touchque-authenticator 4.2.0__py3-none-any.whl

touchque/config.py

@@ -0,0 +1,56 @@
+import os
+from urllib.parse import urlparse
+
+from .exceptions import TouchQueConfigException
+
+_LOCAL_HOSTS = {"localhost", "127.0.0.1", "::1"}
+DEFAULT_BASE_URL = "https://api.touchque.com"
+
+
+def _assert_safe_base_url(base_url: str) -> None:
+    """Allow plaintext http only for localhost / loopback (local development)."""
+    parsed = urlparse(base_url)
+    if parsed.scheme == "https":
+        return
+    if parsed.scheme == "http" and (parsed.hostname or "").lower() in _LOCAL_HOSTS:
+        return
+    if parsed.scheme == "http":
+        raise TouchQueConfigException(
+            f'Refusing a plaintext http:// base_url for "{parsed.hostname}". '
+            "The API key and request signature would be sent in the clear — use https://."
+        )
+    raise TouchQueConfigException(f"base_url must be http(s): {base_url}")
+
+
+class Config:
+    def __init__(
+        self,
+        api_key: str = None,
+        api_secret: str = None,
+        base_url: str = None,
+        timeout: int = 10000,
+    ):
+        """
+        Falls back to the environment when an argument is omitted:
+        ``TQ_API_KEY``, ``TQ_API_SECRET``, ``TQ_API_URL`` (default
+        ``https://api.touchque.com``).
+        """
+        api_key = api_key if api_key is not None else os.environ.get("TQ_API_KEY")
+        api_secret = api_secret if api_secret is not None else os.environ.get("TQ_API_SECRET")
+        base_url = base_url if base_url is not None else os.environ.get("TQ_API_URL", DEFAULT_BASE_URL)
+
+        if not api_key or not api_secret:
+            raise TouchQueConfigException(
+                "Set TQ_API_KEY and TQ_API_SECRET (or pass api_key=/api_secret=)."
+            )
+        if not api_key.startswith('tq_'):
+            raise TouchQueConfigException(
+                'api_key must start with "tq_". Did you accidentally swap api_key and api_secret?'
+            )
+
+        _assert_safe_base_url(base_url)
+
+        self.api_key = api_key
+        self.api_secret = api_secret
+        self.base_url = base_url.rstrip('/')
+        self.timeout = timeout

touchque/contrib/__init__.py

@@ -0,0 +1,4 @@
+"""Framework adapters. Each is a thin wrapper over ``touchque.guard.run_guard``
+(step-up decorator) and ``touchque.relay.RelayHandler`` (relay routes)
+— import only the one you use, so the others' framework isn't a hard
+dependency (``touchque.contrib.flask`` needs Flask installed, etc.)."""

touchque/contrib/django.py

@@ -0,0 +1,175 @@
+"""
+Django: one line per protected view.
+
+    from touchque.contrib.django import require_touchque
+
+    @require_touchque('SEND_MONEY', details=lambda req: {'Amount': f'{req.POST["amount"]} EUR'})
+    def transfer(request):
+        return JsonResponse({'ok': True, 'touchque': request.touchque})
+
+Until the user approves on their phone this answers
+202 {"touchque": step, "token": ...}. Your page shows the step in its own
+design and sends the same request again with header
+``X-TouchQue-Token: <token>``. Once approved the view runs ONCE, with
+``request.touchque`` set to the approval.
+
+Relay routes (POST /login, enrollment, offline codes, passkey ceremonies)
+under one URL prefix - see ``touchque.relay.RelayHandler`` for every option:
+
+    # urls.py
+    from touchque.contrib.django import touchque_relay_urls
+
+    def opened(request, response, info):
+        request.session['user'] = info['externalUsername']
+
+    urlpatterns = [
+        path('touchque/', include(touchque_relay_urls(
+            get_user_id=lambda req: req.session.get('user'),
+            get_login_user=lambda req: req.session.get('password_ok'),
+            on_authenticated=opened,
+        ))),
+    ]
+
+Django's CSRF protection stays on for these POST/DELETE routes: send the
+token from the page (``@touchque/web``: ``headers: {'X-CSRFToken': ...}``),
+or pass ``csrf_exempt=True`` if you protect them another way.
