tba-app-backend-core 0.4.0.dev2__py3-none-any.whl

tba_app_backend_core/surfaces/introspection_surface.py

@@ -0,0 +1,247 @@
+"""Runtime collaborators and composition for the RFC 7662 HTTP carrier."""
+
+from __future__ import annotations
+
+import base64
+from http import HTTPStatus
+from typing import Any, Mapping
+from uuid import UUID
+
+from tigrbl import Request, TigrblApp
+from tigrbl.engine import HybridSession as AsyncSession
+from tigrbl.runtime.status import HTTPException
+from tba_router_oauth_introspection import (
+    build_introspection_router,
+    include_introspection_endpoint as include_http_introspection_endpoint,
+)
+from tba_protocol_oauth.standards._introspection_activity import header
+from tba_protocol_oauth.standards.jwt_client_auth import (
+    PRIVATE_KEY_JWT_AUTH_METHOD,
+    authenticate_client_assertion,
+)
+from tba_protocol_oauth.standards.mutual_tls_client_authentication import (
+    SUPPORTED_MTLS_AUTH_METHODS,
+    authenticate_mtls_client,
+    presented_certificate_pem,
+    presented_certificate_thumbprint,
+)
+from tba_protocol_oauth.standards.resource_verifier_contract import (
+    build_protected_resource_verifier_contract,
+)
+from tba_runtime_identity.deployment import deployment_from_request
+from tba_runtime_identity.settings import settings
+from tba_storage_oauth.tables import Client
+from tba_storage_oauth.tables import ClientRegistration
+from tba_runtime_identity_storage.engine import get_db
+from tba_runtime_identity_storage.ops.clients import lookup_client
+from tigrbl import (
+    first_table_record,
+    read_table_record,
+)
+from tba_capability_client_secret_authentication import (
+    ClientSecretAuthenticationCapability,
+)
+
+from tba_server_identity.security.token_introspection import (
+    build_rfc7662_introspection_service,
+)
+
+
+DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD = "client_secret_basic"
+client_secret_authentication = ClientSecretAuthenticationCapability(lookup_client)
+
+
+def _require_transport(request: Request) -> None:
+    scope = getattr(request, "scope", {})
+    scheme = scope.get("scheme") if isinstance(scope, dict) else None
+    if not scheme:
+        try:
+            url = request.url
+            scheme = url.scheme if hasattr(url, "scheme") else str(url).split(":", 1)[0]
+        except Exception:
+            scheme = "http"
+    deployment = deployment_from_request(request, settings)
+    if deployment.flag_enabled("require_tls") and scheme != "https":
+        raise HTTPException(HTTPStatus.BAD_REQUEST, {"error": "tls_required"})
+
+
+def _optional_registration_unavailable(exc: Exception) -> bool:
+    message = f"{exc.__class__.__module__}.{exc.__class__.__name__}: {exc}".lower()
+    if "has no attribute 'execute'" in message:
+        return True
+    return any(
+        marker in message
+        for marker in ("undefinedtable", "no such table", "missing table")
+    ) or ("does not exist" in message and ("relation" in message or "table" in message))
+
+
+async def _load_client(
+    db: Any, client_id: str
+) -> tuple[Client | None, ClientRegistration | None]:
+    try:
+        client_key: UUID | str = UUID(str(client_id))
+    except ValueError:
+        client_key = client_id
+    client = await read_table_record(Client, db, client_key)
+    registration = None
+    if client is not None:
+        try:
+            registration = await first_table_record(
+                ClientRegistration, db, {"client_id": client.id}
+            )
+        except Exception as exc:
+            if not _optional_registration_unavailable(exc):
+                raise
+    return client, registration
+
+
+def _registered_auth_method(registration: ClientRegistration | None) -> str:
+    raw = getattr(registration, "registration_metadata", None)
+    metadata = raw if isinstance(raw, dict) else {}
+    return str(
+        metadata.get("token_endpoint_auth_method") or DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD
+    )
+
+
+def _protected_resource_verifier_contract(request: Any):
+    return build_protected_resource_verifier_contract(
+        deployment_from_request(request, settings)
+    )
+
+
+def _introspection_endpoint_audiences(request: Any) -> set[str]:
+    deployment = deployment_from_request(request, settings)
+    issuer = str(getattr(deployment, "issuer", None) or settings.issuer).rstrip("/")
+    return {issuer, f"{issuer}/introspect", f"{issuer}/token"} - {""}
+
+
+async def authorize_introspection_caller(
+    request: Request,
+    form_data: Mapping[str, object],
+    db: AsyncSession,
+) -> None:
+    contract = _protected_resource_verifier_contract(request)
