pypomes-jwt 0.8.9__py3-none-any.whl → 0.9.0__py3-none-any.whl

pypomes_jwt/jwt_data.py

@@ -1,8 +1,8 @@
-import base64
 import jwt
 import requests
 import string
 import sys
+from base64 import urlsafe_b64encode
 from datetime import datetime, timezone
 from logging import Logger
 from pypomes_core import str_random
@@ -33,11 +33,13 @@ class JwtData:
            "access-max-age": <int>,      # in seconds - defaults to JWT_ACCESS_MAX_AGE
            "refresh-max-age": <int>,     # in seconds - defaults to JWT_REFRESH_MAX_AGE
            "grace-interval": <int>       # time to wait for token to be valid, in seconds
+           # optional
            "token-audience": <string>    # the audience the token is intended for
            "token_nonce": <string>       # value used to associate a client session with a token
            "claims": {
              "valid-from": <string>      # token's start (<YYYY-MM-DDThh:mm:ss+00:00>)
              "valid-until": <string>     # token's finish (<YYYY-MM-DDThh:mm:ss+00:00>)
+             # optional
              "birthdate": <string>,      # subject's birth date
              "email": <string>,          # subject's email
              "gender": <string>,         # subject's gender
@@ -63,7 +65,6 @@ class JwtData:
       "jti": <string>           # JWT id
       "sub": <string>           # subject (the account identification)
       "nat": <string>           # nature of token (A: access; R: refresh) - locally issued tokens, only
-      # optional:
       "aud": <string>           # token audience
       "nbt": <timestamp>        # not before time
 
@@ -81,8 +82,10 @@ class JwtData:
     The token header has these items:
       "alg": <string>           # the algorithm used to sign the token (one of 'HS256', 'HS512', 'RSA256', 'RSA512')
       "typ": <string>           # the token type (fixed to 'JWT'
-      "kid": <string>           # a reference to the encoding/decoding keys used
-                                # (if issued by the local server, holds the public key, if assimetric keys were used)
+      "kid": <string>           # a reference to the token type and the key to its location in the token database
+
+    If issued by the local server, "kid" holds the key to the corresponding record in the token database.
+    It starts with *A* for (*Access*) or *R* (for *Refresh*) followed its integer key.
     """
     def __init__(self) -> None:
         """
@@ -242,17 +245,23 @@ class JwtData:
                     # JWT service is being provided locally
                     just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
                     current_claims["iat"] = just_now
-
+                    grace_interval = account_data.get("grace-interval")
+                    if grace_interval:
+                        account_data["nbf"] = just_now + grace_interval
+                        current_claims["valid-from"] = datetime.fromtimestamp(timestamp=current_claims["nbf"],
+                                                                              tz=timezone.utc).isoformat()
+                    else:
+                        current_claims["valid-from"] = datetime.fromtimestamp(timestamp=current_claims["iat"],
+                                                                              tz=timezone.utc).isoformat()
                     # issue a candidate refresh token first, and persist it
                     current_claims["exp"] = just_now + account_data.get("refresh-max-age")
-                    current_claims["valid-from"] = datetime.fromtimestamp(timestamp=current_claims["iat"],
-                                                                          tz=timezone.utc).isoformat()
                     current_claims["valid-until"] = datetime.fromtimestamp(timestamp=current_claims["exp"],
                                                                            tz=timezone.utc).isoformat()
                     # may raise an exception
                     refresh_token: str = jwt.encode(payload=current_claims,
                                                     key=JWT_ENCODING_KEY,
-                                                    algorithm=JWT_DEFAULT_ALGORITHM)
+                                                    algorithm=JWT_DEFAULT_ALGORITHM,
+                                                    headers={"kid": "R0"})
                     # obtain a DB connection (may raise an exception)
                     db_conn: Any = db_connect(errors=errors,
                                               logger=logger)
@@ -266,7 +275,7 @@ class JwtData:
                     refresh_token = jwt.encode(payload=current_claims,
                                                key=JWT_ENCODING_KEY,
                                                algorithm=JWT_DEFAULT_ALGORITHM,
-                                               headers={"kid": str(token_id)})
+                                               headers={"kid": f"R{token_id}"})
                     # persist it
                     db_update(errors=errors,
                               update_stmt=f"UPDATE {JWT_DB_TABLE}",
@@ -286,7 +295,8 @@ class JwtData:
                     # may raise an exception
                     access_token: str = jwt.encode(payload=current_claims,
                                                    key=JWT_ENCODING_KEY,
-                                                   algorithm=JWT_DEFAULT_ALGORITHM)
+                                                   algorithm=JWT_DEFAULT_ALGORITHM,
+                                                   headers={"kid": f"A{token_id}"})
                     # return the token data
                     result = {
                         "access_token": access_token,
@@ -453,7 +463,7 @@ def _jwt_persist_token(errors: list[str],
               insert_data={JWT_DB_COL_ACCOUNT: account_id,
                            JWT_DB_COL_TOKEN: jwt_token,
                            JWT_DB_COL_ALGORITHM: JWT_DEFAULT_ALGORITHM,
-                           JWT_DB_COL_DECODER: base64.urlsafe_b64encode(JWT_DECODING_KEY).decode()},
+                           JWT_DB_COL_DECODER: urlsafe_b64encode(JWT_DECODING_KEY).decode()},
               connection=db_conn,
               logger=logger)
     if errors:

