pyweber 1.5.0.dev3__tar.gz → 1.5.2__tar.gz

{pyweber-1.5.0.dev3/pyweber.egg-info → pyweber-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev3
+Version: 1.5.2
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0

{pyweber-1.5.0.dev3 → pyweber-1.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.5.0.dev3"
+version = "1.5.2"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]

{pyweber-1.5.0.dev3 → pyweber-1.5.2}/pyweber/__init__.py

@@ -76,10 +76,29 @@ from .utils.security import (
     sign_value,
     unsign_value,
     generate_csrf_token,
+    get_csrf_token,
 )
 from .utils.icons import Icons
 from .utils.deprecation import warn_deprecated
 from .testing import TestClient
+from .auth import (
+    login_required,
+    login_user,
+    logout_user,
+    current_user,
+    get_user_id,
+    hash_password,
+    check_password,
+    permission_required,
+    role_required,
+    register_roles,
+    clear_roles,
+    define_role,
+    has_role,
+    has_all_roles,
+    has_permission,
+    user_permissions,
+)
 
 from .utils.types import (
     ContentTypes,
@@ -200,6 +219,7 @@ __all__ = [
     'sign_value',
     'unsign_value',
     'generate_csrf_token',
+    'get_csrf_token',
     'ContentTypes',
     'EventType',
     'HTMLTag',
@@ -244,6 +264,22 @@ __all__ = [
     'SecurityEnforcer',
     'SecurityError',
     'ForbiddenError',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'current_user',
+    'get_user_id',
+    'hash_password',
+    'check_password',
+    'permission_required',
+    'role_required',
+    'register_roles',
+    'clear_roles',
+    'define_role',
+    'has_role',
+    'has_all_roles',
+    'has_permission',
+    'user_permissions',
     'Icon',
     'Style',
     'Script',

pyweber-1.5.2/pyweber/auth/__init__.py

@@ -0,0 +1,44 @@
+"""Lightweight session login helpers (Flask-Login style, no ORM) + RBAC."""
+
+from pyweber.auth.decorators import login_required, permission_required, role_required
+from pyweber.auth.passwords import check_password, hash_password
+from pyweber.auth.rbac import (
+    RoleRegistry,
+    clear_roles,
+    define_role,
+    get_role_registry,
+    has_all_roles,
+    has_permission,
+    has_role,
+    register_roles,
+    user_permissions,
+)
+from pyweber.auth.session import (
+    USER_COOKIE_NAME,
+    current_user,
+    get_user_id,
+    login_user,
+    logout_user,
+)
+
+__all__ = [
+    'USER_COOKIE_NAME',
+    'RoleRegistry',
+    'check_password',
+    'clear_roles',
+    'current_user',
+    'define_role',
+    'get_role_registry',
+    'get_user_id',
+    'has_all_roles',
+    'has_permission',
+    'has_role',
+    'hash_password',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'permission_required',
+    'register_roles',
+    'role_required',
+    'user_permissions',
+]

