848a8fb34f
A token may carry a scopes list: it then grants only those permissions, intersected with what the owner holds at use time, with the admin role bypass suspended and role-gated routes denied - a scoped token from an admin account is genuinely limited. Scope ceiling enforced at create/update too (only permissions the owner holds; 400 lists violations) and the picker only offers what you hold. Token management itself now requires the new apitokens.create permission (admin by default, grantable via roles). Unscoped tokens keep the exact prior act-as-owner behavior; imports need an unscoped admin token. Migration 7d22. 756 tests pass; live-verified scoped 201/403 matrix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
115 lines
4.4 KiB
Python
115 lines
4.4 KiB
Python
"""Personal API token (PAT) authentication shim.
|
|
|
|
A request may send `Authorization: Bearer shopdb_pat_...`. This is recognized
|
|
BEFORE any JWT decode: a before_request hook validates the PAT (hash lookup,
|
|
active, not expired, active owner) and, on success, mints a short internal
|
|
request-scoped JWT for the token's user and swaps it into the request's
|
|
Authorization header.
|
|
|
|
Why mint a JWT instead of only stashing the user on g: every write route in
|
|
this app stacks a mandatory @jwt_required() ABOVE @require_permission /
|
|
@require_role. That mandatory decorator decodes the Authorization header
|
|
itself, so the ONLY way a PAT reaches the whole existing auth+authz stack
|
|
(jwt_required, require_permission, require_role, import_mode, current_user,
|
|
get_jwt_identity) unchanged is to present a genuine JWT downstream. The minted
|
|
token lives only in this request's environ and is never returned to the client.
|
|
|
|
Result: a PAT authenticates any route a login JWT would, acting as its owner,
|
|
with zero changes to the authz decorators or import-mode helpers.
|
|
"""
|
|
|
|
from datetime import datetime, timezone
|
|
|
|
from flask import g, request
|
|
from flask_jwt_extended import create_access_token
|
|
|
|
from shopdb.extensions import db
|
|
from shopdb.core.models.apitoken import ApiToken, TOKEN_SECRET_PREFIX
|
|
from shopdb.utils.responses import error_response, ErrorCodes
|
|
|
|
|
|
# Only rewrite lastusedat when it is older than this, to avoid a DB write on
|
|
# every single request a busy integration makes.
|
|
_LASTUSED_THROTTLE_SECONDS = 60
|
|
|
|
|
|
def _utcnow():
|
|
return datetime.now(timezone.utc).replace(tzinfo=None)
|
|
|
|
|
|
def _extract_pat_secret():
|
|
"""Return the PAT secret from the Authorization header, or None."""
|
|
header = request.headers.get('Authorization', '')
|
|
parts = header.split()
|
|
if len(parts) == 2 and parts[0] == 'Bearer' \
|
|
and parts[1].startswith(TOKEN_SECRET_PREFIX):
|
|
return parts[1]
|
|
return None
|
|
|
|
|
|
def _resolve_pat(secret):
|
|
"""Validate a PAT secret. Return (token, user) or None."""
|
|
from shopdb.core.models import User
|
|
|
|
token = ApiToken.query.filter_by(
|
|
tokenhash=ApiToken.hash_secret(secret), isactive=True).first()
|
|
if token is None or token.is_expired:
|
|
return None
|
|
user = db.session.get(User, token.userid)
|
|
if user is None or not user.isactive:
|
|
return None
|
|
return token, user
|
|
|
|
|
|
def _touch_lastused(token):
|
|
"""Throttled lastusedat write. Independent commit; nothing else is pending
|
|
this early in the request, so it cannot clobber route work."""
|
|
now = _utcnow()
|
|
if token.lastusedat is None \
|
|
or (now - token.lastusedat).total_seconds() > _LASTUSED_THROTTLE_SECONDS:
|
|
token.lastusedat = now
|
|
db.session.commit()
|
|
|
|
|
|
def install_apitoken_auth(app):
|
|
"""Register the before_request PAT shim on the app."""
|
|
|
|
@app.before_request
|
|
def _apitoken_before_request():
|
|
secret = _extract_pat_secret()
|
|
if secret is None:
|
|
return
|
|
resolved = _resolve_pat(secret)
|
|
if resolved is None:
|
|
# The caller clearly meant to use a PAT (shopdb_pat_ prefix) but it
|
|
# is unknown, revoked, or expired. Reject with a clear 401 instead
|
|
# of letting the JWT decoder emit a confusing 422 on the non-JWT.
|
|
return error_response(
|
|
ErrorCodes.UNAUTHORIZED,
|
|
'Invalid, revoked, or expired API token',
|
|
http_code=401)
|
|
token, user = resolved
|
|
|
|
# Read claim inputs before the (possible) commit expires the instance.
|
|
claims = {
|
|
'username': user.username,
|
|
'roles': [role.rolename for role in user.roles],
|
|
}
|
|
# A scoped token carries a patscopes claim; authz reads it to grant ONLY
|
|
# the listed permissions and to deny role gates + import mode. Unscoped
|
|
# tokens carry no such claim and mint exactly as a login JWT would.
|
|
scopelist = token.scopelist
|
|
if scopelist is not None:
|
|
claims['patscopes'] = scopelist
|
|
# Expose the token/user for audit and introspection if a handler wants it.
|
|
g.apitokenid = token.tokenid
|
|
g.apitokenuser = user
|
|
|
|
_touch_lastused(token)
|
|
|
|
# Mint a request-scoped JWT for the owner and swap it into the header
|
|
# so the whole downstream auth stack authenticates as that user.
|
|
access_token = create_access_token(
|
|
identity=str(user.userid), additional_claims=claims)
|
|
request.environ['HTTP_AUTHORIZATION'] = f'Bearer {access_token}'
|