supaapps-platform93-auth 0.1.0a2__tar.gz

supaapps_platform93_auth-0.1.0a2/.gitignore

@@ -0,0 +1,38 @@
+# Local configuration and secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+
+# Local Compose credentials
+deploy/compose/secrets/
+
+# Editors and operating systems
+.DS_Store
+.idea/
+.vscode/
+
+# Dependencies
+node_modules/
+**/node_modules/
+vendor/
+
+# Build and test output
+dist/
+build/
+coverage/
+tmp/
+**/.next/
+**/out/
+**/test-results/
+**/playwright-report/
+*.log
+*.test
+*.prof
+*.tsbuildinfo
+/platform93
+__pycache__/
+*.py[cod]

supaapps_platform93_auth-0.1.0a2/PKG-INFO

@@ -0,0 +1,31 @@
+Metadata-Version: 2.4
+Name: supaapps-platform93-auth
+Version: 0.1.0a2
+Summary: Strict Platform93 JWT verification
+Project-URL: Homepage, https://github.com/supaapps/platform93
+Project-URL: Repository, https://github.com/supaapps/platform93
+Project-URL: Issues, https://github.com/supaapps/platform93/issues
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: pyjwt[crypto]<3,>=2.10
+Provides-Extra: django
+Requires-Dist: django>=5.1; extra == 'django'
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.115; extra == 'fastapi'
+Provides-Extra: flask
+Requires-Dist: flask>=3.1; extra == 'flask'
+Description-Content-Type: text/markdown
+
+# supaapps-platform93-auth
+
+Strict server-side verification for Platform93 application JWTs, including issuer,
+audience, actor type, application boundary, expiry, and JWKS rotation checks.
+
+```bash
+pip install supaapps-platform93-auth
+```
+
+Framework adapters are available through the `fastapi`, `django`, and `flask` extras.
+See the [Platform93 repository](https://github.com/supaapps/platform93) for contracts
+and integration documentation.

supaapps_platform93_auth-0.1.0a2/README.md

@@ -0,0 +1,12 @@
+# supaapps-platform93-auth
+
+Strict server-side verification for Platform93 application JWTs, including issuer,
+audience, actor type, application boundary, expiry, and JWKS rotation checks.
+
+```bash
+pip install supaapps-platform93-auth
+```
+
+Framework adapters are available through the `fastapi`, `django`, and `flask` extras.
+See the [Platform93 repository](https://github.com/supaapps/platform93) for contracts
+and integration documentation.

supaapps_platform93_auth-0.1.0a2/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "supaapps-platform93-auth"
+version = "0.1.0-alpha.2"
+description = "Strict Platform93 JWT verification"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+dependencies = ["PyJWT[crypto]>=2.10,<3", "httpx>=0.28,<1"]
+
+[project.urls]
+Homepage = "https://github.com/supaapps/platform93"
+Repository = "https://github.com/supaapps/platform93"
+Issues = "https://github.com/supaapps/platform93/issues"
+
+[project.optional-dependencies]
+fastapi = ["fastapi>=0.115"]
+django = ["django>=5.1"]
+flask = ["flask>=3.1"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/platform93_auth"]

supaapps_platform93_auth-0.1.0a2/src/platform93_auth/__init__.py

@@ -0,0 +1,3 @@
+from .verifier import Claims, Verifier
+
+__all__ = ["Claims", "Verifier"]

supaapps_platform93_auth-0.1.0a2/src/platform93_auth/django.py

@@ -0,0 +1,18 @@
+from django.http import JsonResponse
+
+from .verifier import Verifier
+
+
+class Platform93AuthenticationMiddleware:
+    def __init__(self, get_response, verifier: Verifier | None = None):
+        self.get_response = get_response
+        self.verifier = verifier
+
+    def __call__(self, request):
+        authorization = request.headers.get("Authorization", "")
+        if authorization.lower().startswith("bearer ") and self.verifier:
+            try:
+                request.platform93_claims = self.verifier.verify(authorization[7:].strip())
+            except Exception:
+                return JsonResponse({"detail": "Invalid bearer token"}, status=401)
+        return self.get_response(request)

