qodalis-cli-server-plugin-users 1.0.0b6__tar.gz

qodalis_cli_server_plugin_users-1.0.0b6/.gitignore

@@ -0,0 +1,44 @@
+# Byte-compiled / optimized
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+*.egg-info/
+dist/
+build/
+.eggs/
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Environment variables
+.env
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+TestResults/
+
+# Type checking / linting
+.mypy_cache/
+.ruff_cache/
+
+# C extensions
+*.so
+
+# IDEs and editors
+.idea/
+.vscode/*
+!.vscode/settings.json
+!.vscode/launch.json
+!.vscode/extensions.json
+
+# System files
+.DS_Store
+Thumbs.db
+node_modules/

qodalis_cli_server_plugin_users-1.0.0b6/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Qodalis Solutions
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

qodalis_cli_server_plugin_users-1.0.0b6/PKG-INFO

@@ -0,0 +1,21 @@
+Metadata-Version: 2.5
+Name: qodalis-cli-server-plugin-users
+Version: 1.0.0b6
+Summary: User management plugin for Qodalis CLI servers — authentication, sessions, groups, and audit log
+Project-URL: Homepage, https://github.com/qodalis-solutions/cli-server-python
+Project-URL: Repository, https://github.com/qodalis-solutions/cli-server-python
+Project-URL: Issues, https://github.com/qodalis-solutions/cli-server-python/issues
+Author-email: Nicolae Lupei <nicolae.lupei@qodalis.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: auth,cli,plugin,qodalis,sessions,users
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.100.0

qodalis_cli_server_plugin_users-1.0.0b6/pyproject.toml

@@ -0,0 +1,39 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "qodalis-cli-server-plugin-users"
+version = "1.0.0b6"
+description = "User management plugin for Qodalis CLI servers — authentication, sessions, groups, and audit log"
+readme = { text = "", content-type = "text/plain" }
+license = "MIT"
+requires-python = ">=3.10"
+authors = [
+    { name = "Nicolae Lupei", email = "nicolae.lupei@qodalis.com" },
+]
+keywords = ["cli", "qodalis", "users", "auth", "sessions", "plugin"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+]
+dependencies = [
+    "fastapi>=0.100.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/qodalis-solutions/cli-server-python"
+Repository = "https://github.com/qodalis-solutions/cli-server-python"
+Issues = "https://github.com/qodalis-solutions/cli-server-python/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["qodalis_cli_users"]
+
+[tool.hatch.build.targets.sdist]
+include = ["qodalis_cli_users/**"]

