soliplex 0.83__tar.gz → 0.83.2__tar.gz

soliplex-0.83.2/MANIFEST.in

@@ -0,0 +1,2 @@
+global-include SKILL.md
+include src/soliplex/views/templates/*.mako

{soliplex-0.83/src/soliplex.egg-info → soliplex-0.83.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soliplex
-Version: 0.83
+Version: 0.83.2
 Summary: An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface.
 Author-email: Enfold <info@enfoldsystems.net>
 Classifier: Programming Language :: Python :: 3

{soliplex-0.83 → soliplex-0.83.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "soliplex"
-version = "0.83"
+version = "0.83.2"
 description = "An AI-powered Retrieval-Augmented Generation (RAG) system with a modern web interface."
 authors = [{ name = "Enfold", email = "info@enfoldsystems.net" }]
 readme = "README.md"

soliplex-0.83.2/src/soliplex/authn.py

@@ -0,0 +1,155 @@
+"""Soliplex authentication support"""
+
+import typing
+
+import fastapi
+import jwt
+import starlette.config
+from authlib.integrations import starlette_client
+from fastapi import security
+
+from soliplex import installation
+from soliplex import loggers
+from soliplex.config import authsystem as config_authsystem
+
+UserClaims = dict[str, typing.Any]
+
+oauth2_scheme = security.OAuth2PasswordBearer(
+    tokenUrl="token",
+    auto_error=False,
+)
+oauth2_predicate = fastapi.Depends(oauth2_scheme)
+
+
+_oauth = None
+
+JWT_VALIDATION_NO_TOKEN = "JWT validation failed (no token)"
+JWT_VALIDATION_INVALID_TOKEN = "JWT validation failed (invalid token)"
+
+
+def _get_authsystem_config(
+    *,
+    the_installation: installation.Installation,
+    logger: loggers.LogWrapper,
+    system: str,
+) -> config_authsystem.OIDCAuthSystemConfig:
+    """Return the indicated authsystem config
+
+    Raise a 404 if the system is in no-auth mode, or if the named
+    authsystem config is not found.
+    """
+    msg = loggers.AUTHN_NO_AUTH_MODE
+
+    for config in the_installation.oidc_auth_system_configs:
+        msg = loggers.AUTHN_UNKNOWN_AUTHSYSTEM
+
+        if config.id == system:
+            return config
+
+    logger.error(msg)
+    raise fastapi.HTTPException(
+        status_code=404,
+        detail=msg,
+    )
+
+
+def get_oauth(
+    the_installation: installation.Installation,
+) -> starlette_client.OAuth:
+    global _oauth
+
+    if _oauth is None:
+        config_data = {}  # Or use .env
+        config = starlette.config.Config(environ=config_data)
+        _oauth = starlette_client.OAuth(config)
+
+        for auth_system in the_installation.oidc_auth_system_configs:
+            auth_system_kwargs = auth_system.oauth_client_kwargs
+            _oauth.register(**auth_system_kwargs)
+
+    return _oauth
+
+
+def authenticate(
+    the_installation: installation.Installation,
+    logger: loggers.LogWrapper,
+    token: str,
+) -> UserClaims:
+    # See #316
+    if the_installation.auth_disabled:
+        return installation.NO_AUTH_MODE_USER_TOKEN
+
+    if token is None:
+        logger.info(loggers.AUTHN_JWT_NOT_SET)
+        raise fastapi.HTTPException(
+            status_code=401,
+            detail=JWT_VALIDATION_NO_TOKEN,
+        )
+
+    errors = {}  # accumulated; only reported if all systems miss
+
+    for auth_system in the_installation.oidc_auth_system_configs:
+        payload, msg = validate_access_token(
+            token,
+            auth_system,
+        )
+        if payload is not None:
+            return payload
+
+        errors[auth_system.id] = msg
+
+    for oidc_system_id, msg in errors.items():
+        logger.error(
+            loggers.AUTHN_JWT_INVALID,
+            oidc_system_id=oidc_system_id,
+            reason=msg,
+        )
+
+    raise fastapi.HTTPException(
+        status_code=401,
+        detail=JWT_VALIDATION_INVALID_TOKEN,
+    )
+
+
+def validate_access_token(
+    token: str,
+    auth_system: config_authsystem.OIDCAuthSystemConfig,
+) -> tuple[dict | None, str | None, int | None]:
+    """Return '(payload, None)'  if successful
+
+    Return '(None, msg)' if failed.
+    """
+    payload = msg = None
+    try:
+        payload = jwt.decode(
+            token,
+            auth_system.token_validation_pem,
+            algorithms=["RS256"],
+            issuer=auth_system.issuer,
+            options={
+                "verify_aud": False,
+                "require": ["exp", "iat", "iss", "sub"],
+            },
+        )
+    except jwt.InvalidIssuerError:
+        msg = loggers.AUTHN_JWT_PARSE_INVALID_ISS
+    except jwt.InvalidSignatureError:
+        msg = loggers.AUTHN_JWT_PARSE_INVALID_SIG
+    except jwt.MissingRequiredClaimError as exc:
+        msg = f"{loggers.AUTHN_JWT_PARSE_REQUIRED_CLAIM}:{exc.claim}"
+    except jwt.ExpiredSignatureError:
+        msg = loggers.AUTHN_JWT_PARSE_EXPIRED_SIG
+    except jwt.InvalidTokenError:
+        msg = loggers.AUTHN_JWT_PARSE_OTHER
+
+    if msg is not None:
+        return None, msg
+
+    if payload.get("azp") not in auth_system.accepted_azp_list:
+        return None, loggers.AUTHN_JWT_BIND_AZP
+
+    for claim, expected in auth_system.required_claims.items():
+        if payload.get(claim) != expected:
+            return None, f"{loggers.AUTHN_JWT_BIND_CLAIM}:{claim}"
+
+    return payload, None

