update cli for generic oauth2 ; support 2 auth servers to check tokens in back

Author: prmths128

carbonserver/carbonserver/api/services/auth_providers/oidc_auth_provider.py

@@ -8,12 +8,18 @@
 from typing import Any, Dict, Optional, Tuple
 
 from authlib.integrations.starlette_client import OAuth
+from authlib.jose import JsonWebKey
+from authlib.jose import jwt as jose_jwt
+from fief_client import FiefAsync
 
 from carbonserver.config import settings
 
 DEFAULT_SIGNATURE_CACHE_TTL = 3600  # seconds
 OAUTH_SCOPES = ["openid", "email", "profile"]
 
+fief = FiefAsync(
+    settings.fief_url, settings.fief_client_id, settings.fief_client_secret
+)
 
 oauth = OAuth()
 oauth.register(
@@ -44,3 +50,20 @@ async def get_authorize_url(self, request, login_url):
 
     def get_client_credentials(self) -> Tuple[str, str]:
         return (self.client.client_id, self.client.client_secret)
+
+    async def _decode_token(self, token: str) -> Dict[str, Any]:
+        try:
+            access_token_info = await fief.validate_access_token(token)
+            return access_token_info
+        except Exception:
+            ...
+
+        jwks_data = await self.client.fetch_jwk_set()
+        keyset = JsonWebKey.import_key_set(jwks_data)
+        claims = jose_jwt.decode(token, keyset)
+        claims.validate()
+        return dict(claims)
+
+    async def validate_access_token(self, token: str) -> bool:
+        await self._decode_token(token)
+        return True

carbonserver/carbonserver/api/services/auth_service.py

@@ -64,7 +64,7 @@ async def __call__(
                     await auth_provider.validate_access_token(bearer_token.credentials)
                 except Exception:
                     raise HTTPException(status_code=401, detail="Invalid token")
-            # cli user using auth provider token
+
             self.auth_user = jwt.decode(
                 bearer_token.credentials,
                 options={"verify_signature": False},

codecarbon/cli/main.py

@@ -8,8 +8,6 @@
 import questionary
 import requests
 import typer
-from fief_client import Fief
-from fief_client.integrations.cli import FiefAuth
 from rich import print
 from rich.prompt import Confirm
 from typing_extensions import Annotated
@@ -23,6 +21,7 @@
     overwrite_local_config,
 )
 from codecarbon.cli.monitor import run_and_monitor
+from codecarbon.cli.oidc_auth import OIDCAuth
 from codecarbon.core.api_client import ApiClient, get_datetime_with_timezone
 from codecarbon.core.schemas import ExperimentCreate, OrganizationCreate, ProjectCreate
 from codecarbon.emissions_tracker import EmissionsTracker, OfflineEmissionsTracker
@@ -115,15 +114,14 @@ def show_config(path: Path = Path("./.codecarbon.config")) -> None:
         )
 
 
-def get_fief_auth():
-    fief = Fief(AUTH_SERVER_URL, AUTH_CLIENT_ID)
-    fief_auth = FiefAuth(fief, "./credentials.json")
-    return fief_auth
+def get_oidc_auth():
+    oidc_auth = OIDCAuth(AUTH_SERVER_URL, AUTH_CLIENT_ID, "./credentials.json")
+    return oidc_auth
 
 
 def _get_access_token():
     try:
-        access_token_info = get_fief_auth().access_token_info()
+        access_token_info = get_oidc_auth().access_token_info()
         access_token = access_token_info["access_token"]
         return access_token
     except Exception as e:
@@ -133,7 +131,7 @@ def _get_access_token():
 
 
 def _get_id_token():
-    id_token = get_fief_auth()._tokens["id_token"]
+    id_token = get_oidc_auth().get_id_token()
     return id_token
 
 
@@ -152,7 +150,7 @@ def api_get():
 
 @codecarbon.command("login", short_help="Login to CodeCarbon")
 def login():
-    get_fief_auth().authorize()
+    get_oidc_auth().authorize()
     api = ApiClient(endpoint_url=API_URL)  # TODO: get endpoint from config
     access_token = _get_access_token()
     api.set_access_token(access_token)

pyproject.toml

@@ -43,6 +43,7 @@ dependencies = [
     "questionary",
     "rich",
     "typer",
+    "python-jose[cryptography]>=3.4.0",
 ]
 
 [tool.setuptools.dynamic]