py2http 0.1.63__tar.gz → 0.1.65__tar.gz

{py2http-0.1.63 → py2http-0.1.65}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.63
+Version: 0.1.65
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

py2http-0.1.65/py2http/middleware.py

@@ -0,0 +1,154 @@
+"""
+py2http is a Python module that allows you to dispatch Python functions as HTTP
+services.
+By running a basic HTTP service from a list of functions, you can access OpenAPI
+specifications, Swagger documentation, and utilize the HTTP service's routes.
+Additionally, Py2http provides features for method transformation, input mapping,
+output mapping, error handling, and client generation.
+
+The code snippet provided below is a part of Py2http module and includes middleware
+functions for handling JWT authentication and superadmin authorization.
+These middleware functions are designed to be used within the Py2http framework to
+ensure secure and authenticated access to HTTP routes.
+
+Include the following docstring to describe this module:
+"Middleware functions for handling JWT authentication and superadmin authorization
+within the Py2http framework. These functions ensure secure access to HTTP routes
+by verifying credentials and permissions. Use these middleware functions to enforce
+authentication and control access to web resources.
+"""
+
+import json
+from collections.abc import Iterable
+from warnings import warn
+
+from py2http.constants import JSON_CONTENT_TYPE
+
+DFLT_JWT_ALGORITHMS = ("HS256",)
+DFLT_PUBLIC_ROUTES = ("ping", "openapi")
+
+
+def _algorithm_family(algorithm: str) -> str:
+    """The key family an algorithm verifies with: a shared secret for ``HS*``, a
+    public key otherwise.
+
+    >>> _algorithm_family('HS512'), _algorithm_family('RS256'), _algorithm_family('ES256')
+    ('hmac', 'public-key', 'public-key')
+    """
+    return "hmac" if algorithm.upper().startswith("HS") else "public-key"
+
+
+def mk_jwt_middleware(
+    secret,
+    verify=True,
+    *,
+    algorithms: Iterable[str] = DFLT_JWT_ALGORITHMS,
+    public_routes: Iterable[str] = DFLT_PUBLIC_ROUTES,
+    allow_mixed_algorithm_families: bool = False,
+):
+    """Make an aiohttp middleware that requires a valid ``Authorization: Bearer``
+    JWT on every request, and puts the decoded claims on ``request.token``.
+
+    Args:
+        secret: The key tokens are verified with (an HMAC secret for ``HS*``
+            algorithms, a public key for ``RS*``/``ES*``/...).
+        verify: If False, signatures and claims (``exp``, ...) are NOT checked:
+            whatever a token says ends up on ``request.token``, and an
+            undecodable token only triggers a warning. For development only.
+            (Before, PyJWT 2 ignored the legacy option this passed, so
+            signatures were still checked even with ``verify=False``.)
+        algorithms: The algorithms a token may be signed with (PyJWT names,
+            case-sensitive; ``"none"`` is refused). Defaults to ``("HS256",)``,
+            as ``py2http.bottle_plugins.JWTPlugin`` does.
+        public_routes: Names of aiohttp routes (``name=`` in ``add_route``) that
+            need no token. Matched on the route name, not the handler's
+            ``__name__``, so a handler that happens to be called ``ping`` is not
+            public by accident. Route names are matched in sub-applications
+            too, so a sub-app route named ``ping`` is public as well.
+        allow_mixed_algorithm_families: Accepting an HMAC algorithm and a
+            public-key algorithm with one ``secret`` is the classic
