py2http 0.1.62__tar.gz → 0.1.64__tar.gz

{py2http-0.1.62 → py2http-0.1.64}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.62
+Version: 0.1.64
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

py2http-0.1.64/py2http/middleware.py

@@ -0,0 +1,154 @@
+"""
+py2http is a Python module that allows you to dispatch Python functions as HTTP
+services.
+By running a basic HTTP service from a list of functions, you can access OpenAPI
+specifications, Swagger documentation, and utilize the HTTP service's routes.
+Additionally, Py2http provides features for method transformation, input mapping,
+output mapping, error handling, and client generation.
+
+The code snippet provided below is a part of Py2http module and includes middleware
+functions for handling JWT authentication and superadmin authorization.
+These middleware functions are designed to be used within the Py2http framework to
+ensure secure and authenticated access to HTTP routes.
+
+Include the following docstring to describe this module:
+"Middleware functions for handling JWT authentication and superadmin authorization
+within the Py2http framework. These functions ensure secure access to HTTP routes
+by verifying credentials and permissions. Use these middleware functions to enforce
+authentication and control access to web resources.
+"""
+
+import json
+from collections.abc import Iterable
+from warnings import warn
+
+from py2http.constants import JSON_CONTENT_TYPE
+
+DFLT_JWT_ALGORITHMS = ("HS256",)
+DFLT_PUBLIC_ROUTES = ("ping", "openapi")
+
+
+def _algorithm_family(algorithm: str) -> str:
+    """The key family an algorithm verifies with: a shared secret for ``HS*``, a
+    public key otherwise.
+
+    >>> _algorithm_family('HS512'), _algorithm_family('RS256'), _algorithm_family('ES256')
+    ('hmac', 'public-key', 'public-key')
+    """
+    return "hmac" if algorithm.upper().startswith("HS") else "public-key"
+
+
+def mk_jwt_middleware(
+    secret,
+    verify=True,
+    *,
+    algorithms: Iterable[str] = DFLT_JWT_ALGORITHMS,
+    public_routes: Iterable[str] = DFLT_PUBLIC_ROUTES,
+    allow_mixed_algorithm_families: bool = False,
+):
+    """Make an aiohttp middleware that requires a valid ``Authorization: Bearer``
+    JWT on every request, and puts the decoded claims on ``request.token``.
+
+    Args:
+        secret: The key tokens are verified with (an HMAC secret for ``HS*``
+            algorithms, a public key for ``RS*``/``ES*``/...).
+        verify: If False, signatures and claims (``exp``, ...) are NOT checked:
+            whatever a token says ends up on ``request.token``, and an
+            undecodable token only triggers a warning. For development only.
+            (Before, PyJWT 2 ignored the legacy option this passed, so
+            signatures were still checked even with ``verify=False``.)
+        algorithms: The algorithms a token may be signed with (PyJWT names,
+            case-sensitive; ``"none"`` is refused). Defaults to ``("HS256",)``,
+            as ``py2http.bottle_plugins.JWTPlugin`` does.
+        public_routes: Names of aiohttp routes (``name=`` in ``add_route``) that
+            need no token. Matched on the route name, not the handler's
+            ``__name__``, so a handler that happens to be called ``ping`` is not
+            public by accident. Route names are matched in sub-applications
+            too, so a sub-app route named ``ping`` is public as well.
+        allow_mixed_algorithm_families: Accepting an HMAC algorithm and a
+            public-key algorithm with one ``secret`` is the classic
