pypomes-iam 0.3.4__py3-none-any.whl → 0.3.5__py3-none-any.whl

pypomes_iam/iam_common.py

@@ -1,7 +1,5 @@
-import json
 import requests
 import sys
-from cachetools import Cache
 from datetime import datetime
 from enum import StrEnum
 from logging import Logger
@@ -175,11 +173,10 @@ def _get_user_data(iam_server: IamServer,
     # initialize the return variable
     result: dict[str, Any] | None = None
 
-    cache: Cache = _get_iam_cache(iam_server=iam_server,
-                                  errors=errors,
-                                  logger=logger)
-    if cache:
-        users: dict[str, dict[str, Any]] = cache.get("users")
+    users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
+                                                      errors=errors,
+                                                      logger=logger)
+    if users:
         result = users.get(user_id)
         if not result:
             result = {
@@ -256,9 +253,9 @@ def _get_iam_registry(iam_server: IamServer,
     return result
 
 
-def _get_iam_cache(iam_server: IamServer,
+def _get_iam_users(iam_server: IamServer,
                    errors: list[str] | None,
-                   logger: Logger | None) -> Cache:
+                   logger: Logger | None) -> dict[str, dict[str, Any]]:
     """
     Retrieve the cache storage in *iam_server*'s registry.
 
@@ -270,97 +267,4 @@ def _get_iam_cache(iam_server: IamServer,
     registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
                                                  errors=errors,
                                                  logger=logger)
-    return registry["cache"] if registry else None
-
-
-def _post_for_token(iam_server: IamServer,
-                    body_data: dict[str, Any],
-                    errors: list[str] | None,
-                    logger: Logger | None) -> dict[str, Any] | None:
-    """
-    Send a POST request to obtain the authentication token data, and return the data received.
-
-    For token acquisition, *body_data* will have the attributes:
-        - "grant_type": "authorization_code"
-        - "code": <16-character-random-code>
-        - "redirect_uri": <redirect-uri>
-
-    For token refresh, *body_data* will have the attributes:
-        - "grant_type": "refresh_token"
-        - "refresh_token": <current-refresh-token>
-
-    For token exchange, *body_data* will have the attributes:
-        - "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
-        - "subject_token": <token-to-be-exchanged>,
-        - "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
-        - "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
-        - "audience": <client-id>,
-        - "subject_issuer": "oidc"
-
-    These attributes are then added to *body_data*:
-        - "client_id": <client-id>,
-        - "client_secret": <client-secret>,
-
-    If the operation is successful, the token data is stored in the registry.
-    Otherwise, *errors* will contain the appropriate error message.
-
-    :param iam_server: the reference registered *IAM* server
-    :param body_data: the data to send in the body of the request
-    :param errors: incidental errors
-    :param logger: optional logger
-    :return: the access token obtained, or *None* if error
-    """
-    # initialize the return variable
-    result: dict[str, Any] | None = None
-
-    # PBTAIN THE iam SERVER'S REGISTRY
-    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                 errors=errors,
-                                                 logger=logger)
-    err_msg: str | None = None
-    if registry:
-        # complete the data to send in body of request
-        body_data["client_id"] = registry["client-id"]
-        client_secret: str = registry["client-secret"]
-        if client_secret:
-            body_data["client_secret"] = client_secret
-
-        # obtain the token
-        url: str = registry["base-url"] + "/protocol/openid-connect/token"
-        if logger:
-            logger.debug(msg=f"POST '{url}', data {json.dumps(obj=body_data,
-                                                              ensure_ascii=False)}")
-        try:
-            # typical return on a token request:
-            # {
-            #   "token_type": "Bearer",
-            #   "access_token": <str>,
-            #   "expires_in": <number-of-seconds>,
-            #   "refresh_token": <str>,
-            #   "refesh_expires_in": <number-of-seconds>
-            # }
-            response: requests.Response = requests.post(url=url,
-                                                        data=body_data)
-            if response.status_code == 200:
-                # request succeeded
-                if logger:
-                    logger.debug(msg=f"POST success, status {response.status_code}")
-                result = response.json()
-            else:
-                # request resulted in error
-                err_msg = f"POST failure, status {response.status_code}, reason '{response.reason}'"
-                if hasattr(response, "content") and response.content:
-                    err_msg += f", content '{response.content}'"
-                if logger:
-                    logger.error(msg=err_msg)
-        except Exception as e:
-            # the operation raised an exception
-            err_msg = exc_format(exc=e,
-                                 exc_info=sys.exc_info())
-            if logger:
-                logger.error(msg=err_msg)
-
-    if err_msg and isinstance(errors, list):
-        errors.append(err_msg)
-
-    return result
+    return registry["cache"]["users"] if registry else None

