Kaleidoo middleware package
Project description
kal-middleware
kal-middleware
is a Python package designed for FastAPI applications to provide robust JWT and Service-to-Service (STS) authentication using Firebase and Google Identity Platform.
Features
- JWT Authentication: Ensures that the JWTs are valid and checks user roles against provided configurations.
- STS Authentication: Validates tokens for service-to-service communication ensuring that only verified services can communicate.
Installation
Install kal-middleware
using pip:
pip install kal-middleware
Usage
JWT Authentication
To add JWT authentication to your FastAPI endpoints, you can use the jwt_authenticated
decorator provided by kal-middleware
. This decorator checks if the JWT token in the Authorization
header is valid and whether the user has the appropriate role based on a configuration map.
Here's an example of how to apply the firebase_jwt_authenticated
decorator:
Notice: After the JWT is processed, the request.state
holds:
user_uid
- The Firebase unique ID.user_capabilities
- A list of capabilities for later use in the request processing, if needed.user
- Ifcheck_access
is used, the user object will be attached to the request, so the entire process does not need to call the request again.
from kal_middleware.jwt import firebase_jwt_authenticated
from typing import List
from utils import get_org, get_user_by_fb_uid, get_capability_by_service_action
async def get_user(firebase_uid):
user = await get_user_by_fb_uid(firebase_uid)
return user
# if there is specific variable in the body that needed checks of who access its data only
async def check_access(user: dict, body: dict):
# check in the db the user and his parameters
# for example:
capabilities = user.get("capabilities")
if "capability_id" in body:
access = any(capability for capability in capabilities if capability.get("id") == body["capability_id"] )
if not access:
return False, f"User can't access the request."
if "org_id" in body:
org = get_org(body["org_id"])
if not org:
return False, f"Org not found"
return True, {"org": org}
return False, f"User {user.get('id')} from another organization then the one that was requested."
async def get_capability(service, action):
capability = await get_capability_by_service_action(service, action)
return capability
@app.get("/your-route/<service>/<action>")
@firebase_jwt_authenticated(get_user, check_access)
async def your_route_function(
request: Request = None,
service: Union[str, None] = None,
action: Union[str, None] = None
):
# Your route logic
return {"message": "This is a protected route"}
# Or - if there is no need to check for specific data in the body
@app.get("/your-route-without-check-access/<service>/<action>")
@firebase_jwt_authenticated(get_user)
async def your_route_function_without_check_access(
request: Request = None,
service: Union[str, None] = None,
action: Union[str, None] = None
):
# Your route logic
return {"message": "This is a protected route"}
STS Authentication
For service-to-service (STS) authentication using Google's Identity Platform, you can use the sts_authenticated
decorator. This ensures that the calling service's token is verified to enable secure interactions between services.
Here's how to use the sts_authenticated
decorator in your FastAPI app:
- Make sure first you have env variable named
ALLOWED_SERVICE_ACCOUNTS
with the following structure:example1@gserviceaccount.com, example2@gserviceaccount.com
from kal_middleware.sts import sts_authenticated
@app.get("/secure-service")
@sts_authenticated
async def secure_service_function():
# Logic that requires service-to-service authentication
return {"message": "Service-to-service call is authenticated"}
This configuration will parse and verify the Authorization header, ensuring that only requests with a verified bearer token can access the endpoint.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file kal_middleware-2.0.5.tar.gz
.
File metadata
- Download URL: kal_middleware-2.0.5.tar.gz
- Upload date:
- Size: 20.6 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/5.1.1 CPython/3.12.6
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | 444d20379174d318d6a0061377f89daf507e66b9459d24469668dc79ee1d73df |
|
MD5 | 577408d7e595096be7b5b7806c67f87a |
|
BLAKE2b-256 | 4ae5569fe9932a8bf669115da483be880caa6ba2f8b599090c00972f58b2b55a |
Provenance
File details
Details for the file kal_middleware-2.0.5-py2.py3-none-any.whl
.
File metadata
- Download URL: kal_middleware-2.0.5-py2.py3-none-any.whl
- Upload date:
- Size: 13.5 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/5.1.1 CPython/3.12.6
File hashes
Algorithm | Hash digest | |
---|---|---|
SHA256 | 6ada343495e19751ac2f2b812d14d7f2149b804bf762b99d10b4f2a5dc0e2b52 |
|
MD5 | 14436edfb1cf85b33e48f3ae04cbc460 |
|
BLAKE2b-256 | ba1ccb936971b1a9685a7e8041015f54de0df184990fb683d7b44148e80768d7 |