vs-security 0.1.0__tar.gz

vs_security-0.1.0/PKG-INFO

@@ -0,0 +1,29 @@
+Metadata-Version: 2.4
+Name: vs-security
+Version: 0.1.0
+Summary: Security library for Viveka Sutra — authentication, JWT, and authorization
+Project-URL: Homepage, https://vivekasutra.com/
+Project-URL: Source, https://github.com/vivekasutra/viveka-mula
+Keywords: security,auth,jwt,authentication,viveka,vs
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Framework :: AsyncIO
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyjwt>=2.8
+Requires-Dist: bcrypt>=4.0
+Requires-Dist: vs-common
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.110; extra == "fastapi"
+Provides-Extra: dev
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

vs_security-0.1.0/pyproject.toml

@@ -0,0 +1,53 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vs-security"
+version = "0.1.0"
+description = "Security library for Viveka Sutra — authentication, JWT, and authorization"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { file = "LICENSE.txt" }
+keywords = ["security", "auth", "jwt", "authentication", "viveka", "vs"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: Other/Proprietary License",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Framework :: AsyncIO",
+    "Typing :: Typed",
+]
+
+dependencies = [
+    "pydantic>=2.0",
+    "pyjwt>=2.8",
+    "bcrypt>=4.0",
+    "vs-common",
+]
+
+[project.optional-dependencies]
+fastapi = [
+    "fastapi>=0.110",
+]
+dev = [
+    "build",
+    "twine",
+    "pytest>=8.0",
+    "pytest-asyncio>=0.23",
+]
+
+[project.urls]
+Homepage = "https://vivekasutra.com/"
+Source   = "https://github.com/vivekasutra/viveka-mula"
+
+[tool.setuptools.packages.find]
+where   = ["."]
+include = ["vs_security*"]
+exclude = [".venv*"]
+
+[tool.setuptools.package-data]
+vs_security = ["py.typed"]

vs_security-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vs_security-0.1.0/vs_security/__init__.py

@@ -0,0 +1,37 @@
+from vs_security.schema.vs_auth_metadata import VsAuthMetadata
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_credentials import VsCredentials, VsUsernamePasswordCredentials
+from vs_security.schema.vs_token_pair import VsTokenPair
+from vs_security.auth.vs_token_store import VsTokenStore
+from vs_security.auth.vs_auth_provider import VsAuthProvider
+from vs_security.auth.vs_jwt_provider import VsJWTProvider
+from vs_security.auth.vs_auth_manager import VsAuthManager
+from vs_security.auth.vs_username_password_provider import VsUsernamePasswordAuthProvider
+from vs_security.guard.vs_security import VsSecurity, get_auth_context
+from vs_security.error.vs_auth_error import (
+    VsAuthenticationError,
+    VsTokenExpiredError,
+    VsInsufficientRolesError,
+    VsInvalidCredentialsError,
+    VsTokenRevokedError,
+)
+
+__all__ = [
+    "VsAuthMetadata",
+    "VsAuthContext",
+    "VsCredentials",
+    "VsUsernamePasswordCredentials",
+    "VsTokenPair",
+    "VsTokenStore",
+    "VsAuthProvider",
+    "VsJWTProvider",
+    "VsAuthManager",
+    "VsUsernamePasswordAuthProvider",
+    "VsSecurity",
+    "get_auth_context",
+    "VsAuthenticationError",
+    "VsTokenExpiredError",
+    "VsInsufficientRolesError",
+    "VsInvalidCredentialsError",
+    "VsTokenRevokedError",
+]

vs_security-0.1.0/vs_security/auth/__init__.py

@@ -0,0 +1,13 @@
+from vs_security.auth.vs_auth_provider import VsAuthProvider
+from vs_security.auth.vs_token_store import VsTokenStore
+from vs_security.auth.vs_jwt_provider import VsJWTProvider
+from vs_security.auth.vs_auth_manager import VsAuthManager
+from vs_security.auth.vs_username_password_provider import VsUsernamePasswordAuthProvider
+
+__all__ = [
+    "VsAuthProvider",
+    "VsTokenStore",
+    "VsJWTProvider",
+    "VsAuthManager",
+    "VsUsernamePasswordAuthProvider",
+]