+            algorithm-confusion setup (a token "signed" with HS256 using the
+            public key as the HMAC secret), so it raises ``ValueError`` unless
+            this is True. The middleware used to accept ``["HS256", "RS256"]``;
+            pass that list with this flag to restore it.
+    """
+    import jwt
+    from aiohttp import web
+
+    for name, value in [("algorithms", algorithms), ("public_routes", public_routes)]:
+        if isinstance(value, (str, bytes)):
+            raise TypeError(f"{name} must be a list of names, e.g. [{value!r}]")
+    algorithms = list(algorithms)
+    if not algorithms:
+        raise ValueError("algorithms must name at least one JWT algorithm")
+    known = set(jwt.algorithms.get_default_algorithms()) - {"none"}
+    if unknown := [a for a in algorithms if a not in known]:
+        raise ValueError(
+            f"Unknown or unsigned JWT algorithm(s) {unknown}; names are "
+            f"case-sensitive, choose from {sorted(known)}"
+        )
+    if verify and not secret:
+        raise ValueError("secret must be a non-empty key when verify=True")
+    families = {_algorithm_family(a) for a in algorithms}
+    if verify and "hmac" in families and not isinstance(secret, (str, bytes)):
+        raise TypeError(f"an HMAC secret must be str or bytes, got {type(secret)}")
+    if len(families) > 1 and not allow_mixed_algorithm_families:
+        raise ValueError(
+            f"algorithms={algorithms} mixes HMAC and public-key algorithms with one "
+            "secret, which allows algorithm-confusion forgeries; use one family, or "
+            "pass allow_mixed_algorithm_families=True if you really mean it"
+        )
+    public_routes = frozenset(name for name in public_routes if name is not None)
+
+    def _unauthorized(message):
+        return web.HTTPUnauthorized(
+            text=json.dumps({"error": message}),
+            content_type=JSON_CONTENT_TYPE,
+        )
+
+    @web.middleware
+    async def middleware(req, handler):
+        route = req.match_info.route
+        if getattr(route, "name", None) in public_routes:
+            return await handler(req)
+        auth_header = req.headers.get("Authorization", "")
+        token = auth_header[7:] if auth_header[:7].lower() == "bearer " else ""
+        try:
+            decoded = jwt.decode(
+                token,
+                secret,
+                options={"verify_signature": verify},
+                algorithms=algorithms,
+            )
+        except jwt.PyJWTError as error:  # incl. a key unfit for the token's alg
+            if verify:
+                # InvalidTokenError texts describe the token ("Signature has
+                # expired"); other PyJWTErrors can describe the server's key
+                reason = (
+                    str(error)
+                    if isinstance(error, jwt.InvalidTokenError)
+                    else "not acceptable"
+                )
+                raise _unauthorized(f"Invalid authentication token: {reason}")
+            warn(f"Invalid JWT: {error}")
+            return await handler(req)
+        req.token = decoded
+        return await handler(req)
+
+    return middleware
+
+
+def mk_superadmin_middleware(secret):
+    from aiohttp import web
+
+    @web.middleware
+    async def middleware(req, handler):
+        auth_header = req.headers.get("Authorization", "")
+        if auth_header == secret:
+            return await handler(req)
+        return web.HTTPUnauthorized(
+            text=json.dumps({"error": "invalid API key"}),
+            content_type=JSON_CONTENT_TYPE,
+        )
+
+    return middleware