+            algorithm-confusion setup (a token "signed" with HS256 using the
+            public key as the HMAC secret), so it raises ``ValueError`` unless
+            this is True. The middleware used to accept ``["HS256", "RS256"]``;
+            pass that list with this flag to restore it.
+    """
+    import jwt
+    from aiohttp import web
+
+    for name, value in [("algorithms", algorithms), ("public_routes", public_routes)]:
+        if isinstance(value, (str, bytes)):
+            raise TypeError(f"{name} must be a list of names, e.g. [{value!r}]")
+    algorithms = list(algorithms)
+    if not algorithms:
+        raise ValueError("algorithms must name at least one JWT algorithm")
+    known = set(jwt.algorithms.get_default_algorithms()) - {"none"}
+    if unknown := [a for a in algorithms if a not in known]:
+        raise ValueError(
+            f"Unknown or unsigned JWT algorithm(s) {unknown}; names are "
+            f"case-sensitive, choose from {sorted(known)}"
+        )
+    if verify and not secret:
+        raise ValueError("secret must be a non-empty key when verify=True")
+    families = {_algorithm_family(a) for a in algorithms}
+    if verify and "hmac" in families and not isinstance(secret, (str, bytes)):
+        raise TypeError(f"an HMAC secret must be str or bytes, got {type(secret)}")
+    if len(families) > 1 and not allow_mixed_algorithm_families:
+        raise ValueError(
+            f"algorithms={algorithms} mixes HMAC and public-key algorithms with one "
+            "secret, which allows algorithm-confusion forgeries; use one family, or "
+            "pass allow_mixed_algorithm_families=True if you really mean it"
+        )
+    public_routes = frozenset(name for name in public_routes if name is not None)
+
+    def _unauthorized(message):
+        return web.HTTPUnauthorized(
+            text=json.dumps({"error": message}),
+            content_type=JSON_CONTENT_TYPE,
+        )
+
+    @web.middleware
+    async def middleware(req, handler):
+        route = req.match_info.route
+        if getattr(route, "name", None) in public_routes:
+            return await handler(req)
+        auth_header = req.headers.get("Authorization", "")
+        token = auth_header[7:] if auth_header[:7].lower() == "bearer " else ""
+        try:
+            decoded = jwt.decode(
+                token,
+                secret,
+                options={"verify_signature": verify},
+                algorithms=algorithms,
+            )
+        except jwt.PyJWTError as error:  # incl. a key unfit for the token's alg
+            if verify:
+                # InvalidTokenError texts describe the token ("Signature has
+                # expired"); other PyJWTErrors can describe the server's key
+                reason = (
+                    str(error)
+                    if isinstance(error, jwt.InvalidTokenError)
+                    else "not acceptable"
+                )
+                raise _unauthorized(f"Invalid authentication token: {reason}")
+            warn(f"Invalid JWT: {error}")
+            return await handler(req)
+        req.token = decoded
+        return await handler(req)
+
+    return middleware
+
+
+def mk_superadmin_middleware(secret):
+    from aiohttp import web
+
+    @web.middleware
+    async def middleware(req, handler):
+        auth_header = req.headers.get("Authorization", "")
+        if auth_header == secret:
+            return await handler(req)
+        return web.HTTPUnauthorized(
+            text=json.dumps({"error": "invalid API key"}),
+            content_type=JSON_CONTENT_TYPE,
+        )
+
+    return middleware

