unrealon 1.0.9__py3-none-any.whl → 1.1.0__py3-none-any.whl

unrealon_sdk/src/enterprise/authentication.py

@@ -1,401 +0,0 @@
-"""
-Enterprise Authentication System for UnrealOn SDK v1.0
-
-Layer 2: Enterprise Services - Secure authentication with:
-- API key validation and management
-- Token lifecycle management
-- Rate limiting and security monitoring
-- Authentication audit trails
-- Automatic token refresh
-- Security breach detection
-
-Enterprise Features:
-- Multi-environment API key support (dev/prod)
-- Token caching and automatic refresh
-- Authentication rate limiting
-- Security event logging and monitoring
-- Audit trails for compliance
-- Intrusion detection and alerts
-- Role-based access control integration
-"""
-
-import asyncio
-import logging
-from datetime import datetime, timezone, timedelta
-from typing import Dict, List, Optional, Callable, Any, Union
-from collections import defaultdict, deque
-from enum import Enum
-import re
-import hashlib
-import hmac
-import time
-
-# Pydantic v2 for all data models
-from pydantic import BaseModel, Field, ConfigDict
-
-# Use existing auto-generated models - NO duplication!
-from unrealon_sdk.src.clients.python_http.models import (
-    ParserRegistrationRequest,
-    ParserRegistrationResponse,
-    ParserType,
-    ErrorResponse,
-    SuccessResponse,
-)
-from unrealon_sdk.src.clients.python_http.api_config import APIConfig
-
-# Auto-generated services for authentication
-from unrealon_sdk.src.clients.python_http.services.async_ParserManagement_service import (
-    register_parser_api_v1_parsers_register_post,
-)
-
-# DTO models for type-safe data structures
-from unrealon_sdk.src.dto.authentication import (
-    AuthenticationStatus,
-    SecurityEventType,
-    AuthenticationContext,
-    SecurityEvent,
-    RateLimitConfig,
-)
-
-# Core SDK components
-from unrealon_sdk.src.core.config import AdapterConfig
-from unrealon_sdk.src.core.exceptions import AuthenticationError, ConnectionError
-from unrealon_sdk.src.utils import generate_correlation_id, validate_api_key
-
-# Development logging
-from typing import TYPE_CHECKING
-
-if TYPE_CHECKING:
-    from unrealon_sdk.src.enterprise.logging.development import DevelopmentLogger
-
-logger = logging.getLogger(__name__)
-
-
-# Authentication models moved to unrealon_sdk.dto.authentication
-
-
-class EnterpriseAuthenticationSystem:
-    """
-    Enterprise-grade authentication system for UnrealOn SDK.
-
-    Features:
-    - API key validation with enterprise security
-    - Token lifecycle management with automatic refresh
-    - Rate limiting and intrusion detection
-    - Comprehensive audit trails for compliance
-    - Multi-environment support (dev/prod)
-    - Security monitoring and alerting
-    """
-
-    def __init__(self, config: AdapterConfig):
-        """
-        Initialize Enterprise Authentication System.
-
-        Args:
-            config: Adapter configuration with API credentials
-        """
-        self.config = config
-        self.logger = logger
-
-        # Authentication state
-        self._context = AuthenticationContext(
-            api_key=None,
-            access_token=None,
-            session_id=None,
-            parser_id=None,
-            authenticated_at=None,
-            expires_at=None,
-            last_login_attempt=None,
-            rate_limit_reset_time=None,
-        )
-        self._api_config = APIConfig()
-
-        # Security monitoring
-        self._security_events: deque[SecurityEvent] = deque(maxlen=1000)
-        self._rate_limits: Dict[str, List[datetime]] = defaultdict(list)
-        self._rate_limit_config = RateLimitConfig()
-
-        # Background tasks for token refresh and monitoring
-        self._background_tasks: List[asyncio.Task[Any]] = []
-        self._shutdown_event = asyncio.Event()
-
-        self.logger.info("Enterprise Authentication System initialized")
-
-    async def authenticate(self) -> bool:
-        """
-        Authenticate using configured API key.
-
-        Returns:
-            True if authentication successful
-
-        Raises:
-            AuthenticationError: If authentication fails
-        """
-        try:
-            # Check rate limiting
-            if not self._check_rate_limit():
-                await self._log_security_event(
-                    SecurityEventType.RATE_LIMIT_EXCEEDED,
-                    success=False,
-                    error_message="Rate limit exceeded",
-                )
-                raise AuthenticationError("Rate limit exceeded. Please try again later.")
