pypomes-jwt 0.7.6__py3-none-any.whl → 0.7.9__py3-none-any.whl

pypomes_jwt/__init__.py

@@ -8,7 +8,7 @@ from .jwt_constants import (
 from .jwt_pomes import (
     jwt_needed, jwt_verify_request,
     jwt_get_tokens, jwt_get_claims, jwt_validate_token,
-    jwt_assert_access, jwt_set_access, jwt_remove_access, jwt_revoke_tokens
+    jwt_assert_access, jwt_set_access, jwt_remove_account, jwt_revoke_token
 )
 
 __all__ = [
@@ -21,7 +21,7 @@ __all__ = [
     # jwt_pomes
     "jwt_needed", "jwt_verify_request",
     "jwt_get_tokens", "jwt_get_claims", "jwt_validate_token",
-    "jwt_assert_access", "jwt_set_access", "jwt_remove_access", "jwt_revoke_tokens"
+    "jwt_assert_access", "jwt_set_access", "jwt_remove_account", "jwt_revoke_token"
 ]
 
 from importlib.metadata import version

pypomes_jwt/jwt_constants.py

@@ -3,7 +3,7 @@ from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPublicKey
 from pypomes_core import (
     APP_PREFIX,
-    env_get_str, env_get_bytes, env_get_int, env_get_bool
+    env_get_str, env_get_bytes, env_get_int
 )
 from secrets import token_bytes
 from typing import Final
@@ -18,6 +18,7 @@ JWT_DB_CLIENT: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_CLIENT")  # fo
 JWT_DB_DRIVER: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_DRIVER")  # for SQLServer, only
 JWT_DB_TABLE: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_TABLE")
 JWT_DB_COL_ACCOUNT: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_ACCOUNT")
+JWT_DB_COL_HASH: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_HASH")
 JWT_DB_COL_TOKEN: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_TOKEN")
 # define the database engine
 __db_engine: str | None = env_get_str(key=f"{APP_PREFIX}_JWT_DB_ENGINE")
@@ -53,8 +54,7 @@ JWT_ACCESS_MAX_AGE: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_ACCESS_MAX_A
 # recommended: at least 2 hours (set to 24 hours)
 JWT_REFRESH_MAX_AGE: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_REFRESH_MAX_AGE",
                                               def_value=86400)
-JWT_ROTATE_TOKENS: Final[bool] = env_get_bool(key=f"{APP_PREFIX}_JWT_ROTATE_TOKENS",
-                                              def_value=True)
+JWT_ACCOUNT_LIMIT: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_ACCOUNT_LIMIT")
 
 # recommended: allow the encode and decode keys to be generated anew when app starts
 __encoding_key: bytes = env_get_bytes(key=f"{APP_PREFIX}_JWT_ENCODE_KEY")

pypomes_jwt/jwt_data.py

@@ -1,3 +1,4 @@
+import hashlib
 import jwt
 import requests
 import string
@@ -9,8 +10,8 @@ from threading import Lock
 from typing import Any
 
 from .jwt_constants import (
-    JWT_DEFAULT_ALGORITHM, JWT_ENCODING_KEY, JWT_ROTATE_TOKENS,
-    JWT_DB_ENGINE, JWT_DB_TABLE, JWT_DB_COL_ACCOUNT, JWT_DB_COL_TOKEN
+    JWT_DEFAULT_ALGORITHM, JWT_ENCODING_KEY, JWT_DECODING_KEY, JWT_ACCOUNT_LIMIT,
+    JWT_DB_ENGINE, JWT_DB_TABLE, JWT_DB_COL_ACCOUNT, JWT_DB_COL_HASH, JWT_DB_COL_TOKEN
 )
 
 
@@ -19,30 +20,30 @@ class JwtData:
     Shared JWT data for security token access.
 
