTED:
+            stale_connections.append(websocket)
+            continue
+        try:
+            await websocket.send_json(event)
+        except Exception:
+            stale_connections.append(websocket)
+            log.exception("Failed to send NATS event to websocket client")
+
+    if stale_connections:
+        async with _lock:
+            for websocket in stale_connections:
+                _connections.discard(websocket)

services/auth/main.py

@@ -0,0 +1,88 @@
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from services.common.logging import configure_service_logging, install_request_logging
+from services.common.mongo_cdc_watcher import cdc_watcher_status, start_mongo_cdc_watcher, stop_mongo_cdc_watcher
+from services.common.tracing import install_route_tracing
+
+from services.common.db import close_db, connect_db, get_database
+from services.auth.helpers.audit_elasticsearch_sync import start_audit_elasticsearch_sync, stop_audit_elasticsearch_sync
+from services.auth.helpers.graph_store import close_graph_driver
+from services.auth.helpers.influx_store import ensure_event_measurements
+from services.auth.helpers.nats_consumer import consumer_status, start_influx_event_consumer, stop_influx_event_consumer
+from services.auth.helpers.nats_store import close_nats_client
+from services.auth.routers.auth import router as auth_router
+from services.auth.routers.me import router as me_router
+from services.auth.routers.users import router as users_router
+from services.auth.routers.roles import router as roles_router
+from services.auth.routers.permissions import router as permissions_router
+from services.auth.routers.departments import router as departments_router
+from services.auth.routers.teams import router as teams_router
+from services.auth.routers.team_members import router as members_router
+from services.auth.routers.session import router as session_router
+from services.auth.routers.websocket_events import router as websocket_events_router
+from services.auth.routers.integration_config import router as integration_config_router
+
+
+logger = configure_service_logging("auth")
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    await connect_db()
+    await ensure_event_measurements()
+    await start_audit_elasticsearch_sync(get_database())
+    await start_influx_event_consumer()
+    await start_mongo_cdc_watcher(get_database().raw_database)
+    yield
+    await stop_mongo_cdc_watcher()
+    await stop_audit_elasticsearch_sync()
+    await stop_influx_event_consumer()
+    await close_nats_client()
+    await close_graph_driver()
+    await close_db()
+
+
+app = FastAPI(
+    title="Auth and Organization Service",
+    description="Microservice for auth and organization service.",
+    version="1.0.0",
+    lifespan=lifespan,
+)
+install_request_logging(app, "auth")
+install_route_tracing(app, "auth")
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(auth_router, prefix="/api/v1/auth", tags=["Auth"])
+app.include_router(auth_router, prefix="/api/auth", tags=["Auth-Frontend"])  # Frontend compatibility
+app.include_router(me_router, prefix="/api/v1/me", tags=["Me"])
+app.include_router(users_router, prefix="/api/v1/users", tags=["Users"])
+app.include_router(roles_router, prefix="/api/v1/roles", tags=["Roles"])
+app.include_router(permissions_router, prefix="/api/v1/permissions", tags=["Permissions"])
+app.include_router(departments_router, prefix="/api/v1/departments", tags=["Departments"])
+app.include_router(teams_router, prefix="/api/v1/teams", tags=["Teams"])
+app.include_router(members_router, prefix="/api/v1/members", tags=["Members"])
+app.include_router(session_router, prefix="/api/v1/session", tags=["Session"])
+app.include_router(websocket_events_router, prefix="/api/v1/ws", tags=["WebSocket Events"])
+app.include_router(integration_config_router, prefix="/integration-config", tags=["Integration Config"])
+app.include_router(integration_config_router, prefix="/api/v1/integration-config", tags=["Integration Config"])
+
+
+@app.get("/health", tags=["Health"])
+async def health_check():
+    nats_status = consumer_status()
+    return {
+        "status": "healthy",
+        "nats_consumers": nats_status,
+        "approval_audit_consumer": nats_status["approval_audit_consumer"],
+        "audit_consumer": nats_status["audit_consumer"],
+        "mongo_cdc_watcher": cdc_watcher_status(),
+    }

services/auth/models/__init__.py

@@ -0,0 +1,12 @@
+"""auth service models package."""
+
+__all__ = [
+    "departments",
+    "login",
+    "permissions",
+    "roles",
+    "session",
+    "teamMembers",
+    "teams",
+    "users",
+]