+    allowed_auth_methods = set(contract.introspection_auth_methods)
+    authorization = header(request, "Authorization") or ""
+    client_assertion = str(form_data.get("client_assertion") or "").strip()
+    client_assertion_type = str(form_data.get("client_assertion_type") or "").strip()
+    client_id: str | None = None
+    client_secret: str | None = None
+
+    if authorization.startswith("Basic "):
+        try:
+            decoded = base64.b64decode(authorization.split()[1]).decode()
+            client_id, client_secret = decoded.split(":", 1)
+        except Exception as exc:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client") from exc
+    else:
+        client_id = str(form_data.get("client_id") or "").strip() or None
+        client_secret = str(form_data.get("client_secret") or "").strip() or None
+
+    if client_assertion and not client_id:
+        try:
+            claims = authenticate_client_assertion(
+                client_assertion_type=client_assertion_type,
+                client_assertion=client_assertion,
+                audience=_introspection_endpoint_audiences(request),
+                client_id=None,
+            )
+        except ValueError as exc:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client") from exc
+        client_id = str(claims.get("iss") or "").strip() or None
+
+    if not client_id:
+        raise HTTPException(
+            HTTPStatus.UNAUTHORIZED,
+            "authenticated caller required",
+        )
+
+    client, registration = await _load_client(db, client_id)
+    if client is None:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client")
+
+    registered_auth_method = _registered_auth_method(registration)
+    raw_metadata = getattr(registration, "registration_metadata", None)
+    registration_metadata = raw_metadata if isinstance(raw_metadata, dict) else {}
+
+    if client_assertion:
+        if (
+            PRIVATE_KEY_JWT_AUTH_METHOD not in allowed_auth_methods
+            or registered_auth_method != PRIVATE_KEY_JWT_AUTH_METHOD
+        ):
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client")
+        try:
+            authenticate_client_assertion(
+                client_assertion_type=client_assertion_type,
+                client_assertion=client_assertion,
+                audience=_introspection_endpoint_audiences(request),
+                client_id=str(client.id),
+                token_endpoint_auth_method=registered_auth_method,
+            )
+        except ValueError as exc:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client") from exc
+        return None
+
+    if registered_auth_method in SUPPORTED_MTLS_AUTH_METHODS:
+        if registered_auth_method not in allowed_auth_methods:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client")
+        try:
+            authenticate_mtls_client(
+                registration_metadata,
+                presented_certificate_thumbprint(request),
+                presented_certificate_pem=presented_certificate_pem(request),
+                token_endpoint_auth_method=registered_auth_method,
+            )
+        except ValueError as exc:
+            raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client") from exc
+        return None
+
+    if registered_auth_method == "client_secret_post":
+        valid_shape = registered_auth_method in allowed_auth_methods and bool(
+            client_secret
+        )
+    elif registered_auth_method == "client_secret_basic":
+        valid_shape = (
+            registered_auth_method in allowed_auth_methods
+            and authorization.startswith("Basic ")
+            and bool(client_secret)
+        )
+    else:
+        valid_shape = False
+    if not valid_shape:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client")
+
+    result = client_secret_authentication.verify_client_record(client, client_secret)
+    if not result.authenticated:
+        raise HTTPException(HTTPStatus.UNAUTHORIZED, "invalid_client")
+
+
+def _service_for_request(request: Request):
+    return build_rfc7662_introspection_service(settings)
+
+
+router = build_introspection_router(
+    service_for_request=_service_for_request,
+    authorize_caller=authorize_introspection_caller,
+    require_transport=_require_transport,
+    get_db=get_db,
+)
+
+
+def include_introspection_endpoint(app: TigrblApp) -> None:
+    include_http_introspection_endpoint(
+        app,
+        router,
+        enabled=bool(settings.enable_rfc7662),
+    )
+
+
+include_rfc7662 = include_introspection_endpoint
+
+
+__all__ = [
+    "authorize_introspection_caller",
+    "include_introspection_endpoint",
+    "include_rfc7662",
+    "router",
+]

