def __init__(self, opts=None) -> None:
super(CreateSwagger, self).__init__(opts)
sys.path = ["", ".."] + sys.path[1:]
self.info = {"openapi": "3.0.0"}
url_patterns = get_settings_variable("URL_PATTERNS")
swagger_info = get_settings_variable("SWAGGER")
if not swagger_info:
raise CraxImproperlyConfigured(
"'SWAGGER' variable should"
" be defined in configuration file to use Swagger")
elif swagger_info.servers is None or swagger_info.basePath is None:
raise CraxImproperlyConfigured(
"'SWAGGER_HOST' and 'SWAGGER_BASE_PATH' should"
" be defined in configuration file to use Swagger")
self.base_path = swagger_info.basePath
self.swagger_file = f"{BASE_URL}/crax/swagger/static/swagger.json"
info = {
k: v
for k, v in swagger_info.__dict__.items()
if k not in ["host", "basePath", "schemes"]
}
self.info["info"] = info
self.info["host"] = swagger_info.host
self.info["basePath"] = swagger_info.basePath
self.info["servers"] = swagger_info.servers
self.info["tags"] = []
self.url_list = list(unpack_urls(url_patterns))
async def login(request: Request, username: str,
password: str) -> typing.Union[User, AnonymousUser]:
secret = get_settings_variable("SECRET_KEY")
signer = itsdangerous.TimestampSigner(str(secret))
max_age = get_settings_variable("SESSION_EXPIRES", default=1209600)
cookie_name = get_settings_variable("SESSION_COOKIE_NAME",
default="session_id")
if not secret:
raise CraxImproperlyConfigured(
'"SECRET_KEY" variable should be defined to use Authentication backends'
)
if hasattr(request, "cookies"):
cookies = request.cookies
if cookie_name in cookies:
session_cookie = cookies[cookie_name]
session_cookie = b64decode(session_cookie)
user = signer.unsign(session_cookie, max_age=max_age)
user = user.decode("utf-8")
await set_user(request,
username,
password,
user_pk=int(user.split(":")[1]))
else:
await set_user(request, username, password)
return request.user
def create_session_signer() -> tuple:
secret_key = get_settings_variable("SECRET_KEY")
if secret_key is None:
raise CraxImproperlyConfigured(
'"SECRET_KEY" string should be defined in settings to use Crax Sessions'
)
signer = itsdangerous.TimestampSigner(
str(secret_key), algorithm=itsdangerous.signer.HMACAlgorithm())
max_age = get_settings_variable("SESSION_EXPIRES", default=1209600)
cookie_name = get_settings_variable("SESSION_COOKIE_NAME",
default="session_id")
same_site = get_settings_variable("SAME_SITE_COOKIE_MODE", default="lax")
return signer, max_age, cookie_name, same_site
def __init__(self, request: Request, debug: bool = False) -> None:
self.debug = debug
self.request = request
self.url_patterns = get_settings_variable("URL_PATTERNS")
self.enable_csrf = get_settings_variable("ENABLE_CSRF")
self.error_handlers = get_settings_variable("ERROR_HANDLERS")
self.static_dirs = get_settings_variable("STATIC_DIRS", default=["static"])
self.base_url = get_settings_variable(
"BASE_URL",
default=os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
)
self.headers = {}
self.status = 200
self.errors = None
def get_template(self) -> Template:
if (not self.apps or "error_message" in self.kwargs
or self.template in ["default.html", "swagger.html"]):
env = Environment(
loader=PackageLoader("crax", "templates/"),
autoescape=True,
enable_async=True,
)
template = env.get_template(self.template)
else:
template_dirs = [".", "crax"]
for app in self.apps:
template_dirs += [
root for root, _, _ in os.walk(app) if "templates" in root
]
env = Environment(
loader=FileSystemLoader(template_dirs),
autoescape=True,
enable_async=True,
)
template = env.get_template(self.template)
env.globals.update(url=url)
env.globals.update(csrf_token=csrf_token)
custom_functions = get_settings_variable("TEMPLATE_FUNCTIONS")
