scalio-identity 0.1.0__tar.gz

scalio_identity-0.1.0/PKG-INFO

@@ -0,0 +1,61 @@
+Metadata-Version: 2.4
+Name: scalio-identity
+Version: 0.1.0
+Summary: Sign-in through Scalio ID, Entra app roles and second factor, shared by the Scalio apps
+License: Proprietary
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: PyJWT[crypto]>=2.10
+Requires-Dist: httpx>=0.27
+Provides-Extra: mfa
+Requires-Dist: pyotp>=2.9; extra == "mfa"
+Requires-Dist: webauthn>=2.0; extra == "mfa"
+Provides-Extra: testing
+Requires-Dist: cbor2>=5.6; extra == "testing"
+Requires-Dist: cryptography>=42; extra == "testing"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pyotp>=2.9; extra == "dev"
+Requires-Dist: webauthn>=2.0; extra == "dev"
+Requires-Dist: cbor2>=5.6; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+
+# scalio-identity
+
+Identity helpers shared by the Scalio apps Nexus, Citadel, Rosetta and Foundry. Decisions: scalio-docs ADR 0028
+(`idm/I1`–`I12`), concept `concepts/central-user-management.md`. Protocol of the broker: scalio-docs
+`interfaces/scalio-id-oidc.md`.
+
+```
+pip install "scalio-identity[mfa]"          # app
+pip install "scalio-identity[mfa,testing]"  # app tests
+```
+
+| Module | What it does |
+| --- | --- |
+| `scalio_identity.broker` | Sign-in through Scalio ID: `Broker.from_env()`, `Flow.new()`, `authorize_url()`, `redeem()` → `Identity`; `check_binding()` refuses another organisation (`SCALIO_ORG_ID`) or tenant |
+| `scalio_identity.roles` | `RoleMap("Nexus", {"Admin": "admin", ...})`: Entra app roles (`Nexus.Admin`) → app role, unknown = no rights |
+| `scalio_identity.accounts` | Account lookup by Scalio ID subject, then Microsoft tenant + object id; e-mail only for a one-time link |
+| `scalio_identity.mfa` | TOTP (replay safe), backup codes, passkeys (WebAuthn, user verification required) |
+| `scalio_identity.testing` | `FakeBroker` (Scalio ID in memory, `httpx.MockTransport`) and `SoftKey` (software passkey) |
+
+The app keeps its routes, state storage, sessions and accounts; this package only checks.
+
+## Settings of an app
+
+| Variable | Meaning |
+| --- | --- |
+| `SCALIO_ID_ISSUER` | broker, e.g. `https://sso.scaliocloud.com`; empty = Scalio ID off |
+| `SCALIO_ID_CLIENT_ID` | the app's origin; default from the app's own URL |
+| `SCALIO_ORG_ID` | Scalio organisation of a SaaS instance (set at provisioning); empty on self-hosted |
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+Release: bump `pyproject.toml` and `__version__`, CHANGELOG line, merge, then "Freigeben" in the Scalio Dev
+cockpit (or Actions → Publish with the version). PyPI trusted publishing, environment `pypi`, no token.

scalio_identity-0.1.0/README.md

@@ -0,0 +1,38 @@
+# scalio-identity
+
+Identity helpers shared by the Scalio apps Nexus, Citadel, Rosetta and Foundry. Decisions: scalio-docs ADR 0028
+(`idm/I1`–`I12`), concept `concepts/central-user-management.md`. Protocol of the broker: scalio-docs
+`interfaces/scalio-id-oidc.md`.
+
+```
+pip install "scalio-identity[mfa]"          # app
+pip install "scalio-identity[mfa,testing]"  # app tests
+```
+
+| Module | What it does |
+| --- | --- |
+| `scalio_identity.broker` | Sign-in through Scalio ID: `Broker.from_env()`, `Flow.new()`, `authorize_url()`, `redeem()` → `Identity`; `check_binding()` refuses another organisation (`SCALIO_ORG_ID`) or tenant |
+| `scalio_identity.roles` | `RoleMap("Nexus", {"Admin": "admin", ...})`: Entra app roles (`Nexus.Admin`) → app role, unknown = no rights |
+| `scalio_identity.accounts` | Account lookup by Scalio ID subject, then Microsoft tenant + object id; e-mail only for a one-time link |
+| `scalio_identity.mfa` | TOTP (replay safe), backup codes, passkeys (WebAuthn, user verification required) |
+| `scalio_identity.testing` | `FakeBroker` (Scalio ID in memory, `httpx.MockTransport`) and `SoftKey` (software passkey) |
+
+The app keeps its routes, state storage, sessions and accounts; this package only checks.
+
+## Settings of an app
+
+| Variable | Meaning |
+| --- | --- |
+| `SCALIO_ID_ISSUER` | broker, e.g. `https://sso.scaliocloud.com`; empty = Scalio ID off |
+| `SCALIO_ID_CLIENT_ID` | the app's origin; default from the app's own URL |
+| `SCALIO_ORG_ID` | Scalio organisation of a SaaS instance (set at provisioning); empty on self-hosted |
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+Release: bump `pyproject.toml` and `__version__`, CHANGELOG line, merge, then "Freigeben" in the Scalio Dev
+cockpit (or Actions → Publish with the version). PyPI trusted publishing, environment `pypi`, no token.

scalio_identity-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "scalio-identity"
+version = "0.1.0"
+description = "Sign-in through Scalio ID, Entra app roles and second factor, shared by the Scalio apps"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Proprietary" }
+dependencies = ["PyJWT[crypto]>=2.10", "httpx>=0.27"]
+
+[project.optional-dependencies]
+mfa = ["pyotp>=2.9", "webauthn>=2.0"]
+testing = ["cbor2>=5.6", "cryptography>=42"]
+dev = ["pytest>=8", "pytest-asyncio>=0.23", "pyotp>=2.9", "webauthn>=2.0", "cbor2>=5.6", "ruff>=0.6"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 120
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B"]
+ignore = ["B008"]
+
+[tool.ruff.lint.per-file-ignores]
+# copied unchanged from the apps; webauthn raises several exception types
+"tests/test_mfa.py" = ["B017"]

scalio_identity-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

scalio_identity-0.1.0/src/scalio_identity/__init__.py

@@ -0,0 +1,16 @@
+"""Shared identity helpers of the Scalio apps (Nexus, Citadel, Rosetta, Foundry).
+
+- broker: sign-in through Scalio ID (OpenID Connect, PKCE, nonce), checked identity, instance binding
+- roles: Entra app roles (claim `roles`) -> the app's own role
+- accounts: which stored account belongs to an identity (Microsoft tenant + object id, never e-mail alone)
+- mfa: second factor for local accounts (TOTP, backup codes, passkeys), extra `mfa`
+- testing: fake Scalio ID broker and software passkey for app tests, extra `testing`
+
+Decisions: scalio-docs ADR 0028 (idm/I1-I12).
+"""
+from .broker import Broker, CodeRejected, Flow, Identity, IdentityRejected, NotAllowed, check_binding, error_code
+from .roles import RoleMap
+
+__all__ = ["Broker", "CodeRejected", "Flow", "Identity", "IdentityRejected", "NotAllowed", "RoleMap",
+           "check_binding", "error_code"]
+__version__ = "0.1.0"

