Fix #42: multiple authentication backends (#47)

* Revamp authentication to allow multiple backends

* Make router generate a login route for each backend

* Apply black

* Remove unused imports

* Complete docstrings

* Update documentation

* WIP add cookie auth

* Complete cookie auth unit tests

* Add documentation for cookie auth

* Fix cookie backend default name

* Don't make cookie return a Response

fastapi_users/authentication/__init__.py

@@ -1,2 +1,60 @@
+from typing import Sequence
+
+from fastapi import HTTPException
+from starlette import status
+from starlette.requests import Request
+
 from fastapi_users.authentication.base import BaseAuthentication  # noqa: F401
+from fastapi_users.authentication.cookie import CookieAuthentication  # noqa: F401
 from fastapi_users.authentication.jwt import JWTAuthentication  # noqa: F401
+from fastapi_users.db import BaseUserDatabase
+from fastapi_users.models import BaseUserDB
+
+
+class Authenticator:
+    """
+    Provides dependency callables to retrieve authenticated user.
+
+    It performs the authentication against a list of backends
+    defined by the end-developer. The first backend yielding a user wins.
+    If no backend yields a user, an HTTPException is raised.
+
+    :param backends: List of authentication backends.
+    :param user_db: Database adapter instance.
+    """
+
+    backends: Sequence[BaseAuthentication]
+    user_db: BaseUserDatabase
+
+    def __init__(
+        self, backends: Sequence[BaseAuthentication], user_db: BaseUserDatabase
+    ):
+        self.backends = backends
+        self.user_db = user_db
+
+    async def get_current_user(self, request: Request) -> BaseUserDB:
+        return await self._authenticate(request)
+
+    async def get_current_active_user(self, request: Request) -> BaseUserDB:
+        user = await self.get_current_user(request)
+        if not user.is_active:
+            raise self._get_credentials_exception()
+        return user
+
+    async def get_current_superuser(self, request: Request) -> BaseUserDB:
+        user = await self.get_current_active_user(request)
+        if not user.is_superuser:
+            raise self._get_credentials_exception(status.HTTP_403_FORBIDDEN)
+        return user
+
+    async def _authenticate(self, request: Request) -> BaseUserDB:
+        for backend in self.backends:
+            user = await backend(request, self.user_db)
+            if user is not None:
+                return user
+        raise self._get_credentials_exception()
+
+    def _get_credentials_exception(
+        self, status_code: int = status.HTTP_401_UNAUTHORIZED
+    ) -> HTTPException:
+        return HTTPException(status_code=status_code)

fastapi_users/authentication/base.py

@@ -1,70 +1,30 @@
-from typing import Callable
+from typing import Any, Optional
 
-from fastapi import HTTPException
-from fastapi.security import OAuth2PasswordBearer
-from starlette import status
+from starlette.requests import Request
 from starlette.responses import Response
 
 from fastapi_users.db import BaseUserDatabase
 from fastapi_users.models import BaseUserDB
 
-credentials_exception = HTTPException(status_code=status.HTTP_401_UNAUTHORIZED)
-
 
 class BaseAuthentication:
     """
-    Base adapter for generating and decoding authentication tokens.
+    Base authentication backend.
 
-    Provides dependency injectors to get current active/superuser user.
+    Every backend should derive from this class.
 
-    :param scheme: Optional authentication scheme for OpenAPI.
-    Defaults to `OAuth2PasswordBearer(tokenUrl="/users/login")`.
-    Override it if your login route lives somewhere else.
+    :param name: Name of the backend. It will be used to name the login route.
     """
 
-    scheme: OAuth2PasswordBearer
+    name: str
 
-    def __init__(self, scheme: OAuth2PasswordBearer = None):
-        if scheme is None:
-            self.scheme = OAuth2PasswordBearer(tokenUrl="/users/login")
-        else:
-            self.scheme = scheme
+    def __init__(self, name: str = "base"):
+        self.name = name
 
-    async def get_login_response(self, user: BaseUserDB, response: Response):
+    async def __call__(
+        self, request: Request, user_db: BaseUserDatabase
+    ) -> Optional[BaseUserDB]:
         raise NotImplementedError()
 
-    def get_current_user(self, user_db: BaseUserDatabase):
+    async def get_login_response(self, user: BaseUserDB, response: Response) -> Any:
         raise NotImplementedError()
-
-    def get_current_active_user(self, user_db: BaseUserDatabase):
-        raise NotImplementedError()
-
-    def get_current_superuser(self, user_db: BaseUserDatabase):
-        raise NotImplementedError()
-
-    def _get_authentication_method(
-        self, user_db: BaseUserDatabase
-    ) -> Callable[..., BaseUserDB]:
-        raise NotImplementedError()
-
-    def _get_current_user_base(self, user: BaseUserDB) -> BaseUserDB:
-        if user is None:
-            raise self._get_credentials_exception()
-        return user
-
-    def _get_current_active_user_base(self, user: BaseUserDB) -> BaseUserDB:
-        user = self._get_current_user_base(user)
-        if not user.is_active:
-            raise self._get_credentials_exception()
-        return user
-
-    def _get_current_superuser_base(self, user: BaseUserDB) -> BaseUserDB:
-        user = self._get_current_active_user_base(user)
-        if not user.is_superuser:
-            raise self._get_credentials_exception(status.HTTP_403_FORBIDDEN)
-        return user
-
-    def _get_credentials_exception(
-        self, status_code: int = status.HTTP_401_UNAUTHORIZED
-    ) -> HTTPException:
-        return HTTPException(status_code=status_code)

