pypomes-iam 0.3.5__py3-none-any.whl → 0.3.6__py3-none-any.whl

pypomes_iam/iam_common.py

@@ -5,6 +5,7 @@ from enum import StrEnum
 from logging import Logger
 from pypomes_core import TZ_LOCAL, exc_format
 from pypomes_crypto import crypto_jwk_convert
+from threading import Lock
 from typing import Any, Final
 
 
@@ -16,7 +17,8 @@ class IamServer(StrEnum):
     IAM_KEYCLOAK = "iam-keycloak"
 
 
-# the logger for IAM operations
+# the logger for IAM service operations
+# (used exclusively at the HTTP endpoint - all other functions receive the lgger as parameter)
 __IAM_LOGGER: Logger | None = None
 
 # registry structure:
@@ -51,11 +53,18 @@ __IAM_LOGGER: Logger | None = None
 # }
 _IAM_SERVERS: Final[dict[IamServer, dict[str, Any]]] = {}
 
+# the lock protecting the data in '_IAM_SERVER'
+# (because it is 'Final' and set at declaration time, it can be accessed through simple imports)
+_iam_lock: Final[Lock] = Lock()
+
 
 def _get_logger() -> Logger | None:
     """
     Retrieve the registered logger for *IAM* operations.
 
+    This function is invoked exclusively from the HTTP endpoints.
+    All other functions receive the logger as parameter.
+
     :return: the registered logger for *IAM* operations.
     """
     return __IAM_LOGGER

pypomes_iam/iam_pomes.py

@@ -3,14 +3,13 @@ import requests
 import secrets
 import string
 import sys
-from cachetools import Cache
 from datetime import datetime
 from logging import Logger
 from pypomes_core import TZ_LOCAL, exc_format
 from typing import Any
 
 from .iam_common import (
-    IamServer,
+    IamServer, _iam_lock,
     _register_logger, _get_iam_users, _get_iam_registry,
     _get_login_timeout, _get_user_data, _get_public_key
 )
@@ -48,30 +47,34 @@ def user_login(iam_server: IamServer,
     # build the user data
     # ('oauth_state' is a randomly-generated string, thus 'user_data' is always a new entry)
     oauth_state: str = "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(16))
-    user_data: dict[str, Any] = _get_user_data(iam_server=iam_server,
-                                               user_id=oauth_state,
-                                               errors=errors,
-                                               logger=logger)
-    if user_data:
-        user_data["login-id"] = user_id
-        timeout: int = _get_login_timeout(iam_server=iam_server,
-                                          errors=errors,
-                                          logger=logger)
-        if not errors:
-            user_data["login-expiration"] = int(datetime.now(tz=TZ_LOCAL).timestamp()) + timeout if timeout else None
-            redirect_uri: str = args.get("redirect-uri")
-
-            # build the login url
-            registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                         errors=errors,
-                                                         logger=logger)
-            if registry:
-                registry["redirect-uri"] = redirect_uri
-                result = {"login-url": (f"{registry["base-url"]}/protocol/openid-connect/auth"
-                                        f"?response_type=code&scope=openid"
-                                        f"&client_id={registry["client-id"]}"
-                                        f"&redirect_uri={redirect_uri}"
-                                        f"&state={oauth_state}")}
+
+    with _iam_lock:
+        # retrieve the user data from the IAM server's registry
+        user_data: dict[str, Any] = _get_user_data(iam_server=iam_server,
+                                                   user_id=oauth_state,
+                                                   errors=errors,
+                                                   logger=logger)
+        if user_data:
+            user_data["login-id"] = user_id
+            timeout: int = _get_login_timeout(iam_server=iam_server,
+                                              errors=errors,
+                                              logger=logger)
+            if not errors:
+                user_data["login-expiration"] = int(datetime.now(tz=TZ_LOCAL).timestamp()) + timeout \
+                    if timeout else None
+                redirect_uri: str = args.get("redirect-uri")
+
+                # build the login url
+                registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                             errors=errors,
+                                                             logger=logger)
+                if registry:
+                    registry["redirect-uri"] = redirect_uri
+                    result = {"login-url": (f"{registry["base-url"]}/protocol/openid-connect/auth"
+                                            f"?response_type=code&scope=openid"
+                                            f"&client_id={registry["client-id"]}"
+                                            f"&redirect_uri={redirect_uri}"
+                                            f"&state={oauth_state}")}
     return result
 
 
@@ -94,14 +97,15 @@ def user_logout(iam_server: IamServer,
     user_id: str = args.get("user-id") or args.get("user_id") or args.get("login")
 
     if user_id:
-        # retrieve the IAM server's cache storage
-        users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
-                                                          errors=errors,
-                                                          logger=logger) or {}
-        if user_id in users:
-            users.pop(user_id)
-            if logger:
-                logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
+        with _iam_lock:
+            # retrieve the data for all users in the IAM server's registry
+            users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
+                                                              errors=errors,
+                                                              logger=logger) or {}
+            if user_id in users:
+                users.pop(user_id)
+                if logger:
+                    logger.debug(msg=f"User '{user_id}' removed from {iam_server}'s registry")
 
 
 def user_token(iam_server: IamServer,
@@ -111,7 +115,7 @@ def user_token(iam_server: IamServer,
     """
     Retrieve the authentication token for the user, from *iam_server*.
 
-    The user is identified by the attribute *user-id*, *user_id*, or "login", provided in *args*.
+    The user is identified by the attribute *user-id*, *user_id*, or *login*, provided in *args*.
 