scalio_identity-0.1.0/src/scalio_identity/accounts.py

@@ -0,0 +1,55 @@
+"""Which stored account belongs to an identity (idm, security finding N9).
+
+An account is found by the Scalio ID subject, then by Microsoft tenant + object id. E-mail is never enough on
+its own: an e-mail address can be renamed or reused, the object id cannot. Linking an existing account by
+e-mail is allowed once, for an account that has no Microsoft identity yet, and only when the app says so
+(e.g. self-registration closed, so every account was created by an admin).
+
+Field names differ per app (Citadel `scalio_sub`, Nexus camelCase), so the app passes them in.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .broker import Identity
+
+
+@dataclass(frozen=True)
+class Fields:
+    sub: str = "scalio_sub"
+    tid: str = "scalio_tid"
+    oid: str = "scalio_oid"
+    email: str = "email"
+
+
+def lookups(ident: Identity, f: Fields = Fields()) -> list[dict]:
+    """Mongo filters to try in order. Empty when the identity has neither subject nor Microsoft ids."""
+    out = []
+    if ident.sub:
+        out.append({f.sub: ident.sub})
+    if ident.is_microsoft:
+        out.append({f.tid: ident.tid, f.oid: ident.oid})
+    return out
+
+
+def email_link_filter(ident: Identity, f: Fields = Fields()) -> dict | None:
+    """Filter for the one-time e-mail link: same e-mail, no Microsoft identity or subject stored yet."""
+    if not ident.email or "@" not in ident.email:
+        return None
+    return {f.email: ident.email, f.sub: {"$exists": False}, f.oid: {"$exists": False}}
+
+
+def link_fields(ident: Identity, f: Fields = Fields()) -> dict:
+    """Fields to $set on the account when it is linked or created."""
+    doc = {f.sub: ident.sub}
+    if ident.is_microsoft:
+        doc.update({f.tid: ident.tid, f.oid: ident.oid})
+    return doc
+
+
+def same_person(account: dict, ident: Identity, f: Fields = Fields()) -> bool:
+    """True when the stored Microsoft ids (if any) match the identity. Use before trusting a lookup by sub."""
+    tid, oid = str(account.get(f.tid) or "").lower(), str(account.get(f.oid) or "").lower()
+    if not (tid or oid):
+        return True
+    return ident.is_microsoft and tid == ident.tid and oid == ident.oid

scalio_identity-0.1.0/src/scalio_identity/broker.py

@@ -0,0 +1,217 @@
+"""Sign-in through Scalio ID, the shared sign-in service of the Scalio apps (repo Scalio-Cloud/scalio-id).
+
+The app is a public client of the broker: client id = its origin, code flow with PKCE (S256) and nonce, no
+secret. This module only talks to the broker and checks what comes back. State storage, sessions and accounts
+stay in the app.
+
+    broker = Broker.from_env(fallback_origin=FRONTEND_URL)
+    flow = Flow.new()                       # store state/nonce/verifier in the app, bound to the browser
+    url = broker.authorize_url(flow)        # redirect
+    ident = await broker.redeem(code, flow.verifier, flow.nonce)
+    check_binding(ident, org_id=..., tenant_ids=...)   # raises NotAllowed
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import os
+import secrets
+import time
+from dataclasses import dataclass, field
+from urllib.parse import urlencode, urlsplit
+
+import httpx
+import jwt
+
+CALLBACK_PATH = "/api/auth/scalio/callback"
+JWKS_TTL = 3600
+LEEWAY = 60
+# Errors at the broker that only mean "no silent sign-in possible": show the normal login page.
+SILENT_ERRORS = ("login_required", "consent_required", "interaction_required")
+
+
+class CodeRejected(Exception):
+    """The broker did not accept the code (expired, used, wrong verifier)."""
+
+
+class IdentityRejected(Exception):
+    """The ID token is invalid (signature, audience, issuer, nonce, expiry, missing claims)."""
+
+
+class NotAllowed(Exception):
+    """A valid identity that may not use this instance (other organisation or tenant)."""
+
+    def __init__(self, reason: str):
+        super().__init__(reason)
+        self.reason = reason
+
+
+def origin(url: str) -> str:
+    """scheme://host[:port] in lower case, or "" for anything that is not http(s)."""
+    parts = urlsplit((url or "").strip())
+    if parts.scheme not in ("http", "https") or not parts.netloc:
+        return ""
+    return f"{parts.scheme}://{parts.netloc}".lower()
+
+
+def _b64u(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+@dataclass(frozen=True)
+class Flow:
+    """Secrets of one sign-in. The app stores them (hash the state) and binds them to the browser."""
+    state: str
+    nonce: str
+    verifier: str
+
+    @classmethod
+    def new(cls) -> Flow:
+        return cls(*(secrets.token_urlsafe(32) for _ in range(3)))
+
+    @property
+    def challenge(self) -> str:
+        return _b64u(hashlib.sha256(self.verifier.encode()).digest())
+
+
+@dataclass(frozen=True)
+class Identity:
+    """A checked identity from the broker's ID token."""
+    sub: str
+    idp: str = ""
+    tid: str = ""
+    oid: str = ""
+    email: str = ""
+    name: str = ""
+    org: str = ""            # Scalio organisation (Scalio Konto, idm/I2); empty until the broker sends it
+    app_role: str = ""       # role for this app from Scalio Konto (idm/I3)
+    roles: tuple[str, ...] = ()   # Entra app roles, already limited to this app by the broker or RoleMap
+    via_msp: str = ""        # MSP organisation acting for the customer (idm/I8)
+    claims: dict = field(default_factory=dict, repr=False, compare=False)
+
+    @property
+    def is_microsoft(self) -> bool:
+        return self.idp == "entra" and bool(self.tid and self.oid)
+
+    @classmethod
+    def from_claims(cls, c: dict) -> Identity:
+        roles = c.get("roles") or ()
+        if isinstance(roles, str):
+            roles = (roles,)