pypomes_iam/iam_pomes.py

@@ -1,18 +1,20 @@
+import json
+import requests
 import secrets
 import string
 import sys
 from cachetools import Cache
 from datetime import datetime
 from logging import Logger
-from pypomes_core import TZ_LOCAL
+from pypomes_core import TZ_LOCAL, exc_format
 from typing import Any
 
 from .iam_common import (
     IamServer,
-    _register_logger, _post_for_token,
-    _get_iam_cache, _get_iam_registry,
+    _register_logger, _get_iam_users, _get_iam_registry,
     _get_login_timeout, _get_user_data, _get_public_key
 )
+from .token_pomes import token_validate
 
 
 def register_logger(logger: Logger) -> None:
@@ -93,15 +95,13 @@ def user_logout(iam_server: IamServer,
 
     if user_id:
         # retrieve the IAM server's cache storage
-        cache: Cache = _get_iam_cache(iam_server=iam_server,
-                                      errors=errors,
-                                      logger=logger)
-        if cache:
-            users: dict[str, dict[str, Any]] = cache.get("users") or {}
-            if user_id in users:
-                users.pop(user_id)
-                if logger:
-                    logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
+        users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
+                                                          errors=errors,
+                                                          logger=logger) or {}
+        if user_id in users:
+            users.pop(user_id)
+            if logger:
+                logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
 
 
 def user_token(iam_server: IamServer,
@@ -147,20 +147,20 @@ def user_token(iam_server: IamServer,
                             "grant_type": "refresh_token",
                             "refresh_token": refresh_token
                         }
-                        token_data: dict[str, Any] = _post_for_token(iam_server=iam_server,
-                                                                     body_data=body_data,
-                                                                     errors=errors,
-                                                                     logger=logger)
+                        now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+                        token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
+                                                                      body_data=body_data,
+                                                                      errors=errors,
+                                                                      logger=logger)
+                        # validate and store the token data
                         if token_data:
-                            result = token_data.get("access_token")
-                            user_data["access-token"] = result
-                            # keep current refresh token if a new one is not provided
-                            user_data["refresh-token"] = (token_data.get("refresh_token") or
-                                                          body_data.get("refresh_token"))
-                            user_data["access-expiration"] = now + token_data.get("expires_in")
-                            refresh_expiration: int = user_data.get("refresh_expires_in")
-                            user_data["refresh-expiration"] = (now + refresh_expiration) \
-                                if refresh_expiration else sys.maxsize
+                            token_info: tuple[str, str] = __validate_and_store(iam_server=iam_server,
+                                                                               user_data=user_data,
+                                                                               token_data=token_data,
+                                                                               now=now,
+                                                                               errors=errors,
+                                                                               logger=logger)
+                            result = token_info[1]
                         else:
                             # refresh token is no longer valid
                             user_data["refresh-token"] = None
@@ -201,8 +201,6 @@ def login_callback(iam_server: IamServer,
     :param logger: optional logger
     :return: a tuple containing the reference user identification and the token obtained, or *None* if error
     """
-    from .token_pomes import token_validate
-
     # initialize the return variable
     result: tuple[str, str] | None = None
 