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
@@ -127,56 +131,58 @@ def user_token(iam_server: IamServer,
 
     err_msg: str | None = None
     if user_id:
-        user_data: dict[str, Any] = _get_user_data(iam_server=iam_server,
-                                                   user_id=user_id,
-                                                   errors=errors,
-                                                   logger=logger)
-        token: str = user_data["access-token"] if user_data else None
-        if token:
-            access_expiration: int = user_data.get("access-expiration")
-            now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
-            if now < access_expiration:
-                result = token
-            else:
-                # access token has expired
-                refresh_token: str = user_data["refresh-token"]
-                if refresh_token:
-                    refresh_expiration = user_data["refresh-expiration"]
-                    if now < refresh_expiration:
-                        body_data: dict[str, str] = {
-                            "grant_type": "refresh_token",
-                            "refresh_token": refresh_token
-                        }
-                        now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
-                        token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
-                                                                      body_data=body_data,
-                                                                      errors=errors,
-                                                                      logger=logger)
-                        # validate and store the token data
-                        if token_data:
-                            token_info: tuple[str, str] = __validate_and_store(iam_server=iam_server,
-                                                                               user_data=user_data,
-                                                                               token_data=token_data,
-                                                                               now=now,
-                                                                               errors=errors,
-                                                                               logger=logger)
-                            result = token_info[1]
+        with _iam_lock:
+            # retrieve the user data in the IAM server's registry
+            user_data: dict[str, Any] = _get_user_data(iam_server=iam_server,
+                                                       user_id=user_id,
+                                                       errors=errors,
+                                                       logger=logger)
+            token: str = user_data["access-token"] if user_data else None
+            if token:
+                access_expiration: int = user_data.get("access-expiration")
+                now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+                if now < access_expiration:
+                    result = token
+                else:
+                    # access token has expired
+                    refresh_token: str = user_data["refresh-token"]
+                    if refresh_token:
+                        refresh_expiration = user_data["refresh-expiration"]
+                        if now < refresh_expiration:
+                            body_data: dict[str, str] = {
+                                "grant_type": "refresh_token",
+                                "refresh_token": refresh_token
+                            }
+                            now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+                            token_data: dict[str, Any] = __post_for_token(iam_server=iam_server,
+                                                                          body_data=body_data,
+                                                                          errors=errors,
+                                                                          logger=logger)
+                            # validate and store the token data
+                            if token_data:
+                                token_info: tuple[str, str] = __validate_and_store(iam_server=iam_server,
+                                                                                   user_data=user_data,
+                                                                                   token_data=token_data,
+                                                                                   now=now,
+                                                                                   errors=errors,
+                                                                                   logger=logger)
+                                result = token_info[1]
+                            else:
+                                # refresh token is no longer valid
+                                user_data["refresh-token"] = None
                         else:
-                            # refresh token is no longer valid
-                            user_data["refresh-token"] = None
+                            # refresh token has expired
+                            err_msg = "Access and refresh tokens expired"
+                            if logger:
+                                logger.error(msg=err_msg)
                     else:
-                        # refresh token has expired
-                        err_msg = "Access and refresh tokens expired"
+                        err_msg = "Access token expired, no refresh token available"
                         if logger:
                             logger.error(msg=err_msg)
-                else:
-                    err_msg = "Access token expired, no refresh token available"
-                    if logger:
-                        logger.error(msg=err_msg)
-        else:
-            err_msg = f"User '{user_id}' not authenticated"
-            if logger:
-                logger.error(msg=err_msg)
+            else:
+                err_msg = f"User '{user_id}' not authenticated"
+                if logger:
+                    logger.error(msg=err_msg)
     else:
         err_msg = "User identification not provided"
         if logger:
@@ -193,7 +199,11 @@ def login_callback(iam_server: IamServer,
                    errors: list[str] = None,
                    logger: Logger = None) -> tuple[str, str] | None:
     """
-    Entry point for the callback from *iam_server* via the front-end application, on authentication operation.
+    Entry point for the callback from *iam_server* via the front-end application, on authentication operations.
+
+    The relevant arguments received are:
+        - *state*: used to enhance security during the authorization process, typically to provide *CSRF* protection
+        - *code*: the temporary authorization code, to be exchanged for the token
 
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
@@ -204,15 +214,13 @@ def login_callback(iam_server: IamServer,
     # initialize the return variable
     result: tuple[str, str] | None = None
 
-    # retrieve the users authentication data
-    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                 errors=errors,
-                                                 logger=logger)
-    cache: Cache = registry["cache"] if registry else None
-    if cache:
-        users: dict[str, dict[str, Any]] = cache.get("users")
-
-        # validate the OAuth2 state
+    with _iam_lock:
+        # retrieve the IAM server's registry and the data for all users therein
+        registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                     errors=errors,
+                                                     logger=logger)
+        users: dict[str, dict[str, Any]] = (registry["cache"]["users"] or {}) if registry else {}
+        # retrieve the OAuth2 state
         oauth_state: str = args.get("state")
         user_data: dict[str, Any] | None = None
         if oauth_state:
@@ -221,7 +229,7 @@ def login_callback(iam_server: IamServer,
                     user_data = data
                     break
 
-        # exchange 'code' for the token
+        # exchange 'code' received for the token
         if user_data:
             expiration: int = user_data["login-expiration"] or sys.maxsize
             if int(datetime.now(tz=TZ_LOCAL).timestamp()) > expiration:
@@ -268,6 +276,15 @@ def token_exchange(iam_server: IamServer,
         - client-id: identification for the reference user (aliases: 'client_id', 'login')
         - token: the token to be exchanged
 
