tina4-python 0.2.122__py3-none-any.whl

tina4_python/Auth.py

@@ -0,0 +1,222 @@
+#
+# Tina4 - This is not a 4ramework.
+# Copy-right 2007 - current Tina4
+# License: MIT https://opensource.org/licenses/MIT
+#
+# flake8: noqa: E501
+import datetime
+import os
+import jwt
+import bcrypt
+from json import JSONEncoder
+from cryptography import x509
+from cryptography.x509 import NameOID
+from cryptography.hazmat.primitives import serialization, hashes
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.backends import default_backend
+
+
+class AuthJSONSerializer(JSONEncoder):
+    def default(self, o):
+        if isinstance(o, datetime.datetime):
+            return o.isoformat()
+        else:
+            raise TypeError(f'Object of type {o.__class__.__name__} '
+                            f'is not JSON serializable')
+
+
+class Auth:
+    secret = None
+    private_key = None
+    root_path = None
+    loaded_private_key = None
+    loaded_public_key = None
+
+    def hash_password(self, text):
+        """
+        Generates a Bcrypt password hash
+        :param text:
+        :return:
+        """
+        password_bytes = text.encode('utf-8')
+        # Generate a salt
+        salt = bcrypt.gensalt()
+        # Hash the password
+        return bcrypt.hashpw(password_bytes, salt).decode('utf-8')
+
+    def check_password(self, password_hash, text):
+        """
+        Checks a Bcrypt password hash
+        :param password_hash:
+        :param text:
+        :return:
+        """
+        password_bytes = text.encode('utf-8')
+        return bcrypt.checkpw(password_bytes, password_hash.encode('utf-8'))
+
+    def load_private_key(self):
+        """
+        Loads the private key from the secrets folder
+        :return:
+        """
+        if self.loaded_private_key:
+            return self.loaded_private_key
+        with open(self.private_key, "rb") as f:
+            private_key = serialization.load_pem_private_key(
+                f.read(), b"{self.secret}", backend=default_backend()
+            )
+            self.loaded_private_key = private_key
+            return private_key
+
+    def load_public_key(self):
+        """
+        Loads the public key from the secrets folder
+        :return:
+        """
+        if self.loaded_public_key:
+            return self.loaded_public_key
+        with open(self.public_key, "rb") as f:
+            public_key = serialization.load_pem_public_key(
+                f.read(), backend=default_backend()
+            )
+            self.loaded_public_key = public_key
+            return public_key
+
+    def __init__(self, root_path):
+        self.root_path = root_path
+        self.secret = os.environ.get("SECRET", None)
+        self.private_key = root_path + os.sep + "secrets" + os.sep + "private.key"
+        self.public_key = root_path + os.sep + "secrets" + os.sep + "public.key"
+        self.self_signed = root_path + os.sep + "secrets" + os.sep + "domain.cert"
+
+        # check if we have a secrets folder
+        if not os.path.exists(root_path + os.sep + "secrets"):
+            os.makedirs(root_path + os.sep + "secrets")
+
+        if not os.path.isfile(self.private_key):
+            private_key = rsa.generate_private_key(
+                public_exponent=65537,
+                key_size=2048,
+            )
+            with open(self.private_key, "wb") as f:
+                f.write(private_key.private_bytes(
+                    encoding=serialization.Encoding.PEM,
+                    format=serialization.PrivateFormat.TraditionalOpenSSL,
+                    encryption_algorithm=serialization.BestAvailableEncryption(b"{self.secret}"),
+                ))
+        else:
+            private_key = self.load_private_key()
+
+        if not os.path.isfile(self.public_key):
+            public_key = private_key.public_key()
+            public_pem = public_key.public_bytes(
+                encoding=serialization.Encoding.PEM,
+                format=serialization.PublicFormat.SubjectPublicKeyInfo
+            )
+            with open(self.public_key, 'wb') as f:
+                f.write(public_pem)
+
+        if not os.path.isfile(self.self_signed):
+            subject = issuer = x509.Name([
+                x509.NameAttribute(NameOID.COUNTRY_NAME, os.environ.get('COUNTRY', 'ZA')),
+                x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, os.environ.get('STATE', 'WESTERN CAPE')),
+                x509.NameAttribute(NameOID.LOCALITY_NAME, os.environ.get('CITY', 'CAPE TOWN')),
+                x509.NameAttribute(NameOID.ORGANIZATION_NAME, os.environ.get('ORGANIZATION', 'Tina4')),
+                x509.NameAttribute(NameOID.COMMON_NAME, os.environ.get('DOMAIN_NAME', 'localhost'))
+            ])
+            cert = (x509.CertificateBuilder().subject_name(
+                subject
+            ).issuer_name(
+                issuer
+            ).public_key(
+                private_key.public_key()
+            ).serial_number(
+                x509.random_serial_number()
+            ).not_valid_before(
+                datetime.datetime.now(datetime.timezone.utc)
+            ).not_valid_after(
+                datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=99999)
+            ).add_extension(
+                x509.SubjectAlternativeName([x509.DNSName("localhost")]),
+                critical=False,
+            ).sign(private_key, hashes.SHA256()))
+
+            with open(self.self_signed, "wb") as f:
+                f.write(cert.public_bytes(serialization.Encoding.PEM))
+
+    def get_token(self, payload_data, expiry_minutes=0):
+        """
+        Returns a token to be used as bearer
+        :param payload_data:
+        :param expiry_minutes:
+        :return:
+        """
+        private_key = self.load_private_key()
+        now = datetime.datetime.now()
+
+        if "expires" not in payload_data:
+            token_limit_minutes = int(os.environ.get("TINA4_TOKEN_LIMIT", 2))
+            if expiry_minutes != 0:
+                token_limit_minutes  = expiry_minutes
+            expiry_time = now + datetime.timedelta(minutes=token_limit_minutes)
+            payload_data["expires"] = expiry_time.isoformat()
+
+        token = jwt.encode(
+            payload=payload_data,
+            key=private_key,
+            algorithm='RS256',
+            json_encoder=AuthJSONSerializer
+        )
+
+        return token
+
+    def get_payload(self, token):
+        """
+        Gets the payload of the token to be evaluated
+        :param token:
+        :return:
+        """
+        public_key = self.load_public_key()
+        try:
+            payload = jwt.decode(token, key=public_key, algorithms=['RS256'])
+        except jwt.exceptions.InvalidSignatureError:
+            payload = None
+
+        return payload
+
+    def validate(self, token):
+        """
+        Validates the token
+        :param token:
+        :return:
+        """
+        # first check for API_KEY = token, simplest form
+        if os.environ.get("API_KEY", None) is not None:
+            if token == os.environ.get("API_KEY"):
+                return True
+
+        public_key = self.load_public_key()
+        try:
+            payload = jwt.decode(token, key=public_key, algorithms=['RS256'])
+            if "expires" not in payload:
+                return False
+
+            if "expires" in payload:
+                now = datetime.datetime.now()
+                expiry_time = datetime.datetime.fromisoformat(payload["expires"])
+                if now > expiry_time:
+                    return False
+                else:
+                    return True
+        except Exception:
+            return False
+
+        return False
+
+    def valid(self, token):
+        """
+        Validates the token
+        :param token:
+        :return:
+        """
+        return self.validate(token)

