Security & Authentication Service

from authlib.integrations.flask_oauth2 import AuthorizationServer, ResourceProtector
from authlib.oauth2.rfc6749 import grants
import jwt
from datetime import datetime, timedelta
 
class SindhanAuthorizationServer:
    def __init__(self, app, user_model, client_model):
        self.server = AuthorizationServer(app)
        self.user_model = user_model
        self.client_model = client_model
        self._configure_grants()
    
    def _configure_grants(self):
        # Authorization Code Grant
        self.server.register_grant(grants.AuthorizationCodeGrant, [
            self._authenticate_user,
            self._save_authorization_code,
            self._authenticate_client,
            self._validate_code,
        ])
        
        # Client Credentials Grant
        self.server.register_grant(grants.ClientCredentialsGrant)
        
        # Refresh Token Grant
        self.server.register_grant(grants.RefreshTokenGrant)
    
    def _authenticate_user(self, username, password):
        """Authenticate user credentials"""
        user = self.user_model.query.filter_by(username=username).first()
        if user and user.check_password(password):
            return user
        return None
    
    def generate_access_token(self, client, user, scope):
        """Generate JWT access token"""
        payload = {
            'iss': 'https://auth.sindhan.ai',
            'sub': str(user.id) if user else str(client.id),
            'aud': client.client_id,
            'exp': datetime.utcnow() + timedelta(hours=1),
            'iat': datetime.utcnow(),
            'scope': scope,
            'roles': [role.name for role in user.roles] if user else [],
            'permissions': self._get_user_permissions(user) if user else []
        }
        
        return jwt.encode(payload, self._get_signing_key(), algorithm='RS256')
    
    def _get_user_permissions(self, user):
        """Get user permissions based on roles"""
        permissions = set()
        for role in user.roles:
            for permission in role.permissions:
                permissions.add(permission.name)
        return list(permissions)
 
# Resource protection decorator
class SindhanResourceProtector:
    def __init__(self, public_key):
        self.public_key = public_key
    
    def require_auth(self, scope=None, permissions=None):
        def decorator(f):
            def decorated_function(*args, **kwargs):
                token = self._extract_token()
                if not token:
                    return {'error': 'missing_token'}, 401
                
                try:
                    payload = jwt.decode(token, self.public_key, algorithms=['RS256'])
                    
                    # Check scope
                    if scope and scope not in payload.get('scope', '').split():
                        return {'error': 'insufficient_scope'}, 403
                    
                    # Check permissions
                    if permissions:
                        user_permissions = set(payload.get('permissions', []))
                        required_permissions = set(permissions)
                        if not required_permissions.issubset(user_permissions):
                            return {'error': 'insufficient_permissions'}, 403
                    
                    # Add user context to request
                    request.user = {
                        'id': payload['sub'],
                        'roles': payload.get('roles', []),
                        'permissions': payload.get('permissions', [])
                    }
                    
                    return f(*args, **kwargs)
                
                except jwt.ExpiredSignatureError:
                    return {'error': 'token_expired'}, 401
                except jwt.InvalidTokenError:
                    return {'error': 'invalid_token'}, 401
            
            return decorated_function
        return decorator
 
# Usage example
protector = SindhanResourceProtector(public_key)
 
@app.route('/api/users/<user_id>')
@protector.require_auth(scope='read:users', permissions=['user.read'])
def get_user(user_id):
    # Access user context
    current_user = request.user
    
    # Check if user can access this resource
    if current_user['id'] != user_id and 'admin' not in current_user['roles']:
        return {'error': 'access_denied'}, 403
    
    return get_user_data(user_id)

from abc import ABC, abstractmethod
from typing import Dict, Any, List
import re
 
class PolicyEvaluator:
    def __init__(self):
        self.policies = {}
        self.functions = {
            'contains': lambda arr, item: item in arr,
            'startswith': lambda string, prefix: string.startswith(prefix),
            'matches': lambda string, pattern: bool(re.match(pattern, string)),
            'time_between': self._time_between,
            'ip_in_range': self._ip_in_range
        }
    
    def register_policy(self, name: str, policy: Dict[str, Any]):
        """Register a new policy"""
        self.policies[name] = policy
    
    def evaluate(self, policy_name: str, context: Dict[str, Any]) -> bool:
        """Evaluate a policy against the given context"""
        if policy_name not in self.policies:
            return False
        
        policy = self.policies[policy_name]
        return self._evaluate_condition(policy['condition'], context)
    
    def _evaluate_condition(self, condition: Dict[str, Any], context: Dict[str, Any]) -> bool:
        """Recursively evaluate policy conditions"""
        if 'and' in condition:
            return all(self._evaluate_condition(c, context) for c in condition['and'])
        
        if 'or' in condition:
            return any(self._evaluate_condition(c, context) for c in condition['or'])
        
        if 'not' in condition:
            return not self._evaluate_condition(condition['not'], context)
        
