• Search by Module
• Search by Words
• Search Projects

• Java
• Python
• JavaScript
• TypeScript
• C++
• Scala
• Blog

• asap-authentication-python-master
  • ChangeLog
  • AUTHORS
  • .mailmap
  • LICENSE
  • test-requirements.txt
  • README.rst
  • setup.py
  • atlassian_jwt_auth
    • verifier.py
    • exceptions.py
    • key.py
    • frameworks
      • common
        • decorators.py
        • asap.py
        • __init__.py
        • utils.py
        • tests
          • test_utils.py
          • test_decorators.py
          • __init__.py
        • backend.py
      • django
        • middleware.py
        • decorators.py
        • __init__.py
        • tests
          • views.py
          • urls.py
          • __init__.py
          • settings.py
          • test_django.py
        • backend.py
      • __init__.py
      • wsgi
        • middleware.py
        • __init__.py
        • tests
          • test_wsgi.py
        • backend.py
      • flask
        • decorators.py
        • __init__.py
        • tests
          • test_flask.py
          • __init__.py
        • backend.py
    • __init__.py
    • algorithms.py
    • tests
      • test_key.py
      • test_signer.py
      • test_verifier.py
      • test_signer_private_key_repo.py
      • test_public_key_provider.py
      • __init__.py
      • utils.py
      • test_private_key_provider.py
    • auth.py
    • contrib
      • requests.py
      • flask_app
        • decorators.py
        • __init__.py
      • aiohttp
        • verifier.py
        • key.py
        • __init__.py
        • auth.py
      • django
        • middleware.py
        • decorators.py
        • __init__.py
      • __init__.py
      • README.md
      • tests
        • aiohttp
          • test_verifier.py
          • test_public_key_provider.py
          • test_auth.py
          • __init__.py
        • test_requests.py
        • __init__.py
        • utils.py
      • server
        • __init__.py
    • signer.py
  • setup.cfg
  • .travis.yml
  • requirements.txt
  • .gitignore

from functools import wraps
from jwt.exceptions import InvalidIssuerError, InvalidTokenError

from .asap import _process_asap_token, _verify_issuers
from .utils import SettingsDict


def _with_asap(func=None, backend=None, issuers=None, required=True,
               subject_should_match_issuer=None):
    if backend is None:
        raise ValueError(
            'Invalid value for backend. Use a subclass instead.'
        )

    def with_asap_decorator(func):
        @wraps(func)
        def with_asap_wrapper(*args, **kwargs):
            settings = _update_settings_from_kwargs(
                backend.settings,
                issuers=issuers, required=required,
                subject_should_match_issuer=subject_should_match_issuer
            )

            request = None
            if len(args) > 0:
                request = args[0]

            error_response = _process_asap_token(
                request, backend, settings
            )

            if error_response is not None:
                return error_response

            return func(*args, **kwargs)

        return with_asap_wrapper

    if callable(func):
        return with_asap_decorator(func)

    return with_asap_decorator


def _restrict_asap(func=None, backend=None, issuers=None,
                   required=True, subject_should_match_issuer=None):
    """Decorator to allow endpoint-specific ASAP authorization, assuming ASAP
    authentication has already occurred.
    """

    def restrict_asap_decorator(func):
        @wraps(func)
        def restrict_asap_wrapper(request, *args, **kwargs):
            settings = _update_settings_from_kwargs(
                backend.settings,
                issuers=issuers, required=required,
                subject_should_match_issuer=subject_should_match_issuer
            )
            asap_claims = getattr(request, 'asap_claims', None)
            error_response = None

            if required and not asap_claims:
                return backend.get_401_response(
                    'Unauthorized', request=request
                )

            try:
                _verify_issuers(asap_claims, settings.ASAP_VALID_ISSUERS)
            except InvalidIssuerError:
                error_response = backend.get_403_response(
                    'Forbidden: Invalid token issuer', request=request
                )
            except InvalidTokenError:
                error_response = backend.get_401_response(
                    'Unauthorized: Invalid token', request=request
                )

            if error_response and required:
                return error_response

            return func(request, *args, **kwargs)

        return restrict_asap_wrapper

    if callable(func):
        return restrict_asap_decorator(func)

    return restrict_asap_decorator


def _update_settings_from_kwargs(settings, issuers=None, required=True,
                                 subject_should_match_issuer=None):
    settings = settings.copy()

    if issuers is not None:
        settings['ASAP_VALID_ISSUERS'] = set(issuers)

    if required is not None:
        settings['ASAP_REQUIRED'] = required

    if subject_should_match_issuer is not None:
        settings['ASAP_SUBJECT_SHOULD_MATCH_ISSUER'] = (
            subject_should_match_issuer
        )

    return SettingsDict(settings)