pyweber-1.5.2/pyweber/auth/decorators.py

@@ -0,0 +1,201 @@
+"""``@login_required`` / ``@permission_required`` / ``@role_required``."""
+
+from __future__ import annotations
+
+import inspect
+from functools import wraps
+from typing import Any, Callable
+
+from pyweber.auth.rbac import user_has_permissions, user_has_roles
+from pyweber.auth.session import current_user
+from pyweber.models.context import get_current_request
+from pyweber.models.response import Response
+from pyweber.utils.types import ContentTypes
+
+
+def _wants_json(request) -> bool:
+    if request is None:
+        return False
+    accept = (request.headers.get('accept') or '').lower()
+    if 'application/json' in accept:
+        if 'text/html' not in accept:
+            return True
+        return accept.find('application/json') <= accept.find('text/html')
+    return False
+
+
+def _unauthorized(*, redirect: str | None, request) -> Response:
+    if redirect and not _wants_json(request):
+        return Response(
+            content=b'',
+            status=302,
+            request=request,
+            route=redirect,
+            headers={'Location': redirect},
+            content_type=ContentTypes.txt,
+        )
+    return Response.json({'detail': 'Unauthorized'}, status=401, request=request)
+
+
+def _forbidden(*, request) -> Response:
+    return Response.json({'detail': 'Forbidden'}, status=403, request=request)
+
+
+def _authorize(
+    user: dict[str, Any] | None,
+    *,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+) -> str | None:
+    """Return ``'unauthorized'``, ``'forbidden'``, or ``None`` if allowed."""
+    if user is None:
+        return 'unauthorized'
+    if not user_has_roles(user, roles, roles_all=roles_all):
+        return 'forbidden'
+    if not user_has_permissions(user, permissions, permissions_all=permissions_all):
+        return 'forbidden'
+    return None
+
+
+def _wrap_handler(
+    func: Callable,
+    *,
+    redirect: str | None,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+):
+    if inspect.iscoroutinefunction(func):
+        @wraps(func)
+        async def async_wrapper(*args, **kwargs):
+            request = get_current_request()
+            decision = _authorize(
+                current_user(),
+                roles=roles,
+                roles_all=roles_all,
+                permissions=permissions,
+                permissions_all=permissions_all,
+            )
+            if decision == 'unauthorized':
+                return _unauthorized(redirect=redirect, request=request)
+            if decision == 'forbidden':
+                return _forbidden(request=request)
+            return await func(*args, **kwargs)
+
+        return async_wrapper
+
+    @wraps(func)
+    def sync_wrapper(*args, **kwargs):
+        request = get_current_request()
+        decision = _authorize(
+            current_user(),
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+        if decision == 'unauthorized':
+            return _unauthorized(redirect=redirect, request=request)
+        if decision == 'forbidden':
+            return _forbidden(request=request)
+        return func(*args, **kwargs)
+
+    return sync_wrapper
+
+
+def login_required(
+    fn: Callable | None = None,
+    *,
+    redirect: str | None = None,
+    roles: list[str] | None = None,
+    roles_all: list[str] | None = None,
+    permissions: list[str] | None = None,
+    permissions_all: list[str] | None = None,
+):
+    """Require a logged-in user (cookie) or ``request.auth`` from OpenAPI schemes.
+
+    RBAC (optional)::
+
+        @login_required(roles=['admin', 'moderator'])          # any role
+        @login_required(roles_all=['staff', 'verified'])       # all roles
+        @login_required(permissions=['posts:write'])           # via register_roles()
+        @login_required(permissions_all=['posts:read', 'posts:write'])
+
+    Usage::
+
+        @app.route('/dash')
+        @login_required(redirect='/login')
+        def dash():
+            ...
+
+        @login_required  # bare form
+        def api_me():
+            ...
+    """
+
+    def decorator(func: Callable):
+        return _wrap_handler(
+            func,
+            redirect=redirect,
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+
+    if fn is not None and callable(fn):
+        return decorator(fn)
+    return decorator
+
+
+def permission_required(
+    *permissions: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(permissions=…)`` / ``permissions_all=``.
+
+    ::
+
+        @permission_required('posts:write')
+        def create(): ...
+
+        @permission_required('a', 'b', require_all=True)
+        def both(): ...
+    """
+    if not permissions:
+        raise TypeError('permission_required() needs at least one permission')
+    perms = list(permissions)
+    return login_required(
+        redirect=redirect,
+        permissions=None if require_all else perms,
+        permissions_all=perms if require_all else None,
+    )
+
+
+def role_required(
+    *roles: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(roles=…)`` / ``roles_all=``.
+
+    ::
+
+        @role_required('admin')
+        def admin_panel(): ...
+
+        @role_required('staff', 'verified', require_all=True)
+        def staff_only(): ...
+    """
+    if not roles:
+        raise TypeError('role_required() needs at least one role')
+    rs = list(roles)
+    return login_required(
+        redirect=redirect,
+        roles=None if require_all else rs,
+        roles_all=rs if require_all else None,
+    )

