Release/4.2.4

api/auth/cas_auth.py

@@ -2,6 +2,7 @@
 
 import flask
 import requests
+import sqlalchemy
 from flask import request, json
 from flask_api import status
 from xmltodict import parse
@@ -33,6 +34,7 @@
 blueprint = flask.Blueprint('cas', __name__)
 
 PROXY_TICKET_PREFIX = "PGT-"
+JWT_TOKEN_PREFIX = "jwt:"
 MEMBER_STATUS_ACTIVE = "active"
 MEMBER_STATUS_SUSPENDED = "suspended"
 
@@ -281,13 +283,13 @@ def start_member_session(cas_response, ticket, auto_create_member=False):
     return member_session
 
 
-def start_member_session_jwt(decoded_jwt, auto_create_member=False):
+def start_member_session_jwt(decoded_jwt, token_string, auto_create_member=False):
 
     usr = decoded_jwt.get("preferred_username")
 
     member = db.session.query(Member).filter_by(username=usr).first()
 
-    if member is None and (auto_create_member): 
+    if member is None and (auto_create_member):
         member = Member(first_name=decoded_jwt.get("given_name"),
                         last_name=decoded_jwt.get("family_name"),
                         username=usr,
@@ -299,18 +301,16 @@ def start_member_session_jwt(decoded_jwt, auto_create_member=False):
             current_app.logger.error(f"Failed to add new member {usr}: {e}")
             raise
 
-    member_session = MemberSession(member_id=member.id, session_key=decoded_jwt, creation_date=datetime.utcnow())
     try:
-        db.session.add(member_session)
-        db.session.commit()
+        query = """INSERT INTO member_session (member_id, session_key, creation_date)
+            VALUES ({}, '{}', '{}')
+            ON CONFLICT (session_key) DO NOTHING;""".format(member.id, token_string, datetime.utcnow())
+        db.session.execute(sqlalchemy.text(query))
     except Exception as e:
         db.session.rollback()
         current_app.logger.error(f"Failed to create member session for {usr}: {e}")
         raise
 
-    current_app.logger.error(f"Found member {usr}")
-    current_app.logger.error(f"Member username {member.username}")
-
     return member
 
 
@@ -323,7 +323,7 @@ def get_cas_attribute_value(attributes, attribute_key):
 
 
 def decrypt_proxy_ticket(ticket):
-    if ticket.startswith(PROXY_TICKET_PREFIX):
+    if ticket.startswith(PROXY_TICKET_PREFIX) or ticket.startswith(JWT_TOKEN_PREFIX):
         return ticket
     else:
         try:

api/auth/security.py

@@ -32,8 +32,8 @@ def get_authorized_user():
                 decoded = verify_jwt_token(auth_header_value)
                 if not decoded:
                     raise AuthenticationError("Invalid or expired jwt token.")
-                
-                _member = start_member_session_jwt(decoded)
+
+                _member = start_member_session_jwt(decoded, auth_header_value)
 
                 return _member
             else:
@@ -46,8 +46,8 @@ def get_authorized_user():
                 decoded = verify_jwt_token(token)
                 if not decoded:
                     raise AuthenticationError("Invalid or expired jwt token.")
-                
-                _member = start_member_session_jwt(decoded)
+
+                _member = start_member_session_jwt(decoded, token)
 
                 return _member
             else: # Malformed Authorization header
@@ -197,14 +197,23 @@ def verify_jwt_token(token):
         signing_key = jwks_client.get_signing_key_from_jwt(token)
 
         # Decode and validate the token
-        decoded_token = jwt.decode(
-            token,
-            signing_key.key,
-            algorithms=["RS256"],
-            audience=settings.JWT_AUDIENCE,
-            options={"verify_exp": False}
-        )
+        try:
+            decoded_token = jwt_decode(token, signing_key, True)
+        except:
+            # Retry without expiration validation
+            decoded_token = jwt_decode(token, signing_key, False)
+
         return decoded_token
     except Exception as e:
         print(f"JWT validation error: {e}")
         return None
+
+def jwt_decode(token, signing_key, verify_exp):
+    decoded_token = jwt.decode(
+                token,
+                signing_key.key,
+                algorithms=["RS256"],
+                audience=settings.JWT_AUDIENCE,
+                options={"verify_exp": verify_exp}
+            )
+    return decoded_token

api/models/member_session.py

@@ -7,7 +7,7 @@ class MemberSession(Base):
 
     id = db.Column(db.Integer, primary_key=True)
     member_id = db.Column(db.Integer, db.ForeignKey('member.id'), nullable=False)
-    session_key = db.Column(db.String())
+    session_key = db.Column(db.String(), unique=True)
     creation_date = db.Column(db.DateTime())
     member = db.relationship('Member', backref=db.backref('sessions'))
 

docker/Dockerfile

@@ -2,7 +2,8 @@
 FROM python:3.9 as builder
 
 # Install Poetry
-RUN curl -sSL https://install.python-poetry.org | python3 -
+RUN curl -sSL https://install.python-poetry.org | python3 - --version 2.2.1 && \
+    export PATH="/root/.local/bin:$PATH" 
 
 ENV PATH="${PATH}:/root/.local/bin" \
     POETRY_NO_INTERACTION=1 \