Coverage for docs_src/security/tutorial005.py: 100%

1from datetime import datetime, timedelta, timezone 5 ctx1abcde

2from typing import List, Union 5 ctx1abcde

3 

4import jwt 5 ctx1abcde

5from fastapi import Depends, FastAPI, HTTPException, Security, status 5 ctx1abcde

6from fastapi.security import ( 5 ctx1abcde

7 OAuth2PasswordBearer, 

8 OAuth2PasswordRequestForm, 

9 SecurityScopes, 

10) 

11from jwt.exceptions import InvalidTokenError 5 ctx1abcde

12from passlib.context import CryptContext 5 ctx1abcde

13from pydantic import BaseModel, ValidationError 5 ctx1abcde

14 

15# to get a string like this run: 

16# openssl rand -hex 32 

17SECRET_KEY = "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7" 5 ctx1abcde

18ALGORITHM = "HS256" 5 ctx1abcde

19ACCESS_TOKEN_EXPIRE_MINUTES = 30 5 ctx1abcde

20 

21 

22fake_users_db = { 5 ctx1abcde

23 "johndoe": { 

24 "username": "johndoe", 

25 "full_name": "John Doe", 

26 "email": "johndoe@example.com", 

27 "hashed_password": "$2b$12$EixZaYVK1fsbw1ZfbX3OXePaWxn96p36WQoeG6Lruj3vjPGga31lW", 

28 "disabled": False, 

29 }, 

30 "alice": { 

31 "username": "alice", 

32 "full_name": "Alice Chains", 

33 "email": "alicechains@example.com", 

34 "hashed_password": "$2b$12$gSvqqUPvlXP2tfVFaWK1Be7DlH.PKZbv5H8KnzzVgXXbVxpva.pFm", 

35 "disabled": True, 

36 }, 

37} 

38 

39 

40class Token(BaseModel): 5 ctx1abcde

41 access_token: str 5 ctx1abcde

42 token_type: str 5 ctx1abcde

43 

44 

45class TokenData(BaseModel): 5 ctx1abcde

46 username: Union[str, None] = None 5 ctx1abcde

47 scopes: List[str] = [] 5 ctx1abcde

48 

49 

50class User(BaseModel): 5 ctx1abcde

51 username: str 5 ctx1abcde

52 email: Union[str, None] = None 5 ctx1abcde

53 full_name: Union[str, None] = None 5 ctx1abcde

54 disabled: Union[bool, None] = None 5 ctx1abcde

55 

56 

57class UserInDB(User): 5 ctx1abcde

58 hashed_password: str 5 ctx1abcde

59 

60 

61pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") 5 ctx1abcde

62 

63oauth2_scheme = OAuth2PasswordBearer( 5 ctx1abcde

64 tokenUrl="token", 

65 scopes={"me": "Read information about the current user.", "items": "Read items."}, 

66) 

67 

68app = FastAPI() 5 ctx1abcde

69 

70 

71def verify_password(plain_password, hashed_password): 5 ctx1abcde

72 return pwd_context.verify(plain_password, hashed_password) 5 ctx1abcde

73 

74 

75def get_password_hash(password): 5 ctx1abcde

76 return pwd_context.hash(password) 5 ctx1abcde

77 

78 

79def get_user(db, username: str): 5 ctx1abcde

80 if username in db: 5 ctx1abcde

81 user_dict = db[username] 5 ctx1abcde

82 return UserInDB(**user_dict) 5 ctx1abcde

83 

84 

85def authenticate_user(fake_db, username: str, password: str): 5 ctx1abcde

86 user = get_user(fake_db, username) 5 ctx1abcde

87 if not user: 5 ctx1abcde

88 return False 5 ctx1abcde

89 if not verify_password(password, user.hashed_password): 5 ctx1abcde

90 return False 5 ctx1abcde

91 return user 5 ctx1abcde

92 

93 

94def create_access_token(data: dict, expires_delta: Union[timedelta, None] = None): 5 ctx1abcde

