pypomes-jwt 1.1.5__tar.gz → 1.1.7__tar.gz

{pypomes_jwt-1.1.5 → pypomes_jwt-1.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 1.1.5
+Version: 1.1.7
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -12,5 +12,5 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Requires-Dist: cryptography>=44.0.2
 Requires-Dist: pyjwt>=2.10.1
-Requires-Dist: pypomes-core>=2.0.4
+Requires-Dist: pypomes-core>=2.0.5
 Requires-Dist: pypomes-db>=2.1.1

{pypomes_jwt-1.1.5 → pypomes_jwt-1.1.7}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_jwt"
-version = "1.1.5"
+version = "1.1.7"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]
@@ -21,7 +21,7 @@ classifiers = [
 dependencies = [
     "PyJWT>=2.10.1",
     "cryptography>=44.0.2",
-    "pypomes_core>=2.0.4",
+    "pypomes_core>=2.0.5",
     "pypomes_db>=2.1.1"
 ]
 

{pypomes_jwt-1.1.5 → pypomes_jwt-1.1.7}/src/pypomes_jwt/jwt_pomes.py

@@ -38,6 +38,8 @@ def jwt_verify_request(request: Request) -> Response:
     """
     Verify whether the HTTP *request* has the proper authorization, as per the JWT standard.
 
+    This implementation assumes that HTTP requests are handled with the *Flask* framework.
+
     :param request: the *request* to be verified
     :return: *None* if the *request* is valid, otherwise a *Response* reporting the error
     """
@@ -47,15 +49,19 @@ def jwt_verify_request(request: Request) -> Response:
     # retrieve the authorization from the request header
     auth_header: str = request.headers.get("Authorization")
 
-    # was a 'Bearer' authorization obtained ?
+    # validate the authorization token
     bad_token: bool = True
     if auth_header and auth_header.startswith("Bearer "):
         # yes, extract and validate the JWT access token
         token: str = auth_header.split(" ")[1]
-        if jwt_validate_token(errors=None,
-                              nature="A",
-                              token=token):
-            bad_token = False
+        claims: dict[str, Any] = jwt_validate_token(errors=None,
+                                                    token=token,
+                                                    nature="A")
+        if claims:
+            login: str = request.values.get("login")
+            subject: str = claims["payload"].get("sub")
+            if not login or not subject or login == subject:
+                bad_token = False
 
     # deny the authorization
     if bad_token:
@@ -78,7 +84,7 @@ def jwt_set_account(account_id: str,
                     claims: dict[str, Any],
                     access_max_age: int = JwtConfig.ACCESS_MAX_AGE.value,
                     refresh_max_age: int = JwtConfig.REFRESH_MAX_AGE.value,
-                    grace_interval: int = None,
+                    lead_interval: int = None,
                     logger: Logger = None) -> None:
     """
     Establish the data needed to obtain JWT tokens for *account_id*.
@@ -92,7 +98,7 @@ def jwt_set_account(account_id: str,
     :param claims: the JWT claimset, as key-value pairs
     :param access_max_age: access token duration, in seconds
     :param refresh_max_age: refresh token duration, in seconds
-    :param grace_interval: optional time to wait for token to be valid, in seconds
+    :param lead_interval: optional time to wait for token to be valid, in seconds
     :param logger: optional logger
     """
     if logger:
@@ -103,7 +109,7 @@ def jwt_set_account(account_id: str,
                                claims=claims,
                                access_max_age=access_max_age,
                                refresh_max_age=max(refresh_max_age, access_max_age + 300),
-                               grace_interval=grace_interval,
+                               lead_interval=lead_interval,
                                logger=logger)
 
 
@@ -302,7 +308,7 @@ def jwt_issue_token(errors: list[str] | None,
                     account_id: str,
                     nature: str,
                     duration: int,
-                    grace_interval: int = None,
+                    lead_interval: int = None,
                     claims: dict[str, Any] = None,
                     logger: Logger = None) -> str:
     """
@@ -318,7 +324,7 @@ def jwt_issue_token(errors: list[str] | None,
     :param nature: the token's nature, must be a single letter in the range *[B-Z]*, less *R*
     :param duration: the number of seconds for the token to remain valid (at least 60 seconds)
     :param claims: optional token's claims
-    :param grace_interval: optional interval for the token to become active (in seconds)
+    :param lead_interval: optional interval for the token to become active (in seconds)
     :param logger: optional logger
     :return: the JWT token data, or *None* if error
     """
@@ -334,7 +340,7 @@ def jwt_issue_token(errors: list[str] | None,
                                             nature=nature,
                                             duration=duration,
                                             claims=claims,
-                                            grace_interval=grace_interval,
+                                            lead_interval=lead_interval,
                                             logger=logger)
         if logger:
             logger.debug(msg=f"Token is '{result}'")

