simplesitesearch 0.0.6__tar.gz → 0.0.7__tar.gz

{simplesitesearch-0.0.6/simplesitesearch.egg-info → simplesitesearch-0.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplesitesearch
-Version: 0.0.6
+Version: 0.0.7
 Summary: Reptile Simple Site Search django app
 Home-page: https://github.com/FlavienLouis/simplesitesearch
 Author: Reptile Tech
@@ -160,6 +160,49 @@ Pagination links preserve the tag filter.
 
 The search includes basic honeypot protection. If a `message` parameter is present, the search will not execute.
 
+## Indexing authentication (optional)
+
+When crawling or indexing protected CMS content, enable opaque bearer-token auth so indexers can act as a configured Django user.
+
+### Settings
+
+```python
+SIMPLE_SITE_SEARCH_INDEXING_ENABLED = True
+SIMPLE_SITE_SEARCH_INDEXING_USER = "indexer"  # username, user id, or pk string
+SIMPLE_SITE_SEARCH_INDEXING_BOOTSTRAP_TOKEN = "your-long-random-secret"
+
+# Optional (defaults shown)
+SIMPLE_SITE_SEARCH_INDEXING_ACCESS_TTL = 3600       # seconds
+SIMPLE_SITE_SEARCH_INDEXING_REFRESH_TTL = 86400      # seconds
+SIMPLE_SITE_SEARCH_INDEXING_CACHE_PREFIX = "sss_idx"
+```
+
+Use a shared Django cache backend in multi-worker deployments so tokens are visible across processes.
+
+### Middleware
+
+Add after `AuthenticationMiddleware`:
+
+```python
+MIDDLEWARE = [
+    # ...
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "simplesitesearch.indexing_middleware.IndexingAccessTokenMiddleware",
+    # ...
+]
+```
+
+### Token endpoints
+
+Both endpoints are under the same URL prefix as search (e.g. `/search/` when included at `path('search/', include('simplesitesearch.urls'))`):
+
+| Endpoint | Auth header | Response |
+|----------|-------------|----------|
+| `POST …/internal/indexing/token/` | `Authorization: Bearer <bootstrap_token>` | `access_token`, `refresh_token`, `expires_in`, `refresh_expires_in` |
+| `POST …/internal/indexing/refresh/` | `Authorization: Bearer <refresh_token>` | New token pair (refresh rotation) |
+
+Send the access token on subsequent requests; the middleware logs in the configured user for that request.
+
 ## Utility functions (QOL)
 
 The app provides helpers in `simplesitesearch.utils` for use in views, management commands, or other code.
@@ -285,6 +328,9 @@ For support and questions, please open an issue on the [GitHub repository](https
 
 ## Changelog
 
+### 0.0.7
+- **Added** optional indexing authentication: bootstrap/refresh token endpoints, cache-backed opaque tokens, and `IndexingAccessTokenMiddleware` for indexer login via Bearer access tokens.
+
 ### 0.0.6
 - **Changed** search results: API hits normalized for templates (`display_title`, `snippet`, domain/type/language/tags/date metadata); highlighted title when available.
 - **Changed** templates: `{% load static %}` instead of deprecated `staticfiles` (Django 4+).

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7}/README.md

@@ -114,6 +114,49 @@ Pagination links preserve the tag filter.
 
 The search includes basic honeypot protection. If a `message` parameter is present, the search will not execute.
 