pyweber-1.5.2/pyweber/auth/passwords.py

@@ -0,0 +1,52 @@
+"""Password hashing helpers (stdlib PBKDF2-HMAC-SHA256)."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+DEFAULT_ITERATIONS = 260_000
+_SCHEME = 'pbkdf2_sha256'
+
+
+def hash_password(password: str, *, iterations: int = DEFAULT_ITERATIONS) -> str:
+    """Hash a password for storage.
+
+    Format: ``pbkdf2_sha256$<iterations>$<salt_hex>$<digest_hex>``
+    """
+    if not isinstance(password, str) or password == '':
+        raise ValueError('password must be a non-empty string')
+    salt = secrets.token_hex(16)
+    digest = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        bytes.fromhex(salt),
+        iterations,
+    ).hex()
+    return f'{_SCHEME}${iterations}${salt}${digest}'
+
+
+def check_password(password: str, encoded: str) -> bool:
+    """Constant-time verify of ``password`` against ``hash_password`` output."""
+    if not password or not encoded or not isinstance(encoded, str):
+        return False
+    try:
+        scheme, iter_s, salt, digest = encoded.split('$', 3)
+    except ValueError:
+        return False
+    if scheme != _SCHEME:
+        return False
+    try:
+        iterations = int(iter_s)
+        salt_b = bytes.fromhex(salt)
+        expected = bytes.fromhex(digest)
+    except (TypeError, ValueError):
+        return False
+    actual = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        salt_b,
+        iterations,
+    )
+    return hmac.compare_digest(actual, expected)