+"""
+import functools
+import json
+from typing import Any, Callable, Dict, List, Optional
+
+from django.core.serializers.json import DjangoJSONEncoder
+from django.http import Http404, HttpRequest, HttpResponse, JsonResponse
+from django.urls import re_path
+from django.views.decorators.csrf import csrf_exempt as _csrf_exempt
+
+from ..client import TouchQue, get_default_client
+from ..guard import SilentSignIn, guard_input_from_headers, run_guard, silent_input_from_headers
+from ..relay import RelayHandler
+from ..steps import LoginDetails
+
+
+def _default_user(request: HttpRequest) -> Optional[str]:
+    u = getattr(request, 'user', None)
+    if u is None or not getattr(u, 'is_authenticated', True):
+        return None
+    if isinstance(u, str):
+        return u
+    email = getattr(u, 'email', None)
+    return email or getattr(u, 'username', None) or str(getattr(u, 'pk', '') or '') or None
+
+
+def require_touchque(
+    action: str,
+    client: Optional[TouchQue] = None,
+    user: Optional[Callable[[HttpRequest], Optional[str]]] = None,
+    details: Optional[Callable[[HttpRequest], Optional[LoginDetails]]] = None,
+    reference_id: Optional[Callable[[HttpRequest], Optional[str]]] = None,
+    silent_sign_in: SilentSignIn = False,
+    context: Optional[Callable[[HttpRequest], Optional[Dict[str, Any]]]] = None,
+) -> Callable:
+    """
+    ``user``: who is approving, given the request. Default:
+    ``request.user.email`` (Django auth). For the login step, return the user
+    who just passed your password check, e.g.
+    ``user=lambda req: req.session.get('password_ok')``.
+
+    ``silent_sign_in`` (default off): when on, a new attempt whose browser
+    sent its device-bound key proof (``X-TouchQue-Browser``, added by
+    ``@touchque/web`` with ``browserKey: true``) first asks TouchQue whether
+    anything about it is new. If nothing is, your view runs at once with no
+    push (``request.touchque['assurance']['method'] == 'silent'``,
+    ``request.touchque['reasons']``). Otherwise, and on any error, the usual push
+    starts and its approval makes the browser known.
+    ``{'max_age_seconds': n}`` sets your own limit on how long ago the last
+    phone approval in that browser may be.
+
+    ``context``: for your TouchQue Actions only (``event.context``), e.g. the
+    user's roles. Never shown on the phone.
+    """
+    user_of = user or _default_user
+    tq = client
+
+    def decorator(view: Callable) -> Callable:
+        @functools.wraps(view)
+        def wrapped(request: HttpRequest, *args: Any, **kwargs: Any) -> Any:
+            c = tq or get_default_client()
+            uid = user_of(request)
+            result = run_guard(
+                c, uid, action,
+                details=details(request) if details else None,
+                reference_id=reference_id(request) if reference_id else None,
+                context=context(request) if context else None,
+                ip=request.META.get('REMOTE_ADDR'), user_agent=request.META.get('HTTP_USER_AGENT'),
+                **guard_input_from_headers(lambda name: request.headers.get(name)),
+                **silent_input_from_headers(silent_sign_in, lambda name: request.headers.get(name)),
+            )
+            if 'approved' in result:
+                request.touchque = result['approved']
+                return view(request, *args, **kwargs)
+            resp = JsonResponse(result['body'], status=result['status'])
+            resp['Cache-Control'] = 'no-store'
+            retry = result['body']['touchque'].get('retryAfter')
+            if retry:
+                resp['Retry-After'] = str(retry)
+            return resp
+        return wrapped
+    return decorator
+
+
+def _json_body(request: HttpRequest) -> Any:
+    if request.content_type != 'application/json' or not request.body:
+        return None
+    try:
+        return json.loads(request.body)
+    except ValueError:
+        return None
+
+
+def touchque_relay_view(
+    client: Optional[TouchQue] = None,
+    csrf_exempt: bool = False,
+    handler: Optional[RelayHandler] = None,
+    **options: Any
+) -> Callable:
+    """One view for every relay route; the sub-path comes from the ``sub``
+    URL kwarg (see ``touchque_relay_urls``). ``options`` are
+    ``RelayHandler``'s (``get_user_id`` is required); or pass a ready ``handler``.
+
+    Callbacks get the ``HttpRequest``; ``on_authenticated(request, response,
+    info)`` gets the ``HttpResponse`` that will be sent, so it may call
+    ``response.set_cookie(...)`` or write ``request.session``.
