usso 0.24.11__py3-none-any.whl → 0.24.12__py3-none-any.whl

usso/async_session.py

@@ -1,21 +1,51 @@
 from contextlib import asynccontextmanager
-from datetime import datetime
+from datetime import datetime, timedelta
 
 import aiohttp
 import jwt
 
 
 class AsyncUssoSession:
-    def __init__(self, sso_refresh_url: str, refresh_token: str | None = None):
+    def __init__(
+        self,
+        sso_refresh_url: str,
+        refresh_token: str | None = None,
+        api_key: str | None = None,
+    ):
         self.sso_refresh_url = sso_refresh_url
-        self.refresh_token = refresh_token
+        self._refresh_token = refresh_token
         self.access_token = None
         self.session = None  # This will hold the aiohttp session
+        self.api_key = api_key
+
+    @property
+    def refresh_token(self):
+        decoded_token = jwt.decode(
+            self._refresh_token, options={"verify_signature": False}
+        )
+        exp = decoded_token.get("exp", datetime.now() + timedelta(days=1))
+        if exp < datetime.now():
+            self._refresh_token = None
+
+        return self._refresh_token
+
+    async def _refresh_api(self):
+        async with aiohttp.ClientSession() as session:
+            async with session.get(
+                f"{self.sso_refresh_url}/api",
+                headers={"x-api-key": self.api_key},
+            ) as response:
+                response.raise_for_status()
+                data: dict = await response.json()
+                self._refresh_token = data.get("token", {}).get("refresh_token")
 
     async def _refresh(self):
-        if not self.refresh_token:
+        if not self.refresh_token and not self.api_key:
             raise ValueError("Refresh token not provided or invalid.")
 
+        if self.api_key and not self.refresh_token:
+            self._refresh_api()
+
         async with aiohttp.ClientSession() as session:
             async with session.post(
                 self.sso_refresh_url,

usso/core.py

@@ -64,23 +64,11 @@ class Usso(metaclass=Singleton):
         scheme, _, param = authorization_header_value.partition(" ")
         return scheme, param
 
-    def user_data_from_token(self, token: str, **kwargs) -> UserData | None:
-        """Return the user associated with a token value."""
+    def decode_token(self, key, token: str, **kwargs) -> dict:
         try:
-            # header = jwt.get_unverified_header(token)
-            # jwks_url = header["jwk_url"]
-            jwks_client = self.get_jwks_keys()
-            signing_key = jwks_client.get_signing_key_from_jwt(token)
-            decoded = jwt.decode(
-                token,
-                signing_key.key,
-                algorithms=["RS256"],
-            )
+            decoded = jwt.decode(token, key, algorithms=["RS256"])
             if decoded["token_type"] != "access":
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_token_type",
-                )
+                raise USSOException(status_code=401, error="invalid_token_type")
             decoded["token"] = token
             return UserData(**decoded)
         except jwt.exceptions.ExpiredSignatureError:
@@ -91,31 +79,30 @@ class Usso(metaclass=Singleton):
                 raise USSOException(status_code=401, error="invalid_signature")
         except jwt.exceptions.InvalidAlgorithmError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_algorithm",
-                )
+                raise USSOException(status_code=401, error="invalid_algorithm")
         except jwt.exceptions.InvalidIssuedAtError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_issued_at",
-                )
+                raise USSOException(status_code=401, error="invalid_issued_at")
         except jwt.exceptions.InvalidTokenError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_token",
-                )
+                raise USSOException(status_code=401, error="invalid_token")
         except jwt.exceptions.InvalidKeyError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_key",
-                )
+                raise USSOException(status_code=401, error="invalid_key")
         except USSOException as e:
             if kwargs.get("raise_exception", True):
                 raise e
+        except Exception as e:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="error", message=str(e))
+            logger.error(e)
+
+    def user_data_from_token(self, token: str, **kwargs) -> UserData | None:
+        """Return the user associated with a token value."""
+        try:
+            jwks_client = self.get_jwks_keys()
+            signing_key = jwks_client.get_signing_key_from_jwt(token)
+            return self.decode_token(signing_key.key, token, **kwargs)
         except Exception as e:
             if kwargs.get("raise_exception", True):
                 raise USSOException(

usso/fastapi/auth_middleware.py

@@ -73,15 +73,45 @@ class Usso:
         scheme, _, param = authorization_header_value.partition(" ")
         return scheme, param
 