+## Indexing authentication (optional)
+
+When crawling or indexing protected CMS content, enable opaque bearer-token auth so indexers can act as a configured Django user.
+
+### Settings
+
+```python
+SIMPLE_SITE_SEARCH_INDEXING_ENABLED = True
+SIMPLE_SITE_SEARCH_INDEXING_USER = "indexer"  # username, user id, or pk string
+SIMPLE_SITE_SEARCH_INDEXING_BOOTSTRAP_TOKEN = "your-long-random-secret"
+
+# Optional (defaults shown)
+SIMPLE_SITE_SEARCH_INDEXING_ACCESS_TTL = 3600       # seconds
+SIMPLE_SITE_SEARCH_INDEXING_REFRESH_TTL = 86400      # seconds
+SIMPLE_SITE_SEARCH_INDEXING_CACHE_PREFIX = "sss_idx"
+```
+
+Use a shared Django cache backend in multi-worker deployments so tokens are visible across processes.
+
+### Middleware
+
+Add after `AuthenticationMiddleware`:
+
+```python
+MIDDLEWARE = [
+    # ...
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "simplesitesearch.indexing_middleware.IndexingAccessTokenMiddleware",
+    # ...
+]
+```
+
+### Token endpoints
+
+Both endpoints are under the same URL prefix as search (e.g. `/search/` when included at `path('search/', include('simplesitesearch.urls'))`):
+
+| Endpoint | Auth header | Response |
+|----------|-------------|----------|
+| `POST …/internal/indexing/token/` | `Authorization: Bearer <bootstrap_token>` | `access_token`, `refresh_token`, `expires_in`, `refresh_expires_in` |
+| `POST …/internal/indexing/refresh/` | `Authorization: Bearer <refresh_token>` | New token pair (refresh rotation) |
+
+Send the access token on subsequent requests; the middleware logs in the configured user for that request.
+
 ## Utility functions (QOL)
 
 The app provides helpers in `simplesitesearch.utils` for use in views, management commands, or other code.
@@ -239,6 +282,9 @@ For support and questions, please open an issue on the [GitHub repository](https
 
 ## Changelog
 
+### 0.0.7
+- **Added** optional indexing authentication: bootstrap/refresh token endpoints, cache-backed opaque tokens, and `IndexingAccessTokenMiddleware` for indexer login via Bearer access tokens.
+
 ### 0.0.6
 - **Changed** search results: API hits normalized for templates (`display_title`, `snippet`, domain/type/language/tags/date metadata); highlighted title when available.
 - **Changed** templates: `{% load static %}` instead of deprecated `staticfiles` (Django 4+).

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "simplesitesearch"
-version = "0.0.6"
+version = "0.0.7"
 description = "Reptile Simple Site Search django app"
 readme = "README.md"
 license = {text = "MIT"}

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = simplesitesearch
-version = 0.0.6
+version = 0.0.7
 author = Reptile Tech
 author_email = flouis@reptile.tech
 description = Reptile Simple Site Search django app

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7}/setup.py

@@ -8,7 +8,7 @@ with open("README.md", "r", encoding="utf-8") as fh:
 
 setup(
     name="simplesitesearch",
-    version="0.0.6",
+    version="0.0.7",
     author="Reptile Tech",
     author_email="flouis@reptile.tech",
     description="Reptile Simple Site Search django app",

simplesitesearch-0.0.7/simplesitesearch/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.0.7"

