pyweber 1.5.0.dev3__tar.gz → 1.6.0.dev0__tar.gz

{pyweber-1.5.0.dev3/pyweber.egg-info → pyweber-1.6.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev3
+Version: 1.6.0.dev0
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0
@@ -24,6 +24,19 @@ Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: pytest-asyncio; extra == "dev"
 Provides-Extra: fast-html
 Requires-Dist: lxml; extra == "fast-html"
+Provides-Extra: db
+Requires-Dist: sqlalchemy[asyncio]>=2.0; extra == "db"
+Requires-Dist: alembic>=1.13; extra == "db"
+Provides-Extra: db-sqlite
+Requires-Dist: aiosqlite>=0.20; extra == "db-sqlite"
+Provides-Extra: db-pg
+Requires-Dist: asyncpg>=0.29; extra == "db-pg"
+Provides-Extra: db-mysql
+Requires-Dist: aiomysql>=0.2; extra == "db-mysql"
+Provides-Extra: db-mssql
+Requires-Dist: aioodbc>=0.5; extra == "db-mssql"
+Provides-Extra: redis
+Requires-Dist: redis[hiredis]>=8.1.0; extra == "redis"
 Dynamic: license-file
 
 # Pyweber Framework

{pyweber-1.5.0.dev3 → pyweber-1.6.0.dev0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.5.0.dev3"
+version = "1.6.0.dev0"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]
@@ -29,6 +29,12 @@ include = ["pyweber*"]
 [project.optional-dependencies]
 dev = ["pytest", "pytest-cov", "pytest-asyncio"]
 fast-html = ["lxml"]
+db = ["sqlalchemy[asyncio]>=2.0", "alembic>=1.13"]
+db-sqlite = ["aiosqlite>=0.20"]
+db-pg = ["asyncpg>=0.29"]
+db-mysql = ["aiomysql>=0.2"]
+db-mssql = ["aioodbc>=0.5"]
+redis = ["redis[hiredis]>=8.1.0"]
 
 [tool.setuptools.package-data]
 pyweber = ["static/**/*", "admin/**/*"]

{pyweber-1.5.0.dev3 → pyweber-1.6.0.dev0}/pyweber/__init__.py

@@ -76,10 +76,29 @@ from .utils.security import (
     sign_value,
     unsign_value,
     generate_csrf_token,
+    get_csrf_token,
 )
 from .utils.icons import Icons
 from .utils.deprecation import warn_deprecated
 from .testing import TestClient
+from .auth import (
+    login_required,
+    login_user,
+    logout_user,
+    current_user,
+    get_user_id,
+    hash_password,
+    check_password,
+    permission_required,
+    role_required,
+    register_roles,
+    clear_roles,
+    define_role,
+    has_role,
+    has_all_roles,
+    has_permission,
+    user_permissions,
+)
 
 from .utils.types import (
     ContentTypes,
@@ -129,7 +148,6 @@ from .components.input import (
     Input,
     InputButton,
     InputCheckbox,
-    InputCheckbox,
     InputColor,
     InputDate,
     InputEmail,
@@ -200,6 +218,7 @@ __all__ = [
     'sign_value',
     'unsign_value',
     'generate_csrf_token',
+    'get_csrf_token',
     'ContentTypes',
     'EventType',
     'HTMLTag',
@@ -244,6 +263,22 @@ __all__ = [
     'SecurityEnforcer',
     'SecurityError',
     'ForbiddenError',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'current_user',
+    'get_user_id',
+    'hash_password',
+    'check_password',
+    'permission_required',
+    'role_required',
+    'register_roles',
+    'clear_roles',
+    'define_role',
+    'has_role',
+    'has_all_roles',
+    'has_permission',
+    'user_permissions',
     'Icon',
     'Style',
     'Script',
@@ -251,7 +286,6 @@ __all__ = [
     'Input',
     'InputButton',
     'InputCheckbox',
-    'InputCheckbox',
     'InputColor',
     'InputDate',
     'InputEmail',