+    def decode_token(self, key, token: str, **kwargs) -> dict:
+        try:
+            decoded = jwt.decode(token, key, algorithms=["RS256"])
+            if decoded["token_type"] != "access":
+                raise USSOException(status_code=401, error="invalid_token_type")
+            decoded["token"] = token
+            return UserData(**decoded)
+        except jwt.exceptions.ExpiredSignatureError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="expired_signature")
+        except jwt.exceptions.InvalidSignatureError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="invalid_signature")
+        except jwt.exceptions.InvalidAlgorithmError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="invalid_algorithm")
+        except jwt.exceptions.InvalidIssuedAtError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="invalid_issued_at")
+        except jwt.exceptions.InvalidTokenError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="invalid_token")
+        except jwt.exceptions.InvalidKeyError:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="invalid_key")
+        except USSOException as e:
+            if kwargs.get("raise_exception", True):
+                raise e
+        except Exception as e:
+            if kwargs.get("raise_exception", True):
+                raise USSOException(status_code=401, error="error", message=str(e))
+            logger.error(e)
+
     def user_data_from_token(self, token: str, **kwargs) -> UserData | None:
         """Return the user associated with a token value."""
         try:
             decoded = self.jwk_url.decode(token)
             if decoded["token_type"] != "access":
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_token_type",
-                )
+                raise USSOException(status_code=401, error="invalid_token_type")
             decoded["token"] = token
             return UserData(**decoded)
         except jwt.exceptions.ExpiredSignatureError:
@@ -92,45 +122,25 @@ class Usso:
                 raise USSOException(status_code=401, error="invalid_signature")
         except jwt.exceptions.InvalidAlgorithmError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_algorithm",
-                )
+                raise USSOException(status_code=401, error="invalid_algorithm")
         except jwt.exceptions.InvalidIssuedAtError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_issued_at",
-                )
+                raise USSOException(status_code=401, error="invalid_issued_at")
         except jwt.exceptions.InvalidTokenError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_token",
-                )
+                raise USSOException(status_code=401, error="invalid_token")
         except jwt.exceptions.InvalidKeyError:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="invalid_key",
-                )
+                raise USSOException(status_code=401, error="invalid_key")
         except KeyError as e:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="key_error",
-                    message=str(e),
-                )
+                raise USSOException(status_code=401, error="key_error", message=str(e))
         except USSOException as e:
             if kwargs.get("raise_exception", True):
                 raise e
         except Exception as e:
             if kwargs.get("raise_exception", True):
-                raise USSOException(
-                    status_code=401,
-                    error="error",
-                    message=str(e),
-                )
+                raise USSOException(status_code=401, error="error", message=str(e))
             logger.error(e)
 
     async def jwt_access_security(self, request: Request) -> UserData | None:

usso/session.py

@@ -1,19 +1,49 @@
-from datetime import datetime
+from datetime import datetime, timedelta
 
 import jwt
 import requests
 
 
 class UssoSession:
-    def __init__(self, sso_refresh_url: str, refresh_token: str | None = None):
+
+    def __init__(
+        self,
+        sso_refresh_url: str,
+        refresh_token: str | None = None,
+        api_key: str | None = None,
+    ):
         self.sso_refresh_url = sso_refresh_url
-        self.refresh_token = refresh_token
+        self._refresh_token = refresh_token
         self.session = requests.Session()
         self.access_token = None
+        self.api_key = api_key
+
+    @property
+    def refresh_token(self):
+        decoded_token = jwt.decode(
+            self._refresh_token, options={"verify_signature": False}
+        )
+        exp = decoded_token.get("exp", datetime.now() + timedelta(days=1))
+        if exp < datetime.now():
+            self._refresh_token = None
+
+        return self._refresh_token
+
+    def _refresh_api(self):
+        response = requests.get(
+            f"{self.sso_refresh_url}/api",
+            headers={"x-api-key": self.api_key},
+        )
+        response.raise_for_status()
+        data = response.json()
+        self._refresh_token = data.get("token", {}).get("refresh_token")
 
     def _refresh(self):
-        if not self.refresh_token:
+        if not self.refresh_token and not self.api_key:
             return
+        
+        if self.api_key and not self.refresh_token:
+            self._refresh_api()
 
         response = requests.post(
             self.sso_refresh_url,

{usso-0.24.11.dist-info → usso-0.24.12.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: usso
-Version: 0.24.11
+Version: 0.24.12
 Summary: A plug-and-play client for integrating universal single sign-on (SSO) with Python frameworks, enabling secure and seamless authentication across microservices.
 Author-email: Mahdi Kiani <mahdikiany@gmail.com>
 Maintainer-email: Mahdi Kiani <mahdikiany@gmail.com>