+        return cls(sub=str(c["sub"]), idp=str(c.get("idp") or ""), tid=str(c.get("tid") or "").lower(),
+                   oid=str(c.get("oid") or "").lower(), email=str(c.get("email") or "").strip().lower(),
+                   name=str(c.get("name") or "").strip(), org=str(c.get("org") or ""),
+                   app_role=str(c.get("app_role") or ""), roles=tuple(str(r) for r in roles if r),
+                   via_msp=str(c.get("via_msp") or ""), claims=dict(c))
+
+
+def error_code(error: str, description: str = "") -> str:
+    """Broker error -> short code for the login page: personal, tenant_not_allowed, cancelled, failed."""
+    if error == "access_denied":
+        if description == "entra_personal_account":
+            return "personal"
+        if description == "entra_tenant_not_allowed":
+            return "tenant_not_allowed"
+        if description.startswith("microsoft_") or description == "consent_denied":
+            return "cancelled"
+    return "failed"
+
+
+def check_binding(ident: Identity, org_id: str = "", tenant_ids=()) -> None:
+    """Refuse an identity of another customer. Raises NotAllowed("org" | "tenant").
+
+    org_id: the instance's Scalio organisation (SCALIO_ORG_ID, set at provisioning). When set, the token must
+    carry exactly this organisation, so a token for customer A never works at customer B.
+    tenant_ids: Microsoft tenants of this installation; when given, a Microsoft identity must come from one.
+    """
+    if org_id and not secrets.compare_digest(ident.org, org_id):
+        raise NotAllowed("org")
+    allowed = {t.strip().lower() for t in tenant_ids if t and t.strip()}
+    if allowed and ident.idp == "entra" and ident.tid not in allowed:
+        raise NotAllowed("tenant")
+
+
+def org_id_from_env() -> str:
+    return os.environ.get("SCALIO_ORG_ID", "").strip()
+
+
+class Broker:
+    def __init__(self, issuer: str, client_id: str, transport: httpx.AsyncBaseTransport | None = None,
+                 callback_path: str = CALLBACK_PATH):
+        self.issuer = (issuer or "").strip().rstrip("/")
+        self.client_id = origin(client_id)
+        self.callback_path = callback_path
+        self.transport = transport  # tests: httpx.MockTransport (testing.FakeBroker)
+        self._jwks: dict = {}
+        self._jwks_at = 0.0
+
+    @classmethod
+    def from_env(cls, fallback_origin: str = "", **kw) -> Broker:
+        """SCALIO_ID_ISSUER (empty = off), SCALIO_ID_CLIENT_ID (default: origin of fallback_origin)."""
+        return cls(os.environ.get("SCALIO_ID_ISSUER", ""),
+                   os.environ.get("SCALIO_ID_CLIENT_ID", "").strip() or fallback_origin, **kw)
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self.issuer and self.client_id)
+
+    @property
+    def redirect_uri(self) -> str:
+        return self.client_id + self.callback_path
+
+    def authorize_url(self, flow: Flow, prompt: str = "", login_hint: str = "",
+                      scope: str = "openid email profile") -> str:
+        q = {"client_id": self.client_id, "redirect_uri": self.redirect_uri, "response_type": "code",
+             "scope": scope, "state": flow.state, "nonce": flow.nonce, "code_challenge": flow.challenge,
+             "code_challenge_method": "S256"}
+        if prompt:
+            q["prompt"] = prompt
+        if login_hint:
+            q["login_hint"] = login_hint
+        return f"{self.issuer}/authorize?{urlencode(q)}"
+
+    def issuer_matches(self, iss: str | None) -> bool:
+        """The callback's optional iss parameter (RFC 9207) must name this broker."""
+        return not iss or iss.rstrip("/") == self.issuer
+
+    def _client(self) -> httpx.AsyncClient:
+        return httpx.AsyncClient(transport=self.transport, timeout=15)
+
+    async def _key(self, kid: str):
+        if time.time() - self._jwks_at >= JWKS_TTL or kid not in self._jwks:
+            async with self._client() as c:
+                r = await c.get(f"{self.issuer}/.well-known/jwks.json")
+                r.raise_for_status()
+            self._jwks = {k["kid"]: k for k in r.json().get("keys", []) if k.get("kid")}
+            self._jwks_at = time.time()
+        if kid not in self._jwks:
+            raise IdentityRejected("unknown key")
+        return jwt.PyJWK(self._jwks[kid], algorithm="RS256").key
+
+    async def verify(self, id_token: str, nonce: str) -> Identity:
+        try:
+            header = jwt.get_unverified_header(id_token)
+            if header.get("alg") != "RS256":
+                raise IdentityRejected("algorithm")
+            c = jwt.decode(id_token, key=await self._key(str(header.get("kid") or "")), algorithms=["RS256"],
+                           audience=self.client_id, issuer=self.issuer, leeway=LEEWAY,
+                           options={"require": ["exp", "iat", "aud", "iss", "sub", "nonce"]})
+        except jwt.PyJWTError as e:
+            raise IdentityRejected(str(e)) from e
+        if not nonce or not secrets.compare_digest(str(c.get("nonce")), nonce):
+            raise IdentityRejected("nonce")
+        return Identity.from_claims(c)
+
+    async def redeem(self, code: str, verifier: str, nonce: str) -> Identity:
+        """Code -> checked Identity. Raises CodeRejected, IdentityRejected or httpx.HTTPError."""
+        async with self._client() as c:
+            r = await c.post(f"{self.issuer}/token", data={
+                "grant_type": "authorization_code", "code": code, "client_id": self.client_id,
+                "redirect_uri": self.redirect_uri, "code_verifier": verifier})
+        if r.status_code != 200:
+            raise CodeRejected()
+        try:
+            token = str((r.json() or {}).get("id_token") or "")
+        except ValueError as e:
+            raise CodeRejected() from e
+        return await self.verify(token, nonce)