+    The typical data set returned contains the following attributes:
+        {
+            "token_type": "Bearer",
+            "access_token": <str>,
+            "expires_in": <number-of-seconds>,
+            "refresh_token": <str>,
+            "refesh_expires_in": <number-of-seconds>
+        }
+
     :param iam_server: the reference registered *IAM* server
     :param args: the arguments passed when requesting the service
     :param errors: incidental errors
@@ -280,40 +297,41 @@ def token_exchange(iam_server: IamServer,
     # obtain the user's identification
     user_id: str = args.get("user-id") or args.get("user_id") or args.get("login")
 
-    # retrieve the token to be exchanges
+    # obtain the token to be exchanges
     token: str = args.get("token")
 
     if user_id and token:
         # HAZARD: only 'IAM_KEYCLOAK' is currently supported
-        registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                     errors=errors,
-                                                     logger=logger)
-        if registry:
-            body_data: dict[str, str] = {
-                "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
-                "subject_token": token,
-                "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
-                "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
-                "audience": registry["client-id"],
-                "subject_issuer": "oidc"
-            }
-            now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
-            token_data: dict[str, Any] = __post_for_token(iam_server=IamServer.IAM_KEYCLOAK,
-                                                          body_data=body_data,
-                                                          errors=errors,
-                                                          logger=logger)
-            # validate and store the token data
-            if token_data:
-                user_data: dict[str, Any] = {}
-                result = __validate_and_store(iam_server=iam_server,
-                                              user_data=user_data,
-                                              token_data=token_data,
-                                              now=now,
-                                              errors=errors,
-                                              logger=logger)
-
+        with _iam_lock:
+            # retrieve the IAM server's registry
+            registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                         errors=errors,
+                                                         logger=logger)
+            if registry:
+                body_data: dict[str, str] = {
+                    "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
+                    "subject_token": token,
+                    "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
+                    "requested_token_type": "urn:ietf:params:oauth:token-type:access_token",
+                    "audience": registry["client-id"],
+                    "subject_issuer": "oidc"
+                }
+                now: int = int(datetime.now(tz=TZ_LOCAL).timestamp())
+                token_data: dict[str, Any] = __post_for_token(iam_server=IamServer.IAM_KEYCLOAK,
+                                                              body_data=body_data,
+                                                              errors=errors,
+                                                              logger=logger)
+                # validate and store the token data
+                if token_data:
+                    user_data: dict[str, Any] = {}
+                    result = __validate_and_store(iam_server=iam_server,
+                                                  user_data=user_data,
+                                                  token_data=token_data,
+                                                  now=now,
+                                                  errors=errors,
+                                                  logger=logger)
     else:
-        msg: str = "User identification and token must be provided"
+        msg: str = "User identification or token not provided"
         if logger:
             logger.error(msg=msg)
         if isinstance(errors, list):
@@ -353,7 +371,7 @@ def __post_for_token(iam_server: IamServer,
     If the operation is successful, the token data is stored in the *IAM* server's registry, and returned.
     Otherwise, *errors* will contain the appropriate error message.
 
-    The typical data returned contains the following attributes:
+    The typical data set returned contains the following attributes:
         {
             "token_type": "Bearer",
             "access_token": <str>,
@@ -371,52 +389,53 @@ def __post_for_token(iam_server: IamServer,
     # initialize the return variable
     result: dict[str, Any] | None = None
 
-    # PBTAIN THE iam SERVER'S REGISTRY
-    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                 errors=errors,
-                                                 logger=logger)
     err_msg: str | None = None
-    if registry:
-        # complete the data to send in body of request
-        body_data["client_id"] = registry["client-id"]
-        client_secret: str = registry["client-secret"]
-        if client_secret:
-            body_data["client_secret"] = client_secret
-
-        # obtain the token
-        url: str = registry["base-url"] + "/protocol/openid-connect/token"
-        if logger:
-            logger.debug(msg=f"POST '{url}', data {json.dumps(obj=body_data,
-                                                              ensure_ascii=False)}")
-        try:
-            # typical return on a token request:
-            # {
-            #   "token_type": "Bearer",
-            #   "access_token": <str>,
-            #   "expires_in": <number-of-seconds>,
-            #   "refresh_token": <str>,
-            #   "refesh_expires_in": <number-of-seconds>
-            # }
-            response: requests.Response = requests.post(url=url,
-                                                        data=body_data)
-            if response.status_code == 200:
-                # request succeeded
-                if logger:
-                    logger.debug(msg=f"POST success, status {response.status_code}")
-                result = response.json()
-            else:
-                # request resulted in error
-                err_msg = f"POST failure, status {response.status_code}, reason '{response.reason}'"
-                if hasattr(response, "content") and response.content:
-                    err_msg += f", content '{response.content}'"
+    with _iam_lock:
+        # retrieve the IAM server's registry
+        registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                     errors=errors,
+                                                     logger=logger)
+        if registry:
+            # complete the data to send in body of request
+            body_data["client_id"] = registry["client-id"]
+            client_secret: str = registry["client-secret"]
+            if client_secret:
+                body_data["client_secret"] = client_secret
+
+            # obtain the token
+            url: str = registry["base-url"] + "/protocol/openid-connect/token"
+            if logger:
+                logger.debug(msg=f"POST '{url}', data {json.dumps(obj=body_data,
+                                                                  ensure_ascii=False)}")
+            try:
+                # typical return on a token request:
+                # {
+                #   "token_type": "Bearer",
+                #   "access_token": <str>,
+                #   "expires_in": <number-of-seconds>,
+                #   "refresh_token": <str>,
+                #   "refesh_expires_in": <number-of-seconds>
+                # }
+                response: requests.Response = requests.post(url=url,
+                                                            data=body_data)
+                if response.status_code == 200:
+                    # request succeeded
+                    if logger:
+                        logger.debug(msg=f"POST success, status {response.status_code}")
+                    result = response.json()
+                else:
+                    # request resulted in error
+                    err_msg = f"POST failure, status {response.status_code}, reason '{response.reason}'"
+                    if hasattr(response, "content") and response.content:
+                        err_msg += f", content '{response.content}'"
+                    if logger:
+                        logger.error(msg=err_msg)
+            except Exception as e:
+                # the operation raised an exception
+                err_msg = exc_format(exc=e,
+                                     exc_info=sys.exc_info())
                 if logger:
                     logger.error(msg=err_msg)
-        except Exception as e:
-            # the operation raised an exception
-            err_msg = exc_format(exc=e,
-                                 exc_info=sys.exc_info())
-            if logger:
-                logger.error(msg=err_msg)
 
