pypomes-jwt 0.6.1__tar.gz → 0.6.3__tar.gz

{pypomes_jwt-0.6.1 → pypomes_jwt-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 0.6.1
+Version: 0.6.3
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -12,4 +12,4 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Requires-Dist: cryptography>=44.0.1
 Requires-Dist: pyjwt>=2.10.1
-Requires-Dist: pypomes-core>=1.7.7
+Requires-Dist: pypomes-core>=1.7.8

{pypomes_jwt-0.6.1 → pypomes_jwt-0.6.3}/pyproject.toml

@@ -1,12 +1,12 @@
 [build-system]
 requires = [
-    "hatchling>=1.22.2"
+    "hatchling>=1.27.0"
 ]
 build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_jwt"
-version = "0.6.1"
+version = "0.6.3"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]
@@ -21,7 +21,7 @@ classifiers = [
 dependencies = [
     "PyJWT>=2.10.1",
     "cryptography>=44.0.1",
-    "pypomes_core>=1.7.7"
+    "pypomes_core>=1.7.8"
 ]
 
 [project.urls]

{pypomes_jwt-0.6.1 → pypomes_jwt-0.6.3}/src/pypomes_jwt/jwt_data.py

@@ -1,8 +1,9 @@
 import jwt
 import requests
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from jwt.exceptions import InvalidTokenError
 from logging import Logger
+from pypomes_core import str_random
 from requests import Response
 from threading import Lock
 from typing import Any, Literal
@@ -17,6 +18,17 @@ class JwtData:
         - access_data: list with dictionaries holding the JWT token data:
          [
            {
+             "control-data": {               # control data
+               "remote-provider": <bool>,    # whether the JWT provider is a remote server
+               "access-token": <jwt-token>,  # access token
+               "algorithm": <string>,        # HS256, HS512, RSA256, RSA512
+               "request-timeout": <int>,     # in seconds - defaults to no timeout
+               "access-max-age": <int>,      # in seconds - defaults to JWT_ACCESS_MAX_AGE
+               "refresh-exp": <timestamp>,   # expiration time for the refresh operation
+               "hs-secret-key": <bytes>,     # HS secret key
+               "rsa-private-key": <bytes>,   # RSA private key
+               "rsa-public-key": <bytes>,    # RSA public key
+             },
              "reserved-claims": {        # reserved claims
                "exp": <timestamp>,       # expiration time
                "iat": <timestamp>        # issued at
@@ -38,17 +50,6 @@ class JwtData:
                "<custom-claim-key-1>": "<custom-claim-value-1>",
                ...
                "<custom-claim-key-n>": "<custom-claim-value-n>"
-             },
-             "control-data": {               # control data
-               "remote-provider": <bool>,    # whether the JWT provider is a remote server
-               "access-token": <jwt-token>,  # access token
-               "algorithm": <string>,        # HS256, HS512, RSA256, RSA512
-               "request-timeout": <int>,     # in seconds - defaults to no timeout
-               "access-max-age": <int>,      # in seconds - defaults to JWT_ACCESS_MAX_AGE
-               "refresh-exp": <timestamp>,   # expiration time for the refresh operation
-               "secret-key": <bytes>,        # HS secret key
-               "private-key": <bytes>,       # RSA private key
-               "public-key": <bytes>,        # RSA public key
              }
            },
            ...
@@ -68,9 +69,9 @@ class JwtData:
                         algorithm: Literal["HS256", "HS512", "RSA256", "RSA512"],
                         access_max_age: int,
                         refresh_max_age: int,
-                        secret_key: bytes,
-                        private_key: bytes,
-                        public_key: bytes,
+                        hs_secret_key: bytes,
+                        rsa_private_key: bytes,
+                        rsa_public_key: bytes,
                         request_timeout: int,
                         remote_provider: bool,
                         logger: Logger = None) -> None:
@@ -78,11 +79,11 @@ class JwtData:
         Add to storage the parameters needed to produce and validate JWT tokens for *account_id*.
 
