xtr-security-http 5.2.0__tar.gz → 6.0.0__tar.gz

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xtr-security-http
-Version: 5.2.0
+Version: 6.0.0
 Summary: The HTTP edge of xtr security: firewalls, authenticators, bearer access tokens and the request surface.
 Keywords: security,authentication,firewall,fastapi,oauth2
 Author: Xterr
@@ -14,20 +14,20 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Typing :: Typed
-Requires-Dist: xtr-security-core>=5.0,<6
-Requires-Dist: xtr-security-csrf>=5.0,<6
-Requires-Dist: xtr-http-kernel>=5.0,<6
-Requires-Dist: xtr-http-foundation>=5.0,<6
-Requires-Dist: xtr-http-message-contracts>=5.0,<6
-Requires-Dist: xtr-http-client-contracts>=5.0,<6
-Requires-Dist: xtr-cache-contracts>=5.0,<6
-Requires-Dist: xtr-dependency-injection>=5.0,<6
-Requires-Dist: xtr-event-dispatcher>=5.0,<6
-Requires-Dist: xtr-event-dispatcher-contracts>=5.0,<6
-Requires-Dist: xtr-clock>=5.0,<6
-Requires-Dist: xtr-logging-contracts>=5.0,<6
-Requires-Dist: xtr-password-hasher>=5.0,<6
-Requires-Dist: xtr-rate-limiter>=5.0,<6
+Requires-Dist: xtr-security-core>=6.0,<7
+Requires-Dist: xtr-security-csrf>=6.0,<7
+Requires-Dist: xtr-http-kernel>=6.0,<7
+Requires-Dist: xtr-http-foundation>=6.0,<7
+Requires-Dist: xtr-http-message-contracts>=6.0,<7
+Requires-Dist: xtr-http-client-contracts>=6.0,<7
+Requires-Dist: xtr-cache-contracts>=6.0,<7
+Requires-Dist: xtr-dependency-injection>=6.0,<7
+Requires-Dist: xtr-event-dispatcher>=6.0,<7
+Requires-Dist: xtr-event-dispatcher-contracts>=6.0,<7
+Requires-Dist: xtr-clock>=6.0,<7
+Requires-Dist: xtr-logging-contracts>=6.0,<7
+Requires-Dist: xtr-password-hasher>=6.0,<7
+Requires-Dist: xtr-rate-limiter>=6.0,<7
 Requires-Dist: fastapi>=0.123
 Requires-Dist: starlette>=0.40
 Requires-Dist: anyio>=4.0
@@ -215,8 +215,10 @@ dispatcher. At the request it matches the map, runs the matched firewall's chain
 routing, so a request no route would answer is still challenged as a request — and parks the
 matched firewall and its exception listener on the request's security state; a failure the
 chain raises is announced on the exception event and answered by that listener, exactly once;
-the finish of the request puts the stored listener away. A route documents its security with
-the framework's own params; the firewall contributes no OpenAPI scheme of its own.
+a failure no listener answers is raised as it was raised, so the request fails rather than
+going on with the rest of the chain — the access decision included — never asked. The finish
+of the request puts the stored listener away. A route documents its security with the
+framework's own params; the firewall contributes no OpenAPI scheme of its own.
 
 ### Firewall listeners
 

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/README.md

@@ -176,8 +176,10 @@ dispatcher. At the request it matches the map, runs the matched firewall's chain
 routing, so a request no route would answer is still challenged as a request — and parks the
 matched firewall and its exception listener on the request's security state; a failure the
 chain raises is announced on the exception event and answered by that listener, exactly once;
-the finish of the request puts the stored listener away. A route documents its security with
-the framework's own params; the firewall contributes no OpenAPI scheme of its own.
+a failure no listener answers is raised as it was raised, so the request fails rather than
+going on with the rest of the chain — the access decision included — never asked. The finish
+of the request puts the stored listener away. A route documents its security with the
+framework's own params; the firewall contributes no OpenAPI scheme of its own.
 