@@ -237,35 +235,18 @@ def login_callback(iam_server: IamServer,
                     "redirect_uri": registry["redirect-uri"]
                 }
                 now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
-                token_data: dict[str, Any] = _post_for_token(iam_server=iam_server,
-                                                             body_data=body_data,
-                                                             errors=errors,
-                                                             logger=logger)
-                # process the token data
+                token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
+                                                              body_data=body_data,
+                                                              errors=errors,
+                                                              logger=logger)
+                # validate and store the token data
                 if token_data:
-                    token: str = token_data.get("access_token")
-                    user_data["access-token"] = token
-                    # keep current refresh token if a new one is not provided
-                    user_data["refresh-token"] = token_data.get("refresh_token") or body_data.get("refresh_token")
-                    user_data["access-expiration"] = now + token_data.get("expires_in")
-                    refresh_exp: int = user_data.get("refresh_expires_in")
-                    user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
-                    public_key: str = _get_public_key(iam_server=iam_server,
-                                                      errors=errors,
-                                                      logger=logger)
-                    if public_key:
-                        recipient_attr = registry["recipient_attr"]
-                        login_id = user_data.pop("login-id", None)
-                        token_claims: dict[str, dict[str, Any]] = token_validate(token=token,
-                                                                                 issuer=registry["base-url"],
-                                                                                 recipient_id=login_id,
-                                                                                 recipient_attr=recipient_attr,
-                                                                                 public_key=public_key,
-                                                                                 errors=errors,
-                                                                                 logger=logger)
-                        if token_claims:
-                            token_user: str = token_claims["payload"].get(recipient_attr)
-                            result = (token_user, token)
+                    result = __validate_and_store(iam_server=iam_server,
+                                                  user_data=user_data,
+                                                  token_data=token_data,
+                                                  now=now,
+                                                  errors=errors,
+                                                  logger=logger)
         else:
             msg: str = "Unknown state received"
             if logger:
@@ -281,7 +262,11 @@ def token_exchange(iam_server: IamServer,
                    errors: list[str] = None,
                    logger: Logger = None) -> dict[str, Any]:
     """
-    Requst *iam_server* to issue a token in exchange for the token obtained from another *IAM* server.
+    Request *iam_server* to issue a token in exchange for the token obtained from another *IAM* server.
+
+    The expected parameters in *args* are:
+        - client-id: identification for the reference user (aliases: 'client_id', 'login')
+        - token: the token to be exchanged
 
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
@@ -312,10 +297,21 @@ def token_exchange(iam_server: IamServer,
                 "audience": registry["client-id"],
                 "subject_issuer": "oidc"
             }
-            result = _post_for_token(iam_server=IamServer.IAM_KEYCLOAK,
-                                     body_data=body_data,
-                                     errors=errors,
-                                     logger=logger)
+            now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+            token_data: dict[str, Any] = __post_for_token(iam_server=IamServer.IAM_KEYCLOAK,
+                                                          body_data=body_data,
+                                                          errors=errors,
+                                                          logger=logger)
+            # validate and store the token data
+            if token_data:
+                user_data: dict[str, Any] = {}
+                result = __validate_and_store(iam_server=iam_server,
+                                              user_data=user_data,
+                                              token_data=token_data,
+                                              now=now,
+                                              errors=errors,
+                                              logger=logger)
+
     else:
         msg: str = "User identification and token must be provided"
         if logger:
@@ -324,3 +320,170 @@ def token_exchange(iam_server: IamServer,
             errors.append(msg)
 