     Instance variables:
-        - access_lock: lock for safe multi-threading access
-        - access_data: dictionary holding the JWT token data, organized by account id:
-         {
-           <account-id>: {
-             "reference-url":              # the reference URL
-             "remote-provider": <bool>,    # whether the JWT provider is a remote server
-             "request-timeout": <int>,     # in seconds - defaults to no timeout
-             "access-max-age": <int>,      # in seconds - defaults to JWT_ACCESS_MAX_AGE
-             "refresh-max-age": <int>,     # in seconds - defaults to JWT_REFRESH_MAX_AGE
-             "grace-interval": <int>       # time to wait for token to be valid, in seconds
-             "token-audience": <string>    # the audience the token is intended for
-             "token_nonce": <string>       # value used to associate a client session with a token
-             "claims": {
-               "birthdate": <string>,    # subject's birth date
-               "email": <string>,        # subject's email
-               "gender": <string>,       # subject's gender
-               "name": <string>,         # subject's name
-               "roles": <List[str]>,     # subject roles
-               "nonce": <string>,        # value used to associate a Client session with a token
-               ...
-             }
-           },
-           ...
-         }
+      - access_lock: lock for safe multi-threading access
+      - access_data: dictionary holding the JWT token data, organized by account id:
+       {
+         <account-id>: {
+           "reference-url":              # the reference URL
+           "remote-provider": <bool>,    # whether the JWT provider is a remote server
+           "request-timeout": <int>,     # in seconds - defaults to no timeout
+           "access-max-age": <int>,      # in seconds - defaults to JWT_ACCESS_MAX_AGE
+           "refresh-max-age": <int>,     # in seconds - defaults to JWT_REFRESH_MAX_AGE
+           "grace-interval": <int>       # time to wait for token to be valid, in seconds
+           "token-audience": <string>    # the audience the token is intended for
+           "token_nonce": <string>       # value used to associate a client session with a token
+           "claims": {
+             "birthdate": <string>,    # subject's birth date
+             "email": <string>,        # subject's email
+             "gender": <string>,       # subject's gender
+             "name": <string>,         # subject's name
+             "roles": <List[str]>,     # subject roles
+             "nonce": <string>,        # value used to associate a Client session with a token
+             ...
+           }
+         },
+         ...
+       }
 
     JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between
     two parties. It is fully described in the RFC 7519, issued by the Internet Engineering Task Force
@@ -51,24 +52,30 @@ class JwtData:
     as token-related and account-related. All times are UTC.
 
     Token-related claims are mostly required claims, and convey information about the token itself:
-       "exp": <timestamp>        # expiration time
-       "iat": <timestamp>        # issued at
-       "iss": <string>           # issuer (for remote providers, URL to obtain and validate the access tokens)
-       "jti": <string>           # JWT id
-       "sub": <string>           # subject (the account identification)
-       "nat": <string>           # nature of token (A: access; R: refresh) - locally issued tokens, only
-       # optional:
-       "aud": <string>           # token audience
-       "nbt": <timestamp>        # not before time
+      "exp": <timestamp>        # expiration time
+      "iat": <timestamp>        # issued at
+      "iss": <string>           # issuer (for remote providers, URL to obtain and validate the access tokens)
+      "jti": <string>           # JWT id
+      "sub": <string>           # subject (the account identification)
+      "nat": <string>           # nature of token (A: access; R: refresh) - locally issued tokens, only
+      # optional:
+      "aud": <string>           # token audience
+      "nbt": <timestamp>        # not before time
 
     Account-related claims are optional claims, and convey information about the registered account they belong to.
     Alhough they can be freely specified, these are some of the most commonly used claims:
-       "birthdate": <string>     # subject's birth date
-       "email": <string>         # subject's email
-       "gender": <string>        # subject's gender
-       "name": <string>          # subject's name
-       "roles": <List[str]>      # subject roles
-       "nonce": <string>         # value used to associate a client session with a token
+      "birthdate": <string>     # subject's birth date
+      "email": <string>         # subject's email
+      "gender": <string>        # subject's gender
+      "name": <string>          # subject's name
+      "roles": <List[str]>      # subject roles
+      "nonce": <string>         # value used to associate a client session with a token
+
+    The token header has these items:
+      "alg": <string>           # the algorithm used to sign the token (one of 'HS256', 'HS512', 'RSA256', 'RSA512')
+      "typ": <string>           # the token type (fixed to 'JWT'
+      "kid": <string>           # a reference to the encoding/decoding keys used
+                                # (if issued by the local server, holds the public key, if assimetric keys were used)
     """
     def __init__(self) -> None:
         """
@@ -77,18 +84,18 @@ class JwtData:
         self.access_lock: Lock = Lock()
         self.access_data: dict[str, Any] = {}
 