-
-            # Update context
-            self._context.status = AuthenticationStatus.AUTHENTICATING
-            self._context.login_attempts += 1
-            self._context.last_login_attempt = datetime.now(timezone.utc)
-
-            # Validate API key format
-            if not validate_api_key(self.config.api_key):
-                await self._handle_authentication_failure("Invalid API key format")
-                return False
-
-            # Extract environment from API key
-            environment = "prod" if self.config.api_key.startswith("up_prod_") else "dev"
-            self._context.environment = environment
-
-            # Mask API key for logging
-            self._context.api_key = self._mask_api_key(self.config.api_key)
-
-            # Create registration request using auto-generated model
-            registration_request = ParserRegistrationRequest(
-                api_key=self.config.api_key,
-                parser_id=self.config.parser_id,
-                parser_name=self.config.parser_name,
-                parser_type=ParserType.GENERAL,  # Use available type
-                metadata={
-                    "sdk_version": "1.0.0",
-                    "environment": environment,
-                    "authentication_method": "api_key",
-                    "session_id": generate_correlation_id(),
-                },
-            )
-
-            # Configure API client
-            self._api_config.access_token = self.config.api_key
-
-            # Attempt registration/authentication
-            response = await register_parser_api_v1_parsers_register_post(
-                data=registration_request,
-                authorization=f"Bearer {self.config.api_key}",
-                api_config_override=self._api_config,
-            )
-
-            # Handle successful authentication
-            await self._handle_authentication_success(response)
-
-            # Log security event
-            await self._log_security_event(
-                SecurityEventType.LOGIN_SUCCESS,
-                success=True,
-                metadata={"parser_id": self.config.parser_id, "environment": environment},
-            )
-
-            return True
-
-        except Exception as e:
-            await self._handle_authentication_failure(str(e))
-            return False
-
-    async def _handle_authentication_success(self, response: ParserRegistrationResponse) -> None:
-        """Handle successful authentication response."""
-        self._context.status = AuthenticationStatus.AUTHENTICATED
-        self._context.authenticated_at = datetime.now(timezone.utc)
-        self._context.session_id = generate_correlation_id()
-        self._context.parser_id = self.config.parser_id
-
-        # Reset failure counters
-        self._context.failed_attempts = 0
-
-        # Set token expiration (default 24 hours for enterprise)
-        self._context.expires_at = datetime.now(timezone.utc) + timedelta(hours=24)
-
-        self.logger.info(f"Authentication successful for parser: {self.config.parser_id}")
-
-    async def _handle_authentication_failure(self, error_message: str) -> None:
-        """Handle authentication failure with security monitoring."""
-        self._context.status = AuthenticationStatus.FAILED
-        self._context.failed_attempts += 1
-
-        # Check for account lockout
-        if self._context.failed_attempts >= self._rate_limit_config.max_attempts:
-            self._context.status = AuthenticationStatus.LOCKED
-            self._context.rate_limit_reset_time = datetime.now(timezone.utc) + timedelta(
-                seconds=self._rate_limit_config.lockout_duration_seconds
-            )
-
-            await self._log_security_event(
-                SecurityEventType.ACCOUNT_LOCKED,
-                success=False,
-                error_message=f"Account locked after {self._context.failed_attempts} failures",
-            )
-
-        # Log authentication failure
-        await self._log_security_event(
-            SecurityEventType.LOGIN_FAILURE, success=False, error_message=error_message
-        )
-
-        self.logger.warning(f"Authentication failed: {error_message}")
-        raise AuthenticationError(f"Authentication failed: {error_message}")
-
-    def _check_rate_limit(self) -> bool:
-        """Check if current request is within rate limits."""
-        now = datetime.now(timezone.utc)
-        api_key_hash = self._hash_api_key(self.config.api_key)
-
-        # Clean old attempts
-        cutoff = now - timedelta(seconds=self._rate_limit_config.window_seconds)
-        self._rate_limits[api_key_hash] = [
-            attempt for attempt in self._rate_limits[api_key_hash] if attempt > cutoff
-        ]
-
-        # Check if under limit
-        current_attempts = len(self._rate_limits[api_key_hash])
-        if current_attempts >= self._rate_limit_config.max_attempts:
-            return False
-
-        # Add current attempt
-        self._rate_limits[api_key_hash].append(now)
-        return True
-
-    def _mask_api_key(self, api_key: str) -> str:
-        """Mask API key for secure logging."""
