pypomes-jwt 1.0.8__tar.gz → 1.1.0__tar.gz

{pypomes_jwt-1.0.8 → pypomes_jwt-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 1.0.8
+Version: 1.1.0
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -12,5 +12,5 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Requires-Dist: cryptography>=44.0.2
 Requires-Dist: pyjwt>=2.10.1
-Requires-Dist: pypomes-core>=1.9.2
-Requires-Dist: pypomes-db>=2.0.3
+Requires-Dist: pypomes-core>=1.9.6
+Requires-Dist: pypomes-db>=2.0.9

{pypomes_jwt-1.0.8 → pypomes_jwt-1.1.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_jwt"
-version = "1.0.8"
+version = "1.1.0"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]
@@ -21,8 +21,8 @@ classifiers = [
 dependencies = [
     "PyJWT>=2.10.1",
     "cryptography>=44.0.2",
-    "pypomes_core>=1.9.2",
-    "pypomes_db>=2.0.3"
+    "pypomes_core>=1.9.6",
+    "pypomes_db>=2.0.9"
 ]
 
 [project.urls]

pypomes_jwt-1.1.0/src/pypomes_jwt/__init__.py

@@ -0,0 +1,23 @@
+from .jwt_constants import (
+    JwtParam, JwtDbParam
+)
+from .jwt_pomes import (
+    jwt_needed, jwt_verify_request,
+    jwt_assert_account, jwt_set_account, jwt_remove_account,
+    jwt_issue_token, jwt_issue_tokens, jwt_refresh_tokens,
+    jwt_get_claims, jwt_validate_token, jwt_revoke_token
+)
+
+__all__ = [
+    # jwt_constants
+    "JwtParam", "JwtDbParam",
+    # jwt_pomes
+    "jwt_needed", "jwt_verify_request",
+    "jwt_assert_account", "jwt_set_account", "jwt_remove_account",
+    "jwt_issue_token", "jwt_issue_tokens", "jwt_refresh_tokens",
+    "jwt_get_claims", "jwt_validate_token", "jwt_revoke_token"
+]
+
+from importlib.metadata import version
+__version__ = version("pypomes_jwt")
+__version_info__ = tuple(int(i) for i in __version__.split(".") if i.isdigit())

