pyramid_cloudflare_access 1.1__tar.gz

pyramid_cloudflare_access-1.1/CHANGES.rst

@@ -0,0 +1,17 @@
+=======
+Changes
+=======
+
+1.1
+---
+
+* Support for Heroku Review Apps.
+  [zupo]
+
+
+1.0
+---
+
+* Initial release.
+  [dz0ny, zupo]
+

pyramid_cloudflare_access-1.1/COPYING.txt

@@ -0,0 +1,26 @@
+Copyright (c) 2022 Niteo GmbH
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are
+permitted provided that the following conditions are met:
+
+   1. Redistributions of source code must retain the above copyright notice, this list of
+      conditions and the following disclaimer.
+
+   2. Redistributions in binary form must reproduce the above copyright notice, this list
+      of conditions and the following disclaimer in the documentation and/or other materials
+      provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE ABOVE COPYRIGHT HOLDERS ''AS IS'' AND ANY EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those of the
+authors and should not be interpreted as representing official policies, either expressed
+or implied, of their employers.

pyramid_cloudflare_access-1.1/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.1
+Name: pyramid_cloudflare_access
+Version: 1.1
+Summary: A bunch of helpers for successfully running Pyramid on Heroku.
+Home-page: https://github.com/teamniteo/pyramid_cloudflare_access
+License: BSD-3-Clause
+Keywords: pyramid,cloudflare,pylons,web
+Author: Niteo
+Author-email: info@niteo.co
+Requires-Python: >=3.9
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: Pylons
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Internet :: WWW/HTTP :: WSGI
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: cryptography
+Requires-Dist: pyjwt
+Requires-Dist: pyramid (>=1.7,<2.0)
+Description-Content-Type: text/x-rst
+
+pyramid_cloudflare_access
+=========================
+
+Introduction
+------------
+
+
+Installation
+------------
+
+Just do
+
+``pip install pyramid_cloudflare_access``
+
+or
+
+``easy_install pyramid_cloudflare_access``
+
+
+Compatibility
+-------------
+
+pyramid_cloudflare_access runs with pyramid>=1.7 and python>=3.6.
+Other versions might also work.
+
+Heroku Review Apps deployed on `*.herokuapp.com` subdomains automatically skip the cloudflare access check as their domains are dynamic and as such can't be configured in Cloudflare dashboard in advance. 
+
+Usage
+-----
+
+Add Cloudfalre config to a production.ini::
+
+    pyramid_cloudflare_access.policy_audience = "my_audience"
+    pyramid_cloudflare_access.team = "https://team.cloudfare-access.com"
+
+
+More information can be found at https://developers.cloudflare.com/cloudflare-one/identity/users/validating-json#python-example
+
+Usage example for the tween::
+
+    def main(global_config, **settings):
+        config = Configurator(settings=settings)
+        config.include('pyramid_cloudflare_access')
+        return config.make_wsgi_app()
+
+
+Releasing
+---------
+
+#. Update CHANGES.rst.
+#. Update pyproject.toml version.
+#. Run ``poetry check``.
+#. Run ``poetry publish --build``.
+
+
+We're hiring!
+-------------
+
+At Niteo we regularly contribute back to the Open Source community. If you do too, we'd like to invite you to `join our team
+<https://niteo.co/careers/>`_!
+

pyramid_cloudflare_access-1.1/README.rst

@@ -0,0 +1,60 @@
+pyramid_cloudflare_access
+=========================
+
+Introduction
+------------
+
+
+Installation
+------------
+
+Just do
+
+``pip install pyramid_cloudflare_access``
+
+or
+
+``easy_install pyramid_cloudflare_access``
+
+
+Compatibility
+-------------
+
+pyramid_cloudflare_access runs with pyramid>=1.7 and python>=3.6.
+Other versions might also work.
+
+Heroku Review Apps deployed on `*.herokuapp.com` subdomains automatically skip the cloudflare access check as their domains are dynamic and as such can't be configured in Cloudflare dashboard in advance. 
+
+Usage
+-----
+
+Add Cloudfalre config to a production.ini::
+
+    pyramid_cloudflare_access.policy_audience = "my_audience"
+    pyramid_cloudflare_access.team = "https://team.cloudfare-access.com"
+
+
+More information can be found at https://developers.cloudflare.com/cloudflare-one/identity/users/validating-json#python-example
+
+Usage example for the tween::
+
+    def main(global_config, **settings):
+        config = Configurator(settings=settings)
+        config.include('pyramid_cloudflare_access')
+        return config.make_wsgi_app()
+
+
+Releasing
+---------
+
+#. Update CHANGES.rst.
+#. Update pyproject.toml version.
+#. Run ``poetry check``.
+#. Run ``poetry publish --build``.
+
+
+We're hiring!
+-------------
+
+At Niteo we regularly contribute back to the Open Source community. If you do too, we'd like to invite you to `join our team
+<https://niteo.co/careers/>`_!

