pypomes-jwt 1.1.8__tar.gz → 1.2.0__tar.gz

{pypomes_jwt-1.1.8 → pypomes_jwt-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 1.1.8
+Version: 1.2.0
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -12,6 +12,6 @@ Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.12
 Requires-Dist: cryptography>=44.0.2
 Requires-Dist: pyjwt>=2.10.1
-Requires-Dist: pypomes-core>=2.0.5
-Requires-Dist: pypomes-db>=2.1.3
+Requires-Dist: pypomes-core>=2.0.6
+Requires-Dist: pypomes-db>=2.1.5
 Requires-Dist: pypomes-logging>=0.6.1

{pypomes_jwt-1.1.8 → pypomes_jwt-1.2.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_jwt"
-version = "1.1.8"
+version = "1.2.0"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]
@@ -21,8 +21,8 @@ classifiers = [
 dependencies = [
     "PyJWT>=2.10.1",
     "cryptography>=44.0.2",
-    "pypomes_core>=2.0.5",
-    "pypomes_db>=2.1.3",
+    "pypomes_core>=2.0.6",
+    "pypomes_db>=2.1.5",
     "pypomes_logging>=0.6.1"
 ]
 

{pypomes_jwt-1.1.8 → pypomes_jwt-1.2.0}/src/pypomes_jwt/jwt_pomes.py

@@ -37,7 +37,9 @@ def jwt_needed(func: callable) -> callable:
 
 def jwt_verify_request(request: Request) -> Response:
     """
-    Verify whether the HTTP *request* has the proper authorization, as per the JWT standard.
+    Verify whether the HTTP *request* has the proper authorization, as per the JWT standard..
+
+    This implementation assumes that HTTP requests are handled with the *Flask* framework.
 
     :param request: the *request* to be verified
     :return: *None* if the *request* is valid, otherwise a *Response* reporting the error
@@ -48,15 +50,19 @@ def jwt_verify_request(request: Request) -> Response:
     # retrieve the authorization from the request header
     auth_header: str = request.headers.get("Authorization")
 
-    # was a 'Bearer' authorization obtained ?
+    # validate the authorization token
     bad_token: bool = True
     if auth_header and auth_header.startswith("Bearer "):
         # yes, extract and validate the JWT access token
         token: str = auth_header.split(" ")[1]
-        if jwt_validate_token(errors=None,
-                              nature="A",
-                              token=token):
-            bad_token = False
+        claims: dict[str, Any] = jwt_validate_token(errors=None,
+                                                    token=token,
+                                                    nature="A")
+        if claims:
+            login: str = request.values.get("login")
+            subject: str = claims["payload"].get("sub")
+            if not login or not subject or login == subject:
+                bad_token = False
 
     # deny the authorization
     if bad_token:
@@ -132,7 +138,7 @@ def jwt_validate_token(errors: list[str] | None,
     """
     Verify if *token* ia a valid JWT token.
 
-    Attempt to validate non locally issued tokens will not succeed. if *nature* is provided,
+    Attempt to validate non locally issued tokens will not succeed. If *nature* is provided,
     validate whether *token* is of that nature. A token issued locally has the header claim *kid*
     starting with *A* (for *Access*) or *R* (for *Refresh*), followed by its id in the token database,
     or as a single letter in the range *[B-Z]*, less *R*. If the *kid* claim contains such an id,

{pypomes_jwt-1.1.8 → pypomes_jwt-1.2.0}/src/pypomes_jwt/jwt_registry.py

@@ -1,7 +1,7 @@
 import jwt
 import string
 import sys
-from base64 import urlsafe_b64encode
+from base64 import b64encode
 from datetime import datetime, timezone
 from logging import Logger
 from pypomes_core import str_random
@@ -184,8 +184,8 @@ class JwtRegistry:
             raise RuntimeError(err_msg)
 