pypomes_jwt-1.1.0/src/pypomes_jwt/jwt_constants.py

@@ -0,0 +1,108 @@
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPublicKey
+from enum import StrEnum
+from pypomes_core import (
+    APP_PREFIX,
+    env_get_str, env_get_bytes, env_get_int
+)
+from pypomes_db import DbEngine, db_setup
+from secrets import token_bytes
+from sys import stderr
+from typing import Any, Final
+
+
+class JwtParam(StrEnum):
+    """
+    Parameters for JWT provider access.
+    """
+    ACCESS_MAX_AGE = "access-max-age"
+    ACCOUNT_LIMIT = "account-limit"
+    DECODING_KEY = "decoding-key"
+    DEFAULT_ALGORITHM = "default-algorithm"
+    ENCODING_KEY = "encoding-key"
+    REFRESH_MAX_AGE = "refresh-max-age"
+
+
+class JwtDbParam(StrEnum):
+    """
+    Parameters for JWT databse connection.
+    """
+    CLIENT = "client"
+    DRIVER = "driver"
+    ENGINE = "engine"
+    NAME = "name"
+    HOST = "host"
+    PORT = "port"
+    USER = "user"
+    PWD = "pwd"
+    TABLE = "table"
+    COL_ACCOUNT = "col-account"
+    COL_ALGORITHM = "col-algorithm"
+    COL_DECODER = "col-decoder"
+    COL_KID = "col-kid"
+    COL_TOKEN = "col-token"
+
+
+# recommended: allow the encode and decode keys to be generated anew when app starts
+__encoding_key: bytes = env_get_bytes(key=f"{APP_PREFIX}_JWT_ENCODING_KEY",
+                                      encoding="base64url")
+__decoding_key: bytes
+# one of HS256, HS512, RS256, RS512
+__default_algorithm: str = env_get_str(key=f"{APP_PREFIX}_JWT_DEFAULT_ALGORITHM",
+                                       def_value="RS256")
+if __default_algorithm in ["HS256", "HS512"]:
+    if not __encoding_key:
+        __encoding_key = token_bytes(nbytes=32)
+    __decoding_key = __encoding_key
+else:
+    __decoding_key: bytes = env_get_bytes(key=f"{APP_PREFIX}_JWT_DECODING_KEY")
+    if not __encoding_key or not __decoding_key:
+        __priv_key: RSAPrivateKey = rsa.generate_private_key(public_exponent=65537,
+                                                             key_size=2048)
+        __encoding_key = __priv_key.private_bytes(encoding=serialization.Encoding.PEM,
+                                                  format=serialization.PrivateFormat.PKCS8,
+                                                  encryption_algorithm=serialization.NoEncryption())
+        __pub_key: RSAPublicKey = __priv_key.public_key()
+        __decoding_key = __pub_key.public_bytes(encoding=serialization.Encoding.PEM,
+                                                format=serialization.PublicFormat.SubjectPublicKeyInfo)
+
+_JWT_CONFIG: Final[dict[JwtParam, Any]] = {
+    # recommended: between 5 min and 1 hour (set to 5 min)
+    JwtParam.ACCESS_MAX_AGE: env_get_int(key=f"{APP_PREFIX}_JWT_ACCESS_MAX_AGE",
+                                         def_value=300),
+    JwtParam.ACCOUNT_LIMIT: env_get_int(key=f"{APP_PREFIX}_JWT_ACCOUNT_LIMIT"),
+    JwtParam.DECODING_KEY: __decoding_key,
+    JwtParam.DEFAULT_ALGORITHM: __default_algorithm,
+    JwtParam.ENCODING_KEY: __encoding_key,
+    # recommended: at least 2 hours (set to 24 hours)
+    JwtParam.REFRESH_MAX_AGE: env_get_int(key=f"{APP_PREFIX}_JWT_REFRESH_MAX_AGE",
+                                          def_value=86400)
+}
+_JWT_DB: Final[JwtDbParam, Any] = {
+    JwtDbParam.ENGINE: DbEngine(env_get_str(key=f"{APP_PREFIX}_JWT_DB_ENGINE")),
+    JwtDbParam.CLIENT: env_get_str(key=f"{APP_PREFIX}_JWT_DB_CLIENT"),  # for Oracle, only
+    JwtDbParam.DRIVER: env_get_str(key=f"{APP_PREFIX}_JWT_DB_DRIVER"),  # for SQLServer, only
+    JwtDbParam.NAME: env_get_str(key=f"{APP_PREFIX}_JWT_DB_NAME"),
+    JwtDbParam.HOST: env_get_str(key=f"{APP_PREFIX}_JWT_DB_HOST"),
+    JwtDbParam.PORT: env_get_int(key=f"{APP_PREFIX}_JWT_DB_PORT"),
+    JwtDbParam.USER: env_get_str(key=f"{APP_PREFIX}_JWT_DB_USER"),
+    JwtDbParam.PWD: env_get_str(key=f"{APP_PREFIX}_JWT_DB_PWD"),
+    JwtDbParam.TABLE:  env_get_str(key=f"{APP_PREFIX}_JWT_DB_TABLE"),
+    JwtDbParam.COL_ACCOUNT: env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_ACCOUNT"),
+    JwtDbParam.COL_ALGORITHM: env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_ALGORITHM"),
+    JwtDbParam.COL_DECODER: env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_DECODER"),
+    JwtDbParam.COL_KID: env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_KID"),
+    JwtDbParam.COL_TOKEN: env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_TOKEN")
+}
+
+# define and validate the database engine
+if not db_setup(engine=_JWT_DB[JwtDbParam.ENGINE],
+                db_name=_JWT_DB[JwtDbParam.NAME],
+                db_user=_JWT_DB[JwtDbParam.USER],
+                db_pwd=_JWT_DB[JwtDbParam.PWD],
+                db_host=_JWT_DB[JwtDbParam.HOST],
+                db_port=_JWT_DB[JwtDbParam.PORT],
+                db_client=_JWT_DB[JwtDbParam.CLIENT],
+                db_driver=_JWT_DB[JwtDbParam.DRIVER]):
+    stderr.write("Invalid database parameters\n")