pyramid_cloudflare_access-1.1/pyproject.toml

@@ -0,0 +1,45 @@
+[tool.poetry]
+name = "pyramid_cloudflare_access"
+version = "1.1"
+description = "A bunch of helpers for successfully running Pyramid on Heroku."
+readme = "README.rst"
+include = [ "CHANGES.rst", "COPYING.txt" ]
+classifiers = [
+    "Operating System :: OS Independent",
+    "License :: OSI Approved :: BSD License",
+    "Programming Language :: Python",
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Framework :: Pylons",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.7",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Internet :: WWW/HTTP :: WSGI",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+packages = [
+    { include = "pyramid_cloudflare_access" },
+]
+authors = [ "Niteo <info@niteo.co>" ]
+license = "BSD-3-Clause"
+homepage = "https://github.com/teamniteo/pyramid_cloudflare_access"
+keywords = [ "pyramid", "cloudflare", "pylons", "web" ]
+
+[tool.poetry.dependencies]
+python = ">=3.9"
+pyramid = ">=1.7, <2.0"
+pyjwt = "*"
+cryptography = "*"
+
+[tool.poetry.dev-dependencies]
+typecov = "*"
+pytest-mock = "*"
+pytest-cov = "*"
+pytest = "*"
+mypy = "*"
+mock = "*"
+isort = "*"
+black = "*"
+autoflake = "*"
+"zope.testing" = "*"
+pytest-freezegun = "*"

pyramid_cloudflare_access-1.1/pyramid_cloudflare_access/__init__.py

@@ -0,0 +1,71 @@
+"""Verify Cloudflare Access requests."""
+
+from jwt import decode as jwt_decode
+from jwt import PyJWKClient
+from jwt.api_jwk import PyJWK
+from pyramid.config import Configurator
+from pyramid.request import Request
+from pyramid.tweens import INGRESS
+
+import pyramid.httpexceptions as exc
+import typing as t
+
+
+def includeme(config: Configurator) -> None:  # pragma: no cover
+    # as possibly first tween in chain, order does not matter
+    config.add_tween("pyramid_cloudflare_access.CloudflareAccess", under=INGRESS)
+
+
+def _get_public_keys(team: str) -> t.List[PyJWK]:
+    """Get JWK public keys for a team."""
+
+    url = f"{team}/cdn-cgi/access/certs"
+    client = PyJWKClient(url, cache_keys=False)
+    return client.get_signing_keys()
+
+
+class CloudflareAccess:
+    """Deny access to Pyramid app when CF Access token is missing or invalid.
+
+    ref: https://developers.cloudflare.com/cloudflare-one/identity/users/validating-json#python-example
+    """
+
+    def __init__(self, handler, registry):
+        settings = getattr(registry, "settings", {})
+        self.handler = handler
+        self.policy_audience = settings["pyramid_cloudflare_access.policy_audience"]
+        self.public_keys = _get_public_keys(settings["pyramid_cloudflare_access.team"])
+
+    def authenticated_request(self, request: Request) -> bool:
+        token = request.cookies.get("CF_Authorization")
+
+        if not token:
+            raise exc.HTTPBadRequest()
+
+        # Loop through the keys since we can't pass the key set to the decoder
+        for signing_key in self.public_keys:
+            try:
+                # decode returns the claims and verifies token against public keys
+                claims = jwt_decode(
+                    token,
+                    key=signing_key.key,
+                    audience=self.policy_audience,
+                    algorithms=["RS256"],
+                )
+                return claims is not None
+            except:
+                pass
+
+        return False
+
+    def __call__(self, request: Request):
+
+        # Support for Heroku Review apps
+        if "herokuapp.com" in request.headers.get("Host", ""):
+            return self.handler(request)
+            
+        if not self.authenticated_request(request):
+            raise exc.HTTPForbidden()
+
+        # Continue with processing requests
+        return self.handler(request)