if custom_functions and isinstance(custom_functions, list):
for func in custom_functions:
env.globals.update(**{func.__name__: func})
return template
def url(*args: typing.Union[tuple, list],
**kwargs: typing.Any) -> typing.Optional[str]:
url_patterns = get_settings_variable("URL_PATTERNS")
params = kwargs.keys()
path = f'/{args[0]}/{"/".join(params)}/'
match = None
urls = unpack_urls(url_patterns)
for route in urls:
for u in route.urls:
if u.name == args[0]:
match = u
else:
if u.path == path:
match = u
if u.type_ == "re_path":
m = re.match(u.path, path)
if m:
if len(params) == len(m.groupdict()):
match = u
else:
split_req_path = [x for x in path.split("/") if x]
split_path = [x for x in u.path.split("/") if x]
intersection = set(split_req_path).intersection(split_path)
if len(intersection) == len(params):
match = u
if match is not None:
if match.type_ == "re_path":
lst = prepare_url(match.path)
else:
lst = (x for x in match.path.split("/") if x)
res = create_path(lst, match.namespace, kwargs)
return res
async def process_headers(self) -> typing.Union[Request, ExceptionType]:
max_body = get_settings_variable("MAX_BODY_SIZE", default=1024 * 1024)
content_length = self.request.headers.get("content-length")
if content_length and int(content_length) > int(max_body):
self.request.status_code = 400
return RuntimeError(
f"Too large body. Allowed body size up to {max_body} bytes")
return self.request
def create_password(password: str) -> str:
secret = get_settings_variable("SECRET_KEY")
if not secret:
raise CraxImproperlyConfigured(
'"SECRET_KEY" variable should be defined to use Authentication backends'
)
secret = secret.encode()
hashed = hashlib.pbkdf2_hmac("sha256", password.encode(), secret, 100000)
return hashed.hex()
async def send_file():
base_url = get_settings_variable("BASE_URL")
file_ = f"{base_url}/test.log"
if os.path.isfile(file_):
with open(file_, "r") as f:
z = f.readlines()
for i in z:
yield i
else:
yield ""
async def get(self):
secret_key = get_settings_variable("SECRET_KEY")
max_age = get_settings_variable("SESSION_EXPIRES", default=1209600)
cookie_name = get_settings_variable("SESSION_COOKIE_NAME",
default="session_id")
signer = itsdangerous.TimestampSigner(str(secret_key))
sign = signer.sign("Anonymous:0")
encoded = b64encode(sign)
session = encoded.decode("utf-8")
session_cookie = (f"{cookie_name}={session}; path=/;"
f" Max-Age={max_age}; httponly; samesite=lax")
signed = {"Anonymous:0": session_cookie}
self.request.session = json.dumps(signed)
response = JSONResponse(
self.request,
{"user": self.request.session},
)
return response
async def pub(queue):
base_url = get_settings_variable("BASE_URL")
file_ = open(f"{base_url}/test.log", "r")
while True:
where = file_.tell()
line = file_.readline()
if not line:
await asyncio.sleep(0.1)
file_.seek(where)
else:
await queue.put(line)
def check_password(hashed: str, password: str) -> bool:
secret = get_settings_variable("SECRET_KEY")
if not secret:
raise CraxImproperlyConfigured(
'"SECRET_KEY" variable should be defined to use Authentication backends'
)
secret = secret.encode()
return hmac.compare_digest(
bytearray.fromhex(hashed),
hashlib.pbkdf2_hmac("sha256", password.encode(), secret, 100000),
)
def csrf_token():
secret_key = get_settings_variable("SECRET_KEY")
if secret_key is None:
raise CraxImproperlyConfigured(
'"SECRET_KEY" string should be defined in settings to use CSRF Protection'
)
signer = itsdangerous.TimestampSigner(str(secret_key))
sign = signer.sign(str(int(time.time())))
encoded = b64encode(sign)
csrf_key = encoded.decode("utf-8")
return csrf_key
async def test_swagger():
crax_path = __import__(CreateSwagger.__module__)