scalio_identity-0.1.0/src/scalio_identity/mfa.py

@@ -0,0 +1,168 @@
+"""Second factor for local accounts: authenticator app (TOTP), backup codes and passkeys (WebAuthn).
+
+Plain helpers without database or web framework, shared by every Scalio app (package scalio-identity, ported from
+Scalio Compass). Routes and storage live in the app. Compared with Compass:
+- a TOTP code works only once (the caller stores the returned time step),
+- backup codes have 50 bits (10 characters), stored as sha256,
+- passkeys are discoverable (sign-in without email) and need user verification (PIN, Face ID),
+  so a passkey alone counts as two factors.
+"""
+import hashlib
+import hmac
+import json
+import secrets
+import time
+import uuid
+from datetime import datetime, timedelta, timezone
+from urllib.parse import urlparse
+
+import jwt
+import pyotp
+from webauthn import (
+    generate_authentication_options,
+    generate_registration_options,
+    options_to_json,
+    verify_authentication_response,
+    verify_registration_response,
+)
+from webauthn.helpers import base64url_to_bytes, bytes_to_base64url
+from webauthn.helpers.structs import (
+    AuthenticatorSelectionCriteria,
+    PublicKeyCredentialDescriptor,
+    ResidentKeyRequirement,
+    UserVerificationRequirement,
+)
+
+TOTP_STEP = 30
+CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"  # no 0/O, 1/I
+CHALLENGE_TTL = timedelta(minutes=5)
+
+
+# ---------- Authenticator app (TOTP) ----------
+def new_totp_secret() -> str:
+    return pyotp.random_base32()
+
+
+def totp_uri(secret: str, account: str, issuer: str) -> str:
+    return pyotp.TOTP(secret).provisioning_uri(name=account, issuer_name=issuer)
+
+
+def totp_match(secret: str, code: str, last_step: int = 0, at: float | None = None) -> int | None:
+    """Time step of a valid code (one step clock drift either way), None if wrong or already used.
+
+    Store the returned step and pass it as last_step next time: a code is then accepted only once.
+    """
+    code = "".join((code or "").split())
+    if not secret or len(code) != 6 or not code.isdigit():
+        return None
+    totp = pyotp.TOTP(secret)
+    now_step = int((time.time() if at is None else at) // TOTP_STEP)
+    for step in (now_step - 1, now_step, now_step + 1):
+        if step > (last_step or 0) and hmac.compare_digest(totp.at(step * TOTP_STEP), code):
+            return step
+    return None
+
+
+# ---------- Backup codes ----------
+def _norm_code(code: str) -> str:
+    return "".join(ch for ch in (code or "").upper() if ch.isalnum())
+
+
+def hash_backup_code(code: str) -> str:
+    return hashlib.sha256(_norm_code(code).encode()).hexdigest()
+
+
+def new_backup_codes(n: int = 10) -> tuple[list[str], list[str]]:
+    """n codes like ABCDE-FGH23 (shown once) and their hashes (stored)."""
+    codes = []
+    while len(codes) < n:
+        raw = "".join(secrets.choice(CODE_ALPHABET) for _ in range(10))
+        code = f"{raw[:5]}-{raw[5:]}"
+        if code not in codes:
+            codes.append(code)
+    return codes, [hash_backup_code(c) for c in codes]
+
+
+def use_backup_code(code: str, hashes: list[str]) -> list[str] | None:
+    """Remaining hashes if the code is valid, else None."""
+    if not _norm_code(code):
+        return None
+    h = hash_backup_code(code)
+    if not any(hmac.compare_digest(h, x) for x in hashes or []):
+        return None
+    return [x for x in hashes if x != h]
+
+
+# ---------- Sign-in step 2 token ----------
+def issue_mfa_token(user_id: str, secret: str, minutes: int = 5) -> tuple[str, str]:
+    """Short-lived token between password and code. Not usable as an access token."""
+    jti = uuid.uuid4().hex
+    payload = {"sub": user_id, "type": "mfa", "jti": jti,
+               "exp": datetime.now(timezone.utc) + timedelta(minutes=minutes)}
+    return jwt.encode(payload, secret, algorithm="HS256"), jti
+
+
+def read_mfa_token(token: str, secret: str) -> dict:
+    try:
+        payload = jwt.decode(token or "", secret, algorithms=["HS256"])
+    except jwt.PyJWTError as e:
+        raise ValueError("Sign-in expired. Please sign in again.") from e
+    if payload.get("type") != "mfa" or not payload.get("jti"):
+        raise ValueError("Invalid sign-in token")
+    return payload
+
+
+# ---------- Passkeys (WebAuthn) ----------
+def relying_party(origin: str, rp_id: str | None = None) -> tuple[str, str]:
+    """(rp_id, origin) for the browser origin. rp_id fixes the domain (e.g. WEBAUTHN_RP_ID)."""
+    p = urlparse(origin or "")
+    host = (p.hostname or "").lower()
+    if not host or p.scheme not in ("https", "http") or (p.scheme == "http" and host != "localhost"):
+        raise ValueError("Passkeys need the app's https address")
+    if rp_id:
+        rp_id = rp_id.lower()
+        if host != rp_id and not host.endswith("." + rp_id):
+            raise ValueError("This address cannot use passkeys")
+        return rp_id, f"{p.scheme}://{p.netloc}"
+    return host, f"{p.scheme}://{p.netloc}"
+
+
+def registration_options(rp_id: str, rp_name: str, user_handle: bytes, user_name: str, display_name: str,
+                         exclude_ids: list[str]) -> tuple[dict, str]:
+    opts = generate_registration_options(
+        rp_id=rp_id, rp_name=rp_name, user_id=user_handle, user_name=user_name,
+        user_display_name=display_name or user_name,
+        exclude_credentials=[PublicKeyCredentialDescriptor(id=base64url_to_bytes(i)) for i in exclude_ids],
+        authenticator_selection=AuthenticatorSelectionCriteria(
+            resident_key=ResidentKeyRequirement.REQUIRED, require_resident_key=True,
+            user_verification=UserVerificationRequirement.REQUIRED))
+    return json.loads(options_to_json(opts)), bytes_to_base64url(opts.challenge)
+
+
+def check_registration(response: dict, challenge: str, rp_id: str, origin: str) -> dict:
+    v = verify_registration_response(credential=response, expected_challenge=base64url_to_bytes(challenge),
+                                     expected_rp_id=rp_id, expected_origin=origin, require_user_verification=True)
+    return {"id": bytes_to_base64url(v.credential_id), "public_key": bytes_to_base64url(v.credential_public_key),
+            "sign_count": v.sign_count}
+
+
+def authentication_options(rp_id: str) -> tuple[dict, str]:
+    """Sign-in without email: the browser offers the passkeys it has for this domain."""
+    opts = generate_authentication_options(rp_id=rp_id, user_verification=UserVerificationRequirement.REQUIRED)
+    return json.loads(options_to_json(opts)), bytes_to_base64url(opts.challenge)
+
+
+def user_handle(response: dict) -> bytes:
+    raw = ((response or {}).get("response") or {}).get("userHandle") or ""
+    return base64url_to_bytes(raw) if raw else b""
+
+
+def check_authentication(response: dict, challenge: str, rp_id: str, origin: str, public_key: str,
+                         sign_count: int) -> int:
+    """New sign count; raises if the signature, challenge, origin or user verification is wrong."""
+    v = verify_authentication_response(credential=response, expected_challenge=base64url_to_bytes(challenge),
+                                       expected_rp_id=rp_id, expected_origin=origin,
+                                       credential_public_key=base64url_to_bytes(public_key),
+                                       credential_current_sign_count=sign_count or 0,
+                                       require_user_verification=True)
+    return v.new_sign_count

scalio_identity-0.1.0/src/scalio_identity/roles.py

@@ -0,0 +1,39 @@
+"""Entra app roles -> the app's own role (idm/I3).
+
+Scalio defines the app roles once in the manifest of the Scalio enterprise app, with one prefix per product
+(`Nexus.Admin`, `Citadel.Reader`, ...). The customer's IT assigns people (free) or groups (Entra ID P1) in their
+own tenant, and the claim `roles` carries them. Each app maps the part after its prefix to one of its own roles:
+
+    ROLES = RoleMap("Nexus", {"Admin": "admin", "HelpDesk": "helpdesk", "Reader": "viewer"})
+    ROLES.resolve(ident.roles)   # -> "admin", or None when no known role is assigned
+
+Rules: only roles with this app's prefix count; unknown values give no rights; several roles -> the strongest,
+in the order of the mapping (first = strongest). Prefix and names are case sensitive like in Entra.
+"""
+from __future__ import annotations
+
+
+class RoleMap:
+    def __init__(self, prefix: str, mapping: dict[str, str]):
+        if not prefix or "." in prefix:
+            raise ValueError("prefix is the product name without a dot, e.g. 'Nexus'")
+        if not mapping:
+            raise ValueError("mapping needs at least one role")
+        self.prefix = prefix
+        self.mapping = dict(mapping)
+        self._rank = {name: i for i, name in enumerate(self.mapping)}
+
+    def values(self) -> list[str]:
+        """Role values for the Entra manifest, strongest first (e.g. ['Nexus.Admin', 'Nexus.Reader'])."""
+        return [f"{self.prefix}.{name}" for name in self.mapping]
+
+    def own(self, roles) -> list[str]:
+        """The known roles of this app among `roles`, strongest first, without prefix."""
+        start = self.prefix + "."
+        names = {r[len(start):] for r in roles or () if isinstance(r, str) and r.startswith(start)}
+        return sorted((n for n in names if n in self._rank), key=self._rank.__getitem__)
+
+    def resolve(self, roles) -> str | None:
+        """The app role for the strongest assigned Entra role, or None."""
+        own = self.own(roles)
+        return self.mapping[own[0]] if own else None