     if err_msg and isinstance(errors, list):
         errors.append(err_msg)
@@ -452,38 +471,39 @@ def __validate_and_store(iam_server: IamServer,
     # initialize the return variable
     result: tuple[str, str] | None = None
 
-    # retrieve the IAM server's registry
-    registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
-                                                 errors=errors,
-                                                 logger=logger)
-    if registry:
-        token: str = token_data.get("access_token")
-        user_data["access-token"] = token
-        # keep current refresh token if a new one is not provided
-        if token_data.get("refresh_token"):
-            user_data["refresh-token"] = token_data.get("refresh_token")
-        user_data["access-expiration"] = now + token_data.get("expires_in")
-        refresh_exp: int = user_data.get("refresh_expires_in")
-        user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
-        public_key: str = _get_public_key(iam_server=iam_server,
-                                          errors=errors,
-                                          logger=logger)
-        if public_key:
-            recipient_attr = registry["recipient_attr"]
-            login_id = user_data.pop("login-id", None)
-            claims: dict[str, dict[str, Any]] = token_validate(token=token,
-                                                               issuer=registry["base-url"],
-                                                               recipient_id=login_id,
-                                                               recipient_attr=recipient_attr,
-                                                               public_key=public_key,
-                                                               errors=errors,
-                                                               logger=logger)
-            if claims:
-                users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
-                                                                  errors=errors,
-                                                                  logger=logger)
-                if users:
-                    user_id: str = login_id if login_id else claims["payload"][recipient_attr]
-                    users[user_id] = user_data
-                    result = (user_id, token)
+    with _iam_lock:
+        # retrieve the IAM server's registry
+        registry: dict[str, Any] = _get_iam_registry(iam_server=iam_server,
+                                                     errors=errors,
+                                                     logger=logger)
+        if registry:
+            token: str = token_data.get("access_token")
+            user_data["access-token"] = token
+            # keep current refresh token if a new one is not provided
+            if token_data.get("refresh_token"):
+                user_data["refresh-token"] = token_data.get("refresh_token")
+            user_data["access-expiration"] = now + token_data.get("expires_in")
+            refresh_exp: int = user_data.get("refresh_expires_in")
+            user_data["refresh-expiration"] = (now + refresh_exp) if refresh_exp else sys.maxsize
+            public_key: str = _get_public_key(iam_server=iam_server,
+                                              errors=errors,
+                                              logger=logger)
+            if public_key:
+                recipient_attr = registry["recipient_attr"]
+                login_id = user_data.pop("login-id", None)
+                claims: dict[str, dict[str, Any]] = token_validate(token=token,
+                                                                   issuer=registry["base-url"],
+                                                                   recipient_id=login_id,
+                                                                   recipient_attr=recipient_attr,
+                                                                   public_key=public_key,
+                                                                   errors=errors,
+                                                                   logger=logger)
+                if claims:
+                    users: dict[str, dict[str, Any]] = _get_iam_users(iam_server=iam_server,
+                                                                      errors=errors,
+                                                                      logger=logger)
+                    if users:
+                        user_id: str = login_id if login_id else claims["payload"][recipient_attr]
+                        users[user_id] = user_data
+                        result = (user_id, token)
     return result

pypomes_iam/iam_services.py

@@ -3,8 +3,14 @@ from flask import Request, Response, request, jsonify
 from logging import Logger
 from typing import Any
 
-from .iam_common import IamServer, _get_logger, _get_iam_server
-from .iam_pomes import user_login, user_logout, user_token, token_exchange, login_callback
+from .iam_common import (
+    IamServer, _iam_lock,
+    _get_logger, _get_iam_server
+)
+from .iam_pomes import (
+    user_login, user_logout,
+    user_token, token_exchange, login_callback
+)
 
 
 # @flask_app.route(rule=<login_endpoint>,  # JUSBR_ENDPOINT_LOGIN
@@ -28,19 +34,20 @@ def service_login() -> Response:
         # log the request
         logger.debug(msg=_log_init(request=request))
 