{py2http-0.1.62 → py2http-0.1.64}/py2http/service.py

@@ -16,6 +16,9 @@ Python functions, enabling developers to easily expose their functions as remote
 with minimal setup."""
 
 import inspect
+from collections import OrderedDict
+from collections.abc import MutableMapping
+from types import ModuleType
 from uuid import uuid4
 from aiohttp import web
 import asyncio
@@ -53,7 +56,146 @@ from py2http.schema_tools import (
 from py2http.util import TypeAsserter
 from py2http.constants import JSON_CONTENT_TYPE
 
-obj_store = {}
+# Maximum number of objects a class endpoint keeps alive; the least recently used
+# one is evicted beyond that. Pass ``obj_store=...`` in a handler to change it.
+# Note: this bounds the number of objects, not their size, and object ids are the
+# only access control (any client holding an id can use the object).
+DFLT_OBJ_STORE_MAX_SIZE = 1000
+
+
+class LRUObjStore(MutableMapping):
+    """A mapping that keeps at most ``max_size`` items, evicting the least recently
+    used one when a new key would exceed it.
+
+    Used as the default store of objects created through a class endpoint, so that
+    clients cannot grow server memory without bound by creating objects.
+
+    >>> s = LRUObjStore(max_size=2)
+    >>> s['a'], s['b'] = 1, 2
+    >>> _ = s['a']  # 'a' is now the most recently used
+    >>> s['c'] = 3
+    >>> sorted(s)
+    ['a', 'c']
+    """
+
+    def __init__(self, *, max_size: int = DFLT_OBJ_STORE_MAX_SIZE):
+        if max_size < 1:
+            raise ValueError(f"max_size must be at least 1, got {max_size}")
+        self.max_size = max_size
+        self._data = OrderedDict()
+
+    def __getitem__(self, k):
+        v = self._data[k]
+        self._data.move_to_end(k)
+        return v
+
+    def __setitem__(self, k, v):
+        self._data[k] = v
+        self._data.move_to_end(k)
+        while len(self._data) > self.max_size:
+            self._data.popitem(last=False)
+
+    def __delitem__(self, k):
+        del self._data[k]
+
+    def __iter__(self):
+        return iter(self._data)
+
+    def __len__(self):
+        return len(self._data)
+
+
+def public_attr(obj, attr_name: str) -> bool:
+    """The attribute policy ``attr_names='*'`` stands for: only public methods.
+
+    A name is dispatchable if it does not start with ``_`` and
+
+    - for a module: it is a function that the module defines (or lists in its
+      ``__all__``), never something it merely imports, nor plain data;
+    - otherwise: it is a plain Python function, ``staticmethod``,
+      ``classmethod`` or ``property`` defined in the object's class (or a base
+      class), and the instance does not shadow it.
+
+    This keeps private helpers, dunders (``__dict__``, ``__init__``, ...),
+    per-instance state (``__dict__`` entries, ``__slots__``, dataclass and
+    namedtuple fields) and callables merely assigned as class attributes
+    (``opener = open``) out of reach of HTTP clients.
+
+    Note that every public method is exposed, inherited ones included (e.g. a
+    pydantic model's ``model_dump``). For anything holding secrets, or a mapping
+    whose mutators should stay private (``MutableMapping`` mixins such as
+    ``clear`` and ``pop`` are plain functions), list the names explicitly instead.
+
+    >>> class A:
+    ...     data = 0
+    ...     opener = open
+    ...     def f(self): ...
+    ...     def _g(self): ...
+    ...     def __init__(self): self.secret = 1
+    >>> [public_attr(A(), name)
+    ...  for name in ('f', '_g', '__init__', '__dict__', 'secret', 'data', 'opener')]
+    [True, False, False, False, False, False, False]
+    """
+    if not isinstance(attr_name, str) or attr_name.startswith("_"):
+        return False
+    if isinstance(obj, ModuleType):
+        return _is_public_module_function(obj, attr_name)
+    try:  # (bypassing any class-level ``__dict__`` attribute)
+        instance_dict = object.__getattribute__(obj, "__dict__")
+    except AttributeError:
+        instance_dict = {}
+    if attr_name in instance_dict:
+        return False  # instance state, or an instance attribute shadowing a method
+    # Look in the class's MRO dicts only (not the metaclass: ``mro``, ...), and at
+    # the raw class attribute, not what the instance would return for it
+    for klass in type(obj).__mro__:
+        if attr_name in vars(klass):
+            return _is_method_like(vars(klass)[attr_name])
+    return False
+
+
+def _is_method_like(class_attr) -> bool:
+    if isinstance(class_attr, (staticmethod, classmethod)):
+        class_attr = class_attr.__func__
+    return isinstance(class_attr, (FunctionType, property))
+
+
+def _is_public_module_function(module: ModuleType, attr_name: str) -> bool:
+    value = vars(module).get(attr_name)
+    if not inspect.isfunction(value):
+        return False
+    exported = getattr(module, "__all__", None)
+    if exported is not None:
+        return attr_name in exported
+    return value.__module__ == module.__name__
+
+
+def unsafe_any_attr(obj, attr_name: str) -> bool:
+    """Dispatch ANY attribute of the object, including private ones and dunders.
+
+    This was the behaviour of ``attr_names='*'`` before ``public_attr``: it lets a
+    client read ``__dict__``, call ``__init__`` with arguments of its choosing, and so
+    on. Use ``attr_names=unsafe_any_attr`` only when every client is trusted.
+    """
+    return isinstance(attr_name, str) and hasattr(obj, attr_name)
+
+
+def _attr_name_policy(attr_names) -> Callable[[Any, str], bool]:
+    """Normalize a handler's ``attr_names`` into a ``(obj, attr_name) -> bool``
+    predicate: ``'*'`` means ``public_attr``, a callable is used as is, and an
+    iterable of names is an explicit allow-list (dunders included, if listed).
+    """
+    if attr_names == "*":
+        return public_attr
+    if callable(attr_names):
+        return attr_names
+    if isinstance(attr_names, str):
+        allowed = {attr_names}
+    else:
+        allowed = set(attr_names)
+    return lambda obj, attr_name: (
+        isinstance(attr_name, str) and attr_name in allowed and hasattr(obj, attr_name)
+    )
 