         The parameter *claims* may contain public and custom claims. Currently, the public claims supported
-        are *birthdate*, *email*, *gender*, *name*, and *roles*. Everything else are considered to be custom
-        claims, and are sent to the remote JWT provided, if applicable.
+        are *birthdate*, *email*, *gender*, *name*, and *roles*. Everything else is considered to be custom
+        claims, and sent to the remote JWT provided, if applicable.
 
         Presently, the *refresh_max_age* data is not relevant, as the authorization parameters in *claims*
-        (typically, an acess-key/secret-key pair), have been previously validated elsewhere.
+        (typically, an acess-key/hs-secret-key pair), have been previously validated elsewhere.
         This situation might change in the future.
 
         :param account_id: the account identification
@@ -91,28 +92,28 @@ class JwtData:
         :param algorithm: the algorithm used to sign the token with
         :param access_max_age: token duration (in seconds)
         :param refresh_max_age: duration for the refresh operation (in seconds)
-        :param secret_key: secret key for HS authentication
-        :param private_key: private key for RSA authentication
-        :param public_key: public key for RSA authentication
+        :param hs_secret_key: secret key for HS authentication
+        :param rsa_private_key: private key for RSA authentication
+        :param rsa_public_key: public key for RSA authentication
         :param request_timeout: timeout for the requests to the reference URL
         :param remote_provider: whether the JWT provider is a remote server
         :param logger: optional logger
         """
         # Do the access data already exist ?
-        if not self.retrieve_access_data(account_id=account_id):
+        if not self.get_access_data(account_id=account_id):
             # no, build control data
             control_data: dict[str, Any] = {
                 "algorithm": algorithm,
                 "access-max-age": access_max_age,
                 "request-timeout": request_timeout,
                 "remote-provider": remote_provider,
-                "refresh-exp": datetime.now(tz=timezone.utc) + timedelta(seconds=refresh_max_age)
+                "refresh-exp": datetime.now(tz=timezone.utc).timestamp() + refresh_max_age
             }
             if algorithm in ["HS256", "HS512"]:
-                control_data["secret-key"] = secret_key
+                control_data["hs-secret-key"] = hs_secret_key
             else:
-                control_data["private-key"] = private_key
-                control_data["public-key"] = public_key
+                control_data["rsa-private-key"] = rsa_private_key
+                control_data["rsa-public-key"] = rsa_public_key
 
             # build claims
             reserved_claims: dict[str, Any] = {
@@ -120,7 +121,7 @@ class JwtData:
                 "iss": reference_url,
                 "exp": "<numeric-UTC-datetime>",
                 "iat": "<numeric-UTC-datetime>",
-                "jti": "<jwt-id",
+                "jti": "<jwt-id>",
             }
             custom_claims: dict[str, Any] = {}
             public_claims: dict[str, Any] = {}
@@ -153,8 +154,8 @@ class JwtData:
         :param logger: optional logger
         """
         # obtain the access data item in storage
-        item_data: dict[str, dict[str, Any]] = self.retrieve_access_data(account_id=account_id,
-                                                                         logger=logger)
+        item_data: dict[str, dict[str, Any]] = self.get_access_data(account_id=account_id,
+                                                                    logger=logger)
         if item_data:
             with self.access_lock:
                 self.access_data.remove(item_data)
@@ -172,6 +173,7 @@ class JwtData:
         Structure of the return data:
         {
           "access_token": <jwt-token>,
+          "created_in": <timestamp>,
           "expires_in": <seconds-to-expiration>
         }
 
@@ -195,8 +197,8 @@ class JwtData:
         result: dict[str, Any]
 
         # obtain the item in storage
-        item_data: dict[str, Any] = self.retrieve_access_data(account_id=account_id,
-                                                              logger=logger)
+        item_data: dict[str, Any] = self.get_access_data(account_id=account_id,
+                                                         logger=logger)
         # was the JWT data obtained ?
         if item_data:
             # yes, proceed
@@ -207,40 +209,51 @@ class JwtData:
 
