pypomes-jwt 1.2.8__tar.gz → 1.3.0__tar.gz

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pypomes_jwt
-Version: 1.2.8
+Version: 1.3.0
 Summary: A collection of Python pomes, penyeach (JWT module)
 Project-URL: Homepage, https://github.com/TheWiseCoder/PyPomes-JWT
 Project-URL: Bug Tracker, https://github.com/TheWiseCoder/PyPomes-JWT/issues
@@ -14,4 +14,4 @@ Requires-Dist: cryptography>=45.0.6
 Requires-Dist: flask>=3.1.2
 Requires-Dist: pyjwt>=2.10.1
 Requires-Dist: pypomes-core>=2.7.0
-Requires-Dist: pypomes-db>=2.5.8
+Requires-Dist: pypomes-db>=2.5.9

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pypomes_jwt"
-version = "1.2.8"
+version = "1.3.0"
 authors = [
   { name="GT Nunes", email="wisecoder01@gmail.com" }
 ]
@@ -23,7 +23,7 @@ dependencies = [
     "Flask>=3.1.2",
     "PyJWT>=2.10.1",
     "pypomes_core>=2.7.0",
-    "pypomes_db>=2.5.8"
+    "pypomes_db>=2.5.9"
 ]
 
 [project.urls]

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/src/pypomes_jwt/jwt_config.py

@@ -52,14 +52,19 @@ class JwtConfig(Enum):
                                       def_value=300)
     ACCOUNT_LIMIT: int = env_get_int(key=f"{APP_PREFIX}_JWT_ACCOUNT_LIMIT",
                                      def_value=5)
+    DEFAULT_ALGORITHM: _default_algorithm
     ENCODING_KEY: bytes = _encoding_key
     DECODING_KEY: bytes = _decoding_key
-    DEFAULT_ALGORITHM: str = _default_algorithm
     # recommended: at least 2 hours (set to 24 hours)
     REFRESH_MAX_AGE: int = env_get_int(key=f"{APP_PREFIX}_JWT_REFRESH_MAX_AGE",
                                        def_value=86400)
 
 
+del _decoding_key
+del _encoding_key
+del _default_algorithm
+
+
 class JwtDbConfig(StrEnum):
     """
     Parameters for JWT database connection.

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/src/pypomes_jwt/jwt_pomes.py

@@ -158,7 +158,10 @@ def jwt_validate_token(token: str,
 
     if logger:
         logger.debug(msg="Validate JWT token")
-    op_errors: list[str] = []
+
+    # make sure to have an errors list
+    if not isinstance(errors, list):
+        errors = []
 
     # extract needed data from token header
     token_header: dict[str, Any] | None = None
@@ -169,9 +172,9 @@ def jwt_validate_token(token: str,
                                   exc_info=sys.exc_info())
         if logger:
             logger.error(msg=f"Error retrieving the token's header: {exc_err}")
-        op_errors.append(exc_err)
+        errors.append(exc_err)
 
-    if not op_errors:
+    if not errors:
         token_kid: str = token_header.get("kid")
         token_alg: str | None = None
         token_decoder: bytes | None = None
@@ -180,7 +183,7 @@ def jwt_validate_token(token: str,
         if nature and not (token_kid and token_kid[0:1] == nature):
             if logger:
                 logger.error(f"Nature of token's 'kid' ('{token_kid}') not '{nature}'")
-            op_errors.append("Invalid token")
+            errors.append("Invalid token")
         elif token_kid and len(token_kid) > 1 and \
                 token_kid[0:1] in ["A", "R"] and token_kid[1:].isdigit():
             # token was likely issued locally
@@ -192,24 +195,24 @@ def jwt_validate_token(token: str,
                                                         f"FROM {JwtDbConfig.TABLE}",
                                                where_data=where_data,
                                                engine=DbEngine(JwtDbConfig.ENGINE),
-                                               errors=op_errors,
+                                               errors=errors,
                                                logger=logger)
             if recs:
                 token_alg = recs[0][0]
                 token_decoder = b64decode(recs[0][1])
-            elif op_errors:
+            elif errors:
                 if logger:
-                    logger.error(msg=f"Error retrieving the token's decoder: {'; '.join(op_errors)}")
+                    logger.error(msg=f"Error retrieving the token's decoder: {'; '.join(errors)}")
             else:
                 if logger:
                     logger.error(msg="Token not in the database")
-                op_errors.append("Invalid token")
+                errors.append("Invalid token")
         else:
             token_alg = JwtConfig.DEFAULT_ALGORITHM.value
             token_decoder = JwtConfig.DECODING_KEY.value
 