-    # retrieve the IAM server
     errors: list[str] = []
-    iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
-                                            errors=errors,
-                                            logger=logger)
-    if iam_server:
-        # obtain the login URL
-        login_data: dict[str,  str] = user_login(iam_server=iam_server,
-                                                 args=request.args,
-                                                 errors=errors,
-                                                 logger=logger)
-        if login_data:
-            result = jsonify(login_data)
+    with _iam_lock:
+        # retrieve the IAM server
+        iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
+                                                errors=errors,
+                                                logger=logger)
+        if iam_server:
+            # obtain the login URL
+            login_data: dict[str,  str] = user_login(iam_server=iam_server,
+                                                     args=request.args,
+                                                     errors=errors,
+                                                     logger=logger)
+            if login_data:
+                result = jsonify(login_data)
 
     if errors:
         result = Response("; ".join(errors))
@@ -74,17 +81,18 @@ def service_logout() -> Response:
         # log the request
         logger.debug(msg=_log_init(request=request))
 
-    # retrieve the IAM server
     errors: list[str] = []
-    iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
-                                            errors=errors,
-                                            logger=logger)
-    if iam_server:
-        # logout the user
-        user_logout(iam_server=iam_server,
-                    args=request.args,
-                    errors=errors,
-                    logger=logger)
+    with _iam_lock:
+        # retrieve the IAM server
+        iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
+                                                errors=errors,
+                                                logger=logger)
+        if iam_server:
+            # logout the user
+            user_logout(iam_server=iam_server,
+                        args=request.args,
+                        errors=errors,
+                        logger=logger)
     if errors:
         result = Response("; ".join(errors))
         result.status_code = 400
@@ -106,10 +114,11 @@ def service_callback() -> Response:
     """
     Entry point for the callback from JusBR on authentication operation.
 
-    This callback is typically invoked from a front-end application after a successful login at the
-    JusBR login page, forwarding the data received.
+    This callback is invoked from a front-end application after a successful login at the
+    *IAM* server's login page, forwarding the data received. In a typical OAuth2 flow faction,
+    this data is then used to effectively obtain the token from the *IAM* server.
 
-    :return: the response containing the token, or *BAD REQUEST*
+    :return: the *Response* containing the reference user identification and the token, or *BAD REQUEST*
     """
     # retrieve the operations's logger
     logger: Logger = _get_logger()
@@ -117,18 +126,19 @@ def service_callback() -> Response:
         # log the request
         logger.debug(msg=_log_init(request=request))
 
-    # retrieve the IAM server
     errors: list[str] = []
     token_data: tuple[str, str] | None = None
-    iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
-                                            errors=errors,
-                                            logger=logger)
-    if iam_server:
-        # process the callback operation
-        token_data = login_callback(iam_server=iam_server,
-                                    args=request.args,
-                                    errors=errors,
-                                    logger=logger)
+    with _iam_lock:
+        # retrieve the IAM server
+        iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
+                                                errors=errors,
+                                                logger=logger)
+        if iam_server:
+            # process the callback operation
+            token_data = login_callback(iam_server=iam_server,
+                                        args=request.args,
+                                        errors=errors,
+                                        logger=logger)
     result: Response
     if errors:
         result = jsonify({"errors": "; ".join(errors)})
@@ -136,10 +146,8 @@ def service_callback() -> Response:
         if logger:
             logger.error(msg=json.dumps(obj=result))
     else:
-        result = jsonify({
-            "user-id": token_data[0],
-            "access-token": token_data[1]})
-
+        result = jsonify({"user-id": token_data[0],
+                          "access-token": token_data[1]})
     # log the response
     if logger:
         logger.debug(msg=f"Response {result}")
@@ -148,14 +156,14 @@ def service_callback() -> Response:
 
 
 # @flask_app.route(rule=<token_endpoint>,  # JUSBR_ENDPOINT_TOKEN
-# @flask_app.route(rule=<token_endpoint>,  # KEYCLOAK_ENDPOINT_TOKEN
 #                  methods=["GET"])
+# @flask_app.route(rule=<token_endpoint>,  # KEYCLOAK_ENDPOINT_TOKEN
 #                  methods=["GET"])
 def service_token() -> Response:
     """
-    Entry point for retrieving token from the *IAM* server.
+    Entry point for retrieving a token from the *IAM* server.
 
-    :return: the response containing the token, or *UNAUTHORIZED*
+    :return: the *Response* containing the user reference identification and the token, or *BAD REQUEST*
     """
     # retrieve the operations's logger
     logger: Logger = _get_logger()
@@ -163,26 +171,38 @@ def service_token() -> Response:
         # log the request
         logger.debug(msg=_log_init(request=request))
 
-    # retrieve the IAM server
+    # obtain the user's identification
+    args: dict[str, Any] = request.args
+    user_id: str = args.get("user-id") or args.get("user_id") or args.get("login")
+
     errors: list[str] = []
-    iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
-                                            errors=errors,
-                                            logger=logger)
-    # retrieve the token
     token: str | None = None
-    if iam_server:
-        errors: list[str] = []
-        token: str = user_token(iam_server=iam_server,
-                                args=request.args,
-                                errors=errors,
-                                logger=logger)
+    if user_id:
+        with _iam_lock:
+            # retrieve the IAM server
+            iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
+                                                    errors=errors,
+                                                    logger=logger)
+            if iam_server:
+                # retrieve the token
+                errors: list[str] = []
+                token: str = user_token(iam_server=iam_server,
+                                        args=args,
+                                        errors=errors,
+                                        logger=logger)
+    else:
+        msg: str = "User identification not provided"
+        errors.append(msg)
+        if logger:
+            logger.error(msg=msg)
+
     result: Response
     if errors:
         result = Response("; ".join(errors))
         result.status_code = 400
     else:
-        result = jsonify({"token": token})
-
+        result = jsonify({"user-id": user_id,
+                          "token": token})
     # log the response
     if logger:
         logger.debug(msg=f"Response {result}")
@@ -213,24 +233,28 @@ def service_exchange() -> Response:
             "refesh_expires_in": <number-of-seconds>
         }
 