scalio_identity-0.1.0/src/scalio_identity/testing/__init__.py

@@ -0,0 +1,4 @@
+"""Test helpers for the apps (extra `testing`): FakeBroker (a Scalio ID in memory) and SoftKey (a passkey)."""
+from .fake_broker import FakeBroker
+
+__all__ = ["FakeBroker"]

scalio_identity-0.1.0/src/scalio_identity/testing/fake_broker.py

@@ -0,0 +1,62 @@
+"""A Scalio ID broker in memory for app tests (httpx.MockTransport). Only for tests.
+
+    fake = FakeBroker("https://ssodev.example", client_id="https://app.example")
+    broker = Broker(fake.issuer, fake.client_id, transport=fake.transport)
+    code = fake.issue_code(nonce=flow.nonce, verifier=flow.verifier, tid="t1", oid="o1", roles=["Nexus.Admin"])
+    ident = await broker.redeem(code, flow.verifier, flow.nonce)
+"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import secrets
+import time
+from urllib.parse import parse_qsl
+
+import httpx
+import jwt
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+
+def _b64u_int(n: int) -> str:
+    raw = n.to_bytes((n.bit_length() + 7) // 8, "big")
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+class FakeBroker:
+    def __init__(self, issuer: str = "https://sso.test", client_id: str = "https://app.test", kid: str = "k1"):
+        self.issuer, self.client_id, self.kid = issuer.rstrip("/"), client_id, kid
+        self.key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+        self._codes: dict[str, dict] = {}
+        self.transport = httpx.MockTransport(self._handle)
+
+    def jwks(self) -> dict:
+        n = self.key.public_key().public_numbers()
+        return {"keys": [{"kty": "RSA", "kid": self.kid, "use": "sig", "alg": "RS256",
+                          "n": _b64u_int(n.n), "e": _b64u_int(n.e)}]}
+
+    def token(self, nonce: str, sub: str = "u1", idp: str = "entra", aud: str = "", **claims) -> str:
+        now = int(time.time())
+        body = {"iss": self.issuer, "aud": aud or self.client_id, "sub": sub, "iat": now, "exp": now + 300,
+                "nonce": nonce, "idp": idp, **{k: v for k, v in claims.items() if v is not None}}
+        return jwt.encode(body, self.key, algorithm="RS256", headers={"kid": self.kid})
+
+    def issue_code(self, nonce: str, verifier: str, **claims) -> str:
+        code = secrets.token_urlsafe(16)
+        self._codes[code] = {"verifier": verifier, "token": self.token(nonce, **claims)}
+        return code
+
+    def _handle(self, request: httpx.Request) -> httpx.Response:
+        path = request.url.path
+        if path == "/.well-known/jwks.json":
+            return httpx.Response(200, json=self.jwks())
+        if path == "/token" and request.method == "POST":
+            form = dict(parse_qsl(request.content.decode()))
+            rec = self._codes.pop(form.get("code", ""), None)
+            challenge_ok = rec and secrets.compare_digest(
+                hashlib.sha256(form.get("code_verifier", "").encode()).digest(),
+                hashlib.sha256(rec["verifier"].encode()).digest())
+            if not rec or not challenge_ok or form.get("client_id") != self.client_id:
+                return httpx.Response(400, json={"error": "invalid_grant"})
+            return httpx.Response(200, json={"id_token": rec["token"], "token_type": "Bearer"})
+        return httpx.Response(404)

scalio_identity-0.1.0/src/scalio_identity/testing/softkey.py

@@ -0,0 +1,65 @@
+"""A software passkey for tests: builds WebAuthn responses like a browser plus authenticator would.
+
+Only for tests. ES256 key, attestation "none", user presence and user verification set.
+"""
+import base64
+import hashlib
+import json
+import os
+
+import cbor2
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec
+
+
+def b64u(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def unb64u(text: str) -> bytes:
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+class SoftKey:
+    def __init__(self, rp_id: str, origin: str):
+        self.rp_id, self.origin = rp_id, origin
+        self.key = ec.generate_private_key(ec.SECP256R1())
+        self.cred_id = os.urandom(32)
+        self.user_handle = b""
+        self.counter = 0
+
+    @property
+    def id(self) -> str:
+        return b64u(self.cred_id)
+
+    def _client_data(self, kind: str, challenge: str, origin: str | None) -> bytes:
+        return json.dumps({"type": kind, "challenge": challenge, "origin": origin or self.origin,
+                           "crossOrigin": False}).encode()
+
+    def _cose_key(self) -> bytes:
+        nums = self.key.public_key().public_numbers()
+        return cbor2.dumps({1: 2, 3: -7, -1: 1, -2: nums.x.to_bytes(32, "big"), -3: nums.y.to_bytes(32, "big")})
+
+    def register(self, options: dict, origin: str | None = None, rp_id: str | None = None) -> dict:
+        """Answer to navigator.credentials.create() for the given options."""
+        self.user_handle = unb64u(options["user"]["id"])
+        rp_hash = hashlib.sha256((rp_id or self.rp_id).encode()).digest()
+        attested = bytes(16) + len(self.cred_id).to_bytes(2, "big") + self.cred_id + self._cose_key()
+        auth_data = rp_hash + bytes([0x45]) + self.counter.to_bytes(4, "big") + attested
+        att = cbor2.dumps({"fmt": "none", "attStmt": {}, "authData": auth_data})
+        return {"id": self.id, "rawId": self.id, "type": "public-key",
+                "response": {"clientDataJSON": b64u(self._client_data("webauthn.create", options["challenge"], origin)),
+                             "attestationObject": b64u(att), "transports": ["internal"]},
+                "clientExtensionResults": {}}
+
+    def assert_(self, options: dict, origin: str | None = None, uv: bool = True) -> dict:
+        """Answer to navigator.credentials.get() for the given options."""
+        self.counter += 1
+        rp_hash = hashlib.sha256(self.rp_id.encode()).digest()
+        auth_data = rp_hash + bytes([0x05 if uv else 0x01]) + self.counter.to_bytes(4, "big")
+        client = self._client_data("webauthn.get", options["challenge"], origin)
+        sig = self.key.sign(auth_data + hashlib.sha256(client).digest(), ec.ECDSA(hashes.SHA256()))
+        return {"id": self.id, "rawId": self.id, "type": "public-key",
+                "response": {"clientDataJSON": b64u(client), "authenticatorData": b64u(auth_data),
+                             "signature": b64u(sig), "userHandle": b64u(self.user_handle)},
+                "clientExtensionResults": {}}