         # validate the token
-        if not op_errors:
+        if not errors:
             try:
                 # raises:
                 #   InvalidTokenError: token is invalid
@@ -232,7 +235,7 @@ def jwt_validate_token(token: str,
                 if account_id and payload.get("sub") != account_id:
                     if logger:
                         logger.error(msg=f"Token does not belong to account '{account_id}'")
-                    op_errors.append("Invalid token")
+                    errors.append("Invalid token")
                 else:
                     result = {
                         "header": token_header,
@@ -243,12 +246,9 @@ def jwt_validate_token(token: str,
                                           exc_info=sys.exc_info())
                 if logger:
                     logger.error(msg=f"Error decoding the token: {exc_err}")
-                op_errors.append(exc_err)
+                errors.append(exc_err)
 
-    if op_errors:
-        if isinstance(errors, list):
-            errors.extend(op_errors)
-    elif logger:
+    if not errors and logger:
         logger.debug(msg="Token is valid")
 
     return result
@@ -275,15 +275,18 @@ def jwt_revoke_token(account_id: str,
     if logger:
         logger.debug(msg=f"Revoking token of account '{account_id}'")
 
-    op_errors: list[str] = []
+    # make sure to have an errors list
+    if not isinstance(errors, list):
+        errors = []
+
     token_claims: dict[str, Any] = jwt_validate_token(token=token,
                                                       account_id=account_id,
-                                                      errors=op_errors,
+                                                      errors=errors,
                                                       logger=logger)
-    if not op_errors:
+    if not errors:
         token_kid: str = token_claims["header"].get("kid")
         if token_kid[0:1] not in ["A", "R"]:
-            op_errors.append("Invalid token")
+            errors.append("Invalid token")
         else:
             db_delete(delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
                       where_data={
@@ -291,15 +294,12 @@ def jwt_revoke_token(account_id: str,
                           JwtDbConfig.COL_ACCOUNT: account_id
                       },
                       engine=DbEngine(JwtDbConfig.ENGINE),
-                      errors=op_errors,
+                      errors=errors,
                       logger=logger)
-    if op_errors:
-        if logger:
-            logger.error(msg="; ".join(op_errors))
-        if isinstance(errors, list):
-            errors.extend(op_errors)
-    else:
+    if not errors:
         result = True
+    elif logger:
+        logger.error(msg="; ".join(errors))
 
     return result
 
@@ -333,7 +333,6 @@ def jwt_issue_token(account_id: str,
 
     if logger:
         logger.debug(msg=f"Issuing a JWT token for '{account_id}'")
-    op_errors: list[str] = []
 
     try:
         result = __jwt_registry.issue_token(account_id=account_id,
@@ -350,10 +349,8 @@ def jwt_issue_token(account_id: str,
                                   exc_info=sys.exc_info())
         if logger:
             logger.error(msg=f"Error issuing the token: {exc_err}")
-        op_errors.append(exc_err)
-
-    if op_errors and isinstance(errors, list):
-        errors.extend(op_errors)
+        if isinstance(errors, list):
+            errors.append(exc_err)
 
     return result
 
@@ -387,7 +384,6 @@ def jwt_issue_tokens(account_id: str,
 
     if logger:
         logger.debug(msg=f"Issuing a JWT token pair for '{account_id}'")
-    op_errors: list[str] = []
 
     try:
         result = __jwt_registry.issue_tokens(account_id=account_id,
@@ -401,13 +397,8 @@ def jwt_issue_tokens(account_id: str,
                                   exc_info=sys.exc_info())
         if logger:
             logger.error(msg=f"Error issuing the token pair: {exc_err}")
-        op_errors.append(exc_err)
-
-    if op_errors:
-        if logger:
-            logger.error("; ".join(op_errors))
         if isinstance(errors, list):
-            errors.extend(op_errors)
+            errors.append(exc_err)
 
     return result
 
@@ -440,7 +431,10 @@ def jwt_refresh_tokens(account_id: str,
 
     if logger:
         logger.debug(msg=f"Refreshing a JWT token pair for '{account_id}'")
-    op_errors: list[str] = []
+
+    # make sure to have an errors list
+    if not isinstance(errors, list):
+        errors = []
 