+    ``REMOTE_ADDR`` is the client IP the rate limiter uses: behind a proxy,
+    make sure it holds the real client address.
+    """
+    relay = handler or RelayHandler(client, **options)
+
+    def view(request: HttpRequest, sub: str = '') -> HttpResponse:
+        response = HttpResponse(content_type='application/json')
+        result = relay.handle(
+            request.method or '', '/' + sub, body=_json_body(request),
+            ip=request.META.get('REMOTE_ADDR'), user_agent=request.META.get('HTTP_USER_AGENT'),
+            get_header=lambda name: request.headers.get(name),
+            request=request, response=response,
+        )
+        if result is None:
+            raise Http404()
+        response.status_code = result.status
+        response.content = json.dumps(result.body, cls=DjangoJSONEncoder).encode('utf-8')
+        for key, value in result.headers.items():
+            response[key] = value
+        return response
+
+    return _csrf_exempt(view) if csrf_exempt else view
+
+
+def touchque_relay_urls(
+    client: Optional[TouchQue] = None,
+    csrf_exempt: bool = False,
+    handler: Optional[RelayHandler] = None,
+    **options: Any
+) -> List[Any]:
+    """URL patterns for the relay, to mount with
+    ``path('touchque/', include(touchque_relay_urls(...)))``."""
+    view = touchque_relay_view(client, csrf_exempt=csrf_exempt, handler=handler, **options)
+    return [re_path(r'^(?P<sub>.*)$', view, name='touchque_relay')]

touchque/contrib/fastapi.py

@@ -0,0 +1,208 @@
+"""
+FastAPI: one line per protected route, as a dependency.
+
+    from fastapi import Depends, Request
+    from touchque.contrib.fastapi import RequireTouchQue
+
+    @app.post('/transfer')
+    async def transfer(request: Request, touchque=Depends(
+        RequireTouchQue('SEND_MONEY', details=lambda req: {'Amount': f'{req.state.amount} EUR'})
+    )):
+        return {'ok': True, 'touchque': touchque}
+
+Until the user approves on their phone the dependency raises
+``HTTPException(202, detail={"touchque": step, "token": ...})``. Your page
+shows the step in its own design and sends the same request again with
+header ``X-TouchQue-Token: <token>``. Once approved the dependency resolves
+to the approval (once) and your route runs.
+
+FastAPI's default exception handler puts that JSON under a top-level
+``"detail"`` key (``{"detail": {"touchque": ..., "token": ...}}``) — unlike
+the Django/Flask adapters, which return it at the top level. Call
+``install_touchque_exception_handler(app)`` once at startup to flatten it and
+match the other adapters exactly.
+
+``run_guard`` makes a blocking HTTP call (the ``requests`` library); it runs
+in FastAPI's threadpool via ``anyio.to_thread`` so it never blocks the event
+loop.
+
+Relay routes (POST /login, enrollment, offline codes, passkey ceremonies)
+as one APIRouter - see ``touchque.relay.RelayHandler`` for every option.
+Callbacks may be sync or async:
+
+    from touchque.contrib.fastapi import touchque_relay_router
+
+    async def opened(request, response, info):
+        response.set_cookie('session', await create_session(info['externalUsername']))
+
+    app.include_router(touchque_relay_router(
+        tq,
+        get_user_id=lambda req: req.session.get('user'),
+        get_login_user=lambda req: req.session.get('password_ok'),
+        on_authenticated=opened,
+    ), prefix='/touchque')
+"""
+import json
+from typing import Any, Awaitable, Callable, Optional
+
+import anyio
+import anyio.from_thread
+import anyio.to_thread
+import fastapi
+from fastapi import APIRouter, HTTPException, Request
+from fastapi.responses import JSONResponse, Response
+
+from ..client import TouchQue, get_default_client
+from ..guard import SilentSignIn, guard_input_from_headers, run_guard, silent_input_from_headers
+from ..relay import RELAY_ROUTES, RelayHandler
+from ..steps import LoginDetails
+
+
+async def _default_user(request: Request) -> Optional[str]:
+    u = getattr(request.state, 'user', None)
+    if u is None:
+        return None
+    if isinstance(u, str):
+        return u
+    return getattr(u, 'email', None) or getattr(u, 'id', None) or getattr(u, 'username', None)
+
+
+def RequireTouchQue(  # noqa: N802 — reads as a dependency factory, PascalCase is idiomatic here
+    action: str,
+    client: Optional[TouchQue] = None,
+    user: Optional[Callable[[Request], Any]] = None,
+    details: Optional[Callable[[Request], Optional[LoginDetails]]] = None,
+    reference_id: Optional[Callable[[Request], Any]] = None,
+    silent_sign_in: SilentSignIn = False,
+    context: Optional[Callable[[Request], Any]] = None,
+) -> Callable[[Request], Any]:
+    """
+    ``user``: async or sync callable resolving who is approving from the
+    request. Default: ``request.state.user``. For the login step, return the
+    user who just passed your password check.