-    def add_access(self,
-                   account_id: str,
-                   reference_url: str,
-                   claims: dict[str, Any],
-                   access_max_age: int,
-                   refresh_max_age: int,
-                   grace_interval: int,
-                   token_audience: str,
-                   token_nonce: str,
-                   request_timeout: int,
-                   remote_provider: bool,
-                   logger: Logger = None) -> None:
+    def add_account(self,
+                    account_id: str,
+                    reference_url: str,
+                    claims: dict[str, Any],
+                    access_max_age: int,
+                    refresh_max_age: int,
+                    grace_interval: int,
+                    token_audience: str,
+                    token_nonce: str,
+                    request_timeout: int,
+                    remote_provider: bool,
+                    logger: Logger = None) -> None:
         """
         Add to storage the parameters needed to produce and validate JWT tokens for *account_id*.
 
@@ -128,9 +135,9 @@ class JwtData:
             elif logger:
                 logger.warning(f"JWT data already exists for '{account_id}'")
 
-    def remove_access(self,
-                      account_id: str,
-                      logger: Logger) -> bool:
+    def remove_account(self,
+                       account_id: str,
+                       logger: Logger) -> bool:
         """
         Remove from storage the access data for *account_id*.
 
@@ -142,6 +149,12 @@ class JwtData:
         with self.access_lock:
             account_data = self.access_data.pop(account_id, None)
 
+        if account_data and JWT_DB_ENGINE:
+            from pypomes_db import db_delete
+            db_delete(errors=None,
+                      delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
+                      where_data={JWT_DB_COL_ACCOUNT: account_id},
+                      logger=logger)
         if logger:
             if account_data:
                 logger.debug(f"Removed JWT data for '{account_id}'")
@@ -200,6 +213,7 @@ class JwtData:
                 # obtain new tokens
                 current_claims["jti"] = str_random(size=32,
                                                    chars=string.ascii_letters + string.digits)
+                current_claims["sub"] = account_id
                 current_claims["iss"] = account_data.get("reference-url")
 
                 # where is the JWT service provider ?
@@ -224,55 +238,36 @@ class JwtData:
                     # JWT service is being provided locally
                     just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
                     current_claims["iat"] = just_now
+                    token_header: dict[str, Any] = None \
+                        if JWT_DEFAULT_ALGORITHM not in ["RSA256", "RSA512"] \
+                        else {"kid": JWT_DECODING_KEY}
 
