open-api-framework 0.8.0__tar.gz → 0.9.0__tar.gz

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/CHANGELOG.rst

@@ -1,6 +1,30 @@
 Changelog
 =========
 
+0.9.0 (2024-11-11)
+------------------
+**New Features**
+
+* Add ``SESSION_COOKIE_AGE`` configurable setting
+* Add user session management admin
+
+.. note::
+
+ SessionProfile admin should be added to admin index and its fixture.
+
+**Bugfixes/QOL**
+
+* fix runtime configuration for django-log-outgoing-requests
+
+0.8.1 (2024-09-26)
+------------------
+
+**Bugfixes/QOL**
+
+* Change SESSION_COOKIE_SAMESITE to "Lax" to fix OIDC (#72)
+* Remove url from SECRET_KEY help text (#76)
+* Change CSP headers to support API schema page
+
 0.8.0 (2024-08-22)
 ------------------
 

{open_api_framework-0.8.0/open_api_framework.egg-info → open_api_framework-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.8.0
+Version: 0.9.0
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,7 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
 Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
@@ -59,6 +59,7 @@ Requires-Dist: celery>=5.4.0
 Requires-Dist: flower>=2.0.1
 Requires-Dist: maykin-2fa>=1.0.1
 Requires-Dist: django-setup-configuration>=0.1.0
+Requires-Dist: django-sessionprofile>=3.0.0
 Provides-Extra: tests
 Requires-Dist: pytest; extra == "tests"
 Requires-Dist: pytest-django; extra == "tests"
@@ -66,6 +67,7 @@ Requires-Dist: tox; extra == "tests"
 Requires-Dist: isort; extra == "tests"
 Requires-Dist: black; extra == "tests"
 Requires-Dist: flake8; extra == "tests"
+Requires-Dist: factory-boy; extra == "tests"
 Provides-Extra: coverage
 Requires-Dist: pytest-cov; extra == "coverage"
 Provides-Extra: docs
@@ -78,7 +80,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.9.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/README.rst

@@ -1,7 +1,7 @@
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.9.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

open_api_framework-0.9.0/open_api_framework/admin.py

@@ -0,0 +1,40 @@
+from django.contrib import admin
+
+from sessionprofile.models import SessionProfile
+
+from open_api_framework.utils import get_session_store
+
+
+@admin.register(SessionProfile)
+class SessionProfileAdmin(admin.ModelAdmin):
+    list_display = ["session_key", "user", "exists"]
+
+    @property
+    def SessionStore(self):
+
+        return get_session_store()
+
+    def get_queryset(self, request):
+        qs = super().get_queryset(request)
+        return qs.filter(user=request.user)
+
+    def has_add_permission(self, request, obj=None):
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        return False
+
+    @admin.display(boolean=True)
+    def exists(self, obj):
+        return self.SessionStore().exists(obj.session_key)
+
+    def delete_model(self, request, obj):
+        self.SessionStore(obj.session_key).flush()
+        super().delete_model(request, obj)
+
+    def delete_queryset(self, request, queryset):
+
+        for session_profile in queryset.iterator():
+            self.SessionStore(session_profile.session_key).flush()
+
+        super().delete_queryset(request, queryset)

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/open_api_framework/conf/base.py

@@ -39,10 +39,7 @@ SITE_ID = config(
 # SECURITY WARNING: keep the secret key used in production secret!
 SECRET_KEY = config(
     "SECRET_KEY",
-    help_text=(
-        "Secret key that's used for certain cryptographic utilities. "
-        "You should generate one via `miniwebtool <https://www.miniwebtool.com/django-secret-key-generator>`_"
-    ),
+    help_text="Secret key that's used for certain cryptographic utilities. ",
 )
 
 # NEVER run with DEBUG=True in production-like environments
@@ -213,6 +210,7 @@ INSTALLED_APPS = [
     "vng_api_common",
     "notifications_api_common",
     "drf_spectacular",
+    "drf_spectacular_sidecar",
     "rest_framework",
     "django_markup",
     "solo",
@@ -231,19 +229,20 @@ INSTALLED_APPS = [
     "mozilla_django_oidc_db",
     "log_outgoing_requests",
     "django_setup_configuration",
+    "sessionprofile",
     "open_api_framework",
     PROJECT_DIRNAME,
 ]
 
 MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
+    "sessionprofile.middleware.SessionProfileMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "corsheaders.middleware.CorsMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "maykin_2fa.middleware.OTPMiddleware",
-    "mozilla_django_oidc_db.middleware.SessionRefresh",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "axes.middleware.AxesMiddleware",
@@ -503,7 +502,7 @@ LOGGING = {
             "handlers": (
                 ["log_outgoing_requests", "save_outgoing_requests"]
                 if LOG_REQUESTS
-                else []
+                else ["save_outgoing_requests"]
             ),
             "level": "DEBUG",
             "propagate": True,
@@ -537,6 +536,12 @@ AUTHENTICATION_BACKENDS = [
 
 SESSION_COOKIE_NAME = f"{PROJECT_DIRNAME}_sessionid"
 SESSION_ENGINE = "django.contrib.sessions.backends.cache"
+SESSION_COOKIE_AGE = config(
+    "SESSION_COOKIE_AGE",
+    default=1209600,
+    help_text="For how long, in seconds, the session cookie will be valid.",
+)
+
 
 LOGIN_URL = reverse_lazy("admin:login")
 LOGIN_REDIRECT_URL = reverse_lazy("admin:index")
@@ -549,11 +554,12 @@ SESSION_COOKIE_SECURE = IS_HTTPS
 SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SAMESITE = config(
     "SESSION_COOKIE_SAMESITE",
-    "Strict",
+    "Lax",
     help_text=(
         "The value of the SameSite flag on the session cookie. This flag prevents the "
         "cookie from being sent in cross-site requests thus preventing CSRF attacks and "
         "making some methods of stealing session cookie impossible."
+        "Currently interferes with OIDC. Keep the value set at Lax if used."
     ),
 )
 
@@ -955,9 +961,7 @@ LOG_OUTGOING_REQUESTS_MAX_AGE = config(
 # NOTE: make sure values are a tuple or list, and to quote special values like 'self'
 
 # ideally we'd use BASE_URI but it'd have to be lazy or cause issues
-CSP_DEFAULT_SRC = [
-    "'self'",
-] + config(
+CSP_DEFAULT_SRC = ["'self'"] + config(
     "CSP_EXTRA_DEFAULT_SRC",
     default=[],
     split=True,
@@ -998,12 +1002,16 @@ CSP_FORM_ACTION = (
     + CORS_ALLOWED_ORIGINS
 )
 
-CSP_IMG_SRC = CSP_DEFAULT_SRC + config(
-    "CSP_EXTRA_IMG_SRC",
-    default=[],
-    split=True,
-    group="Content Security Policy",
-    help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+CSP_IMG_SRC = (
+    CSP_DEFAULT_SRC
+    + ["data:", "cdn.redoc.ly"]  # used by DRF spectacular
+    + config(
+        "CSP_EXTRA_IMG_SRC",
+        default=[],
+        split=True,
+        group="Content Security Policy",
+        help_text="Extra ``img-src`` sources for CSP other than ``CSP_DEFAULT_SRC``.",
+    )
 )
 
 # affects <object> and <embed> tags, block everything by default but allow deploy-time
@@ -1018,8 +1026,13 @@ CSP_OBJECT_SRC = config(
 
 # we must include this explicitly, otherwise the style-src only includes the nonce because
 # of CSP_INCLUDE_NONCE_IN
-CSP_STYLE_SRC = CSP_DEFAULT_SRC
-CSP_SCRIPT_SRC = CSP_DEFAULT_SRC
+CSP_STYLE_SRC = CSP_DEFAULT_SRC + [
+    "'unsafe-inline'",
+    "fonts.googleapis.com",
+]  # used by DRF spectacular
+CSP_SCRIPT_SRC = CSP_DEFAULT_SRC + ["'unsafe-inline'"]
+CSP_FONT_SRC = ("'self'", "fonts.gstatic.com")
+CSP_WORKER_SRC = ("'self'", "blob:")
 
 # firefox does not get the nonce from default-src, see
 # https://stackoverflow.com/a/63376012
@@ -1036,8 +1049,8 @@ CSP_FRAME_SRC = ["'self'"]
 
 CSP_UPGRADE_INSECURE_REQUESTS = False  # TODO enable on production?
 