 ### Firewall listeners
 

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "xtr-security-http"
-version = "5.2.0"
+version = "6.0.0"
 description = "The HTTP edge of xtr security: firewalls, authenticators, bearer access tokens and the request surface."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -23,20 +23,20 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "xtr-security-core>=5.0,<6",
-    "xtr-security-csrf>=5.0,<6",
-    "xtr-http-kernel>=5.0,<6",
-    "xtr-http-foundation>=5.0,<6",
-    "xtr-http-message-contracts>=5.0,<6",
-    "xtr-http-client-contracts>=5.0,<6",
-    "xtr-cache-contracts>=5.0,<6",
-    "xtr-dependency-injection>=5.0,<6",
-    "xtr-event-dispatcher>=5.0,<6",
-    "xtr-event-dispatcher-contracts>=5.0,<6",
-    "xtr-clock>=5.0,<6",
-    "xtr-logging-contracts>=5.0,<6",
-    "xtr-password-hasher>=5.0,<6",
-    "xtr-rate-limiter>=5.0,<6",
+    "xtr-security-core>=6.0,<7",
+    "xtr-security-csrf>=6.0,<7",
+    "xtr-http-kernel>=6.0,<7",
+    "xtr-http-foundation>=6.0,<7",
+    "xtr-http-message-contracts>=6.0,<7",
+    "xtr-http-client-contracts>=6.0,<7",
+    "xtr-cache-contracts>=6.0,<7",
+    "xtr-dependency-injection>=6.0,<7",
+    "xtr-event-dispatcher>=6.0,<7",
+    "xtr-event-dispatcher-contracts>=6.0,<7",
+    "xtr-clock>=6.0,<7",
+    "xtr-logging-contracts>=6.0,<7",
+    "xtr-password-hasher>=6.0,<7",
+    "xtr-rate-limiter>=6.0,<7",
     "fastapi>=0.123",
     "starlette>=0.40",
     "anyio>=4.0",
@@ -59,10 +59,10 @@ dev = [
     "anyio>=4.0",
     "ty>=0.0.83",
     "joserfc>=1.7",
-    "xtr-http-message>=5.0,<6",
-    "xtr-http-client>=5.0,<6",
-    "xtr-cache>=5.0,<6",
-    "xtr-console>=5.0,<6",
+    "xtr-http-message>=6.0,<7",
+    "xtr-http-client>=6.0,<7",
+    "xtr-cache>=6.0,<7",
+    "xtr-console>=6.0,<7",
 ]
 
 [build-system]

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "xtr-security-http"
-version = "5.2.0"
+version = "6.0.0"
 description = "The HTTP edge of xtr security: firewalls, authenticators, bearer access tokens and the request surface."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -20,24 +20,24 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "xtr-security-core>=5.0,<6",
-    "xtr-security-csrf>=5.0,<6",
-    "xtr-http-kernel>=5.0,<6",
-    "xtr-http-foundation>=5.0,<6",
-    "xtr-http-message-contracts>=5.0,<6",
+    "xtr-security-core>=6.0,<7",
+    "xtr-security-csrf>=6.0,<7",
+    "xtr-http-kernel>=6.0,<7",
+    "xtr-http-foundation>=6.0,<7",
+    "xtr-http-message-contracts>=6.0,<7",
     # The client interface the introspection endpoint is reached through; the client
     # itself is installed by the application that introspects.
-    "xtr-http-client-contracts>=5.0,<6",
+    "xtr-http-client-contracts>=6.0,<7",
     # The cache contract the introspection responses are cached under; the pool
     # behind it is the application's choice.
-    "xtr-cache-contracts>=5.0,<6",
-    "xtr-dependency-injection>=5.0,<6",
-    "xtr-event-dispatcher>=5.0,<6",
-    "xtr-event-dispatcher-contracts>=5.0,<6",
-    "xtr-clock>=5.0,<6",
-    "xtr-logging-contracts>=5.0,<6",
-    "xtr-password-hasher>=5.0,<6",
-    "xtr-rate-limiter>=5.0,<6",
+    "xtr-cache-contracts>=6.0,<7",
+    "xtr-dependency-injection>=6.0,<7",
+    "xtr-event-dispatcher>=6.0,<7",
+    "xtr-event-dispatcher-contracts>=6.0,<7",
+    "xtr-clock>=6.0,<7",
+    "xtr-logging-contracts>=6.0,<7",
+    "xtr-password-hasher>=6.0,<7",
+    "xtr-rate-limiter>=6.0,<7",
     "fastapi>=0.123",
     "starlette>=0.40",
     "anyio>=4.0",
@@ -59,12 +59,12 @@ dev = [
     "ty>=0.0.83",
     "joserfc>=1.7",
     # The tests match real requests, so they build the request messages.
-    "xtr-http-message>=5.0,<6",
+    "xtr-http-message>=6.0,<7",
     # The tests drive the introspection endpoint through the scripted client and
     # cache the responses in the in-memory pool.
-    "xtr-http-client>=5.0,<6",
-    "xtr-cache>=5.0,<6",
-    "xtr-console>=5.0,<6",
+    "xtr-http-client>=6.0,<7",
+    "xtr-cache>=6.0,<7",
+    "xtr-console>=6.0,<7",
 ]
 