-    :return: the response containing the token data, or *UNAUTHORIZED*
+    :return: the *Response* containing the token data, or *UNAUTHORIZED*
     """
     # retrieve the operations's logger
     logger: Logger = _get_logger()
+    if logger:
+        # log the request
+        logger.debug(msg=_log_init(request=request))
 
-    # retrieve the IAM server (currently, only 'Keycloak' is supported)
     errors: list[str] = []
-    iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
-                                            errors=errors,
-                                            logger=logger)
-    # exchange the token
-    token_data: dict[str, Any] | None = None
-    if iam_server:
-        errors: list[str] = []
-        token_data = token_exchange(iam_server=iam_server,
-                                    args=request.args,
-                                    errors=errors,
-                                    logger=logger)
+    with _iam_lock:
+        # retrieve the IAM server (currently, only 'IAM_KEYCLOAK' is supported)
+        iam_server: IamServer = _get_iam_server(endpoint=request.endpoint,
+                                                errors=errors,
+                                                logger=logger)
+        # exchange the token
+        token_data: dict[str, Any] | None = None
+        if iam_server:
+            errors: list[str] = []
+            token_data = token_exchange(iam_server=iam_server,
+                                        args=request.args,
+                                        errors=errors,
+                                        logger=logger)
     result: Response
     if errors:
         result = Response("; ".join(errors))

pypomes_iam/jusbr_pomes.py

@@ -7,7 +7,7 @@ from pypomes_core import (
 )
 from typing import Any, Final
 
-from .iam_common import _IAM_SERVERS, IamServer
+from .iam_common import _IAM_SERVERS, IamServer, _iam_lock
 from .iam_pomes import user_token
 
 JUSBR_CLIENT_ID: Final[str] = env_get_str(key=f"{APP_PREFIX}_JUSBR_CLIENT_ID")
@@ -65,18 +65,19 @@ def jusbr_setup(flask_app: Flask,
     # configure the JusBR registry
     cache: Cache = FIFOCache(maxsize=1048576)
     cache["users"] = {}
-    _IAM_SERVERS[IamServer.IAM_JUSRBR] = {
-        "client-id": client_id,
-        "client-secret": client_secret,
-        "client-timeout": client_timeout,
-        "recipient-attr": recipient_attribute,
-        "base-url": base_url,
-        "pk-expiration": sys.maxsize,
-        "pk-lifetime": public_key_lifetime,
-        "cache": cache,
-        "logger": logger,
-        "redirect-uri": None
-    }
+    with _iam_lock:
+        _IAM_SERVERS[IamServer.IAM_JUSRBR] = {
+            "client-id": client_id,
+            "client-secret": client_secret,
+            "client-timeout": client_timeout,
+            "recipient-attr": recipient_attribute,
+            "base-url": base_url,
+            "pk-expiration": sys.maxsize,
+            "pk-lifetime": public_key_lifetime,
+            "cache": cache,
+            "logger": logger,
+            "redirect-uri": None
+        }
 
     # establish the endpoints
     if login_endpoint:
@@ -112,9 +113,14 @@ def jusbr_get_token(user_id: str,
     :param logger: optional logger
     :return: the uthentication tokem
     """
+    # declare the return variable
+    result: str
+
     # retrieve the token
     args: dict[str, Any] = {"user-id": user_id}
-    return user_token(iam_server=IamServer.IAM_JUSRBR,
-                      args=args,
-                      errors=errors,
-                      logger=logger)
+    with _iam_lock:
+        result = user_token(iam_server=IamServer.IAM_JUSRBR,
+                            args=args,
+                            errors=errors,
+                            logger=logger)
+    return result

pypomes_iam/keycloak_pomes.py

@@ -7,7 +7,7 @@ from pypomes_core import (
 )
 from typing import Any, Final
 
-from .iam_common import _IAM_SERVERS, IamServer
+from .iam_common import _IAM_SERVERS, IamServer, _iam_lock
 from .iam_pomes import user_token
 
 KEYCLOAK_CLIENT_ID: Final[str] = env_get_str(key=f"{APP_PREFIX}_KEYCLOAK_CLIENT_ID")
@@ -74,18 +74,19 @@ def keycloak_setup(flask_app: Flask,
     # configure the Keycloak registry
     cache: Cache = FIFOCache(maxsize=1048576)
     cache["users"] = {}
-    _IAM_SERVERS[IamServer.IAM_KEYCLOAK] = {
-        "client-id": client_id,
-        "client-secret": client_secret,
-        "client-timeout": client_timeout,
-        "recipient-attr": recipient_attribute,
-        "base-url": f"{base_url}/realms/{realm}",
-        "pk-expiration": sys.maxsize,
-        "pk-lifetime": public_key_lifetime,
-        "cache": cache,
-        "logger": logger,
-        "redirect-uri": None
-    }
+    with _iam_lock:
+        _IAM_SERVERS[IamServer.IAM_KEYCLOAK] = {
+            "client-id": client_id,
+            "client-secret": client_secret,
+            "client-timeout": client_timeout,
+            "recipient-attr": recipient_attribute,
+            "base-url": f"{base_url}/realms/{realm}",
+            "pk-expiration": sys.maxsize,
+            "pk-lifetime": public_key_lifetime,
+            "cache": cache,
+            "logger": logger,
+            "redirect-uri": None
+        }
 