vs_security-0.1.0/vs_security/auth/vs_auth_manager.py

@@ -0,0 +1,25 @@
+from vs_common.log.vs_log_manager import VsLogManager
+from vs_security.auth.vs_auth_provider import VsAuthProvider
+from vs_security.auth.vs_jwt_provider import VsJWTProvider
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_credentials import VsCredentials
+from vs_security.schema.vs_token_pair import VsTokenPair
+
+
+class VsAuthManager:
+
+    def __init__(self, jwt_provider: VsJWTProvider):
+        self._jwt_provider = jwt_provider
+        self._providers: dict[str, VsAuthProvider] = {}
+        self._logger = VsLogManager.get_instance(self.__class__.__name__)
+
+    def register(self, name: str, provider: VsAuthProvider) -> None:
+        self._providers[name] = provider
+        self._logger.info(f"Registered auth provider: {name}")
+
+    async def authenticate(self, provider_name: str, credentials: VsCredentials) -> VsTokenPair:
+        provider = self._providers.get(provider_name)
+        if not provider:
+            raise ValueError(f"No auth provider registered with name: {provider_name}")
+        context: VsAuthContext = await provider.authenticate(credentials)
+        return await self._jwt_provider.generate_token(context)

vs_security-0.1.0/vs_security/auth/vs_auth_provider.py

@@ -0,0 +1,10 @@
+from abc import ABC, abstractmethod
+
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_credentials import VsCredentials
+
+
+class VsAuthProvider(ABC):
+
+    @abstractmethod
+    async def authenticate(self, credentials: VsCredentials) -> VsAuthContext: ...

vs_security-0.1.0/vs_security/auth/vs_jwt_provider.py

@@ -0,0 +1,100 @@
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+from uuid import UUID
+
+import jwt
+
+from vs_common.config.vs_base_config import VsBaseConfig
+from vs_common.log.vs_log_manager import VsLogManager
+from vs_security.auth.vs_token_store import VsTokenStore
+from vs_security.error.vs_auth_error import VsTokenExpiredError, VsAuthenticationError, VsTokenRevokedError
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_token_pair import VsTokenPair
+
+_DEFAULT_ALGORITHM = "HS256"
+_DEFAULT_ACCESS_EXPIRY_MINUTES = 15
+_DEFAULT_REFRESH_EXPIRY_DAYS = 7
+
+
+class VsJWTProvider:
+
+    def __init__(self, config: VsBaseConfig, token_store: Optional[VsTokenStore] = None):
+        self._logger = VsLogManager.get_instance(self.__class__.__name__)
+        self._token_store = token_store
+        self._secret = config.get("auth.secret_key")
+        self._algorithm = config.get("auth.algorithm", default=_DEFAULT_ALGORITHM)
+        self._access_expiry_minutes = config.get(
+            "auth.access_expiry_minutes", default=_DEFAULT_ACCESS_EXPIRY_MINUTES, data_type=int
+        )
+        self._refresh_expiry_days = config.get(
+            "auth.refresh_expiry_days", default=_DEFAULT_REFRESH_EXPIRY_DAYS, data_type=int
+        )
+        if not self._secret:
+            raise ValueError("auth.secret_key must be set in config.ini")
+
+    async def generate_token(self, context: VsAuthContext) -> VsTokenPair:
+        access_token = self._mint(context, self._access_expiry_minutes * 60, "access")
+        refresh_token = self._mint(context, self._refresh_expiry_days * 86400, "refresh")
+        if self._token_store:
+            await self._token_store.save(context.user_id, refresh_token)
+        self._logger.debug(f"Generated token pair for user {context.user_id}")
+        return VsTokenPair(access_token=access_token, refresh_token=refresh_token)
+
+    async def verify_token(self, token: str) -> VsAuthContext:
+        payload = self._decode(token, expected_type="access")
+        return self._payload_to_context(payload)
+
+    async def refresh_token(self, refresh_token: str) -> VsTokenPair:
+        payload = self._decode(refresh_token, expected_type="refresh")
+        user_id = UUID(payload["sub"])
+
+        if self._token_store:
+            stored = await self._token_store.get_all(user_id)
+            if refresh_token not in stored:
+                raise VsTokenRevokedError()
+            await self._token_store.delete(user_id, refresh_token)
+
+        context = self._payload_to_context(payload)
+        return await self.generate_token(context)
+
+    async def revoke_token(self, user_id: UUID, refresh_token: str) -> None:
+        if not self._token_store:
+            raise NotImplementedError("No VsTokenStore configured")
+        await self._token_store.delete(user_id, refresh_token)
+
+    async def revoke_all_tokens(self, user_id: UUID) -> None:
+        if not self._token_store:
+            raise NotImplementedError("No VsTokenStore configured")
+        await self._token_store.delete_all(user_id)
+
+    def _mint(self, context: VsAuthContext, expiry_seconds: int, token_type: str) -> str:
+        now = datetime.now(timezone.utc)
+        payload = {
+            "sub": str(context.user_id),
+            "username": context.username,
+            "roles": context.roles,
+            "provider": context.provider,
+            "type": token_type,
+            "iat": now,
+            "exp": now + timedelta(seconds=expiry_seconds),
+        }
+        return jwt.encode(payload, self._secret, algorithm=self._algorithm)
+
+    def _decode(self, token: str, expected_type: str) -> dict:
+        try:
+            payload = jwt.decode(token, self._secret, algorithms=[self._algorithm])
+            if payload.get("type") != expected_type:
+                raise VsAuthenticationError(f"Expected {expected_type} token")
+            return payload
+        except jwt.ExpiredSignatureError:
+            raise VsTokenExpiredError()
+        except jwt.InvalidTokenError as e:
+            raise VsAuthenticationError(f"Invalid token: {e}")
+
+    def _payload_to_context(self, payload: dict) -> VsAuthContext:
+        return VsAuthContext(
+            user_id=UUID(payload["sub"]),
+            username=payload["username"],
+            roles=payload.get("roles", []),
+            provider=payload.get("provider", ""),
+        )