pyramid_cloudflare_access-1.1/pyramid_cloudflare_access/tests/conftest.py

@@ -0,0 +1,3 @@
+"""
+Pytest fixtures
+"""

pyramid_cloudflare_access-1.1/pyramid_cloudflare_access/tests/test_access.py

@@ -0,0 +1,115 @@
+"""Tests for HerokuappAccess tween."""
+
+from pyramid import testing
+from pyramid.httpexceptions import HTTPBadRequest
+from pyramid.httpexceptions import HTTPForbidden
+from pyramid_cloudflare_access import CloudflareAccess
+
+import pytest
+
+# Taken from example at https://pyjwt.readthedocs.io/en/latest/usage.html#retrieve-rsa-signing-keys-from-a-jwks-endpoint
+sample_jwk = {
+    "keys": [
+        {
+            "alg": "RS256",
+            "kty": "RSA",
+            "use": "sig",
+            "n": "0wtlJRY9-ru61LmOgieeI7_rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkfLsuFtR8cG07EE4uvJ78bAqRjMsCvprWp4e2p7hqPnWcpRpDEyHjzirEJle1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset_Obh8BwtO-Ww-UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWaF6_GeOhbFoyWcyUmFvzWhBm8Q38vWgsSI7oHTkEw",
+            "e": "AQAB",
+            "kid": "NEE1QURBOTM4MzI5RkFDNTYxOTU1MDg2ODgwQ0UzMTk1QjYyRkRFQw",
+            "x5t": "NEE1QURBOTM4MzI5RkFDNTYxOTU1MDg2ODgwQ0UzMTk1QjYyRkRFQw",
+            "x5c": [
+                "MIIDBzCCAe+gAwIBAgIJNtD9Ozi6j2jJMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMTFmRldi04N2V2eDlydS5hdXRoMC5jb20wHhcNMTkwNjIwMTU0NDU4WhcNMzMwMjI2MTU0NDU4WjAhMR8wHQYDVQQDExZkZXYtODdldng5cnUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0wtlJRY9+ru61LmOgieeI7/rD1oIna9QpBMAOWw8wTuoIhFQFwcIi7MFB7IEfelCPj08vkfLsuFtR8cG07EE4uvJ78bAqRjMsCvprWp4e2p7hqPnWcpRpDEyHjzirEJle1LPpjLLVaSWgkbrVaOD0lkWkP1T1TkrOset/Obh8BwtO+Ww+UfrEwxTyz1646AGkbT2nL8PX0trXrmira8GnrCkFUgTUS61GoTdb9bCJ19PLX9Gnxw7J0BtR0GubopXq8KlI0ThVql6ZtVGN2dvmrCPAVAZleM5TVB61m0VSXvGWaF6/GeOhbFoyWcyUmFvzWhBm8Q38vWgsSI7oHTkEwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQlGXpmYaXFB7Q3eG69Uhjd4cFp/jAOBgNVHQ8BAf8EBAMCAoQwDQYJKoZIhvcNAQELBQADggEBAIzQOF/h4T5WWAdjhcIwdNS7hS2Deq+UxxkRv+uavj6O9mHLuRG1q5onvSFShjECXaYT6OGibn7Ufw/JSm3+86ZouMYjBEqGh4OvWRkwARy1YTWUVDGpT2HAwtIq3lfYvhe8P4VfZByp1N4lfn6X2NcJflG+Q+mfXNmRFyyft3Oq51PCZyyAkU7bTun9FmMOyBtmJvQjZ8RXgBLvu9nUcZB8yTVoeUEg4cLczQlli/OkiFXhWgrhVr8uF0/9klslMFXtm78iYSgR8/oC+k1pSNd1+ESSt7n6+JiAQ2Co+ZNKta7LTDGAjGjNDymyoCrZpeuYQwwnHYEHu/0khjAxhXo="
+            ],
+        },
+        {
+            "alg": "RS256",
+            "kty": "RSA",
+            "use": "sig",