pyweber-1.5.2/pyweber/auth/rbac.py

@@ -0,0 +1,184 @@
+"""Lightweight role → permission registry (no ORM).
+
+Define roles once, then gate routes with ``permissions=`` / helpers::
+
+    from pyweber.auth import register_roles, has_permission, login_required
+
+    register_roles({
+        'admin': ['*'],
+        'editor': ['posts:read', 'posts:write'],
+        'viewer': ['posts:read'],
+    })
+
+    @app.route('/posts', methods=['POST'])
+    @login_required(permissions=['posts:write'])
+    def create_post():
+        ...
+"""
+
+from __future__ import annotations
+
+from typing import Any, Iterable
+
+from pyweber.auth.session import current_user
+
+# Wildcard: full access, or ``resource:*`` for a namespace.
+ALL_PERMISSIONS = '*'
+
+
+class RoleRegistry:
+    """Map role names to permission strings."""
+
+    def __init__(self) -> None:
+        self._roles: dict[str, set[str]] = {}
+
+    def clear(self) -> None:
+        self._roles.clear()
+
+    def role(self, name: str, permissions: Iterable[str] | None = None) -> None:
+        self._roles[str(name)] = {str(p) for p in (permissions or [])}
+
+    def register(self, mapping: dict[str, Iterable[str]]) -> None:
+        for name, perms in mapping.items():
+            self.role(name, perms)
+
+    def get(self, name: str) -> set[str]:
+        return set(self._roles.get(str(name), set()))
+
+    def permissions_for(self, roles: Iterable[str] | None) -> set[str]:
+        out: set[str] = set()
+        for role in roles or []:
+            out |= self.get(role)
+        return out
+
+    def has_permission(self, roles: Iterable[str] | None, permission: str) -> bool:
+        return permission_matches(self.permissions_for(roles), permission)
+
+
+def permission_matches(granted: Iterable[str], needed: str) -> bool:
+    """Return True if ``needed`` is covered by ``granted`` (supports ``*`` / ``ns:*``)."""
+    need = str(needed)
+    have = {str(p) for p in granted}
+    if ALL_PERMISSIONS in have or need in have:
+        return True
+    if ':' in need:
+        ns = need.split(':', 1)[0]
+        if f'{ns}:*' in have:
+            return True
+    return False
+
+
+def permissions_match_any(granted: Iterable[str], needed: Iterable[str]) -> bool:
+    return any(permission_matches(granted, p) for p in needed)
+
+
+def permissions_match_all(granted: Iterable[str], needed: Iterable[str]) -> bool:
+    return all(permission_matches(granted, p) for p in needed)
+
+
+_registry = RoleRegistry()
+
+
+def get_role_registry() -> RoleRegistry:
+    return _registry
+
+
+def register_roles(mapping: dict[str, Iterable[str]]) -> None:
+    """Register or replace role → permission mappings (process-wide)."""
+    _registry.register(mapping)
+
+
+def define_role(name: str, permissions: Iterable[str] | None = None) -> None:
+    _registry.role(name, permissions)
+
+
+def clear_roles() -> None:
+    """Clear the process-wide role registry (useful in tests)."""
+    _registry.clear()
+
+
+def _user_role_names(user: dict[str, Any] | None = None) -> list[str]:
+    u = user if user is not None else current_user()
+    if not u:
+        return []
+    return [str(r) for r in (u.get('roles') or [])]
+
+
+def _direct_permissions(user: dict[str, Any] | None = None) -> set[str]:
+    """Extra permissions stored on the session (``data['permissions']``)."""
+    u = user if user is not None else current_user()
+    if not u:
+        return set()
+    data = u.get('data') or {}
+    raw = data.get('permissions') or []
+    if isinstance(raw, str):
+        return {raw}
+    return {str(p) for p in raw}
+
+
+def user_permissions(user: dict[str, Any] | None = None) -> set[str]:
+    """Expanded permissions for the current (or given) user."""
+    u = user if user is not None else current_user()
+    if not u:
+        return set()
+    return _registry.permissions_for(_user_role_names(u)) | _direct_permissions(u)
+
+
+def has_role(*roles: str, require_all: bool = False, user: dict[str, Any] | None = None) -> bool:
+    """True if the user has any (default) or all of the given roles."""
+    u = user if user is not None else current_user()
+    if not u or not roles:
+        return False
+    have = {str(r) for r in (u.get('roles') or [])}
+    need = {str(r) for r in roles}
+    if require_all:
+        return need <= have
+    return bool(have & need)
+
+
+def has_all_roles(*roles: str, user: dict[str, Any] | None = None) -> bool:
+    return has_role(*roles, require_all=True, user=user)
+
+
+def has_permission(
+    *permissions: str,
+    require_all: bool = False,
+    user: dict[str, Any] | None = None,
+) -> bool:
+    """True if the user has any (default) or all of the given permissions."""
+    if not permissions:
+        return False
+    granted = user_permissions(user)
+    if require_all:
+        return permissions_match_all(granted, permissions)
+    return permissions_match_any(granted, permissions)
+
+
+def user_has_roles(
+    user: dict[str, Any],
+    roles: list[str] | None = None,
+    *,
+    roles_all: list[str] | None = None,
+) -> bool:
+    if roles_all:
+        if not has_role(*roles_all, require_all=True, user=user):
+            return False
+    if roles:
+        if not has_role(*roles, require_all=False, user=user):
+            return False
+    return True
+
+
+def user_has_permissions(
+    user: dict[str, Any],
+    permissions: list[str] | None = None,
+    *,
+    permissions_all: list[str] | None = None,
+) -> bool:
+    if permissions_all:
+        if not has_permission(*permissions_all, require_all=True, user=user):
+            return False
+    if permissions:
+        if not has_permission(*permissions, require_all=False, user=user):
+            return False
+    return True

