svc-infra 0.1.593__py3-none-any.whl → 0.1.594__py3-none-any.whl

svc_infra/api/fastapi/auth/routers/session_router.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import List
+
+from fastapi import APIRouter, HTTPException
+from sqlalchemy import select
+
+from svc_infra.api.fastapi.auth.security import Identity
+from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
+from svc_infra.security.models import AuthSession
+from svc_infra.security.permissions import RequirePermission
+
+
+def build_session_router() -> APIRouter:
+    router = APIRouter(prefix="/sessions", tags=["sessions"])
+
+    @router.get(
+        "/me", response_model=list[dict], dependencies=[RequirePermission("security.session.list")]
+    )
+    async def list_my_sessions(identity: Identity, session: SqlSessionDep) -> List[dict]:
+        stmt = select(AuthSession).where(AuthSession.user_id == identity.user.id)
+        rows = (await session.execute(stmt)).scalars().all()
+        return [
+            {
+                "id": str(r.id),
+                "user_agent": r.user_agent,
+                "ip_hash": r.ip_hash,
+                "revoked": bool(r.revoked_at),
+                "last_seen_at": r.last_seen_at.isoformat() if r.last_seen_at else None,
+                "created_at": r.created_at.isoformat() if r.created_at else None,
+            }
+            for r in rows
+        ]
+
+    @router.post(
+        "/{session_id}/revoke",
+        status_code=204,
+        dependencies=[RequirePermission("security.session.revoke")],
+    )
+    async def revoke_session(session_id: str, identity: Identity, db: SqlSessionDep):
+        # Load session and ensure it belongs to the user (non-admin users cannot revoke others)
+        s = await db.get(AuthSession, session_id)
+        if not s:
+            raise HTTPException(404, "session_not_found")
+        # Basic ownership check; could extend for admin bypass later
+        if s.user_id != identity.user.id:
+            raise HTTPException(403, "forbidden")
+        if s.revoked_at:
+            return  # already revoked
+        s.revoked_at = datetime.now(timezone.utc)
+        s.revoke_reason = "user_revoked"
+        # Revoke all refresh tokens for this session
+        for rt in s.refresh_tokens:
+            if not rt.revoked_at:
+                rt.revoked_at = s.revoked_at
+                rt.revoke_reason = "session_revoked"
+        await db.flush()
+
+    return router
+
+
+__all__ = ["build_session_router"]

svc_infra/api/fastapi/auth/settings.py

@@ -18,6 +18,8 @@ class OIDCProvider(BaseModel):
 class JWTSettings(BaseModel):
     secret: SecretStr
     lifetime_seconds: int = 60 * 60 * 24 * 7
+    # Optional older secrets accepted for verification during rotation window
+    old_secrets: List[SecretStr] = Field(default_factory=list)
 
 
 class PasswordClient(BaseModel):

svc_infra/api/fastapi/db/sql/users.py

@@ -12,6 +12,7 @@ from svc_infra.api.fastapi.auth.settings import get_auth_settings
 from svc_infra.api.fastapi.dual.dualize import dualize_public, dualize_user
 from svc_infra.api.fastapi.dual.router import DualAPIRouter
 from svc_infra.app.env import CURRENT_ENVIRONMENT, DEV_ENV, LOCAL_ENV
+from svc_infra.security.jwt_rotation import RotatingJWTStrategy
 
 from ...auth.security import auth_login_path
 from ...auth.sender import get_sender
@@ -94,7 +95,18 @@ def get_fastapi_users(
         lifetime = getattr(jwt_block, "lifetime_seconds", None) if jwt_block else None
         if not isinstance(lifetime, int) or lifetime <= 0:
             lifetime = 3600
-        return JWTStrategy(secret=secret, lifetime_seconds=lifetime)
+        old = []
+        if jwt_block and getattr(jwt_block, "old_secrets", None):
+            old = [s.get_secret_value() for s in jwt_block.old_secrets or []]
+        audience = "fastapi-users:auth"
+        if old:
+            return RotatingJWTStrategy(
+                secret=secret,
+                lifetime_seconds=lifetime,
+                old_secrets=old,
+                token_audience=audience,
+            )
+        return JWTStrategy(secret=secret, lifetime_seconds=lifetime, token_audience=audience)
 
