nlbone 0.7.14__tar.gz → 0.7.16__tar.gz

{nlbone-0.7.14 → nlbone-0.7.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nlbone
-Version: 0.7.14
+Version: 0.7.16
 Summary: Backbone package for interfaces and infrastructure in Python projects
 Author-email: Amir Hosein Kahkbazzadeh <a.khakbazzadeh@gmail.com>
 License: MIT

{nlbone-0.7.14 → nlbone-0.7.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nlbone"
-version = "0.7.14"
+version = "0.7.16"
 description = "Backbone package for interfaces and infrastructure in Python projects"
 readme = "README.md"
 requires-python = ">=3.10"

nlbone-0.7.16/src/nlbone/adapters/auth/auth_service.py

@@ -0,0 +1,59 @@
+import requests
+
+from nlbone.config.settings import get_settings
+from nlbone.core.ports.auth import AuthService as BaseAuthService
+from nlbone.utils.http import normalize_https_base
+from nlbone.utils.cache import cached
+
+
+class AuthService(BaseAuthService):
+    def __init__(self):
+        s = get_settings()
+        self.client_id = s.KEYCLOAK_CLIENT_ID
+        self.client_secret = s.CLIENT_SECRET.get_secret_value().strip()
+        self._base_url = normalize_https_base(s.AUTH_SERVICE_URL.unicode_string(), enforce_https=False)
+        self._timeout = float(s.HTTP_TIMEOUT_SECONDS)
+        self._client = requests.session()
+
+    def has_access(self, token: str, permissions: list[str]) -> bool:
+        ...
+
+    @cached(ttl=15 * 60)
+    def verify_token(self, token: str) -> dict:
+        url = f"{self._base_url}/introspect"
+        result = self._client.post(url, data={
+            "token": token
+        })
+        if result.status_code == 200:
+            return result.json()
+        return None
+
+    def get_client_id(self, token: str):
+        data = self.verify_token(token)
+        if data:
+            return data["sub"] if data["sub"].startswith('service-account') else None
+        return None
+
+    def get_client_token(self) -> dict | None:
+        url = f"{self._base_url}/introspect"
+        result = self._client.post(url, data={
+            "client_id": self.client_id,
+            "client_secret": self.client_secret,
+            "grant_type": "client_credentials"
+        })
+        if result.status_code == 200:
+            return result.json()
+        return None
+
+    def is_client_token(self, token: str, allowed_clients: set[str] | None = None) -> bool:
+        ...
+
+    def client_has_access(self, token: str, permissions: list[str], allowed_clients: set[str] | None = None) -> bool:
+        data = self.verify_token(token)
+        if not data:
+            return False
+        has_access = [perm in data.get("allowed_permissions", []) for perm in permissions]
+        return all(has_access)
+
+    def get_permissions(self, token: str) -> list[str]:
+        ...

{nlbone-0.7.14 → nlbone-0.7.16}/src/nlbone/adapters/auth/token_provider.py

@@ -31,7 +31,7 @@ class ClientTokenProvider:
             access_token = data.get("access_token")
             if not access_token:
                 raise RuntimeError("Keycloak: missing access_token")
-            expires_in = int(data.get("expires_in", 60))
+            expires_in = int(data.get("expires_in", 15 * 60))
             self._token = access_token
             self._expires_at = time.time() + max(1, expires_in)
             return self._token

{nlbone-0.7.14 → nlbone-0.7.16}/src/nlbone/config/settings.py

@@ -3,7 +3,7 @@ from functools import lru_cache
 from pathlib import Path
 from typing import Literal
 
-from pydantic import AnyHttpUrl, Field, SecretStr
+from pydantic import AnyHttpUrl, Field, SecretStr, AliasChoices
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -63,6 +63,8 @@ class Settings(BaseSettings):
     PRICING_API_SECRET: str = ''
 
     AUTH_SERVICE_URL:  AnyHttpUrl = Field(default="https://auth.numberland.ir")
+    CLIENT_ID: str = Field(default="", validation_alias=AliasChoices("KEYCLOAK_CLIENT_ID"))
+    CLIENT_SECRET: SecretStr = Field(default="", validation_alias=AliasChoices("KEYCLOAK_CLIENT_SECRET"))
 
     # ---------------------------
     # Database

{nlbone-0.7.14 → nlbone-0.7.16}/src/nlbone/container.py

@@ -5,6 +5,8 @@ from typing import Dict, Optional
 from dependency_injector import containers, providers
 from pydantic_settings import BaseSettings
 
+from nlbone.adapters.auth.auth_service import AuthService as AuthService_IMP
+from nlbone.core.ports.auth import AuthService
 from nlbone.adapters.auth.keycloak import KeycloakAuthService
 from nlbone.adapters.auth.token_provider import ClientTokenProvider
 from nlbone.adapters.cache.async_redis import AsyncRedisCache
@@ -28,7 +30,7 @@ class Container(containers.DeclarativeContainer):
     # event_bus: providers.Singleton[EventBusPort] = providers.Singleton(InMemoryEventBus)
 