 
 def method_not_found(method_name):
@@ -617,8 +759,12 @@ def _get_func_to_dispatch_handler(handler):
         return endpoint
         # was return endpoint, but then the output didn't get the __name__ = name
         # func = endpoint
+    is_dispatchable = _attr_name_policy(attr_names)
     if inspect.isclass(endpoint):
         cls = endpoint
+        obj_store = handler.get("obj_store")
+        if obj_store is None:
+            obj_store = LRUObjStore()
 
         def func(_obj_id=None, _attr_name=None, **kwargs):
             if _obj_id is None:
@@ -628,25 +774,24 @@ def _get_func_to_dispatch_handler(handler):
                 new_id = str(uuid4())
                 obj_store[new_id] = new_obj
                 return new_id
-            obj = obj_store.get(_obj_id)
-            if not obj:
+            obj = obj_store.get(_obj_id) if isinstance(_obj_id, str) else None
+            if obj is None:
                 raise InputError(f"No object found with id {_obj_id}")
             if _attr_name is None:
                 raise InputError("_attr_name must be provided when _obj_id is not None")
-            return _get_attr_value(obj, _attr_name, attr_names, **kwargs)
+            return _get_attr_value(obj, _attr_name, is_dispatchable, **kwargs)
 
     else:
 
         def func(_attr_name=None, **kwargs):
-            return _get_attr_value(endpoint, _attr_name, attr_names, **kwargs)
+            return _get_attr_value(endpoint, _attr_name, is_dispatchable, **kwargs)
 
     func.__name__ = name
     return func
 
 
-def _get_attr_value(obj, attr_name, valid_attr_names, **kwargs):
-    valid_attr_names = [attr_name] if valid_attr_names == "*" else valid_attr_names
-    if attr_name not in valid_attr_names or not hasattr(obj, attr_name):
+def _get_attr_value(obj, attr_name, is_dispatchable, /, **kwargs):
+    if not is_dispatchable(obj, attr_name):
         raise InputError(
             f"No attribute found with name {attr_name} or it is not dispatched"
         )