fastapi_users/authentication/cookie.py

@@ -0,0 +1,53 @@
+from typing import Any, Optional
+
+from fastapi.security import APIKeyCookie
+from starlette.requests import Request
+from starlette.responses import Response
+
+from fastapi_users.authentication.jwt import JWTAuthentication
+from fastapi_users.models import BaseUserDB
+
+
+class CookieAuthentication(JWTAuthentication):
+    """
+    Authentication backend using a cookie.
+
+    Internally, uses a JWT token to store the data.
+
+    :param secret: Secret used to encode the cookie.
+    :param lifetime_seconds: Lifetime duration of the cookie in seconds.
+    :param cookie_name: Name of the cookie.
+    :param name: Name of the backend. It will be used to name the login route.
+    """
+
+    lifetime_seconds: int
+    cookie_name: str
+
+    def __init__(
+        self,
+        secret: str,
+        lifetime_seconds: int,
+        cookie_name: str = "fastapiusersauth",
+        name: str = "cookie",
+    ):
+        super().__init__(secret, lifetime_seconds, name=name)
+        self.lifetime_seconds = lifetime_seconds
+        self.cookie_name = cookie_name
+        self.api_key_cookie = APIKeyCookie(name=self.cookie_name, auto_error=False)
+
+    async def get_login_response(self, user: BaseUserDB, response: Response) -> Any:
+        token = await self._generate_token(user)
+        response.set_cookie(
+            self.cookie_name,
+            token,
+            max_age=self.lifetime_seconds,
+            secure=True,
+            httponly=True,
+        )
+
+        # We shouldn't return directly the response
+        # so that FastAPI can terminate it properly
+        return None
+
+    async def _retrieve_token(self, request: Request) -> Optional[str]:
+        return await self.api_key_cookie.__call__(request)

fastapi_users/authentication/jwt.py

@@ -1,5 +1,8 @@
+from typing import Any, Optional
+
 import jwt
-from fastapi import Depends
+from fastapi.security import OAuth2PasswordBearer
+from starlette.requests import Request
 from starlette.responses import Response
 
 from fastapi_users.authentication.base import BaseAuthentication
@@ -10,62 +13,58 @@ from fastapi_users.utils import JWT_ALGORITHM, generate_jwt
 
 class JWTAuthentication(BaseAuthentication):
     """
-    Authentication using a JWT.
+    Authentication backend using a JWT in a Bearer header.
 
     :param secret: Secret used to encode the JWT.
     :param lifetime_seconds: Lifetime duration of the JWT in seconds.
+    :param tokenUrl: Path where to get a token.
+    :param name: Name of the backend. It will be used to name the login route.
     """
 
     token_audience: str = "fastapi-users:auth"
     secret: str
     lifetime_seconds: int
 
-    def __init__(self, secret: str, lifetime_seconds: int, *args, **kwargs):
-        super().__init__(*args, **kwargs)
+    def __init__(
+        self,
+        secret: str,
+        lifetime_seconds: int,
+        tokenUrl: str = "/users/login",
+        name: str = "jwt",
+    ):
+        super().__init__(name)
         self.secret = secret
         self.lifetime_seconds = lifetime_seconds
+        self.scheme = OAuth2PasswordBearer(tokenUrl, auto_error=False)
 
-    async def get_login_response(self, user: BaseUserDB, response: Response):
-        data = {"user_id": user.id, "aud": self.token_audience}
-        token = generate_jwt(data, self.lifetime_seconds, self.secret, JWT_ALGORITHM)
+    async def __call__(
+        self, request: Request, user_db: BaseUserDatabase,
+    ) -> Optional[BaseUserDB]:
+        token = await self._retrieve_token(request)
+        if token is None:
+            return None
 
+        try:
+            data = jwt.decode(
+                token,
+                self.secret,
+                audience=self.token_audience,
+                algorithms=[JWT_ALGORITHM],
+            )
+            user_id = data.get("user_id")
+            if user_id is None:
+                return None
+        except jwt.PyJWTError:
+            return None
+        return await user_db.get(user_id)
+
+    async def get_login_response(self, user: BaseUserDB, response: Response) -> Any:
+        token = await self._generate_token(user)
         return {"token": token}
 
-    def get_current_user(self, user_db: BaseUserDatabase):
-        async def _get_current_user(token: str = Depends(self.scheme)):
-            user = await self._get_authentication_method(user_db)(token)
-            return self._get_current_user_base(user)
+    async def _retrieve_token(self, request: Request) -> Optional[str]:
+        return await self.scheme.__call__(request)
 
-        return _get_current_user
-
-    def get_current_active_user(self, user_db: BaseUserDatabase):
-        async def _get_current_active_user(token: str = Depends(self.scheme)):
-            user = await self._get_authentication_method(user_db)(token)
-            return self._get_current_active_user_base(user)
-
-        return _get_current_active_user
-
-    def get_current_superuser(self, user_db: BaseUserDatabase):
-        async def _get_current_superuser(token: str = Depends(self.scheme)):
-            user = await self._get_authentication_method(user_db)(token)
-            return self._get_current_superuser_base(user)
-
-        return _get_current_superuser
-
-    def _get_authentication_method(self, user_db: BaseUserDatabase):
-        async def authentication_method(token: str = Depends(self.scheme)):
-            try:
-                data = jwt.decode(
-                    token,
-                    self.secret,
-                    audience=self.token_audience,
-                    algorithms=[JWT_ALGORITHM],
-                )
-                user_id = data.get("user_id")
-                if user_id is None:
-                    return None
-            except jwt.PyJWTError:
-                return None
-            return await user_db.get(user_id)
-
-        return authentication_method
+    async def _generate_token(self, user: BaseUserDB) -> str:
+        data = {"user_id": user.id, "aud": self.token_audience}
+        return generate_jwt(data, self.lifetime_seconds, self.secret, JWT_ALGORITHM)