Merge pull request #3 from permitio/access-control

Access control

Author: gemanor

.github/workflows/pypi-release.yml

@@ -0,0 +1,35 @@
+name: Release to PyPI
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+
+    - name: Install build tools
+      run: |
+        python -m pip install --upgrade pip
+        pip install build twine
+
+    - name: Build package
+      run: |
+        python -m build
+
+    - name: Publish to PyPI
+      env:
+        TWINE_USERNAME: __token__
+        TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+      run: |
+        twine upload dist/*

.github/workflows/test-lint.yml

@@ -0,0 +1,33 @@
+name: Test and Lint
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install pytest flake8  
+
+    - name: Run linting
+      run: |
+        flake8 . --max-line-length=150
+
+    - name: Run tests
+      run: |
+        pytest

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+repos:
+  - repo: https://github.com/psf/black
+    rev: 25.1.0
+    hooks:
+      - id: black
+        language_version: python3
+  - repo: https://github.com/pycqa/flake8
+    rev: 7.1.2
+    hooks:
+      - id: flake8
+        args: [--max-line-length=150]
+  - repo: local
+    hooks:
+      - id: pytest
+        name: Run Pytest
+        entry: pytest
+        language: system
+        types: [python]
+        pass_filenames: false
+

components/__init__.py

@@ -3,6 +3,9 @@
 from .data_protection import DataProtectionComponent
 from .jwt_validator import JWTValidatorComponent
 from .permissions_check import PermissionsCheckComponent
-from .message_formatter import MessageFormatterComponent
 
-__all__ = ["DataProtectionComponent", "JWTValidatorComponent", "PermissionsCheckComponent","MessageFormatterComponent"]
+__all__ = [
+    "DataProtectionComponent",
+    "JWTValidatorComponent",
+    "PermissionsCheckComponent",
+]

components/data_protection.py

@@ -4,6 +4,7 @@
 from langflow.template import Output
 from permit import Permit
 
+
 class DataProtectionComponent(Component):
     display_name = "Data Protection"
     description = "Gets allowed resource IDs for a user."
@@ -51,13 +52,8 @@ async def validate_auth(self) -> Message:
         permit = Permit(token=self.api_key, pdp=self.pdp_url)
         permissions = await permit.get_user_permissions(self.user_id)
         allowed_ids = [
-            p.resource_id 
-            for p in permissions 
+            p.resource_id
+            for p in permissions
             if p.resource == self.resource_type and p.action == self.action
         ]
         return Message(content=allowed_ids)
-
-
-
-
-

components/jwt_validator.py

@@ -1,9 +1,14 @@
+import base64
+
+import jwt
+import requests
+from jwt import PyJWK
+
 from langflow.custom import Component
 from langflow.inputs import MessageTextInput
-from langflow.template import Output
 from langflow.schema.message import Message
-import jwt
-import requests
+from langflow.template import Output
+
 
 class JWTValidatorComponent(Component):
     display_name = "JWT Validator"
@@ -30,9 +35,31 @@ class JWTValidatorComponent(Component):
     ]
 
     def validate_auth(self) -> Message:
-        response = requests.get(self.jwks_url)
+        response = requests.get(self.jwks_url, timeout=10)
         jwks = response.json()
         headers = jwt.get_unverified_header(self.jwt_token)
-        key = next(k for k in jwks["keys"] if k["kid"] == headers["kid"])
-        payload = jwt.decode(self.jwt_token, key, algorithms=["RS256"])
-        return Message(content=payload["sub"])
+
+        try:
+            jwk = next(k for k in jwks["keys"] if k["kid"] == headers["kid"])
+            if isinstance(jwk.get("e"), int):
+                jwk["e"] = self._int_to_base64url(jwk["e"])
+            if isinstance(jwk.get("n"), int):
+                jwk["n"] = self._int_to_base64url(jwk["n"])
+
+            public_key = PyJWK(jwk).key
+            payload = jwt.decode(self.jwt_token, public_key, algorithms=["RS256"])
+            return Message(content=payload["sub"])
+        except KeyError as e:
+            error_message = f"Missing key in JWT or JWKS: {e!s}"
+            raise KeyError(error_message) from e
+        except jwt.ExpiredSignatureError:
+            raise
+        except jwt.PyJWTError as e:
+            error_message = f"JWT validation failed: {e!s}"
+            raise jwt.InvalidTokenError(error_message) from e
+
+    def _int_to_base64url(self, value: int) -> str:
+        """Convert an integer to a Base64URL-encoded string."""
+        byte_length = (value.bit_length() + 7) // 8
+        value_bytes = value.to_bytes(byte_length, byteorder="big")
+        return base64.urlsafe_b64encode(value_bytes).rstrip(b"=").decode("ascii")

components/permissions_check.py

@@ -4,6 +4,7 @@
 from langflow.schema.message import Message
 from permit import Permit
 