py2http-0.1.64/py2http/tests/test_attr_dispatch.py

@@ -0,0 +1,284 @@
+"""Object/attribute dispatch (``attr_names``) only exposes what was meant to be exposed."""
+
+import pytest
+from i2.errors import InputError
+
+from py2http.service import (
+    LRUObjStore,
+    _get_func_to_dispatch_handler,
+    public_attr,
+    unsafe_any_attr,
+)
+
+
+class Counter:
+    def __init__(self, start: int = 0):
+        self.count = start
+        self._secret = "s3cr3t"
+
+    def incr(self, by: int = 1):
+        self.count += by
+        return self.count
+
+    def _reset(self):
+        self.count = 0
+
+
+def _dispatcher(endpoint, attr_names, **handler_extras):
+    return _get_func_to_dispatch_handler(
+        dict(endpoint=endpoint, name="ep", attr_names=attr_names, **handler_extras)
+    )
+
+
+@pytest.mark.parametrize(
+    "attr_name", ["_reset", "_secret", "__dict__", "__init__", "__class__", "count"]
+)
+def test_star_refuses_private_dunder_and_instance_attrs(attr_name):
+    obj = Counter(5)
+    func = _dispatcher(obj, "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+    assert obj.count == 5
+
+
+def test_star_allows_public_methods():
+    func = _dispatcher(Counter(5), "*")
+    assert func(_attr_name="incr", by=2) == 7
+
+
+def test_star_on_class_endpoint():
+    func = _dispatcher(Counter, "*")
+    obj_id = func(start=3)
+    assert func(_obj_id=obj_id, _attr_name="incr") == 4
+    for attr_name in ("__init__", "__dict__", "_secret", "mro"):
+        with pytest.raises(InputError):
+            func(_obj_id=obj_id, _attr_name=attr_name)
+
+
+def test_explicit_list_unaffected():
+    """An explicit allow-list may name dunders on purpose (see examples/object_dispatch)."""
+
+    class Store(dict):
+        def __getitem__(self, key):
+            return super().__getitem__(key)
+
+    d = Store(a=1)
+    func = _dispatcher(d, ["__getitem__", "__len__"])
+    assert func(_attr_name="__getitem__", key="a") == 1
+    assert func(_attr_name="__len__") == 1
+    with pytest.raises(InputError):
+        func(_attr_name="clear")
+    with pytest.raises(InputError):
+        func(_attr_name="__dict__")
+    assert d == {"a": 1}
+
+
+def test_unsafe_any_attr_opt_in_restores_old_behaviour():
+    obj = Counter(5)
+    func = _dispatcher(obj, unsafe_any_attr)
+    func(_attr_name="_reset")
+    assert obj.count == 0
+
+
+def test_custom_predicate():
+    func = _dispatcher(Counter(1), lambda obj, name: name == "incr")
+    assert func(_attr_name="incr") == 2
+
+
+def test_public_attr_on_module():
+    import json
+
+    assert public_attr(json, "dumps")
+    assert not public_attr(json, "_default_encoder")
+    assert not public_attr(json, "__loader__")
+
+
+def test_obj_store_is_bounded():
+    store = LRUObjStore(max_size=2)
+    func = _dispatcher(Counter, "*", obj_store=store)
+    ids = [func(start=i) for i in range(3)]
+    assert len(store) == 2
+    with pytest.raises(InputError, match="No object found"):
+        func(_obj_id=ids[0], _attr_name="incr")
+    assert func(_obj_id=ids[2], _attr_name="incr") == 3
+
+
+def test_obj_store_default_is_bounded_lru():
+    func = _dispatcher(Counter, "*")
+    obj_id = func()
+    assert func(_obj_id=obj_id, _attr_name="incr") == 1
+
+
+def test_falsy_object_is_still_found():
+    func = _dispatcher(list, ["append", "__len__"])
+    obj_id = func()  # an empty list is falsy
+    assert func(_obj_id=obj_id, _attr_name="__len__") == 0
+
+
+def test_lru_obj_store_rejects_bad_size():
+    with pytest.raises(ValueError):
+        LRUObjStore(max_size=0)
+
+
+# --- shapes found by the adversarial review: instance state must stay private ---
+
+from dataclasses import dataclass
+from types import ModuleType
+from typing import NamedTuple
+
+
+class Slotted:
+    __slots__ = ("token",)
+
+    def __init__(self):
+        self.token = "TOK"
+
+    def ping(self):
+        return "pong"
+
+
+@dataclass
+class DC:
+    token: str = "default"