{pypomes_jwt-1.1.5 → pypomes_jwt-1.1.7}/src/pypomes_jwt/jwt_registry.py

@@ -26,7 +26,7 @@ class JwtRegistry:
          <account-id>: {
            "access-max-age": <int>,         # defaults to JWT_ACCESS_MAX_AGE (in seconds)
            "refresh-max-age": <int>,        # defaults to JWT_REFRESH_MAX_AGE (in seconds)
-           "grace-interval": <int>,         # time to wait for token to be valid, in seconds
+           "lead-interval": <int>,          # time to wait for token to be valid, in seconds
            "claims": {
              "iss": <string>,               # token'ss issuer
              "birthdate": <string>,         # subject's birth date
@@ -35,9 +35,6 @@ class JwtRegistry:
              "name": <string>,              # subject's name
              "roles": <List[str]>,          # subject roles
              "nonce": <string>,             # used to associate a Client session with a token
-             # output, only
-             "valid-from": <string>,        # token's start (<YYYY-MM-DDThh:mm:ss+00:00>)
-             "valid-until": <string>,       # token's finish (<YYYY-MM-DDThh:mm:ss+00:00>)
              ...
            }
          },
@@ -63,8 +60,6 @@ class JwtRegistry:
 
     Account-related claims are optional claims, and convey information about the registered account they belong to.
     Alhough they can be freely specified, these are some of the most commonly used claims:
-       "valid-from": <string>   token's start (<YYYY-MM-DDThh:mm:ss+00:00>)
-       "valid-until": <string>  token's finish (<YYYY-MM-DDThh:mm:ss+00.00>)
        "birthdate": <string>    subject's birth date
        "email": <string>        subject's email
        "gender": <string>       subject's gender
@@ -92,7 +87,7 @@ class JwtRegistry:
                     claims: dict[str, Any],
                     access_max_age: int,
                     refresh_max_age: int,
-                    grace_interval: int | None,
+                    lead_interval: int | None,
                     logger: Logger = None) -> None:
         """
         Add to storage the parameters needed to produce and validate JWT tokens for *account_id*.
@@ -105,7 +100,7 @@ class JwtRegistry:
         :param claims: the JWT claimset, as key-value pairs
         :param access_max_age: access token duration, in seconds (at least 60 seconds)
         :param refresh_max_age: refresh token duration, in seconds (greater than *access_max_age*)
-        :param grace_interval: time to wait for token to be valid, in seconds
+        :param lead_interval: time to wait for token to be valid, in seconds
         :param logger: optional logger
         """
         # build and store the access data for the account
@@ -114,7 +109,7 @@ class JwtRegistry:
                 self.access_registry[account_id] = {
                     "access-max-age": access_max_age,
                     "refresh-max-age": refresh_max_age,
-                    "grace-interval": grace_interval,
+                    "lead-interval": lead_interval,
                     "claims": claims or {}
                 }
                 if logger:
@@ -155,7 +150,7 @@ class JwtRegistry:
                     account_id: str,
                     nature: str,
                     duration: int,
-                    grace_interval: int = None,
+                    lead_interval: int = None,
                     claims: dict[str, Any] = None,
                     logger: Logger = None) -> str:
         """
@@ -170,7 +165,7 @@ class JwtRegistry:
         :param nature: the token's nature, must be a single letter in the range *[B-Z]*, less *R*
         :param duration: the number of seconds for the token to remain valid (at least 60 seconds)
         :param claims: optional token's claims
-        :param grace_interval: optional interval for the token to become active (in seconds)
+        :param lead_interval: optional interval for the token to become active (in seconds)
         :param logger: optional logger
         :return: the JWT token
         :raises RuntimeError: invalid parameter
@@ -203,8 +198,8 @@ class JwtRegistry:
         current_claims["sub"] = account_id
         just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
         current_claims["iat"] = just_now
-        if grace_interval:
-            current_claims["nbf"] = just_now + grace_interval
+        if lead_interval:
+            current_claims["nbf"] = just_now + lead_interval
         current_claims["exp"] = just_now + duration
 
         # may raise an exception
@@ -256,9 +251,9 @@ class JwtRegistry:
 
             just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
             current_claims["iat"] = just_now
-            grace_interval = account_data.get("grace-interval")
-            if grace_interval:
-                current_claims["nbf"] = just_now + grace_interval
+            lead_interval = account_data.get("lead-interval")
+            if lead_interval:
+                current_claims["nbf"] = just_now + lead_interval
 
             # issue a candidate refresh token first, and persist it
             current_claims["exp"] = just_now + account_data.get("refresh-max-age")