         # obtain the account data in storage (may raise an exception)
-        account_data: dict[str, Any] = self.__get_account_data(account_id=account_id,
-                                                               logger=logger)
+        account_data: dict[str, Any] = self.get_account_data(account_id=account_id,
+                                                             logger=logger)
         # issue the token
         current_claims: dict[str, Any] = {}
         iss: str = account_data["claims"].get("iss")
@@ -240,8 +240,8 @@ class JwtRegistry:
         """
         # process the account data in storage
         with (self.access_lock):
-            account_data: dict[str, Any] = self.__get_account_data(account_id=account_id,
-                                                                   logger=logger)
+            account_data: dict[str, Any] = self.get_account_data(account_id=account_id,
+                                                                 logger=logger)
             current_claims: dict[str, Any] = account_data["claims"].copy()
             if account_claims:
                 current_claims.update(account_claims)
@@ -271,10 +271,10 @@ class JwtRegistry:
                                                    logger=logger)
             if curr_conn:
                 # persist the candidate token (may raise an exception)
-                token_id: int = _jwt_persist_token(account_id=account_id,
-                                                   jwt_token=refresh_token,
-                                                   db_conn=curr_conn,
-                                                   logger=logger)
+                token_id: int = JwtRegistry.jwt_persist_token(account_id=account_id,
+                                                              jwt_token=refresh_token,
+                                                              db_conn=curr_conn,
+                                                              logger=logger)
                 # issue the definitive refresh token
                 refresh_token = jwt.encode(payload=current_claims,
                                            key=JwtConfig.ENCODING_KEY.value,
@@ -318,9 +318,9 @@ class JwtRegistry:
                 "refresh-token": refresh_token
             }
 
-    def __get_account_data(self,
-                           account_id: str,
-                           logger: Logger = PYPOMES_LOGGER) -> dict[str, Any]:
+    def get_account_data(self,
+                         account_id: str,
+                         logger: Logger = PYPOMES_LOGGER) -> dict[str, Any]:
         """
         Retrieve the JWT access data associated with *account_id*.
 
@@ -338,138 +338,138 @@ class JwtRegistry:
 
         return result
 
+    @staticmethod
+    def jwt_persist_token(account_id: str,
+                          jwt_token: str,
+                          db_conn: Any,
+                          logger: Logger = PYPOMES_LOGGER) -> int:
+        """
+        Persist the given token, making sure that the account limit is complied with.
 
-def _jwt_persist_token(account_id: str,
-                       jwt_token: str,
-                       db_conn: Any,
-                       logger: Logger = PYPOMES_LOGGER) -> int:
-    """
-    Persist the given token, making sure that the account limit is complied with.
-
-    The tokens in storage, associated with *account_id*, are examined for their expiration timestamp.
-    If a token's expiration timestamp is in the past, it is removed from storage. If the maximum number
-    of active tokens for *account_id* has been reached, the oldest active one is alse removed,
-    to make room for the new *jwt_token*.
-    The provided database connection *db_conn* indicates that this operation is part of a larger transaction.
-
-    :param account_id: the account identification
-    :param jwt_token: the JWT token to persist
-    :param db_conn: the database connection to use
-    :param logger: optional logger
-    :return: the storage id of the inserted token
-    :raises RuntimeError: error accessing the token database
-    """
-    from .jwt_pomes import jwt_get_claims
-
-    # retrieve the account's tokens
-    errors: list[str] = []
-    # noinspection PyTypeChecker
-    recs: list[tuple[int, str, str, str]] = \
-        db_select(errors=errors,
-                  sel_stmt=f"SELECT {JwtDbConfig.COL_KID}, {JwtDbConfig.COL_TOKEN} "
-                           f"FROM {JwtDbConfig.TABLE}",
-                  where_data={JwtDbConfig.COL_ACCOUNT: account_id},
-                  engine=DbEngine(JwtDbConfig.ENGINE),
-                  connection=db_conn,
-                  committable=False,
-                  logger=logger)
-    if errors:
-        raise RuntimeError("; ".join(errors))
-
-    if logger:
-        logger.debug(msg=f"Read {len(recs)} token from storage for account '{account_id}'")
-    # remove the expired tokens
-    just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
-    oldest_ts: int = sys.maxsize
-    oldest_id: int | None = None
-    existing_ids: list[int] = []
-    expired: list[int] = []
-    for rec in recs:
-        token: str = rec[1]
-        token_id: int = rec[0]
-        token_payload: dict[str, Any] = (jwt_get_claims(errors=errors,
-                                                        token=token,
-                                                        logger=logger) or {}).get("payload")
+        The tokens in storage, associated with *account_id*, are examined for their expiration timestamp.
+        If a token's expiration timestamp is in the past, it is removed from storage. If the maximum number
+        of active tokens for *account_id* has been reached, the oldest active one is alse removed,
+        to make room for the new *jwt_token*.
+        The provided database connection *db_conn* indicates that this operation is part of a larger transaction.
+
+        :param account_id: the account identification
+        :param jwt_token: the JWT token to persist
+        :param db_conn: the database connection to use
+        :param logger: optional logger
+        :return: the storage id of the inserted token
+        :raises RuntimeError: error accessing the token database
+        """
+        from .jwt_pomes import jwt_get_claims
+
+        # retrieve the account's tokens
+        errors: list[str] = []
+        # noinspection PyTypeChecker
+        recs: list[tuple[int, str, str, str]] = \
+            db_select(errors=errors,
+                      sel_stmt=f"SELECT {JwtDbConfig.COL_KID}, {JwtDbConfig.COL_TOKEN} "
+                               f"FROM {JwtDbConfig.TABLE}",
+                      where_data={JwtDbConfig.COL_ACCOUNT: account_id},
+                      engine=DbEngine(JwtDbConfig.ENGINE),
+                      connection=db_conn,
+                      committable=False,
+                      logger=logger)
         if errors:
             raise RuntimeError("; ".join(errors))
 