pyweber-1.6.0.dev0/pyweber/auth/__init__.py

@@ -0,0 +1,44 @@
+"""Lightweight session login helpers (Flask-Login style, no ORM) + RBAC."""
+
+from pyweber.auth.decorators import login_required, permission_required, role_required
+from pyweber.auth.passwords import check_password, hash_password
+from pyweber.auth.rbac import (
+    RoleRegistry,
+    clear_roles,
+    define_role,
+    get_role_registry,
+    has_all_roles,
+    has_permission,
+    has_role,
+    register_roles,
+    user_permissions,
+)
+from pyweber.auth.session import (
+    USER_COOKIE_NAME,
+    current_user,
+    get_user_id,
+    login_user,
+    logout_user,
+)
+
+__all__ = [
+    'USER_COOKIE_NAME',
+    'RoleRegistry',
+    'check_password',
+    'clear_roles',
+    'current_user',
+    'define_role',
+    'get_role_registry',
+    'get_user_id',
+    'has_all_roles',
+    'has_permission',
+    'has_role',
+    'hash_password',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'permission_required',
+    'register_roles',
+    'role_required',
+    'user_permissions',
+]

pyweber-1.6.0.dev0/pyweber/auth/decorators.py

@@ -0,0 +1,201 @@
+"""``@login_required`` / ``@permission_required`` / ``@role_required``."""
+
+from __future__ import annotations
+
+import inspect
+from functools import wraps
+from typing import Any, Callable
+
+from pyweber.auth.rbac import user_has_permissions, user_has_roles
+from pyweber.auth.session import current_user
+from pyweber.models.context import get_current_request
+from pyweber.models.response import Response
+from pyweber.utils.types import ContentTypes
+
+
+def _wants_json(request) -> bool:
+    if request is None:
+        return False
+    accept = (request.headers.get('accept') or '').lower()
+    if 'application/json' in accept:
+        if 'text/html' not in accept:
+            return True
+        return accept.find('application/json') <= accept.find('text/html')
+    return False
+
+
+def _unauthorized(*, redirect: str | None, request) -> Response:
+    if redirect and not _wants_json(request):
+        return Response(
+            content=b'',
+            status=302,
+            request=request,
+            route=redirect,
+            headers={'Location': redirect},
+            content_type=ContentTypes.txt,
+        )
+    return Response.json({'detail': 'Unauthorized'}, status=401, request=request)
+
+
+def _forbidden(*, request) -> Response:
+    return Response.json({'detail': 'Forbidden'}, status=403, request=request)
+
+
+def _authorize(
+    user: dict[str, Any] | None,
+    *,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+) -> str | None:
+    """Return ``'unauthorized'``, ``'forbidden'``, or ``None`` if allowed."""
+    if user is None:
+        return 'unauthorized'
+    if not user_has_roles(user, roles, roles_all=roles_all):
+        return 'forbidden'
+    if not user_has_permissions(user, permissions, permissions_all=permissions_all):
+        return 'forbidden'
+    return None
+
+
+def _wrap_handler(
+    func: Callable,
+    *,
+    redirect: str | None,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+):
+    if inspect.iscoroutinefunction(func):
+        @wraps(func)
+        async def async_wrapper(*args, **kwargs):
+            request = get_current_request()
+            decision = _authorize(
+                current_user(),
+                roles=roles,
+                roles_all=roles_all,
+                permissions=permissions,
+                permissions_all=permissions_all,
+            )
+            if decision == 'unauthorized':
+                return _unauthorized(redirect=redirect, request=request)
+            if decision == 'forbidden':
+                return _forbidden(request=request)
+            return await func(*args, **kwargs)
+
+        return async_wrapper
+
+    @wraps(func)
+    def sync_wrapper(*args, **kwargs):
+        request = get_current_request()
+        decision = _authorize(
+            current_user(),
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+        if decision == 'unauthorized':
+            return _unauthorized(redirect=redirect, request=request)
+        if decision == 'forbidden':
+            return _forbidden(request=request)
+        return func(*args, **kwargs)
+
+    return sync_wrapper
+
+
+def login_required(
+    fn: Callable | None = None,
+    *,
+    redirect: str | None = None,
+    roles: list[str] | None = None,
+    roles_all: list[str] | None = None,
+    permissions: list[str] | None = None,
+    permissions_all: list[str] | None = None,
+):
+    """Require a logged-in user (cookie) or ``request.auth`` from OpenAPI schemes.
+
+    RBAC (optional)::
+
+        @login_required(roles=['admin', 'moderator'])          # any role
+        @login_required(roles_all=['staff', 'verified'])       # all roles
+        @login_required(permissions=['posts:write'])           # via register_roles()
+        @login_required(permissions_all=['posts:read', 'posts:write'])
+
+    Usage::
+
+        @app.route('/dash')
+        @login_required(redirect='/login')
+        def dash():
+            ...
+
+        @login_required  # bare form
+        def api_me():
+            ...
+    """
+
+    def decorator(func: Callable):
+        return _wrap_handler(
+            func,
+            redirect=redirect,
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+
+    if fn is not None and callable(fn):
+        return decorator(fn)
+    return decorator
+
+
+def permission_required(
+    *permissions: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(permissions=…)`` / ``permissions_all=``.
+
+    ::
+
+        @permission_required('posts:write')
+        def create(): ...
+
+        @permission_required('a', 'b', require_all=True)
+        def both(): ...
+    """
+    if not permissions:
+        raise TypeError('permission_required() needs at least one permission')
+    perms = list(permissions)
+    return login_required(
+        redirect=redirect,
+        permissions=None if require_all else perms,
+        permissions_all=perms if require_all else None,
+    )
+
+
+def role_required(
+    *roles: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(roles=…)`` / ``roles_all=``.
+
+    ::
+
+        @role_required('admin')
+        def admin_panel(): ...
+
+        @role_required('staff', 'verified', require_all=True)
+        def staff_only(): ...
+    """
+    if not roles:
+        raise TypeError('role_required() needs at least one role')
+    rs = list(roles)
+    return login_required(
+        redirect=redirect,
+        roles=None if require_all else rs,
+        roles_all=rs if require_all else None,
+    )