services/auth/models/departments.py

@@ -0,0 +1,55 @@
+from datetime import datetime, timezone
+from typing import Optional, List
+from pydantic import BaseModel, Field, model_validator
+
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+class Department(BaseModel):
+    department_id: str           = Field(..., min_length=1)
+    name:          str           = Field(..., min_length=1)
+    description:   Optional[str] = None
+    head_user_id:  Optional[str] = None   # references UserEntry.user_id
+    is_active:     bool          = True
+    
+    created_at: datetime = Field(default_factory=utc_now)
+    updated_at: datetime = Field(default_factory=utc_now)
+
+    @model_validator(mode="after")
+    def normalize_datetimes(self) -> "Department":
+        self.created_at = ensure_utc(self.created_at)
+        self.updated_at = ensure_utc(self.updated_at)
+        return self
+
+
+class DepartmentCreate(Department):
+    pass
+
+
+class DepartmentUpdate(BaseModel):
+    name:         Optional[str]  = None
+    description:  Optional[str]  = None
+    head_user_id: Optional[str]  = None
+    is_active:    Optional[bool] = None
+    updated_at: datetime = Field(default_factory=utc_now)
+
+
+class DepartmentResponse(Department):
+    class Config:
+        from_attributes = True
+
+
+class PaginatedDepartmentResponse(BaseModel):
+    total:     int
+    page:      int
+    page_size: int
+    results:   List[DepartmentResponse]

services/auth/models/login.py

@@ -0,0 +1,20 @@
+from typing import Optional
+from pydantic import BaseModel
+
+
+class LoginRequest(BaseModel):
+    email: str
+    password: str
+
+ 
+class TokenResponse(BaseModel):
+    access_token: str | None = None
+    refresh_token: str | None = None
+    token_type: str = "bearer"
+    mfa_required: bool = False
+    mfa_challenge_token: str | None = None
+ 
+class RefreshTokenRequest(BaseModel):
+    refresh_token: str
+
+ 

services/auth/models/permissions.py

@@ -0,0 +1,61 @@
+from datetime import datetime, timezone
+from typing import Optional, List
+from pydantic import BaseModel, Field, model_validator
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+
+# ---------------------------------------------------------------------------
+# Permission
+# ---------------------------------------------------------------------------
+class Permission(BaseModel):
+    permission_id: str           = Field(..., min_length=1)
+    role_id:       Optional[str] = None
+    name:          str           = Field(..., min_length=1)
+    resource:      str           = Field(..., min_length=1)
+    action:        str           = Field(..., min_length=1)
+    description:   Optional[str] = None
+    is_active:     bool          = True
+    created_at:    datetime      = Field(default_factory=utc_now)
+    updated_at:    datetime      = Field(default_factory=utc_now)
+
+    @model_validator(mode="after")
+    def normalize_datetimes(self) -> "Permission":
+        self.created_at = ensure_utc(self.created_at)
+        self.updated_at = ensure_utc(self.updated_at)
+        return self
+
+
+class PermissionCreate(Permission):
+    pass
+
+
+class PermissionUpdate(BaseModel):
+    role_id:     Optional[str]  = None
+    name:        Optional[str]  = None
+    resource:    Optional[str]  = None
+    action:      Optional[str]  = None
+    description: Optional[str]  = None
+    is_active:   Optional[bool] = None
+    updated_at:  datetime       = Field(default_factory=utc_now)
+
+
+class PermissionResponse(Permission):
+    class Config:
+        from_attributes = True
+
+
+class PaginatedPermissionResponse(BaseModel):
+    total:     int
+    page:      int
+    page_size: int
+    results:   List[PermissionResponse]

services/auth/models/roles.py

@@ -0,0 +1,53 @@
+from datetime import datetime, timezone
+from typing import Optional, List
+from pydantic import BaseModel, Field, model_validator
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+class Role(BaseModel):
+    role_id:        str        = Field(..., min_length=1)
+    name:           str        = Field(..., min_length=1)
+    description:    Optional[str] = None
+    permissions: List[str]  = Field(default_factory=list)  # references Permission.permission_id
+    is_active:      bool       = True
+    created_at: datetime = Field(default_factory=utc_now)
+    updated_at: datetime = Field(default_factory=utc_now)
+
+    @model_validator(mode="after")
+    def normalize_datetimes(self) -> "Role":
+        self.created_at = ensure_utc(self.created_at)
+        self.updated_at = ensure_utc(self.updated_at)
+        return self
+
+
+class RoleCreate(Role):
+    pass
+
+
+class RoleUpdate(BaseModel):
+    name:           Optional[str]       = None
+    description:    Optional[str]       = None
+    permissions: Optional[List[str]] = None
+    is_active:      Optional[bool]      = None
+    updated_at: datetime = Field(default_factory=utc_now)
+
+
+class RoleResponse(Role):
+    class Config:
+        from_attributes = True
+
+
+class PaginatedRoleResponse(BaseModel):
+    total:     int
+    page:      int
+    page_size: int
+    results:   List[RoleResponse]

