Phase 5: AI/MCP Bearer-Auth + Delegationstoken + Audit

5.1 Delegationstoken (app/core/delegation_token.py): - HMAC-SHA256 signiert mit SECRET_KEY, max 60s Lifetime - Payload: user_id, tenant_id, agent_id, audience, expires_at, token_id - Statelose Verifikation, Audience-Check, Expiry-Check 5.2 MCP Bearer-Auth: - app/core/api_token.py: Token Service (create, verify, revoke, list) - app/deps.py: get_current_user_bearer + get_current_user_or_bearer - app/routes/api_tokens.py: Token CRUD Routes (create, list, revoke) - MCP Server Routes: get_current_user_or_bearer akzeptiert Session + Bearer 5.3 Methodenrechte: - MCP nutzt bereits mcp:read/mcp:write basierend auf tool_def.required_permission 5.5 Audit: - MCP Tool-Ausfuehrung wird protokolliert (log_audit mit correlation_id) Tests: 13/13 bestanden (7 API Token + 6 Delegation Token)
2026-08-03 14:06:55 +02:00
parent ea797b033a
commit 8ad0a19f25
7 changed files with 659 additions and 2 deletions
@@ -0,0 +1,180 @@
+"""API Token Service — create, verify, revoke, list Bearer tokens.
+
+Uses ApiToken model with token_hash (SHA-256). Tokens are shown once at creation
+and never stored in plaintext. Verification hashes the incoming token and
+matches against the database.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import secrets
+import uuid
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+from sqlalchemy import select, update, func
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.auth import ApiToken
+from app.models.user import User, UserTenant
+
+
+def _hash_token(token: str) -> str:
+    """Hash a plaintext token with SHA-256."""
+    return hashlib.sha256(token.encode()).hexdigest()
+
+
+def _generate_token() -> str:
+    """Generate a secure random token (URL-safe, 32 bytes)."""
+    return secrets.token_urlsafe(32)
+
+
+async def create_api_token(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    user_id: uuid.UUID,
+    name: str,
+    scopes: list[str] | None = None,
+    expires_at: datetime | None = None,
+) -> dict[str, Any]:
+    """Create a new API token. Returns the plaintext token ONCE."""
+    plaintext = _generate_token()
+    token_hash = _hash_token(plaintext)
+
+    token = ApiToken(
+        tenant_id=tenant_id,
+        user_id=user_id,
+        token_hash=token_hash,
+        name=name,
+        scopes=scopes or [],
+        expires_at=expires_at,
+    )
+    db.add(token)
+    await db.flush()
+    await db.refresh(token)
+
+    return {
+        "id": str(token.id),
+        "token": plaintext,  # Only returned once at creation
+        "name": token.name,
+        "scopes": token.scopes,
+        "expires_at": token.expires_at.isoformat() if token.expires_at else None,
+        "created_at": token.created_at.isoformat() if token.created_at else None,
+    }
+
+
+async def verify_api_token(
+    db: AsyncSession, token: str
+) -> dict[str, Any] | None:
+    """Verify a Bearer token. Returns user context dict or None.
+
+    Checks:
+    - Token hash matches a database record
+    - Token is not revoked (revoked_at is NULL)
+    - Token is not expired (expires_at is NULL or in the future)
+    - User is active
+    - User has an active membership in the token's tenant
+    """
+    token_hash = _hash_token(token)
+
+    q = select(ApiToken).where(
+        ApiToken.token_hash == token_hash,
+        ApiToken.revoked_at.is_(None),
+    )
+    result = await db.execute(q)
+    api_token = result.scalar_one_or_none()
+
+    if api_token is None:
+        return None
+
+    # Check expiry
+    now = datetime.now(UTC)
+    if api_token.expires_at is not None:
+        expires_at = api_token.expires_at
+        if expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=UTC)
+        if now > expires_at:
+            return None
+
+    # Load user
+    user_q = select(User).where(User.id == api_token.user_id, User.is_active == True)  # noqa: E712
+    user_result = await db.execute(user_q)
+    user = user_result.scalar_one_or_none()
+    if user is None:
+        return None
+
+    # Check active membership
+    ut_q = select(UserTenant).where(
+        UserTenant.user_id == user.id,
+        UserTenant.tenant_id == api_token.tenant_id,
+        UserTenant.status == "active",
+    )
+    ut_result = await db.execute(ut_q)
+    ut = ut_result.scalar_one_or_none()
+    if ut is None:
+        return None
+
+    # Update last_used_at (non-blocking)
+    await db.execute(
+        update(ApiToken)
+        .where(ApiToken.id == api_token.id)
+        .values(last_used_at=now)
+    )
+    await db.flush()
+
+    # Build user context dict (same shape as get_current_user)
+    return {
+        "user_id": str(user.id),
+        "tenant_id": str(api_token.tenant_id),
+        "email": user.email,
+        "name": user.name,
+        "role": ut.role,
+        "is_system_admin": user.is_system_admin,
+        "permissions": [],  # Loaded by require_permission if needed
+        "_auth_method": "api_token",
+        "_token_id": str(api_token.id),
+        "_token_scopes": api_token.scopes or [],
+    }
+
+
+async def revoke_api_token(
+    db: AsyncSession, tenant_id: uuid.UUID, token_id: uuid.UUID
+) -> bool:
+    """Revoke an API token."""