scalio_identity-0.1.0/src/scalio_identity.egg-info/PKG-INFO

@@ -0,0 +1,61 @@
+Metadata-Version: 2.4
+Name: scalio-identity
+Version: 0.1.0
+Summary: Sign-in through Scalio ID, Entra app roles and second factor, shared by the Scalio apps
+License: Proprietary
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: PyJWT[crypto]>=2.10
+Requires-Dist: httpx>=0.27
+Provides-Extra: mfa
+Requires-Dist: pyotp>=2.9; extra == "mfa"
+Requires-Dist: webauthn>=2.0; extra == "mfa"
+Provides-Extra: testing
+Requires-Dist: cbor2>=5.6; extra == "testing"
+Requires-Dist: cryptography>=42; extra == "testing"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pyotp>=2.9; extra == "dev"
+Requires-Dist: webauthn>=2.0; extra == "dev"
+Requires-Dist: cbor2>=5.6; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+
+# scalio-identity
+
+Identity helpers shared by the Scalio apps Nexus, Citadel, Rosetta and Foundry. Decisions: scalio-docs ADR 0028
+(`idm/I1`–`I12`), concept `concepts/central-user-management.md`. Protocol of the broker: scalio-docs
+`interfaces/scalio-id-oidc.md`.
+
+```
+pip install "scalio-identity[mfa]"          # app
+pip install "scalio-identity[mfa,testing]"  # app tests
+```
+
+| Module | What it does |
+| --- | --- |
+| `scalio_identity.broker` | Sign-in through Scalio ID: `Broker.from_env()`, `Flow.new()`, `authorize_url()`, `redeem()` → `Identity`; `check_binding()` refuses another organisation (`SCALIO_ORG_ID`) or tenant |
+| `scalio_identity.roles` | `RoleMap("Nexus", {"Admin": "admin", ...})`: Entra app roles (`Nexus.Admin`) → app role, unknown = no rights |
+| `scalio_identity.accounts` | Account lookup by Scalio ID subject, then Microsoft tenant + object id; e-mail only for a one-time link |
+| `scalio_identity.mfa` | TOTP (replay safe), backup codes, passkeys (WebAuthn, user verification required) |
+| `scalio_identity.testing` | `FakeBroker` (Scalio ID in memory, `httpx.MockTransport`) and `SoftKey` (software passkey) |
+
+The app keeps its routes, state storage, sessions and accounts; this package only checks.
+
+## Settings of an app
+
+| Variable | Meaning |
+| --- | --- |
+| `SCALIO_ID_ISSUER` | broker, e.g. `https://sso.scaliocloud.com`; empty = Scalio ID off |
+| `SCALIO_ID_CLIENT_ID` | the app's origin; default from the app's own URL |
+| `SCALIO_ORG_ID` | Scalio organisation of a SaaS instance (set at provisioning); empty on self-hosted |
+
+## Development
+
+```
+pip install -e ".[dev]"
+ruff check . && pytest -q
+```
+
+Release: bump `pyproject.toml` and `__version__`, CHANGELOG line, merge, then "Freigeben" in the Scalio Dev
+cockpit (or Actions → Publish with the version). PyPI trusted publishing, environment `pypi`, no token.

scalio_identity-0.1.0/src/scalio_identity.egg-info/SOURCES.txt

@@ -0,0 +1,19 @@
+README.md
+pyproject.toml
+src/scalio_identity/__init__.py
+src/scalio_identity/accounts.py
+src/scalio_identity/broker.py
+src/scalio_identity/mfa.py
+src/scalio_identity/roles.py
+src/scalio_identity.egg-info/PKG-INFO
+src/scalio_identity.egg-info/SOURCES.txt
+src/scalio_identity.egg-info/dependency_links.txt
+src/scalio_identity.egg-info/requires.txt
+src/scalio_identity.egg-info/top_level.txt
+src/scalio_identity/testing/__init__.py
+src/scalio_identity/testing/fake_broker.py
+src/scalio_identity/testing/softkey.py
+tests/test_accounts.py
+tests/test_broker.py
+tests/test_mfa.py
+tests/test_roles.py

scalio_identity-0.1.0/src/scalio_identity.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

scalio_identity-0.1.0/src/scalio_identity.egg-info/requires.txt

@@ -0,0 +1,18 @@
+PyJWT[crypto]>=2.10
+httpx>=0.27
+
+[dev]
+pytest>=8
+pytest-asyncio>=0.23
+pyotp>=2.9
+webauthn>=2.0
+cbor2>=5.6
+ruff>=0.6
+
+[mfa]
+pyotp>=2.9
+webauthn>=2.0
+
+[testing]
+cbor2>=5.6
+cryptography>=42

scalio_identity-0.1.0/src/scalio_identity.egg-info/top_level.txt

@@ -0,0 +1 @@
+scalio_identity

scalio_identity-0.1.0/tests/test_accounts.py

@@ -0,0 +1,31 @@
+from scalio_identity import accounts
+from scalio_identity.broker import Identity
+
+MS = Identity(sub="s1", idp="entra", tid="t1", oid="o1", email="pia@acme.ch")
+NEXUS = accounts.Fields(sub="scalioSub", tid="entraTenantId", oid="entraObjectId")
+
+
+def test_lookup_by_subject_then_microsoft_ids_never_email():
+    assert accounts.lookups(MS) == [{"scalio_sub": "s1"}, {"scalio_tid": "t1", "scalio_oid": "o1"}]
+    assert accounts.lookups(MS, NEXUS)[1] == {"entraTenantId": "t1", "entraObjectId": "o1"}
+    assert all("email" not in q for q in accounts.lookups(MS))
+    assert accounts.lookups(Identity(sub="s2", idp="scalio", email="x@y.ch")) == [{"scalio_sub": "s2"}]
+
+
+def test_email_link_only_for_accounts_without_identity():
+    f = accounts.email_link_filter(MS)
+    assert f == {"email": "pia@acme.ch", "scalio_sub": {"$exists": False}, "scalio_oid": {"$exists": False}}
+    assert accounts.email_link_filter(Identity(sub="s", email="")) is None
+    assert accounts.email_link_filter(Identity(sub="s", email="no-at")) is None
+
+
+def test_link_fields():
+    assert accounts.link_fields(MS) == {"scalio_sub": "s1", "scalio_tid": "t1", "scalio_oid": "o1"}
+    assert accounts.link_fields(Identity(sub="s3", idp="scalio")) == {"scalio_sub": "s3"}
+
+
+def test_same_person_guards_stored_microsoft_ids():
+    assert accounts.same_person({}, MS)
+    assert accounts.same_person({"scalio_tid": "T1", "scalio_oid": "O1"}, MS)
+    assert not accounts.same_person({"scalio_tid": "t1", "scalio_oid": "other"}, MS)
+    assert not accounts.same_person({"scalio_tid": "t1", "scalio_oid": "o1"}, Identity(sub="s1", idp="scalio"))