simplesitesearch-0.0.7/simplesitesearch/indexing.py

@@ -0,0 +1,156 @@
+"""
+Opaque indexing tokens stored in Django cache (shared backend required in multi-worker setups).
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import secrets
+from typing import Optional, Tuple
+
+from django.conf import settings
+from django.core.cache import cache
+
+
+def indexing_cache_prefix() -> str:
+    return getattr(
+        settings,
+        "SIMPLE_SITE_SEARCH_INDEXING_CACHE_PREFIX",
+        "sss_idx",
+    )
+
+
+def access_ttl_seconds() -> int:
+    return int(
+        getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_ACCESS_TTL", 3600)
+    )
+
+
+def refresh_ttl_seconds() -> int:
+    return int(
+        getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_REFRESH_TTL", 86400)
+    )
+
+
+def _hash_token(raw: str) -> str:
+    return hashlib.sha256(raw.encode("utf-8")).hexdigest()
+
+
+def access_cache_key(raw_access_token: str) -> str:
+    return "%s:a:%s" % (indexing_cache_prefix(), _hash_token(raw_access_token))
+
+
+def refresh_cache_key(raw_refresh_token: str) -> str:
+    return "%s:r:%s" % (indexing_cache_prefix(), _hash_token(raw_refresh_token))
+
+
+def parse_bearer_authorization(header_value: str) -> Optional[str]:
+    if not header_value:
+        return None
+    parts = header_value.split(None, 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        return None
+    token = parts[1].strip()
+    return token or None
+
+
+def bootstrap_token_valid(given: str) -> bool:
+    expected = getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_BOOTSTRAP_TOKEN", "") or ""
+    if not expected or not given:
+        return False
+    try:
+        eb = expected.encode("utf-8")
+        gb = given.encode("utf-8")
+    except UnicodeEncodeError:
+        return False
+    if len(eb) != len(gb):
+        return False
+    return hmac.compare_digest(eb, gb)
+
+
+def issue_token_pair(user_id: int) -> Tuple[str, str, int, int]:
+    access = secrets.token_urlsafe(32)
+    refresh = secrets.token_urlsafe(32)
+    at = access_ttl_seconds()
+    rt = refresh_ttl_seconds()
+    cache.set(
+        access_cache_key(access),
+        json.dumps({"user_id": user_id}),
+        at,
+    )
+    cache.set(
+        refresh_cache_key(refresh),
+        json.dumps({"user_id": user_id}),
+        rt,
+    )
+    return access, refresh, at, rt
+
+
+def lookup_access_user_id(raw_access_token: str) -> Optional[int]:
+    raw = cache.get(access_cache_key(raw_access_token))
+    if raw is None:
+        return None
+    if isinstance(raw, bytes):
+        raw = raw.decode("utf-8")
+    try:
+        data = json.loads(raw)
+        uid = data.get("user_id")
+        return int(uid) if uid is not None else None
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return None
+
+
+def consume_refresh_and_rotate(user_id: int, old_refresh: str) -> Optional[Tuple[str, str, int, int]]:
+    """
+    Validate refresh token, delete it, issue new access + refresh (rotation).
+    Returns (access, refresh, access_ttl, refresh_ttl) or None if invalid.
+    """
+    rkey = refresh_cache_key(old_refresh)
+    raw = cache.get(rkey)
+    if raw is None:
+        return None
+    if isinstance(raw, bytes):
+        raw = raw.decode("utf-8")
+    try:
+        data = json.loads(raw)
+        if int(data.get("user_id")) != int(user_id):
+            return None
+    except (TypeError, ValueError, json.JSONDecodeError):
+        return None
+    cache.delete(rkey)
+    return issue_token_pair(user_id)
+
+
+def lookup_refresh_user_id(raw_refresh_token: str) -> Optional[int]:
+    rkey = refresh_cache_key(raw_refresh_token)
+    raw = cache.get(rkey)
+    if raw is None:
+        return None
+    if isinstance(raw, bytes):
+        raw = raw.decode("utf-8")
+    try:
+        data = json.loads(raw)
+        return int(data["user_id"])
+    except (TypeError, ValueError, KeyError, json.JSONDecodeError):
+        return None
+
+
+def resolve_indexing_user_id() -> Optional[int]:
+    spec = getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_USER", None)
+    if spec is None:
+        return None
+    from django.contrib.auth import get_user_model
+
+    User = get_user_model()
+    if isinstance(spec, int):
+        pk = spec
+    else:
+        s = str(spec).strip()
+        if s.isdigit():
+            pk = int(s)
+        else:
+            lookup = {User.USERNAME_FIELD: s}
+            u = User.objects.filter(**lookup).values_list("pk", flat=True).first()
+            return int(u) if u is not None else None
+    return pk if User.objects.filter(pk=pk).exists() else None