             # obtain a new token, if the current token has expired
             if just_now > reserved_claims.get("exp"):
-                # where is the locus of the JWT service provider ?
+                # where is the JWT service provider ?
                 if control_data.get("remote-provider"):
                     # JWT service is being provided by a remote server
                     errors: list[str] = []
-                    result = jwt_request_token(errors=errors,
-                                               reference_url=reserved_claims.get("iss"),
-                                               claims=custom_claims,
-                                               timeout=control_data.get("request-timeout"),
-                                               logger=logger)
-                    if result:
+                    # Structure of the return data:
+                    # {
+                    #   "access_token": <jwt-token>,
+                    #   "created_in": <timestamp>,
+                    #   "expires_in": <seconds-to-expiration>,
+                    #   ...
+                    # }
+                    reply: dict[str, Any] = jwt_request_token(errors=errors,
+                                                              reference_url=reserved_claims.get("iss"),
+                                                              claims=custom_claims,
+                                                              timeout=control_data.get("request-timeout"),
+                                                              logger=logger)
+                    if reply:
                         with self.access_lock:
-                            control_data["access-token"] = result.get("access_token")
-                            duration: int = result.get("expires_in")
-                            reserved_claims["exp"] = just_now + duration
+                            control_data["access-token"] = reply.get("access_token")
+                            reserved_claims["jti"] = str_random(size=16)
+                            reserved_claims["iat"] = reply.get("created_in")
+                            reserved_claims["exp"] = reply.get("created_in") + reply.get("expires_in")
                     else:
                         raise RuntimeError(" - ".join(errors))
                 else:
                     # JWT service is being provided locally
-                    reserved_claims["iat"] = just_now
-                    reserved_claims["exp"] = just_now + control_data.get("access-max-age")
                     claims: dict[str, Any] = item_data.get("public-claims").copy()
-                    claims.update(reserved_claims)
-                    claims.update(custom_claims)
+                    claims.update(m=reserved_claims)
+                    claims.update(m=custom_claims)
                     # may raise an exception
                     token: str = jwt.encode(payload=claims,
-                                            key=control_data.get("secret-key") or control_data.get("private-key"),
+                                            key=(control_data.get("hs-secret-key") or
+                                                 control_data.get("rsa-private-key")),
                                             algorithm=control_data.get("algorithm"))
                     with self.access_lock:
+                        reserved_claims["jti"] = str_random(size=16)
+                        reserved_claims["iat"] = just_now
+                        reserved_claims["exp"] = just_now + control_data.get("access-max-age")
                         control_data["access-token"] = token
 
             # return the token
             result = {
                 "access_token": control_data.get("access-token"),
-                "expires_in": reserved_claims.get("exp") - just_now
+                "created_in": reserved_claims.get("iat"),
+                "expires_in": reserved_claims.get("exp") - reserved_claims.get("iat")
             }
         else:
             # JWT access data not found
@@ -263,37 +276,46 @@ class JwtData:
         :raises InvalidTokenError: token is not valid
         :raises ExpiredSignatureError: token has expired
         """
-        algorithm: str | None = None
-        key: str | None = None
-        with self.access_lock:
-            for item_data in self.access_data:
-                control_data: dict[str, Any] = item_data.get("control-data")
-                if token == control_data.get("access-token"):
-                    algorithm = control_data.get("algorithm")
-                    key = control_data.get("public-key") or control_data.get("secret-key")
-                    break
-
-        if not algorithm or not key:
-            raise InvalidTokenError("JWT token is not valid")
+        # declare the return variable
+        result: dict[str, Any]
 
