quantum-framework 0.18.0__py3-none-any.whl

quantum_admin/backend/auth_service.py

@@ -0,0 +1,394 @@
+"""
+Auth Service for Quantum Admin
+JWT-based authentication with bcrypt password hashing
+"""
+import copy
+import os
+import secrets
+import logging
+from datetime import datetime, timedelta
+from typing import Optional, Dict, Any
+from dataclasses import dataclass
+
+logger = logging.getLogger(__name__)
+
+# Try to import JWT library
+try:
+    import jwt
+    JWT_AVAILABLE = True
+except ImportError:
+    JWT_AVAILABLE = False
+    logger.warning("PyJWT not installed. Run: pip install PyJWT")
+
+# Try to import bcrypt
+try:
+    import bcrypt
+    BCRYPT_AVAILABLE = True
+except ImportError:
+    BCRYPT_AVAILABLE = False
+    logger.warning("bcrypt not installed. Run: pip install bcrypt")
+
+
+@dataclass
+class User:
+    id: int
+    username: str
+    role: str = "user"  # user, admin
+
+
+@dataclass
+class TokenPayload:
+    user_id: int
+    username: str
+    role: str
+    exp: datetime
+    iat: datetime
+
+
+class AuthConfigError(RuntimeError):
+    """The admin is configured in a way that cannot be served safely."""
+    pass
+
+
+class AuthService:
+    """JWT authentication service with bcrypt password hashing"""
+
+    # Values that used to be the defaults, and are published in this file.
+    # Refused outright: someone setting them explicitly is almost always
+    # copying an old README, not making a decision.
+    UNSAFE_SECRETS = frozenset({
+        "quantum-admin-secret-change-in-production",
+        "change-me-in-production",
+        "changeme",
+        "secret",
+    })
+    UNSAFE_PASSWORDS = frozenset({"admin", "password", "changeme", "123456"})
+
+    # The admin account. The password is set per instance in __init__ — never
+    # here, because a value on the class is shared by every instance.
+    DEFAULT_USERS = {
+        "admin": {
+            "id": 1,
+            "password_hash": None,
+            "role": "admin"
+        }
+    }
+
+    def __init__(self, secret_key: str = None, expiry_hours: int = 24):
+        """
+        Initialize auth service.
+
+        Args:
+            secret_key: JWT signing key. Falls back to JWT_SECRET_KEY, and
+                to a random per-process key when neither is set.
+            expiry_hours: Token expiry in hours
+
+        There used to be constant fallbacks here: the signing key defaulted to
+        "quantum-admin-secret-change-in-production" and the admin password to
+        "admin". Both are in the public source, so an unconfigured admin
+        accepted a token anyone could forge — full admin without ever seeing
+        the login screen — and admin/admin as well.
+
+        Now an unconfigured instance gets random values. Development still
+        works (the generated password is printed once at boot); an attacker
+        gains nothing from reading this file. With
+        QUANTUM_ADMIN_ENV=production the service refuses to start at all
+        without explicit configuration, because a random key means every
+        restart and every extra worker invalidates the sessions.
+        """
+        strict = os.environ.get("QUANTUM_ADMIN_ENV", "").lower() in (
+            "production", "prod")
+
+        configured_key = secret_key or os.environ.get("JWT_SECRET_KEY")
+        if configured_key in self.UNSAFE_SECRETS:
+            raise AuthConfigError(
+                "JWT_SECRET_KEY is set to the placeholder value that ships in "
+                "the source. Anyone can forge an admin token with it. "
+                "Generate one: python -c \"import secrets; "
+                "print(secrets.token_hex(32))\""
+            )
+        if not configured_key:
+            if strict:
+                raise AuthConfigError(
+                    "QUANTUM_ADMIN_ENV=production requires JWT_SECRET_KEY. "
+                    "Without it each process signs with its own random key "
+                    "and users are logged out at random."
+                )
+            configured_key = secrets.token_hex(32)
+            logger.warning(
+                "JWT_SECRET_KEY not set — signing with a random key for this "
+                "process only. Sessions will not survive a restart, and a "
+                "second worker will reject this one's tokens."
+            )
+        self.secret_key = configured_key
+
+        self.expiry_hours = expiry_hours
+        self.algorithm = "HS256"
+
+        # deepcopy, not copy: DEFAULT_USERS' inner dict is shared with the
+        # class, so a shallow copy let the first instance write the password
+        # hash onto the class and every later instance inherit it — including
+        # after ADMIN_PASSWORD changed.