{soliplex-0.83 → soliplex-0.83.2}/src/soliplex/config/authsystem.py

@@ -1,6 +1,7 @@
 from __future__ import annotations  # forward refs in typing decls
 
 import dataclasses
+import enum
 import pathlib
 import ssl
 import typing
@@ -12,6 +13,7 @@ from . import interpolation as config_interp
 if typing.TYPE_CHECKING:  # avoid an import cycle at runtime
     from . import installation as config_installation
 
+_default_list_field = _utils._default_list_field
 _no_repr_no_compare_none = _utils._no_repr_no_compare_none
 _secret_whole_or_literal_field = config_interp.secret_whole_or_literal_field
 
@@ -23,6 +25,11 @@ _secret_whole_or_literal_field = config_interp.secret_whole_or_literal_field
 WELL_KNOWN_OPENID_CONFIGURATION = ".well-known/openid-configuration"
 
 
+class UnlistedFrontendOriginPolicy(enum.StrEnum):
+    CONSENT_REQUIRED = "consent-required"
+    DENY_ALL = "deny-all"
+
+
 @dataclasses.dataclass(kw_only=True)
 class OIDCAuthSystemConfig:
     id: str
@@ -36,6 +43,65 @@ class OIDCAuthSystemConfig:
     # literal.  'env:' markers are not honored here.
     client_secret: str = _secret_whole_or_literal_field(default="")
     oidc_client_pem_path: pathlib.Path = None
+    consent_template_path: pathlib.Path = None
+
+    allowed_frontend_origins: list[str] = _default_list_field()
+    unlisted_frontend_origin: UnlistedFrontendOriginPolicy = (
+        UnlistedFrontendOriginPolicy.CONSENT_REQUIRED
+    )
+
+    _accepted_azp_list: list[str] | None = None
+
+    @property
+    def accepted_azp_list(self) -> list[str]:
+        """Accepted values for the 'azp' token claim."""
+        if self._accepted_azp_list is not None:
+            return self._accepted_azp_list
+        else:
+            return [self.client_id]
+
+    _issuer: str | None = None
+
+    @property
+    def issuer(self) -> str:
+        """Expected value for the 'iss' token claim."""
+        if self._issuer is not None:
+            return self._issuer
+        else:
+            return self.server_url
+
+    # Required claims: must match values
+    required_claims: dict[str, str] = _utils._default_dict_field()
+
+    @property
+    def server_metadata_url(self):
+        """URL for discovery of OAuth metadata"""
+        return f"{self.server_url}/{WELL_KNOWN_OPENID_CONFIGURATION}"
+
+    @property
+    def oauth_client_kwargs(self) -> dict:
+        """Registered kwargs for this authsystem's 'ouath' client factory"""
+        client_kwargs = {}
+
+        if self.scope is not None:
+            client_kwargs["scope"] = self.scope
+
+        if self.oidc_client_pem_path is not None:
+            client_kwargs["verify"] = ssl.create_default_context(
+                cafile=self.oidc_client_pem_path
+            )
+
+        client_secret = config_interp.resolve_field(self, "client_secret")
+
+        return {
+            "name": self.id,
+            "server_metadata_url": self.server_metadata_url,
+            "client_id": self.client_id,
+            "client_secret": client_secret,
+            "client_kwargs": client_kwargs,
+            # added by the auth setup
+            # "authorize_state": main.SESSION_SECRET_KEY,
+        }
 