         if logger:
             logger.debug(msg=f"Retrieve claims for JWT token '{token}'")
-        result: dict[str, Any] = jwt.decode(jwt=token,
-                                            key=key,
-                                            algorithms=[algorithm])
+
+        control_data: dict[str, Any] = self.get_access_data(access_token=token,
+                                                            logger=logger)
+        if control_data:
+            if control_data.get("remote-provider"):
+                # provider is remote
+                result = control_data.get("custom-claims")
+            else:
+                # may raise InvalidTokenError or ExpiredSignatureError
+                result = jwt.decode(jwt=token,
+                                    key=(control_data.get("hs-secret-key") or
+                                         control_data.get("rsa-public-key")),
+                                    algorithms=[control_data.get("algorithm")])
+        else:
+            raise InvalidTokenError("JWT token is not valid")
+
         if logger:
             logger.debug(f"Retrieved claims for JWT token '{token}': {result}")
 
         return result
 
-    def retrieve_access_data(self,
-                             account_id: str,
-                             logger: Logger = None) -> dict[str, dict[str, Any]]:
+    def get_access_data(self,
+                        account_id: str = None,
+                        access_token: str = None,
+                        logger: Logger = None) -> dict[str, dict[str, Any]]:
         # noinspection HttpUrlsUsage
         """
-        Retrieve and return the access data in storage for *account_id*.
+        Retrieve and return the access data in storage for *account_id*, or optionally, for *access_token*.
+
+        Either *account_id* or *access_token* must be provided, the former having precedence over the later.
+        Note that, whereas *account_id* uniquely identifies an access dataset, *access_token* might not,
+        and thus, the first dataset associated with it would be returned.
 
         :param account_id: the account identification
+        :param access_token: the access token
         :param logger: optional logger
         :return: the corresponding item in storage, or *None* if not found
         """
@@ -301,11 +323,13 @@ class JwtData:
         result: dict[str, dict[str, Any]] | None = None
     
         if logger:
-            logger.debug(f"Retrieve access data for account id '{account_id}'")
+            target: str = f"account id '{account_id}'" if account_id else f"token '{access_token}'"
+            logger.debug(f"Retrieve access data for {target}")
         # retrieve the data
         with self.access_lock:
             for item_data in self.access_data:
-                if account_id == item_data.get("reserved-claims").get("sub"):
+                if (account_id and account_id == item_data.get("reserved-claims").get("sub")) or \
+                        (access_token and access_token == item_data.get("control-data").get("access-token")):
                     result = item_data
                     break
         if logger:
@@ -320,7 +344,7 @@ def jwt_request_token(errors: list[str],
                       timeout: int = None,
                       logger: Logger = None) -> dict[str, Any]:
     """
-    Obtain and return the JWT token associated with *reference_url*, along with its duration.
+    Obtain and return the JWT token from *reference_url*, along with its duration.
 
     Expected structure of the return data:
     {

{pypomes_jwt-0.6.1 → pypomes_jwt-0.6.3}/src/pypomes_jwt/jwt_pomes.py

@@ -2,6 +2,7 @@ import contextlib
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPublicKey
+from datetime import datetime
 from flask import Request, Response, request, jsonify
 from logging import Logger
 from pypomes_core import APP_PREFIX, env_get_str, env_get_bytes, env_get_int
@@ -64,7 +65,7 @@ def jwt_assert_access(account_id: str) -> bool:
     :param account_id: the account identification
     :return: *True* if access data exists for *account_id*, *False* otherwise
     """
-    return __jwt_data.retrieve_access_data(account_id=account_id) is not None
+    return __jwt_data.get_access_data(account_id=account_id) is not None
 
 
 def jwt_set_access(account_id: str,
@@ -113,9 +114,9 @@ def jwt_set_access(account_id: str,
                                algorithm=algorithm,
                                access_max_age=access_max_age,
                                refresh_max_age=refresh_max_age,
-                               secret_key=secret_key,
-                               private_key=private_key,
-                               public_key=public_key,
+                               hs_secret_key=secret_key,
+                               rsa_private_key=private_key,
+                               rsa_public_key=public_key,
                                request_timeout=request_timeout,
                                remote_provider=remote_provider,
                                logger=logger)
@@ -176,6 +177,7 @@ def jwt_get_token_data(errors: list[str],
     Structure of the return data:
     {
       "access_token": <jwt-token>,
+      "created_in": <timestamp>,
       "expires_in": <seconds-to-expiration>
     }
 