scalio_identity-0.1.0/tests/test_broker.py

@@ -0,0 +1,129 @@
+"""Sign-in through Scalio ID: authorize URL, code redemption, token checks, instance binding."""
+from urllib.parse import parse_qs, urlsplit
+
+import jwt
+import pytest
+
+from scalio_identity import Broker, CodeRejected, Flow, IdentityRejected, NotAllowed, check_binding, error_code
+from scalio_identity.broker import Identity, origin
+from scalio_identity.testing import FakeBroker
+
+APP = "https://acme.ch.scalionexus.com"
+
+
+@pytest.fixture
+def fake():
+    return FakeBroker("https://sso.test", client_id=APP)
+
+
+@pytest.fixture
+def broker(fake):
+    return Broker(fake.issuer, APP + "/login?x=1", transport=fake.transport)
+
+
+def test_client_id_is_the_origin_and_off_without_issuer():
+    assert origin("HTTPS://Acme.Example:8443/path?q=1") == "https://acme.example:8443"
+    assert origin("javascript:alert(1)") == "" and origin("") == ""
+    assert not Broker("", APP).enabled
+    assert not Broker("https://sso.test", "ftp://x").enabled
+    assert Broker("https://sso.test/", APP).issuer == "https://sso.test"
+
+
+def test_from_env(monkeypatch):
+    monkeypatch.setenv("SCALIO_ID_ISSUER", "https://ssodev.scaliocloud.com/")
+    monkeypatch.delenv("SCALIO_ID_CLIENT_ID", raising=False)
+    b = Broker.from_env(fallback_origin=APP + "/")
+    assert b.enabled and b.client_id == APP and b.redirect_uri == APP + "/api/auth/scalio/callback"
+    monkeypatch.setenv("SCALIO_ID_CLIENT_ID", "https://other.example")
+    assert Broker.from_env(fallback_origin=APP).client_id == "https://other.example"
+
+
+def test_authorize_url_has_pkce_nonce_and_prompt(broker):
+    flow = Flow.new()
+    url = broker.authorize_url(flow, prompt="none", login_hint="pia@acme.ch")
+    parts = urlsplit(url)
+    q = {k: v[0] for k, v in parse_qs(parts.query).items()}
+    assert f"{parts.scheme}://{parts.netloc}{parts.path}" == "https://sso.test/authorize"
+    assert q["client_id"] == APP and q["redirect_uri"] == APP + "/api/auth/scalio/callback"
+    assert q["code_challenge_method"] == "S256" and q["code_challenge"] == flow.challenge != flow.verifier
+    assert q["state"] == flow.state and q["nonce"] == flow.nonce and q["prompt"] == "none"
+    assert q["login_hint"] == "pia@acme.ch"
+    assert "prompt" not in broker.authorize_url(flow)
+    assert len({flow.state, flow.nonce, flow.verifier}) == 3
+
+
+async def test_redeem_returns_checked_identity(fake, broker):
+    flow = Flow.new()
+    code = fake.issue_code(flow.nonce, flow.verifier, sub="s1", tid="TID-1", oid="OID-1", email="Pia@Acme.ch",
+                           name=" Pia ", org="org-acme", app_role="admin", roles=["Nexus.Admin", "Citadel.Reader"],
+                           via_msp="msp-1")
+    ident = await broker.redeem(code, flow.verifier, flow.nonce)
+    assert (ident.sub, ident.tid, ident.oid, ident.email, ident.name) == ("s1", "tid-1", "oid-1", "pia@acme.ch", "Pia")
+    assert ident.is_microsoft and ident.org == "org-acme" and ident.app_role == "admin" and ident.via_msp == "msp-1"
+    assert ident.roles == ("Nexus.Admin", "Citadel.Reader")
+
+
+async def test_code_is_single_use_and_needs_the_verifier(fake, broker):
+    flow = Flow.new()
+    code = fake.issue_code(flow.nonce, flow.verifier)
+    with pytest.raises(CodeRejected):
+        await broker.redeem(code, "wrong-verifier", flow.nonce)
+    code = fake.issue_code(flow.nonce, flow.verifier)
+    await broker.redeem(code, flow.verifier, flow.nonce)
+    with pytest.raises(CodeRejected):
+        await broker.redeem(code, flow.verifier, flow.nonce)
+
+
+@pytest.mark.parametrize("bad", ["nonce", "aud", "iss", "expired", "alg", "kid", "sig"])
+async def test_bad_tokens_are_refused(fake, broker, bad):
+    nonce = "n-1"
+    if bad == "nonce":
+        token = fake.token("other")
+    elif bad == "aud":
+        token = fake.token(nonce, aud="https://evil.example")
+    elif bad == "iss":
+        token = fake.token(nonce, iss="https://evil.example")
+    elif bad == "expired":
+        token = fake.token(nonce, iat=1, exp=2)
+    elif bad == "alg":
+        token = jwt.encode({"sub": "x", "nonce": nonce}, "k" * 32, algorithm="HS256", headers={"kid": fake.kid})
+    elif bad == "kid":
+        token = jwt.encode({"sub": "x"}, fake.key, algorithm="RS256", headers={"kid": "nope"})
+    else:
+        token = jwt.encode({"iss": fake.issuer, "aud": APP, "sub": "x", "iat": 9e9, "exp": 9e9, "nonce": nonce},
+                           FakeBroker().key, algorithm="RS256", headers={"kid": fake.kid})
+    with pytest.raises(IdentityRejected):
+        await broker.verify(token, nonce)
+
+
+async def test_empty_nonce_is_refused(fake, broker):
+    with pytest.raises(IdentityRejected):
+        await broker.verify(fake.token(""), "")
+
+
+def test_issuer_parameter_must_match(broker):
+    assert broker.issuer_matches(None) and broker.issuer_matches("https://sso.test/")
+    assert not broker.issuer_matches("https://evil.example")
+
+
+def test_error_codes():
+    assert error_code("access_denied", "entra_personal_account") == "personal"
+    assert error_code("access_denied", "entra_tenant_not_allowed") == "tenant_not_allowed"
+    assert error_code("access_denied", "microsoft_access_denied") == "cancelled"
+    assert error_code("access_denied", "consent_denied") == "cancelled"
+    assert error_code("server_error") == "failed"
+
+
+def test_binding_refuses_other_organisation_and_tenant():
+    ident = Identity(sub="s", idp="entra", tid="t-a", oid="o", org="org-a")
+    check_binding(ident)
+    check_binding(ident, org_id="org-a", tenant_ids=["T-A", ""])
+    with pytest.raises(NotAllowed) as e:
+        check_binding(ident, org_id="org-b")
+    assert e.value.reason == "org"
+    # an instance bound to an organisation refuses tokens without one (old broker, other client)
+    with pytest.raises(NotAllowed):
+        check_binding(Identity(sub="s", idp="entra", tid="t-a", oid="o"), org_id="org-a")
+    with pytest.raises(NotAllowed) as e:
+        check_binding(ident, tenant_ids=["t-b"])
+    assert e.value.reason == "tenant"