     bearer_transport = BearerTransport(tokenUrl=auth_login_path)
     auth_backend = AuthenticationBackend(

svc_infra/api/fastapi/dependencies/ratelimit.py

@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import time
+from typing import Callable
+
+from fastapi import HTTPException
+from starlette.requests import Request
+
+from svc_infra.api.fastapi.middleware.ratelimit_store import InMemoryRateLimitStore, RateLimitStore
+from svc_infra.obs.metrics import emit_rate_limited
+
+
+class RateLimiter:
+    def __init__(
+        self,
+        *,
+        limit: int,
+        window: int = 60,
+        key_fn: Callable = lambda r: "global",
+        store: RateLimitStore | None = None,
+    ):
+        self.limit = limit
+        self.window = window
+        self.key_fn = key_fn
+        self.store = store or InMemoryRateLimitStore(limit=limit)
+
+    async def __call__(self, request: Request):
+        key = self.key_fn(request)
+        count, limit, reset = self.store.incr(str(key), self.window)
+        if count > limit:
+            retry = max(0, reset - int(time.time()))
+            try:
+                emit_rate_limited(str(key), limit, retry)
+            except Exception:
+                pass
+            raise HTTPException(
+                status_code=429, detail="Rate limit exceeded", headers={"Retry-After": str(retry)}
+            )
+
+
+__all__ = ["RateLimiter"]
+
+
+def rate_limiter(
+    *,
+    limit: int,
+    window: int = 60,
+    key_fn: Callable = lambda r: "global",
+    store: RateLimitStore | None = None,
+):
+    store_ = store or InMemoryRateLimitStore(limit=limit)
+
+    async def dep(request: Request):
+        key = key_fn(request)
+        count, lim, reset = store_.incr(str(key), window)
+        if count > lim:
+            retry = max(0, reset - int(time.time()))
+            try:
+                emit_rate_limited(str(key), lim, retry)
+            except Exception:
+                pass
+            raise HTTPException(
+                status_code=429, detail="Rate limit exceeded", headers={"Retry-After": str(retry)}
+            )
+
+    return dep

svc_infra/api/fastapi/middleware/ratelimit.py

@@ -3,25 +3,41 @@ import time
 from starlette.middleware.base import BaseHTTPMiddleware
 from starlette.responses import JSONResponse
 
+from svc_infra.obs.metrics import emit_rate_limited
+
+from .ratelimit_store import InMemoryRateLimitStore, RateLimitStore
+
 
 class SimpleRateLimitMiddleware(BaseHTTPMiddleware):
-    def __init__(self, app, limit: int = 120, window: int = 60, key_fn=None):
+    def __init__(
+        self,
+        app,
+        limit: int = 120,
+        window: int = 60,
+        key_fn=None,
+        store: RateLimitStore | None = None,
+    ):
         super().__init__(app)
         self.limit, self.window = limit, window
         self.key_fn = key_fn or (lambda r: r.headers.get("X-API-Key") or r.client.host)
-        self.buckets = {}  # replace with Redis in prod
+        self.store = store or InMemoryRateLimitStore(limit=limit)
 
     async def dispatch(self, request, call_next):
         key = self.key_fn(request)
         now = int(time.time())
-        win = now - (now % self.window)
-        bucket = self.buckets.setdefault((key, win), 0)
+        # Increment counter in store
+        count, limit, reset = self.store.incr(str(key), self.window)
+        remaining = max(0, limit - count)
 