-CSP_EXCLUDE_URL_PREFIXES = (
-    # ReDoc/Swagger pull in external sources, so don't enforce CSP on API endpoints/documentation.
-    "/api/",
-    "/admin/",
-)
+
+#
+# Django Solo
+#
+SOLO_CACHE = "default"

open_api_framework-0.9.0/open_api_framework/utils.py

@@ -0,0 +1,8 @@
+from importlib import import_module
+
+from django.conf import settings
+from django.contrib.sessions.backends.base import SessionBase
+
+
+def get_session_store() -> SessionBase:
+    return import_module(settings.SESSION_ENGINE).SessionStore

{open_api_framework-0.8.0 → open_api_framework-0.9.0/open_api_framework.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: open_api_framework
-Version: 0.8.0
+Version: 0.9.0
 Summary: A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings
 Author-email: Maykin Media <support@maykinmedia.nl>
 License: Copyright © Maykin 2024
@@ -41,7 +41,7 @@ Requires-Dist: django-redis>=5.4.0
 Requires-Dist: djangorestframework>=3.15.2
 Requires-Dist: djangorestframework-gis>=1.0
 Requires-Dist: django-filter>=24.2
-Requires-Dist: drf-spectacular>=0.27.2
+Requires-Dist: drf-spectacular[sidecar]>=0.27.2
 Requires-Dist: django-csp>=3.8
 Requires-Dist: djangorestframework-inclusions>=1.2.0
 Requires-Dist: commonground-api-common>=1.12.1
@@ -59,6 +59,7 @@ Requires-Dist: celery>=5.4.0
 Requires-Dist: flower>=2.0.1
 Requires-Dist: maykin-2fa>=1.0.1
 Requires-Dist: django-setup-configuration>=0.1.0
+Requires-Dist: django-sessionprofile>=3.0.0
 Provides-Extra: tests
 Requires-Dist: pytest; extra == "tests"
 Requires-Dist: pytest-django; extra == "tests"
@@ -66,6 +67,7 @@ Requires-Dist: tox; extra == "tests"
 Requires-Dist: isort; extra == "tests"
 Requires-Dist: black; extra == "tests"
 Requires-Dist: flake8; extra == "tests"
+Requires-Dist: factory-boy; extra == "tests"
 Provides-Extra: coverage
 Requires-Dist: pytest-cov; extra == "coverage"
 Provides-Extra: docs
@@ -78,7 +80,7 @@ Requires-Dist: twine; extra == "release"
 Open API Framework
 ==================
 
-:Version: 0.8.0
+:Version: 0.9.0
 :Source: https://github.com/maykinmedia/open-api-framework
 :Keywords: metapackage, dependencies
 

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/open_api_framework.egg-info/SOURCES.txt

@@ -5,9 +5,11 @@ README.rst
 pyproject.toml
 setup.cfg
 open_api_framework/__init__.py
+open_api_framework/admin.py
 open_api_framework/apps.py
 open_api_framework/context_processors.py
 open_api_framework/py.typed
+open_api_framework/utils.py
 open_api_framework.egg-info/PKG-INFO
 open_api_framework.egg-info/SOURCES.txt
 open_api_framework.egg-info/dependency_links.txt
@@ -27,5 +29,6 @@ open_api_framework/templates/open_api_framework/components/version.html
 open_api_framework/templatetags/__init__.py
 open_api_framework/templatetags/doc_tags.py
 open_api_framework/templatetags/open_api_framework.py
+tests/test_admin.py
 tests/test_config_helpers.py
 tests/test_generate_envvar_docs.py

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/open_api_framework.egg-info/requires.txt

@@ -9,7 +9,7 @@ django-redis>=5.4.0
 djangorestframework>=3.15.2
 djangorestframework-gis>=1.0
 django-filter>=24.2
-drf-spectacular>=0.27.2
+drf-spectacular[sidecar]>=0.27.2
 django-csp>=3.8
 djangorestframework-inclusions>=1.2.0
 commonground-api-common>=1.12.1
@@ -27,6 +27,7 @@ celery>=5.4.0
 flower>=2.0.1
 maykin-2fa>=1.0.1
 django-setup-configuration>=0.1.0
+django-sessionprofile>=3.0.0
 