supaapps_platform93_auth-0.1.0a2/src/platform93_auth/fastapi.py

@@ -0,0 +1,17 @@
+from typing import Annotated
+
+from fastapi import Header, HTTPException
+
+from .verifier import Claims, Verifier
+
+
+def bearer_dependency(verifier: Verifier):
+    def verify(authorization: Annotated[str | None, Header()] = None) -> Claims:
+        if not authorization or not authorization.lower().startswith("bearer "):
+            raise HTTPException(status_code=401, detail="Bearer token required")
+        try:
+            return verifier.verify(authorization[7:].strip())
+        except Exception as error:
+            raise HTTPException(status_code=401, detail="Invalid bearer token") from error
+
+    return verify

supaapps_platform93_auth-0.1.0a2/src/platform93_auth/flask.py

@@ -0,0 +1,23 @@
+from functools import wraps
+
+from flask import g, jsonify, request
+
+from .verifier import Verifier
+
+
+def require_platform93(verifier: Verifier):
+    def decorator(function):
+        @wraps(function)
+        def wrapped(*args, **kwargs):
+            authorization = request.headers.get("Authorization", "")
+            if not authorization.lower().startswith("bearer "):
+                return jsonify(detail="Bearer token required"), 401
+            try:
+                g.platform93_claims = verifier.verify(authorization[7:].strip())
+            except Exception:
+                return jsonify(detail="Invalid bearer token"), 401
+            return function(*args, **kwargs)
+
+        return wrapped
+
+    return decorator

supaapps_platform93_auth-0.1.0a2/src/platform93_auth/verifier.py

@@ -0,0 +1,82 @@
+from dataclasses import dataclass
+from typing import Any
+
+import jwt
+from jwt import PyJWKClient
+
+
+@dataclass(frozen=True)
+class Claims:
+    values: dict[str, Any]
+
+    @property
+    def locale(self) -> str:
+        return str(self.values.get("locale", ""))
+
+    def has_permission(self, permission: str) -> bool:
+        return any(
+            value == permission
+            or value == "*"
+            or (
+                value.endswith("/*")
+                and (permission == value[:-2] or permission.startswith(value[:-1]))
+            )
+            for value in self.values.get("scope", "").split()
+        )
+
+
+class Verifier:
+    def __init__(self, issuer: str, audience: str, application_id: str):
+        self.issuer = issuer.rstrip("/")
+        self.audience = audience
+        self.application_id = application_id
+        self.jwks = PyJWKClient(
+            f"{self.issuer}/jwks.json", cache_jwk_set=True, lifespan=300
+        )
+
+    def verify(self, token: str) -> Claims:
+        header = jwt.get_unverified_header(token)
+        if (
+            header.get("alg") != "RS256"
+            or header.get("typ") != "JWT"
+            or not isinstance(header.get("kid"), str)
+            or not header["kid"]
+        ):
+            raise jwt.InvalidTokenError("Platform93 token algorithm rejected")
+        key = self.jwks.get_signing_key_from_jwt(token)
+        values = jwt.decode(
+            token,
+            key.key,
+            algorithms=["RS256"],
+            audience=self.audience,
+            issuer=self.issuer,
+            options={
+                "require": [
+                    "exp", "iat", "nbf", "iss", "sub", "aud",
+                    "application_id", "token_kind", "actor_type", "scope",
+                ]
+            },
+        )
+        if (
+            not isinstance(values.get("sub"), str)
+            or not values["sub"]
+            or values.get("application_id") != self.application_id
+            or not (
+                values.get("token_kind") == "access"
+                and values.get("actor_type") == "user"
+                or values.get("token_kind") == "machine"
+                and values.get("actor_type") == "client"
+            )
+            or not isinstance(values.get("scope"), str)
+        ):
+            raise jwt.InvalidTokenError("Platform93 token context rejected")
+        actor = values.get("act")
+        if actor is not None and (
+            values["token_kind"] != "access"
+            or not isinstance(actor, dict)
+            or actor.get("type") != "operator"
+            or not isinstance(actor.get("sub"), str)
+            or not actor["sub"]
+        ):
+            raise jwt.InvalidTokenError("Platform93 delegated token actor rejected")
+        return Claims(values)

