xn-auth 0.0.3.dev1__tar.gz → 0.0.4__tar.gz

{xn_auth-0.0.3.dev1 → xn_auth-0.0.4}/.pre-commit-config.yaml

@@ -4,7 +4,7 @@ repos:
   - id: tag
     name: tag
     ### make tag with next ver only if "fix" in commit_msg or starts with "feat"
-    entry: bash -c 'grep -e ^feat -e fix .git/COMMIT_EDITMSG && make patch || exit 0'
+    entry: bash -c 'grep -e "^feat:" -e "^fix:" .git/COMMIT_EDITMSG && make patch || exit 0'
     language: system
     verbose: true
     pass_filenames: false

{xn_auth-0.0.3.dev1/xn_auth.egg-info → xn_auth-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xn-auth
-Version: 0.0.3.dev1
+Version: 0.0.4
 Summary: Auth adapter for XN-Api framework
 Author-email: Artemiev <mixartemev@gmail.com>
 License: MIT

xn_auth-0.0.4/x_auth/__init__.py

@@ -0,0 +1,116 @@
+import logging
+from datetime import timedelta, datetime
+from enum import IntEnum
+from typing import Annotated
+from fastapi import Depends, HTTPException, Security
+from fastapi.security import SecurityScopes, HTTPBearer
+from jose import jwt, JWTError
+from pydantic import BaseModel, ValidationError
+from starlette import status
+from starlette.authentication import SimpleUser, AuthenticationError
+from starlette.requests import HTTPConnection
+from starlette.responses import Response
+
+from x_auth.enums import Scope, UserStatus
+from x_auth.models import User
+from x_auth.pydantic import UserAuth
+
+
+class FailReason(IntEnum):
+    username = 1
+    password = 2
+    signature = 3
+    expired = 4
+    dep_not_installed = 5
+    undefined = 6
+
+
+class AuthException(AuthenticationError, HTTPException):
+    detail: FailReason
+
+    def __init__(self, detail: FailReason, clear_cookie: str | None = "access_token", parent: Exception = None) -> None:
+        hdrs = (
+            {"set-cookie": clear_cookie + "=; expires=Thu, 01 Jan 1970 00:00:00 GMT"} if clear_cookie else None
+        )  # path=/;
+        if parent:
+            logging.error(repr(parent))
+        super().__init__(status_code=status.HTTP_401_UNAUTHORIZED, detail=detail.name, headers=hdrs)
+
+
+def on_error(_: HTTPConnection, exc: AuthException) -> Response:
+    hdr = {}
+    if exc.status_code == 303 and "/login" in (r.path for r in _.app.routes):
+        hdr = {"Location": "/login"}
+    resp = Response(str(exc), status_code=exc.status_code, headers=hdr)
+    resp.delete_cookie("access_token")
+    return resp
+
+
+def jwt_decode(jwtoken: str, secret: str) -> UserAuth:
+    payload = jwt.decode(jwtoken, secret, algorithms=["HS256"])
+    return UserAuth(**payload)
+
+
+class AuthUser(SimpleUser):
+    id: int
+
+    def __init__(self, uid: int, username: str) -> None:
+        super().__init__(username)
+        self.id = uid
+
+
+class BaseAuth:
+    expires = timedelta(days=7)
+    auth_scheme = HTTPBearer()
+
+    class Token(BaseModel):
+        access_token: str
+        token_type: str
+        user: UserAuth
+
+    def __init__(self, secret: str, db_user_model: type[User] = User):
+        self.secret: str = secret
+        self.db_user_model: type[User] = db_user_model
+
+        self.read = Security(self.check_token, scopes=[Scope.READ.name])
+        self.write = Security(self.check_token, scopes=[Scope.WRITE.name])
+        self.my = Security(self.check_token, scopes=[Scope.ALL.name])
+        self.active = Depends(self.check_token)
+
+    def jwt_encode(self, data: UserAuth, expires_delta: timedelta = expires) -> str:
+        return jwt.encode({"exp": datetime.now() + expires_delta, **data}, self.secret)
+
+    def jwt_decode(self, jwtoken: str) -> UserAuth:
+        return jwt_decode(jwtoken, self.secret)
+
+    # dependency
+    async def check_token(self, security_scopes: SecurityScopes, token: Annotated[str, Depends(auth_scheme)]):
+        auth_val = "Bearer"
+        if security_scopes.scopes:
+            auth_val += f' scope="{security_scopes.scope_str}"'
+        cred_exc = HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Could not validate credentials",
+            headers={"WWW-Authenticate": auth_val},
+        )
+        try:
+            user: UserAuth = self.jwt_decode(token)
+        except (JWTError, ValidationError) as e:
+            cred_exc.detail += f": {e}"
+            raise cred_exc
+        if not user.username or not user.id:
+            cred_exc.detail += "token"
+            raise cred_exc
+        # noinspection PyTypeChecker
+        user_status: UserStatus | None = await self.db_user_model.get_or_none(username=user.username).values_list(
+            "status", flat=True
+        )
+        if not user_status:
+            cred_exc.detail = "User not found"
+            raise cred_exc
+        elif user_status < UserStatus.TEST:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Inactive user")
+        for scope in security_scopes.scopes:
+            if scope not in user.scopes:
+                cred_exc.detail = f"Not enough permissions. Need '{scope}'"
+                raise cred_exc