-        # find expired tokens
-        exp: int = token_payload.get("exp", sys.maxsize)
-        if exp < just_now:
-            expired.append(token_id)
-
-        # find oldest token
-        iat: int = token_payload.get("iat", sys.maxsize)
-        if iat < oldest_ts:
-            oldest_ts = iat
-            oldest_id = token_id
-
-        # save token id
-        existing_ids.append(token_id)
-
-    # remove expired tokens from persistence
-    if expired:
-        db_delete(errors=errors,
-                  delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
-                  where_data={JwtDbConfig.COL_KID: expired},
+        if logger:
+            logger.debug(msg=f"Read {len(recs)} token from storage for account '{account_id}'")
+        # remove the expired tokens
+        just_now: int = int(datetime.now(tz=timezone.utc).timestamp())
+        oldest_ts: int = sys.maxsize
+        oldest_id: int | None = None
+        existing_ids: list[int] = []
+        expired: list[int] = []
+        for rec in recs:
+            token: str = rec[1]
+            token_id: int = rec[0]
+            token_payload: dict[str, Any] = (jwt_get_claims(errors=errors,
+                                                            token=token,
+                                                            logger=logger) or {}).get("payload")
+            if errors:
+                raise RuntimeError("; ".join(errors))
+
+            # find expired tokens
+            exp: int = token_payload.get("exp", sys.maxsize)
+            if exp < just_now:
+                expired.append(token_id)
+
+            # find oldest token
+            iat: int = token_payload.get("iat", sys.maxsize)
+            if iat < oldest_ts:
+                oldest_ts = iat
+                oldest_id = token_id
+
+            # save token id
+            existing_ids.append(token_id)
+
+        # remove expired tokens from persistence
+        if expired:
+            db_delete(errors=errors,
+                      delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
+                      where_data={JwtDbConfig.COL_KID: expired},
+                      engine=DbEngine(JwtDbConfig.ENGINE),
+                      connection=db_conn,
+                      committable=False,
+                      logger=logger)
+            if errors:
+                raise RuntimeError("; ".join(errors))
+            if logger:
+                logger.debug(msg=f"{len(expired)} tokens of account "
+                                 f"'{account_id}' removed from storage")
+
+        if 0 < JwtConfig.ACCOUNT_LIMIT.value <= len(recs) - len(expired):
+            # delete the oldest token to make way for the new one
+            db_delete(errors=errors,
+                      delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
+                      where_data={JwtDbConfig.COL_KID: oldest_id},
+                      engine=DbEngine(JwtDbConfig.ENGINE),
+                      connection=db_conn,
+                      committable=False,
+                      logger=logger)
+            if errors:
+                raise RuntimeError("; ".join(errors))
+            if logger:
+                logger.debug(msg="Oldest active token of account "
+                                 f"'{account_id}' removed from storage")
+        # persist token
+        db_insert(errors=errors,
+                  insert_stmt=f"INSERT INTO {JwtDbConfig.TABLE}",
+                  insert_data={
+                      JwtDbConfig.COL_ACCOUNT: account_id,
+                      JwtDbConfig.COL_TOKEN: jwt_token,
+                      JwtDbConfig.COL_ALGORITHM: JwtConfig.DEFAULT_ALGORITHM.value,
+                      JwtDbConfig.COL_DECODER: b64encode(s=JwtConfig.DECODING_KEY.value).decode()
+                  },
                   engine=DbEngine(JwtDbConfig.ENGINE),
                   connection=db_conn,
                   committable=False,
                   logger=logger)