-                    # retrieve the refresh token associated with the account id
-                    refresh_token: str | None = None
-                    if JWT_DB_ENGINE:
-                        from pypomes_db import db_select, db_delete
-                        if JWT_ROTATE_TOKENS:
-                            db_delete(errors=errors,
-                                      delete_stmt=f"DELETE FROM {JWT_DB_TABLE} "
-                                                  f"WHERE {JWT_DB_COL_ACCOUNT} = '{account_id}'",
-                                      logger=logger)
-                        else:
-                            recs: list[tuple[str]] = \
-                                db_select(errors=errors,
-                                          sel_stmt=f"SELECT token FROM {JWT_DB_TABLE} "
-                                                   f"WHERE {JWT_DB_COL_ACCOUNT} = '{account_id}'",
-                                          max_count=1,
-                                          logger=logger)
-                            if recs:
-                                refresh_token = recs[0][0]
-                        if errors:
-                            raise RuntimeError(" - ".join(errors))
-
-                    # was it obtained ?
-                    if not refresh_token:
-                        # no, issue a new one
-                        current_claims["exp"] = just_now + account_data.get("refresh-max-age")
-                        current_claims["nat"] = "R"
-                        # may raise an exception
-                        refresh_token: str = jwt.encode(payload=current_claims,
-                                                        key=JWT_ENCODING_KEY,
-                                                        algorithm=JWT_DEFAULT_ALGORITHM)
-                        # persist the new refresh token
-                        if JWT_DB_ENGINE:
-                            from pypomes_db import db_insert
-                            db_insert(errors=errors,
-                                      insert_stmt=f"INSERT INTO {JWT_DB_TABLE}",
-                                      insert_data={JWT_DB_COL_ACCOUNT: account_id,
-                                                   JWT_DB_COL_TOKEN: refresh_token},
-                                      logger=logger)
-                            if errors:
-                                raise RuntimeError(" - ".join(errors))
-
-                    # issue the access token
+                    # issue the access token first
                     current_claims["nat"] = "A"
                     current_claims["exp"] = just_now + account_data.get("access-max-age")
                     # may raise an exception
                     access_token: str = jwt.encode(payload=current_claims,
                                                    key=JWT_ENCODING_KEY,
-                                                   algorithm=JWT_DEFAULT_ALGORITHM)
+                                                   algorithm=JWT_DEFAULT_ALGORITHM,
+                                                   headers=token_header)
+
+                    # then issue the refresh token
+                    current_claims["exp"] = just_now + account_data.get("refresh-max-age")
+                    current_claims["nat"] = "R"
+                    # may raise an exception
+                    refresh_token: str = jwt.encode(payload=current_claims,
+                                                    key=JWT_ENCODING_KEY,
+                                                    algorithm=JWT_DEFAULT_ALGORITHM,
+                                                    headers=token_header)
+                    if JWT_DB_ENGINE:
+                        # persist the refresh token
+                        _jwt_persist_token(errors=errors,
+                                           account_id=account_id,
+                                           jwt_token=refresh_token,
+                                           logger=logger)
+                        if errors:
+                            raise RuntimeError("; ".join(errors))
+
                     # return the token data
                     result = {
                         "access_token": access_token,
@@ -301,7 +296,9 @@ def _jwt_request_token(errors: list[str],
     Expected structure of the return data:
     {
       "access_token": <jwt-token>,
-      "expires_in": <seconds-to-expiration>
+      "created_in": <timestamp>,
+      "expires_in": <seconds-to-expiration>,
+      "refresh_token": <token>
     }
     It is up to the invoker to make sure that the *claims* data conform to the requirements
     of the provider issuing the JWT token.
@@ -340,3 +337,68 @@ def _jwt_request_token(errors: list[str],
         errors.append(err_msg)
 