pyweber-1.5.2/pyweber/auth/session.py

@@ -0,0 +1,146 @@
+"""Signed login-user cookie (not the reactive WS session id)."""
+
+from __future__ import annotations
+
+import json
+import time
+from typing import Any
+
+from pyweber.models.context import get_cookie_manager, get_current_request
+from pyweber.utils.security import https_enabled, sign_value, unsign_value
+
+USER_COOKIE_NAME = 'pyweber_user'
+DEFAULT_MAX_AGE = 60 * 60 * 24 * 14  # 14 days
+
+
+def _encode_payload(payload: dict[str, Any]) -> str:
+    raw = json.dumps(payload, separators=(',', ':'), sort_keys=True)
+    return sign_value(raw)
+
+
+def _decode_payload(signed: str | None) -> dict[str, Any] | None:
+    if not signed:
+        return None
+    raw = unsign_value(signed)
+    if not raw:
+        return None
+    try:
+        data = json.loads(raw)
+    except (TypeError, json.JSONDecodeError):
+        return None
+    if not isinstance(data, dict) or 'id' not in data:
+        return None
+    exp = data.get('exp')
+    if exp is not None:
+        try:
+            if float(exp) < time.time():
+                return None
+        except (TypeError, ValueError):
+            return None
+    return data
+
+
+def _from_request_auth() -> dict[str, Any] | None:
+    request = get_current_request()
+    auth = getattr(request, 'auth', None) if request else None
+    if auth is None:
+        return None
+    user = getattr(auth, 'user', None)
+    if isinstance(user, dict) and 'id' in user:
+        roles = user.get('roles') or getattr(auth, 'scopes', None) or []
+        return {
+            'id': user['id'],
+            'roles': list(roles) if roles else [],
+            'data': {k: v for k, v in user.items() if k not in ('id', 'roles')},
+            'scheme': getattr(auth, 'scheme', None),
+        }
+    if user is not None:
+        return {
+            'id': user,
+            'roles': list(getattr(auth, 'scopes', None) or []),
+            'data': {},
+            'scheme': getattr(auth, 'scheme', None),
+        }
+    # credentials-only success (e.g. bearer token string)
+    creds = getattr(auth, 'credentials', None)
+    if creds is not None:
+        return {
+            'id': creds if not isinstance(creds, dict) else creds.get('id', creds),
+            'roles': list(getattr(auth, 'scopes', None) or []),
+            'data': creds if isinstance(creds, dict) else {},
+            'scheme': getattr(auth, 'scheme', None),
+        }
+    return {
+        'id': getattr(auth, 'scheme', 'authenticated'),
+        'roles': list(getattr(auth, 'scopes', None) or []),
+        'data': {},
+        'scheme': getattr(auth, 'scheme', None),
+    }
+
+
+def current_user() -> dict[str, Any] | None:
+    """Return the logged-in user dict, or map ``request.auth``, or None."""
+    request = get_current_request()
+    if request is not None:
+        signed = request.cookies.get(USER_COOKIE_NAME)
+        payload = _decode_payload(signed)
+        if payload is not None:
+            return {
+                'id': payload['id'],
+                'roles': list(payload.get('roles') or []),
+                'data': dict(payload.get('data') or {}),
+            }
+    return _from_request_auth()
+
+
+def get_user_id() -> Any | None:
+    user = current_user()
+    return None if user is None else user.get('id')
+
+
+def login_user(
+    user_id: Any,
+    *,
+    roles: list[str] | None = None,
+    data: dict[str, Any] | None = None,
+    max_age: int = DEFAULT_MAX_AGE,
+) -> dict[str, Any]:
+    """Mark the current request's principal as logged in (signed cookie)."""
+    cm = get_cookie_manager()
+    if cm is None:
+        raise RuntimeError('login_user() must be called inside an HTTP request handler')
+
+    now = time.time()
+    payload = {
+        'id': user_id,
+        'roles': list(roles or []),
+        'data': dict(data or {}),
+        'exp': now + max_age if max_age and max_age > 0 else None,
+    }
+    signed = _encode_payload(payload)
+    cm.set_cookie(
+        cookie_name=USER_COOKIE_NAME,
+        cookie_value=signed,
+        httponly=True,
+        secure=https_enabled(),
+        samesite='Strict',
+        max_age=max_age if max_age and max_age > 0 else None,
+    )
+    return {
+        'id': user_id,
+        'roles': list(roles or []),
+        'data': dict(data or {}),
+    }
+
+
+def logout_user() -> None:
+    """Clear the login cookie on the current response."""
+    cm = get_cookie_manager()
+    if cm is None:
+        raise RuntimeError('logout_user() must be called inside an HTTP request handler')
+    cm.delete_cookie(
+        cookie_name=USER_COOKIE_NAME,
+        httponly=True,
+        secure=https_enabled(),
+        samesite='Strict',
+    )