Coverage for docs_src/security/tutorial005_py310.py: 100%

1from datetime import datetime, timedelta, timezone 4 ctx1abcd

2 

3import jwt 4 ctx1abcd

4from fastapi import Depends, FastAPI, HTTPException, Security, status 4 ctx1abcd

5from fastapi.security import ( 4 ctx1abcd

6 OAuth2PasswordBearer, 

7 OAuth2PasswordRequestForm, 

8 SecurityScopes, 

9) 

10from jwt.exceptions import InvalidTokenError 4 ctx1abcd

11from passlib.context import CryptContext 4 ctx1abcd

12from pydantic import BaseModel, ValidationError 4 ctx1abcd

13 

14# to get a string like this run: 

15# openssl rand -hex 32 

16SECRET_KEY = "09d25e094faa6ca2556c818166b7a9563b93f7099f6f0f4caa6cf63b88e8d3e7" 4 ctx1abcd

17ALGORITHM = "HS256" 4 ctx1abcd

18ACCESS_TOKEN_EXPIRE_MINUTES = 30 4 ctx1abcd

19 

20 

21fake_users_db = { 4 ctx1abcd

22 "johndoe": { 

23 "username": "johndoe", 

24 "full_name": "John Doe", 

25 "email": "johndoe@example.com", 

26 "hashed_password": "$2b$12$EixZaYVK1fsbw1ZfbX3OXePaWxn96p36WQoeG6Lruj3vjPGga31lW", 

27 "disabled": False, 

28 }, 

29 "alice": { 

30 "username": "alice", 

31 "full_name": "Alice Chains", 

32 "email": "alicechains@example.com", 

33 "hashed_password": "$2b$12$gSvqqUPvlXP2tfVFaWK1Be7DlH.PKZbv5H8KnzzVgXXbVxpva.pFm", 

34 "disabled": True, 

35 }, 

36} 

37 

38 

39class Token(BaseModel): 4 ctx1abcd

40 access_token: str 4 ctx1abcd

41 token_type: str 4 ctx1abcd

42 

43 

44class TokenData(BaseModel): 4 ctx1abcd

45 username: str | None = None 4 ctx1abcd

46 scopes: list[str] = [] 4 ctx1abcd

47 

48 

49class User(BaseModel): 4 ctx1abcd

50 username: str 4 ctx1abcd

51 email: str | None = None 4 ctx1abcd

52 full_name: str | None = None 4 ctx1abcd

53 disabled: bool | None = None 4 ctx1abcd

54 

55 

56class UserInDB(User): 4 ctx1abcd

57 hashed_password: str 4 ctx1abcd

58 

59 

60pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") 4 ctx1abcd

61 

62oauth2_scheme = OAuth2PasswordBearer( 4 ctx1abcd

63 tokenUrl="token", 

64 scopes={"me": "Read information about the current user.", "items": "Read items."}, 

65) 

66 

67app = FastAPI() 4 ctx1abcd

68 

69 

70def verify_password(plain_password, hashed_password): 4 ctx1abcd

71 return pwd_context.verify(plain_password, hashed_password) 32 ctx1yKeqfmr4zLgshnt5AMiujov6BNkwlpx7

72 

73 

74def get_password_hash(password): 4 ctx1abcd

75 return pwd_context.hash(password) 4 ctx189!#

76 

77 

78def get_user(db, username: str): 4 ctx1abcd

79 if username in db: 40 ctx1yKSeqfmrCDzLTgshntEFAMUiujovGHBNVkwlpxIJ

80 user_dict = db[username] 28 ctx1yKeqfmrzLgshntAMiujovBNkwlpx

81 return UserInDB(**user_dict) 28 ctx1yKeqfmrzLgshntAMiujovBNkwlpx

82 

83 

84def authenticate_user(fake_db, username: str, password: str): 4 ctx1abcd

85 user = get_user(fake_db, username) 32 ctx1yKSeqfmrzLTgshntAMUiujovBNVkwlpx

86 if not user: 32 ctx1yKSeqfmrzLTgshntAMUiujovBNVkwlpx

87 return False 4 ctx1STUV

88 if not verify_password(password, user.hashed_password): 28 ctx1yKeqfmrzLgshntAMiujovBNkwlpx

89 return False 4 ctx1KLMN

90 return user 24 ctx1yeqfmrzgshntAiujovBkwlpx

91 

92 

93def create_access_token(data: dict, expires_delta: timedelta | None = None): 4 ctx1abcd

94 to_encode = data.copy() 28 ctx10yeqfmr1zgshnt2Aiujov3Bkwlpx

95 if expires_delta: 28 ctx10yeqfmr1zgshnt2Aiujov3Bkwlpx

96 expire = datetime.now(timezone.utc) + expires_delta 24 ctx1yeqfmrzgshntAiujovBkwlpx

97 else: 

98 expire = datetime.now(timezone.utc) + timedelta(minutes=15) 4 ctx10123

99 to_encode.update({"exp": expire}) 28 ctx10yeqfmr1zgshnt2Aiujov3Bkwlpx

100 encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM) 28 ctx10yeqfmr1zgshnt2Aiujov3Bkwlpx