+        self._users = copy.deepcopy(self.DEFAULT_USERS)
+
+        password = os.environ.get("ADMIN_PASSWORD")
+        if password in self.UNSAFE_PASSWORDS:
+            raise AuthConfigError(
+                f"ADMIN_PASSWORD is {password!r}, which is the first thing "
+                "anyone tries. Choose another."
+            )
+        if not password:
+            if strict:
+                raise AuthConfigError(
+                    "QUANTUM_ADMIN_ENV=production requires ADMIN_PASSWORD."
+                )
+            password = secrets.token_urlsafe(18)
+            self.generated_password = password
+            # Printed, not just logged: a generated credential nobody can read
+            # is the same as no login at all.
+            banner = (
+                "\n" + "=" * 68 +
+                "\n  Quantum Admin: no ADMIN_PASSWORD set, so one was generated"
+                "\n  for this process. It changes on every restart."
+                f"\n\n      user: admin\n      password: {password}\n\n"
+                "  Set ADMIN_PASSWORD to keep a stable login.\n" +
+                "=" * 68 + "\n"
+            )
+            print(banner)
+            logger.warning(
+                "ADMIN_PASSWORD not set — generated a random admin password "
+                "for this process (printed at startup)."
+            )
+        self._users["admin"]["password_hash"] = self._hash_password(password)
+
+    def _hash_password(self, password: str) -> str:
+        """Hash a password with bcrypt (secure, with salt)"""
+        if not BCRYPT_AVAILABLE:
+            # Fallback to less secure method if bcrypt not installed
+            import hashlib
+            logger.warning("Using SHA-256 fallback - install bcrypt for production!")
+            return "sha256:" + hashlib.sha256(password.encode()).hexdigest()
+
+        # bcrypt automatically generates a salt and includes it in the hash
+        salt = bcrypt.gensalt(rounds=12)  # Cost factor of 12 is secure and fast enough
+        password_bytes = password.encode('utf-8')
+        hashed = bcrypt.hashpw(password_bytes, salt)
+        return "bcrypt:" + hashed.decode('utf-8')
+
+    def _verify_password(self, password: str, password_hash: str) -> bool:
+        """Verify a password against its hash"""
+        if password_hash.startswith("bcrypt:"):
+            if not BCRYPT_AVAILABLE:
+                logger.error("bcrypt required to verify password but not installed")
+                return False
+            stored_hash = password_hash[7:].encode('utf-8')  # Remove "bcrypt:" prefix
+            password_bytes = password.encode('utf-8')
+            return bcrypt.checkpw(password_bytes, stored_hash)
+        elif password_hash.startswith("sha256:"):
+            # Legacy SHA-256 support (for migration)
+            import hashlib
+            stored_hash = password_hash[7:]  # Remove "sha256:" prefix
+            return hashlib.sha256(password.encode()).hexdigest() == stored_hash
+        else:
+            # Very old format without prefix (assume SHA-256)
+            import hashlib
+            return hashlib.sha256(password.encode()).hexdigest() == password_hash
+
+    # =========================================================================
+    # Authentication
+    # =========================================================================
+
+    def authenticate(self, username: str, password: str) -> Optional[Dict[str, Any]]:
+        """
+        Authenticate user and return tokens
+
+        Args:
+            username: Username
+            password: Plain text password
+
+        Returns:
+            Dict with access_token and user info, or None if invalid
+        """
+        if not JWT_AVAILABLE:
+            logger.error("PyJWT not available")
+            return None
+
+        user_data = self._users.get(username)
+        if not user_data:
+            logger.warning(f"Authentication failed: user '{username}' not found")
+            return None
+
+        if not self._verify_password(password, user_data["password_hash"]):
+            logger.warning(f"Authentication failed: invalid password for '{username}'")
+            return None
+
+        # Migrate old SHA-256 passwords to bcrypt on successful login
+        if BCRYPT_AVAILABLE and not user_data["password_hash"].startswith("bcrypt:"):
+            logger.info(f"Migrating password hash to bcrypt for user '{username}'")
+            user_data["password_hash"] = self._hash_password(password)
+
+        # Generate token
+        user = User(
+            id=user_data["id"],
+            username=username,
+            role=user_data["role"]
+        )
+
+        token = self._create_token(user)
+
+        logger.info(f"User '{username}' authenticated successfully")
+        return {
+            "access_token": token,
+            "token_type": "bearer",
