🔏 Requires valid access tokens for API calls

.env.sample

@@ -0,0 +1,13 @@
+# Postgres URL for Chowda DB.
+# Format: postgresql://{user}:{password}@{host}:{port}/{database}
+DB_URL=''
+
+# Env vars beginning with "AUTH0_" are used for authentication and authorization with Auth0.
+# These values can be obtained by logging into our Auth0 account.
+AUTH0_DOMAIN=''
+AUTH0_CLIENT_ID=''
+AUTH0_CLIENT_SECRET=''
+AUTH0_API_AUDIENCE=''
+
+# Secret value for securing session data using SessionMiddleware
+CHOWDA_SECRET=''

.github/workflows/CI.yml

@@ -2,9 +2,6 @@ name: 🧪 Integration Tests
 
 on: [push, pull_request, workflow_dispatch]
 
-env:
-  DB_URL: postgresql://postgres:postgres@postgres:5432/chowda-test
-
 jobs:
   tests:
     name: ⚗️ Application Tests
@@ -13,7 +10,7 @@ jobs:
     with:
       pdm_args: -G test,ci
       pytest_args: -n auto --nbmake -ra -s
-      pg_db: chowda-test
+      pg_db: chowda
 
   lint:
     name: 👕 Lint

.gitignore

@@ -23,4 +23,9 @@ ci.toml
 
 # Metaflow generated files
 metaflow.s3.*
-.metaflow
+.metaflow
+
+.cache_ggshield
+
+.env.*
+!.env.sample

.vscode/launch.json

@@ -18,20 +18,6 @@
       "jinja": false,
       "justMyCode": false
     },
-    {
-      "name": "Chowda: tests",
-      "type": "python",
-      "request": "launch",
-      "cwd": "${workspaceFolder}",
-      "module": "pytest",
-      "args": [
-        "-v",
-        "-n",
-        "auto"
-      ],
-      "jinja": false,
-      "justMyCode": false
-    },
     {
       "name": "Metaflow: Run",
       "type": "python",

chowda/auth/oauth.py

@@ -10,7 +10,7 @@
 from starlette_admin.auth import AdminUser, AuthMiddleware, AuthProvider
 
 from chowda.config import (
-    API_AUDIENCE,
+    AUTH0_API_AUDIENCE,
     AUTH0_CLIENT_ID,
     AUTH0_CLIENT_SECRET,
     AUTH0_DOMAIN,
@@ -25,7 +25,7 @@
         'scope': 'openid profile email',
     },
     server_metadata_url=f'https://{AUTH0_DOMAIN}/.well-known/openid-configuration',
-    authorize_params={'audience': API_AUDIENCE},
+    authorize_params={'audience': AUTH0_API_AUDIENCE},
 )
 
 

chowda/auth/utils.py

@@ -1,17 +1,40 @@
-from typing import Annotated
+from typing import Annotated, List
 
 from fastapi import Depends, HTTPException, Request, status
 from pydantic import BaseModel, Field
 
-from chowda.config import API_AUDIENCE
 
+from chowda.config import AUTH0_API_AUDIENCE, AUTH0_JWKS_URL
 
-class UserToken(BaseModel):
+unauthorized_redirect = HTTPException(
+    status_code=status.HTTP_303_SEE_OTHER,
+    detail='Not Authorized',
+    headers={'Location': '/admin'},
+)
+
+unauthorized = HTTPException(
+    status_code=status.HTTP_401_UNAUTHORIZED,
+    detail='Not Authorized',
+)
+
+
+class OAuthAccessToken(BaseModel):
+    """OAuth Authorization token"""
+
+    sub: str
+    permissions: List[str] = []
+
+
+class OAuthIDToken(BaseModel):
+    """OAuth ID Token with User info"""
+
+
+class OAuthUser(BaseModel):
     """ID Token model for authorization."""
 
     name: str
     email: str | None = None
-    roles: set[str] = Field(set(), alias=f'{API_AUDIENCE}/roles')
+    roles: set[str] = Field(set(), alias=f'{AUTH0_API_AUDIENCE}/roles')
 
     @property
     def is_admin(self) -> bool:
@@ -24,29 +47,68 @@ def is_clammer(self) -> bool:
         return 'clammer' in self.roles
 