xn_auth-0.0.4/x_auth/backend.py

@@ -0,0 +1,28 @@
+from jose import JWTError
+from pydantic import ValidationError
+from starlette.authentication import AuthenticationBackend, AuthCredentials
+from starlette.requests import HTTPConnection
+
+from x_auth import AuthUser, AuthException, FailReason, jwt_decode
+from x_auth.pydantic import UserAuth
+
+
+class AuthBackend(AuthenticationBackend):
+    def __init__(self, secret: str):
+        self.secret = secret
+
+    async def authenticate(self, conn: HTTPConnection) -> tuple[AuthCredentials, AuthUser] | None:
+        # todo: refact with BearerSchema
+        if not (auth := conn.headers.get("Authorization")):
+            return
+
+        scheme, credentials = auth.split()
+
+        if scheme.lower() == "bearer":
+            try:
+                user: UserAuth = jwt_decode(credentials, self.secret)
+                return AuthCredentials(user.scopes), AuthUser(**user.model_dump())
+            except JWTError as e:
+                raise AuthException(FailReason.expired, parent=e)
+            except ValidationError as e:
+                raise AuthException(FailReason.signature, parent=e)

xn_auth-0.0.4/x_auth/enums.py

@@ -0,0 +1,22 @@
+from enum import IntEnum
+
+
+class UserStatus(IntEnum):
+    BANNED = 0
+    WAIT = 1  # waiting for approve
+    TEST = 2  # trial
+    ACTIVE = 3
+    PREMIUM = 4
+
+
+class Scope(IntEnum):
+    READ = 4
+    WRITE = 2
+    ALL = 1  # not only my
+
+
+class Role(IntEnum):
+    READER = Scope.READ  # 4
+    WRITER = Scope.WRITE  # 2
+    MANAGER = Scope.READ + Scope.WRITE  # 6
+    ADMIN = Scope.READ + Scope.WRITE + Scope.ALL  # 7

xn_auth-0.0.4/x_auth/models.py

@@ -0,0 +1,25 @@
+from tortoise import fields
+from x_model.model import Model as BaseModel, TsTrait
+
+from x_auth.enums import UserStatus, Role, Scope
+
+
+class Model(BaseModel):
+    _allowed: Role = None  # allows access to read/write/all for all
+
+
+class User(Model, TsTrait):
+    username: str | None = fields.CharField(95, unique=True, null=True)
+    status: UserStatus = fields.IntEnumField(UserStatus, default=UserStatus.WAIT)
+    email: str | None = fields.CharField(100, unique=True, null=True)
+    phone: int | None = fields.BigIntField(null=True)
+    role: Role = fields.IntEnumField(Role, default=Role.READER)
+
+    _icon = "user"
+    _name = {"username"}
+
+    def _can(self, scope: Scope) -> bool:
+        return bool(self.role.value & scope)
+
+    class Meta:
+        table_description = "Users"

xn_auth-0.0.4/x_auth/pydantic.py

@@ -0,0 +1,30 @@
+from pydantic import BaseModel, computed_field
+
+from x_auth.enums import UserStatus, Role, Scope
+
+
+class UserReg(BaseModel):
+    username: str
+    email: str | None = None
+    phone: int | None = None
+
+
+class UserUpdate(BaseModel):
+    username: str
+    status: UserStatus
+    email: str | None
+    phone: int | None
+    role: Role
+
+
+class UserAuth(UserUpdate):
+    id: int
+    username: str
+    status: UserStatus
+    role: Role
+    # ref_id: int | None
+
+    @computed_field
+    @property
+    def scopes(self) -> list[str]:
+        return [scope.name for scope in Scope if self.role.value & scope.value]

{xn_auth-0.0.3.dev1 → xn_auth-0.0.4/xn_auth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: xn-auth
-Version: 0.0.3.dev1
+Version: 0.0.4
 Summary: Auth adapter for XN-Api framework
 Author-email: Artemiev <mixartemev@gmail.com>
 License: MIT