+
+    def ping(self):
+        return "pong"
+
+
+class NT(NamedTuple):
+    token: str
+
+    def ping(self):
+        return "pong"
+
+
+class Odd:
+    count = 0
+    opener = open
+    Nested = dict
+
+    def __init__(self):
+        self.count = 42
+        self.incr = lambda: "shadowed"
+
+    def incr(self):
+        return "real"
+
+    @staticmethod
+    def s():
+        return "static"
+
+    @classmethod
+    def c(cls):
+        return "class"
+
+    @property
+    def p(self):
+        return "prop"
+
+
+@pytest.mark.parametrize(
+    "obj", [Slotted(), DC(token="TOK"), NT(token="TOK")], ids=["slots", "dc", "nt"]
+)
+def test_star_refuses_fields(obj):
+    func = _dispatcher(obj, "*")
+    with pytest.raises(InputError):
+        func(_attr_name="token")
+    assert func(_attr_name="ping") == "pong"
+
+
+@pytest.mark.parametrize("attr_name", ["count", "opener", "Nested", "incr"])
+def test_star_refuses_data_shadowed_and_assigned_callables(attr_name):
+    func = _dispatcher(Odd(), "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+
+
+def test_star_allows_static_class_methods_and_properties():
+    func = _dispatcher(Odd(), "*")
+    assert [func(_attr_name=n) for n in ("s", "c", "p")] == ["static", "class", "prop"]
+
+
+def test_star_refuses_builtin_mapping_mutators():
+    class Store(dict):
+        def keys_list(self):
+            return list(self)
+
+    d = Store(a=1)
+    func = _dispatcher(d, "*")
+    with pytest.raises(InputError):
+        func(_attr_name="clear")
+    assert func(_attr_name="keys_list") == ["a"] and d == {"a": 1}
+
+
+def _mk_module(name, *, all_=None):
+    mod = ModuleType(name)
+    exec(
+        "from os import listdir\nfrom json import dumps\nimport os\nAPI_KEY = 'k-123'\n"
+        "def hello():\n    return 'hi'\n",
+        vars(mod),
+    )
+    if all_ is not None:
+        mod.__all__ = all_
+    return mod
+
+
+@pytest.mark.parametrize("attr_name", ["listdir", "dumps", "os", "API_KEY"])
+def test_star_on_module_refuses_imports_and_data(attr_name):
+    func = _dispatcher(_mk_module("some_service"), "*")
+    with pytest.raises(InputError):
+        func(_attr_name=attr_name)
+    assert func(_attr_name="hello") == "hi"
+
+
+def test_star_on_module_honours_all():
+    mod = _mk_module("some_service", all_=["dumps", "listdir"])
+    assert public_attr(mod, "dumps")  # a re-export listed in __all__
+    assert not public_attr(mod, "listdir")  # listed, but not a Python function
+    assert not public_attr(mod, "hello")  # not listed
+
+
+@pytest.mark.parametrize("bad", [["x"], {"a": 1}, 3, None])
+def test_non_str_names_and_ids_are_input_errors(bad):
+    func = _dispatcher({"x": 1}, ["x", "__len__"])
+    if bad is not None:
+        with pytest.raises(InputError):
+            func(_attr_name=bad)
+    cls_func = _dispatcher(Counter, "*")
+    with pytest.raises(InputError):
+        cls_func(_obj_id=bad if bad is not None else [], _attr_name="incr")
+
+
+def test_method_params_named_like_dispatch_internals():
+    class A:
+        def f(self, obj, attr_name, is_dispatchable):
+            return [obj, attr_name, is_dispatchable]
+
+    func = _dispatcher(A(), "*")
+    assert func(_attr_name="f", obj=1, attr_name=2, is_dispatchable=3) == [1, 2, 3]
+
+
+def test_star_exposes_mutable_mapping_mixins_as_documented():
+    """Inherited public Python methods ARE dispatched: use an explicit list for stores."""
+    from collections.abc import MutableMapping
+
+    class MM(MutableMapping):
+        def __init__(self):
+            self._d = {"a": 1}
+
+        def __getitem__(self, k):
+            return self._d[k]
+
+        def __setitem__(self, k, v):
+            self._d[k] = v
+
+        def __delitem__(self, k):
+            del self._d[k]
+
+        def __iter__(self):
+            return iter(self._d)
+
+        def __len__(self):
+            return len(self._d)
+
+    assert public_attr(MM(), "clear")