+    now = datetime.now(UTC)
+    result = await db.execute(
+        update(ApiToken)
+        .where(
+            ApiToken.id == token_id,
+            ApiToken.tenant_id == tenant_id,
+            ApiToken.revoked_at.is_(None),
+        )
+        .values(revoked_at=now)
+    )
+    await db.flush()
+    return result.rowcount > 0
+
+
+async def list_api_tokens(
+    db: AsyncSession, tenant_id: uuid.UUID, user_id: uuid.UUID
+) -> list[dict[str, Any]]:
+    """List all API tokens for a user (without token hashes)."""
+    q = select(ApiToken).where(
+        ApiToken.tenant_id == tenant_id,
+        ApiToken.user_id == user_id,
+        ApiToken.revoked_at.is_(None),
+    ).order_by(ApiToken.created_at.desc())
+    result = await db.execute(q)
+    tokens = result.scalars().all()
+    return [
+        {
+            "id": str(t.id),
+            "name": t.name,
+            "scopes": t.scopes or [],
+            "expires_at": t.expires_at.isoformat() if t.expires_at else None,
+            "last_used_at": t.last_used_at.isoformat() if t.last_used_at else None,
+            "created_at": t.created_at.isoformat() if t.created_at else None,
+        }
+        for t in tokens
+    ]
@@ -0,0 +1,93 @@
+"""Delegation Token Service — HMAC-signed short-lived tokens for internal AI calls.
+
+Tokens are signed with the app SECRET_KEY using HMAC-SHA256.
+Max lifetime: 60 seconds. No persistent storage — stateless verification.
+
+Token format: base64(payload).base64(signature)
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import uuid
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+from app.config import get_settings
+
+
+DELEGATION_AUDIENCE = "internal-ai-delegation"
+MAX_TOKEN_LIFETIME = 60  # seconds
+
+
+def _get_secret() -> bytes:
+    """Get the signing secret from app settings."""
+    return get_settings().secret_key.encode()
+
+
+def _sign(payload: dict) -> str:
+    """Sign payload with HMAC-SHA256 and return base64(payload).base64(sig)."""
+    payload_bytes = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
+    sig = hmac.new(_get_secret(), payload_bytes, hashlib.sha256).digest()
+    return f"{base64.b64encode(payload_bytes).decode()}.{base64.b64encode(sig).decode()}"
+
+
+def _verify(token: str) -> dict | None:
+    """Verify a delegation token. Returns payload dict or None."""
+    try:
+        payload_b64, sig_b64 = token.rsplit(".", 1)
+        payload_bytes = base64.b64decode(payload_b64)
+        expected_sig = hmac.new(_get_secret(), payload_bytes, hashlib.sha256).digest()
+        actual_sig = base64.b64decode(sig_b64)
+        if not hmac.compare_digest(expected_sig, actual_sig):
+            return None
+        payload = json.loads(payload_bytes)
+        # Check expiry
+        now = datetime.now(UTC)
+        expires_at = datetime.fromisoformat(payload["expires_at"])
+        if expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=UTC)
+        if now > expires_at:
+            return None
+        # Check audience
+        if payload.get("audience") != DELEGATION_AUDIENCE:
+            return None
+        return payload
+    except Exception:
+        return None
+
+
+def create_delegation_token(
+    user_id: str,
+    tenant_id: str,
+    agent_id: str = "ai-copilot",
+    lifetime_seconds: int = MAX_TOKEN_LIFETIME,
+) -> str:
+    """Create a short-lived delegation token for an internal AI call.
+
+    The token contains:
+    - user_id, tenant_id: who the AI acts on behalf of
+    - agent_id: which agent/service is calling
+    - audience: fixed to internal-ai-delegation
+    - expires_at: max 60 seconds from now
+    - token_id: unique ID for audit tracing
+    """
+    now = datetime.now(UTC)
+    expires_at = now + timedelta(seconds=min(lifetime_seconds, MAX_TOKEN_LIFETIME))
+    payload = {
+        "user_id": user_id,
+        "tenant_id": tenant_id,
+        "agent_id": agent_id,
+        "audience": DELEGATION_AUDIENCE,
+        "expires_at": expires_at.isoformat(),
+        "token_id": str(uuid.uuid4()),
+    }
+    return _sign(payload)
+
+
+def verify_delegation_token(token: str) -> dict[str, Any] | None:
+    """Verify a delegation token. Returns payload or None if invalid/expired."""
+    return _verify(token)