pypomes_jwt/jwt_pomes.py

@@ -1,9 +1,9 @@
-import base64
 import jwt
+from base64 import urlsafe_b64decode
 from flask import Request, Response, request
 from logging import Logger
 from pypomes_db import db_select, db_delete
-from typing import Any, Literal
+from typing import Any
 
 from . import JWT_DB_COL_ACCOUNT
 from .jwt_constants import (
@@ -61,7 +61,7 @@ def jwt_verify_request(request: Request,
             logger.debug(msg="Token was found")
         errors: list[str] = []
         jwt_validate_token(errors=errors,
-                           nature="A",
+                           nature=["A"],
                            token=token)
         if errors:
             err_msg = "; ".join(errors)
@@ -157,17 +157,20 @@ def jwt_remove_account(account_id: str,
 
 def jwt_validate_token(errors: list[str] | None,
                        token: str,
-                       nature: Literal["A", "R"] = None,
+                       nature: list[str] = None,
                        account_id: str = None,
                        logger: Logger = None) -> dict[str, Any] | None:
     """
     Verify if *token* ia a valid JWT token.
 
     Raise an appropriate exception if validation failed.
+    if *nature* is provided, it is checked whether *token* has been locally issued and is of a appropriate nature.
+    A token issued locally has the header claim *kid* starting with "A" (for *Access*) or "R" (for *Refresh*),
+    followed by its id in the token database.
 
     :param errors: incidental error messages
     :param token: the token to be validated
-    :param nature: optionally validate the token's nature ("A": access token, "R": refresh token)
+    :param nature: one of more prefixes identifying the nature of locally issued tokens
     :param account_id: optionally, validate the token's account owner
     :param logger: optional logger
     :return: The token's claims (header and payload) if if is valid, *None* otherwise
@@ -179,17 +182,16 @@ def jwt_validate_token(errors: list[str] | None,
 
     # extract needed data from token header
     token_header: dict[str, Any] = jwt.get_unverified_header(jwt=token)
-    token_kid: int = int(token_header.get("kid") or 0)
+    token_kid: str = token_header.get("kid")
     token_alg: str | None = None
     token_decoder: bytes | None = None
     op_errors: list[str] = []
 
     # retrieve token data from database
-    if (nature == "R" and not token_kid) or (nature == "A" and token_kid):
-        nat: str = "an access" if nature == "A" else "a refresh"
-        op_errors.append(f"Token is not {nat} token")
+    if nature and not (token_kid and token_kid[0:1] in nature):
+        op_errors.append("Invalid token")
     elif token_kid:
-        where_data: dict[str, str] = {JWT_DB_COL_KID: token_kid}
+        where_data: dict[str, Any] = {JWT_DB_COL_KID: int(token_kid[1:])}
         if account_id:
             where_data[JWT_DB_COL_ACCOUNT] = account_id
         recs: list[tuple[str]] = db_select(errors=op_errors,
@@ -199,7 +201,7 @@ def jwt_validate_token(errors: list[str] | None,
                                            logger=logger)
         if recs:
             token_alg = recs[0][0]
-            token_decoder = base64.urlsafe_b64decode(recs[0][1])
+            token_decoder = urlsafe_b64decode(recs[0][1])
         else:
             op_errors.append("Invalid token")
     else:
@@ -215,9 +217,7 @@ def jwt_validate_token(errors: list[str] | None,
             #   ExpiredSignatureError: token and refresh period have expired
             #   InvalidSignatureError: signature does not match the one provided as part of the token
             #   ImmatureSignatureError: 'nbf' or 'iat' claim represents a timestamp in the future
-            #   InvalidAudienceError: 'aud' claim does not match one of the expected audience
             #   InvalidAlgorithmError: the specified algorithm is not recognized
-            #   InvalidIssuerError: 'iss' claim does not match the expected issuer
             #   InvalidIssuedAtError: 'iat' claim is non-numeric
             #   MissingRequiredClaimError: a required claim is not contained in the claimset
             payload: dict[str, Any] = jwt.decode(jwt=token,
@@ -227,7 +227,7 @@ def jwt_validate_token(errors: list[str] | None,
                                                      "verify_nbf": True
                                                  },
                                                  key=token_decoder,
-                                                 require=["exp"],
+                                                 require=["iat", "iss", "exp", "sub"],
                                                  algorithms=token_alg)
             if account_id and payload.get("sub") != account_id:
                 op_errors.append("Token does not belong to account")
@@ -275,15 +275,15 @@ def jwt_revoke_token(errors: list[str] | None,
     op_errors: list[str] = []
     token_claims: dict[str, Any] = jwt_validate_token(errors=op_errors,
                                                       token=refresh_token,
-                                                      nature="R",
+                                                      nature=["A", "R"],
                                                       account_id=account_id,
                                                       logger=logger)
     if not op_errors:
-        token_kid: int = int(token_claims["header"].get("kid") or 0)
+        token_kid: str = token_claims["header"].get("kid")
         db_delete(errors=op_errors,
                   delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
                   where_data={
-                      JWT_DB_COL_KID: token_kid,
+                      JWT_DB_COL_KID: int(token_kid[1:]),
                       JWT_DB_COL_ACCOUNT: account_id
                   },
                   logger=logger)
@@ -334,7 +334,7 @@ def jwt_get_tokens(errors: list[str] | None,
         # verify whether this refresh token is legitimate
         account_claims = (jwt_validate_token(errors=op_errors,
                                              token=refresh_token,
-                                             nature="R",
+                                             nature=["R"],
                                              account_id=account_id,
                                              logger=logger) or {}).get("payload")
         if account_claims:
@@ -380,7 +380,7 @@ def jwt_get_claims(errors: list[str] | None,
         "header": {
           "alg": "RS256",
           "typ": "JWT",
-          "kid": "1234"
+          "kid": "A1234"
         },
         "payload": {
           "valid-from": <YYYY-MM-DDThh:mm:ss+00:00>