{pypomes_jwt-1.0.8 → pypomes_jwt-1.1.0}/src/pypomes_jwt/jwt_pomes.py

@@ -9,15 +9,12 @@ from pypomes_db import (
 )
 from typing import Any
 
-from . import (
-    JWT_ACCESS_MAX_AGE, JWT_REFRESH_MAX_AGE,
-    JWT_DEFAULT_ALGORITHM, JWT_DECODING_KEY,
-    JWT_DB_TABLE, JWT_DB_COL_KID,
-    JWT_DB_COL_ACCOUNT, JWT_DB_COL_ALGORITHM, JWT_DB_COL_DECODER
+from .jwt_constants import (
+    JwtParam, JwtDbParam, _JWT_CONFIG, _JWT_DB
 )
 from .jwt_registry import JwtRegistry
 
-# the JWT data object
+# the JWT registry
 __jwt_registry: JwtRegistry = JwtRegistry()
 
 
@@ -42,8 +39,8 @@ def jwt_verify_request(request: Request) -> Response:
     """
     Verify whether the HTTP *request* has the proper authorization, as per the JWT standard.
 
-    :param request: the request to be verified
-    :return: *None* if the request is valid, otherwise a *Response* object reporting the error
+    :param request: the *request* to be verified
+    :return: *None* if the *request* is valid, otherwise a *Response* reporting the error
     """
     # initialize the return variable
     result: Response | None = None
@@ -80,8 +77,8 @@ def jwt_assert_account(account_id: str) -> bool:
 
 def jwt_set_account(account_id: str,
                     claims: dict[str, Any],
-                    access_max_age: int = JWT_ACCESS_MAX_AGE,
-                    refresh_max_age: int = JWT_REFRESH_MAX_AGE,
+                    access_max_age: int = _JWT_CONFIG[JwtParam.ACCESS_MAX_AGE],
+                    refresh_max_age: int = _JWT_CONFIG[JwtParam.REFRESH_MAX_AGE],
                     grace_interval: int = None,
                     logger: Logger = None) -> None:
     """
@@ -182,12 +179,15 @@ def jwt_validate_token(errors: list[str] | None,
         elif token_kid and len(token_kid) > 1 and \
                 token_kid[0:1] in ["A", "R"] and token_kid[1:].isdigit():
             # token was likely issued locally
-            where_data: dict[str, Any] = {JWT_DB_COL_KID: int(token_kid[1:])}
+            where_data: dict[str, Any] = {
+                _JWT_DB[JwtDbParam.COL_KID]: int(token_kid[1:])
+            }
             if account_id:
-                where_data[JWT_DB_COL_ACCOUNT] = account_id
+                where_data[_JWT_DB[JwtDbParam.COL_ACCOUNT]] = account_id
             recs: list[tuple[str]] = db_select(errors=op_errors,
-                                               sel_stmt=f"SELECT {JWT_DB_COL_ALGORITHM}, {JWT_DB_COL_DECODER} "
-                                                        f"FROM {JWT_DB_TABLE}",
+                                               sel_stmt=f"SELECT {_JWT_DB[JwtDbParam.COL_ALGORITHM]}, "
+                                                        f"{_JWT_DB[JwtDbParam.COL_DECODER]} "
+                                                        f"FROM {_JWT_DB[JwtDbParam.TABLE]}",
                                                where_data=where_data,
                                                logger=logger)
             if recs:
@@ -201,8 +201,8 @@ def jwt_validate_token(errors: list[str] | None,
                     logger.error(msg="Token not in the database")
                 op_errors.append("Invalid token")
         else:
-            token_alg = JWT_DEFAULT_ALGORITHM
-            token_decoder = JWT_DECODING_KEY
+            token_alg = _JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM]
+            token_decoder = _JWT_CONFIG[JwtParam.DECODING_KEY]
 