swagger_file = f"{crax_path.__path__[0]}/swagger/static/swagger.json"
with open(swagger_file, "w") as f:
f.write("")
os.environ["CRAX_SETTINGS"] = "config_files.conf_csrf"
create_swagger = CreateSwagger(OPTIONS).create_swagger
create_swagger()
url_patterns = get_settings_variable("URL_PATTERNS")
expected_urls = []
url_list = [
y for x in unpack_urls(url_patterns) for y in x.urls
if "api" in y.path and y.tag != "crax"
]
for u in url_list:
re_path = False
if u.type_ == "re_path":
re_path = True
z = CreateSwagger(OPTIONS).prepare_url([u.path], re_path=re_path)
expected_urls.append(z)
with open(swagger_file, "r") as f:
swagger_data = json.load(f)
urls = list(swagger_data["paths"])
assert all(x in list(urls) for x in expected_urls)
test_path = [x for x in expected_urls if "optional" in x][0]
swagger_path = swagger_data["paths"][test_path]
swagger_params = [x["name"] for x in swagger_path["get"]["parameters"]]
test_params = test_path.replace("{", "").replace("}", "").split("/")
assert swagger_params == test_params[3:]
assert swagger_path["get"]["tags"] == [test_params[2]]
assert swagger_path["delete"]["tags"] == [test_params[2]]
assert swagger_path["patch"]["tags"] == [test_params[2]]
assert swagger_path["patch"]["parameters"][0]["type"] == "integer"
assert swagger_path["patch"]["parameters"][0]["format"] == "int64"
assert swagger_path["patch"]["parameters"][1]["type"] == "string"
assert swagger_path["patch"]["parameters"][1]["format"] == "string"
def any_no_settings(host):
time.sleep(1)
resp = requests.get(host)
assert resp.status_code == 200
await SimpleResponseTest(
any_no_settings,
"http://127.0.0.1:8000/api_doc",
settings="tests.config_files.conf_csrf",
debug=True,
)
def __init__(
self,
settings: str = None,
debug: bool = False,
on_startup: typing.Union[typing.Callable, typing.Coroutine] = None,
) -> None:
self.settings = settings
self.debug = debug
self.on_startup = on_startup
self.errors = None
self.request = None
self.app_logger = None
self.status_code = None
self.db_connections = {}
if not settings:
os.environ["CRAX_SETTINGS"] = "crax.conf"
else:
try:
__import__(settings)
os.environ["CRAX_SETTINGS"] = settings
disable_logging = get_settings_variable("DISABLE_LOGS",
default=True)
if disable_logging is False:
logging_backend = get_settings_variable(
"LOGGING_BACKEND", default="crax.logger.CraxLogger")
spl_middleware = logging_backend.split(".")
module = __import__(".".join(spl_middleware[:-1]),
fromlist=spl_middleware[:-1])
logger = getattr(module, spl_middleware[-1])
app_logger = logger()
self.app_logger = app_logger.get_logger()
except (ModuleNotFoundError, ImportError) as ex:
self.errors = ex
self.status_code = 500
async def __call__(self, scope: Scope, receive: Receive,
send: Send) -> None:
if scope["type"] == "lifespan":
databases = get_settings_variable('DATABASES')
message = await receive()
if message["type"] == "lifespan.startup":
if databases:
from crax.database.connection import create_connections
self.db_connections = await create_connections()
start_message = "STARTING CRAX FRAMEWORK"
sys.stdout.write(f"\033[36m{start_message}\033[0m \n")
if self.on_startup is not None:
if inspect.iscoroutinefunction(self.on_startup):
await self.on_startup()
else:
self.on_startup()
await send({"type": "lifespan.startup.complete"})
elif message["type"] == "lifespan.shutdown":
if databases:
from crax.database.connection import close_pool
await close_pool(self.db_connections)
await send({"type": "lifespan.shutdown.complete"})
elif scope["type"] in ["http", "websocket"]:
self.request = Request(scope)
if "method" in scope and scope["method"] in ["POST", "PATCH"]:
form_data = FormData(self.request, self._receive(receive))
