Chris CoutinhoandClaude Opus 4.7
b696541918
Seven findings from the latest review on #758 (3 medium, 4 low/nit): Medium: - storage.py: replace 5 ``assert self.cipher is not None`` sites with explicit ``RuntimeError`` so missing TOKEN_ENCRYPTION_KEY can't silently become an AttributeError under ``python -O`` - session_backend.py: document the silent-invalidation invariant — refresh-token TTL expiry without explicit logout deliberately makes the browser session unusable; future readers must not relax it - server/oauth_tools.py: drop user_id from the Flow 2 session_id identifier — use ``flow2_{secrets.token_hex(16)}`` so audit logs and DB rows don't carry user_id in the session_id field Low / nit: - token_utils.py: drop _fetch_locks dict entry in finally so a probed deployment can't grow the lock dict without bound; coalescing test now pins the invariant with len(_fetch_locks) == 0 - browser_oauth_routes.py: strip trailing slash from settings.nextcloud_host before constructing the well-known URL so a host configured as ``https://cloud.example.com/`` doesn't produce a double-slash - browser_oauth_routes.py: add comment explaining the three-layer CSRF policy on the mcp_session cookie set (SameSite=Lax + POST-only logout + Origin/Referer check) - oauth_routes.py: convert all 23 f-string log calls to lazy %-style per the CLAUDE.md / memory feedback_lazy_logging convention Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
111 lines
4.2 KiB
Python
111 lines
4.2 KiB
Python
"""Session-based authentication backend for Starlette routes.
|
|
|
|
Provides browser-based authentication for admin UI routes, separate from
|
|
MCP's OAuth authentication flow.
|
|
"""
|
|
|
|
import logging
|
|
import os
|
|
|
|
from starlette.authentication import (
|
|
AuthCredentials,
|
|
AuthenticationBackend,
|
|
SimpleUser,
|
|
)
|
|
from starlette.requests import HTTPConnection
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class SessionAuthBackend(AuthenticationBackend):
|
|
"""Authentication backend using signed session cookies.
|
|
|
|
For BasicAuth mode: Always authenticates as the configured user.
|
|
For OAuth mode: Checks for valid session cookie with stored refresh token.
|
|
|
|
Behavior note — silent invalidation on refresh-token TTL expiry:
|
|
The OAuth path requires *both* a live ``browser_sessions`` row and a
|
|
live ``refresh_tokens`` row for the resolved user. Logout deletes
|
|
both atomically, so a logged-out user always fails closed here.
|
|
However, if the refresh token expires by TTL (without an explicit
|
|
logout) the row is removed by ``get_refresh_token`` and the browser
|
|
session becomes unusable — the user simply gets redirected to
|
|
``/oauth/login``. This is intentional defense-in-depth: the
|
|
refresh-token check is what makes a leaked or stale browser cookie
|
|
unusable after revocation. Do not relax this without first removing
|
|
the cleanup invariant on logout (PR #758 round-4 review medium 2).
|
|
"""
|
|
|
|
def __init__(self, oauth_enabled: bool = False):
|
|
"""Initialize session authentication backend.
|
|
|
|
Args:
|
|
oauth_enabled: Whether OAuth mode is enabled
|
|
"""
|
|
self.oauth_enabled = oauth_enabled
|
|
|
|
async def authenticate(
|
|
self, conn: HTTPConnection
|
|
) -> tuple[AuthCredentials, SimpleUser] | None:
|
|
"""Authenticate the request based on session cookie or BasicAuth mode.
|
|
|
|
This backend is only applied to browser routes (/user/*) via a separate
|
|
Starlette app mount. FastMCP routes use their own OAuth Bearer token
|
|
authentication.
|
|
|
|
Args:
|
|
conn: HTTP connection
|
|
|
|
Returns:
|
|
Tuple of (credentials, user) if authenticated, None otherwise
|
|
"""
|
|
# BasicAuth mode: Always authenticated as the configured user
|
|
if not self.oauth_enabled:
|
|
username = os.getenv("NEXTCLOUD_USERNAME", "admin")
|
|
return AuthCredentials(["authenticated", "admin"]), SimpleUser(username)
|
|
|
|
# OAuth mode: opaque random session_id cookie -> user_id mapping.
|
|
# Replaces the prior `mcp_session=<user_id>` cookie pattern (issue
|
|
# #626 finding 2). The cookie value is no longer the user identity;
|
|
# we look it up server-side and reject unknown / expired sessions.
|
|
session_id = conn.cookies.get("mcp_session")
|
|
if not session_id:
|
|
logger.info("No session cookie found - redirecting to login")
|
|
return None
|
|
|
|
oauth_context = getattr(conn.app.state, "oauth_context", None)
|
|
if not oauth_context:
|
|
logger.warning("OAuth context not available in app state")
|
|
return None
|
|
|
|
storage = oauth_context.get("storage")
|
|
if not storage:
|
|
logger.warning("OAuth storage not available")
|
|
return None
|
|
|
|
try:
|
|
user_id = await storage.get_browser_session_user(session_id)
|
|
if not user_id:
|
|
logger.info(
|
|
"Browser session not found or expired (sid=%s…)", session_id[:8]
|
|
)
|
|
return None
|
|
|
|
# Defense-in-depth: only authenticate sessions for users that
|
|
# actually have a refresh token persisted. Logout deletes both,
|
|
# so an expired/revoked user state will fail closed here.
|
|
token_data = await storage.get_refresh_token(user_id)
|
|
if not token_data:
|
|
logger.warning(
|
|
"Session %s… has no refresh token for user %s; rejecting",
|
|
session_id[:8],
|
|
user_id,
|
|
)
|
|
return None
|
|
|
|
return AuthCredentials(["authenticated"]), SimpleUser(user_id)
|
|
|
|
except Exception as e:
|
|
logger.warning("Session validation error: %s", e)
|
|
return None
|