qodalis-cli-server-plugin-users 1.0.0b6__py3-none-any.whl

qodalis_cli_server_plugin_users-1.0.0b6.dist-info/METADATA

@@ -0,0 +1,21 @@
+Metadata-Version: 2.5
+Name: qodalis-cli-server-plugin-users
+Version: 1.0.0b6
+Summary: User management plugin for Qodalis CLI servers — authentication, sessions, groups, and audit log
+Project-URL: Homepage, https://github.com/qodalis-solutions/cli-server-python
+Project-URL: Repository, https://github.com/qodalis-solutions/cli-server-python
+Project-URL: Issues, https://github.com/qodalis-solutions/cli-server-python/issues
+Author-email: Nicolae Lupei <nicolae.lupei@qodalis.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: auth,cli,plugin,qodalis,sessions,users
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.100.0

qodalis_cli_server_plugin_users-1.0.0b6.dist-info/RECORD

@@ -0,0 +1,32 @@
+qodalis_cli_users/__init__.py,sha256=F9xQGr9JU9Yr7r677JgWtuot8mxa9fNPXu2WPy7Y5Qw,3986
+qodalis_cli_users/_http.py,sha256=RKzT8kVz6aK8XNHLWdZ8FBDaLL_lmHgNYepPyNysaFY,5675
+qodalis_cli_users/cli_users_builder.py,sha256=otpys4dBh4XukRH-GVjfpVsxVuAaFeDhDtkZpZW29lw,16027
+qodalis_cli_users/errors.py,sha256=pdYuoSwjCA606f0qRFYUjbr8yvcBJaG78Q24QthiG8c,4292
+qodalis_cli_users/models.py,sha256=Q2CTwnBEGxL3jKQhU7FxRULCLwuFcpyjlB5qbxqU4Pc,8598
+qodalis_cli_users/permissions.py,sha256=_yUCrg5IAooNTEyF68CLcYOvuQK15eYN0Cd3p6yVDxM,1844
+qodalis_cli_users/server_protection.py,sha256=ETFw_Wict2zE0931OdHjn2iiQzti6s6TpID4G_SafDs,8547
+qodalis_cli_users/shell_access.py,sha256=8G03Ytmy1wWadgjebt0yYqQDqhtLg8LsuVg_qco2c5I,5277
+qodalis_cli_users/validation.py,sha256=CMSpDlmGT6BDVkOGh42qYe0DvgsMQSAyTsntfoDSoV4,3371
+qodalis_cli_users/controllers/__init__.py,sha256=uc06EpxRVwjBZ8LjiQHYePviyDRasrcJFJGLpb0mJc0,368
+qodalis_cli_users/controllers/_routing.py,sha256=CEGOD7y9lrBvBWWydOnqtTDQG8zXCpmS7SBmhKUASPU,781
+qodalis_cli_users/controllers/audit_controller.py,sha256=HxankpCkMsWgpW8uei_I3jZLENoKYURTwp6sx2uf5ps,1356