supaapps_platform93_auth-0.1.0a2/tests/conformance.py

@@ -0,0 +1,91 @@
+import base64
+import json
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import jwt
+from cryptography.hazmat.primitives.asymmetric import rsa
+
+from platform93_auth import Verifier
+
+
+fixture = json.loads((Path(__file__).parents[4] / "conformance" / "jwt.json").read_text())
+primary = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+wrong = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+public_jwk = json.loads(jwt.algorithms.RSAAlgorithm.to_jwk(primary.public_key()))
+public_jwk.update({"kid": "primary", "alg": "RS256", "use": "sig"})
+
+
+class JWKSHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        body = json.dumps({"keys": [public_jwk]}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *_args):
+        pass
+
+
+server = ThreadingHTTPServer(("127.0.0.1", 0), JWKSHandler)
+thread = threading.Thread(target=server.serve_forever, daemon=True)
+thread.start()
+issuer = f"http://127.0.0.1:{server.server_port}"
+verifier = Verifier(issuer, fixture["audience"], fixture["application_id"])
+
+
+def token_for(mutation: str) -> str:
+    now = int(time.time())
+    headers = {"alg": "RS256", "typ": "JWT", "kid": "primary"}
+    claims = {
+        "iss": issuer,
+        "sub": "user-1",
+        "aud": [fixture["audience"]],
+        "exp": now + 300,
+        "iat": now,
+        "nbf": now - 1,
+        "application_id": fixture["application_id"],
+        "token_kind": "access",
+        "actor_type": "user",
+        "scope": "/applications/app/profile/read",
+    }
+    signing_key = primary
+    if mutation == "machine": claims.update(token_kind="machine", actor_type="client")
+    elif mutation == "delegated": claims["act"] = {"sub": "operator-1", "type": "operator"}
+    elif mutation == "wrong_issuer": claims["iss"] = "https://wrong.example"
+    elif mutation == "wrong_audience": claims["aud"] = ["wrong-api"]
+    elif mutation == "wrong_application": claims["application_id"] = "01900000-0000-7000-8000-000000000000"
+    elif mutation == "expired": claims["exp"] = now - 60
+    elif mutation == "future_nbf": claims["nbf"] = now + 300
+    elif mutation == "future_iat": claims["iat"] = now + 300
+    elif mutation == "missing_sub": claims.pop("sub")
+    elif mutation == "missing_application": claims.pop("application_id")
+    elif mutation == "missing_token_kind": claims.pop("token_kind")
+    elif mutation == "missing_actor_type": claims.pop("actor_type")
+    elif mutation == "operator_actor": claims["actor_type"] = "operator"
+    elif mutation == "missing_kid": headers.pop("kid")
+    elif mutation == "unknown_kid": headers["kid"] = "unknown"
+    elif mutation == "wrong_signature": signing_key = wrong
+    elif mutation == "delegated_wrong_actor_type": claims["act"] = {"sub": "operator-1", "type": "user"}
+    token = jwt.encode(claims, signing_key, algorithm="RS256", headers=headers)
+    if mutation == "wrong_algorithm":
+        parts = token.split(".")
+        parts[0] = base64.urlsafe_b64encode(json.dumps({**headers, "alg": "HS256"}).encode()).rstrip(b"=").decode()
+        token = ".".join(parts)
+    return token
+
+
+try:
+    for case in fixture["cases"]:
+        accepted = True
+        try:
+            verifier.verify(token_for(case["mutation"]))
+        except Exception:
+            accepted = False
+        assert accepted == case["accept"], case["name"]
+finally:
+    server.shutdown()