await form_data.process()
if self.app_logger is not None:
client = self.request.client
server = self.request.server
method = self.request.method
user_agent = self.request.headers.get("user-agent", "Unknown")
message = f'{scope["type"]} {method} {server} {client} {user_agent} {scope["path"]}'
self.app_logger.info(message)
try:
await self.process_request(scope, receive, send)
except Exception as ex:
self.status_code = 500
self.errors = ex
await self.process_errors(scope, receive, send)
self.errors = None
else:
raise NotImplementedError(
"Unknown request type") # pragma: no cover
def success_custom_cors(host, as_string=False):
time.sleep(1)
headers = {
"origin": "http://127.0.0.1:8000",
"access-control-request-method": "PATCH",
"Allow-By-Cookie": "true",
}
cors_options = get_settings_variable("CORS_OPTIONS", default={})
origins = cors_options["origins"]
if isinstance(origins, list):
origins = ", ".join(origins)
resp = requests.options(host, headers=headers)
if as_string is True:
allow_headers = "*"
else:
allow_headers = "content-type, allow-by-cookie"
preflight = {
"access-control-allow-origin": origins,
"access-control-allow-methods": "POST, PATCH",
"access-control-allow-headers": allow_headers,
"access-control-max-age": "600",
"vary": "Origin",
"access-control-expose-headers": "Exposed_One, Exposed_Two",
}
assert all(
x in resp.headers and all(k in resp.headers[x] for k in preflight[x])
for x in preflight
)
assert resp.status_code == 200
headers = {"Allow-By-Cookie": "true"}
resp = requests.post(host, headers=headers, data={"data": "Test data"})
no_preflight = {
"access-control-allow-origin": origins,
"access-control-allow-methods": "POST, PATCH",
"access-control-max-age": "600",
"vary": "Origin",
}
assert all(
x in resp.headers and resp.headers[x] == no_preflight[x] for x in no_preflight
)
assert resp.status_code == 200
assert resp.json()["data"] == "Test data"
async def __call__(self, scope, receive, send):
base_url = get_settings_variable("BASE_URL")
if self.request.method == "POST":
test_dir = f"{os.path.dirname(os.path.dirname(base_url))}/tests"
command_ = f"cd .. && {test_dir}/venv/bin/python3 -m coverage html"
os.system(command_)
cove_dir = f"{test_dir}/htmlcov"
docker_dir = f"{test_dir}/docker"
static_dir = f"{docker_dir}/static"
if not os.path.exists(static_dir):
os.mkdir(static_dir)
template_dir = f"{docker_dir}/streams/templates"
if os.path.exists(cove_dir):
for file_ in os.listdir(cove_dir):
if file_.endswith(".html"):
shutil.copyfile(f"{cove_dir}/{file_}",
f"{template_dir}/{file_}")
for match in REPLACEMENTS:
replacement(f"{template_dir}/{file_}", match[0],
match[1])
elif re.match(r".*\.js|.*css|.*\.png", file_):
shutil.copyfile(f"{cove_dir}/{file_}",
f"{static_dir}/{file_}")
response = JSONResponse(self.request,
{"success": "Coverage created"})
else:
response = JSONResponse(
self.request,
{"error": "Failed to create coverage report"})
await response(scope, receive, send)
else:
response = StreamingResponse(self.request, send_file())
await response(scope, receive, send)
started = os.environ.get("CRAX_TEST_SESSION_STARTED")
if started is None:
file_path = f"{base_url}/test.log"
if os.path.isfile(file_path):
run_ = asyncio.create_task(run_pub_sub())
os.environ["CRAX_RUN_TEST_CORO"] = str(id(run_))
os.environ["CRAX_TEST_SESSION_STARTED"] = "Started"
async def process_headers(self) -> typing.Any:
response = await super(CorsHeadersMiddleware, self).process_headers()
cors_options = get_settings_variable("CORS_OPTIONS", default={})
preflight = True
error = None
status_code = 200
if self.request.method == "OPTIONS":
if not isinstance(cors_options, dict):