scalio_identity-0.1.0/tests/test_mfa.py

@@ -0,0 +1,118 @@
+"""Second factor helpers (mfa.py): TOTP with replay protection, backup codes, MFA tokens, passkeys."""
+import time
+
+import pyotp
+import pytest
+
+from scalio_identity import mfa
+from scalio_identity.testing.softkey import SoftKey
+
+ORIGIN, RP = "https://dev.scalionexus.com", "dev.scalionexus.com"
+
+
+def test_totp_accepts_current_code_once():
+    secret = mfa.new_totp_secret()
+    now = time.time()
+    code = pyotp.TOTP(secret).at(now)
+    step = mfa.totp_match(secret, code, last_step=0, at=now)
+    assert step == int(now // 30)
+    # the same code again (replay) is refused
+    assert mfa.totp_match(secret, code, last_step=step, at=now) is None
+    # spaces are fine, wrong codes not
+    assert mfa.totp_match(secret, f"{code[:3]} {code[3:]}", at=now) == step
+    assert mfa.totp_match(secret, "000000" if code != "000000" else "111111", at=now) is None
+    assert mfa.totp_match(secret, "", at=now) is None
+    assert mfa.totp_match("", code, at=now) is None
+
+
+def test_totp_allows_one_step_clock_drift_only():
+    secret = mfa.new_totp_secret()
+    now = 1_800_000_000
+    assert mfa.totp_match(secret, pyotp.TOTP(secret).at(now - 30), at=now) is not None
+    assert mfa.totp_match(secret, pyotp.TOTP(secret).at(now + 30), at=now) is not None
+    assert mfa.totp_match(secret, pyotp.TOTP(secret).at(now - 90), at=now) is None
+
+
+def test_totp_uri_names_issuer_and_account():
+    uri = mfa.totp_uri("JBSWY3DPEHPK3PXP", "pia@example.com", "Scalio Nexus")
+    assert uri.startswith("otpauth://totp/Scalio%20Nexus:pia%40example.com?")
+    assert "issuer=Scalio%20Nexus" in uri
+
+
+def test_backup_codes_are_strong_single_use_and_hashed():
+    codes, hashes = mfa.new_backup_codes()
+    assert len(codes) == 10 == len(set(codes))
+    assert all(len(c) == 11 and c[5] == "-" for c in codes)
+    assert not set(codes) & set(hashes)
+    # lower case and without dash also work
+    left = mfa.use_backup_code(codes[0].lower().replace("-", ""), hashes)
+    assert left is not None and len(left) == 9
+    assert mfa.use_backup_code(codes[0], left) is None
+    assert mfa.use_backup_code("", hashes) is None
+    assert mfa.hash_backup_code(codes[1]) in hashes
+
+
+def test_mfa_token_roundtrip_and_expiry():
+    token, jti = mfa.issue_mfa_token("u1", "unit-test-secret-with-32-bytes-ok!!", minutes=5)
+    p = mfa.read_mfa_token(token, "unit-test-secret-with-32-bytes-ok!!")
+    assert p["sub"] == "u1" and p["jti"] == jti
+    with pytest.raises(ValueError):
+        mfa.read_mfa_token(token, "another-unit-test-secret-32-bytes!!")
+    old, _ = mfa.issue_mfa_token("u1", "unit-test-secret-with-32-bytes-ok!!", minutes=-1)
+    with pytest.raises(ValueError):
+        mfa.read_mfa_token(old, "unit-test-secret-with-32-bytes-ok!!")
+
+
+def test_mfa_token_is_not_an_access_token():
+    import jwt
+    access = jwt.encode({"sub": "u1", "type": "access"}, "unit-test-secret-with-32-bytes-ok!!", algorithm="HS256")
+    with pytest.raises(ValueError):
+        mfa.read_mfa_token(access, "unit-test-secret-with-32-bytes-ok!!")
+
+
+def test_rp_comes_from_origin_or_fixed_rp_id():
+    assert mfa.relying_party(ORIGIN) == (RP, ORIGIN)
+    assert mfa.relying_party("http://localhost:3000") == ("localhost", "http://localhost:3000")
+    assert mfa.relying_party("https://dev.scalionexus.com", rp_id="scalionexus.com") == ("scalionexus.com", ORIGIN)
+    for bad in ("", "null", "https://evil.example.com"):
+        with pytest.raises(ValueError):
+            mfa.relying_party(bad, rp_id="scalionexus.com")
+    with pytest.raises(ValueError):
+        mfa.relying_party("http://dev.scalionexus.com")  # plain http only for localhost
+
+
+def test_passkey_register_and_sign_in():
+    key = SoftKey(RP, ORIGIN)
+    options, challenge = mfa.registration_options(RP, "Scalio Nexus", b"user-1", "pia@example.com", "Pia", [])
+    assert options["authenticatorSelection"]["residentKey"] == "required"
+    assert options["authenticatorSelection"]["userVerification"] == "required"
+    cred = mfa.check_registration(key.register(options), challenge, RP, ORIGIN)
+    assert cred["id"] == key.id and cred["sign_count"] == 0 and cred["public_key"]
+
+    # usernameless: no allowCredentials, the authenticator picks the account
+    options, challenge = mfa.authentication_options(RP)
+    assert not options.get("allowCredentials")
+    assert options["userVerification"] == "required"
+    resp = key.assert_(options)
+    assert mfa.user_handle(resp) == b"user-1"
+    assert mfa.check_authentication(resp, challenge, RP, ORIGIN, cred["public_key"], cred["sign_count"]) == 1
+
+
+def test_passkey_refuses_wrong_origin_challenge_and_missing_verification():
+    key = SoftKey(RP, ORIGIN)
+    options, challenge = mfa.registration_options(RP, "Scalio Nexus", b"user-1", "pia@example.com", "Pia", [])
+    with pytest.raises(Exception):
+        mfa.check_registration(key.register(options, origin="https://evil.example.com"), challenge, RP, ORIGIN)
+    cred = mfa.check_registration(key.register(options), challenge, RP, ORIGIN)
+
+    options, challenge = mfa.authentication_options(RP)
+    other, _ = mfa.authentication_options(RP)
+    with pytest.raises(Exception):
+        mfa.check_authentication(key.assert_(other), challenge, RP, ORIGIN, cred["public_key"], 0)
+    with pytest.raises(Exception):
+        mfa.check_authentication(key.assert_(options, uv=False), challenge, RP, ORIGIN, cred["public_key"], 0)
+
+
+def test_registration_excludes_known_credentials():
+    options, _ = mfa.registration_options(RP, "Scalio Nexus", b"user-1", "pia@example.com", "Pia", ["AAAA"])
+    assert [c["id"] for c in options["excludeCredentials"]] == ["AAAA"]

scalio_identity-0.1.0/tests/test_roles.py

@@ -0,0 +1,25 @@
+import pytest
+
+from scalio_identity import RoleMap
+
+NEXUS = RoleMap("Nexus", {"Admin": "admin", "HelpDesk": "helpdesk", "Reader": "viewer"})
+
+
+def test_strongest_known_role_of_this_app_wins():
+    assert NEXUS.resolve(["Nexus.Reader", "Nexus.Admin"]) == "admin"
+    assert NEXUS.resolve(["Nexus.HelpDesk", "Citadel.Admin"]) == "helpdesk"
+    assert NEXUS.own(["Nexus.Reader", "Nexus.Admin", "Nexus.Admin"]) == ["Admin", "Reader"]
+
+
+@pytest.mark.parametrize("roles", [None, [], ["Citadel.Admin"], ["Nexus.Owner"], ["nexus.admin"], ["Admin"],
+                                   ["Nexus.Admin.Extra"], [42]])
+def test_unknown_or_foreign_roles_give_no_rights(roles):
+    assert NEXUS.resolve(roles) is None
+
+
+def test_manifest_values_and_bad_setup():
+    assert NEXUS.values() == ["Nexus.Admin", "Nexus.HelpDesk", "Nexus.Reader"]
+    with pytest.raises(ValueError):
+        RoleMap("Nexus.", {"Admin": "admin"})
+    with pytest.raises(ValueError):
+        RoleMap("Nexus", {})