vs_security-0.1.0/vs_security/auth/vs_token_store.py

@@ -0,0 +1,18 @@
+from abc import ABC, abstractmethod
+from typing import List
+from uuid import UUID
+
+
+class VsTokenStore(ABC):
+
+    @abstractmethod
+    async def save(self, user_id: UUID, refresh_token: str) -> None: ...
+
+    @abstractmethod
+    async def get_all(self, user_id: UUID) -> List[str]: ...
+
+    @abstractmethod
+    async def delete(self, user_id: UUID, refresh_token: str) -> None: ...
+
+    @abstractmethod
+    async def delete_all(self, user_id: UUID) -> None: ...

vs_security-0.1.0/vs_security/auth/vs_username_password_provider.py

@@ -0,0 +1,39 @@
+from typing import Awaitable, Callable, Tuple
+
+import bcrypt
+
+from vs_common.log.vs_log_manager import VsLogManager
+from vs_security.auth.vs_auth_provider import VsAuthProvider
+from vs_security.auth.vs_jwt_provider import VsJWTProvider
+from vs_security.error.vs_auth_error import VsInvalidCredentialsError
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_credentials import VsCredentials, VsUsernamePasswordCredentials
+from vs_security.schema.vs_token_pair import VsTokenPair
+
+
+class VsUsernamePasswordAuthProvider(VsAuthProvider):
+
+    def __init__(
+        self,
+        jwt_provider: VsJWTProvider,
+        user_loader: Callable[[str], Awaitable[Tuple[VsAuthContext, str]]],
+    ):
+        self._jwt_provider = jwt_provider
+        self._user_loader = user_loader
+        self._logger = VsLogManager.get_instance(self.__class__.__name__)
+
+    async def authenticate(self, credentials: VsCredentials) -> VsAuthContext:
+        if not isinstance(credentials, VsUsernamePasswordCredentials):
+            raise TypeError("Expected VsUsernamePasswordCredentials")
+
+        result = await self._user_loader(credentials.username)
+        if result is None:
+            raise VsInvalidCredentialsError()
+
+        context, hashed_password = result
+
+        if not bcrypt.checkpw(credentials.password.encode(), hashed_password.encode()):
+            raise VsInvalidCredentialsError()
+
+        self._logger.debug(f"Authenticated user {credentials.username}")
+        return context

vs_security-0.1.0/vs_security/error/__init__.py

@@ -0,0 +1,15 @@
+from vs_security.error.vs_auth_error import (
+    VsAuthenticationError,
+    VsTokenExpiredError,
+    VsInsufficientRolesError,
+    VsInvalidCredentialsError,
+    VsTokenRevokedError,
+)
+
+__all__ = [
+    "VsAuthenticationError",
+    "VsTokenExpiredError",
+    "VsInsufficientRolesError",
+    "VsInvalidCredentialsError",
+    "VsTokenRevokedError",
+]