     # assert the refresh token
     if refresh_token:
@@ -448,7 +442,7 @@ def jwt_refresh_tokens(account_id: str,
         token_claims: dict[str, Any] = jwt_validate_token(token=refresh_token,
                                                           nature="R",
                                                           account_id=account_id,
-                                                          errors=op_errors,
+                                                          errors=errors,
                                                           logger=logger)
         if token_claims:
             # yes, proceed
@@ -457,7 +451,7 @@ def jwt_refresh_tokens(account_id: str,
             # start the database transaction
             db_conn: Any = db_connect(autocommit=False,
                                       engine=DbEngine(JwtDbConfig.ENGINE),
-                                      errors=op_errors,
+                                      errors=errors,
                                       logger=logger)
             if db_conn:
                 # delete current refresh token
@@ -469,11 +463,11 @@ def jwt_refresh_tokens(account_id: str,
                           engine=DbEngine(JwtDbConfig.ENGINE),
                           connection=db_conn,
                           committable=False,
-                          errors=op_errors,
+                          errors=errors,
                           logger=logger)
 
                 # issue the token pair
-                if not op_errors:
+                if not errors:
                     try:
                         result = __jwt_registry.issue_tokens(account_id=account_id,
                                                              account_claims=token_claims.get("payload"),
@@ -487,27 +481,24 @@ def jwt_refresh_tokens(account_id: str,
                                                   exc_info=sys.exc_info())
                         if logger:
                             logger.error(msg=f"Error refreshing the token pair: {exc_err}")
-                        op_errors.append(exc_err)
+                        errors.append(exc_err)
 
                 # wrap-up the transaction
-                if op_errors:
+                if errors:
                     db_rollback(connection=db_conn,
                                 logger=logger)
                 else:
                     db_commit(connection=db_conn,
-                              errors=op_errors,
+                              errors=errors,
                               logger=logger)
                 db_close(connection=db_conn,
                          logger=logger)
     else:
         # refresh token not found
-        op_errors.append("Refresh token was not provided")
+        errors.append("Refresh token was not provided")
 
-    if op_errors:
-        if logger:
-            logger.error("; ".join(op_errors))
-        if isinstance(errors, list):
-            errors.extend(op_errors)
+    if errors and logger:
+        logger.error(msg="; ".join(errors))
 
     return result
 

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/src/pypomes_jwt/jwt_providers.py

@@ -62,14 +62,14 @@ def provider_register(provider_id: str,
     }
 
 
-def provider_get_token(errors: list[str] | None,
-                       provider_id: str,
+def provider_get_token(provider_id: str,
+                       errors: list[str] | None,
                        logger: Logger = None) -> str | None:
     """
     Obtain an authentication token from the external provider *provider_id*.
 
-    :param errors: incidental error messages
     :param provider_id: the provider's identification
+    :param errors: incidental error messages
     :param logger: optional logger
     """
     # initialize the return variable

{pypomes_jwt-1.2.8 → pypomes_jwt-1.3.0}/src/pypomes_jwt/jwt_registry.py

@@ -6,7 +6,7 @@ from datetime import datetime, UTC
 from logging import Logger
 from pypomes_core import str_random
 from pypomes_db import (
-    DbEngine, db_connect, db_commit, db_rollback,
+    DbEngine, db_connect, db_commit, db_rollback, db_close,
     db_select, db_insert, db_update, db_delete
 )
 from threading import Lock
@@ -296,6 +296,8 @@ class JwtRegistry:
                         db_commit(connection=curr_conn,
                                   errors=errors,
                                   logger=logger)
+                    db_close(connection=curr_conn)
+
             if errors:
                 raise RuntimeError("; ".join(errors))
 
@@ -359,102 +361,100 @@ class JwtRegistry:
         """
         from .jwt_pomes import jwt_get_claims
 