         if errors:
             raise RuntimeError("; ".join(errors))
-        if logger:
-            logger.debug(msg=f"{len(expired)} tokens of account "
-                             f"'{account_id}' removed from storage")
-
-    if 0 < JwtConfig.ACCOUNT_LIMIT.value <= len(recs) - len(expired):
-        # delete the oldest token to make way for the new one
-        db_delete(errors=errors,
-                  delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
-                  where_data={JwtDbConfig.COL_KID: oldest_id},
-                  engine=DbEngine(JwtDbConfig.ENGINE),
-                  connection=db_conn,
-                  committable=False,
-                  logger=logger)
+
+        # obtain and return the token's storage id
+        # HAZARD: JWT_DB_COL_TOKEN's column type might prevent it for being used in a WHERE clause
+        where_clause: str | None = None
+        if existing_ids:
+            where_clause = f"{JwtDbConfig.COL_KID} NOT IN {existing_ids}"
+            where_clause = where_clause.replace("[", "(", 1).replace("]", ")", 1)
+        reply: list[tuple[int]] = db_select(errors=errors,
+                                            sel_stmt=f"SELECT {JwtDbConfig.COL_KID} "
+                                                     f"FROM {JwtDbConfig.TABLE}",
+                                            where_clause=where_clause,
+                                            where_data={JwtDbConfig.COL_ACCOUNT: account_id},
+                                            min_count=1,
+                                            max_count=1,
+                                            engine=DbEngine(JwtDbConfig.ENGINE),
+                                            connection=db_conn,
+                                            committable=False,
+                                            logger=logger)
         if errors:
             raise RuntimeError("; ".join(errors))
-        if logger:
-            logger.debug(msg="Oldest active token of account "
-                             f"'{account_id}' removed from storage")
-    # persist token
-    db_insert(errors=errors,
-              insert_stmt=f"INSERT INTO {JwtDbConfig.TABLE}",
-              insert_data={
-                  JwtDbConfig.COL_ACCOUNT: account_id,
-                  JwtDbConfig.COL_TOKEN: jwt_token,
-                  JwtDbConfig.COL_ALGORITHM: JwtConfig.DEFAULT_ALGORITHM.value,
-                  JwtDbConfig.COL_DECODER: urlsafe_b64encode(s=JwtConfig.DECODING_KEY.value).decode()
-              },
-              engine=DbEngine(JwtDbConfig.ENGINE),
-              connection=db_conn,
-              committable=False,
-              logger=logger)
-    if errors:
-        raise RuntimeError("; ".join(errors))
-
-    # obtain and return the token's storage id
-    # HAZARD: JWT_DB_COL_TOKEN's column type might prevent it for being used in a WHERE clause
-    where_clause: str | None = None
-    if existing_ids:
-        where_clause = f"{JwtDbConfig.COL_KID} NOT IN {existing_ids}"
-        where_clause = where_clause.replace("[", "(", 1).replace("]", ")", 1)
-    reply: list[tuple[int]] = db_select(errors=errors,
-                                        sel_stmt=f"SELECT {JwtDbConfig.COL_KID} "
-                                                 f"FROM {JwtDbConfig.TABLE}",
-                                        where_clause=where_clause,
-                                        where_data={JwtDbConfig.COL_ACCOUNT: account_id},
-                                        min_count=1,
-                                        max_count=1,
-                                        engine=DbEngine(JwtDbConfig.ENGINE),
-                                        connection=db_conn,
-                                        committable=False,
-                                        logger=logger)
-    if errors:
-        raise RuntimeError("; ".join(errors))
-
-    return reply[0][0]
+
+        return reply[0][0]