-        remaining = self.limit - bucket
-        reset = win + self.window
+        if remaining < 0:  # defensive clamp
+            remaining = 0
 
-        if remaining <= 0:
+        if count > limit:
             retry = max(0, reset - now)
+            try:
+                emit_rate_limited(str(key), limit, retry)
+            except Exception:
+                pass
             return JSONResponse(
                 status_code=429,
                 content={
@@ -31,16 +47,15 @@ class SimpleRateLimitMiddleware(BaseHTTPMiddleware):
                     "code": "RATE_LIMITED",
                 },
                 headers={
-                    "X-RateLimit-Limit": str(self.limit),
+                    "X-RateLimit-Limit": str(limit),
                     "X-RateLimit-Remaining": "0",
                     "X-RateLimit-Reset": str(reset),
                     "Retry-After": str(retry),
                 },
             )
 
-        self.buckets[(key, win)] = bucket + 1
         resp = await call_next(request)
-        resp.headers.setdefault("X-RateLimit-Limit", str(self.limit))
-        resp.headers.setdefault("X-RateLimit-Remaining", str(self.limit - (bucket + 1)))
+        resp.headers.setdefault("X-RateLimit-Limit", str(limit))
+        resp.headers.setdefault("X-RateLimit-Remaining", str(remaining))
         resp.headers.setdefault("X-RateLimit-Reset", str(reset))
         return resp

svc_infra/api/fastapi/middleware/ratelimit_store.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+import time
+from typing import Protocol, Tuple
+
+
+class RateLimitStore(Protocol):
+    def incr(self, key: str, window: int) -> Tuple[int, int, int]:
+        """Increment and return (count, limit, resetEpoch).
+
+        Implementations should manage per-window buckets. The 'limit' is stored configuration.
+        """
+        ...
+
+
+class InMemoryRateLimitStore:
+    def __init__(self, limit: int = 120):
+        self.limit = limit
+        self._buckets: dict[tuple[str, int], int] = {}
+
+    def incr(self, key: str, window: int) -> Tuple[int, int, int]:
+        now = int(time.time())
+        win = now - (now % window)
+        count = self._buckets.get((key, win), 0) + 1
+        self._buckets[(key, win)] = count
+        reset = win + window
+        return count, self.limit, reset
+
+
+__all__ = ["RateLimitStore", "InMemoryRateLimitStore"]

svc_infra/api/fastapi/middleware/request_size_limit.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import JSONResponse
+
+from svc_infra.obs.metrics import emit_suspect_payload
+
+
+class RequestSizeLimitMiddleware(BaseHTTPMiddleware):
+    def __init__(self, app, max_bytes: int = 1_000_000):
+        super().__init__(app)
+        self.max_bytes = max_bytes
+
+    async def dispatch(self, request, call_next):
+        length = request.headers.get("content-length")
+        try:
+            size = int(length) if length is not None else None
+        except Exception:
+            size = None
+        if size is not None and size > self.max_bytes:
+            try:
+                emit_suspect_payload(
+                    getattr(request, "url", None).path if hasattr(request, "url") else None, size
+                )
+            except Exception:
+                pass
+            return JSONResponse(
+                status_code=413,
+                content={
+                    "title": "Payload Too Large",
+                    "status": 413,
+                    "detail": "Request body exceeds allowed size.",
+                    "code": "PAYLOAD_TOO_LARGE",
+                },
+            )
+        return await call_next(request)

svc_infra/api/fastapi/setup.py

@@ -61,7 +61,8 @@ def _setup_cors(app: FastAPI, public_cors_origins: list[str] | str | None = None
     elif isinstance(public_cors_origins, str):
         origins = [o.strip() for o in public_cors_origins.split(",") if o and o.strip()]
     else:
-        fallback = os.getenv("CORS_ALLOW_ORIGINS", "http://localhost:3000")
+        # Strict by default: no CORS unless explicitly configured via env or parameter.
+        fallback = os.getenv("CORS_ALLOW_ORIGINS", "")
         origins = [o.strip() for o in fallback.split(",") if o and o.strip()]
 