 [coverage]
 pytest-cov
@@ -46,3 +47,4 @@ tox
 isort
 black
 flake8
+factory-boy

{open_api_framework-0.8.0 → open_api_framework-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open_api_framework"
-version = "0.8.0"
+version = "0.9.0"
 description = "A metapackage for registration components, that bundles the dependencies shared between these components and provides generic settings"
 authors = [
     {name = "Maykin Media", email = "support@maykinmedia.nl"}
@@ -38,7 +38,7 @@ dependencies = [
     "djangorestframework>=3.15.2",
     "djangorestframework-gis>=1.0",
     "django-filter>=24.2",
-    "drf-spectacular>=0.27.2",
+    "drf-spectacular[sidecar]>=0.27.2",
     "django-csp>=3.8",
     "djangorestframework-inclusions>=1.2.0",
     "commonground-api-common>=1.12.1",
@@ -56,6 +56,7 @@ dependencies = [
     "flower>=2.0.1",
     "maykin-2fa>=1.0.1",
     "django-setup-configuration>=0.1.0",
+    "django-sessionprofile>=3.0.0",
 ]
 
 [project.urls]
@@ -72,6 +73,7 @@ tests = [
     "isort",
     "black",
     "flake8",
+    "factory-boy",
 ]
 coverage = [
     "pytest-cov",
@@ -101,7 +103,7 @@ testpaths = ["tests"]
 DJANGO_SETTINGS_MODULE = "testapp.settings"
 
 [tool.bumpversion]
-current_version = "0.8.0"
+current_version = "0.9.0"
 files = [
     {filename = "pyproject.toml"},
     {filename = "README.rst"},