qodalis_cli_server_plugin_users-1.0.0b6/qodalis_cli_users/__init__.py

@@ -0,0 +1,134 @@
+"""Qodalis CLI users plugin — user management, authentication, permissions,
+sessions, groups and audit."""
+
+from __future__ import annotations
+
+import warnings
+from dataclasses import dataclass
+from typing import Any, Callable, Optional
+
+from .cli_users_builder import CliUsersBuilder, CliUsersPlugin
+from .errors import UsersApiError
+from .models import (
+    AuditEntry,
+    AuditQueryOptions,
+    Credentials,
+    ExternalAuthAdapter,
+    ExternalAuthResult,
+    Group,
+    Session,
+    SessionMetadata,
+    User,
+)
+from .permissions import has_permission, merge_permissions, permission_matches
+from .services.auth_service import (
+    DEFAULT_SESSION_TIMEOUT_MS,
+    AuthContext,
+    AuthService,
+    AuthServiceOptions,
+)
+from .services.users_service import UsersService
+from .server_protection import ServerProtectionMiddleware
+from .shell_access import UsersShellAccess
+from .stores.in_memory_audit_store import InMemoryAuditStore
+from .stores.in_memory_credential_store import InMemoryCredentialStore
+from .stores.in_memory_group_store import InMemoryGroupStore
+from .stores.in_memory_session_store import InMemorySessionStore
+from .stores.in_memory_user_store import InMemoryUserStore
+from .stores.interfaces import (
+    IAuditStore,
+    ICredentialStore,
+    IGroupStore,
+    ISessionStore,
+    IUserStore,
+)
+
+__all__ = [
+    "AuditEntry",
+    "AuditQueryOptions",
+    "AuthContext",
+    "AuthService",
+    "AuthServiceOptions",
+    "CliUsersBuilder",
+    "CliUsersPlugin",
+    "Credentials",
+    "ExternalAuthAdapter",
+    "ExternalAuthResult",
+    "Group",
+    "IAuditStore",
+    "ICredentialStore",
+    "IGroupStore",
+    "ISessionStore",
+    "IUserStore",
+    "InMemoryAuditStore",
+    "InMemoryCredentialStore",
+    "InMemoryGroupStore",
+    "InMemorySessionStore",
+    "InMemoryUserStore",
+    "Session",
+    "ServerProtectionMiddleware",
+    "SessionMetadata",
+    "User",
+    "UsersApiError",
+    "UsersPluginOptions",
+    "UsersPluginResult",
+    "UsersService",
+    "UsersShellAccess",
+    "build_users_plugin",
+    "has_permission",
+    "merge_permissions",
+    "permission_matches",
+]
+
+#: Deprecated alias of :class:`CliUsersPlugin`.
+UsersPluginResult = CliUsersPlugin
+
+
+@dataclass
+class UsersPluginOptions:
+    """Deprecated options for :func:`build_users_plugin`; use
+    :class:`CliUsersBuilder`."""
+
+    user_store: IUserStore | None = None
+    session_store: ISessionStore | None = None
+    credential_store: ICredentialStore | None = None
+    audit_store: IAuditStore | None = None
+    group_store: IGroupStore | None = None
+    session_timeout_ms: int = DEFAULT_SESSION_TIMEOUT_MS
+    default_admin_password: str | None = None
+    auth_adapter: Optional[ExternalAuthAdapter] = None
+
+
+async def build_users_plugin(
+    options: UsersPluginOptions | None = None,
+    broadcast_event: Callable[[str], Any] | None = None,
+) -> CliUsersPlugin:
+    """Deprecated: use :class:`CliUsersBuilder` and call ``startup()`` from
+    the app lifespan.  Builds the plugin and runs ``startup()`` on the
+    current loop."""
+    warnings.warn(
+        "build_users_plugin() is deprecated; use CliUsersBuilder().build() and "
+        "await plugin.startup() in the app lifespan",
+        DeprecationWarning,
+        stacklevel=2,
+    )
+    opts = options or UsersPluginOptions()
+    builder = (
+        CliUsersBuilder()
+        .set_default_admin_password(opts.default_admin_password)
+        .set_session_timeout(opts.session_timeout_ms)
+        .set_auth_adapter(opts.auth_adapter)
+    )
+    if opts.user_store:
+        builder.set_user_store(opts.user_store)
+    if opts.session_store:
+        builder.set_session_store(opts.session_store)
+    if opts.credential_store:
+        builder.set_credential_store(opts.credential_store)
+    if opts.audit_store:
+        builder.set_audit_store(opts.audit_store)
+    if opts.group_store:
+        builder.set_group_store(opts.group_store)
+    plugin = builder.build(broadcast_event)
+    await plugin.startup()
+    return plugin