+            "n": "qMDEywqsPbiQbnSPVoKOb1HrQ_2KxI4JDe-AK-kbpb2Q3QXFl6IM3pJCvfYOm-f3DuEtBpll_Rg28WWeXl8pXAhmHk3V2Ig57f81uzGXg5xFtZDrqAG0chgwCQPD15FG00xrLDTvSDkIEPJZq-Y4IlJ3NbzQ8gn_JiappjMc8FjqQMz_4uUF-iIPU_aUgbLLtN98moKeNLAVV2lV3H5kVhNP8Fqd6piiH-mdma_KdY--GahAFC7Lt72_QtxnxowalbdkdMDim7paTeqxoZUKKHJsRVPXbiGx1zB3cfgBH7meU8ILv7JX3odu0juy0y2gagSaMkEd9-mcTLr8Bg0-5Q",
+            "e": "AQAB",
+            "kid": "Dt0jkFkY7KkmYdDb2BaI1",
+            "x5t": "lhmczC7hbLpBZh6MBSygH1D9qeE",
+            "x5c": [
+                "MIIDBzCCAe+gAwIBAgIJHjJKyTNJE/wIMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMTFmRldi04N2V2eDlydS5hdXRoMC5jb20wHhcNMjAwMzExMjA1OTM5WhcNMzMxMTE4MjA1OTM5WjAhMR8wHQYDVQQDExZkZXYtODdldng5cnUuYXV0aDAuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqMDEywqsPbiQbnSPVoKOb1HrQ/2KxI4JDe+AK+kbpb2Q3QXFl6IM3pJCvfYOm+f3DuEtBpll/Rg28WWeXl8pXAhmHk3V2Ig57f81uzGXg5xFtZDrqAG0chgwCQPD15FG00xrLDTvSDkIEPJZq+Y4IlJ3NbzQ8gn/JiappjMc8FjqQMz/4uUF+iIPU/aUgbLLtN98moKeNLAVV2lV3H5kVhNP8Fqd6piiH+mdma/KdY++GahAFC7Lt72/QtxnxowalbdkdMDim7paTeqxoZUKKHJsRVPXbiGx1zB3cfgBH7meU8ILv7JX3odu0juy0y2gagSaMkEd9+mcTLr8Bg0+5QIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQxVQqyrrAtXsBznZj2GN4nfJf+sTAOBgNVHQ8BAf8EBAMCAoQwDQYJKoZIhvcNAQELBQADggEBAGsIl6yxIG8GOkHlfcSEa4//4WDxwfw8lg6zNPri6nhYtF1kbHTO5PqUbE+kasMnvqEV5Y0QXvyxwIjLLbbYiySK6aWp5XS2Wy5hYlMjXOimAw6mwbkNVhujRsPjTY3P+bv/9eiv2zO9yEfzfmfr6jhYcmnOdTFgAujsL4AyDpUh4/jKDtDNFl6lMdn8J7DcdRNZM/8OsAk6GgZYlzStfh4aI/uE3ekJ84XAxxdHUzwDUu5B8CetmHvfxQvV9MjmozLR8SbkTEhUv4//tr8SfGc8jS78E5w8NJN6DtYVcUNweHrAlvQXRevCmBRu3D9hKARjXfTBqilBBF9nNt93mYM="
+            ],
+        },
+    ]
+}
+sample_token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ik5FRTFRVVJCT1RNNE16STVSa0ZETlRZeE9UVTFNRGcyT0Rnd1EwVXpNVGsxUWpZeVJrUkZRdyJ9.eyJpc3MiOiJodHRwczovL2Rldi04N2V2eDlydS5hdXRoMC5jb20vIiwic3ViIjoiYVc0Q2NhNzl4UmVMV1V6MGFFMkg2a0QwTzNjWEJWdENAY2xpZW50cyIsImF1ZCI6Imh0dHBzOi8vZXhwZW5zZXMtYXBpIiwiaWF0IjoxNTcyMDA2OTU0LCJleHAiOjE1NzIwMDY5NjQsImF6cCI6ImFXNENjYTc5eFJlTFdVejBhRTJINmtEME8zY1hCVnRDIiwiZ3R5IjoiY2xpZW50LWNyZWRlbnRpYWxzIn0.PUxE7xn52aTCohGiWoSdMBZGiYAHwE5FYie0Y1qUT68IHSTXwXVd6hn02HTah6epvHHVKA2FqcFZ4GGv5VTHEvYpeggiiZMgbxFrmTEY0csL6VNkX1eaJGcuehwQCRBKRLL3zKmA5IKGy5GeUnIbpPHLHDxr-GXvgFzsdsyWlVQvPX2xjeaQ217r2PtxDeqjlf66UYl6oY6AqNS8DH3iryCvIfCcybRZkc_hdy-6ZMoKT6Piijvk_aXdm7-QQqKJFHLuEqrVSOuBqqiNfVrG27QzAPuPOxvfXTVLXL2jek5meH6n-VWgrBdoMFH93QEszEDowDAEhQPHVs0xj7SIzA"
+sample_audience = "https://expenses-api"
+
+
+@pytest.mark.freeze_time("2019-10-25 12:36:00")
+def test_happy_path(mocker) -> None:
+    """Test that JWT token is parsed and authorized."""
+
+    mocker.patch(