{xn_auth-0.0.3.dev1 → xn_auth-0.0.4}/xn_auth.egg-info/SOURCES.txt

@@ -5,7 +5,10 @@ README.md
 makefile
 pyproject.toml
 x_auth/__init__.py
+x_auth/backend.py
+x_auth/enums.py
 x_auth/models.py
+x_auth/pydantic.py
 xn_auth.egg-info/PKG-INFO
 xn_auth.egg-info/SOURCES.txt
 xn_auth.egg-info/dependency_links.txt

xn_auth-0.0.3.dev1/x_auth/__init__.py

@@ -1,211 +0,0 @@
-from datetime import timedelta, datetime
-from enum import IntEnum
-
-# from importlib.metadata import distributions
-from typing import Annotated
-from fastapi import Depends, HTTPException, Security
-from fastapi.security import OAuth2PasswordBearer, SecurityScopes, OAuth2PasswordRequestForm
-from jose import jwt, JWTError
-from pydantic import BaseModel, ValidationError
-from starlette import status
-from starlette.authentication import AuthCredentials, SimpleUser, AuthenticationError, AuthenticationBackend
-from starlette.requests import HTTPConnection
-from starlette.responses import Response
-from x_model.enum import Scope, UserStatus
-from x_model.model import Model, User
-from x_model.pydantic import UserReg, UserAuth
-
-
-class AuthFailReason(IntEnum):
-    username = 1
-    password = 2
-    signature = 3
-    expired = 4
-    dep_not_installed = 5
-
-
-class AuthException(AuthenticationError, HTTPException):
-    detail: AuthFailReason
-
-    def __init__(self, detail: AuthFailReason, clear_cookie: str | None = "access_token") -> None:
-        hdrs = (
-            {"set-cookie": clear_cookie + "=; expires=Thu, 01 Jan 1970 00:00:00 GMT"} if clear_cookie else None
-        )  # path=/;
-        super().__init__(status_code=status.HTTP_401_UNAUTHORIZED, detail=detail.name, headers=hdrs)
-
-
-def on_error(_: HTTPConnection, exc: AuthException) -> Response:
-    hdr = (
-        {
-            "Location": "/login",
-        }
-        if exc.status_code == 303 and "/login" in (r.path for r in _.app.routes)
-        else {}
-    )
-    resp = Response(str(exc), status_code=exc.status_code, headers=hdr)
-    resp.delete_cookie("access_token")
-    return resp
-
-
-class AuthType(IntEnum):
-    pwd = 1
-    tg = 2
-
-
-class TokenData(BaseModel):
-    id: int
-    username: str | None = None
-    scopes: list[str] = []
-
-
-class AuthUser(SimpleUser):
-    id: int
-
-    def __init__(self, uid: int, username: str) -> None:
-        super().__init__(username)
-        self.id = uid
-
-
-class OAuth(AuthenticationBackend):
-    EXPIRES = timedelta(days=7)
-
-    class Token(BaseModel):
-        access_token: str
-        token_type: str
-        user: UserAuth
-
-    def __init__(self, secret: str, db_user_model: type[User] = User, auth_type: AuthType = AuthType.pwd):
-        self.secret: str = secret
-        self.db_user_model: type[User] = db_user_model
-        self.auth_type: AuthType = auth_type
-
-        self.read = Security(self.check_token, scopes=[Scope.READ.name])
-        self.write = Security(self.check_token, scopes=[Scope.WRITE.name])
-        self.my = Security(self.check_token, scopes=[Scope.ALL.name])
-        self.active = Depends(self.check_token)
-
-    oauth2_scheme = OAuth2PasswordBearer(
-        tokenUrl="token",
-        scopes={
-            Scope.READ.name: "READ own items",
-            Scope.WRITE.name: "Write own items",
-            Scope.ALL.name: "Access for not only own items",
-        },
-    )
-
-    # async def get_token_for_tg(self, tg_user: WebAppUser) -> Token:
-    #     user: User
-    #     user, cr = await user_upsert(tg_user)
-    #     access_token = self.gen_access_token(
-    #         data={"sub": tg_user.username or str(tg_user.id), "id": tg_user.id,
-    #               "scopes": self.role_scopes_map[user.role]},
-    #         expires_delta=self.EXPIRES,
-    #     )
-    #     auth_user: UserAuth = UserAuth.model_validate(user, from_attributes=True)
-    #     return self.Token.model_validate(
-    #         {"access_token": access_token, "token_type": "bearer", "user": auth_user},
-    #         from_attributes=True
-    #     )
-
-    def get_data_from_jwt(self, jwtoken: str) -> tuple[AuthCredentials, AuthUser]:
-        payload = jwt.decode(jwtoken, self.secret, algorithms=["HS256"])
-        uid: int = payload.get("id")
-        username: str = payload.get("sub")
-        scopes = payload.get("scopes", [])
-        return AuthCredentials(scopes), AuthUser(uid, username)
-
-    async def authenticate(self, conn: HTTPConnection) -> tuple[AuthCredentials, AuthUser] | None:
-        if not (auth := conn.headers.get("Authorization")):
-            return
-        # try:
-        scheme, credentials = auth.split()
-        if scheme.lower() == "bearer":
-            try:
-                return self.get_data_from_jwt(credentials)
-            except JWTError as e:
-                print(e)