         # validate the token
         if not op_errors:
@@ -282,10 +282,10 @@ def jwt_revoke_token(errors: list[str] | None,
             op_errors.append("Invalid token")
         else:
             db_delete(errors=op_errors,
-                      delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
+                      delete_stmt=f"DELETE FROM {_JWT_DB[JwtDbParam.TABLE]}",
                       where_data={
-                          JWT_DB_COL_KID: int(token_kid[1:]),
-                          JWT_DB_COL_ACCOUNT: account_id
+                          _JWT_DB[JwtDbParam.COL_KID]: int(token_kid[1:]),
+                          _JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id
                       },
                       logger=logger)
     if op_errors:
@@ -456,10 +456,10 @@ def jwt_refresh_tokens(errors: list[str] | None,
             if db_conn:
                 # delete current refresh token
                 db_delete(errors=op_errors,
-                          delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
+                          delete_stmt=f"DELETE FROM {_JWT_DB[JwtDbParam.TABLE]}",
                           where_data={
-                              JWT_DB_COL_KID: int(token_kid[1:]),
-                              JWT_DB_COL_ACCOUNT: account_id
+                              _JWT_DB[JwtDbParam.COL_KID]: int(token_kid[1:]),
+                              _JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id
                           },
                           connection=db_conn,
                           committable=False,

{pypomes_jwt-1.0.8 → pypomes_jwt-1.1.0}/src/pypomes_jwt/jwt_registry.py

@@ -12,11 +12,8 @@ from pypomes_db import (
 from threading import Lock
 from typing import Any
 
-from . import (
-    JWT_DEFAULT_ALGORITHM, JWT_ACCOUNT_LIMIT,
-    JWT_ENCODING_KEY, JWT_DECODING_KEY,
-    JWT_DB_TABLE, JWT_DB_COL_KID, JWT_DB_COL_ACCOUNT,
-    JWT_DB_COL_ALGORITHM, JWT_DB_COL_DECODER, JWT_DB_COL_TOKEN
+from .jwt_constants import (
+    JwtParam, JwtDbParam, _JWT_CONFIG, _JWT_DB
 )
 
 
@@ -144,8 +141,8 @@ class JwtRegistry:
 
         # remove from database
         db_delete(errors=None,
-                  delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
-                  where_data={JWT_DB_COL_ACCOUNT: account_id},
+                  delete_stmt=f"DELETE FROM {_JWT_DB[JwtDbParam.TABLE]}",
+                  where_data={_JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id},
                   logger=logger)
         if logger:
             if account_data:
@@ -219,8 +216,8 @@ class JwtRegistry:
                                                                tz=timezone.utc).isoformat()
         # may raise an exception
         return jwt.encode(payload=current_claims,
-                          key=JWT_ENCODING_KEY,
-                          algorithm=JWT_DEFAULT_ALGORITHM,
+                          key=_JWT_CONFIG[JwtParam.ENCODING_KEY],
+                          algorithm=_JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM],
                           headers={"kid": nature})
 
     def issue_tokens(self,
@@ -280,8 +277,8 @@ class JwtRegistry:
                                                                    tz=timezone.utc).isoformat()
             # may raise an exception
             refresh_token: str = jwt.encode(payload=current_claims,
-                                            key=JWT_ENCODING_KEY,
-                                            algorithm=JWT_DEFAULT_ALGORITHM,
+                                            key=_JWT_CONFIG[JwtParam.ENCODING_KEY],
+                                            algorithm=_JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM],
                                             headers={"kid": "R0"})
 