error = RuntimeError("Cors options should be a dict")
status_code = 500
response = TextResponse(
self.request, str(error), status_code=status_code
)
return response
origin = cors_options.get("origins", "*")
method = cors_options.get("methods", "*")
header = cors_options.get("headers", "*")
expose_headers = cors_options.get("expose_headers", None)
max_age = cors_options.get("max_age", "600")
request_origin = self.request.headers.get("origin")
request_method = self.request.headers.get("access-control-request-method")
request_headers = self.request.headers.get("access-control-request-headers")
if request_method is None:
request_method = self.request.scope["method"]
if self.request.method == "OPTIONS":
if request_headers:
request_headers = set(request_headers.split(","))
else:
request_headers = {"content-type"}
request_method = {request_method}
request_origin = {request_origin}
if header != "*" and "cors_cookie" in cors_options:
if "*" in header:
pass # pragma: no cover
else:
header = [x for x in header]
header.append(cors_options["cors_cookie"].lower())
cors_headers = self.check_allowed(header, request_headers)
if cors_headers is None:
error = RuntimeError(
f"Cross Origin Request with headers: "
f'"{list(request_headers)[0]}" not allowed on this server'
)
status_code = 400
cors_methods = self.check_allowed(method, request_method)
if cors_methods is None:
error = RuntimeError(
f"Cross Origin Request with method: "
f'"{list(request_method)[0]}" not allowed on this server'
)
status_code = 400
cors_origins = self.check_allowed(origin, request_origin)
if cors_origins is None:
error = RuntimeError(
f"Cross Origin Request from: "
f'"{list(request_origin)[0]}" not allowed on this server'
)
status_code = 400
elif (
"cors_cookie" in cors_options
and cors_options["cors_cookie"].lower() in self.request.headers
):
preflight = False
if not isinstance(origin, str):
cors_origins = ", ".join(origin)
else:
cors_origins = origin
if not isinstance(method, str):
cors_methods = ", ".join(method)
else:
cors_methods = method
if not isinstance(header, str):
cors_headers = ", ".join(header)
else:
cors_headers = header
else:
return response
if error is None:
cors_headers = [
(b"Access-Control-Allow-Origin", cors_origins.encode("latin-1")),
(b"Access-Control-Allow-Methods", cors_methods.encode("latin-1")),
(b"Access-Control-Allow-Headers", cors_headers.encode("latin-1")),
(b"Access-Control-Max-Age", max_age.encode("latin-1")),
(b"Vary", b"Origin"),
]
if expose_headers is not None and preflight is True:
if isinstance(expose_headers, str):
expose_headers = [x.strip() for x in expose_headers.split(",")]
assert type(expose_headers) == list
cors_headers.append(
(b"Access-Control-Expose-Headers", ", ".join(expose_headers).encode("latin-1"))
)
if preflight is False:
if self.request.content_type is not None:
cors_headers.append(
(b"Content-Type", self.request.content_type.encode("latin-1"))
)
self.headers.append(cors_headers)
response.headers.extend(*self.headers)
else:
response = TextResponse(self.request, str(error), status_code=status_code)
return response
def __init__(self, request: Request = None, **kwargs: typing.Any) -> None:
super(TemplateView, self).__init__(request=None, **kwargs)
self.request = request
self.kwargs = kwargs
self.apps = get_settings_variable("APPLICATIONS")
self.get_status_code()
def check_allowed(self, handler: typing.Callable):
errors = None
if self.request.user is not None:
if hasattr(handler, "login_required"):
login_required = handler.login_required
if (
hasattr(self.request.user, "pk")
and self.request.user.pk == 0
and login_required is True
):
errors = {
"error_handler": CraxUnauthorized,
"error_message": self.request.path,