+        "pyramid_cloudflare_access.PyJWKClient.fetch_data", return_value=sample_jwk
+    )
+    tween_handler = mocker.Mock()
+
+    request = testing.DummyRequest()
+    request.cookies = {"CF_Authorization": sample_token}
+    request.registry.settings = {
+        "pyramid_cloudflare_access.policy_audience": sample_audience,
+        "pyramid_cloudflare_access.team": "https://foo.cloudflareaccess.com",
+    }
+
+    CloudflareAccess(tween_handler, request.registry)(request)
+    tween_handler.assert_called_with(request)
+
+
+def test_missing_cookie(mocker) -> None:
+    """Test that access is denied on wrong request."""
+
+    mocker.patch(
+        "pyramid_cloudflare_access.PyJWKClient.fetch_data", return_value=sample_jwk
+    )
+    tween_handler = mocker.Mock()
+
+    request = testing.DummyRequest()
+    request.registry.settings = {
+        "pyramid_cloudflare_access.policy_audience": sample_audience,
+        "pyramid_cloudflare_access.team": "https://foo.cloudflareaccess.com",
+    }
+    with pytest.raises(HTTPBadRequest):
+        CloudflareAccess(tween_handler, request.registry)(request)
+
+
+def test_auth_failed(mocker) -> None:
+    """Test that access is denied on expired auth."""
+
+    mocker.patch(
+        "pyramid_cloudflare_access.PyJWKClient.fetch_data", return_value=sample_jwk
+    )
+    tween_handler = mocker.Mock()
+
+    request = testing.DummyRequest()
+    request.cookies = {"CF_Authorization": sample_token}
+    request.registry.settings = {
+        "pyramid_cloudflare_access.policy_audience": sample_audience,
+        "pyramid_cloudflare_access.team": "https://foo.cloudflareaccess.com",
+    }
+    with pytest.raises(HTTPForbidden):
+        CloudflareAccess(tween_handler, request.registry)(request)
+
+def test_herokuapp(mocker) -> None:
+    """Test that Cloudflare Access is skipped for Heroku-hosted apps.
+
+    This is to support Review Apps that have dynamic *.herokuapp.com hostname,
+    that cannot be configured as a domain for Cloudflare Access application
+    in Cloudflare dashboard.
+    """
+    tween_handler = mocker.Mock()
+    
+    request = testing.DummyRequest()
+    request.cookies = {}
+    request.registry.settings = {
+        "pyramid_cloudflare_access.policy_audience": sample_audience,
+        "pyramid_cloudflare_access.team": "https://foo.cloudflareaccess.com",
+    }
+    request.headers['Host'] = "foo.herokuapp.com"
+
+    CloudflareAccess(tween_handler, request.registry)(request)
+    tween_handler.assert_called_with(request)