-        # retrieve the account's tokens
-        errors: list[str] = []
-        # noinspection PyTypeChecker
-        recs: list[tuple[int, str, str, str]] = \
-            db_select(sel_stmt=f"SELECT {JwtDbConfig.COL_KID}, {JwtDbConfig.COL_TOKEN} "
-                               f"FROM {JwtDbConfig.TABLE}",
-                      where_data={JwtDbConfig.COL_ACCOUNT: account_id},
-                      engine=DbEngine(JwtDbConfig.ENGINE),
-                      connection=db_conn,
-                      errors=errors,
-                      logger=logger)
-        if errors:
-            raise RuntimeError("; ".join(errors))
+        # initialize the return variable
+        result: int | None = None
 
-        if logger:
-            logger.debug(msg=f"Retrieved {len(recs)} tokens from storage for account '{account_id}'")
-        # remove the expired tokens
-        just_now: int = int(datetime.now(tz=UTC).timestamp())
-        oldest_ts: int = sys.maxsize
-        oldest_id: int | None = None
-        expired: list[int] = []
-        for rec in recs:
-            token: str = rec[1]
-            token_id: int = rec[0]
-            token_payload: dict[str, Any] = (jwt_get_claims(token=token,
-                                                            errors=errors,
-                                                            logger=logger) or {}).get("payload")
-            if errors:
-                raise RuntimeError("; ".join(errors))
-
-            # find expired tokens
-            exp: int = token_payload.get("exp", sys.maxsize)
-            if exp < just_now:
-                expired.append(token_id)
-
-            # find oldest token
-            iat: int = token_payload.get("iat", sys.maxsize)
-            if iat < oldest_ts:
-                oldest_ts = iat
-                oldest_id = token_id
-
-        # remove expired tokens from persistence
-        if expired:
-            db_delete(delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
-                      where_data={JwtDbConfig.COL_KID: expired},
-                      engine=DbEngine(JwtDbConfig.ENGINE),
-                      connection=db_conn,
-                      errors=errors,
-                      logger=logger)
-            if errors:
-                raise RuntimeError("; ".join(errors))
-            if logger:
-                logger.debug(msg=f"{len(expired)} tokens of account "
-                                 f"'{account_id}' removed from storage")
-
-        if 0 < JwtConfig.ACCOUNT_LIMIT.value <= len(recs) - len(expired):
-            # delete the oldest token to make way for the new one
-            db_delete(delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
-                      where_data={JwtDbConfig.COL_KID: oldest_id},
-                      engine=DbEngine(JwtDbConfig.ENGINE),
-                      connection=db_conn,
-                      errors=errors,
-                      logger=logger)
+        # make sure to have a database connection
+        errors: list[str] = []
+        curr_conn: Any = db_conn or db_connect(autocommit=False,
+                                               engine=DbEngine(JwtDbConfig.ENGINE),
+                                               errors=errors,
+                                               logger=logger)
+        if not errors:
+
+            # retrieve the account's tokens
+            # noinspection PyTypeChecker
+            recs: list[tuple[int, str, str, str]] = \
+                db_select(sel_stmt=f"SELECT {JwtDbConfig.COL_KID}, {JwtDbConfig.COL_TOKEN} "
+                                   f"FROM {JwtDbConfig.TABLE}",
+                          where_data={JwtDbConfig.COL_ACCOUNT: account_id},
+                          engine=DbEngine(JwtDbConfig.ENGINE),
+                          connection=curr_conn,
+                          errors=errors,
+                          logger=logger)
+            if not errors:
+                if logger:
+                    logger.debug(msg=f"Retrieved {len(recs)} tokens from storage for account '{account_id}'")
+                # remove the expired tokens
+                just_now: int = int(datetime.now(tz=UTC).timestamp())
+                oldest_ts: int = sys.maxsize
+                oldest_id: int | None = None
+                expired: list[int] = []
+                for rec in recs:
+                    token: str = rec[1]
+                    token_id: int = rec[0]
+                    token_payload: dict[str, Any] = (jwt_get_claims(token=token,
+                                                                    errors=errors,
+                                                                    logger=logger) or {}).get("payload")
+                    if errors:
+                        break
+                    # find expired tokens
+                    exp: int = token_payload.get("exp", sys.maxsize)
+                    if exp < just_now:
