nvidia-nat 1.1.0a20251020__py3-none-any.whl

nat/authentication/api_key/__init__.py

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

nat/authentication/api_key/api_key_auth_provider.py

@@ -0,0 +1,96 @@
+# SPDX-FileCopyrightText: Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import logging
+
+from pydantic import SecretStr
+
+from nat.authentication.api_key.api_key_auth_provider_config import APIKeyAuthProviderConfig
+from nat.authentication.interfaces import AuthProviderBase
+from nat.data_models.authentication import AuthResult
+from nat.data_models.authentication import BearerTokenCred
+from nat.data_models.authentication import HeaderAuthScheme
+
+logger = logging.getLogger(__name__)
+
+
+class APIKeyAuthProvider(AuthProviderBase[APIKeyAuthProviderConfig]):
+
+    # fmt: off
+    def __init__(self,
+                 config: APIKeyAuthProviderConfig,
+                 config_name: str | None = None) -> None:
+        assert isinstance(config, APIKeyAuthProviderConfig), ("Config is not APIKeyAuthProviderConfig")
+        super().__init__(config)
+    # fmt: on
+
+    async def _construct_authentication_header(self) -> BearerTokenCred:
+        """
+        Constructs the authenticated HTTP header based on the authentication scheme.
+        Basic Authentication follows the OpenAPI 3.0 Basic Authentication standard as well as RFC 7617.
+
+        Args:
+            header_auth_scheme (HeaderAuthScheme): The HTTP authentication scheme to use.
+                                             Supported schemes: BEARER, X_API_KEY, BASIC, CUSTOM.
+
+        Returns:
+            BearerTokenCred: The HTTP headers containing the authentication credentials.
+                             Returns None if the scheme is not supported or configuration is invalid.
+
+        """
+
+        from nat.authentication.interfaces import AUTHORIZATION_HEADER
+
+        config: APIKeyAuthProviderConfig = self.config
+
+        header_auth_scheme = config.auth_scheme
+
+        if header_auth_scheme == HeaderAuthScheme.BEARER:
+            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
+                                   scheme=HeaderAuthScheme.BEARER.value,
+                                   header_name=AUTHORIZATION_HEADER)
+
+        if header_auth_scheme == HeaderAuthScheme.X_API_KEY:
+            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
+                                   scheme=HeaderAuthScheme.X_API_KEY.value,
+                                   header_name='')
+
+        if header_auth_scheme == HeaderAuthScheme.CUSTOM:
+            if not config.custom_header_name:
+                raise ValueError('custom_header_name required when using header_auth_scheme=CUSTOM')
+
+            if not config.custom_header_prefix:
+                raise ValueError('custom_header_prefix required when using header_auth_scheme=CUSTOM')
+
+            return BearerTokenCred(token=SecretStr(f"{config.raw_key}"),
+                                   scheme=config.custom_header_prefix,
+                                   header_name=config.custom_header_name)
+
+        raise ValueError(f"Unsupported header auth scheme: {header_auth_scheme}")
+
+    async def authenticate(self, user_id: str | None = None, **kwargs) -> AuthResult | None:
+        """
+        Authenticate the user using the API key credentials.
+
+        Args:
+            user_id (str): The user ID to authenticate.
+
+        Returns:
+            AuthenticatedContext: The authenticated context containing headers, query params, cookies, etc.
+        """
+
+        headers = await self._construct_authentication_header()
+
+        return AuthResult(credentials=[headers])