     if not origins:

svc_infra/obs/metrics/__init__.py

@@ -0,0 +1,53 @@
+from __future__ import annotations
+
+"""
+Metrics package public API.
+
+Provides lightweight, overridable hooks for abuse heuristics so callers can
+plug in logging or a metrics backend without a hard dependency.
+"""
+
+from typing import Callable, Optional
+
+# Function variables so applications/tests can replace them at runtime.
+on_rate_limit_exceeded: Callable[[str, int, int], None] | None = None
+"""
+Called when a request is rate-limited.
+Args:
+    key: identifier used for rate limiting (e.g., API key or IP)
+    limit: configured limit for the window
+    retry_after: seconds until next allowed attempt
+"""
+
+on_suspect_payload: Callable[[Optional[str], int], None] | None = None
+"""
+Called when a request exceeds the configured size limit.
+Args:
+    path: request path if available
+    size: reported content-length
+"""
+
+
+def emit_rate_limited(key: str, limit: int, retry_after: int) -> None:
+    if on_rate_limit_exceeded:
+        try:
+            on_rate_limit_exceeded(key, limit, retry_after)
+        except Exception:
+            # Never break request flow on metrics exceptions
+            pass
+
+
+def emit_suspect_payload(path: Optional[str], size: int) -> None:
+    if on_suspect_payload:
+        try:
+            on_suspect_payload(path, size)
+        except Exception:
+            pass
+
+
+__all__ = [
+    "emit_rate_limited",
+    "emit_suspect_payload",
+    "on_rate_limit_exceeded",
+    "on_suspect_payload",
+]

svc_infra/obs/metrics.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+"""
+Lightweight metrics hooks for abuse heuristics. Intentionally minimal to avoid pulling
+full metrics stacks; these are no-ops by default but can be swapped in tests or wired
+to a metrics backend by overriding the functions.
+"""
+
+from typing import Callable, Optional
+
+# Function variables so applications/tests can replace them at runtime.
+on_rate_limit_exceeded: Callable[[str, int, int], None] | None = None
+"""
+Called when a request is rate-limited.
+Args:
+    key: identifier used for rate limiting (e.g., API key or IP)
+    limit: configured limit for the window
+    retry_after: seconds until next allowed attempt
+"""
+
+on_suspect_payload: Callable[[Optional[str], int], None] | None = None
+"""
+Called when a request exceeds the configured size limit.
+Args:
+    path: request path if available
+    size: reported content-length
+"""
+
+
+def emit_rate_limited(key: str, limit: int, retry_after: int) -> None:
+    if on_rate_limit_exceeded:
+        try:
+            on_rate_limit_exceeded(key, limit, retry_after)
+        except Exception:
+            # Never break request flow on metrics exceptions
+            pass
+
+
+def emit_suspect_payload(path: Optional[str], size: int) -> None:
+    if on_suspect_payload:
+        try:
+            on_suspect_payload(path, size)
+        except Exception:
+            pass
+
+
+__all__ = [
+    "emit_rate_limited",
+    "emit_suspect_payload",
+    "on_rate_limit_exceeded",
+    "on_suspect_payload",
+]