open_api_framework-0.9.0/tests/test_admin.py

@@ -0,0 +1,197 @@
+from django.contrib.sessions.backends.cache import SessionStore as CachedSessionStore
+from django.contrib.sessions.backends.db import SessionStore as DBSessionStore
+from django.contrib.sessions.models import Session
+from django.test import override_settings
+from django.urls import reverse
+
+import pytest
+from sessionprofile.models import SessionProfile
+
+from open_api_framework.utils import get_session_store
+
+from .factories import SessionProfileFactory
+
+
+@pytest.fixture
+def session_changelist_url():
+    return reverse("admin:sessionprofile_sessionprofile_changelist")
+
+
+def test_session_profile_sanity(client, admin_user, session_changelist_url):
+
+    client.force_login(admin_user)
+    response = client.get(session_changelist_url)
+    assert response.status_code == 200
+
+    assert SessionProfile.objects.count() == 1
+
+    session = SessionProfile.objects.get()
+    assert client.session.session_key == session.session_key
+
+
+def test_only_session_profile_of_user_shown(
+    client, admin_user, django_user_model, session_changelist_url
+):
+
+    other_admin = django_user_model.objects.create_superuser("garry")
+
+    client.force_login(other_admin)
+    response = client.get(session_changelist_url)
+    assert response.status_code == 200
+
+    client.force_login(admin_user)
+    response = client.get(session_changelist_url)
+    assert response.status_code == 200
+
+    # two sessions, one for each user
+    assert SessionProfile.objects.count() == 2
+
+    # Session created after response, needs to be called again
+    response = client.get(session_changelist_url)
+
+    admin_user_session = SessionProfile.objects.get(user=admin_user)
+    assert admin_user_session.session_key in response.content.decode()
+
+    other_user_session = SessionProfile.objects.get(user=other_admin)
+    assert other_user_session.session_key not in response.content.decode()
+
+    # should only be able to access own page
+    change_url = reverse(
+        "admin:sessionprofile_sessionprofile_change",
+        args=[admin_user_session.session_key],
+    )
+    response = client.get(change_url)
+    assert response.status_code == 200
+
+    change_url = reverse(
+        "admin:sessionprofile_sessionprofile_change",
+        args=[other_user_session.session_key],
+    )
+    response = client.get(change_url)
+    assert response.status_code == 302
+    assert response.url == reverse("admin:index")
+
+
+def test_cant_delete_other_users_session(client, admin_user, django_user_model):
+    client.force_login(admin_user)
+
+    other_admin = django_user_model.objects.create_superuser("garry")
+
+    other_user_session = SessionProfileFactory(user=other_admin)
+
+    delete_url = reverse(
+        "admin:sessionprofile_sessionprofile_delete",
+        args=[other_user_session.session_key],
+    )
+
+    response = client.post(delete_url, {"post": "yes"})
+    assert response.status_code == 302
+
+    SessionStore = get_session_store()
+
+    assert SessionStore().exists(other_user_session.session_key)
+
+
+def test_delete_with_session_db_backend(client, admin_user, session_changelist_url):
+    client.force_login(admin_user)
+
+    session = SessionProfileFactory(user=admin_user)
+
+    assert SessionProfile.objects.count() == 1
+    # sesison created by login
+    assert Session.objects.count() == 2
+    assert DBSessionStore().exists(session.session_key)
+
+    url = reverse("admin:sessionprofile_sessionprofile_delete", args=[session.pk])
+
+    response = client.post(url, {"post": "yes"})
+    assert response.status_code == 302
+
+    # new session saved upon request
+    assert SessionProfile.objects.count() == 1
+    assert SessionProfile.objects.count() != session
+    assert Session.objects.count() == 1
+    assert not DBSessionStore().exists(session.session_key)
+
+
+@override_settings(SESSION_ENGINE="django.contrib.sessions.backends.cache")
+def test_delete_with_session_cache_backend(client, admin_user, session_changelist_url):
+    client.force_login(admin_user)
+
+    session = SessionProfileFactory(user=admin_user)
+
+    assert SessionProfile.objects.count() == 1
+    assert Session.objects.count() == 0
+    assert CachedSessionStore().exists(session.session_key)
+
+    url = reverse("admin:sessionprofile_sessionprofile_delete", args=[session.pk])
+
+    response = client.post(url, {"post": "yes"})
+    assert response.status_code == 302
+
+    # new session saved upon request
+    assert SessionProfile.objects.count() == 1
+    assert SessionProfile.objects.count() != session
+    assert Session.objects.count() == 0
+    assert not CachedSessionStore().exists(session.session_key)
+
+
+def test_delete_action_with_session_db_backend(
+    client, admin_user, session_changelist_url
+):
+    client.force_login(admin_user)
+    sessions = SessionProfileFactory.create_batch(5, user=admin_user)
+
+    # one created from user login
+    assert Session.objects.count() == 6
+    assert SessionProfile.objects.count() == 5
+
+    session_keys = [session.session_key for session in sessions]
+    for session_key in session_keys:
+        assert DBSessionStore().exists(session_key)
+
+    response = client.post(
+        session_changelist_url,
+        {"action": "delete_selected", "_selected_action": session_keys, "post": "yes"},
+    )
+    assert response.status_code == 302
+
+    # one is created as the post request is sent
+    assert SessionProfile.objects.count() == 1
+    assert Session.objects.count() == 1
+
+    for session_key in session_keys:
+        assert not DBSessionStore().exists(session_key)
+
+
+@override_settings(SESSION_ENGINE="django.contrib.sessions.backends.cache")
+def test_delete_action_with_session_cache_backend(
+    client, admin_user, session_changelist_url
+):
+
+    client.force_login(admin_user)
+    sessions = SessionProfileFactory.create_batch(5, user=admin_user)
+
+    # no db sessions are created
+    assert Session.objects.count() == 0
+    assert SessionProfile.objects.count() == 5
+
+    session_keys = [session.session_key for session in sessions]
+
+    # sessions are created
+    for session_key in session_keys:
+        assert CachedSessionStore().exists(session_key)
+
+    response = client.post(
+        session_changelist_url,
+        {"action": "delete_selected", "_selected_action": session_keys, "post": "yes"},
+    )
+    assert response.status_code == 302
+
+    # one is created as the post request is sent
+    assert SessionProfile.objects.count() == 1
+    assert Session.objects.count() == 0
+
+    # sessions should be deleted
+    for session_key in session_keys:
+        assert not CachedSessionStore().exists(session_key)