nat/authentication/api_key/api_key_auth_provider_config.py

@@ -0,0 +1,124 @@
+# SPDX-FileCopyrightText: Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import logging
+import re
+import string
+
+from pydantic import Field
+from pydantic import field_validator
+
+from nat.authentication.exceptions.api_key_exceptions import APIKeyFieldError
+from nat.authentication.exceptions.api_key_exceptions import HeaderNameFieldError
+from nat.authentication.exceptions.api_key_exceptions import HeaderPrefixFieldError
+from nat.data_models.authentication import AuthProviderBaseConfig
+from nat.data_models.authentication import HeaderAuthScheme
+
+logger = logging.getLogger(__name__)
+
+# Strict RFC 7230 compliant header name regex
+HEADER_NAME_REGEX = re.compile(r"^[!#$%&'*+\-.^_`|~0-9a-zA-Z]+$")
+
+
+class APIKeyAuthProviderConfig(AuthProviderBaseConfig, name="api_key"):
+    """
+    API Key authentication configuration model.
+    """
+
+    raw_key: str = Field(description=("Raw API token or credential to be injected into the request parameter. "
+                                      "Used for 'bearer','x-api-key','custom', and other schemes. "))
+
+    auth_scheme: HeaderAuthScheme = Field(default=HeaderAuthScheme.BEARER,
+                                          description=("The HTTP authentication scheme to use. "
+                                                       "Supported schemes: BEARER, X_API_KEY, BASIC, CUSTOM."))
+
+    custom_header_name: str | None = Field(description="The HTTP header name that MUST be used in conjunction "
+                                           "with the custom_header_prefix when HeaderAuthScheme is CUSTOM.",
+                                           default=None)
+    custom_header_prefix: str | None = Field(description="The HTTP header prefix that MUST be used in conjunction "
+                                             "with the custom_header_name when HeaderAuthScheme is CUSTOM.",
+                                             default=None)
+
+    @field_validator('raw_key')
+    @classmethod
+    def validate_raw_key(cls, value: str) -> str:
+        if not value:
+            raise APIKeyFieldError('value_missing', 'raw_key field value is required.')
+
+        if len(value) < 8:
+            raise APIKeyFieldError(
+                'value_too_short',
+                'raw_key field value must be at least 8 characters long for security. '
+                f'Got: {len(value)} characters.')
+
+        if len(value.strip()) != len(value):
+            raise APIKeyFieldError('whitespace_found',
+                                   'raw_key field value cannot have leading or trailing whitespace.')
+
+        if any(c in string.whitespace for c in value):
+            raise APIKeyFieldError('contains_whitespace', 'raw_key must not contain any '
+                                   'whitespace characters.')
+
+        return value
+
+    @field_validator('custom_header_name')
+    @classmethod
+    def validate_custom_header_name(cls, value: str) -> str:
+        if not value:
+            raise HeaderNameFieldError('value_missing', 'custom_header_name is required.')
+
+        if value != value.strip():
+            raise HeaderNameFieldError('whitespace_found',
+                                       'custom_header_name field value cannot have leading or trailing whitespace.')
+
+        if any(c in string.whitespace for c in value):
+            raise HeaderNameFieldError('contains_whitespace',
+                                       'custom_header_name must not contain any whitespace characters.')
+
+        if not HEADER_NAME_REGEX.fullmatch(value):
+            raise HeaderNameFieldError(
+                'invalid_format',
+                'custom_header_name must match the HTTP token syntax: ASCII letters, digits, or allowed symbols.')
+
+        return value
+
+    @field_validator('custom_header_prefix')
+    @classmethod
+    def validate_custom_header_prefix(cls, value: str) -> str:
+        if not value:
+            raise HeaderPrefixFieldError('value_missing', 'custom_header_prefix is required.')
+
+        if value != value.strip():
+            raise HeaderPrefixFieldError(
+                'whitespace_found', 'custom_header_prefix field value cannot have '
+                'leading or trailing whitespace.')
+
+        if any(c in string.whitespace for c in value):
+            raise HeaderPrefixFieldError('contains_whitespace',
+                                         'custom_header_prefix must not contain any whitespace characters.')
+
+        if not value.isascii():
+            raise HeaderPrefixFieldError('invalid_format', 'custom_header_prefix must be ASCII.')
+
+        return value
+
+    @field_validator('raw_key', mode='after')
+    @classmethod
+    def validate_raw_key_after(cls, value: str) -> str:
+        if not value:
+            raise APIKeyFieldError('value_missing', 'raw_key field value is '
+                                   'required after construction.')
+
+        return value

nat/authentication/api_key/register.py

@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from nat.authentication.api_key.api_key_auth_provider_config import APIKeyAuthProviderConfig
+from nat.builder.builder import Builder
+from nat.cli.register_workflow import register_auth_provider
+
+
+@register_auth_provider(config_type=APIKeyAuthProviderConfig)
+async def api_key_client(config: APIKeyAuthProviderConfig, builder: Builder):
+
+    from nat.authentication.api_key.api_key_auth_provider import APIKeyAuthProvider
+
+    yield APIKeyAuthProvider(config=config)

nat/authentication/credential_validator/__init__.py

@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.