89 lines
2.7 KiB
Python
89 lines
2.7 KiB
Python
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
from hashlib import sha256
|
|
from hmac import compare_digest
|
|
from typing import Protocol, runtime_checkable
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class Principal:
|
|
id: str = "anonymous"
|
|
scopes: frozenset[str] = field(default_factory=frozenset)
|
|
|
|
|
|
@runtime_checkable
|
|
class AuthProvider(Protocol):
|
|
def authenticate(self, request: object) -> Principal | None: ...
|
|
|
|
|
|
class NullAuthProvider:
|
|
"""Explicit insecure-development provider with unrestricted scope."""
|
|
|
|
def authenticate(self, request: object) -> Principal | None:
|
|
return Principal(scopes=frozenset({"*"}))
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class BearerCredential:
|
|
principal_id: str
|
|
token: str = field(repr=False)
|
|
scopes: frozenset[str] = field(default_factory=frozenset)
|
|
|
|
def __post_init__(self) -> None:
|
|
if not self.principal_id.strip():
|
|
raise ValueError("bearer credential principal_id must not be empty")
|
|
if not self.token:
|
|
raise ValueError("bearer credential token must not be empty")
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class _StoredBearerCredential:
|
|
principal: Principal
|
|
token_digest: bytes = field(repr=False)
|
|
|
|
|
|
class ConfiguredBearerAuthProvider:
|
|
"""Authenticate configured bearer tokens without exposing credential text."""
|
|
|
|
def __init__(self, credentials: list[BearerCredential]) -> None:
|
|
self._credentials = tuple(
|
|
_StoredBearerCredential(
|
|
principal=Principal(
|
|
id=credential.principal_id,
|
|
scopes=frozenset(credential.scopes),
|
|
),
|
|
token_digest=_token_digest(credential.token),
|
|
)
|
|
for credential in credentials
|
|
)
|
|
|
|
def authenticate(self, request: object) -> Principal | None:
|
|
token = _extract_bearer_token(request)
|
|
if token is None:
|
|
return None
|
|
|
|
candidate_digest = _token_digest(token)
|
|
matched_principal: Principal | None = None
|
|
for credential in self._credentials:
|
|
if compare_digest(candidate_digest, credential.token_digest):
|
|
matched_principal = credential.principal
|
|
return matched_principal
|
|
|
|
|
|
def _extract_bearer_token(request: object) -> str | None:
|
|
headers = getattr(request, "headers", None)
|
|
if headers is None:
|
|
return None
|
|
authorization = headers.get("authorization")
|
|
if not isinstance(authorization, str):
|
|
return None
|
|
scheme, separator, token = authorization.partition(" ")
|
|
if not separator or scheme.lower() != "bearer" or not token:
|
|
return None
|
|
return token
|
|
|
|
|
|
def _token_digest(token: str) -> bytes:
|
|
return sha256(token.encode("utf-8")).digest()
|