     return result
+
+
+def __post_for_token(iam_server: IamServer,
+                     body_data: dict[str, Any],
+                     errors: list[str] | None,
+                     logger: Logger | None) -> dict[str, Any] | None:
+    """
+    Send a POST request to obtain the authentication token data, and return the data received.
+
+    For token acquisition, *body_data* will have the attributes:
+        - "grant_type": "authorization_code"
+        - "code": <16-character-random-code>
+        - "redirect_uri": <redirect-uri>
+
+    For token refresh, *body_data* will have the attributes:
+        - "grant_type": "refresh_token"
+        - "refresh_token": <current-refresh-token>
+
+    For token exchange, *body_data* will have the attributes:
+        - "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
+        - "subject_token": <token-to-be-exchanged>,
+        - "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
+        - "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
+        - "audience": <client-id>,
+        - "subject_issuer": "oidc"
+
+    These attributes are then added to *body_data*:
+        - "client_id": <client-id>,
+        - "client_secret": <client-secret>,
+
+    If the operation is successful, the token data is stored in the *IAM* server's registry, and returned.
+    Otherwise, *errors* will contain the appropriate error message.
+
+    The typical data returned contains the following attributes:
+        {
+            "token_type": "Bearer",
+            "access_token": <str>,
+            "expires_in": <number-of-seconds>,
+            "refresh_token": <str>,
+            "refesh_expires_in": <number-of-seconds>
+        }
+
+    :param iam_server: the reference registered *IAM* server
+    :param body_data: the data to send in the body of the request
+    :param errors: incidental errors
+    :param logger: optional logger
+    :return: the token data, or *None* if error
+    """
+    # initialize the return variable
+    result: dict[str, Any] | None = None
+
+    # PBTAIN THE iam SERVER'S REGISTRY
+    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                 errors=errors,
+                                                 logger=logger)
+    err_msg: str | None = None
+    if registry:
+        # complete the data to send in body of request
+        body_data["client_id"] = registry["client-id"]
+        client_secret: str = registry["client-secret"]
+        if client_secret:
+            body_data["client_secret"] = client_secret
+
+        # obtain the token
+        url: str = registry["base-url"] + "/protocol/openid-connect/token"
+        if logger:
+            logger.debug(msg=f"POST '{url}', data {json.dumps(obj=body_data,
+                                                              ensure_ascii=False)}")
+        try:
+            # typical return on a token request:
+            # {
+            #   "token_type": "Bearer",
+            #   "access_token": <str>,
+            #   "expires_in": <number-of-seconds>,
+            #   "refresh_token": <str>,
+            #   "refesh_expires_in": <number-of-seconds>
+            # }
+            response: requests.Response = requests.post(url=url,
+                                                        data=body_data)
+            if response.status_code == 200:
+                # request succeeded
+                if logger:
+                    logger.debug(msg=f"POST success, status {response.status_code}")
+                result = response.json()
+            else:
+                # request resulted in error
+                err_msg = f"POST failure, status {response.status_code}, reason '{response.reason}'"
+                if hasattr(response, "content") and response.content:
+                    err_msg += f", content '{response.content}'"
+                if logger:
+                    logger.error(msg=err_msg)
+        except Exception as e:
+            # the operation raised an exception
+            err_msg = exc_format(exc=e,
+                                 exc_info=sys.exc_info())
+            if logger:
+                logger.error(msg=err_msg)
+
+    if err_msg and isinstance(errors, list):
+        errors.append(err_msg)
+
+    return result
+
+
+def __validate_and_store(iam_server: IamServer,
+                         user_data: dict[str, Any],
+                         token_data: dict[str, Any],
+                         now: int,
+                         errors: list[str] | None,
+                         logger: Logger) -> tuple[str, str] | None:
+    """
+    Validate and store the token data.
+
+    The typical *token_data* contains the following attributes:
+        {
+            "token_type": "Bearer",
+            "access_token": <str>,
+            "expires_in": <number-of-seconds>,
+            "refresh_token": <str>,
+            "refesh_expires_in": <number-of-seconds>
+        }
+
+    :param iam_server: the reference registered *IAM* server
+    :param user_data: the aurthentication data kepth in *iam_server*'s registry
+    :param token_data: the token data
+    :param errors: incidental errors
+    :param logger: optional logger
+    :return: tuple containing the user identification and the validated and stored token, or *None* if error
+    """
+    # initialize the return variable
+    result: tuple[str, str] | None = None
+
+    # retrieve the IAM server's registry
+    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                 errors=errors,
+                                                 logger=logger)
+    if registry:
+        token: str = token_data.get("access_token")
+        user_data["access-token"] = token
+        # keep current refresh token if a new one is not provided
+        if token_data.get("refresh_token"):
+            user_data["refresh-token"] = token_data.get("refresh_token")
+        user_data["access-expiration"] = now + token_data.get("expires_in")
+        refresh_exp: int = user_data.get("refresh_expires_in")
+        user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
+        public_key: str = _get_public_key(iam_server=iam_server,
+                                          errors=errors,
+                                          logger=logger)
+        if public_key:
+            recipient_attr = registry["recipient_attr"]
+            login_id = user_data.pop("login-id", None)
+            claims: dict[str, dict[str, Any]] = token_validate(token=token,
+                                                               issuer=registry["base-url"],
+                                                               recipient_id=login_id,
+                                                               recipient_attr=recipient_attr,
+                                                               public_key=public_key,
+                                                               errors=errors,
+                                                               logger=logger)
+            if claims:
+                users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
+                                                                  errors=errors,
+                                                                  logger=logger)
+                if users:
+                    user_id: str = login_id if login_id else claims["payload"][recipient_attr]
+                    users[user_id] = user_data
+                    result = (user_id, token)
+    return result

pypomes_iam/iam_services.py

@@ -196,9 +196,24 @@ def service_exchange() -> Response:
     """
     Entry point for requesting the *IAM* server to exchange the token.
 
-    This is currently limit to the *Keycloak* server
-
-    :return: the response containing the token, or *UNAUTHORIZED*
+    This is currently limited to the *KEYCLOAK* server. The token itself is stored in *KEYCLOAK*'s registry.
+    The expected parameters in the request are:
+        - client-id: identification for the reference user (aliases: 'client_id', 'login')
+        - token: the token to be exchanged
+
+    If the exchange is successful, the token data is stored in the *IAM* server's registry, and returned.
+    Otherwise, *errors* will contain the appropriate error message.
+
+    The typical *Response* returned contains the following attributes:
+        {
+            "token_type": "Bearer",
+            "access_token": <str>,
+            "expires_in": <number-of-seconds>,
+            "refresh_token": <str>,
+            "refesh_expires_in": <number-of-seconds>
+        }
+
+    :return: the response containing the token data, or *UNAUTHORIZED*
     """
     # retrieve the operations's logger
     logger: Logger = _get_logger()