simplesitesearch-0.0.7/simplesitesearch/indexing_middleware.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+from django.conf import settings
+from django.contrib.auth import get_user_model, login
+
+from .indexing import lookup_access_user_id, parse_bearer_authorization
+
+
+def _skip_for_path(path: str) -> bool:
+    if "internal/indexing/token" in path or "internal/indexing/refresh" in path:
+        return True
+    return False
+
+
+class IndexingAccessTokenMiddleware:
+    """
+    After AuthenticationMiddleware: if Authorization Bearer matches a valid indexing
+    access token, log in as the configured indexer user for this request.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_ENABLED", False):
+            return self.get_response(request)
+        if _skip_for_path(getattr(request, "path", "") or ""):
+            return self.get_response(request)
+        authz = request.META.get("HTTP_AUTHORIZATION", "")
+        token = parse_bearer_authorization(authz)
+        if not token:
+            return self.get_response(request)
+        user_id = lookup_access_user_id(token)
+        if user_id is None:
+            return self.get_response(request)
+        User = get_user_model()
+        try:
+            user = User.objects.get(pk=user_id, is_active=True)
+        except User.DoesNotExist:
+            return self.get_response(request)
+        login(
+            request,
+            user,
+            backend="django.contrib.auth.backends.ModelBackend",
+        )
+        return self.get_response(request)

simplesitesearch-0.0.7/simplesitesearch/indexing_views.py

@@ -0,0 +1,70 @@
+from __future__ import annotations
+
+from django.conf import settings
+from django.http import JsonResponse
+from django.views.decorators.csrf import csrf_exempt
+from django.views.decorators.http import require_POST
+
+from .indexing import (
+    bootstrap_token_valid,
+    consume_refresh_and_rotate,
+    issue_token_pair,
+    lookup_refresh_user_id,
+    parse_bearer_authorization,
+    resolve_indexing_user_id,
+)
+
+
+def _indexing_disabled_response():
+    return JsonResponse({"detail": "indexing_disabled"}, status=403)
+
+
+def _json_error(detail: str, status: int):
+    return JsonResponse({"detail": detail}, status=status)
+
+
+@csrf_exempt
+@require_POST
+def obtain_indexing_token(request):
+    if not getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_ENABLED", False):
+        return _indexing_disabled_response()
+    user_id = resolve_indexing_user_id()
+    if user_id is None:
+        return _json_error("indexing_user_not_configured", 503)
+    token = parse_bearer_authorization(request.META.get("HTTP_AUTHORIZATION", ""))
+    if not token or not bootstrap_token_valid(token):
+        return _json_error("invalid_bootstrap", 401)
+    access, refresh, at, rt = issue_token_pair(user_id)
+    return JsonResponse(
+        {
+            "access_token": access,
+            "refresh_token": refresh,
+            "expires_in": at,
+            "refresh_expires_in": rt,
+        }
+    )
+
+
+@csrf_exempt
+@require_POST
+def refresh_indexing_token(request):
+    if not getattr(settings, "SIMPLE_SITE_SEARCH_INDEXING_ENABLED", False):
+        return _indexing_disabled_response()
+    token = parse_bearer_authorization(request.META.get("HTTP_AUTHORIZATION", ""))
+    if not token:
+        return _json_error("missing_refresh", 401)
+    user_id = lookup_refresh_user_id(token)
+    if user_id is None:
+        return _json_error("invalid_refresh", 401)
+    pair = consume_refresh_and_rotate(user_id, token)
+    if pair is None:
+        return _json_error("invalid_refresh", 401)
+    access, refresh, at, rt = pair
+    return JsonResponse(
+        {
+            "access_token": access,
+            "refresh_token": refresh,
+            "expires_in": at,
+            "refresh_expires_in": rt,
+        }
+    )

simplesitesearch-0.0.7/simplesitesearch/urls.py

@@ -0,0 +1,17 @@
+from django.urls import re_path
+
+from . import indexing_views, views
+
+urlpatterns = [
+    re_path(r'^$', views.SearchResult.as_view(), name='search'),
+    re_path(
+        r'^internal/indexing/token/?$',
+        indexing_views.obtain_indexing_token,
+        name='sss_indexing_token',
+    ),
+    re_path(
+        r'^internal/indexing/refresh/?$',
+        indexing_views.refresh_indexing_token,
+        name='sss_indexing_refresh',
+    ),
+]

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7/simplesitesearch.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: simplesitesearch
-Version: 0.0.6
+Version: 0.0.7
 Summary: Reptile Simple Site Search django app
 Home-page: https://github.com/FlavienLouis/simplesitesearch
 Author: Reptile Tech
@@ -160,6 +160,49 @@ Pagination links preserve the tag filter.
 