pyweber-1.6.0.dev0/pyweber/auth/passwords.py

@@ -0,0 +1,52 @@
+"""Password hashing helpers (stdlib PBKDF2-HMAC-SHA256)."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+DEFAULT_ITERATIONS = 260_000
+_SCHEME = 'pbkdf2_sha256'
+
+
+def hash_password(password: str, *, iterations: int = DEFAULT_ITERATIONS) -> str:
+    """Hash a password for storage.
+
+    Format: ``pbkdf2_sha256$<iterations>$<salt_hex>$<digest_hex>``
+    """
+    if not isinstance(password, str) or password == '':
+        raise ValueError('password must be a non-empty string')
+    salt = secrets.token_hex(16)
+    digest = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        bytes.fromhex(salt),
+        iterations,
+    ).hex()
+    return f'{_SCHEME}${iterations}${salt}${digest}'
+
+
+def check_password(password: str, encoded: str) -> bool:
+    """Constant-time verify of ``password`` against ``hash_password`` output."""
+    if not password or not encoded or not isinstance(encoded, str):
+        return False
+    try:
+        scheme, iter_s, salt, digest = encoded.split('$', 3)
+    except ValueError:
+        return False
+    if scheme != _SCHEME:
+        return False
+    try:
+        iterations = int(iter_s)
+        salt_b = bytes.fromhex(salt)
+        expected = bytes.fromhex(digest)
+    except (TypeError, ValueError):
+        return False
+    actual = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        salt_b,
+        iterations,
+    )
+    return hmac.compare_digest(actual, expected)