vs_security-0.1.0/vs_security/error/vs_auth_error.py

@@ -0,0 +1,25 @@
+class VsAuthenticationError(Exception):
+    def __init__(self, message: str = "Authentication failed"):
+        super().__init__(message)
+        self.message = message
+
+
+class VsTokenExpiredError(VsAuthenticationError):
+    def __init__(self):
+        super().__init__("Token has expired")
+
+
+class VsInsufficientRolesError(VsAuthenticationError):
+    def __init__(self, required: list):
+        super().__init__(f"Required roles not present: {required}")
+        self.required = required
+
+
+class VsInvalidCredentialsError(VsAuthenticationError):
+    def __init__(self):
+        super().__init__("Invalid username or password")
+
+
+class VsTokenRevokedError(VsAuthenticationError):
+    def __init__(self):
+        super().__init__("Token has been revoked")

vs_security-0.1.0/vs_security/guard/__init__.py

@@ -0,0 +1,6 @@
+from vs_security.guard.vs_security import VsSecurity, get_auth_context
+
+__all__ = [
+    "VsSecurity",
+    "get_auth_context",
+]

vs_security-0.1.0/vs_security/guard/vs_security.py

@@ -0,0 +1,42 @@
+from contextvars import ContextVar
+from typing import List, Optional
+
+from fastapi import Depends
+from fastapi.exceptions import HTTPException
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from vs_security.auth.vs_jwt_provider import VsJWTProvider
+from vs_security.error.vs_auth_error import VsAuthenticationError, VsInsufficientRolesError
+from vs_security.schema.vs_auth_context import VsAuthContext
+
+_bearer = HTTPBearer()
+
+_auth_context_var: ContextVar[Optional[VsAuthContext]] = ContextVar("auth_context", default=None)
+
+
+def get_auth_context() -> Optional[VsAuthContext]:
+    return _auth_context_var.get()
+
+
+class VsSecurity:
+
+    def __init__(self, jwt_provider: VsJWTProvider, roles: Optional[List[str]] = None):
+        self._jwt_provider = jwt_provider
+        self._roles = roles or []
+
+    async def __call__(
+        self, credentials: HTTPAuthorizationCredentials = Depends(_bearer)
+    ) -> VsAuthContext:
+        try:
+            context = await self._jwt_provider.verify_token(credentials.credentials)
+        except VsAuthenticationError as e:
+            raise HTTPException(status_code=401, detail=str(e))
+
+        if self._roles and not context.has_any_role(*self._roles):
+            raise HTTPException(
+                status_code=403,
+                detail=f"Required roles: {self._roles}",
+            )
+
+        _auth_context_var.set(context)
+        return context

vs_security-0.1.0/vs_security/guard/vs_security_factory.py

@@ -0,0 +1,43 @@
+from typing import List, Optional
+
+from vs_security.guard.vs_security import VsSecurity
+
+
+class VsSecurityFactory:
+
+    _instance: Optional[VsSecurity] = None
+    _jwt_provider = None
+
+    @classmethod
+    def init(cls, secret_key: str, algorithm: str = "HS256", roles: Optional[List[str]] = None) -> None:
+        from vs_security.auth.vs_jwt_provider import VsJWTProvider
+
+        class _InlineConfig:
+            def get(self, key, default=None, data_type=str):
+                if key == "auth.secret_key":
+                    return secret_key
+                if key == "auth.algorithm":
+                    return algorithm
+                return default
+
+            def get_section(self, section):
+                return {}
+
+        cls._jwt_provider = VsJWTProvider(config=_InlineConfig())
+        cls._instance = VsSecurity(jwt_provider=cls._jwt_provider, roles=roles)
+
+    @classmethod
+    def get(cls) -> VsSecurity:
+        if cls._instance is None:
+            raise RuntimeError(
+                "VsSecurityFactory not initialized. Call VsSecurityFactory.init() at startup."
+            )
+        return cls._instance
+
+    @classmethod
+    def with_roles(cls, roles: List[str]) -> VsSecurity:
+        if cls._jwt_provider is None:
+            raise RuntimeError(
+                "VsSecurityFactory not initialized. Call VsSecurityFactory.init() at startup."
+            )
+        return VsSecurity(jwt_provider=cls._jwt_provider, roles=roles)