-                raise AuthException(AuthFailReason.expired, "access_token")
-            except ValidationError as e:
-                print(e)
-                raise AuthException(AuthFailReason.signature, "access_token")
-            # except Exception as exc:
-            #     raise AuthenticationError(exc, 'Invalid auth credentials')
-        # elif scheme.lower() == 'tg':
-        #     if 'xtg-auth' not in [d.name for d in distributions()]:
-        #         raise AuthException(AuthFailReason.dep_not_installed, None)
-        #     from aiogram.utils.web_app import safe_parse_webapp_init_data
-        #     tgData = safe_parse_webapp_init_data(self.secret, credentials)
-        #     credentials = (await self.get_token_for_tg(tgData.user)).access_token
-
-    # dependency
-    async def check_token(
-        self, security_scopes: SecurityScopes, token: Annotated[str | None, Depends(oauth2_scheme)]
-    ):  # , tg_data: [str, ]
-        auth_val = "Bearer"
-        if security_scopes.scopes:
-            auth_val += f' scope="{security_scopes.scope_str}"'
-        cred_exc = HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Could not validate credentials",
-            headers={"WWW-Authenticate": auth_val},
-        )
-        try:
-            creds, user = self.get_data_from_jwt(token)
-        except (JWTError, ValidationError) as e:
-            cred_exc.detail += f": {e}"
-            raise cred_exc
-        if not user.username or not user.id:
-            cred_exc.detail += "token"
-            raise cred_exc
-        # noinspection PyTypeChecker
-        user_status: UserStatus | None = await self.db_user_model.get_or_none(username=user.username).values_list(
-            "status", flat=True
-        )
-        if not user_status:
-            cred_exc.detail = "User not found"
-            raise cred_exc
-        elif user_status < UserStatus.TEST:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Inactive user")
-        for scope in security_scopes.scopes:
-            if scope not in creds.scopes:
-                cred_exc.detail = f"Not enough permissions. Need `{scope}`"
-                raise cred_exc
-
-    # api reg endpoint
-    async def reg_user(self, user_reg_input: UserReg) -> Token:
-        data = user_reg_input.model_dump()
-        try:
-            await self.db_user_model.create(**data)
-        except Exception as e:
-            raise HTTPException(status.HTTP_406_NOT_ACCEPTABLE, detail=e.__repr__())
-        tok = await self.login_for_access_token(
-            OAuth2PasswordRequestForm(username=user_reg_input.username, password=user_reg_input.password)
-        )
-        return tok
-
-    async def authenticate_user(self, username: str, password: str) -> tuple[TokenData, Model]:
-        if user_db := await self.db_user_model.get_or_none(username=username):
-            td = TokenData.model_validate(user_db, from_attributes=True)
-            td.scopes = self.role_scopes_map[user_db.role]
-            if user_db.pwd_vrf(password):
-                return td, user_db
-            reason = AuthFailReason.password
-        else:
-            reason = AuthFailReason.username
-        raise AuthException(detail=reason)
-
-    def gen_access_token(self, data: dict, expires_delta: timedelta = EXPIRES) -> str:
-        return jwt.encode({"exp": datetime.utcnow() + expires_delta, **data}, self.secret)
-
-    # api login endpoint
-    async def login_for_access_token(self, form_data: Annotated[OAuth2PasswordRequestForm, Depends()]) -> Token:
-        token, user_db = await self.authenticate_user(form_data.username, form_data.password)
-        if isinstance(token, TokenData):
-            access_token = self.gen_access_token(
-                data={"id": token.id, "sub": token.username, "scopes": token.scopes},
-                expires_delta=self.EXPIRES,
-            )
-            r = self.Token.model_validate(
-                {"access_token": access_token, "token_type": "bearer", "user": user_db}, from_attributes=True
-            )
-            return r

xn_auth-0.0.3.dev1/x_auth/models.py

@@ -1,24 +0,0 @@
-from tortoise.fields import CharField
-from x_model import User as BaseUser
-
-
-class User(BaseUser):
-    from pwdlib import PasswordHash
-
-    __cc = PasswordHash.recommended()
-
-    password: str | None = CharField(60, null=True)
-
-    def pwd_vrf(self, pwd: str) -> bool:
-        return self.__cc.verify(pwd, self.password)
-
-    @classmethod
-    async def create(cls, using_db=None, **kwargs) -> BaseUser:
-        user: User = await super().create(using_db, **kwargs)
-        if pwd := kwargs.get("password"):
-            await user.set_pwd(pwd)
-        return user
-
-    async def set_pwd(self, pwd: str = password) -> None:
-        self.password = self.__cc.hash(pwd)
-        await self.save()