101 return encoded_jwt 28 ctx10yeqfmr1zgshnt2Aiujov3Bkwlpx

102 

103 

104async def get_current_user( 4 ctx1abcd

105 security_scopes: SecurityScopes, token: str = Depends(oauth2_scheme) 

106): 

107 if security_scopes.scopes: 36 ctx1WeqfmrOCDXgshntPEFYiujovQGHZkwlpxRIJ

108 authenticate_value = f'Bearer scope="{security_scopes.scope_str}"' 32 ctx1WefmrOCDXghntPEFYijovQGHZklpxRIJ

109 else: 

110 authenticate_value = "Bearer" 4 ctx1qsuw

111 credentials_exception = HTTPException( 36 ctx1WeqfmrOCDXgshntPEFYiujovQGHZkwlpxRIJ

112 status_code=status.HTTP_401_UNAUTHORIZED, 

113 detail="Could not validate credentials", 

114 headers={"WWW-Authenticate": authenticate_value}, 

115 ) 

116 try: 36 ctx1WeqfmrOCDXgshntPEFYiujovQGHZkwlpxRIJ

117 payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM]) 36 ctx1WeqfmrOCDXgshntPEFYiujovQGHZkwlpxRIJ

118 username: str = payload.get("sub") 32 ctx1eqfmrOCDgshntPEFiujovQGHkwlpxRIJ

119 if username is None: 32 ctx1eqfmrOCDgshntPEFiujovQGHkwlpxRIJ

120 raise credentials_exception 4 ctx1OPQR

121 token_scopes = payload.get("scopes", []) 28 ctx1eqfmrCDgshntEFiujovGHkwlpxIJ

122 token_data = TokenData(scopes=token_scopes, username=username) 28 ctx1eqfmrCDgshntEFiujovGHkwlpxIJ

123 except (InvalidTokenError, ValidationError): 8 ctx1WOXPYQZR

124 raise credentials_exception 4 ctx1WXYZ

125 user = get_user(fake_users_db, username=token_data.username) 28 ctx1eqfmrCDgshntEFiujovGHkwlpxIJ

126 if user is None: 28 ctx1eqfmrCDgshntEFiujovGHkwlpxIJ

127 raise credentials_exception 8 ctx1CDEFGHIJ

128 for scope in security_scopes.scopes: 20 ctx1eqfmrgshntiujovkwlpx

129 if scope not in token_data.scopes: 16 ctx1efmrghntijovklpx

130 raise HTTPException( 4 ctx1rtvx

131 status_code=status.HTTP_401_UNAUTHORIZED, 

132 detail="Not enough permissions", 

133 headers={"WWW-Authenticate": authenticate_value}, 

134 ) 

135 return user 16 ctx1eqfmgshniujokwlp

136 

137 

138async def get_current_active_user( 4 ctx1abcd

139 current_user: User = Security(get_current_user, scopes=["me"]), 

140): 

141 if current_user.disabled: 12 ctx1efmghnijoklp

142 raise HTTPException(status_code=400, detail="Inactive user") 4 ctx1mnop

143 return current_user 8 ctx1efghijkl

144 

145 

146@app.post("/token") 4 ctx1abcd

147async def login_for_access_token( 4 ctx1abcd

148 form_data: OAuth2PasswordRequestForm = Depends(), 

149) -> Token: 

150 user = authenticate_user(fake_users_db, form_data.username, form_data.password) 32 ctx1yKSeqfmrzLTgshntAMUiujovBNVkwlpx

151 if not user: 32 ctx1yKSeqfmrzLTgshntAMUiujovBNVkwlpx

152 raise HTTPException(status_code=400, detail="Incorrect username or password") 8 ctx1KSLTMUNV

153 access_token_expires = timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES) 24 ctx1yeqfmrzgshntAiujovBkwlpx

154 access_token = create_access_token( 24 ctx1yeqfmrzgshntAiujovBkwlpx

155 data={"sub": user.username, "scopes": form_data.scopes}, 

156 expires_delta=access_token_expires, 

157 ) 

158 return Token(access_token=access_token, token_type="bearer") 24 ctx1yeqfmrzgshntAiujovBkwlpx

159 

160 

161@app.get("/users/me/", response_model=User) 4 ctx1abcd

162async def read_users_me(current_user: User = Depends(get_current_active_user)): 4 ctx1abcd

163 return current_user 4 ctx1fhjl

164 

165 

166@app.get("/users/me/items/") 4 ctx1abcd

167async def read_own_items( 4 ctx1abcd

168 current_user: User = Security(get_current_active_user, scopes=["items"]), 

169): 

170 return [{"item_id": "Foo", "owner": current_user.username}] 4 ctx1egik

171 

172 

173@app.get("/status/") 4 ctx1abcd

174async def read_system_status(current_user: User = Depends(get_current_user)): 4 ctx1abcd

175 return {"status": "ok"} 4 ctx1qsuw