 The search includes basic honeypot protection. If a `message` parameter is present, the search will not execute.
 
+## Indexing authentication (optional)
+
+When crawling or indexing protected CMS content, enable opaque bearer-token auth so indexers can act as a configured Django user.
+
+### Settings
+
+```python
+SIMPLE_SITE_SEARCH_INDEXING_ENABLED = True
+SIMPLE_SITE_SEARCH_INDEXING_USER = "indexer"  # username, user id, or pk string
+SIMPLE_SITE_SEARCH_INDEXING_BOOTSTRAP_TOKEN = "your-long-random-secret"
+
+# Optional (defaults shown)
+SIMPLE_SITE_SEARCH_INDEXING_ACCESS_TTL = 3600       # seconds
+SIMPLE_SITE_SEARCH_INDEXING_REFRESH_TTL = 86400      # seconds
+SIMPLE_SITE_SEARCH_INDEXING_CACHE_PREFIX = "sss_idx"
+```
+
+Use a shared Django cache backend in multi-worker deployments so tokens are visible across processes.
+
+### Middleware
+
+Add after `AuthenticationMiddleware`:
+
+```python
+MIDDLEWARE = [
+    # ...
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "simplesitesearch.indexing_middleware.IndexingAccessTokenMiddleware",
+    # ...
+]
+```
+
+### Token endpoints
+
+Both endpoints are under the same URL prefix as search (e.g. `/search/` when included at `path('search/', include('simplesitesearch.urls'))`):
+
+| Endpoint | Auth header | Response |
+|----------|-------------|----------|
+| `POST …/internal/indexing/token/` | `Authorization: Bearer <bootstrap_token>` | `access_token`, `refresh_token`, `expires_in`, `refresh_expires_in` |
+| `POST …/internal/indexing/refresh/` | `Authorization: Bearer <refresh_token>` | New token pair (refresh rotation) |
+
+Send the access token on subsequent requests; the middleware logs in the configured user for that request.
+
 ## Utility functions (QOL)
 
 The app provides helpers in `simplesitesearch.utils` for use in views, management commands, or other code.
@@ -285,6 +328,9 @@ For support and questions, please open an issue on the [GitHub repository](https
 
 ## Changelog
 
+### 0.0.7
+- **Added** optional indexing authentication: bootstrap/refresh token endpoints, cache-backed opaque tokens, and `IndexingAccessTokenMiddleware` for indexer login via Bearer access tokens.
+
 ### 0.0.6
 - **Changed** search results: API hits normalized for templates (`display_title`, `snippet`, domain/type/language/tags/date metadata); highlighted title when available.
 - **Changed** templates: `{% load static %}` instead of deprecated `staticfiles` (Django 4+).

{simplesitesearch-0.0.6 → simplesitesearch-0.0.7}/simplesitesearch.egg-info/SOURCES.txt

@@ -6,6 +6,9 @@ setup.cfg
 setup.py
 simplesitesearch/__init__.py
 simplesitesearch/cms_apps.py
+simplesitesearch/indexing.py
+simplesitesearch/indexing_middleware.py
+simplesitesearch/indexing_views.py
 simplesitesearch/urls.py
 simplesitesearch/utils.py
 simplesitesearch/views.py

simplesitesearch-0.0.6/simplesitesearch/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.0.6"

simplesitesearch-0.0.6/simplesitesearch/urls.py

@@ -1,7 +0,0 @@
-from django.urls import include, re_path
-
-from . import views
-
-urlpatterns = [
-    re_path(r'^$', views.SearchResult.as_view(), name='search'),
-]