             # make sure to have a database connection
@@ -296,14 +293,14 @@ class JwtRegistry:
                                                    logger=logger)
                 # issue the definitive refresh token
                 refresh_token = jwt.encode(payload=current_claims,
-                                           key=JWT_ENCODING_KEY,
-                                           algorithm=JWT_DEFAULT_ALGORITHM,
+                                           key=_JWT_CONFIG[JwtParam.ENCODING_KEY],
+                                           algorithm=_JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM],
                                            headers={"kid": f"R{token_id}"})
                 # persist it
                 db_update(errors=errors,
-                          update_stmt=f"UPDATE {JWT_DB_TABLE}",
-                          update_data={JWT_DB_COL_TOKEN: refresh_token},
-                          where_data={JWT_DB_COL_KID: token_id},
+                          update_stmt=f"UPDATE {_JWT_DB[JwtDbParam.TABLE]}",
+                          update_data={_JWT_DB[JwtDbParam.COL_TOKEN]: refresh_token},
+                          where_data={_JWT_DB[JwtDbParam.COL_KID]: token_id},
                           connection=curr_conn,
                           committable=False,
                           logger=logger)
@@ -325,8 +322,8 @@ class JwtRegistry:
             current_claims["exp"] = just_now + account_data.get("access-max-age")
             # may raise an exception
             access_token: str = jwt.encode(payload=current_claims,
-                                           key=JWT_ENCODING_KEY,
-                                           algorithm=JWT_DEFAULT_ALGORITHM,
+                                           key=_JWT_CONFIG[JwtParam.ENCODING_KEY],
+                                           algorithm=_JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM],
                                            headers={"kid": f"A{token_id}"})
             # return the token data
             return {
@@ -384,9 +381,9 @@ def _jwt_persist_token(account_id: str,
     # noinspection PyTypeChecker
     recs: list[tuple[int, str, str, str]] = \
         db_select(errors=errors,
-                  sel_stmt=f"SELECT {JWT_DB_COL_KID}, {JWT_DB_COL_TOKEN} "
-                           f"FROM {JWT_DB_TABLE}",
-                  where_data={JWT_DB_COL_ACCOUNT: account_id},
+                  sel_stmt=f"SELECT {_JWT_DB[JwtDbParam.COL_KID]}, {_JWT_DB[JwtDbParam.COL_TOKEN]} "
+                           f"FROM {_JWT_DB[JwtDbParam.TABLE]}",
+                  where_data={_JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id},
                   connection=db_conn,
                   committable=False,
                   logger=logger)
@@ -427,8 +424,8 @@ def _jwt_persist_token(account_id: str,
     # remove expired tokens from persistence
     if expired:
         db_delete(errors=errors,
-                  delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
-                  where_data={JWT_DB_COL_KID: expired},
+                  delete_stmt=f"DELETE FROM {_JWT_DB[JwtDbParam.TABLE]}",
+                  where_data={_JWT_DB[JwtDbParam.COL_KID]: expired},
                   connection=db_conn,
                   committable=False,
                   logger=logger)
@@ -438,11 +435,11 @@ def _jwt_persist_token(account_id: str,
             logger.debug(msg=f"{len(expired)} tokens of account "
                              f"'{account_id}' removed from storage")
 