     return result
+
+
+def _jwt_persist_token(errors: list[str],
+                       account_id: str,
+                       jwt_token: str,
+                       logger: Logger = None) -> None:
+    """
+    Persist the given token, making sure that the account limit is adhered to.
+
+    :param errors: incidental errors
+    :param account_id: the account identification
+    :param jwt_token: the JWT token to persist
+    :param logger: optional logger
+    """
+    from pypomes_db import db_select, db_insert, db_delete
+    from .jwt_pomes import jwt_get_claims
+
+    # retrieve the account's tokens
+    recs: list[tuple[str]] = db_select(errors=errors,
+                                       sel_stmt=f"SELECT {JWT_DB_COL_HASH}, {JWT_DB_COL_TOKEN} FROM {JWT_DB_TABLE} ",
+                                       where_data={JWT_DB_COL_ACCOUNT: account_id})
+    if not errors:
+        if logger:
+            logger.debug(msg=f"Read {len(recs)} token from storage for account '{account_id}'")
+        # remove the expired tokens
+        expired: list[str] = []
+        for rec in recs:
+            token: str = rec[1]
+            token_hash: str = rec[0]
+            token_claims: dict[str, Any] = jwt_get_claims(errors=errors,
+                                                          token=token,
+                                                          validate=False,
+                                                          logger=logger)
+            if errors:
+                break
+            exp: int = token_claims["payload"]["exp"]
+            if exp < datetime.now(tz=timezone.utc).timestamp():
+                expired.append(token_hash)
+
+        if not errors:
+            # remove expired tokens from persistence
+            # ruff: noqa: SIM102
+            if expired:
+                if db_delete(errors=errors,
+                             delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
+                             where_data={
+                                JWT_DB_COL_ACCOUNT: account_id,
+                                JWT_DB_COL_HASH: expired
+                             },
+                             logger=logger) is not None:
+                    if logger:
+                        logger.debug(msg=f"{len(expired)} tokens removed from storage")
+                    if 0 < JWT_ACCOUNT_LIMIT <= len(recs) - len(expired):
+                        errors.append("Maximum number of active sessions "
+                                      f"({JWT_ACCOUNT_LIMIT}) exceeded for account '{account_id}'")
+            # persist token
+            if not errors:
+                # ruff: noqa: S324
+                hasher = hashlib.new(name="md5",
+                                     data=jwt_token.encode())
+                token_hash: str = hasher.digest().decode()
+                db_insert(errors=errors,
+                          insert_stmt=f"INSERT INTO {JWT_DB_TABLE}",
+                          insert_data={"ds_hash": token_hash,
+                                       "ds_token": jwt_token})

pypomes_jwt/jwt_pomes.py

@@ -1,3 +1,4 @@
+import hashlib
 import jwt
 from flask import Request, Response, request
 from logging import Logger
@@ -31,6 +32,51 @@ def jwt_needed(func: callable) -> callable:
     return wrapper
 
 
+def jwt_verify_request(request: Request,
+                       logger: Logger = None) -> Response:
+    """
+    Verify wheher the HTTP *request* has the proper authorization, as per the JWT standard.
+
+    :param request: the request to be verified
+    :param logger: optional logger
+    :return: *None* if the request is valid, otherwise a *Response* object reporting the error
+    """
+    # initialize the return variable
+    result: Response | None = None
+
+    if logger:
+        logger.debug(msg="Validate a JWT token")
+    err_msg: str | None = None
+
+    # retrieve the authorization from the request header
+    auth_header: str = request.headers.get("Authorization")
+
+    # was a 'Bearer' authorization obtained ?
+    if auth_header and auth_header.startswith("Bearer "):
+        # yes, extract and validate the JWT access token
+        token: str = auth_header.split(" ")[1]
+        if logger:
+            logger.debug(msg=f"Token is '{token}'")
+        errors: list[str] = []
+        jwt_validate_token(errors=errors,
+                           nature="A",
+                           token=token)
+        if errors:
+            err_msg = "; ".join(errors)
+    else:
+        # no 'Bearer' found, report the error
+        err_msg = "Request header has no 'Bearer' data"
+
+    # log the error and deny the authorization
+    if err_msg:
+        if logger:
+            logger.error(msg=err_msg)
+        result = Response(response="Authorization failed",
+                          status=401)
+
+    return result
+
+
 def jwt_assert_access(account_id: str) -> bool:
     """
     Determine whether access for *account_id* has been established.
@@ -68,7 +114,7 @@ def jwt_set_access(account_id: str,
     :param logger: optional logger
     """
     if logger:
-        logger.debug(msg=f"Register access data for '{account_id}'")
+        logger.debug(msg=f"Register account data for '{account_id}'")
 
     # extract the claims provided in the reference URL's query string
     pos: int = reference_url.find("?")
@@ -79,21 +125,21 @@ def jwt_set_access(account_id: str,
         reference_url = reference_url[:pos]
 