@@ -236,13 +238,14 @@ def jwt_verify_request(request: Request,
 
     :param request: the request to be verified
     :param logger: optional logger
-    :return: 'None' if the request is valid, otherwise a 'Response' object reporting the error
+    :return: *None* if the request is valid, otherwise a *Response* object reporting the error
     """
     # initialize the return variable
     result: Response | None = None
-    
+
     if logger:
         logger.debug(msg="Validate a JWT token")
+    err_msg: str | None = None
 
     # retrieve the authorization from the request header
     auth_header: str = request.headers.get("Authorization")
@@ -253,20 +256,34 @@ def jwt_verify_request(request: Request,
         token: str = auth_header.split(" ")[1]
         if logger:
             logger.debug(msg=f"Token is '{token}'")
-        try:
-            jwt_validate_token(token=token,
-                               key=JWT_HS_SECRET_KEY or JWT_RSA_PUBLIC_KEY,
-                               algorithm=JWT_DEFAULT_ALGORITHM)
-        except Exception as e:
-            # validation failed
-            if logger:
-                logger.error(msg=str(e))
-            result = Response(response=str(e),
-                              status=401)
+        # retrieve the reference access data
+        access_data: dict[str, Any] = __jwt_data.get_access_data(access_token=token)
+        if access_data:
+            control_data: dict[str, Any] = access_data.get("control-data")
+            if control_data.get("remote-provider"):
+                # JWT provider is remote
+                if datetime.now().timestamp() > access_data.get("reserved-claims").get("exp"):
+                    err_msg = "Token has expired"
+            else:
+                # JWT was locally provided
+                try:
+                    jwt_validate_token(token=token,
+                                       key=(control_data.get("hs-secret-key") or
+                                            control_data.get("rsa-public-key")),
+                                       algorithm=control_data.get("algorithm"))
+                except Exception as e:
+                    # validation failed
+                    err_msg = str(e)
+        else:
+            err_msg = "No access data found for token"
     else:
-        # no, report the error
+        # no 'Bearer' found, report the error
+        err_msg = "Request header has no 'Bearer' data"
+
+    # log the error and deny the authorization
+    if err_msg:
         if logger:
-            logger.error(msg="Request header has no 'Bearer' data")
+            logger.error(msg=err_msg)
         result = Response(response="Authorization failed",
                           status=401)
 
@@ -293,13 +310,14 @@ def jwt_service(account_id: str = None,
     Structure of the return data:
     {
       "access_token": <jwt-token>,
+      "created_in": <timestamp>,
       "expires_in": <seconds-to-expiration>
     }
 
     :param account_id: the account identification, alternatively passed in JSON
     :param service_params: the optional JSON containing the request parameters (defaults to JSON in body)
     :param logger: optional logger
-    :return: the requested JWT token, along with its duration.
+    :return: a *Response* containing the requested JWT token and its duration, or reporting an error
     """
     # declare the return variable
     result: Response
@@ -324,8 +342,8 @@ def jwt_service(account_id: str = None,
         # yes, proceed
         if logger:
             logger.debug(msg=f"Account identification is '{account_id}'")
-        item_data: dict[str, dict[str, Any]] = __jwt_data.retrieve_access_data(account_id=account_id,
-                                                                               logger=logger) or {}
+        item_data: dict[str, dict[str, Any]] = __jwt_data.get_access_data(account_id=account_id,
+                                                                          logger=logger) or {}
         custom_claims: dict[str, Any] = item_data.get("custom-claims").copy()
         for key, value in params.items():
             custom_claims[key] = value