 [build-system]

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/src/xtr_security_http/access_token/oidc/oidc_token_handler.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, cast, final
 
-from joserfc import jwt
+from joserfc import jws, jwt
 from joserfc.errors import InvalidKeyIdError, JoseError
 from joserfc.jwt import JWTClaimsRegistry
 from xtr_clock import SystemClock
@@ -122,15 +122,23 @@ class OidcTokenHandler:
     async def _decode(self, access_token: str) -> Token:
         """Verify the signature, refetching the key set once on an unknown ``kid``.
 
+        A header nesting deeper than the decoder follows is read before the
+        signature can be checked, and ends in a ``RecursionError`` on some
+        interpreters: the token cannot be read, so it is refused as any other.
+        A header that is no JSON object is refused before joserfc judges it,
+        and one whose members have the wrong shape — a ``crit`` that is no
+        list of names — fails joserfc's own check with a ``TypeError``.
+
         Raises:
             InvalidAccessTokenError: When the token cannot be verified.
         """
         try:
+            _require_object_header(access_token)
             key_set = await self._key_set_provider.get_key_set()
             return jwt.decode(access_token, key_set, algorithms=list(self._algorithms))
         except InvalidKeyIdError as error:
             return await self._decode_after_refresh(access_token, error)
-        except (JoseError, OidcKeySetError, ValueError) as error:
+        except (JoseError, OidcKeySetError, ValueError, TypeError, RecursionError) as error:
             raise InvalidAccessTokenError(f"The token could not be verified: {error}") from error
 
     async def _decode_after_refresh(self, access_token: str, cause: InvalidKeyIdError) -> Token:
@@ -142,7 +150,7 @@ class OidcTokenHandler:
         try:
             key_set = await self._key_set_provider.get_key_set(force_refresh=True)
             return jwt.decode(access_token, key_set, algorithms=list(self._algorithms))
-        except (JoseError, OidcKeySetError, ValueError) as error:
+        except (JoseError, OidcKeySetError, ValueError, TypeError, RecursionError) as error:
             raise InvalidAccessTokenError(
                 f"The token names an unknown key: {cause}",
             ) from error
@@ -248,3 +256,18 @@ def _scopes(claims: Mapping[str, object]) -> list[str]:
     if isinstance(scp, (list, tuple)):
         return [str(one) for one in cast("Sequence[object]", scp)]
     return []
+
+
+def _require_object_header(access_token: str) -> None:
+    """Refuse a token whose protected header is no JSON object.
+
+    joserfc reads the header's members by name, so an array or a string
+    standing where the object should be is turned away here, before it is
+    judged.
+
+    Raises:
+        InvalidAccessTokenError: When the header is no JSON object.
+    """
+    header = cast("object", jws.extract_compact(access_token.encode()).headers())
+    if not isinstance(header, dict):
+        raise InvalidAccessTokenError("The token header is not a JSON object.")