+qodalis_cli_users/controllers/groups_controller.py,sha256=4JtqUBl1WDRAKL_yhbzgboFIyOXl_Amsv6v07shqqNM,4012
+qodalis_cli_users/controllers/sessions_controller.py,sha256=7t3cTD-nsHPfC2Ux5DrAslfU0l1yo9bGp_KiFUXMMUc,4745
+qodalis_cli_users/controllers/users_controller.py,sha256=qLChQzpAGdIBeJ3HhOcA1HyMxYOsm3UyMQ5onlJmt2I,6937
+qodalis_cli_users/middleware/__init__.py,sha256=LmdPf8wm9S5yoBPTzls0d4UIxboUo0BqfiCVH4k72Dg,172
+qodalis_cli_users/middleware/auth_middleware.py,sha256=78cu9PstBpTyGlH5HqO_TPLj2e-HAG0lH5u3OuOPLqo,3123
+qodalis_cli_users/services/__init__.py,sha256=Y7SU5E8XOgpVkaQ7E0cxylhgPRtpQuiXak81L9Ua1fA,249
+qodalis_cli_users/services/auth_service.py,sha256=_nzc19v4_GiAjZ4Zrp6l1dVYOTJ25Y_asg5mXzZixmk,30767
+qodalis_cli_users/services/password_hasher.py,sha256=90813Z2Nk2N_PK0Kggpl1e5MMFZGZJIYrs51FbbeToA,3670
+qodalis_cli_users/services/users_service.py,sha256=9C2-FQ3CdjktO9Q04vq3r9PLH7EMzwSLXNpf_8__iFM,13459
+qodalis_cli_users/stores/__init__.py,sha256=T0qCMrETLtvP77B7mMqYLJ7_aOpdloMmTVQJOQAvzwU,696
+qodalis_cli_users/stores/in_memory_audit_store.py,sha256=ku17nYZo0bMlY07UL-P7pXRCRn2Yv03FYl4tkQJGo9U,1824
+qodalis_cli_users/stores/in_memory_credential_store.py,sha256=TT9X5wi5LV9cnANugLH89ov9KMr5x4JbEsOPl7D86kM,797
+qodalis_cli_users/stores/in_memory_group_store.py,sha256=4BwlncJ3M2MHiv-1TchuRk9kQZl3aeOlyGc-LD4mlQ0,1919
+qodalis_cli_users/stores/in_memory_session_store.py,sha256=0pT49BTfdpLIGdUs5un5y4zjKS5CnHsbPL7_drdxJ-k,2384
+qodalis_cli_users/stores/in_memory_user_store.py,sha256=SfBQKhya0K19HiG2ZsvfYtXgahdAaLtvK5POWI4KxEE,3162
+qodalis_cli_users/stores/interfaces.py,sha256=_AHmgMop6LP1Qf97e_Lz4TXSFDbY-LlEsVWJN199U7Q,5312
+qodalis_cli_server_plugin_users-1.0.0b6.dist-info/METADATA,sha256=fbv_6isoXRjhG9Yso72pz8ZgWZK_z8f3NSv5Lvvx6n8,1023
+qodalis_cli_server_plugin_users-1.0.0b6.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+qodalis_cli_server_plugin_users-1.0.0b6.dist-info/licenses/LICENSE,sha256=uagko_O2JboeVOW3cldvxKW4QIDjTHCCk5T32qqg_As,1079
+qodalis_cli_server_plugin_users-1.0.0b6.dist-info/RECORD,,

