oxutils 0.6.0__tar.gz → 0.6.2__tar.gz

{oxutils-0.6.0 → oxutils-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oxutils
-Version: 0.6.0
+Version: 0.6.2
 Summary: Production-ready utilities for Django applications in the Oxiliere ecosystem
 Keywords: django,utilities,jwt,audit,logging,celery,structlog
 Author: Edimedia Mutoke

{oxutils-0.6.0 → oxutils-0.6.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "oxutils"
-version = "0.6.0"
+version = "0.6.2"
 description = "Production-ready utilities for Django applications in the Oxiliere ecosystem"
 readme = "README.md"
 license = "LGPL-3.0-only"

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/__init__.py

@@ -40,7 +40,7 @@ Other:
       image validation, bound-request detection
 """
 
-__version__ = "0.6.0"
+__version__ = "0.6.2"
 
 from oxutils.conf import AUDIT_MIDDLEWARE, UTILS_APPS
 from oxutils.settings import oxi_settings

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/auth/mixins.py

@@ -2,6 +2,7 @@
 Cookie token mixin with configurable security flags.
 """
 from django.conf import settings
+from ninja_jwt.settings import api_settings
 
 from oxutils.auth.constants import ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE
 
@@ -39,6 +40,7 @@ class CookieTokenMixin:
             self.context.response.set_cookie(
                 key=REFRESH_TOKEN_COOKIE,
                 value=refresh_token,
+                max_age=int(api_settings.REFRESH_TOKEN_LIFETIME.total_seconds()),
                 httponly=httponly,
                 domain=domain,
                 secure=secure,
@@ -48,6 +50,7 @@ class CookieTokenMixin:
         self.context.response.set_cookie(
             key=ACCESS_TOKEN_COOKIE,
             value=access_token,
+            max_age=int(api_settings.ACCESS_TOKEN_LIFETIME.total_seconds()),
             httponly=httponly,
             domain=domain,
             secure=secure,

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/auth/sessions/controllers.py

@@ -33,8 +33,13 @@ class UserSessionController(ControllerBase):
 
     def _validate_current_session_age(self, request: HttpRequest) -> None:
         """
-        Validate that the current session (the one making the request) is older than 3 days
-        This ensures account security by preventing new sessions from deleting established sessions.
+        Validate that the current session (the one making the request) is older
+        than 3 days.
+
+        The age comes from the ``cat`` claim, stamped once when the session is
+        created. Rotating the refresh token preserves it, so a long-lived
+        session keeps the ability to revoke newer ones — even after a
+        reauthentication (which only moves ``rat``).
         """
         # Get the current session token from Authorization header
 

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/auth/tokens/tokens.py

@@ -18,7 +18,15 @@ class RefreshToken(DefaultRefreshToken):
 
     def __init__(self, token: Optional[Any] = None, verify: bool = True) -> None:
         super().__init__(token, verify)
+        # ``cat`` is the session creation time. It is stamped once, when the
+        # session opens, and never moves afterwards: rotating a token must not
+        # make an old session look new (the 3-day revoke guard relies on it).
         self.set_cat()  # type: ignore
+        # ``rat`` is the last time the user actually re-proved their identity.
+        # A brand-new token is "recently authenticated"; a rotated token
+        # inherits the claim from its predecessor.
+        if token is None:
+            self.set_rat()  # type: ignore
 
     def set_session(self, id_=None):
         """
@@ -46,6 +54,21 @@ class RefreshToken(DefaultRefreshToken):
 
         self.payload[claim] = datetime_to_epoch(at_time)
 
+    def set_rat(
+        self,
+        claim: str = "rat",
+        at_time: Optional[datetime] = None,
+        force: bool = False,
+    ) -> None:
+        """Set the last reauthentication time if absent (or force it)."""
+        if self.payload.get(claim) and not force:
+            return
+
+        if at_time is None:
+            at_time = self.current_time
+
+        self.payload[claim] = datetime_to_epoch(at_time)
+
     @classmethod
     def for_user(cls, user, request=None, enabled=True):
         """