tba_app_backend_core/surfaces/login_surface.py

@@ -0,0 +1,25 @@
+"""Runtime composition for the interactive session-login HTTP carrier."""
+
+from tba_router_session_login import build_login_router
+from tba_runtime_identity_storage.engine import get_db
+
+from tba_server_identity.login_runtime import (
+    change_required_password,
+    login_user,
+    password_authentication,
+)
+
+
+router = build_login_router(
+    login_request=login_user,
+    get_db=get_db,
+    required_password_change_request=change_required_password,
+)
+
+
+__all__ = [
+    "change_required_password",
+    "login_user",
+    "password_authentication",
+    "router",
+]

tba_app_backend_core/surfaces/logout_surface.py

@@ -0,0 +1,38 @@
+"""Runtime composition for the OpenID Connect logout HTTP carrier."""
+
+from tigrbl import TigrblApp
+from tba_router_oidc_logout import (
+    build_logout_router,
+    include_logout_endpoint as include_logout_carrier,
+)
+from tba_runtime_identity.deployment import deployment_from_app
+from tba_runtime_identity.settings import settings
+from tba_runtime_identity_storage.engine import get_db
+
+from tba_server_identity.logout_runtime import logout, logout_request
+
+
+router = build_logout_router(logout_request=logout, get_db=get_db)
+api = router
+
+
+def include_logout_endpoint(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_logout_carrier(
+        app,
+        router,
+        enabled=deployment.route_enabled("/logout"),
+    )
+
+
+include_oidc_rp_initiated_logout = include_logout_endpoint
+
+
+__all__ = [
+    "api",
+    "include_logout_endpoint",
+    "include_oidc_rp_initiated_logout",
+    "logout",
+    "logout_request",
+    "router",
+]

tba_app_backend_core/surfaces/oidc_discovery_surface.py

@@ -0,0 +1,79 @@
+"""Runtime composition for OIDC discovery and JWKS HTTP carriers."""
+
+from tigrbl import TigrblApp, TigrblRouter
+from tba_router_oidc_discovery import (
+    build_oidc_discovery_routers,
+    include_jwks as include_jwks_carrier,
+    include_oidc_discovery as include_oidc_discovery_carrier,
+    include_openid_configuration as include_openid_configuration_carrier,
+)
+from tba_protocol_oauth.standards.authorization_server_metadata import (
+    JWKS_PATH,
+)
+from tba_runtime_identity.deployment import deployment_from_app
+from tba_runtime_identity.settings import settings
+from tba_runtime_identity_storage.engine import get_db
+
+from tba_server_identity.oidc_discovery_runtime import (
+    jwks,
+    openid_configuration,
+    realm_jwks,
+    realm_openid_configuration,
+    tenant_jwks,
+    tenant_openid_configuration,
+)
+
+
+discovery_api, jwks_api = build_oidc_discovery_routers(
+    openid_configuration=openid_configuration,
+    tenant_openid_configuration=tenant_openid_configuration,
+    realm_openid_configuration=realm_openid_configuration,
+    jwks=jwks,
+    tenant_jwks=tenant_jwks,
+    realm_jwks=realm_jwks,
+    get_db=get_db,
+)
+api = TigrblRouter()
+api.include_router(discovery_api)
+api.include_router(jwks_api)
+router = api
+
+
+def include_openid_configuration(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_openid_configuration_carrier(
+        app,
+        discovery_api,
+        enabled=deployment.route_enabled("/.well-known/openid-configuration"),
+    )
+
+
+def include_jwks(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_jwks_carrier(
+        app,
+        jwks_api,
+        enabled=deployment.route_enabled(JWKS_PATH),
+    )
+
+
+def include_oidc_discovery(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_oidc_discovery_carrier(
+        app,
+        discovery_api,
+        jwks_api,
+        discovery_enabled=deployment.route_enabled("/.well-known/openid-configuration"),
+        jwks_enabled=deployment.route_enabled(JWKS_PATH),
+    )
+
+
+__all__ = [
+    "api",
+    "discovery_api",
+    "include_jwks",
+    "include_oidc_discovery",
+    "include_openid_configuration",
+    "jwks_api",
+    "router",
+]