{usso-0.24.11.dist-info → usso-0.24.12.dist-info}/RECORD

@@ -1,20 +1,20 @@
 usso/__init__.py,sha256=NnOS_S1a-JKTOlGe1nw-kCL3m0y82mA2mDraus7BQ2o,120
 usso/api.py,sha256=xlDq2nZNpq3mhAvqIbGEfANHNjJpPquSeULBfS7iMJw,5094
 usso/async_api.py,sha256=rb-Xh5oudmZrPYM_iH_B75b5Z0Fvi1V1uurdcKE51w0,5551
-usso/async_session.py,sha256=EPHT0wjwGuRg3NLvtUlLNSVZCgvAvRyUGx21XBsEBHk,3028
+usso/async_session.py,sha256=whaxQjR1tkarOljknrhNyPAS5sHvYasBszvd0_MoN3Q,4015
 usso/b64tools.py,sha256=HGQ0E59vzjrQo2-4jrcY03ebtTaYwTtCZ7KgJaEmxO0,610
-usso/core.py,sha256=m6Y-g70FuPYZM3AMtsEVVToQkYrf4WwNVH8C4HZRzl8,4103
+usso/core.py,sha256=cOpETK_gGVsUJT0EeIebOGLEbF8vHVET-_I-8QxOCyE,3977
 usso/exceptions.py,sha256=hawOAuVbvQtjgRfwp1KFZ4SmV7fh720y5Gom9JVA8W8,504
 usso/package_data.dat,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-usso/session.py,sha256=S3dFXzar0Pcwxj5TGqadKwGdmzmzgp4H2W3brfOwJ6A,1184
+usso/session.py,sha256=4KFePzs9gjtoPOpcrKR8A-GWtUF3zhVBAAWzKaA3lm8,2055
 usso/django/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 usso/django/middleware.py,sha256=EEEpHvMQ6QiWw2HY8zQ2Aec0RCATcLWsCKeyiPWJKio,3245
 usso/fastapi/__init__.py,sha256=0EcdOzb4f3yu9nILIdGWnlyUz-0VaVX2az1e3f2BusI,201
-usso/fastapi/auth_middleware.py,sha256=5JnDHvBM_xfasSHpBIFlrxFsZTLS2AhMuvyzr0tyI8k,6323
+usso/fastapi/auth_middleware.py,sha256=DYrNPy_9FIV1amRuafoJtgGMi8uE0FPmSKBUGP79GNo,7616
 usso/fastapi/integration.py,sha256=VAUWaa7ChQ1jTtn8A136VgyG6t2kDo5pGK-3RgmNDVs,1669
-usso-0.24.11.dist-info/LICENSE.txt,sha256=ceC9ZJOV9H6CtQDcYmHOS46NA3dHJ_WD4J9blH513pc,1081
-usso-0.24.11.dist-info/METADATA,sha256=q-FE19C5UYkURUE1vqgifDzb52Dxf1irEWjyhwiijYg,4275
-usso-0.24.11.dist-info/WHEEL,sha256=GV9aMThwP_4oNCtvEC2ec3qUYutgWeAzklro_0m4WJQ,91
-usso-0.24.11.dist-info/entry_points.txt,sha256=4Zgpm5ELaAWPf0jPGJFz1_X69H7un8ycT3WdGoJ0Vvk,35
-usso-0.24.11.dist-info/top_level.txt,sha256=g9Jf6h1Oyidh0vPiFni7UHInTJjSvu6cUalpLTIvthg,5
-usso-0.24.11.dist-info/RECORD,,
+usso-0.24.12.dist-info/LICENSE.txt,sha256=ceC9ZJOV9H6CtQDcYmHOS46NA3dHJ_WD4J9blH513pc,1081
+usso-0.24.12.dist-info/METADATA,sha256=3ZTqFGl6CCBk-YIXYsDy6IECFv1nAbdhWKI-s1aEUD8,4275
+usso-0.24.12.dist-info/WHEEL,sha256=GV9aMThwP_4oNCtvEC2ec3qUYutgWeAzklro_0m4WJQ,91
+usso-0.24.12.dist-info/entry_points.txt,sha256=4Zgpm5ELaAWPf0jPGJFz1_X69H7un8ycT3WdGoJ0Vvk,35
+usso-0.24.12.dist-info/top_level.txt,sha256=g9Jf6h1Oyidh0vPiFni7UHInTJjSvu6cUalpLTIvthg,5
+usso-0.24.12.dist-info/RECORD,,