svc_infra/security/audit.py

@@ -0,0 +1,130 @@
+from __future__ import annotations
+
+"""Audit log append & chain verification utilities.
+
+Provides helpers to append a new AuditLog entry maintaining a hash-chain
+integrity model and to verify an existing sequence for tampering.
+
+Design notes:
+ - Each event stores prev_hash (previous event's hash or 64 zeros for genesis).
+ - Hash = sha256(prev_hash + canonical_json_payload).
+ - Verification recomputes expected hash for each event and compares.
+ - If a middle event is altered, that event and all subsequent events will
+   fail verification (because their prev_hash links break transitively).
+"""
+
+from datetime import datetime, timezone
+from typing import Any, List, Optional, Sequence, Tuple
+
+try:  # SQLAlchemy may not be present in minimal test context
+    from sqlalchemy import select
+    from sqlalchemy.ext.asyncio import AsyncSession
+except Exception:  # pragma: no cover
+    AsyncSession = Any  # type: ignore
+    select = None  # type: ignore
+
+from svc_infra.security.models import AuditLog, compute_audit_hash
+
+
+async def append_audit_event(
+    db: Any,
+    *,
+    actor_id=None,
+    tenant_id: Optional[str] = None,
+    event_type: str,
+    resource_ref: Optional[str] = None,
+    metadata: dict | None = None,
+    ts: Optional[datetime] = None,
+    prev_event: Optional[AuditLog] = None,
+) -> AuditLog:
+    """Append an audit event returning the persisted row.
+
+    If prev_event is not supplied, it attempts to fetch the latest event for
+    the tenant (or global chain when tenant_id is None).
+    """
+    metadata = metadata or {}
+    ts = ts or datetime.now(timezone.utc)
+
+    prev_hash: Optional[str] = None
+    if prev_event is not None:
+        prev_hash = prev_event.hash
+    elif select is not None and hasattr(db, "execute"):  # attempt DB lookup for previous event
+        try:
+            stmt = (
+                select(AuditLog)
+                .where(AuditLog.tenant_id == tenant_id)
+                .order_by(AuditLog.id.desc())
+                .limit(1)
+            )
+            result = await db.execute(stmt)  # type: ignore[attr-defined]
+            prev = result.scalars().first()
+            if prev:
+                prev_hash = prev.hash
+        except Exception:  # pragma: no cover - defensive for minimal fakes
+            pass
+
+    new_hash = compute_audit_hash(
+        prev_hash,
+        ts=ts,
+        actor_id=actor_id,
+        tenant_id=tenant_id,
+        event_type=event_type,
+        resource_ref=resource_ref,
+        metadata=metadata,
+    )
+
+    row = AuditLog(
+        ts=ts,
+        actor_id=actor_id,
+        tenant_id=tenant_id,
+        event_type=event_type,
+        resource_ref=resource_ref,
+        event_metadata=metadata,
+        prev_hash=prev_hash or "0" * 64,
+        hash=new_hash,
+    )
+    if hasattr(db, "add"):
+        try:
+            db.add(row)  # type: ignore[attr-defined]
+        except Exception:  # pragma: no cover - minimal shim safety
+            pass
+        if hasattr(db, "flush"):
+            try:
+                await db.flush()  # type: ignore[attr-defined]
+            except Exception:  # pragma: no cover
+                pass
+    return row
+
+
+def verify_audit_chain(events: Sequence[AuditLog]) -> Tuple[bool, List[int]]:
+    """Verify a sequence of audit events.
+
+    Returns (ok, broken_indices). If any event's hash doesn't match the recomputed
+    expected hash (based on previous event), its index is recorded. All events are
+    checked so callers can analyze extent of tampering.
+    """
+    broken: List[int] = []
+    prev_hash = "0" * 64
+    for idx, ev in enumerate(events):
+        expected = compute_audit_hash(
+            prev_hash if ev.prev_hash == prev_hash else ev.prev_hash,
+            ts=ev.ts,
+            actor_id=ev.actor_id,
+            tenant_id=ev.tenant_id,
+            event_type=ev.event_type,
+            resource_ref=ev.resource_ref,
+            metadata=ev.event_metadata,
+        )
+        # prev_hash stored should equal previous event hash (or zeros for genesis)
+        if (idx == 0 and ev.prev_hash != "0" * 64) or (
+            idx > 0 and ev.prev_hash != events[idx - 1].hash
+        ):
+            broken.append(idx)
+        if ev.hash != expected:
+            broken.append(idx)
+        prev_hash = ev.hash
+    ok = not broken
+    return ok, sorted(set(broken))
+
+
+__all__ = ["append_audit_event", "verify_audit_chain"]