+            "expires_in": self.expiry_hours * 3600,
+            "user": {
+                "id": user.id,
+                "username": user.username,
+                "role": user.role
+            }
+        }
+
+    def _create_token(self, user: User) -> str:
+        """Create JWT token for user"""
+        now = datetime.utcnow()
+        payload = {
+            "sub": str(user.id),  # JWT sub claim must be a string
+            "user_id": user.id,
+            "username": user.username,
+            "role": user.role,
+            "iat": now,
+            "exp": now + timedelta(hours=self.expiry_hours)
+        }
+        return jwt.encode(payload, self.secret_key, algorithm=self.algorithm)
+
+    def verify_token(self, token: str) -> Optional[TokenPayload]:
+        """
+        Verify JWT token and return payload
+
+        Args:
+            token: JWT token string
+
+        Returns:
+            TokenPayload or None if invalid
+        """
+        if not JWT_AVAILABLE:
+            return None
+
+        try:
+            payload = jwt.decode(
+                token,
+                self.secret_key,
+                algorithms=[self.algorithm]
+            )
+            return TokenPayload(
+                user_id=payload.get("user_id", int(payload["sub"])),
+                username=payload["username"],
+                role=payload["role"],
+                exp=datetime.fromtimestamp(payload["exp"]),
+                iat=datetime.fromtimestamp(payload["iat"])
+            )
+        except jwt.ExpiredSignatureError:
+            logger.warning("Token expired")
+            return None
+        except jwt.InvalidTokenError as e:
+            logger.warning(f"Invalid token: {e}")
+            return None
+
+    def get_current_user(self, token: str) -> Optional[User]:
+        """Get current user from token"""
+        payload = self.verify_token(token)
+        if not payload:
+            return None
+
+        return User(
+            id=payload.user_id,
+            username=payload.username,
+            role=payload.role
+        )
+
+    # =========================================================================
+    # User Management
+    # =========================================================================
+
+    def create_user(
+        self,
+        username: str,
+        password: str,
+        role: str = "user"
+    ) -> Optional[User]:
+        """Create a new user"""
+        if username in self._users:
+            logger.error(f"User '{username}' already exists")
+            return None
+
+        user_id = max(u["id"] for u in self._users.values()) + 1
+
+        self._users[username] = {
+            "id": user_id,
+            "password_hash": self._hash_password(password),
+            "role": role
+        }
+
+        logger.info(f"User '{username}' created with role '{role}'")
+        return User(id=user_id, username=username, role=role)
+
+    def change_password(self, username: str, new_password: str) -> bool:
+        """Change user password"""
+        if username not in self._users:
+            return False
+
+        self._users[username]["password_hash"] = self._hash_password(new_password)
+        logger.info(f"Password changed for user '{username}'")
+        return True
+
+    def delete_user(self, username: str) -> bool:
+        """Delete a user"""
+        if username not in self._users:
+            return False
+
+        if username == "admin":
+            logger.error("Cannot delete admin user")
+            return False
+
+        del self._users[username]
+        logger.info(f"User '{username}' deleted")
+        return True
+
+    def list_users(self) -> list:
+        """List all users (without passwords)"""
+        return [
+            {"id": data["id"], "username": username, "role": data["role"]}
+            for username, data in self._users.items()
+        ]
+
+    # =========================================================================
+    # Role Checking
+    # =========================================================================
+
+    def require_role(self, token: str, required_role: str) -> bool:
+        """Check if token has required role"""
+        payload = self.verify_token(token)
+        if not payload:
+            return False
+
+        # Admin has access to everything
+        if payload.role == "admin":
+            return True
+
+        return payload.role == required_role
+
+    def is_admin(self, token: str) -> bool:
+        """Check if token belongs to admin"""
+        return self.require_role(token, "admin")
+
+
+# Singleton instance
+_auth_service = None
+
+
+def get_auth_service() -> AuthService:
+    """Get singleton instance of AuthService"""
+    global _auth_service
+    if _auth_service is None:
+        _auth_service = AuthService()
+    return _auth_service