py2http-0.1.65/py2http/tests/test_jwt_middleware.py

@@ -0,0 +1,179 @@
+"""``mk_jwt_middleware`` verifies signatures, pins algorithms, and only lets named
+public routes through without a token."""
+
+import asyncio
+import base64
+import hashlib
+import hmac
+import json
+import time
+
+import jwt
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from py2http.middleware import mk_jwt_middleware
+
+SECRET = "s3cret-for-tests-only-0123456789abcdef"
+
+
+async def _whoami(request):
+    return web.json_response(getattr(request, "token", None))
+
+
+async def ping(request):  # a handler whose __name__ is "ping", on a private route
+    return web.json_response("private")
+
+
+def _app(middleware):
+    app = web.Application(middlewares=[middleware])
+    app.router.add_get("/ping", _whoami, name="ping")
+    app.router.add_get("/me", _whoami, name="me")
+    app.router.add_get("/secret", ping)
+    return app
+
+
+def _get(middleware, path, token=None):
+    """GET ``path`` on a fresh app (an aiohttp app is bound to one event loop)."""
+    app = _app(middleware)
+
+    async def go():
+        headers = {"Authorization": f"Bearer {token}"} if token is not None else {}
+        async with TestClient(TestServer(app)) as client:
+            resp = await client.get(path, headers=headers)
+            return resp.status, await resp.text()
+
+    return asyncio.run(go())
+
+
+def _b64(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def _hs256_with_key(claims, key: bytes) -> str:
+    """Sign by hand, so tests can forge what PyJWT itself refuses to produce."""
+    signing_input = f"{_b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())}.{_b64(json.dumps(claims).encode())}"
+    sig = hmac.new(key, signing_input.encode(), hashlib.sha256).digest()
+    return f"{signing_input}.{_b64(sig)}"
+
+
+def test_valid_token_is_decoded_onto_request():
+    token = jwt.encode({"sub": "alice"}, SECRET, algorithm="HS256")
+    status, body = _get(mk_jwt_middleware(SECRET), "/me", token)
+    assert status == 200 and json.loads(body) == {"sub": "alice"}
+
+
+@pytest.mark.parametrize(
+    "token",
+    [
+        None,
+        "",
+        "garbage",
+        jwt.encode(
+            {"sub": "alice"}, "wrong-secret-0123456789abcdef0123", algorithm="HS256"
+        ),
+        _b64(b'{"alg":"none","typ":"JWT"}') + "." + _b64(b'{"sub":"alice"}') + ".",
+        jwt.encode(
+            {"sub": "alice", "exp": int(time.time()) - 60}, SECRET, algorithm="HS256"
+        ),
+        jwt.encode({"sub": "alice"}, SECRET, algorithm="HS512"),  # not an allowed alg
+    ],
+)
+def test_bad_tokens_get_401_and_no_echo(token):
+    status, body = _get(mk_jwt_middleware(SECRET), "/me", token)
+    assert status == 401
+    if token:
+        assert token not in body
+
+
+def test_public_routes_are_matched_by_route_name_not_handler_name():
+    mw = mk_jwt_middleware(SECRET)
+    assert _get(mw, "/ping")[0] == 200
+    assert _get(mw, "/secret")[0] == 401  # handler is called "ping", route is not
+    mw = mk_jwt_middleware(SECRET, public_routes=())
+    assert _get(mw, "/ping")[0] == 401
+
+
+def test_mixed_algorithm_families_need_explicit_opt_in():
+    with pytest.raises(ValueError, match="algorithm-confusion"):
+        mk_jwt_middleware(SECRET, algorithms=["HS256", "RS256"])
+    with pytest.raises(ValueError):
+        mk_jwt_middleware(SECRET, algorithms=[])
+    mk_jwt_middleware(
+        SECRET, algorithms=["HS256", "RS256"], allow_mixed_algorithm_families=True
+    )
+
+
+def test_algorithm_confusion_forgery_is_rejected_with_public_key_secret():
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    public_pem = private.public_key().public_bytes(
+        serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo
+    )
+    mw = mk_jwt_middleware(public_pem, algorithms=["RS256"])
+    genuine = jwt.encode({"sub": "alice"}, private, algorithm="RS256")
+    assert _get(mw, "/me", genuine)[0] == 200
+    forged = _hs256_with_key({"sub": "mallory"}, public_pem)
+    assert _get(mw, "/me", forged)[0] == 401
+
+
+def test_verify_false_skips_signature_check():
+    token = jwt.encode(
+        {"sub": "alice"}, "another-secret-0123456789abcdef01", algorithm="HS256"
+    )
+    with pytest.warns(UserWarning):
+        status, _ = _get(mk_jwt_middleware(SECRET, verify=False), "/me", "garbage")
+    assert status == 200
+    status, body = _get(mk_jwt_middleware(SECRET, verify=False), "/me", token)
+    assert status == 200 and json.loads(body) == {"sub": "alice"}
+
+
+@pytest.mark.parametrize(
+    "kwargs, error",
+    [
+        ({"algorithms": "HS256"}, TypeError),
+        ({"algorithms": ["hs256"]}, ValueError),
+        ({"algorithms": ["none"]}, ValueError),
+        ({"algorithms": ["RS256", "none"]}, ValueError),
+        ({"public_routes": "ping"}, TypeError),
+    ],
+)
+def test_bad_algorithm_config_fails_at_construction(kwargs, error):
+    with pytest.raises(error):
+        mk_jwt_middleware(SECRET, **kwargs)
+
+
+@pytest.mark.parametrize("secret", ["", b"", None, 12345])
+def test_empty_or_unusable_secret_fails_at_construction(secret):
+    with pytest.raises((ValueError, TypeError)):
+        mk_jwt_middleware(secret)
+
+
+def test_key_unfit_for_token_algorithm_is_401_not_500():
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import rsa
+
+    public_pem = (
+        rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        .public_key()
+        .public_bytes(
+            serialization.Encoding.PEM,
+            serialization.PublicFormat.SubjectPublicKeyInfo,
+        )
+    )
+    mw = mk_jwt_middleware(
+        public_pem,
+        algorithms=["HS256", "RS256"],
+        allow_mixed_algorithm_families=True,
+    )
+    forged = _hs256_with_key({"sub": "mallory"}, public_pem)
+    status, body = _get(mw, "/me", forged)
+    assert status == 401 and "asymmetric" not in body.lower()
+
+
+def test_none_in_public_routes_does_not_open_unnamed_routes():
+    mw = mk_jwt_middleware(SECRET, public_routes=["ping", None])
+    assert _get(mw, "/secret")[0] == 401