 
-unauthorized = HTTPException(
-    status_code=status.HTTP_303_SEE_OTHER,
-    detail='Not Authorized',
-    headers={'Location': '/admin'},
-)
-
-
-def get_user(request: Request) -> UserToken:
+def get_oauth_user(request: Request) -> OAuthUser:
     """Get the user token from the session."""
     user = request.session.get('user', None)
     if not user:
         request.session['error'] = 'Not Logged In'
-        raise unauthorized
-    return UserToken(**user)
+        raise unauthorized_redirect
+    return OAuthUser(**user)
 
 
-def admin_user(
-    request: Request, user: Annotated[UserToken, Depends(get_user)]
-) -> UserToken:
+def get_admin_user(
+    request: Request, user: Annotated[OAuthUser, Depends(get_oauth_user)]
+) -> OAuthUser:
     """Check if the user has the admin role using FastAPI Depends.
     If not, sets a session error and raises an HTTPException."""
     if not user.is_admin:
         request.session['error'] = 'Not Authorized'
-        raise unauthorized
+        raise unauthorized_redirect
 
     return user
+
+
+def unverified_access_token(request: Request) -> str:
+    auth_header = request.headers.get('Authorization', None)
+
+    if not auth_header:
+        raise HTTPException(status_code=401, detail="Missing Authorization header")
+    if not auth_header.startswith('Bearer '):
+        raise HTTPException(
+            status_code=401,
+            detail="Bearer token malformed or missing in Authorization header",
+        )
+
+    # Return the access token from the Authorization header, i.e. the string without the
+    # "Bearer " prefix
+    return auth_header.replace('Bearer ', '')
+
+
+def jwt_signing_key(request: Request) -> str:
+    from jwt import PyJWKClient
+
+    jwks_client = PyJWKClient(AUTH0_JWKS_URL)
+    signing_key = jwks_client.get_signing_key_from_jwt(unverified_access_token)
+    return signing_key.key
+
+
+def verified_access_token(
+    request: Request,
+    unverified_access_token: Annotated[str, Depends(unverified_access_token)],
+    jwt_signing_key: Annotated[str, Depends(jwt_signing_key)],
+) -> OAuthAccessToken:
+    """Decodes and verifies an access token. If any exceptions occur, an
+    HTTPUnauthorizedException is raised from the original exception."""
+    try:
+        from jwt import decode
+
+        decoded_token = decode(
+            unverified_access_token,
+            jwt_signing_key,
+            algorithms=['RS256', 'HS256'],
+            audience='https://chowda.wgbh-mla.org/api',
+        )
+
+        return OAuthAccessToken(**decoded_token)
+    except Exception as exc:
+        raise HTTPException(status_code=401, detail=str(exc)) from exc

chowda/config.py

@@ -16,7 +16,11 @@
 AUTH0_CLIENT_ID = environ.get('AUTH0_CLIENT_ID')
 AUTH0_CLIENT_SECRET = environ.get('AUTH0_CLIENT_SECRET')
 AUTH0_DOMAIN = environ.get('AUTH0_DOMAIN')
+AUTH0_JWKS_URL = f'https://{AUTH0_DOMAIN}/.well-known/jwks.json'
+AUTH0_API_AUDIENCE = environ.get('AUTH0_API_AUDIENCE')
 
 SECRET = environ.get('CHOWDA_SECRET')
 
-API_AUDIENCE = environ.get('API_AUDIENCE', 'https://chowda.wgbh-mla.org/api')
+AUTH0_API_AUDIENCE = environ.get(
+    'AUTH0_API_AUDIENCE', 'https://chowda.wgbh-mla.org/api'
+)

chowda/routers/dashboard.py

@@ -2,9 +2,9 @@
 from metaflow.integrations import ArgoEvent
 from starlette.responses import RedirectResponse, Response
 
-from chowda.auth.utils import admin_user
+from chowda.auth.utils import get_admin_user
 
-dashboard = APIRouter(dependencies=[Depends(admin_user)])
+dashboard = APIRouter(dependencies=[Depends(get_admin_user)])
 
 
 @dashboard.post('/sync')

chowda/routers/events.py

@@ -1,18 +1,29 @@
 from json import loads
+from typing import Annotated
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, status
 from metaflow import Run, namespace
 from sqlmodel import Session
 