"status_code": 401,
}
if hasattr(handler, "staff_only"):
staff_only = handler.staff_only
if self.request.user.is_staff is False and staff_only is True:
errors = {
"error_handler": CraxForbidden,
"error_message": self.request.path,
"status_code": 403,
}
if hasattr(handler, "superuser_only"):
superuser_only = handler.superuser_only
if self.request.user.is_superuser is False and superuser_only is True:
errors = {
"error_handler": CraxForbidden,
"error_message": self.request.path,
"status_code": 403,
}
if hasattr(handler, "methods") and self.request.scheme in [
"http",
"http.request",
]:
if self.enable_csrf is True and self.request.method in ["POST", "PATCH"]:
if hasattr(handler, "enable_csrf") and handler.enable_csrf is True:
if "csrf_token" not in self.request.post:
errors = {
"error_handler": CraxForbidden,
"error_message": "CSRF token missed",
"status_code": 403,
}
elif not self.request.post["csrf_token"]:
errors = {
"error_handler": CraxForbidden,
"error_message": "CSRF token is empty",
"status_code": 403,
}
else:
secret_key = get_settings_variable("SECRET_KEY")
if secret_key is None:
raise CraxImproperlyConfigured(
'"SECRET_KEY" string should be defined in settings to use CSRF Protection'
)
try:
token = self.request.post["csrf_token"]
signer = itsdangerous.TimestampSigner(str(secret_key))
max_age = get_settings_variable(
"SESSION_EXPIRES", default=1209600
)
session_cookie = b64decode(token)
signer.unsign(session_cookie, max_age=max_age)
except (
binascii.Error,
BadTimeSignature,
BadSignature,
SignatureExpired,
):
errors = {
"error_handler": CraxForbidden,
"error_message": "CSRF token is incorrect",
"status_code": 403,
}
if not self.request.method: # pragma: no cover
errors = {
"error_handler": CraxNoMethodGiven,
"error_message": handler,
"status_code": 500,
}
elif not handler.methods:
errors = {
"error_handler": CraxEmptyMethods,
"error_message": handler,
"status_code": 500,
}
else:
handler.methods += ["HEAD", "OPTIONS"]
if self.request.method not in handler.methods:
errors = {
"error_handler": CraxMethodNotAllowed,
"error_message": handler,
"status_code": 405,
}
return errors
def __init__(self):
log_format = get_settings_variable(
"LOG_FORMAT", default="%(asctime)s — %(name)s — %(levelname)s — %(message)s"
)
project_base_url = get_settings_variable("BASE_URL", default=".")
self.formatter = logging.Formatter(log_format)
self.logger_name = get_settings_variable("LOGGER_NAME", default="crax")
self.log_file = get_settings_variable(
"LOG_FILE", default=f"{project_base_url}/crax.log"
)
self.log_level = get_settings_variable("LOG_LEVEL", default="INFO")
self.log_rotate_time = get_settings_variable(
"LOG_ROTATE_TIME", default="midnight"
)
self.console = get_settings_variable("LOG_CONSOLE", default=False)
self.streams = get_settings_variable(
"LOG_STREAMS", default=[sys.stdout, sys.stderr]
)
enable_sentry = get_settings_variable("ENABLE_SENTRY", default=False)
if enable_sentry is True: # pragma: no cover
assert sentry_sdk is not None and LoggingIntegration is not None
sentry_dsn = get_settings_variable("LOG_SENTRY_DSN")
assert sentry_dsn is not None
sentry_log_level = get_settings_variable(
"SENTRY_LOG_LEVEL", default=self.log_level
)
sentry_event_level = get_settings_variable(
"SENTRY_EVENT_LEVEL", default="ERROR"
)
sentry_logging = LoggingIntegration(
level=getattr(logging, sentry_log_level),
event_level=getattr(logging, sentry_event_level),
)
sentry_sdk.init(dsn=sentry_dsn, integrations=[sentry_logging])
async def process_headers(self) -> Request:
x_frame_options = get_settings_variable("X_FRAME_OPTIONS",
default="SAMEORIGIN")
self.request.response_headers["X-Frame-Options"] = x_frame_options
return self.request