+                        expired.append(token_id)
+
+                    # find oldest token
+                    iat: int = token_payload.get("iat", sys.maxsize)
+                    if iat < oldest_ts:
+                        oldest_ts = iat
+                        oldest_id = token_id
+
+                # remove expired tokens from persistence
+                if not errors and expired:
+                    db_delete(delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
+                              where_data={JwtDbConfig.COL_KID: expired},
+                              engine=DbEngine(JwtDbConfig.ENGINE),
+                              connection=curr_conn,
+                              errors=errors,
+                              logger=logger)
+                    if not errors and logger:
+                        logger.debug(msg=f"{len(expired)} tokens of account "
+                                         f"'{account_id}' removed from storage")
+
+                if not errors and 0 < JwtConfig.ACCOUNT_LIMIT.value <= len(recs) - len(expired):
+                    # delete the oldest token to make way for the new one
+                    db_delete(delete_stmt=f"DELETE FROM {JwtDbConfig.TABLE}",
+                              where_data={JwtDbConfig.COL_KID: oldest_id},
+                              engine=DbEngine(JwtDbConfig.ENGINE),
+                              connection=curr_conn,
+                              errors=errors,
+                              logger=logger)
+                    if not errors and logger:
+                        logger.debug(msg="Oldest active token of account "
+                                         f"'{account_id}' removed from storage")
+                # persist token
+                if not errors:
+                    result = db_insert(insert_stmt=f"INSERT INTO {JwtDbConfig.TABLE}",
+                                       insert_data={
+                                           JwtDbConfig.COL_ACCOUNT: account_id,
+                                           JwtDbConfig.COL_TOKEN: jwt_token,
+                                           JwtDbConfig.COL_ALGORITHM: JwtConfig.DEFAULT_ALGORITHM.value,
+                                           JwtDbConfig.COL_DECODER: b64encode(s=JwtConfig.DECODING_KEY.value).decode()
+                                       },
+                                       return_cols={JwtDbConfig.COL_KID: int},
+                                       engine=DbEngine(JwtDbConfig.ENGINE),
+                                       connection=curr_conn,
+                                       errors=errors,
+                                       logger=logger)
+        # finish the operation
+        if not db_conn:
             if errors:
-                raise RuntimeError("; ".join(errors))
-            if logger:
-                logger.debug(msg="Oldest active token of account "
-                                 f"'{account_id}' removed from storage")
-        # persist token
-        col_kid: int = db_insert(insert_stmt=f"INSERT INTO {JwtDbConfig.TABLE}",
-                                 insert_data={
-                                     JwtDbConfig.COL_ACCOUNT: account_id,
-                                     JwtDbConfig.COL_TOKEN: jwt_token,
-                                     JwtDbConfig.COL_ALGORITHM: JwtConfig.DEFAULT_ALGORITHM.value,
-                                     JwtDbConfig.COL_DECODER: b64encode(s=JwtConfig.DECODING_KEY.value).decode()
-                                 },
-                                 return_cols={JwtDbConfig.COL_KID: int},
-                                 engine=DbEngine(JwtDbConfig.ENGINE),
-                                 connection=db_conn,
-                                 errors=errors,
-                                 logger=logger)
-        if errors:
-            raise RuntimeError("; ".join(errors))
+                db_rollback(connection=curr_conn)
+            else:
+                db_commit(connection=curr_conn)
+            db_close(connection=curr_conn)
 
-        # obtain and return the token's storage id
-        reply: list[tuple[int]] = db_select(sel_stmt=f"SELECT {JwtDbConfig.COL_KID} "
-                                                     f"FROM {JwtDbConfig.TABLE}",
-                                            where_data={JwtDbConfig.COL_KID: col_kid},
-                                            min_count=1,
-                                            max_count=1,
-                                            engine=DbEngine(JwtDbConfig.ENGINE),
-                                            connection=db_conn,
-                                            committable=False,
-                                            errors=errors,
-                                            logger=logger)
         if errors:
             raise RuntimeError("; ".join(errors))
 
-        return reply[0][0]
+        return result