+from chowda.auth.utils import OAuthAccessToken, verified_access_token
 from chowda.db import engine
 from chowda.models import MetaflowRun
 
 events = APIRouter()
 
 
 @events.post('/')
-def event(event: dict):
+async def event(
+    event: dict,
+    verified_access_token: Annotated[OAuthAccessToken, Depends(verified_access_token)],
+):
     """Receive an event from Argo Events."""
+    if 'create:event' not in verified_access_token.permissions:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail='Missing required permission create:event',
+        )
+
     print('Chowda event received', event)
     if not event.get('body'):
         raise HTTPException(400, 'No body')

chowda/routers/sony_ci.py

@@ -1,8 +1,10 @@
 from datetime import datetime
+from typing import Annotated
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Depends
 from metaflow.integrations import ArgoEvent
 from pydantic import BaseModel
+from chowda.auth.utils import verified_access_token, OAuthAccessToken
 
 sony_ci = APIRouter()
 
@@ -12,7 +14,9 @@ class SyncResponse(BaseModel):
 
 
 @sony_ci.post('/sync', tags=['sync'])
-async def sony_ci_sync() -> SyncResponse:
+async def sony_ci_sync(
+    token: Annotated[OAuthAccessToken, Depends(verified_access_token)]
+) -> SyncResponse:
     try:
         ArgoEvent('sync').publish(ignore_errors=False)
         return SyncResponse(started_at=datetime.utcnow())

chowda/views.py

@@ -16,7 +16,7 @@
 from starlette_admin.exceptions import ActionFailed
 from starlette_admin.fields import BaseField
 
-from chowda.auth.utils import get_user
+from chowda.auth.utils import get_oauth_user
 from chowda.db import engine
 from chowda.fields import (
     BatchMetaflowRunDisplayField,
@@ -77,30 +77,30 @@ class ClammerModelView(ChowdaModelView):
     """Base Clammer permissions for all protected views"""
 
     def can_create(self, request: Request) -> bool:
-        return get_user(request).is_clammer
+        return get_oauth_user(request).is_clammer
 
     def can_delete(self, request: Request) -> bool:
-        return get_user(request).is_clammer
+        return get_oauth_user(request).is_clammer
 
     def can_edit(self, request: Request) -> bool:
-        return get_user(request).is_clammer
+        return get_oauth_user(request).is_clammer
 
 
 class AdminModelView(ClammerModelView):
     """Base Admin permissions for all protected views"""
 
     def is_accessible(self, request: Request) -> bool:
-        user = get_user(request)
+        user = get_oauth_user(request)
         return user.is_admin or user.is_clammer
 
     def can_create(self, request: Request) -> bool:
-        return get_user(request).is_admin
+        return get_oauth_user(request).is_admin
 
     def can_delete(self, request: Request) -> bool:
-        return get_user(request).is_admin
+        return get_oauth_user(request).is_admin
 
     def can_edit(self, request: Request) -> bool:
-        return get_user(request).is_admin
+        return get_oauth_user(request).is_admin
 
 
 class CollectionView(ClammerModelView):
@@ -220,7 +220,7 @@ async def validate(self, request: Request, data: Dict[str, Any]):
         validate_media_file_guids(request, data)
 
     async def is_action_allowed(self, request: Request, name: str) -> bool:
-        user = get_user(request)
+        user = get_oauth_user(request)
         if name == 'start_batches':
             return user.is_clammer
         if name == 'duplicate_batches':
@@ -370,7 +370,7 @@ class MediaFileView(ClammerModelView):
     page_size_options: ClassVar[list[int]] = [10, 25, 100, 500, 2000, 10000]
 
     def can_create(self, request: Request) -> bool:
-        return get_user(request).is_admin
+        return get_oauth_user(request).is_admin
 
     @action(
         name='create_new_batch',
@@ -433,7 +433,7 @@ def sync_history(self) -> Dict[str, Any]:
 
     async def render(self, request: Request, templates: Jinja2Templates) -> Response:
         history = self.sync_history()
-        user = get_user(request)
+        user = get_oauth_user(request)
         sync_disabled = datetime.now() - history[0]['created_at'] < timedelta(
             minutes=15
         )