vs_security-0.1.0/vs_security/schema/__init__.py

@@ -0,0 +1,12 @@
+from vs_security.schema.vs_auth_metadata import VsAuthMetadata
+from vs_security.schema.vs_auth_context import VsAuthContext
+from vs_security.schema.vs_credentials import VsCredentials, VsUsernamePasswordCredentials
+from vs_security.schema.vs_token_pair import VsTokenPair
+
+__all__ = [
+    "VsAuthMetadata",
+    "VsAuthContext",
+    "VsCredentials",
+    "VsUsernamePasswordCredentials",
+    "VsTokenPair",
+]

vs_security-0.1.0/vs_security/schema/vs_auth_context.py

@@ -0,0 +1,23 @@
+from typing import List
+from uuid import UUID
+
+from pydantic import BaseModel
+
+from vs_security.schema.vs_auth_metadata import VsAuthMetadata
+
+
+class VsAuthContext(BaseModel):
+    user_id: UUID
+    username: str
+    roles: List[str] = []
+    provider: str
+    metadata: VsAuthMetadata = VsAuthMetadata()
+
+    def has_role(self, role: str) -> bool:
+        return role in self.roles
+
+    def has_any_role(self, *roles: str) -> bool:
+        return any(r in self.roles for r in roles)
+
+    def has_all_roles(self, *roles: str) -> bool:
+        return all(r in self.roles for r in roles)

vs_security-0.1.0/vs_security/schema/vs_auth_metadata.py

@@ -0,0 +1,5 @@
+from pydantic import BaseModel
+
+
+class VsAuthMetadata(BaseModel):
+    pass

vs_security-0.1.0/vs_security/schema/vs_credentials.py

@@ -0,0 +1,10 @@
+from pydantic import BaseModel
+
+
+class VsCredentials(BaseModel):
+    pass
+
+
+class VsUsernamePasswordCredentials(VsCredentials):
+    username: str
+    password: str

vs_security-0.1.0/vs_security/schema/vs_token_pair.py

@@ -0,0 +1,6 @@
+from pydantic import BaseModel
+
+
+class VsTokenPair(BaseModel):
+    access_token: str
+    refresh_token: str

vs_security-0.1.0/vs_security.egg-info/PKG-INFO

@@ -0,0 +1,29 @@
+Metadata-Version: 2.4
+Name: vs-security
+Version: 0.1.0
+Summary: Security library for Viveka Sutra — authentication, JWT, and authorization
+Project-URL: Homepage, https://vivekasutra.com/
+Project-URL: Source, https://github.com/vivekasutra/viveka-mula
+Keywords: security,auth,jwt,authentication,viveka,vs
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Framework :: AsyncIO
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyjwt>=2.8
+Requires-Dist: bcrypt>=4.0
+Requires-Dist: vs-common
+Provides-Extra: fastapi
+Requires-Dist: fastapi>=0.110; extra == "fastapi"
+Provides-Extra: dev
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"

vs_security-0.1.0/vs_security.egg-info/SOURCES.txt

@@ -0,0 +1,23 @@
+pyproject.toml
+vs_security/__init__.py
+vs_security.egg-info/PKG-INFO
+vs_security.egg-info/SOURCES.txt
+vs_security.egg-info/dependency_links.txt
+vs_security.egg-info/requires.txt
+vs_security.egg-info/top_level.txt
+vs_security/auth/__init__.py
+vs_security/auth/vs_auth_manager.py
+vs_security/auth/vs_auth_provider.py
+vs_security/auth/vs_jwt_provider.py
+vs_security/auth/vs_token_store.py
+vs_security/auth/vs_username_password_provider.py
+vs_security/error/__init__.py
+vs_security/error/vs_auth_error.py
+vs_security/guard/__init__.py
+vs_security/guard/vs_security.py
+vs_security/guard/vs_security_factory.py
+vs_security/schema/__init__.py
+vs_security/schema/vs_auth_context.py
+vs_security/schema/vs_auth_metadata.py
+vs_security/schema/vs_credentials.py
+vs_security/schema/vs_token_pair.py

vs_security-0.1.0/vs_security.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

vs_security-0.1.0/vs_security.egg-info/requires.txt

@@ -0,0 +1,13 @@
+pydantic>=2.0
+pyjwt>=2.8
+bcrypt>=4.0
+vs-common
+
+[dev]
+build
+twine
+pytest>=8.0
+pytest-asyncio>=0.23
+
+[fastapi]
+fastapi>=0.110

vs_security-0.1.0/vs_security.egg-info/top_level.txt

@@ -0,0 +1 @@
+vs_security