+
+    ``silent_sign_in`` (default off): when on, a new attempt whose browser
+    sent its device-bound key proof (``X-TouchQue-Browser``, added by
+    ``@touchque/web`` with ``browserKey: true``) first asks TouchQue whether
+    anything about it is new. If nothing is, the dependency resolves at once
+    with no push (``approval['assurance']['method'] == 'silent'``,
+    ``approval['reasons']``). Otherwise, and on any error, the usual push
+    starts and its approval makes the browser known.
+    ``{'max_age_seconds': n}`` sets your own limit on how long ago the last
+    phone approval in that browser may be.
+
+    ``context``: for your TouchQue Actions only (``event.context``), e.g. the
+    user's roles. Never shown on the phone.
+    """
+    user_of = user or _default_user
+    tq = client
+
+    async def dependency(request: Request) -> Any:
+        c = tq or get_default_client()
+        uid = user_of(request)
+        if hasattr(uid, '__await__'):
+            uid = await uid
+        det = details(request) if details else None
+        if hasattr(det, '__await__'):
+            det = await det
+        ref = reference_id(request) if reference_id else None
+        if hasattr(ref, '__await__'):
+            ref = await ref
+        ctx = context(request) if context else None
+        if hasattr(ctx, '__await__'):
+            ctx = await ctx
+
+        result = await anyio.to_thread.run_sync(lambda: run_guard(
+            c, uid, action, details=det, reference_id=ref, context=ctx,
+            ip=request.client.host if request.client else None,
+            user_agent=request.headers.get('user-agent'),
+            **guard_input_from_headers(lambda name: request.headers.get(name)),
+            **silent_input_from_headers(silent_sign_in, lambda name: request.headers.get(name)),
+        ))
+        if 'approved' in result:
+            return result['approved']
+        headers = {'Cache-Control': 'no-store'}
+        retry = result['body']['touchque'].get('retryAfter')
+        if retry:
+            headers['Retry-After'] = str(retry)
+        raise HTTPException(status_code=result['status'], detail=result['body'], headers=headers)
+
+    return dependency
+
+
+def install_touchque_exception_handler(app: fastapi.FastAPI) -> None:
+    """Optional: makes a raised TouchQue step return the SAME JSON shape as
+    the Django/Flask adapters (no ``{"detail": ...}`` wrapper). Every other
+    ``HTTPException`` goes to FastAPI's own handler, unchanged (no body on a
+    204 or 304)."""
+    from fastapi import Request as _Request
+    from fastapi.exception_handlers import http_exception_handler
+    from fastapi.responses import JSONResponse
+
+    @app.exception_handler(HTTPException)
+    async def _touchque_exception_handler(request: _Request, exc: HTTPException):  # type: ignore[no-redef]
+        if isinstance(exc.detail, dict) and 'touchque' in exc.detail:
+            return JSONResponse(exc.detail, status_code=exc.status_code, headers=exc.headers)
+        return await http_exception_handler(request, exc)
+
+
+async def _await(awaitable: Awaitable[Any]) -> Any:
+    return await awaitable
+
+
+def _run_async(awaitable: Awaitable[Any]) -> Any:
+    """Resolves an async callback's result from the relay's worker thread."""
+    return anyio.from_thread.run(_await, awaitable)
+
+
+def touchque_relay_router(
+    client: Optional[TouchQue] = None,
+    prefix: str = '',
+    handler: Optional[RelayHandler] = None,
+    **options: Any
+) -> APIRouter:
+    """An APIRouter with every relay route. ``options`` are ``RelayHandler``'s
+    (``get_user_id`` is required); or pass a ready ``handler``. Callbacks may
+    be sync or async.