-        if len(api_key) <= 8:
-            return "*" * len(api_key)
-        return api_key[:4] + "*" * (len(api_key) - 8) + api_key[-4:]
-
-    def _hash_api_key(self, api_key: str) -> str:
-        """Create secure hash of API key for rate limiting."""
-        return hashlib.sha256(api_key.encode()).hexdigest()[:16]
-
-    async def _log_security_event(
-        self,
-        event_type: SecurityEventType,
-        success: bool,
-        error_message: Optional[str] = None,
-        metadata: Optional[Dict[str, Any]] = None,
-    ) -> None:
-        """Log security event for audit trails."""
-        event = SecurityEvent(
-            event_id=generate_correlation_id(),
-            event_type=event_type,
-            session_id=self._context.session_id,
-            api_key_hash=self._hash_api_key(self.config.api_key) if self.config.api_key else None,
-            ip_address=None,  # Could be enhanced to get actual IP
-            user_agent=None,  # Could be enhanced to get actual user agent
-            success=success,
-            error_message=error_message,
-            metadata=metadata or {},
-        )
-
-        self._security_events.append(event)
-
-        # Log at appropriate level
-        if success:
-            self.logger.info(f"Security event: {event_type.value}")
-        else:
-            self.logger.warning(f"Security event: {event_type.value} - {error_message}")
-
-    def is_authenticated(self) -> bool:
-        """Check if currently authenticated."""
-        if self._context.status != AuthenticationStatus.AUTHENTICATED:
-            return False
-
-        # Check token expiration
-        if self._context.expires_at and datetime.now(timezone.utc) > self._context.expires_at:
-            self._context.status = AuthenticationStatus.EXPIRED
-            return False
-
-        return True
-
-    def get_authentication_context(self) -> AuthenticationContext:
-        """Get current authentication context."""
-        return self._context
-
-    def get_security_events(
-        self, event_types: Optional[List[SecurityEventType]] = None, limit: int = 100
-    ) -> List[SecurityEvent]:
-        """Get recent security events for monitoring."""
-        events = list(self._security_events)
-
-        if event_types:
-            events = [e for e in events if e.event_type in event_types]
-
-        return events[-limit:]
-
-    async def refresh_authentication(self) -> bool:
-        """Refresh authentication if needed."""
-        if not self.is_authenticated():
-            return await self.authenticate()
-
-        # Check if refresh is needed (refresh 1 hour before expiration)
-        if self._context.expires_at and datetime.now(
-            timezone.utc
-        ) > self._context.expires_at - timedelta(hours=1):
-
-            await self._log_security_event(
-                SecurityEventType.TOKEN_REFRESH,
-                success=True,
-                metadata={"reason": "proactive_refresh"},
-            )
-
-            return await self.authenticate()
-
-        return True
-
-    async def logout(self) -> None:
-        """Logout and clear authentication state."""
-        self._context.status = AuthenticationStatus.UNAUTHENTICATED
-        self._context.access_token = None
-        self._context.session_id = None
-        self._context.authenticated_at = None
-        self._context.expires_at = None
-
-        self.logger.info("Logged out successfully")
-
-    async def shutdown(self) -> None:
-        """Shutdown authentication system gracefully."""
-        self.logger.info("Shutting down Enterprise Authentication System...")
-
-        # Signal shutdown
-        self._shutdown_event.set()
-
-        # Cancel background tasks
-        for task in self._background_tasks:
-            task.cancel()
-
-        # Wait for tasks to complete
-        if self._background_tasks:
-            await asyncio.gather(*self._background_tasks, return_exceptions=True)
-
-        self.logger.info("Enterprise Authentication System shutdown complete")
-
-
-# Convenience function for creating authentication system
-def create_authentication_system(config: AdapterConfig) -> EnterpriseAuthenticationSystem:
-    """
-    Create and configure Enterprise Authentication System.
-
-    Args:
-        config: Adapter configuration with API credentials
-
-    Returns:
-        Configured authentication system instance
-    """
-    return EnterpriseAuthenticationSystem(config)
-
-
-# Export all public components
-__all__ = [
-    # Core system
-    "EnterpriseAuthenticationSystem",
-    "create_authentication_system",
-    # Models (using auto-generated when possible)
-    "AuthenticationContext",
-    "SecurityEvent",
-    "RateLimitConfig",
-    # Enums
-    "AuthenticationStatus",
-    "SecurityEventType",
-]