Add session sharing and AsyncTokenVerifier

Author: adamjmcgrath

auth0/v3/authentication/async_token_verifier.py

@@ -1,7 +1,7 @@
 """Token Verifier module"""
 from .. import TokenValidationError
 from ..rest_async import AsyncRestClient
-from .token_verifier import AsymmetricSignatureVerifier, JwksFetcher
+from .token_verifier import AsymmetricSignatureVerifier, JwksFetcher, TokenVerifier
 
 
 class AsyncAsymmetricSignatureVerifier(AsymmetricSignatureVerifier):
@@ -14,12 +14,21 @@ class AsyncAsymmetricSignatureVerifier(AsymmetricSignatureVerifier):
 
     def __init__(self, jwks_url, algorithm="RS256"):
         super(AsyncAsymmetricSignatureVerifier, self).__init__(jwks_url, algorithm)
-        self._fetcher_async = AsyncJwksFetcher(jwks_url)
+        self._fetcher = AsyncJwksFetcher(jwks_url)
 
-    async def _fetch_key_async(self, key_id=None):
+    def set_session(self, session):
+        """Set Client Session to improve performance by reusing session.
+
+        Args:
+            session (aiohttp.ClientSession): The client session which should be closed
+                manually or within context manager.
+        """
+        self._fetcher.set_session(session)
+
+    async def _fetch_key(self, key_id=None):
         return await self._fetcher.get_key(key_id)
 
-    def verify_signature_async(self, token):
+    async def verify_signature(self, token):
         """Verifies the signature of the given JSON web token.
 
         Args:
@@ -30,7 +39,7 @@ def verify_signature_async(self, token):
             or the token's signature doesn't match the calculated one.
         """
         kid = self._get_kid(token)
-        secret_or_certificate = self._fetch_key(key_id=kid)
+        secret_or_certificate = await self._fetch_key(key_id=kid)
 
         return self._decode_jwt(token, secret_or_certificate)
 
@@ -48,7 +57,16 @@ def __init__(self, *args, **kwargs):
         super(AsyncJwksFetcher, self).__init__(*args, **kwargs)
         self._async_client = AsyncRestClient(None)
 
-    async def _fetch_jwks_async(self, force=False):
+    def set_session(self, session):
+        """Set Client Session to improve performance by reusing session.
+
+        Args:
+            session (aiohttp.ClientSession): The client session which should be closed
+                manually or within context manager.
+        """
+        self._async_client.set_session(session)
+
+    async def _fetch_jwks(self, force=False):
         """Attempts to obtain the JWK set from the cache, as long as it's still valid.
         When not, it will perform a network request to the jwks_url to obtain a fresh result
         and update the cache value with it.
@@ -68,7 +86,7 @@ async def _fetch_jwks_async(self, force=False):
         self._cache_is_fresh = False
         return self._cache_value
 
-    async def get_key_async(self, key_id):
+    async def get_key(self, key_id):
         """Obtains the JWK associated with the given key id.
 
         Args:
@@ -80,15 +98,81 @@ async def get_key_async(self, key_id):
         Raises:
             TokenValidationError: when a key with that id cannot be found
         """
-        keys = await self._fetch_jwks_async()
+        keys = await self._fetch_jwks()
 
         if keys and key_id in keys:
             return keys[key_id]
 
         if not self._cache_is_fresh:
-            keys = await self._fetch_jwks_async(force=True)
+            keys = await self._fetch_jwks(force=True)
             if keys and key_id in keys:
                 return keys[key_id]
         raise TokenValidationError(
             'RSA Public Key with ID "{}" was not found.'.format(key_id)
         )
+
+
+class AsyncTokenVerifier(TokenVerifier):
+    """Class that verifies ID tokens following the steps defined in the OpenID Connect spec.
+    An OpenID Connect ID token is not meant to be consumed until it's verified.
+
+    Args:
+        signature_verifier (AsyncAsymmetricSignatureVerifier): The instance that knows how to verify the signature.
+        issuer (str): The expected issuer claim value.
+        audience (str): The expected audience claim value.
+        leeway (int, optional): The clock skew to accept when verifying date related claims in seconds.
+        Defaults to 60 seconds.
+    """
+
+    def __init__(self, signature_verifier, issuer, audience, leeway=0):
+        if not signature_verifier or not isinstance(
+            signature_verifier, AsyncAsymmetricSignatureVerifier
+        ):
+            raise TypeError(
+                "signature_verifier must be an instance of AsyncAsymmetricSignatureVerifier."
+            )
+
+        self.iss = issuer
+        self.aud = audience
+        self.leeway = leeway
+        self._sv = signature_verifier
+        self._clock = None  # legacy testing requirement
+
+    def set_session(self, session):
+        """Set Client Session to improve performance by reusing session.
+
+        Args:
+            session (aiohttp.ClientSession): The client session which should be closed
+                manually or within context manager.
+        """
+        self._sv.set_session(session)
+
+    async def verify(self, token, nonce=None, max_age=None, organization=None):
+        """Attempts to verify the given ID token, following the steps defined in the OpenID Connect spec.
+
+        Args:
+            token (str): The JWT to verify.
+            nonce (str, optional): The nonce value sent during authentication.
+            max_age (int, optional): The max_age value sent during authentication.
+            organization (str, optional): The expected organization ID (org_id) claim value. This should be specified
+            when logging in to an organization.
+
+        Returns:
+            the decoded payload from the token
+
+        Raises:
+            TokenValidationError: when the token cannot be decoded, the token signing algorithm is not the expected one,
+            the token signature is invalid or the token has a claim missing or with unexpected value.
+        """
+
+        # Verify token presence
+        if not token or not isinstance(token, str):
+            raise TokenValidationError("ID token is required but missing.")
+
+        # Verify algorithm and signature
+        payload = await self._sv.verify_signature(token)
+
+        # Verify claims
+        self._verify_payload(payload, nonce, max_age, organization)
+
+        return payload