-    if 0 < JWT_ACCOUNT_LIMIT <= len(recs) - len(expired):
+    if 0 < _JWT_CONFIG[JwtParam.ACCOUNT_LIMIT] <= len(recs) - len(expired):
         # delete the oldest token to make way for the new one
         db_delete(errors=errors,
-                  delete_stmt=f"DELETE FROM {JWT_DB_TABLE}",
-                  where_data={JWT_DB_COL_KID: oldest_id},
+                  delete_stmt=f"DELETE FROM {_JWT_DB[JwtDbParam.TABLE]}",
+                  where_data={_JWT_DB[JwtDbParam.COL_KID]: oldest_id},
                   connection=db_conn,
                   committable=False,
                   logger=logger)
@@ -453,11 +450,13 @@ def _jwt_persist_token(account_id: str,
                              f"'{account_id}' removed from storage")
     # persist token
     db_insert(errors=errors,
-              insert_stmt=f"INSERT INTO {JWT_DB_TABLE}",
-              insert_data={JWT_DB_COL_ACCOUNT: account_id,
-                           JWT_DB_COL_TOKEN: jwt_token,
-                           JWT_DB_COL_ALGORITHM: JWT_DEFAULT_ALGORITHM,
-                           JWT_DB_COL_DECODER: urlsafe_b64encode(JWT_DECODING_KEY).decode()},
+              insert_stmt=f"INSERT INTO {_JWT_DB[JwtDbParam.TABLE]}",
+              insert_data={
+                  _JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id,
+                  _JWT_DB[JwtDbParam.COL_TOKEN]: jwt_token,
+                  _JWT_DB[JwtDbParam.COL_ALGORITHM]: _JWT_CONFIG[JwtParam.DEFAULT_ALGORITHM],
+                  _JWT_DB[JwtDbParam.COL_DECODER]: urlsafe_b64encode(_JWT_CONFIG[JwtParam.DECODING_KEY]).decode()
+              },
               connection=db_conn,
               committable=False,
               logger=logger)
@@ -468,13 +467,13 @@ def _jwt_persist_token(account_id: str,
     # HAZARD: JWT_DB_COL_TOKEN's column type might prevent it for being used in a WHERE clause
     where_clause: str | None = None
     if existing_ids:
-        where_clause = f"{JWT_DB_COL_KID} NOT IN {existing_ids}"
+        where_clause = f"{_JWT_DB[JwtDbParam.COL_KID]} NOT IN {existing_ids}"
         where_clause = where_clause.replace("[", "(", 1).replace("]", ")", 1)
     reply: list[tuple[int]] = db_select(errors=errors,
-                                        sel_stmt=f"SELECT {JWT_DB_COL_KID} "
-                                                 f"FROM {JWT_DB_TABLE}",
+                                        sel_stmt=f"SELECT {_JWT_DB[JwtDbParam.COL_KID]} "
+                                                 f"FROM {_JWT_DB[JwtDbParam.TABLE]}",
                                         where_clause=where_clause,
-                                        where_data={JWT_DB_COL_ACCOUNT: account_id},
+                                        where_data={_JWT_DB[JwtDbParam.COL_ACCOUNT]: account_id},
                                         require_count=1,
                                         connection=db_conn,
                                         committable=False,

pypomes_jwt-1.0.8/src/pypomes_jwt/__init__.py

@@ -1,33 +0,0 @@
-from .jwt_constants import (
-    JWT_DB_ENGINE, JWT_DB_HOST, JWT_DB_NAME,
-    JWT_DB_PORT, JWT_DB_USER, JWT_DB_PWD,
-    JWT_DB_TABLE, JWT_DB_COL_KID, JWT_DB_COL_ACCOUNT,
-    JWT_DB_COL_ALGORITHM, JWT_DB_COL_DECODER, JWT_DB_COL_TOKEN,
-    JWT_ACCOUNT_LIMIT, JWT_ENCODING_KEY, JWT_DECODING_KEY,
-    JWT_DEFAULT_ALGORITHM, JWT_ACCESS_MAX_AGE, JWT_REFRESH_MAX_AGE
-)
-from .jwt_pomes import (
-    jwt_needed, jwt_verify_request,
-    jwt_assert_account, jwt_set_account, jwt_remove_account,
-    jwt_issue_token, jwt_issue_tokens, jwt_refresh_tokens,
-    jwt_get_claims, jwt_validate_token, jwt_revoke_token
-)
-
-__all__ = [
-    # jwt_constants
-    "JWT_DB_ENGINE", "JWT_DB_HOST", "JWT_DB_NAME",
-    "JWT_DB_PORT", "JWT_DB_USER", "JWT_DB_PWD",
-    "JWT_DB_TABLE", "JWT_DB_COL_KID", "JWT_DB_COL_ACCOUNT",
-    "JWT_DB_COL_ALGORITHM", "JWT_DB_COL_DECODER", "JWT_DB_COL_TOKEN",
-    "JWT_ACCOUNT_LIMIT", "JWT_ENCODING_KEY", "JWT_DECODING_KEY",
-    "JWT_DEFAULT_ALGORITHM", "JWT_ACCESS_MAX_AGE", "JWT_REFRESH_MAX_AGE",
-    # jwt_pomes
-    "jwt_needed", "jwt_verify_request",
-    "jwt_assert_account", "jwt_set_account", "jwt_remove_account",
-    "jwt_issue_token", "jwt_issue_tokens", "jwt_refresh_tokens",
-    "jwt_get_claims", "jwt_validate_token", "jwt_revoke_token"
-]
-
-from importlib.metadata import version
-__version__ = version("pypomes_jwt")
-__version_info__ = tuple(int(i) for i in __version__.split(".") if i.isdigit())