95 to_encode = data.copy() 5 ctx1abcde

96 if expires_delta: 5 ctx1abcde

97 expire = datetime.now(timezone.utc) + expires_delta 5 ctx1abcde

98 else: 

99 expire = datetime.now(timezone.utc) + timedelta(minutes=15) 5 ctx1abcde

100 to_encode.update({"exp": expire}) 5 ctx1abcde

101 encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) 5 ctx1abcde

102 return encoded_jwt 5 ctx1abcde

103 

104 

105async def get_current_user( 5 ctx1abcde

106 security_scopes: SecurityScopes, token: str = Depends(oauth2_scheme) 

107): 

108 if security_scopes.scopes: 5 ctx1abcde

109 authenticate_value = f'Bearer scope="{security_scopes.scope_str}"' 5 ctx1abcde

110 else: 

111 authenticate_value = "Bearer" 5 ctx1abcde

112 credentials_exception = HTTPException( 5 ctx1abcde

113 status_code=status.HTTP_401_UNAUTHORIZED, 

114 detail="Could not validate credentials", 

115 headers={"WWW-Authenticate": authenticate_value}, 

116 ) 

117 try: 5 ctx1abcde

118 payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) 5 ctx1abcde

119 username: str = payload.get("sub") 5 ctx1abcde

120 if username is None: 5 ctx1abcde

121 raise credentials_exception 5 ctx1abcde

122 token_scopes = payload.get("scopes", []) 5 ctx1abcde

123 token_data = TokenData(scopes=token_scopes, username=username) 5 ctx1abcde

124 except (InvalidTokenError, ValidationError): 5 ctx1abcde

125 raise credentials_exception 5 ctx1abcde

126 user = get_user(fake_users_db, username=token_data.username) 5 ctx1abcde

127 if user is None: 5 ctx1abcde

128 raise credentials_exception 5 ctx1abcde

129 for scope in security_scopes.scopes: 5 ctx1abcde

130 if scope not in token_data.scopes: 5 ctx1abcde

131 raise HTTPException( 5 ctx1abcde

132 status_code=status.HTTP_401_UNAUTHORIZED, 

133 detail="Not enough permissions", 

134 headers={"WWW-Authenticate": authenticate_value}, 

135 ) 

136 return user 5 ctx1abcde

137 

138 

139async def get_current_active_user( 5 ctx1abcde

140 current_user: User = Security(get_current_user, scopes=["me"]), 

141): 

142 if current_user.disabled: 5 ctx1abcde

143 raise HTTPException(status_code=400, detail="Inactive user") 5 ctx1abcde

144 return current_user 5 ctx1abcde

145 

146 

147@app.post("/token") 5 ctx1abcde

148async def login_for_access_token( 5 ctx1abcde

149 form_data: OAuth2PasswordRequestForm = Depends(), 

150) -> Token: 

151 user = authenticate_user(fake_users_db, form_data.username, form_data.password) 5 ctx1abcde

152 if not user: 5 ctx1abcde

153 raise HTTPException(status_code=400, detail="Incorrect username or password") 5 ctx1abcde

154 access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) 5 ctx1abcde

155 access_token = create_access_token( 5 ctx1abcde

156 data={"sub": user.username, "scopes": form_data.scopes}, 

157 expires_delta=access_token_expires, 

158 ) 

159 return Token(access_token=access_token, token_type="bearer") 5 ctx1abcde

160 

161 

162@app.get("/users/me/", response_model=User) 5 ctx1abcde

163async def read_users_me(current_user: User = Depends(get_current_active_user)): 5 ctx1abcde

164 return current_user 5 ctx1abcde

165 

166 

167@app.get("/users/me/items/") 5 ctx1abcde

168async def read_own_items( 5 ctx1abcde

169 current_user: User = Security(get_current_active_user, scopes=["items"]), 

170): 

171 return [{"item_id": "Foo", "owner": current_user.username}] 5 ctx1abcde

172 

173 

174@app.get("/status/") 5 ctx1abcde

175async def read_system_status(current_user: User = Depends(get_current_user)): 5 ctx1abcde

176 return {"status": "ok"} 5 ctx1abcde