tina4_python/Constant.py

@@ -0,0 +1,43 @@
+#
+# Tina4 - This is not a 4ramework.
+# Copy-right 2007 - current Tina4
+# License: MIT https://opensource.org/licenses/MIT
+#
+# flake8: noqa: E501
+TINA4_LOG_INFO = "INFO"
+TINA4_LOG_WARNING = "WARN"
+TINA4_LOG_DEBUG = "DEBUG"
+TINA4_LOG_ERROR = "ERROR"
+TINA4_LOG_ALL = "ALL"
+
+TINA4_GET = "GET"
+TINA4_POST = "POST"
+TINA4_ANY = "ANY"
+TINA4_PATCH = "PATCH"
+TINA4_PUT = "PUT"
+TINA4_DELETE = "DELETE"
+TINA4_OPTIONS = "OPTIONS"
+
+HTTP_OK = 200
+HTTP_CREATED = 201
+HTTP_ACCEPTED = 202
+HTTP_NO_CONTENT = 204
+HTTP_PARTIAL_CONTENT = 206
+HTTP_BAD_REQUEST = 400
+HTTP_UNAUTHORIZED = 401
+HTTP_FORBIDDEN = 403
+HTTP_NOT_FOUND = 404
+HTTP_REDIRECT = 302
+HTTP_SERVER_ERROR = 500
+
+LOOKUP_HTTP_CODE = {HTTP_OK: "OK", HTTP_CREATED: "Created", HTTP_ACCEPTED: "Accepted", HTTP_BAD_REQUEST: "Bad Request",
+                    HTTP_PARTIAL_CONTENT: "Partial Content", HTTP_UNAUTHORIZED: "Unauthorized",
+                    HTTP_FORBIDDEN: "Forbidden", HTTP_NOT_FOUND: "Not Found", HTTP_NO_CONTENT: "No Content",
+                    HTTP_REDIRECT: "Redirect",
+                    HTTP_SERVER_ERROR: "Internal Server Error"}
+
+TEXT_HTML = "text/html"
+TEXT_CSS = "text/css"
+TEXT_PLAIN = "text/plain"
+APPLICATION_JSON = "application/json"
+APPLICATION_XML = "application/xml"