{pypomes_jwt-0.8.9.dist-info → pypomes_jwt-0.9.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 0.8.9
+Version: 0.9.0
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -13,4 +13,4 @@ Requires-Python: >=3.12
 Requires-Dist: cryptography>=44.0.2
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: pypomes-core>=1.8.5
-Requires-Dist: pypomes-db>=1.9.6
+Requires-Dist: pypomes-db>=1.9.7

pypomes_jwt-0.9.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+pypomes_jwt/__init__.py,sha256=P7rT6ZVE2BzU3ntYOr83H5iOf5JcCmjDUYakNbrRAP0,1266
+pypomes_jwt/jwt_constants.py,sha256=IQV39AiZKGuU8XxZBgJ-KJZQZ_mmnxyOnRZeuxlqDRk,4045
+pypomes_jwt/jwt_data.py,sha256=keC95-2DgWYZIzAtYEbtLtfkFSH-V_sTBiTbszsZqho,23286
+pypomes_jwt/jwt_pomes.py,sha256=0C4u9UnzqM1ZWTW4rpw18kyvnR1biLEq5nAwZ8MMrz8,17244
+pypomes_jwt-0.9.0.dist-info/METADATA,sha256=0KthAWPxm04v3KMnYfsaHal4_kN0tFj8er2a52A__AI,632
+pypomes_jwt-0.9.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+pypomes_jwt-0.9.0.dist-info/licenses/LICENSE,sha256=NdakochSXm_H_-DSL_x2JlRCkYikj3snYYvTwgR5d_c,1086
+pypomes_jwt-0.9.0.dist-info/RECORD,,

pypomes_jwt-0.8.9.dist-info/RECORD

@@ -1,8 +0,0 @@
-pypomes_jwt/__init__.py,sha256=P7rT6ZVE2BzU3ntYOr83H5iOf5JcCmjDUYakNbrRAP0,1266
-pypomes_jwt/jwt_constants.py,sha256=IQV39AiZKGuU8XxZBgJ-KJZQZ_mmnxyOnRZeuxlqDRk,4045
-pypomes_jwt/jwt_data.py,sha256=FU4zvFr-1ZbClM8ozt9asR2EGZe-xYX3046dxWnGays,22529
-pypomes_jwt/jwt_pomes.py,sha256=XWnP4U2K5FPbP-N5npQboNdMZ-MMLpXTfd8Yf82aFls,17217
-pypomes_jwt-0.8.9.dist-info/METADATA,sha256=orVERU_gL14nmPjxxNMrxyEKy3q4LLBD2vMokmyECSQ,632
-pypomes_jwt-0.8.9.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-pypomes_jwt-0.8.9.dist-info/licenses/LICENSE,sha256=NdakochSXm_H_-DSL_x2JlRCkYikj3snYYvTwgR5d_c,1086
-pypomes_jwt-0.8.9.dist-info/RECORD,,