     # register the JWT service
-    __jwt_data.add_access(account_id=account_id,
-                          reference_url=reference_url,
-                          claims=claims,
-                          access_max_age=access_max_age,
-                          refresh_max_age=refresh_max_age,
-                          grace_interval=grace_interval,
-                          token_audience=token_audience,
-                          token_nonce=token_nonce,
-                          request_timeout=request_timeout,
-                          remote_provider=remote_provider,
-                          logger=logger)
-
-
-def jwt_remove_access(account_id: str,
-                      logger: Logger = None) -> bool:
+    __jwt_data.add_account(account_id=account_id,
+                           reference_url=reference_url,
+                           claims=claims,
+                           access_max_age=access_max_age,
+                           refresh_max_age=refresh_max_age,
+                           grace_interval=grace_interval,
+                           token_audience=token_audience,
+                           token_nonce=token_nonce,
+                           request_timeout=request_timeout,
+                           remote_provider=remote_provider,
+                           logger=logger)
+
+
+def jwt_remove_account(account_id: str,
+                       logger: Logger = None) -> bool:
     """
     Remove from storage the JWT access data for *account_id*.
 
@@ -104,8 +150,8 @@ def jwt_remove_access(account_id: str,
     if logger:
         logger.debug(msg=f"Remove access data for '{account_id}'")
 
-    return __jwt_data.remove_access(account_id=account_id,
-                                    logger=logger)
+    return __jwt_data.remove_account(account_id=account_id,
+                                     logger=logger)
 
 
 def jwt_validate_token(errors: list[str] | None,
@@ -136,7 +182,7 @@ def jwt_validate_token(errors: list[str] | None,
         claims: dict[str, Any] = jwt.decode(jwt=token,
                                             key=JWT_DECODING_KEY,
                                             algorithms=[JWT_DEFAULT_ALGORITHM])
-        if nature and "nat" in claims and nature != claims.get("nat"):
+        if nature and nature != claims.get("nat"):
             nat: str = "an access" if nature == "A" else "a refresh"
             err_msg = f"Token is not {nat} token"
     except Exception as e:
@@ -153,16 +199,18 @@ def jwt_validate_token(errors: list[str] | None,
     return err_msg is None
 
 
-def jwt_revoke_tokens(errors: list[str] | None,
-                      account_id: str,
-                      logger: Logger = None) -> bool:
+def jwt_revoke_token(errors: list[str] | None,
+                     account_id: str,
+                     refresh_token: str,
+                     logger: Logger = None) -> bool:
     """
-    Revoke all refresh tokens associated with *account_id*.
+    Revoke the *refresh_token* associated with *account_id*.
 
     Revoke operations require access to a database table defined by *JWT_DB_TABLE*.
 
     :param errors: incidental error messages
     :param account_id: the account identification
+    :param refresh_token: the token to be revolked
     :param logger: optional logger
     :return: *True* if operation could be performed, *False* otherwise
     """
@@ -170,16 +218,25 @@ def jwt_revoke_tokens(errors: list[str] | None,
     result: bool = False
 
     if logger:
-        logger.debug(msg=f"Revoking refresh tokens of '{account_id}'")
+        logger.debug(msg=f"Revoking refresh token of '{account_id}'")
 
     op_errors: list[str] = []
     if JWT_DB_ENGINE:
-        from pypomes_db import db_delete
-        delete_stmt: str = (f"DELETE FROM {JWT_DB_TABLE} "
-                            f"WHERE {JWT_DB_COL_ACCOUNT} = '{account_id}'")
-        db_delete(errors=op_errors,
-                  delete_stmt=delete_stmt,
-                  logger=logger)
+        from pypomes_db import db_exists, db_delete
+        # ruff: noqa: S324
+        hasher = hashlib.new(name="md5",
+                             data=refresh_token.encode())
+        token_hash: str = hasher.digest().decode()
+        if db_exists(errors=op_errors,
+                     table=JWT_DB_TABLE,
+                     where_data={"ds_hash": token_hash},
+                     logger=logger):
+            db_delete(errors=errors,
+                      delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
+                      where_data={"ds_hash": token_hash},
+                      logger=logger)
+        elif not op_errors:
+            op_errors.append("Token was not found")
     else:
         op_errors.append("Database access for token revocation has not been specified")
 