+
 class PermissionsCheckComponent(Component):
     display_name = "Permissions Check"
     description = "Checks if a user is allowed an action on a resource, with separate outputs for allowed and denied."
@@ -54,19 +55,32 @@ class PermissionsCheckComponent(Component):
         Output(display_name="Denied", name="denied", method="denied_result"),
     ]
 
+    def __init__(self, **kwargs):
+        super().__init__(**kwargs)
+        self._permission_result = False
+
     async def validate_auth(self) -> bool:
         permit = Permit(token=self.api_key, pdp=self.pdp_url)
-        context = {"tenant": self.tenant} if self.tenant else {}
-        is_allowed = await permit.check(self.user_id, self.action, self.resource, context)
-        self.status = is_allowed  # Store the result for use in output methods
-        return is_allowed
+        context = (
+            {"tenant": self.tenant} if hasattr(self, "tenant") and self.tenant else {}
+        )
+
+        # Get the result from permit service
+        self._permission_result = await permit.check(
+            self.user_id, self.action, self.resource, context=context
+        )
+        return self._permission_result
 
     def allowed_result(self) -> Message:
-        if self.status:  # True case
-            return Message(content=f"Permission granted for {self.user_id} to {self.action} on {self.resource}")
-        return Message(content="")  # Empty message instead of None
+        if self._permission_result:
+            return Message(
+                content=f"Permission granted for {self.user_id} to {self.action} on {self.resource}"
+            )
+        return Message(content="")
 
     def denied_result(self) -> Message:
-        if not self.status:  # False case
-            return Message(content=f"Permission denied for {self.user_id} to {self.action} on {self.resource}")
-        return Message(content="")  # Empty message instead of None
+        if not self._permission_result:
+            return Message(
+                content=f"Permission denied for {self.user_id} to {self.action} on {self.resource}"
+            )
+        return Message(content="")

requirements.txt

@@ -3,4 +3,8 @@ python-jwt==4.1.0
 cryptography==42.0.5
 requests==2.32.3
 pytest==8.3.4
-langflow==1.1.4.post1
+langflow==1.2.0
+blockbuster>=1.5.8,<1.6
+asgi-lifespan>=2.1.0
+
+

setup.py

@@ -1,31 +1,31 @@
 from setuptools import setup, find_namespace_packages
 
 setup(
-    name='permit-components',
-    version='0.1.0',
-    packages=find_namespace_packages(include=['base.*', 'components.*']),
+    name="permit-components",
+    version="0.1.0",
+    packages=find_namespace_packages(include=["base.*", "components.*"]),
     install_requires=[
-        'requests>=2.32.3',
-        'python-jwt==4.1.0', 
-        'permit>=2.7.2,<3.0.0',
-        'langflow==1.1.4.post1',
-        'cryptography>=42.0.5',
+        "requests>=2.32.3",
+        "python-jwt==4.1.0",
+        "permit>=2.7.2,<3.0.0",
+        "langflow==1.1.4.post1",
+        "cryptography>=42.0.5",
     ],
-    author='Ekekenta Clinton',
-    author_email='[email protected]',
-    description='Permit.io authentication components for Langflow',
-    long_description=open('README.md', encoding='utf-8').read(),
-    long_description_content_type='text/markdown',
-    url='https://github.com/permitio/permit-components',
-    license='MIT',
+    author="Ekekenta Clinton",
+    author_email="[email protected]",
+    description="Permit.io authentication components for Langflow",
+    long_description=open("README.md", encoding="utf-8").read(),
+    long_description_content_type="text/markdown",
+    url="https://github.com/permitio/permit-components",
+    license="MIT",
     classifiers=[
-        'Development Status :: 3 - Alpha',
-        'Intended Audience :: Developers',
-        'License :: OSI Approved :: MIT License',
-        'Programming Language :: Python :: 3',
-        'Programming Language :: Python :: 3.8',
-        'Programming Language :: Python :: 3.9',
-        'Programming Language :: Python :: 3.10',
+        "Development Status :: 3 - Alpha",
+        "Intended Audience :: Developers",
+        "License :: OSI Approved :: MIT License",
+        "Programming Language :: Python :: 3",
+        "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
     ],
-    python_requires='>=3.8',
-)
+    python_requires=">=3.8",
+)

tests/api_keys.py

@@ -0,0 +1,34 @@
+import os.path
+
+# we need to import tmpdir
+
+
+def get_required_env_var(var: str) -> str:
+    """Get the value of the specified environment variable.
+
+    Args:
+    var (str): The environment variable to get.
+
+    Returns:
+    str: The value of the environment variable.
+
+    Raises:
+    ValueError: If the environment variable is not set.
+    """
+    value = os.getenv(var)
+    if not value:
+        msg = f"Environment variable {var} is not set"
+        raise ValueError(msg)
+    return value
+
+
+def get_openai_api_key() -> str:
+    return get_required_env_var("OPENAI_API_KEY")
+
+
+def get_astradb_application_token() -> str:
+    return get_required_env_var("ASTRA_DB_APPLICATION_TOKEN")
+
+
+def get_astradb_api_endpoint() -> str:
+    return get_required_env_var("ASTRA_DB_API_ENDPOINT")