        # Simple condition evaluation
        operator = condition.get('operator')
        field = condition.get('field')
        value = condition.get('value')
        
        if operator == 'equals':
            return context.get(field) == value
        elif operator == 'contains':
            return value in context.get(field, [])
        elif operator == 'function':
            func_name = condition.get('function')
            args = condition.get('args', [])
            return self._call_function(func_name, args, context)
        
        return False
    
    def _call_function(self, func_name: str, args: List[Any], context: Dict[str, Any]) -> bool:
        """Call a policy function with context substitution"""
        if func_name not in self.functions:
            return False
        
        # Substitute context variables in arguments
        resolved_args = []
        for arg in args:
            if isinstance(arg, str) and arg.startswith('$'):
                resolved_args.append(context.get(arg[1:]))
            else:
                resolved_args.append(arg)
        
        return self.functions[func_name](*resolved_args)
 
# Policy examples
policies = {
    'admin_access': {
        'description': 'Allow admin access to all resources',
        'condition': {
            'operator': 'contains',
            'field': 'user.roles',
            'value': 'admin'
        }
    },
    'business_hours_access': {
        'description': 'Allow access only during business hours',
        'condition': {
            'and': [
                {
                    'operator': 'function',
                    'function': 'time_between',
                    'args': ['$request.time', '09:00', '17:00']
                },
                {
                    'operator': 'contains',
                    'field': 'request.days',
                    'value': 'weekday'
                }
            ]
        }
    },
    'data_access_policy': {
        'description': 'Allow data access based on department and classification',
        'condition': {
            'or': [
                {
                    'and': [
                        {
                            'operator': 'equals',
                            'field': 'user.department',
                            'value': 'finance'
                        },
                        {
                            'operator': 'contains',
                            'field': 'resource.classifications',
                            'value': 'financial'
                        }
                    ]
                },
                {
                    'operator': 'contains',
                    'field': 'user.roles',
                    'value': 'data_admin'
                }
            ]
        }
    }
}
 
# Usage example
evaluator = PolicyEvaluator()
for name, policy in policies.items():
    evaluator.register_policy(name, policy)
 
# Evaluate access
context = {
    'user': {
        'id': 'user123',
        'roles': ['finance_user'],
        'department': 'finance'
    },
    'resource': {
        'type': 'financial_report',
        'classifications': ['financial', 'confidential']
    },
    'request': {
        'time': '14:30',
        'day': 'tuesday'
    }
}
 
# Check if user can access the resource
can_access = evaluator.evaluate('data_access_policy', context)

import requests
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
import jwt
from datetime import datetime, timedelta
 
class ServiceAuthenticationClient:
    def __init__(self, service_id, private_key_path, auth_service_url):
        self.service_id = service_id
        self.auth_service_url = auth_service_url
        self.private_key = self._load_private_key(private_key_path)
        self.access_token = None
        self.token_expires_at = None
    
    def _load_private_key(self, key_path):
        """Load private key for JWT signing"""
        with open(key_path, 'rb') as key_file:
            return serialization.load_pem_private_key(
                key_file.read(),
                password=None
            )
    
    def _create_jwt_assertion(self):
        """Create JWT assertion for client credentials flow"""
        now = datetime.utcnow()
        payload = {
            'iss': self.service_id,
            'sub': self.service_id,
            'aud': f"{self.auth_service_url}/oauth/token",
            'exp': now + timedelta(minutes=5),
            'iat': now,
            'jti': str(uuid.uuid4())
        }
        
        return jwt.encode(payload, self.private_key, algorithm='RS256')
    
    def get_access_token(self, scopes=None):
        """Get access token using client credentials flow"""
        if self.access_token and datetime.utcnow() < self.token_expires_at:
            return self.access_token
        
        jwt_assertion = self._create_jwt_assertion()
        
        data = {
            'grant_type': 'client_credentials',
            'client_assertion_type': 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
            'client_assertion': jwt_assertion,
            'scope': ' '.join(scopes) if scopes else 'api:read api:write'
        }
        
        response = requests.post(
            f"{self.auth_service_url}/oauth/token",
            data=data,
            headers={'Content-Type': 'application/x-www-form-urlencoded'}
        )
        
        if response.status_code == 200:
            token_data = response.json()
            self.access_token = token_data['access_token']
            expires_in = token_data.get('expires_in', 3600)
            self.token_expires_at = datetime.utcnow() + timedelta(seconds=expires_in - 60)
            return self.access_token
        else:
            raise Exception(f"Failed to get access token: {response.text}")
    
    def make_authenticated_request(self, method, url, **kwargs):
        """Make authenticated HTTP request"""
        token = self.get_access_token()
        
        headers = kwargs.get('headers', {})
        headers['Authorization'] = f'Bearer {token}'
        kwargs['headers'] = headers
        
        return requests.request(method, url, **kwargs)
 
# Usage example
auth_client = ServiceAuthenticationClient(
    service_id='user-service',
    private_key_path='/etc/ssl/private/user-service.key',
    auth_service_url='https://auth.sindhan.ai'
)
 
# Make authenticated API call
response = auth_client.make_authenticated_request(
    'GET',
    'https://api.sindhan.ai/internal/user-data',
    params={'user_id': 'user123'}
)