oxutils-0.6.2/src/oxutils/auth/tokens/utils.py

@@ -0,0 +1,56 @@
+from typing import cast, Dict
+from oxutils.auth.tokens.app_settings import RefreshToken
+from oxutils.auth.tokens.models import (
+    RefreshTokenWhitelistModel,
+)
+from ninja_jwt.exceptions import InvalidToken
+from oxutils.auth.utils import is_email_verified
+
+
+
+
+def create_user_token(user, request):
+    refresh = RefreshToken.for_user(user, request=request)
+    return cast(RefreshToken, refresh)
+
+
+def refresh_token(token: str, context: Dict):
+    refresh = RefreshToken(token)
+
+    current = RefreshTokenWhitelistModel.objects.filter(
+        jti=refresh.payload["jti"]
+    ).first()
+    if current is None:
+        # Already rotated or revoked. It cannot authenticate anything anymore;
+        # deleting the whole session here would turn a benign concurrent
+        # refresh (multiple tabs, retries) into a logout.
+        raise InvalidToken()
+
+    if not current.enabled:
+        is_email_verified(current.user, raise_exception=True)
+        raise InvalidToken()
+
+    context = dict(context or {})
+    force = bool(context.pop("force", False))
+
+    data = {"access": str(refresh.access_token)}
+
+    refresh.set_jti()
+    refresh.set_exp()
+    refresh.set_iat()
+    # A rotation is not a reauthentication: only ``rat`` may move, and only
+    # when the caller explicitly re-proved the identity.
+    if force:
+        refresh.set_rat(force=True)
+
+    data["refresh"] = str(refresh)
+
+    # Rotate in place: ``created`` (session start), ``session`` and ``enabled``
+    # stay untouched, and bypassing ``RefreshTokenManager.create()`` keeps the
+    # rotation from counting as a new session (no eviction at the limit).
+    for field, value in context.items():
+        setattr(current, field, value)
+    current.jti = refresh.payload["jti"]
+    current.save()
+
+    return data

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/auth/utils.py

@@ -273,12 +273,17 @@ def did_recently_authenticate(request: HttpRequest) -> bool:
         return True
 
     user = get_token_user(request)
-    cat_claim = getattr(user, "token_created_at", None)
-    if not cat_claim:
+    # ``rat`` is the explicit reauthentication timestamp. Tokens minted before
+    # 0.6.2 only carry ``cat`` (their login time): falling back to it is safe,
+    # since it can never make an old token look freshly reauthenticated.
+    reauth_claim = getattr(user, "token_reauthenticated_at", None) or getattr(
+        user, "token_created_at", None
+    )
+    if not reauth_claim:
         return False
 
     try:
-        authenticated_at = datetime_from_epoch(cat_claim)
+        authenticated_at = datetime_from_epoch(reauth_claim)
         time_diff = time.time() - authenticated_at.timestamp()
         timeout = allauth_settings.REAUTHENTICATION_TIMEOUT
         return time_diff < timeout

{oxutils-0.6.0 → oxutils-0.6.2}/src/oxutils/jwt/models.py

@@ -19,6 +19,10 @@ class TokenUser(DefaultTonkenUser):
     def token_created_at(self):
         return self.token.get("cat", None)
 
+    @cached_property
+    def token_reauthenticated_at(self):
+        return self.token.get("rat", None)
+
     @cached_property
     def token_session(self):
         return self.token.get("session", None)

oxutils-0.6.0/src/oxutils/auth/tokens/utils.py

@@ -1,53 +0,0 @@
-from typing import cast, Dict
-from django.utils import timezone
-from oxutils.auth.tokens.app_settings import RefreshToken
-from oxutils.auth.tokens.models import (
-    RefreshTokenWhitelistModel,
-)
-from ninja_jwt.exceptions import InvalidToken
-from oxutils.auth.utils import is_email_verified
-
-
-
-
-def create_user_token(user, request):
-    refresh = RefreshToken.for_user(user, request=request)
-    return cast(RefreshToken, refresh)
-
-
-def refresh_token(token: str, context: Dict):
-    refresh = RefreshToken(token)
-
-    query_set = list(RefreshTokenWhitelistModel.objects.filter(jti=refresh.payload["jti"]).all())
-    if len(query_set) == 0:
-        # Suspicious operation
-        RefreshTokenWhitelistModel.objects.filter(session=refresh.payload["session"]).delete()
-        raise InvalidToken()
-    if not query_set[0].enabled:
-        is_email_verified(query_set[0].user, raise_exception=True)
-        raise InvalidToken()
-
-    data = {"access": str(refresh.access_token)}
-
-    RefreshTokenWhitelistModel.objects.filter(jti=refresh.payload["jti"]).delete()
-
-    refresh.set_jti()
-    refresh.set_exp()
-    refresh.set_iat()
-    refresh.set_cat(force=bool(context.pop('force', False)))
-
-    data["refresh"] = str(refresh)
-
-    serializer_data = {
-        'jti': refresh.payload['jti'],
-        'user_id': refresh.payload['user_id'],
-        'session': refresh.payload['session'],
-        'created': timezone.now(),
-        **context
-    }
-
-    RefreshTokenWhitelistModel.objects.create(
-        **serializer_data
-    )
-
-    return data