svc_infra/security/audit_service.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+from typing import Any, List, Optional, Sequence, Tuple
+
+try:  # optional SQLAlchemy import for environments without SA
+    from sqlalchemy import select
+except Exception:  # pragma: no cover
+    select = None  # type: ignore
+
+from .audit import append_audit_event, verify_audit_chain
+from .models import AuditLog
+
+
+async def append_event(
+    db: Any,
+    *,
+    actor_id=None,
+    tenant_id: Optional[str] = None,
+    event_type: str,
+    resource_ref: Optional[str] = None,
+    metadata: dict | None = None,
+    prev_event: Optional[AuditLog] = None,
+) -> AuditLog:
+    """Append an AuditLog event using the shared append utility.
+
+    If prev_event is not provided, attempts to look up the last event for the tenant.
+    """
+    return await append_audit_event(
+        db,
+        actor_id=actor_id,
+        tenant_id=tenant_id,
+        event_type=event_type,
+        resource_ref=resource_ref,
+        metadata=metadata,
+        prev_event=prev_event,
+    )
+
+
+async def verify_chain_for_tenant(
+    db: Any, *, tenant_id: Optional[str] = None
+) -> Tuple[bool, List[int]]:
+    """Fetch all AuditLog events for a tenant and verify hash-chain integrity.
+
+    Falls back to inspecting an in-memory 'added' list when SQLAlchemy is not available,
+    to simplify unit tests with fake DBs.
+    """
+    events: Sequence[AuditLog] = []
+    if select is not None and hasattr(db, "execute"):
+        try:
+            stmt = select(AuditLog)
+            if tenant_id is not None:
+                stmt = stmt.where(AuditLog.tenant_id == tenant_id)
+            stmt = stmt.order_by(AuditLog.id.asc())
+            result = await db.execute(stmt)  # type: ignore[attr-defined]
+            events = list(result.scalars().all())
+        except Exception:  # pragma: no cover
+            events = []
+    elif hasattr(db, "added"):
+        try:
+            pool = getattr(db, "added")
+            # Preserve insertion order for in-memory fake DBs where primary keys may be None
+            events = [
+                e
+                for e in pool
+                if isinstance(e, AuditLog) and (tenant_id is None or e.tenant_id == tenant_id)
+            ]
+        except Exception:  # pragma: no cover
+            events = []
+
+    return verify_audit_chain(list(events))
+
+
+__all__ = ["append_event", "verify_chain_for_tenant"]

svc_infra/security/headers.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+SECURE_DEFAULTS = {
+    "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "DENY",
+    "Referrer-Policy": "strict-origin-when-cross-origin",
+    "X-XSS-Protection": "0",
+    # CSP kept minimal; allow config override
+    "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'",
+}
+
+
+class SecurityHeadersMiddleware:
+    def __init__(self, app, overrides: dict[str, str] | None = None):
+        self.app = app
+        self.overrides = overrides or {}
+
+    async def __call__(self, scope, receive, send):
+        if scope.get("type") != "http":
+            await self.app(scope, receive, send)
+            return
+
+        async def _send(message):
+            if message.get("type") == "http.response.start":
+                headers = message.setdefault("headers", [])
+                existing = {k.decode(): v.decode() for k, v in headers}
+                merged = {**SECURE_DEFAULTS, **existing, **self.overrides}
+                # rebuild headers list
+                new_headers = []
+                for k, v in merged.items():
+                    new_headers.append((k.encode(), v.encode()))
+                message["headers"] = new_headers
+            await send(message)
+
+        await self.app(scope, receive, _send)
+
+
+__all__ = ["SecurityHeadersMiddleware", "SECURE_DEFAULTS"]