qodalis_cli_server_plugin_users-1.0.0b6.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

qodalis_cli_server_plugin_users-1.0.0b6.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Qodalis Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

qodalis_cli_users/__init__.py

@@ -0,0 +1,134 @@
+"""Qodalis CLI users plugin — user management, authentication, permissions,
+sessions, groups and audit."""
+
+from __future__ import annotations
+
+import warnings
+from dataclasses import dataclass
+from typing import Any, Callable, Optional
+
+from .cli_users_builder import CliUsersBuilder, CliUsersPlugin
+from .errors import UsersApiError
+from .models import (
+    AuditEntry,
+    AuditQueryOptions,
+    Credentials,
+    ExternalAuthAdapter,
+    ExternalAuthResult,
+    Group,
+    Session,
+    SessionMetadata,
+    User,
+)
+from .permissions import has_permission, merge_permissions, permission_matches
+from .services.auth_service import (
+    DEFAULT_SESSION_TIMEOUT_MS,
+    AuthContext,
+    AuthService,
+    AuthServiceOptions,
+)
+from .services.users_service import UsersService
+from .server_protection import ServerProtectionMiddleware
+from .shell_access import UsersShellAccess
+from .stores.in_memory_audit_store import InMemoryAuditStore
+from .stores.in_memory_credential_store import InMemoryCredentialStore
+from .stores.in_memory_group_store import InMemoryGroupStore
+from .stores.in_memory_session_store import InMemorySessionStore
+from .stores.in_memory_user_store import InMemoryUserStore
+from .stores.interfaces import (
+    IAuditStore,
+    ICredentialStore,
+    IGroupStore,
+    ISessionStore,
+    IUserStore,
+)
+
+__all__ = [
+    "AuditEntry",
+    "AuditQueryOptions",
+    "AuthContext",
+    "AuthService",
+    "AuthServiceOptions",
+    "CliUsersBuilder",
+    "CliUsersPlugin",
+    "Credentials",
+    "ExternalAuthAdapter",
+    "ExternalAuthResult",
+    "Group",
+    "IAuditStore",
+    "ICredentialStore",
+    "IGroupStore",
+    "ISessionStore",
+    "IUserStore",
+    "InMemoryAuditStore",
+    "InMemoryCredentialStore",
+    "InMemoryGroupStore",
+    "InMemorySessionStore",
+    "InMemoryUserStore",
+    "Session",
+    "ServerProtectionMiddleware",
+    "SessionMetadata",
+    "User",
+    "UsersApiError",
+    "UsersPluginOptions",
+    "UsersPluginResult",
+    "UsersService",
+    "UsersShellAccess",
+    "build_users_plugin",
+    "has_permission",
+    "merge_permissions",
+    "permission_matches",
+]
+
+#: Deprecated alias of :class:`CliUsersPlugin`.
+UsersPluginResult = CliUsersPlugin
+
+
+@dataclass
+class UsersPluginOptions:
+    """Deprecated options for :func:`build_users_plugin`; use
+    :class:`CliUsersBuilder`."""
+
+    user_store: IUserStore | None = None
+    session_store: ISessionStore | None = None
+    credential_store: ICredentialStore | None = None
+    audit_store: IAuditStore | None = None
+    group_store: IGroupStore | None = None
+    session_timeout_ms: int = DEFAULT_SESSION_TIMEOUT_MS
+    default_admin_password: str | None = None
+    auth_adapter: Optional[ExternalAuthAdapter] = None
+
+
+async def build_users_plugin(
+    options: UsersPluginOptions | None = None,
+    broadcast_event: Callable[[str], Any] | None = None,
+) -> CliUsersPlugin:
+    """Deprecated: use :class:`CliUsersBuilder` and call ``startup()`` from
+    the app lifespan.  Builds the plugin and runs ``startup()`` on the
+    current loop."""
+    warnings.warn(
+        "build_users_plugin() is deprecated; use CliUsersBuilder().build() and "
+        "await plugin.startup() in the app lifespan",
+        DeprecationWarning,
+        stacklevel=2,
+    )
+    opts = options or UsersPluginOptions()
+    builder = (
+        CliUsersBuilder()
+        .set_default_admin_password(opts.default_admin_password)
+        .set_session_timeout(opts.session_timeout_ms)
+        .set_auth_adapter(opts.auth_adapter)
+    )
+    if opts.user_store:
+        builder.set_user_store(opts.user_store)
+    if opts.session_store:
+        builder.set_session_store(opts.session_store)
+    if opts.credential_store:
+        builder.set_credential_store(opts.credential_store)
+    if opts.audit_store:
+        builder.set_audit_store(opts.audit_store)
+    if opts.group_store:
+        builder.set_group_store(opts.group_store)
+    plugin = builder.build(broadcast_event)
+    await plugin.startup()
+    return plugin