     # --- Services ---
-    auth: providers.Singleton[KeycloakAuthService] = providers.Singleton(KeycloakAuthService)
+    auth: providers.Singleton[AuthService] = providers.Singleton(AuthService_IMP)
     token_provider = providers.Singleton(ClientTokenProvider, auth=auth, skew_seconds=30)
     file_service: providers.Singleton[FileServicePort] = providers.Singleton(
         UploadchiClient, token_provider=token_provider

nlbone-0.7.16/src/nlbone/interfaces/api/dependencies/client_credential.py

@@ -0,0 +1,44 @@
+import asyncio
+import functools
+from typing import Callable
+
+from makefun import wraps as mf_wraps
+
+from nlbone.adapters.auth.auth_service import AuthService
+from nlbone.interfaces.api.exceptions import UnauthorizedException, ForbiddenException
+from nlbone.utils.context import current_request
+
+
+def current_client_id() -> str:
+    request = current_request()
+    if client_id := AuthService().get_client_id(request.state.token):
+        return str(client_id)
+    raise UnauthorizedException()
+
+
+def client_has_access_func(*, permissions=None):
+    request = current_request()
+    if not AuthService().client_has_access(request.state.token, permissions=permissions):
+        raise ForbiddenException(f"Forbidden {permissions}")
+    return True
+
+
+def client_has_access(*, permissions=None):
+    def deco(func: Callable):
+        is_async_func = asyncio.iscoroutinefunction(func)
+
+        if is_async_func:
+            @mf_wraps(func)
+            async def aw(*args, **kwargs):
+                client_has_access_func(permissions=permissions)
+                return await func(*args, **kwargs)
+
+            return aw
+
+        @mf_wraps(func)
+        def sw(*args, **kwargs):
+            client_has_access_func(permissions=permissions)
+            return func(*args, **kwargs)
+
+        return sw
+    return deco

{nlbone-0.7.14 → nlbone-0.7.16}/src/nlbone/utils/cache.py

@@ -5,8 +5,7 @@ from typing import Any, Callable, Iterable, Optional, Mapping
 import hashlib
 from makefun import wraps as mf_wraps
 
-from nlbone.interfaces.api.additional_filed import AdditionalFieldsRequest
-from nlbone.interfaces.api.pagination import PaginateRequest
+
 from nlbone.utils.cache_registry import get_cache
 
 try:
@@ -31,6 +30,9 @@ PRIMITIVES = (str, int, float, bool, type(None))
 
 
 def to_jsonable(obj):
+    from nlbone.interfaces.api.additional_filed import AdditionalFieldsRequest
+    from nlbone.interfaces.api.pagination import PaginateRequest
+
     if isinstance(obj, PRIMITIVES):
         return obj
 
@@ -78,7 +80,7 @@ def _key_from_template(
         payload,
         sort_keys=True,
     )
-    return f"{func.__module__}:{func.__qualname__}:{hashlib.sha1(payload.encode("utf-8")).hexdigest()}"
+    return f"{func.__module__}:{func.__qualname__}:{hashlib.sha1(payload.encode('utf-8')).hexdigest()}"
 
 
 def _format_tags(
@@ -147,6 +149,8 @@ def cached(
             @mf_wraps(func)
             async def aw(*args, **kwargs):
                 cache = (cache_resolver or get_cache)()
+                if not cache:
+                    return await func(*args, **kwargs)
                 k = _key_from_template(key, func, args, kwargs)
                 tg = _format_tags(tags, func, args, kwargs)
 
@@ -177,6 +181,8 @@ def cached(
         @mf_wraps(func)
         def sw(*args, **kwargs):
             cache = (cache_resolver or get_cache)()
+            if not cache:
+                return func(*args, **kwargs)
             k = _key_from_template(key, func, args, kwargs)
             tg = _format_tags(tags, func, args, kwargs)
 

{nlbone-0.7.14 → nlbone-0.7.16}/src/nlbone/utils/cache_registry.py

@@ -21,6 +21,4 @@ def set_context_cache_resolver(fn: Optional[Callable[[], T]]) -> None:
 
 def get_cache() -> T:
     fn = _ctx_resolver.get() or _global_resolver
-    if fn is None:
-        raise RuntimeError("Cache resolver not configured. Call set_cache_resolver(...) first.")
     return fn()

nlbone-0.7.14/src/nlbone/adapters/auth/auth_service.py

@@ -1,25 +0,0 @@
-import requests
-
-from nlbone.config.settings import get_settings
-from nlbone.core.ports.auth import AuthService as BaseAuthService
-from nlbone.utils.http import normalize_https_base
-
-
-class AuthService(BaseAuthService):
-    def __init__(self):
-        s = get_settings()
-        self._base_url = normalize_https_base(s.AUTH_SERVICE_URL.unicode_string())
-        self._timeout = float(s.HTTP_TIMEOUT_SECONDS)
-        self._client =  requests.session()
-
-    def has_access(self, token: str, permissions: list[str]) -> bool: ...
-    def verify_token(self, token: str) -> dict | None:
-        url = f"{self._base_url}/introspect"
-        result = self._client.post(url, data={
-            "token": token
-        })
-        return result.json()
-    def get_client_token(self) -> dict | None: ...
-    def is_client_token(self, token: str, allowed_clients: set[str] | None = None) -> bool: ...
-    def client_has_access(self, token: str, perms: list[str], allowed_clients: set[str] | None = None) -> bool: ...
-    def get_permissions(self, token: str) -> list[str]: ...