pypomes_jwt-1.0.8/src/pypomes_jwt/jwt_constants.py

@@ -1,71 +0,0 @@
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric import rsa
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPublicKey
-from pypomes_core import (
-    APP_PREFIX,
-    env_get_str, env_get_bytes, env_get_int
-)
-from pypomes_db import DbEngine, db_setup
-from secrets import token_bytes
-from sys import stderr
-from typing import Final
-
-# database specs for token persistence
-JWT_DB_HOST: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_HOST")
-JWT_DB_NAME: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_NAME")
-JWT_DB_PORT: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_DB_PORT")
-JWT_DB_USER: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_USER")
-JWT_DB_PWD: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_PWD")
-JWT_DB_CLIENT: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_CLIENT")  # for Oracle, only
-JWT_DB_DRIVER: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_DRIVER")  # for SQLServer, only
-JWT_DB_TABLE: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_TABLE")
-JWT_DB_COL_ACCOUNT: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_ACCOUNT")
-JWT_DB_COL_ALGORITHM: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_ALGORITHM")
-JWT_DB_COL_DECODER: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_DECODER")
-JWT_DB_COL_KID: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_KID")
-JWT_DB_COL_TOKEN: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DB_COL_TOKEN")
-
-# define and validate the database engine
-JWT_DB_ENGINE: Final[DbEngine] = DbEngine(env_get_str(key=f"{APP_PREFIX}_JWT_DB_ENGINE"))
-if not db_setup(engine=JWT_DB_ENGINE,
-                db_name=JWT_DB_NAME,
-                db_user=JWT_DB_USER,
-                db_pwd=JWT_DB_PWD,
-                db_host=JWT_DB_HOST,
-                db_port=JWT_DB_PORT,
-                db_client=JWT_DB_CLIENT,
-                db_driver=JWT_DB_DRIVER):
-    stderr.write("Invalid database parameters\n")
-
-# one of HS256, HS512, RS256, RS512
-JWT_DEFAULT_ALGORITHM: Final[str] = env_get_str(key=f"{APP_PREFIX}_JWT_DEFAULT_ALGORITHM",
-                                                def_value="RS256")
-# recommended: between 5 min and 1 hour (set to 5 min)
-JWT_ACCESS_MAX_AGE: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_ACCESS_MAX_AGE",
-                                             def_value=300)
-# recommended: at least 2 hours (set to 24 hours)
-JWT_REFRESH_MAX_AGE: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_REFRESH_MAX_AGE",
-                                              def_value=86400)
-JWT_ACCOUNT_LIMIT: Final[int] = env_get_int(key=f"{APP_PREFIX}_JWT_ACCOUNT_LIMIT")
-
-# recommended: allow the encode and decode keys to be generated anew when app starts
-__encoding_key: bytes = env_get_bytes(key=f"{APP_PREFIX}_JWT_ENCODING_KEY",
-                                      encoding="base64url")
-__decoding_key: bytes
-if JWT_DEFAULT_ALGORITHM in ["HS256", "HS512"]:
-    if not __encoding_key:
-        __encoding_key = token_bytes(nbytes=32)
-    __decoding_key = __encoding_key
-else:
-    __decoding_key: bytes = env_get_bytes(key=f"{APP_PREFIX}_JWT_DECODING_KEY")
-    if not __encoding_key or not __decoding_key:
-        __priv_key: RSAPrivateKey = rsa.generate_private_key(public_exponent=65537,
-                                                             key_size=2048)
-        __encoding_key = __priv_key.private_bytes(encoding=serialization.Encoding.PEM,
-                                                  format=serialization.PrivateFormat.PKCS8,
-                                                  encryption_algorithm=serialization.NoEncryption())
-        __pub_key: RSAPublicKey = __priv_key.public_key()
-        __decoding_key = __pub_key.public_bytes(encoding=serialization.Encoding.PEM,
-                                                format=serialization.PublicFormat.SubjectPublicKeyInfo)
-JWT_ENCODING_KEY: Final[bytes] = __encoding_key
-JWT_DECODING_KEY: Final[bytes] = __decoding_key