py2http-0.1.64/py2http/tests/test_jwt_middleware.py

@@ -0,0 +1,179 @@
+"""``mk_jwt_middleware`` verifies signatures, pins algorithms, and only lets named
+public routes through without a token."""
+
+import asyncio
+import base64
+import hashlib
+import hmac
+import json
+import time
+
+import jwt
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from py2http.middleware import mk_jwt_middleware
+
+SECRET = "s3cret-for-tests-only-0123456789abcdef"
+
+
+async def _whoami(request):
+    return web.json_response(getattr(request, "token", None))
+
+
+async def ping(request):  # a handler whose __name__ is "ping", on a private route
+    return web.json_response("private")
+
+
+def _app(middleware):
+    app = web.Application(middlewares=[middleware])
+    app.router.add_get("/ping", _whoami, name="ping")
+    app.router.add_get("/me", _whoami, name="me")
+    app.router.add_get("/secret", ping)
+    return app
+
+
+def _get(middleware, path, token=None):
+    """GET ``path`` on a fresh app (an aiohttp app is bound to one event loop)."""
+    app = _app(middleware)
+
+    async def go():
+        headers = {"Authorization": f"Bearer {token}"} if token is not None else {}
+        async with TestClient(TestServer(app)) as client:
+            resp = await client.get(path, headers=headers)
+            return resp.status, await resp.text()
+
+    return asyncio.run(go())
+
+
+def _b64(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def _hs256_with_key(claims, key: bytes) -> str:
+    """Sign by hand, so tests can forge what PyJWT itself refuses to produce."""
+    signing_input = f"{_b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())}.{_b64(json.dumps(claims).encode())}"
+    sig = hmac.new(key, signing_input.encode(), hashlib.sha256).digest()
+    return f"{signing_input}.{_b64(sig)}"
+
+
+def test_valid_token_is_decoded_onto_request():
+    token = jwt.encode({"sub": "alice"}, SECRET, algorithm="HS256")
+    status, body = _get(mk_jwt_middleware(SECRET), "/me", token)
+    assert status == 200 and json.loads(body) == {"sub": "alice"}
+
+
+@pytest.mark.parametrize(
+    "token",
+    [
+        None,
+        "",
+        "garbage",
+        jwt.encode(
+            {"sub": "alice"}, "wrong-secret-0123456789abcdef0123", algorithm="HS256"
+        ),
+        _b64(b'{"alg":"none","typ":"JWT"}') + "." + _b64(b'{"sub":"alice"}') + ".",
+        jwt.encode(
+            {"sub": "alice", "exp": int(time.time()) - 60}, SECRET, algorithm="HS256"
+        ),
+        jwt.encode({"sub": "alice"}, SECRET, algorithm="HS512"),  # not an allowed alg
+    ],
+)
+def test_bad_tokens_get_401_and_no_echo(token):
+    status, body = _get(mk_jwt_middleware(SECRET), "/me", token)
+    assert status == 401
+    if token:
+        assert token not in body
+
+
+def test_public_routes_are_matched_by_route_name_not_handler_name():
+    mw = mk_jwt_middleware(SECRET)
+    assert _get(mw, "/ping")[0] == 200
+    assert _get(mw, "/secret")[0] == 401  # handler is called "ping", route is not
+    mw = mk_jwt_middleware(SECRET, public_routes=())
+    assert _get(mw, "/ping")[0] == 401
+
+
+def test_mixed_algorithm_families_need_explicit_opt_in():
+    with pytest.raises(ValueError, match="algorithm-confusion"):
+        mk_jwt_middleware(SECRET, algorithms=["HS256", "RS256"])
+    with pytest.raises(ValueError):
+        mk_jwt_middleware(SECRET, algorithms=[])
+    mk_jwt_middleware(
+        SECRET, algorithms=["HS256", "RS256"], allow_mixed_algorithm_families=True
+    )
+
+
+def test_algorithm_confusion_forgery_is_rejected_with_public_key_secret():
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    public_pem = private.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    mw = mk_jwt_middleware(public_pem, algorithms=["RS256"])
+    genuine = jwt.encode({"sub": "alice"}, private, algorithm="RS256")
+    assert _get(mw, "/me", genuine)[0] == 200
+    forged = _hs256_with_key({"sub": "mallory"}, public_pem)
+    assert _get(mw, "/me", forged)[0] == 401
+
+
+def test_verify_false_skips_signature_check():
+    token = jwt.encode(
+        {"sub": "alice"}, "another-secret-0123456789abcdef01", algorithm="HS256"
+    )
+    with pytest.warns(UserWarning):
+        status, _ = _get(mk_jwt_middleware(SECRET, verify=False), "/me", "garbage")
+    assert status == 200
+    status, body = _get(mk_jwt_middleware(SECRET, verify=False), "/me", token)
+    assert status == 200 and json.loads(body) == {"sub": "alice"}
+
+
+@pytest.mark.parametrize(
+    "kwargs, error",
+    [
+        ({"algorithms": "HS256"}, TypeError),
+        ({"algorithms": ["hs256"]}, ValueError),
+        ({"algorithms": ["none"]}, ValueError),
+        ({"algorithms": ["RS256", "none"]}, ValueError),
+        ({"public_routes": "ping"}, TypeError),
+    ],
+)
+def test_bad_algorithm_config_fails_at_construction(kwargs, error):
+    with pytest.raises(error):
+        mk_jwt_middleware(SECRET, **kwargs)
+
+
+@pytest.mark.parametrize("secret", ["", b"", None, 12345])
+def test_empty_or_unusable_secret_fails_at_construction(secret):
+    with pytest.raises((ValueError, TypeError)):
+        mk_jwt_middleware(secret)
+
+
+def test_key_unfit_for_token_algorithm_is_401_not_500():
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    public_pem = (
+        rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        .public_key()
+        .public_bytes(
+            serialization.Encoding.PEM,
+            serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+    )
+    mw = mk_jwt_middleware(
+        public_pem,
+        algorithms=["HS256", "RS256"],
+        allow_mixed_algorithm_families=True,
+    )
+    forged = _hs256_with_key({"sub": "mallory"}, public_pem)
+    status, body = _get(mw, "/me", forged)
+    assert status == 401 and "asymmetric" not in body.lower()
+
+
+def test_none_in_public_routes_does_not_open_unnamed_routes():
+    mw = mk_jwt_middleware(SECRET, public_routes=["ping", None])
+    assert _get(mw, "/secret")[0] == 401

