nlbone 0.8.6__tar.gz → 0.9.0__tar.gz

{nlbone-0.8.6 → nlbone-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nlbone
-Version: 0.8.6
+Version: 0.9.0
 Summary: Backbone package for interfaces and infrastructure in Python projects
 Author-email: Amir Hosein Kahkbazzadeh <a.khakbazzadeh@gmail.com>
 License: MIT

{nlbone-0.8.6 → nlbone-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nlbone"
-version = "0.8.6"
+version = "0.9.0"
 description = "Backbone package for interfaces and infrastructure in Python projects"
 readme = "README.md"
 requires-python = ">=3.10"

{nlbone-0.8.6 → nlbone-0.9.0}/src/nlbone/adapters/auth/auth_service.py

@@ -1,3 +1,5 @@
+import functools
+
 import requests
 
 from nlbone.config.settings import get_settings
@@ -15,7 +17,12 @@ class AuthService(BaseAuthService):
         self._timeout = float(s.HTTP_TIMEOUT_SECONDS)
         self._client = requests.session()
 
-    def has_access(self, token: str, permissions: list[str]) -> bool: ...
+    def has_access(self, token: str, permissions: list[str]) -> bool:
+        data = self.verify_token(token)
+        if not data:
+            return False
+        has_access = [self.client_id + "#" + perm in data.get("allowed_permissions", []) for perm in permissions]
+        return all(has_access)
 
     @cached(ttl=15 * 60)
     def verify_token(self, token: str) -> dict:
@@ -41,7 +48,9 @@ class AuthService(BaseAuthService):
             return result.json()
         return None
 
-    def is_client_token(self, token: str, allowed_clients: set[str] | None = None) -> bool: ...
+    def is_client_token(self, token: str, allowed_clients: set[str] | None = None) -> bool:
+        data = self.verify_token(token)
+        return data.get('preferred_username').startswith('service-account')
 
     def client_has_access(self, token: str, permissions: list[str], allowed_clients: set[str] | None = None) -> bool:
         data = self.verify_token(token)
@@ -50,4 +59,10 @@ class AuthService(BaseAuthService):
         has_access = [self.client_id + "#" + perm in data.get("allowed_permissions", []) for perm in permissions]
         return all(has_access)
 
-    def get_permissions(self, token: str) -> list[str]: ...
+    def get_permissions(self, token: str) -> list[str]:
+        data = self.verify_token(token)
+        return data.get('allowed_permissions', [])
+
+@functools.lru_cache(maxsize=1)
+def get_auth_service() -> AuthService:
+    return AuthService()

{nlbone-0.8.6 → nlbone-0.9.0}/src/nlbone/adapters/db/postgres/engine.py

@@ -57,7 +57,6 @@ async def async_session() -> AsyncGenerator[AsyncSession, Any]:
     session = _async_session_factory()
     try:
         yield session
-        await session.commit()
     except Exception:
         await session.rollback()
         raise
@@ -104,7 +103,6 @@ def sync_session() -> Generator[Session, None, None]:
     s = _sync_session_factory()
     try:
         yield s
-        s.commit()
     except Exception:
         s.rollback()
         raise

{nlbone-0.8.6 → nlbone-0.9.0}/src/nlbone/interfaces/api/dependencies/async_auth.py

@@ -1,6 +1,6 @@
 import functools
 
-from nlbone.adapters.auth import KeycloakAuthService
+from nlbone.adapters.auth.auth_service import get_auth_service
 from nlbone.interfaces.api.exceptions import ForbiddenException, UnauthorizedException
 from nlbone.utils.context import current_request
 
@@ -16,7 +16,7 @@ async def current_user_id() -> int:
 
 async def current_client_id() -> str:
     request = current_request()
-    if client_id := KeycloakAuthService().get_client_id(request.state.token):
+    if client_id := get_auth_service().get_client_id(request.state.token):
         return str(client_id)
     raise UnauthorizedException()
 
@@ -50,7 +50,7 @@ def has_access(*, permissions=None):
             request = current_request()
             if not await current_user_id():
                 raise UnauthorizedException()
-            if not KeycloakAuthService().has_access(request.state.token, permissions=permissions):
+            if not get_auth_service().has_access(request.state.token, permissions=permissions):
                 raise ForbiddenException(f"Forbidden {permissions}")
 
             return await func(*args, **kwargs)

{nlbone-0.8.6 → nlbone-0.9.0}/src/nlbone/interfaces/api/dependencies/auth.py

@@ -1,8 +1,7 @@
 import functools
 
 from nlbone.core.domain.models import CurrentUserData
-from nlbone.adapters.auth import KeycloakAuthService
-from nlbone.adapters.auth.keycloak import get_auth_service
+from nlbone.adapters.auth.auth_service import get_auth_service
 from nlbone.config.settings import get_settings
 from nlbone.interfaces.api.exceptions import ForbiddenException, UnauthorizedException
 from nlbone.utils.context import current_request
@@ -31,14 +30,14 @@ def current_user() -> CurrentUserData:
 
 def current_client_id() -> str:
     request = current_request()
-    if client_id := KeycloakAuthService().get_client_id(request.state.token):
+    if client_id := get_auth_service().get_client_id(request.state.token):
         return str(client_id)
     raise UnauthorizedException()
 
 
 def client_has_access_func(*, permissions=None):
     request = current_request()
-    if not KeycloakAuthService().client_has_access(request.state.token, permissions=permissions):
+    if not get_auth_service().client_has_access(request.state.token, permissions=permissions):
         raise ForbiddenException(f"Forbidden {permissions}")
     return True
 
@@ -71,10 +70,8 @@ def user_has_access_func(*, permissions=None):
     request = current_request()
     if not current_user_id():
         raise UnauthorizedException()
-    user_permissions = get_auth_service().get_permissions(request.state.token)
-    for p in permissions or []:
-        if p not in user_permissions:
-            raise ForbiddenException(f"Forbidden {permissions}")
+    if not get_auth_service().has_access(request.state.token, permissions=permissions):
+        raise ForbiddenException(f"Forbidden {permissions}")
     return True
 
 

{nlbone-0.8.6 → nlbone-0.9.0}/src/nlbone/interfaces/api/middleware/authentication.py

@@ -88,7 +88,7 @@ class AuthenticationMiddleware(BaseHTTPMiddleware):
                 return await call_next(request)
         if request.headers.get("X-Client-Id") == "website" and request.headers.get("Authorization"):
             authenticate_user(request)
-        elif request.cookies.get("access_token"):
+        elif request.cookies.get("access_token") or request.headers.get("Authorization"):
             authenticate_user(request)
         elif request.headers.get("Authorization"):
             authenticate_admin_user(request, auth_service=self._get_auth)