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/src/xtr_security_http/decorator/is_csrf_token_valid.py

@@ -108,8 +108,10 @@ async def _payload_value(request: Request, token_key: str) -> str | None:
     """Read the value from the request payload: the JSON body, else the parsed form."""
     try:
         payload = cast("object", await request.json())
-    except ValueError:
+    except (ValueError, RecursionError):
         # A body that is not JSON is not an error: the form is the payload then.
+        # Nesting deeper than the parser goes is a RecursionError, not a ValueError,
+        # and is the same body that does not decode.
         payload = None
     if isinstance(payload, dict):
         value = cast("Mapping[str, object]", payload).get(token_key)

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/src/xtr_security_http/firewall/firewall.py

@@ -67,8 +67,12 @@ class Firewall(EventSubscriberInterface):
     answers it — the matched firewall's stored listener first, the
     listeners that only observe the failure after it — has its response
     set on the request's event, so the request is answered rather than
-    failing. A caller driving the events by hand, with no dispatcher
-    handed to ``on_request``, sees the failure raise as it was raised.
+    failing. A failure no listener answers is raised as it was raised: the
+    steps after the one that failed — the access decision among them — never
+    ran, so letting the request go on would hand the route a request nobody
+    decided about. The firewall fails closed, and the request fails with the
+    error. A caller driving the events by hand, with no dispatcher handed to
+    ``on_request``, sees every failure raise as it was raised.
 
     The kernel has one lifecycle per request — no request is handled inside
     another — so the main-request-only guard the upstream subscriber opens
@@ -123,6 +127,9 @@ class Firewall(EventSubscriberInterface):
             dispatcher: Where a failure the chain raises is announced. The
                 dispatcher passes itself; a caller driving the events by
                 hand leaves it out and sees the failure raise.
+
+        Raises:
+            Exception: Whatever a step raised, when no listener answered it.
         """
         del name
         context = await self._firewall_map.match(event.request)
@@ -148,8 +155,9 @@ class Firewall(EventSubscriberInterface):
                 raise
             failure = ExceptionEvent(event.request, event.state, error)
             _ = await dispatcher.dispatch(failure)
-            if failure.response is not None:
-                event.set_response(failure.response)
+            if failure.response is None:
+                raise
+            event.set_response(failure.response)
 
     async def on_exception(self, event: ExceptionEvent) -> None:
         """Route the failure to the listener of the firewall that ran the request.

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/src/xtr_security_http/oidc/oidc_id_token.py

@@ -66,7 +66,9 @@ class OidcIdToken:
             raise AuthenticationError("Invalid ID token format.") from error
         try:
             claims = cast("object", json.loads(payload or b""))
-        except ValueError as error:
+        except (ValueError, RecursionError) as error:
+            # A nesting deeper than the decoder follows is a payload it
+            # cannot read, whichever of the two the interpreter raises.
             raise AuthenticationError("Invalid ID token payload.") from error
         if not isinstance(claims, dict):
             raise AuthenticationError("Invalid ID token payload.")

{xtr_security_http-5.2.0 → xtr_security_http-6.0.0}/src/xtr_security_http/oidc/oidc_signature_verifier.py

@@ -126,7 +126,10 @@ class OidcSignatureVerifier:
         # any request is sent to its JWKS — and no MAC algorithm is ever
         # accepted, so a public key published by the provider can never be
         # turned into the shared secret of an "HS256" token (key confusion).
-        headers = cast("Mapping[str, object]", signature.headers())
+        protected = cast("object", signature.headers())
+        if not isinstance(protected, dict):
+            raise AuthenticationError("Invalid ID token format: the header is not a JSON object.")
+        headers = cast("Mapping[str, object]", protected)
         algorithm = headers.get("alg")
         if not isinstance(algorithm, str) or algorithm not in self._algorithms:
             expected = '", "'.join(self._algorithms)
@@ -145,7 +148,9 @@ class OidcSignatureVerifier:
         key_set = _key_set(keys)
         try:
             token = jwt.decode(id_token, key_set, algorithms=list(self._algorithms))
-        except (JoseError, ValueError) as error:
+        except (JoseError, ValueError, TypeError) as error:
+            # A header member of the wrong shape (a ``crit`` that is no list
+            # of names) fails joserfc's header check with a TypeError.
             raise AuthenticationError(
                 f"The ID token signature could not be verified: {error}",
             ) from error