{py2http-0.1.63 → py2http-0.1.65}/py2http.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: py2http
-Version: 0.1.63
+Version: 0.1.65
 Summary: Declarative HTTP service entry point.
 Home-page: https://github.com/i2mint/py2http
 License: MIT

{py2http-0.1.63 → py2http-0.1.65}/py2http.egg-info/SOURCES.txt

@@ -37,6 +37,7 @@ py2http/tests/test_attr_dispatch.py
 py2http/tests/test_binary_req.py
 py2http/tests/test_decorators.py
 py2http/tests/test_flask.py
+py2http/tests/test_jwt_middleware.py
 py2http/tests/test_not_set_defaults.py
 py2http/tests/test_p2h2p.py
 py2http/tests/utils_for_testing.py

{py2http-0.1.63 → py2http-0.1.65}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = py2http
-version = 0.1.63
+version = 0.1.65
 url = https://github.com/i2mint/py2http
 root_url = https://github.com/i2mint
 platforms = any

py2http-0.1.63/py2http/middleware.py

@@ -1,71 +0,0 @@
-"""
-py2http is a Python module that allows you to dispatch Python functions as HTTP
-services.
-By running a basic HTTP service from a list of functions, you can access OpenAPI
-specifications, Swagger documentation, and utilize the HTTP service's routes.
-Additionally, Py2http provides features for method transformation, input mapping,
-output mapping, error handling, and client generation.
-
-The code snippet provided below is a part of Py2http module and includes middleware
-functions for handling JWT authentication and superadmin authorization.
-These middleware functions are designed to be used within the Py2http framework to
-ensure secure and authenticated access to HTTP routes.
-
-Include the following docstring to describe this module:
-"Middleware functions for handling JWT authentication and superadmin authorization
-within the Py2http framework. These functions ensure secure access to HTTP routes
-by verifying credentials and permissions. Use these middleware functions to enforce
-authentication and control access to web resources.
-"""
-
-import json
-from warnings import warn
-from py2http.constants import JSON_CONTENT_TYPE
-
-
-def mk_jwt_middleware(secret, verify=True):
-    from aiohttp import web
-    import jwt
-
-    @web.middleware
-    async def middleware(req, handler):
-        if handler.__name__ == "ping" or handler.__name__ == "openapi":
-            return await handler(req)
-        auth_header = req.headers.get("Authorization", "")
-        token = auth_header[7:]
-        try:
-            decoded = jwt.decode(
-                token, secret, options={"verify": verify}, algorithms=["HS256", "RS256"]
-            )
-            req.token = decoded
-            return await handler(req)
-        except jwt.DecodeError as error:
-            if verify:
-                return web.HTTPUnauthorized(
-                    text=json.dumps(
-                        {
-                            "error": f'Invalid authentication token "{token}", {str(error)}'
-                        }
-                    ),
-                    content_type=JSON_CONTENT_TYPE,
-                )
-            warn(f"Invalid JWT: {token}")
-            return await handler(req)
-
-    return middleware
-
-
-def mk_superadmin_middleware(secret):
-    from aiohttp import web
-
-    @web.middleware
-    async def middleware(req, handler):
-        auth_header = req.headers.get("Authorization", "")
-        if auth_header == secret:
-            return await handler(req)
-        return web.HTTPUnauthorized(
-            text=json.dumps({"error": "invalid API key"}),
-            content_type=JSON_CONTENT_TYPE,
-        )
-
-    return middleware