services/auth/models/session.py

@@ -0,0 +1,26 @@
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class SessionValueRequest(BaseModel):
+    value: Any
+
+
+class SessionValueResponse(BaseModel):
+    key: str
+    value: Any = None
+    found: bool = True
+
+
+class SessionBulkSaveRequest(BaseModel):
+    items: dict[str, Any] = Field(default_factory=dict)
+
+
+class SessionBulkGetRequest(BaseModel):
+    keys: list[str] = Field(default_factory=list)
+
+
+class SessionBulkResponse(BaseModel):
+    items: dict[str, Any | None] = Field(default_factory=dict)
+    missing: list[str] = Field(default_factory=list)

services/auth/models/teamMembers.py

@@ -0,0 +1,59 @@
+from datetime import datetime, timezone
+from typing import Optional, List
+from pydantic import BaseModel, Field, model_validator
+
+
+# ── Helpers (reuse same) ──────────────────────────────────────────────────────
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+
+# ── Team Member ───────────────────────────────────────────────────────────────
+class TeamMember(BaseModel):
+    user_id:     str           = Field(..., min_length=1)
+    employee_id: str           = Field(..., min_length=1)
+    name:        str           = Field(..., min_length=1)
+
+    department:  Optional[str] = None
+    email:       Optional[str] = None
+    role:        Optional[str] = None
+
+    is_active:   bool          = True
+    joined_at:   datetime      = Field(default_factory=utc_now)
+
+    @model_validator(mode="after")
+    def normalize_datetimes(self) -> "TeamMember":
+        self.joined_at = ensure_utc(self.joined_at)
+        return self
+
+
+# ── Create ────────────────────────────────────────────────────────────────────
+class TeamMemberCreate(TeamMember):
+    pass
+
+
+# ── Update ────────────────────────────────────────────────────────────────────
+class TeamMemberUpdate(BaseModel):
+    department: Optional[str] = None
+    email:      Optional[str] = None
+    role:       Optional[str] = None
+    is_active:  Optional[bool] = None
+
+
+# ── Response ──────────────────────────────────────────────────────────────────
+class TeamMemberResponse(TeamMember):
+    class Config:
+        from_attributes = True
+
+
+# ── Mapping: team_id → members[] ──────────────────────────────────────────────
+class TeamMembersMapResponse(BaseModel):
+    data: dict[str, List[TeamMemberResponse]]

services/auth/models/teams.py

@@ -0,0 +1,56 @@
+from datetime import datetime, timezone
+from typing import Optional, List
+from pydantic import BaseModel, Field, model_validator
+
+def utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def ensure_utc(dt: Optional[datetime]) -> Optional[datetime]:
+    if dt is None:
+        return None
+    if dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(timezone.utc)
+
+class Team(BaseModel):
+    team_id:       str           = Field(..., min_length=1)
+    name:          str           = Field(..., min_length=1)
+    description:   Optional[str] = None
+    department_id: str           = Field(..., min_length=1)   # parent department
+    lead_user_id:  Optional[str] = None                       # references UserEntry.user_id
+    is_active:     bool          = True
+    created_at: datetime = Field(default_factory=utc_now)
+    updated_at: datetime = Field(default_factory=utc_now)
+
+    @model_validator(mode="after")
+    def normalize_datetimes(self) -> "Team":
+        self.created_at = ensure_utc(self.created_at)
+        self.updated_at = ensure_utc(self.updated_at)
+        return self
+
+
+
+class TeamCreate(Team):
+    pass
+
+
+class TeamUpdate(BaseModel):
+    name:          Optional[str]  = None
+    description:   Optional[str]  = None
+    department_id: Optional[str]  = None
+    lead_user_id:  Optional[str]  = None
+    is_active:     Optional[bool] = None
+    updated_at: datetime = Field(default_factory=utc_now)
+
+
+class TeamResponse(Team):
+    class Config:
+        from_attributes = True
+
+
+class PaginatedTeamResponse(BaseModel):
+    total:     int
+    page:      int
+    page_size: int
+    results:   List[TeamResponse]