qodalis_cli_users/_http.py

@@ -0,0 +1,162 @@
+"""Small HTTP/ASGI helpers (kept local so the plugin does not depend on the
+core server package)."""
+
+from __future__ import annotations
+
+import fnmatch
+from typing import Any, Iterable
+from urllib.parse import urlsplit
+
+SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+#: Key under ``scope["state"]`` where the authenticated caller is stored
+#: (shared with ``qodalis_cli.security``).
+AUTH_STATE_KEY = "qcli_auth"
+
+
+_DEFAULT_PORTS = {"http": 80, "https": 443}
+_WS_SCHEMES = {"ws": "http", "wss": "https"}
+
+
+def _scope_header(scope: Any, name: str) -> str | None:
+    raw = name.encode("latin-1")
+    for key, value in (scope.get("headers") if isinstance(scope, dict) else None) or []:
+        if key.lower() == raw:
+            return value.decode("latin-1")
+    return None
+
+
+def trusted_hops(trust_proxy: bool | int | None) -> int:
+    """Number of trusted reverse-proxy hops for a ``trust_proxy`` setting.
+
+    ``False``/``0``/``None`` trust no proxy, ``True`` one hop, an int ``n``
+    ``n`` hops; any other enabled value below 1 (a negative int) counts as
+    one hop.  ``bool`` is checked first (``True == 1`` in Python).
+    """
+    if isinstance(trust_proxy, bool):
+        return 1 if trust_proxy else 0
+    if not trust_proxy:
+        return 0
+    return max(int(trust_proxy), 1)
+
+
+def forwarded_client_ip(headers: Any, trust_proxy: bool | int | None) -> str | None:
+    """Client IP from ``X-Forwarded-For`` behind ``trust_proxy`` trusted hops.
+
+    Every proxy appends the address it saw, so only the rightmost ``n``
+    entries were written by trusted proxies; the ones to their left are
+    client-controlled.  The client IP is the entry at ``len - n`` of the
+    comma-separated, trimmed list (the rightmost entry for one hop), or the
+    leftmost entry when the list has fewer than ``n`` entries.  Returns
+    ``None`` (use the socket peer) when no proxy is trusted, the header is
+    absent/empty, or the selected entry is empty.
+    """
+    hops = trusted_hops(trust_proxy)
+    if hops == 0:
+        return None
+    entries = [
+        entry.strip()
+        for value in headers.getlist("x-forwarded-for")
+        for entry in value.split(",")
+    ]
+    if not entries:
+        return None
+    return entries[max(len(entries) - hops, 0)] or None
+
+
+def _normalize_origin(scheme: str, netloc: str) -> tuple[str, str, int] | None:
+    scheme = _WS_SCHEMES.get(scheme.strip().lower(), scheme.strip().lower())
+    if scheme not in _DEFAULT_PORTS or not netloc:
+        return None
+    try:
+        parts = urlsplit(f"//{netloc.strip()}")
+        host = (parts.hostname or "").lower()
+        port = parts.port
+    except ValueError:
+        return None
+    if not host:
+        return None
+    return scheme, host, port if port is not None else _DEFAULT_PORTS[scheme]
+
+
+def is_same_origin(origin: str | None, scope: Any, trust_proxy: bool | int = False) -> bool:
+    """True when ``origin`` equals the request's own origin (scheme + Host).
+
+    ``ws``/``wss`` map to ``http``/``https``; default ports are normalized and
+    the comparison is case-insensitive.  ``X-Forwarded-Proto`` /
+    ``X-Forwarded-Host`` are honoured only when ``trust_proxy`` is on.  A
+    same-origin request is never cross-site, so it always passes Origin checks.
+    """
+    if not origin or not isinstance(scope, dict):
+        return False
+    try:
+        o = urlsplit(origin.strip().rstrip("/"))
+    except ValueError:
+        return False
+    if o.path or o.query or o.fragment:
+        return False
+    actual = _normalize_origin(o.scheme, o.netloc)
+    if actual is None:
+        return False
+    scheme = scope.get("scheme") or "http"
+    host = _scope_header(scope, "host")
+    if trust_proxy:
+        fwd_proto = _scope_header(scope, "x-forwarded-proto")
+        fwd_host = _scope_header(scope, "x-forwarded-host")
+        if fwd_proto and fwd_proto.split(",")[0].strip():
+            scheme = fwd_proto.split(",")[0].strip()
+        if fwd_host and fwd_host.split(",")[0].strip():
+            host = fwd_host.split(",")[0].strip()
+    if not host:
+        return False
+    return actual == _normalize_origin(scheme, host)
+
+
+def origin_allowed(
+    origin: str | None,
+    allowed: Iterable[str] | None,
+    scope: Any = None,
+    trust_proxy: bool | int = False,
+) -> bool:
+    """True when ``origin`` matches ``allowed`` (``*`` globs) or, when the
+    request ``scope`` is given, equals the request's own origin."""
+    if not origin:
+        return False
+    if scope is not None and is_same_origin(origin, scope, trust_proxy):
+        return True
+    origin = origin.rstrip("/").lower()
+    for pattern in allowed or []:
+        pattern = pattern.rstrip("/").lower()
+        if pattern == "*" or pattern == origin or fnmatch.fnmatchcase(origin, pattern):
+            return True
+    return False
+
+
+def has_bearer(headers: Any) -> bool:
+    auth = headers.get("authorization", "") or ""
+    return auth[:7].lower() == "bearer " and bool(auth[7:].strip())
+
+
+def bearer_token(headers: Any) -> str | None:
+    auth = headers.get("authorization", "") or ""
+    if auth[:7].lower() != "bearer ":
+        return None
+    token = auth[7:].strip()
+    return token or None
+
+
+def get_scope_auth(scope: dict) -> Any:
+    state = scope.get("state")
+    if isinstance(state, dict):
+        return state.get(AUTH_STATE_KEY)
+    return getattr(state, AUTH_STATE_KEY, None) if state is not None else None
+
+
+def set_scope_auth(scope: dict, ctx: Any) -> None:
+    state = scope.get("state")
+    if state is None:
+        state = {}
+        scope["state"] = state
+    if isinstance(state, dict):
+        state[AUTH_STATE_KEY] = ctx
+    else:
+        setattr(state, AUTH_STATE_KEY, ctx)