     # establish the endpoints
     if login_endpoint:
@@ -126,9 +127,14 @@ def keycloak_get_token(user_id: str,
     :param logger: optional logger
     :return: the uthentication tokem
     """
+    # declare the return variable
+    result: str
+
     # retrieve the token
     args: dict[str, Any] = {"user-id": user_id}
-    return user_token(iam_server=IamServer.IAM_KEYCLOAK,
-                      args=args,
-                      errors=errors,
-                      logger=logger)
+    with _iam_lock:
+        result = user_token(iam_server=IamServer.IAM_KEYCLOAK,
+                            args=args,
+                            errors=errors,
+                            logger=logger)
+    return result

pypomes_iam/provider_pomes.py

@@ -4,7 +4,8 @@ from base64 import b64encode
 from datetime import datetime
 from logging import Logger
 from pypomes_core import TZ_LOCAL, exc_format
-from typing import Any
+from threading import Lock
+from typing import Any, Final
 
 # structure:
 # {
@@ -19,7 +20,11 @@ from typing import Any
 #      "expiration": <timestamp>
 #    }
 # }
-_provider_registry: dict[str, dict[str, Any]] = {}
+_provider_registry: Final[dict[str, dict[str, Any]]] = {}
+
+# the lock protecting the data in '_provider_registry'
+# (because it is 'Final' and set at declaration time, it can be accessed through simple imports)
+_provider_lock: Final[Lock] = Lock()
 
 
 def provider_register(provider_id: str,
@@ -48,18 +53,19 @@ def provider_register(provider_id: str,
     :param headers_data: optional key-value pairs to be added to the request headers
     :param body_data: optional key-value pairs to be added to the request body
     """
-    global _provider_registry  # noqa: PLW0602
+    global _provider_registry
 
-    _provider_registry[provider_id] = {
-        "url": auth_url,
-        "user": auth_user,
-        "pwd": auth_pwd,
-        "custom-auth": custom_auth,
-        "headers-data": headers_data,
-        "body-data": body_data,
-        "token": None,
-        "expiration": datetime.now(tz=TZ_LOCAL).timestamp()
-    }
+    with _provider_lock:
+        _provider_registry[provider_id] = {
+            "url": auth_url,
+            "user": auth_user,
+            "pwd": auth_pwd,
+            "custom-auth": custom_auth,
+            "headers-data": headers_data,
+            "body-data": body_data,
+            "token": None,
+            "expiration": datetime.now(tz=TZ_LOCAL).timestamp()
+        }
 
 
 def provider_get_token(provider_id: str,
@@ -78,53 +84,54 @@ def provider_get_token(provider_id: str,
     result: str | None = None
 
     err_msg: str | None = None
-    provider: dict[str, Any] = _provider_registry.get(provider_id)
-    if provider:
-        now: float = datetime.now(tz=TZ_LOCAL).timestamp()
-        if now > provider.get("expiration"):
-            user: str = provider.get("user")
-            pwd: str = provider.get("pwd")
-            headers_data: dict[str, str] = provider.get("headers-data") or {}
-            body_data: dict[str, str] = provider.get("body-data") or {}
-            custom_auth: tuple[str, str] = provider.get("custom-auth")
-            if custom_auth:
-                body_data[custom_auth[0]] = user
-                body_data[custom_auth[1]] = pwd
-            else:
-                enc_bytes: bytes = b64encode(f"{user}:{pwd}".encode())
-                headers_data["Authorization"] = f"Basic {enc_bytes.decode()}"
-            url: str = provider.get("url")
-            try:
-                # typical return on a token request:
-                # {
-                #   "token_type": "Bearer",
-                #   "access_token": <str>,
-                #   "expires_in": <number-of-seconds>,
-                #   optional data:
-                #   "refresh_token": <str>,
-                #   "refresh_expires_in": <number-of-seconds>
-                # }
-                response: requests.Response = requests.post(url=url,
-                                                            data=body_data,
-                                                            headers=headers_data,
-                                                            timeout=None)
-                if response.status_code < 200 or response.status_code >= 300:
-                    # request resulted in error, report the problem
-                    err_msg = (f"POST '{url}': failed, "
-                               f"status {response.status_code}, reason '{response.reason}'")
+    with _provider_lock:
+        provider: dict[str, Any] = _provider_registry.get(provider_id)
+        if provider:
+            now: float = datetime.now(tz=TZ_LOCAL).timestamp()
+            if now > provider.get("expiration"):
+                user: str = provider.get("user")
+                pwd: str = provider.get("pwd")
+                headers_data: dict[str, str] = provider.get("headers-data") or {}
+                body_data: dict[str, str] = provider.get("body-data") or {}
+                custom_auth: tuple[str, str] = provider.get("custom-auth")
+                if custom_auth:
+                    body_data[custom_auth[0]] = user
+                    body_data[custom_auth[1]] = pwd
                 else:
-                    reply: dict[str, Any] = response.json()
-                    provider["token"] = reply.get("access_token")
-                    provider["expiration"] = now + int(reply.get("expires_in"))
-                    if logger:
-                        logger.debug(msg=f"POST '{url}': status {response.status_code}")
-            except Exception as e:
-                # the operation raised an exception
-                err_msg = exc_format(exc=e,
-                                     exc_info=sys.exc_info())
-                err_msg = f"POST '{url}': error, '{err_msg}'"
-    else:
-        err_msg: str = f"Provider '{provider_id}' not registered"
+                    enc_bytes: bytes = b64encode(f"{user}:{pwd}".encode())
+                    headers_data["Authorization"] = f"Basic {enc_bytes.decode()}"
+                url: str = provider.get("url")
+                try:
+                    # typical return on a token request:
+                    # {
+                    #   "token_type": "Bearer",
+                    #   "access_token": <str>,
+                    #   "expires_in": <number-of-seconds>,
+                    #   optional data:
+                    #   "refresh_token": <str>,
+                    #   "refresh_expires_in": <number-of-seconds>
+                    # }
+                    response: requests.Response = requests.post(url=url,
+                                                                data=body_data,
+                                                                headers=headers_data,
+                                                                timeout=None)
+                    if response.status_code < 200 or response.status_code >= 300:
+                        # request resulted in error, report the problem
+                        err_msg = (f"POST '{url}': failed, "
+                                   f"status {response.status_code}, reason '{response.reason}'")
+                    else:
+                        reply: dict[str, Any] = response.json()
+                        provider["token"] = reply.get("access_token")
+                        provider["expiration"] = now + int(reply.get("expires_in"))
+                        if logger:
+                            logger.debug(msg=f"POST '{url}': status {response.status_code}")
+                except Exception as e:
+                    # the operation raised an exception
+                    err_msg = exc_format(exc=e,
+                                         exc_info=sys.exc_info())
+                    err_msg = f"POST '{url}': error, '{err_msg}'"
+        else:
+            err_msg: str = f"Provider '{provider_id}' not registered"
 