+
+    Callbacks get the Starlette ``Request``; ``on_authenticated(request,
+    response, info)`` gets a ``fastapi.Response`` whose headers (e.g.
+    ``response.set_cookie(...)``) are copied onto the JSON response - the same
+    pattern as a FastAPI ``response: Response`` parameter - or it may write
+    ``request.session``. ``request.client.host`` is the client IP the rate
+    limiter uses: behind a proxy, run uvicorn with ``--proxy-headers``.
+    The relay (blocking HTTP calls) runs in the threadpool.
+    """
+    relay = handler or RelayHandler(client, **options)
+    router = APIRouter(prefix=prefix)
+
+    def make_endpoint(method: str, sub: str) -> Callable[[Request], Awaitable[Response]]:
+        async def endpoint(request: Request) -> Response:
+            raw = await request.body()
+            body = None
+            if raw and request.headers.get('content-type', '').split(';')[0].strip() == 'application/json':
+                try:
+                    body = json.loads(raw)
+                except ValueError:
+                    body = None
+            native = Response()
+            path = sub.replace('<id>', request.path_params.get('cred_id', ''))
+            result = await anyio.to_thread.run_sync(lambda: relay.handle(
+                method, path, body=body,
+                ip=request.client.host if request.client else None,
+                user_agent=request.headers.get('user-agent'),
+                get_header=lambda name: request.headers.get(name),
+                request=request, response=native, run_async=_run_async,
+            ))
+            if result is None:
+                raise HTTPException(status_code=404)
+            out = JSONResponse(result.body, status_code=result.status, headers=result.headers)
+            out.raw_headers.extend(
+                (k, v) for k, v in native.raw_headers if k not in (b'content-length', b'content-type'))
+            return out
+        return endpoint
+
+    for method, sub in RELAY_ROUTES:
+        router.add_api_route(sub.replace('<id>', '{cred_id}'), make_endpoint(method, sub), methods=[method],
+                             include_in_schema=False)
+    return router

touchque/contrib/flask.py

@@ -0,0 +1,154 @@
+"""
+Flask: one line per protected route.
+
+    from touchque.contrib.flask import require_touchque
+
+    @app.post('/transfer')
+    @require_touchque('SEND_MONEY', details=lambda: {'Amount': f'{request.json["amount"]} EUR'})
+    def transfer():
+        return jsonify(ok=True, touchque=g.touchque)
+
+Until the user approves on their phone this answers
+202 {"touchque": step, "token": ...}. Your page shows the step in its own
+design and sends the same request again with header
+``X-TouchQue-Token: <token>``. Once approved the view runs ONCE, with
+``flask.g.touchque`` set to the approval.
+
+Relay routes (POST /login, enrollment, offline codes, passkey ceremonies)
+as one Blueprint - see ``touchque.relay.RelayHandler`` for every option:
+
+    from touchque.contrib.flask import touchque_relay_blueprint
+
+    def opened(req, resp, info):
+        session['user'] = info['externalUsername']
+
+    app.register_blueprint(touchque_relay_blueprint(
+        tq,
+        get_user_id=lambda req: session.get('user'),
+        get_login_user=lambda req: session.get('password_ok'),
+        on_authenticated=opened,
+    ), url_prefix='/touchque')
+"""
+import functools
+from typing import Any, Callable, Dict, Optional
+
+from flask import Blueprint, abort, current_app, g, json, jsonify, request
+
+from ..client import TouchQue, get_default_client
+from ..guard import SilentSignIn, guard_input_from_headers, run_guard, silent_input_from_headers
+from ..relay import RELAY_ROUTES, RelayHandler
+from ..steps import LoginDetails
+
+
+def _default_user() -> Optional[str]:
+    u = getattr(g, 'user', None)
+    if u is None:
+        return None
+    if isinstance(u, str):
+        return u
+    return getattr(u, 'email', None) or getattr(u, 'id', None) or getattr(u, 'username', None)
+
+
+def require_touchque(
+    action: str,
+    client: Optional[TouchQue] = None,
+    user: Optional[Callable[[], Optional[str]]] = None,
+    details: Optional[Callable[[], Optional[LoginDetails]]] = None,
+    reference_id: Optional[Callable[[], Optional[str]]] = None,
+    silent_sign_in: SilentSignIn = False,
+    context: Optional[Callable[[], Optional[Dict[str, Any]]]] = None,
+) -> Callable:
+    """
+    ``user``: who is approving. Default: ``flask.g.user`` (string, or an
+    object with ``.email``/``.id``/``.username``). For the login step, return
+    the user who just passed your password check, e.g.
