Merge branch 'DIRACGrid:main' into refactor/sqlalchemy-DeclarativeBase

Author: HeloiseJoffe

diracx-cli/src/diracx/cli/jobs.py

@@ -13,7 +13,11 @@
 from typer import FileText, Option
 
 from diracx.client.aio import AsyncDiracClient
-from diracx.core.models import ScalarSearchOperator, SearchSpec, VectorSearchOperator
+from diracx.core.models.search import (
+    ScalarSearchOperator,
+    SearchSpec,
+    VectorSearchOperator,
+)
 from diracx.core.preferences import OutputFormats, get_diracx_preferences
 
 from .utils import AsyncTyper

diracx-client/src/diracx/client/patches/auth/aio.py

@@ -14,7 +14,7 @@
 
 from azure.core.pipeline import PipelineResponse
 from azure.core.tracing.decorator_async import distributed_trace_async
-from diracx.core.models import TokenResponse
+from diracx.core.models.auth import TokenResponse
 
 from ..._generated.aio.operations._operations import (
     _models,

diracx-client/src/diracx/client/patches/client/common.py

@@ -20,7 +20,7 @@
 import jwt
 from azure.core.credentials import AccessToken
 from diracx.core.utils import EXPIRES_GRACE_SECONDS, serialize_credentials
-from diracx.core.models import TokenResponse
+from diracx.core.models.auth import TokenResponse
 
 
 class TokenStatus(Enum):

diracx-client/src/diracx/client/patches/jobs/common.py

@@ -16,7 +16,7 @@
 from io import BytesIO, IOBase
 from typing import Any, IO, Dict, TypedDict, Union, Unpack, cast, Literal
 
-from diracx.core.models import SearchSpec
+from diracx.core.models.search import SearchSpec
 
 
 class ResponseExtra(TypedDict, total=False):

diracx-client/src/diracx/client/patches/utils.py

@@ -22,7 +22,7 @@
 from azure.core.pipeline import PipelineRequest
 from azure.core.pipeline.policies import BearerTokenCredentialPolicy
 
-from diracx.core.models import TokenResponse
+from diracx.core.models.auth import TokenResponse
 from diracx.core.preferences import DiracxPreferences, get_diracx_preferences
 
 

diracx-client/tests/test_auth.py

@@ -9,7 +9,7 @@
 from azure.core.credentials import AccessToken
 
 from diracx.client.patches.utils import get_token
-from diracx.core.models import TokenResponse
+from diracx.core.models.auth import TokenResponse
 from diracx.core.utils import serialize_credentials
 
 # Create a fake jwt dictionary

diracx-core/src/diracx/core/models/__init__.py

@@ -0,0 +1,12 @@
+"""Models are used to define the data structure of the requests and responses
+for the DiracX API. They are shared between the client components (cli, api) and
+services components (db, logic, routers).
+"""
+
+# in order to avoid DIRAC from failing to import TokenResponse
+# TODO: remove after DIRACGrid/DIRAC#8433
+from __future__ import annotations
+
+from .auth import TokenResponse
+
+__all__ = ["TokenResponse"]

diracx-core/src/diracx/core/models/auth.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+from datetime import datetime
+from enum import StrEnum
+
+from pydantic import BaseModel
+from typing_extensions import TypedDict
+
+
+class UserInfo(BaseModel):
+    sub: str  # dirac generated vo:sub
+    preferred_username: str
+    dirac_group: str
+    vo: str
+
+
+class TokenTypeHint(StrEnum):
+    """Token type hints for RFC7009 revocation endpoint."""
+
+    access_token = "access_token"  # noqa: S105
+    refresh_token = "refresh_token"  # noqa: S105
+
+
+class GrantType(StrEnum):
+    """Grant types for OAuth2."""
+
+    authorization_code = "authorization_code"
+    device_code = "urn:ietf:params:oauth:grant-type:device_code"
+    refresh_token = "refresh_token"  # noqa: S105   # False positive of Bandit about hard coded password
+
+
+class InitiateDeviceFlowResponse(TypedDict):
+    """Response for the device flow initiation."""
+
+    user_code: str
+    device_code: str
+    verification_uri_complete: str
+    verification_uri: str
+    expires_in: int
+
+
+class OpenIDConfiguration(TypedDict):
+    issuer: str
+    token_endpoint: str
+    userinfo_endpoint: str
+    authorization_endpoint: str
+    device_authorization_endpoint: str
+    revocation_endpoint: str
+    jwks_uri: str
+    grant_types_supported: list[str]
+    scopes_supported: list[str]
+    response_types_supported: list[str]
+    token_endpoint_auth_signing_alg_values_supported: list[str]
+    token_endpoint_auth_methods_supported: list[str]
+    code_challenge_methods_supported: list[str]
+
+
+class TokenPayload(TypedDict):
+    jti: str
+    exp: datetime
+    dirac_policies: dict
+
+
+class TokenResponse(BaseModel):
+    # Based on RFC 6749
+    access_token: str
+    expires_in: int
+    token_type: str = "Bearer"  # noqa: S105
+    refresh_token: str | None = None
+
+
+class AccessTokenPayload(TokenPayload):
+    sub: str
+    vo: str
+    iss: str
+    dirac_properties: list[str]
+    preferred_username: str
+    dirac_group: str
+
+
+class RefreshTokenPayload(TokenPayload):
+    legacy_exchange: bool
+
+
+class SupportInfo(TypedDict):
+    message: str
+    webpage: str | None
+    email: str | None
+
+
+class GroupInfo(TypedDict):
+    properties: list[str]
+
+
+class VOInfo(TypedDict):
+    groups: dict[str, GroupInfo]
+    support: SupportInfo
+    default_group: str
+
+
+class Metadata(TypedDict):
+    virtual_organizations: dict[str, VOInfo]