{py2http-0.1.62 → py2http-0.1.64}/py2http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.62
+Version: 0.1.64
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

{py2http-0.1.62 → py2http-0.1.64}/py2http.egg-info/SOURCES.txt

@@ -33,9 +33,11 @@ py2http/tests/__init__.py
 py2http/tests/example_service_test.py
 py2http/tests/objects_for_testing.py
 py2http/tests/simple_run_process_test.py
+py2http/tests/test_attr_dispatch.py
 py2http/tests/test_binary_req.py
 py2http/tests/test_decorators.py
 py2http/tests/test_flask.py
+py2http/tests/test_jwt_middleware.py
 py2http/tests/test_not_set_defaults.py
 py2http/tests/test_p2h2p.py
 py2http/tests/utils_for_testing.py

{py2http-0.1.62 → py2http-0.1.64}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = py2http
-version = 0.1.62
+version = 0.1.64
 url = https://github.com/i2mint/py2http
 root_url = https://github.com/i2mint
 platforms = any

py2http-0.1.62/py2http/middleware.py

@@ -1,71 +0,0 @@
-"""
-py2http is a Python module that allows you to dispatch Python functions as HTTP
-services.
-By running a basic HTTP service from a list of functions, you can access OpenAPI
-specifications, Swagger documentation, and utilize the HTTP service's routes.
-Additionally, Py2http provides features for method transformation, input mapping,
-output mapping, error handling, and client generation.
-
-The code snippet provided below is a part of Py2http module and includes middleware
-functions for handling JWT authentication and superadmin authorization.
-These middleware functions are designed to be used within the Py2http framework to
-ensure secure and authenticated access to HTTP routes.
-
-Include the following docstring to describe this module:
-"Middleware functions for handling JWT authentication and superadmin authorization
-within the Py2http framework. These functions ensure secure access to HTTP routes
-by verifying credentials and permissions. Use these middleware functions to enforce
-authentication and control access to web resources.
-"""
-
-import json
-from warnings import warn
-from py2http.constants import JSON_CONTENT_TYPE
-
-
-def mk_jwt_middleware(secret, verify=True):
-    from aiohttp import web
-    import jwt
-
-    @web.middleware
-    async def middleware(req, handler):
-        if handler.__name__ == "ping" or handler.__name__ == "openapi":
-            return await handler(req)
-        auth_header = req.headers.get("Authorization", "")
-        token = auth_header[7:]
-        try:
-            decoded = jwt.decode(
-                token, secret, options={"verify": verify}, algorithms=["HS256", "RS256"]
-            )
-            req.token = decoded
-            return await handler(req)
-        except jwt.DecodeError as error:
-            if verify:
-                return web.HTTPUnauthorized(
-                    text=json.dumps(
-                        {
-                            "error": f'Invalid authentication token "{token}", {str(error)}'
-                        }
-                    ),
-                    content_type=JSON_CONTENT_TYPE,
-                )
-            warn(f"Invalid JWT: {token}")
-            return await handler(req)
-
-    return middleware
-
-
-def mk_superadmin_middleware(secret):
-    from aiohttp import web
-
-    @web.middleware
-    async def middleware(req, handler):
-        auth_header = req.headers.get("Authorization", "")
-        if auth_header == secret:
-            return await handler(req)
-        return web.HTTPUnauthorized(
-            text=json.dumps({"error": "invalid API key"}),
-            content_type=JSON_CONTENT_TYPE,
-        )
-
-    return middleware