     if err_msg:
         if isinstance(errors, list):

{pypomes_iam-0.3.5.dist-info → pypomes_iam-0.3.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_iam
-Version: 0.3.5
+Version: 0.3.6
 Summary: A collection of Python pomes, penyeach (IAM modules)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-IAM
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-IAM/issues

pypomes_iam-0.3.6.dist-info/RECORD

@@ -0,0 +1,12 @@
+pypomes_iam/__init__.py,sha256=H7rUCaUEJBLNJv2rtdmBxwcAB28OItdEPenpv_UEOVw,965
+pypomes_iam/iam_common.py,sha256=f74FUDcnMM2cgzJg-AF17GwCKwbfoezS8LppwxYwPys,10049
+pypomes_iam/iam_pomes.py,sha256=gvDpgff6arB4_Y8AAf6QH2CEWRmdy-kcnQLyD0hx4Y4,23966
+pypomes_iam/iam_services.py,sha256=Ae_hLz5luRjK-l_rhBcuuY03Ov7n7o67UYgBb5rbBys,10002
+pypomes_iam/jusbr_pomes.py,sha256=0qbjJ6EGnlx17K-4Lqh5XkfH58y0joVZiD6HykbwpoE,5823
+pypomes_iam/keycloak_pomes.py,sha256=5ZfpncofF20C1IB5ndO31vfrvfa8Ffy7FJxkGoKKoQQ,6836
+pypomes_iam/provider_pomes.py,sha256=3Rui68hmj8zwY0tnw4aWurz-yQ-niacJFQpi6nWzh-M,6355
+pypomes_iam/token_pomes.py,sha256=1g6PMNNMbmdwLrsvSXvpO8-zdRhso1IFnwAyndNmV4Q,5332
+pypomes_iam-0.3.6.dist-info/METADATA,sha256=q53TFkBnU4mUAZgsJ_r_730kASXLiIyCwW_5mkFz8TU,694
+pypomes_iam-0.3.6.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_iam-0.3.6.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
+pypomes_iam-0.3.6.dist-info/RECORD,,

pypomes_iam-0.3.5.dist-info/RECORD

@@ -1,12 +0,0 @@
-pypomes_iam/__init__.py,sha256=H7rUCaUEJBLNJv2rtdmBxwcAB28OItdEPenpv_UEOVw,965
-pypomes_iam/iam_common.py,sha256=1NgXFTiD4qpbVqLfYsCfHrE0khEaczp-nR3AYXmzmvU,9608
-pypomes_iam/iam_pomes.py,sha256=qmnHX88iaiMGaGeZfbs4VT-G_XMTpRT6wqRZeCOOKbQ,22294
-pypomes_iam/iam_services.py,sha256=qdPPfwR9jIdGak-wr4t2NkdfhVaMqauBdvmVJvmFqyg,8914
-pypomes_iam/jusbr_pomes.py,sha256=M47h_PUUgbCmFQyKz2sN1H9T00BC5v_oPgwl5ATWMSA,5625
-pypomes_iam/keycloak_pomes.py,sha256=GtXJb4TZb-a_5b9ExYdJGetBcU1pEP96ONO6prA_vDo,6638
-pypomes_iam/provider_pomes.py,sha256=eP8XzjTUEpwejTkO0wmDiqKjqbIEOzRNCR2ju5E15og,5856
-pypomes_iam/token_pomes.py,sha256=1g6PMNNMbmdwLrsvSXvpO8-zdRhso1IFnwAyndNmV4Q,5332
-pypomes_iam-0.3.5.dist-info/METADATA,sha256=fGRhn3H98wOkQSrxMh9FFTiheHez3TMIpX6R91wysoU,694
-pypomes_iam-0.3.5.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_iam-0.3.5.dist-info/licenses/LICENSE,sha256=YvUELgV8qvXlaYsy9hXG5EW3Bmsrkw-OJmmILZnonAc,1086
-pypomes_iam-0.3.5.dist-info/RECORD,,