qodalis_cli_server_plugin_users-1.0.0b6/qodalis_cli_users/_http.py

@@ -0,0 +1,162 @@
+"""Small HTTP/ASGI helpers (kept local so the plugin does not depend on the
+core server package)."""
+
+from __future__ import annotations
+
+import fnmatch
+from typing import Any, Iterable
+from urllib.parse import urlsplit
+
+SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+#: Key under ``scope["state"]`` where the authenticated caller is stored
+#: (shared with ``qodalis_cli.security``).
+AUTH_STATE_KEY = "qcli_auth"
+
+
+_DEFAULT_PORTS = {"http": 80, "https": 443}
+_WS_SCHEMES = {"ws": "http", "wss": "https"}
+
+
+def _scope_header(scope: Any, name: str) -> str | None:
+    raw = name.encode("latin-1")
+    for key, value in (scope.get("headers") if isinstance(scope, dict) else None) or []:
+        if key.lower() == raw:
+            return value.decode("latin-1")
+    return None
+
+
+def trusted_hops(trust_proxy: bool | int | None) -> int:
+    """Number of trusted reverse-proxy hops for a ``trust_proxy`` setting.
+
+    ``False``/``0``/``None`` trust no proxy, ``True`` one hop, an int ``n``
+    ``n`` hops; any other enabled value below 1 (a negative int) counts as
+    one hop.  ``bool`` is checked first (``True == 1`` in Python).
+    """
+    if isinstance(trust_proxy, bool):
+        return 1 if trust_proxy else 0
+    if not trust_proxy:
+        return 0
+    return max(int(trust_proxy), 1)
+
+
+def forwarded_client_ip(headers: Any, trust_proxy: bool | int | None) -> str | None:
+    """Client IP from ``X-Forwarded-For`` behind ``trust_proxy`` trusted hops.
+
+    Every proxy appends the address it saw, so only the rightmost ``n``
+    entries were written by trusted proxies; the ones to their left are
+    client-controlled.  The client IP is the entry at ``len - n`` of the
+    comma-separated, trimmed list (the rightmost entry for one hop), or the
+    leftmost entry when the list has fewer than ``n`` entries.  Returns
+    ``None`` (use the socket peer) when no proxy is trusted, the header is
+    absent/empty, or the selected entry is empty.
+    """
+    hops = trusted_hops(trust_proxy)
+    if hops == 0:
+        return None
+    entries = [
+        entry.strip()
+        for value in headers.getlist("x-forwarded-for")
+        for entry in value.split(",")
+    ]
+    if not entries:
+        return None
+    return entries[max(len(entries) - hops, 0)] or None
+
+
+def _normalize_origin(scheme: str, netloc: str) -> tuple[str, str, int] | None:
+    scheme = _WS_SCHEMES.get(scheme.strip().lower(), scheme.strip().lower())
+    if scheme not in _DEFAULT_PORTS or not netloc:
+        return None
+    try:
+        parts = urlsplit(f"//{netloc.strip()}")
+        host = (parts.hostname or "").lower()
+        port = parts.port
+    except ValueError:
+        return None
+    if not host:
+        return None
+    return scheme, host, port if port is not None else _DEFAULT_PORTS[scheme]
+
+
+def is_same_origin(origin: str | None, scope: Any, trust_proxy: bool | int = False) -> bool:
+    """True when ``origin`` equals the request's own origin (scheme + Host).
+
+    ``ws``/``wss`` map to ``http``/``https``; default ports are normalized and
+    the comparison is case-insensitive.  ``X-Forwarded-Proto`` /
+    ``X-Forwarded-Host`` are honoured only when ``trust_proxy`` is on.  A
+    same-origin request is never cross-site, so it always passes Origin checks.
+    """
+    if not origin or not isinstance(scope, dict):
+        return False
+    try:
+        o = urlsplit(origin.strip().rstrip("/"))
+    except ValueError:
+        return False
+    if o.path or o.query or o.fragment:
+        return False
+    actual = _normalize_origin(o.scheme, o.netloc)
+    if actual is None:
+        return False
+    scheme = scope.get("scheme") or "http"
+    host = _scope_header(scope, "host")
+    if trust_proxy:
+        fwd_proto = _scope_header(scope, "x-forwarded-proto")
+        fwd_host = _scope_header(scope, "x-forwarded-host")
+        if fwd_proto and fwd_proto.split(",")[0].strip():
+            scheme = fwd_proto.split(",")[0].strip()
+        if fwd_host and fwd_host.split(",")[0].strip():
+            host = fwd_host.split(",")[0].strip()
+    if not host:
+        return False
+    return actual == _normalize_origin(scheme, host)
+
+
+def origin_allowed(
+    origin: str | None,
+    allowed: Iterable[str] | None,
+    scope: Any = None,
+    trust_proxy: bool | int = False,
+) -> bool:
+    """True when ``origin`` matches ``allowed`` (``*`` globs) or, when the
+    request ``scope`` is given, equals the request's own origin."""
+    if not origin:
+        return False
+    if scope is not None and is_same_origin(origin, scope, trust_proxy):
+        return True
+    origin = origin.rstrip("/").lower()
+    for pattern in allowed or []:
+        pattern = pattern.rstrip("/").lower()
+        if pattern == "*" or pattern == origin or fnmatch.fnmatchcase(origin, pattern):
+            return True
+    return False
+
+
+def has_bearer(headers: Any) -> bool:
+    auth = headers.get("authorization", "") or ""
+    return auth[:7].lower() == "bearer " and bool(auth[7:].strip())
+
+
+def bearer_token(headers: Any) -> str | None:
+    auth = headers.get("authorization", "") or ""
+    if auth[:7].lower() != "bearer ":
+        return None
+    token = auth[7:].strip()
+    return token or None
+
+
+def get_scope_auth(scope: dict) -> Any:
+    state = scope.get("state")
+    if isinstance(state, dict):
+        return state.get(AUTH_STATE_KEY)
+    return getattr(state, AUTH_STATE_KEY, None) if state is not None else None
+
+
+def set_scope_auth(scope: dict, ctx: Any) -> None:
+    state = scope.get("state")
+    if state is None:
+        state = {}
+        scope["state"] = state
+    if isinstance(state, dict):
+        state[AUTH_STATE_KEY] = ctx
+    else:
+        setattr(state, AUTH_STATE_KEY, ctx)