feat(cloud-auth): verify scoped bearer tokens

2026-07-12 17:45:31 +08:00
parent 4cb116f527
commit b916b394c7
4 changed files with 186 additions and 27 deletions
@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from hashlib import sha256
+from hmac import compare_digest
+from typing import Protocol, runtime_checkable
+
+
+@dataclass(frozen=True)
+class Principal:
+    id: str = "anonymous"
+    scopes: frozenset[str] = field(default_factory=frozenset)
+
+
+@runtime_checkable
+class AuthProvider(Protocol):
+    def authenticate(self, request: object) -> Principal | None: ...
+
+
+class NullAuthProvider:
+    """Explicit insecure-development provider with unrestricted scope."""
+
+    def authenticate(self, request: object) -> Principal | None:
+        return Principal(scopes=frozenset({"*"}))
+
+
+@dataclass(frozen=True)
+class BearerCredential:
+    principal_id: str
+    token: str = field(repr=False)
+    scopes: frozenset[str] = field(default_factory=frozenset)
+
+    def __post_init__(self) -> None:
+        if not self.principal_id.strip():
+            raise ValueError("bearer credential principal_id must not be empty")
+        if not self.token:
+            raise ValueError("bearer credential token must not be empty")
+
+
+@dataclass(frozen=True)
+class _StoredBearerCredential:
+    principal: Principal
+    token_digest: bytes = field(repr=False)
+
+
+class ConfiguredBearerAuthProvider:
+    """Authenticate configured bearer tokens without exposing credential text."""
+
+    def __init__(self, credentials: list[BearerCredential]) -> None:
+        self._credentials = tuple(
+            _StoredBearerCredential(
+                principal=Principal(
+                    id=credential.principal_id,
+                    scopes=frozenset(credential.scopes),
+                ),
+                token_digest=_token_digest(credential.token),
+            )
+            for credential in credentials
+        )
+
+    def authenticate(self, request: object) -> Principal | None:
+        token = _extract_bearer_token(request)
+        if token is None:
+            return None
+
+        candidate_digest = _token_digest(token)
+        matched_principal: Principal | None = None
+        for credential in self._credentials:
+            if compare_digest(candidate_digest, credential.token_digest):
+                matched_principal = credential.principal
+        return matched_principal
+
+
+def _extract_bearer_token(request: object) -> str | None:
+    headers = getattr(request, "headers", None)
+    if headers is None:
+        return None
+    authorization = headers.get("authorization")
+    if not isinstance(authorization, str):
+        return None
+    scheme, separator, token = authorization.partition(" ")
+    if not separator or scheme.lower() != "bearer" or not token:
+        return None
+    return token
+
+
+def _token_digest(token: str) -> bytes:
+    return sha256(token.encode("utf-8")).digest()