     # Set in 'from_yaml' below
     _installation_config: config_installation.InstallationConfig = (
@@ -59,6 +125,26 @@ class OIDCAuthSystemConfig:
                 config_path.parent / oidc_client_pem_path
             )
 
+        consent_template_path = config_dict.pop("consent_template_path", None)
+        if consent_template_path is not None:
+            config_dict["consent_template_path"] = (
+                config_path.parent / consent_template_path
+            )
+
+        ufo = config_dict.pop("unlisted_frontend_origin", None)
+        if ufo is not None:
+            config_dict["unlisted_frontend_origin"] = (
+                UnlistedFrontendOriginPolicy(ufo)
+            )
+
+        aal = config_dict.pop("accepted_azp_list", None)
+        if aal is not None:
+            config_dict["_accepted_azp_list"] = aal
+
+        iss = config_dict.pop("issuer", None)
+        if iss is not None:
+            config_dict["_issuer"] = iss
+
         try:
             return cls(**config_dict)
         except Exception as exc:
@@ -89,32 +175,26 @@ class OIDCAuthSystemConfig:
             # Absolutized against the config dir on load.  See #1228.
             result["oidc_client_pem_path"] = str(self.oidc_client_pem_path)
 
-        return result
+        if self.consent_template_path is not None:
+            # Absolutized against the config dir on load.  See #1228.
+            result["consent_template_path"] = str(self.consent_template_path)
 
-    @property
-    def server_metadata_url(self):
-        return f"{self.server_url}/{WELL_KNOWN_OPENID_CONFIGURATION}"
+        if self.allowed_frontend_origins:
+            result["allowed_frontend_origins"] = self.allowed_frontend_origins
 
-    @property
-    def oauth_client_kwargs(self) -> dict:
-        client_kwargs = {}
+        if (
+            self.unlisted_frontend_origin
+            is not UnlistedFrontendOriginPolicy.CONSENT_REQUIRED
+        ):
+            result["unlisted_frontend_origin"] = self.unlisted_frontend_origin
 
-        if self.scope is not None:
-            client_kwargs["scope"] = self.scope
+        if self._accepted_azp_list is not None:
+            result["accepted_azp_list"] = self._accepted_azp_list
 
-        if self.oidc_client_pem_path is not None:
-            client_kwargs["verify"] = ssl.create_default_context(
-                cafile=self.oidc_client_pem_path
-            )
+        if self._issuer is not None:
+            result["issuer"] = self._issuer
 
-        client_secret = config_interp.resolve_field(self, "client_secret")
+        if self.required_claims:
+            result["required_claims"] = self.required_claims
 
-        return {
-            "name": self.id,
-            "server_metadata_url": self.server_metadata_url,
-            "client_id": self.client_id,
-            "client_secret": client_secret,
-            "client_kwargs": client_kwargs,
-            # added by the auth setup
-            # "authorize_state": main.SESSION_SECRET_KEY,
-        }
+        return result

{soliplex-0.83 → soliplex-0.83.2}/src/soliplex/config/installation.py

@@ -1356,19 +1356,35 @@ class InstallationConfig:
             oidc_config = oidc_path / "config.yaml"
             config_yaml = _load_config_yaml(oidc_config)
 