pyweber-1.6.0.dev0/pyweber/auth/rbac.py

@@ -0,0 +1,184 @@
+"""Lightweight role → permission registry (no ORM).
+
+Define roles once, then gate routes with ``permissions=`` / helpers::
+
+    from pyweber.auth import register_roles, has_permission, login_required
+
+    register_roles({
+        'admin': ['*'],
+        'editor': ['posts:read', 'posts:write'],
+        'viewer': ['posts:read'],
+    })
+
+    @app.route('/posts', methods=['POST'])
+    @login_required(permissions=['posts:write'])
+    def create_post():
+        ...
+"""
+
+from __future__ import annotations
+
+from typing import Any, Iterable
+
+from pyweber.auth.session import current_user
+
+# Wildcard: full access, or ``resource:*`` for a namespace.
+ALL_PERMISSIONS = '*'
+
+
+class RoleRegistry:
+    """Map role names to permission strings."""
+
+    def __init__(self) -> None:
+        self._roles: dict[str, set[str]] = {}
+
+    def clear(self) -> None:
+        self._roles.clear()
+
+    def role(self, name: str, permissions: Iterable[str] | None = None) -> None:
+        self._roles[str(name)] = {str(p) for p in (permissions or [])}
+
+    def register(self, mapping: dict[str, Iterable[str]]) -> None:
+        for name, perms in mapping.items():
+            self.role(name, perms)
+
+    def get(self, name: str) -> set[str]:
+        return set(self._roles.get(str(name), set()))
+
+    def permissions_for(self, roles: Iterable[str] | None) -> set[str]:
+        out: set[str] = set()
+        for role in roles or []:
+            out |= self.get(role)
+        return out
+
+    def has_permission(self, roles: Iterable[str] | None, permission: str) -> bool:
+        return permission_matches(self.permissions_for(roles), permission)
+
+
+def permission_matches(granted: Iterable[str], needed: str) -> bool:
+    """Return True if ``needed`` is covered by ``granted`` (supports ``*`` / ``ns:*``)."""
+    need = str(needed)
+    have = {str(p) for p in granted}
+    if ALL_PERMISSIONS in have or need in have:
+        return True
+    if ':' in need:
+        ns = need.split(':', 1)[0]
+        if f'{ns}:*' in have:
+            return True
+    return False
+
+
+def permissions_match_any(granted: Iterable[str], needed: Iterable[str]) -> bool:
+    return any(permission_matches(granted, p) for p in needed)
+
+
+def permissions_match_all(granted: Iterable[str], needed: Iterable[str]) -> bool:
+    return all(permission_matches(granted, p) for p in needed)
+
+
+_registry = RoleRegistry()
+
+
+def get_role_registry() -> RoleRegistry:
+    return _registry
+
+
+def register_roles(mapping: dict[str, Iterable[str]]) -> None:
+    """Register or replace role → permission mappings (process-wide)."""
+    _registry.register(mapping)
+
+
+def define_role(name: str, permissions: Iterable[str] | None = None) -> None:
+    _registry.role(name, permissions)
+
+
+def clear_roles() -> None:
+    """Clear the process-wide role registry (useful in tests)."""
+    _registry.clear()
+
+
+def _user_role_names(user: dict[str, Any] | None = None) -> list[str]:
+    u = user if user is not None else current_user()
+    if not u:
+        return []
+    return [str(r) for r in (u.get('roles') or [])]
+
+
+def _direct_permissions(user: dict[str, Any] | None = None) -> set[str]:
+    """Extra permissions stored on the session (``data['permissions']``)."""
+    u = user if user is not None else current_user()
+    if not u:
+        return set()
+    data = u.get('data') or {}
+    raw = data.get('permissions') or []
+    if isinstance(raw, str):
+        return {raw}
+    return {str(p) for p in raw}
+
+
+def user_permissions(user: dict[str, Any] | None = None) -> set[str]:
+    """Expanded permissions for the current (or given) user."""
+    u = user if user is not None else current_user()
+    if not u:
+        return set()
+    return _registry.permissions_for(_user_role_names(u)) | _direct_permissions(u)
+
+
+def has_role(*roles: str, require_all: bool = False, user: dict[str, Any] | None = None) -> bool:
+    """True if the user has any (default) or all of the given roles."""
+    u = user if user is not None else current_user()
+    if not u or not roles:
+        return False
+    have = {str(r) for r in (u.get('roles') or [])}
+    need = {str(r) for r in roles}
+    if require_all:
+        return need <= have
+    return bool(have & need)
+
+
+def has_all_roles(*roles: str, user: dict[str, Any] | None = None) -> bool:
+    return has_role(*roles, require_all=True, user=user)
+
+
+def has_permission(
+    *permissions: str,
+    require_all: bool = False,
+    user: dict[str, Any] | None = None,
+) -> bool:
+    """True if the user has any (default) or all of the given permissions."""
+    if not permissions:
+        return False
+    granted = user_permissions(user)
+    if require_all:
+        return permissions_match_all(granted, permissions)
+    return permissions_match_any(granted, permissions)
+
+
+def user_has_roles(
+    user: dict[str, Any],
+    roles: list[str] | None = None,
+    *,
+    roles_all: list[str] | None = None,
+) -> bool:
+    if roles_all:
+        if not has_role(*roles_all, require_all=True, user=user):
+            return False
+    if roles:
+        if not has_role(*roles, require_all=False, user=user):
+            return False
+    return True
+
+
+def user_has_permissions(
+    user: dict[str, Any],
+    permissions: list[str] | None = None,
+    *,
+    permissions_all: list[str] | None = None,
+) -> bool:
+    if permissions_all:
+        if not has_permission(*permissions_all, require_all=True, user=user):
+            return False
+    if permissions:
+        if not has_permission(*permissions, require_all=False, user=user):
+            return False
+    return True