@@ -233,7 +290,7 @@ def jwt_get_tokens(errors: list[str] | None,
             recs: list[tuple[str]] = db_select(errors=op_errors,
                                                sel_stmt=f"SELECT {JWT_DB_COL_TOKEN} "
                                                         f"FROM {JWT_DB_TABLE}",
-                                               where_data={JWT_DB_COL_ACCOUNT: f"'{account_id}'"},
+                                               where_data={JWT_DB_COL_ACCOUNT: account_id},
                                                logger=logger)
             if not op_errors and \
                     (len(recs) == 0 or recs[0][0] != refresh_token):
@@ -247,7 +304,8 @@ def jwt_get_tokens(errors: list[str] | None,
     if not op_errors:
         try:
             result = __jwt_data.issue_tokens(account_id=account_id,
-                                             account_claims=account_claims)
+                                             account_claims=account_claims,
+                                             logger=logger)
             if logger:
                 logger.debug(msg=f"Data is '{result}'")
         except Exception as e:
@@ -265,12 +323,44 @@ def jwt_get_tokens(errors: list[str] | None,
 
 def jwt_get_claims(errors: list[str] | None,
                    token: str,
+                   validate: bool = True,
                    logger: Logger = None) -> dict[str, Any]:
     """
     Obtain and return the claims set of a JWT *token*.
 
+    If *validate* is set to *True*, tha following pieces of information are verified:
+      - the token was issued and signed by the local provider, and is not corrupted
+      - the claim 'exp' is present and is in the future
+      - the claim 'nbf' is present and is in the past
+
+    Structure of the returned data:
+      {
+        "header": {
+          "alg": "HS256",
+          "typ": "JWT",
+          "kid": "rt466ytRTYH64577uydhDFGHDYJH2341"
+        },
+        "payload": {
+          "birthdate": "1980-01-01",
+          "email": "jdoe@mail.com",
+          "exp": 1516640454,
+          "iat": 1516239022,
+          "iss": "https://my_id_provider/issue",
+          "jti": "Uhsdfgr67FGH567qwSDF33er89retert",
+          "gender": "M,
+          "name": "John Doe",
+          "nbt": 1516249022
+          "sub": "1234567890",
+          "roles": [
+            "administrator",
+            "operator"
+          ]
+        }
+      }
+
     :param errors: incidental error messages
     :param token: the token to be inspected for claims
+    :param validate: If *True*, verifies the token's data
     :param logger: optional logger
     :return: the token's claimset, or *None* if error
     """
@@ -281,14 +371,26 @@ def jwt_get_claims(errors: list[str] | None,
         logger.debug(msg=f"Retrieve claims for token '{token}'")
 
     try:
-        claims: dict[str, Any] = jwt.decode(jwt=token,
-                                            options={"verify_signature": False})
-        if claims.get("nat") in ["A", "R"]:
-            result = jwt.decode(jwt=token,
-                                key=JWT_DECODING_KEY,
-                                algorithms=[JWT_DEFAULT_ALGORITHM])
+        # retrieve the token's payload
+        if validate:
+            payload: dict[str, Any] = jwt.decode(jwt=token,
+                                                 options={
+                                                     "verify_signature": True,
+                                                     "verify_exp": True,
+                                                     "verify_nbf": True
+                                                 },
+                                                 key=JWT_DECODING_KEY,
+                                                 require=["exp", "nbf"],
+                                                 algorithms=[JWT_DEFAULT_ALGORITHM])
         else:
-            result = claims
+            payload: dict[str, Any] = jwt.decode(jwt=token,
+                                                 options={"verify_signature": False})
+        # retrieve the token's header
+        header: dict[str, Any] = jwt.get_unverified_header(jwt=token)
+        result = {
+            "header": header,
+            "payload": payload
+        }
     except Exception as e:
         if logger:
             logger.error(msg=str(e))
@@ -296,48 +398,3 @@ def jwt_get_claims(errors: list[str] | None,
             errors.append(str(e))
 