+            top_level_defaults = {}
+
             oidc_client_pem_path = config_yaml.get("oidc_client_pem_path")
+
             if oidc_client_pem_path is not None:
-                oidc_client_pem_path = oidc_path / oidc_client_pem_path
+                top_level_defaults["oidc_client_pem_path"] = (
+                    oidc_path / oidc_client_pem_path
+                )
+
+            consent_template_path = config_yaml.get("consent_template_path")
+
+            if consent_template_path is not None:
+                top_level_defaults["consent_template_path"] = (
+                    oidc_path / consent_template_path
+                )
+
+            afo = config_yaml.get("allowed_frontend_origins")
+            if afo is not None:
+                top_level_defaults["allowed_frontend_origins"] = afo
+
+            ufo = config_yaml.get("unlisted_frontend_origin")
+            if ufo is not None:
+                top_level_defaults["unlisted_frontend_origin"] = ufo
 
             for auth_system_yaml in config_yaml["auth_systems"]:
-                if "oidc_client_pem_path" not in auth_system_yaml:
-                    auth_system_yaml["oidc_client_pem_path"] = (
-                        oidc_client_pem_path
-                    )
                 oas_config = config_authsystem.OIDCAuthSystemConfig.from_yaml(
                     self,
                     oidc_config,
-                    auth_system_yaml,
+                    top_level_defaults | auth_system_yaml,
                 )
                 oas_configs.append(oas_config)
 

{soliplex-0.83 → soliplex-0.83.2}/src/soliplex/loggers.py

@@ -45,11 +45,31 @@ UPLOADS_POST_ROOM_THREAD = "uploads post room thread"
 WORKDIRS_GET_ROOM_THREAD_RUN = "workdirs get room thread run"
 WORKDIRS_GET_ROOM_THREAD_RUN_FILE = "workdirs get room thread run file"
 
+AUTHN_BAD_REQUEST = "authn bad request"
+AUTHN_CONSENT_CANCELLED = "unlisted frontend origin: sign-in cancelled"
+AUTHN_CONSENT_CONFIRMED = "unlisted frontend origin: sign-in confirmed"
+AUTHN_CONSENT_INVALID = "unlisted frontend origin: invalid confirmation"
+AUTHN_CONSENT_REQUESTED = "unlisted frontend origin: confirmation requested"
+AUTHN_CONSENT_TEMPLATE_FAILED = "consent template failed to render"
+AUTHN_NO_RETURN_TO = "no return_to stored in session"
+AUTHN_UNLISTED_ORIGIN_DENIED = "unlisted frontend origin denied"
 AUTHN_LOGGER_NAME = "soliplex.authn"
-AUTHN_NO_AUTH_MODE = "soliplex server in no-auth mode"
-AUTHN_JWT_INVALID = "JWT validation failed"
-AUTHN_JWT_VALID = "JWT validation succeeded"
+AUTHN_UNKNOWN_AUTHSYSTEM = "unknown auth system"
 AUTHN_NO_AUTH_MODE = "system in no-auth mode"
+
+AUTHN_JWT_NOT_SET = "JWT not set"
+AUTHN_JWT_VALID = "JWT validation succeeded"
+AUTHN_JWT_INVALID = "JWT validation failed"
+
+AUTHN_JWT_PARSE_INVALID_ISS = "jwt-parse-inv-iss"
+AUTHN_JWT_PARSE_INVALID_SIG = "jwt-parse-inv-sig"
+AUTHN_JWT_PARSE_REQUIRED_CLAIM = "jwt-parse-req-claim"
+AUTHN_JWT_PARSE_EXPIRED_SIG = "jwt-parse-exp-sig"
+AUTHN_JWT_PARSE_OTHER = "jwt-parse-other"
+
+AUTHN_JWT_BIND_AZP = "jwt-bind-azp"
+AUTHN_JWT_BIND_CLAIM = "jwt-bind-claim"
+
 AUTHN_GET_LOGIN = "get login"
 AUTHN_GET_LOGIN_SYSTEM = "get login system"
 AUTHN_GET_AUTH_SYSTEM = "get auth system"

{soliplex-0.83 → soliplex-0.83.2}/src/soliplex/views/__init__.py

@@ -49,10 +49,11 @@ async def get_the_user_claims(
     try:
         return authn_module.authenticate(
             the_installation=the_installation,
+            logger=the_unauth_logger,
             token=token,
         )
     except fastapi.HTTPException:
-        the_unauth_logger.exception(
+        the_unauth_logger.error(  # noqa: TRY400 `authenticate' logged details
             loggers.AUTHN_GET_USER_CLAIMS_FAILED,
         )
         raise