+    ``user=lambda: session.get('password_ok')``.
+
+    ``silent_sign_in`` (default off): when on, a new attempt whose browser
+    sent its device-bound key proof (``X-TouchQue-Browser``, added by
+    ``@touchque/web`` with ``browserKey: true``) first asks TouchQue whether
+    anything about it is new. If nothing is, your view runs at once with no
+    push (``g.touchque['assurance']['method'] == 'silent'``,
+    ``g.touchque['reasons']``). Otherwise, and on any error, the usual push
+    starts and its approval makes the browser known.
+    ``{'max_age_seconds': n}`` sets your own limit on how long ago the last
+    phone approval in that browser may be.
+
+    ``context``: for your TouchQue Actions only (``event.context``), e.g.
+    ``context=lambda: {'roles': g.user.roles}``. Never shown on the phone.
+    """
+    user_of = user or _default_user
+    tq = client
+
+    def decorator(view: Callable) -> Callable:
+        @functools.wraps(view)
+        def wrapped(*args: Any, **kwargs: Any) -> Any:
+            c = tq or get_default_client()
+            uid = user_of()
+            result = run_guard(
+                c, uid, action,
+                details=details() if details else None,
+                reference_id=reference_id() if reference_id else None,
+                context=context() if context else None,
+                ip=request.remote_addr, user_agent=request.headers.get('User-Agent'),
+                **guard_input_from_headers(lambda name: request.headers.get(name)),
+                **silent_input_from_headers(silent_sign_in, lambda name: request.headers.get(name)),
+            )
+            if 'approved' in result:
+                g.touchque = result['approved']
+                return view(*args, **kwargs)
+            resp = jsonify(result['body'])
+            resp.status_code = result['status']
+            resp.headers['Cache-Control'] = 'no-store'
+            retry = result['body']['touchque'].get('retryAfter')
+            if retry:
+                resp.headers['Retry-After'] = str(retry)
+            return resp
+        return wrapped
+    return decorator
+
+
+def touchque_relay_blueprint(
+    client: Optional[TouchQue] = None,
+    name: str = 'touchque_relay',
+    url_prefix: Optional[str] = None,
+    handler: Optional[RelayHandler] = None,
+    **options: Any
+) -> Blueprint:
+    """A Blueprint with every relay route. ``options`` are ``RelayHandler``'s
+    (``get_user_id`` is required); or pass a ready ``handler``.
+
+    Callbacks get ``flask.request``; ``on_authenticated(request, response,
+    info)`` gets the Flask response that will be sent, so it may call
+    ``response.set_cookie(...)`` or write ``flask.session``.
+    ``request.remote_addr`` is the client IP the rate limiter uses: behind a
+    proxy, wrap the app in werkzeug's ``ProxyFix``.
+    """
+    relay = handler or RelayHandler(client, **options)
+    bp = Blueprint(name, __name__, url_prefix=url_prefix)
+
+    def make_view(method: str, sub: str) -> Callable:
+        def view(cred_id: Optional[str] = None) -> Any:
+            response = current_app.response_class(mimetype='application/json')
+            result = relay.handle(
+                method, sub.replace('<id>', cred_id or ''),
+                body=request.get_json(silent=True),
+                ip=request.remote_addr, user_agent=request.headers.get('User-Agent'),
+                get_header=lambda name_: request.headers.get(name_),
+                request=request._get_current_object(),  # type: ignore[attr-defined]
+                response=response,
+            )
+            if result is None:
+                abort(404)
+            response.set_data(json.dumps(result.body))
+            response.status_code = result.status
+            for key, value in result.headers.items():
+                response.headers[key] = value
+            return response
+        return view
+
+    for method, sub in RELAY_ROUTES:
+        endpoint = method.lower() + sub.replace('/', '_').replace('<id>', 'id')
+        bp.add_url_rule(sub.replace('<id>', '<cred_id>'), endpoint=endpoint,
+                        view_func=make_view(method, sub), methods=[method])
+    return bp