pypomes_iam/token_pomes.py

@@ -40,7 +40,7 @@ def token_validate(token: str,
     :param recipient_attr: attribute in the token's payload holding the expected subject's identification
     :param errors: incidental error messages
     :param logger: optional logger
-    :return: The token's claims (*header* and *payload*) if it is valid, *None* otherwise
+    :return: The token's claims (*header* and *payload*), or *None* if error
     """
     # initialize the return variable
     result: dict[str, dict[str, Any]] | None = None

{pypomes_iam-0.3.4.dist-info → pypomes_iam-0.3.5.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_iam
-Version: 0.3.4
+Version: 0.3.5
 Summary: A collection of Python pomes, penyeach (IAM modules)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-IAM
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-IAM/issues

pypomes_iam-0.3.5.dist-info/RECORD

@@ -0,0 +1,12 @@
+pypomes_iam/__init__.py,sha256=H7rUCaUEJBLNJv2rtdmBxwcAB28OItdEPenpv_UEOVw,965
+pypomes_iam/iam_common.py,sha256=1NgXFTiD4qpbVqLfYsCfHrE0khEaczp-nR3AYXmzmvU,9608
+pypomes_iam/iam_pomes.py,sha256=qmnHX88iaiMGaGeZfbs4VT-G_XMTpRT6wqRZeCOOKbQ,22294
+pypomes_iam/iam_services.py,sha256=qdPPfwR9jIdGak-wr4t2NkdfhVaMqauBdvmVJvmFqyg,8914
+pypomes_iam/jusbr_pomes.py,sha256=M47h_PUUgbCmFQyKz2sN1H9T00BC5v_oPgwl5ATWMSA,5625
+pypomes_iam/keycloak_pomes.py,sha256=GtXJb4TZb-a_5b9ExYdJGetBcU1pEP96ONO6prA_vDo,6638
+pypomes_iam/provider_pomes.py,sha256=eP8XzjTUEpwejTkO0wmDiqKjqbIEOzRNCR2ju5E15og,5856
+pypomes_iam/token_pomes.py,sha256=1g6PMNNMbmdwLrsvSXvpO8-zdRhso1IFnwAyndNmV4Q,5332
+pypomes_iam-0.3.5.dist-info/METADATA,sha256=fGRhn3H98wOkQSrxMh9FFTiheHez3TMIpX6R91wysoU,694
+pypomes_iam-0.3.5.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_iam-0.3.5.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
+pypomes_iam-0.3.5.dist-info/RECORD,,

pypomes_iam-0.3.4.dist-info/RECORD

@@ -1,12 +0,0 @@
-pypomes_iam/__init__.py,sha256=H7rUCaUEJBLNJv2rtdmBxwcAB28OItdEPenpv_UEOVw,965
-pypomes_iam/iam_common.py,sha256=IWH9DVykF7K-Z9Sn3oP7To9_I2TkO2AzjVod238zUWc,13645
-pypomes_iam/iam_pomes.py,sha256=g06NSz3r1qv4LzDpjQ9iozdVyabidt7qLEocQRv1yns,15230
-pypomes_iam/iam_services.py,sha256=osqDptxCqL9eZPCRecBwtlS35YiMRvO7EIgdcyovSU4,8182
-pypomes_iam/jusbr_pomes.py,sha256=M47h_PUUgbCmFQyKz2sN1H9T00BC5v_oPgwl5ATWMSA,5625
-pypomes_iam/keycloak_pomes.py,sha256=GtXJb4TZb-a_5b9ExYdJGetBcU1pEP96ONO6prA_vDo,6638
-pypomes_iam/provider_pomes.py,sha256=eP8XzjTUEpwejTkO0wmDiqKjqbIEOzRNCR2ju5E15og,5856
-pypomes_iam/token_pomes.py,sha256=cfHdv2qYbsciY-3aEuDYUwCM479uMRSm2uwr4-hCaBQ,5345
-pypomes_iam-0.3.4.dist-info/METADATA,sha256=wt98InTB4_MY_-JQHDs9ZTZ1hb2T5MbJtAkduCUopNo,694
-pypomes_iam-0.3.4.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_iam-0.3.4.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
-pypomes_iam-0.3.4.dist-info/RECORD,,