     return result
-
-
-def jwt_verify_request(request: Request,
-                       logger: Logger = None) -> Response:
-    """
-    Verify wheher the HTTP *request* has the proper authorization, as per the JWT standard.
-
-    :param request: the request to be verified
-    :param logger: optional logger
-    :return: *None* if the request is valid, otherwise a *Response* object reporting the error
-    """
-    # initialize the return variable
-    result: Response | None = None
-
-    if logger:
-        logger.debug(msg="Validate a JWT token")
-    err_msg: str | None = None
-
-    # retrieve the authorization from the request header
-    auth_header: str = request.headers.get("Authorization")
-
-    # was a 'Bearer' authorization obtained ?
-    if auth_header and auth_header.startswith("Bearer "):
-        # yes, extract and validate the JWT access token
-        token: str = auth_header.split(" ")[1]
-        if logger:
-            logger.debug(msg=f"Token is '{token}'")
-        errors: list[str] = []
-        jwt_validate_token(errors=errors,
-                           nature="A",
-                           token=token)
-        if errors:
-            err_msg = "; ".join(errors)
-    else:
-        # no 'Bearer' found, report the error
-        err_msg = "Request header has no 'Bearer' data"
-
-    # log the error and deny the authorization
-    if err_msg:
-        if logger:
-            logger.error(msg=err_msg)
-        result = Response(response="Authorization failed",
-                          status=401)
-
-    return result

{pypomes_jwt-0.7.6.dist-info → pypomes_jwt-0.7.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 0.7.6
+Version: 0.7.9
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues

pypomes_jwt-0.7.9.dist-info/RECORD

@@ -0,0 +1,8 @@
+pypomes_jwt/__init__.py,sha256=xUDd_xphRQFHuTxrvlQxO-mHIXgTqZjHWHMgp5gRrXU,1130
+pypomes_jwt/jwt_constants.py,sha256=6-Jw4ORgf32hRWnaGyVISXMJMtTBk7LdKl3RrDy7Ll0,4328
+pypomes_jwt/jwt_data.py,sha256=gyhGquSQbHevOKIoXmAmjMSwCjXB7pYbI2sY-7sGGO8,19158
+pypomes_jwt/jwt_pomes.py,sha256=xNBlHhvrOH07WP6hKE0PyDl4fKSl0R1Xg7AQO_1b1uo,15201
+pypomes_jwt-0.7.9.dist-info/METADATA,sha256=rXu25F1ufUL_U7frUaV1DMAj27pH8gvPX-TIA0qLlrg,599
+pypomes_jwt-0.7.9.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_jwt-0.7.9.dist-info/licenses/LICENSE,sha256=NdakochSXm_H_-DSL_x2JlRCkYikj3snYYvTwgR5d_c,1086
+pypomes_jwt-0.7.9.dist-info/RECORD,,

pypomes_jwt-0.7.6.dist-info/RECORD

@@ -1,8 +0,0 @@
-pypomes_jwt/__init__.py,sha256=dkWeYPNwypjwFuTjx4YtC8QV9ihykF4xcJJ7x86Wc5g,1130
-pypomes_jwt/jwt_constants.py,sha256=xUX2raEaDUPJsjAm78lQ0APs4KSs5GYBxSPC5QKrrFE,4327
-pypomes_jwt/jwt_data.py,sha256=YH3v8zvOURkB_o0XLMu2y2sFkKCxZBmbyWU5rC2gre4,16419
-pypomes_jwt/jwt_pomes.py,sha256=eRQSLA8DVzr9MfVOh5bl6Zz3iOQtRIAQjzIfoz6Fj9o,12915
-pypomes_jwt-0.7.6.dist-info/METADATA,sha256=5N0G1VHBXKHiH-QAnUBC9UgeqpjOh9-4-BYMtAl680U,599
-pypomes_jwt-0.7.6.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_jwt-0.7.6.dist-info/licenses/LICENSE,sha256=NdakochSXm_H_-DSL_x2JlRCkYikj3snYYvTwgR5d_c,1086
-pypomes_jwt-0.7.6.dist-info/RECORD,,