Coverage for python/lsst/daf/butler/registry/_dbAuth.py: 11%
81 statements
« prev ^ index » next coverage.py v7.2.7, created at 2023-06-14 09:11 +0000
« prev ^ index » next coverage.py v7.2.7, created at 2023-06-14 09:11 +0000
1# This file is part of daf_butler
2#
3# Developed for the LSST Data Management System.
4# This product includes software developed by the LSST Project
5# (http://www.lsst.org).
6# See the COPYRIGHT file at the top-level directory of this distribution
7# for details of code ownership.
8#
9# This program is free software: you can redistribute it and/or modify
10# it under the terms of the GNU General Public License as published by
11# the Free Software Foundation, either version 3 of the License, or
12# (at your option) any later version.
13#
14# This program is distributed in the hope that it will be useful,
15# but WITHOUT ANY WARRANTY; without even the implied warranty of
16# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17# GNU General Public License for more details.
18#
19# You should have received a copy of the GNU General Public License
20# along with this program. If not, see <http://www.gnu.org/licenses/>.
22from __future__ import annotations
24import fnmatch
25import os
26import stat
27import urllib.parse
29import yaml
31__all__ = ["DbAuth", "DbAuthError", "DbAuthPermissionsError"]
34class DbAuthError(RuntimeError):
35 """Exception raised when a problem has occurred retrieving database
36 authentication information.
37 """
39 pass
42class DbAuthNotFoundError(DbAuthError):
43 """Credentials file does not exist or no match was found in it."""
46class DbAuthPermissionsError(DbAuthError):
47 """Credentials file has incorrect permissions."""
50class DbAuth:
51 """Retrieves authentication information for database connections.
53 The authorization configuration is taken from the ``authList`` parameter
54 or a (group- and world-inaccessible) YAML file located at a path specified
55 by the given environment variable or at a default path location.
57 Parameters
58 ----------
59 path : `str` or None, optional
60 Path to configuration file.
61 envVar : `str` or None, optional
62 Name of environment variable pointing to configuration file.
63 authList : `list` [`dict`] or None, optional
64 Authentication configuration.
66 Notes
67 -----
68 At least one of ``path``, ``envVar``, or ``authList`` must be provided;
69 generally ``path`` should be provided as a default location.
70 """
72 def __init__(
73 self,
74 path: str | None = None,
75 envVar: str | None = None,
76 authList: list[dict[str, str]] | None = None,
77 ):
78 if authList is not None:
79 self.authList = authList
80 return
81 if envVar is not None and envVar in os.environ:
82 secretPath = os.path.expanduser(os.environ[envVar])
83 elif path is None:
84 raise DbAuthNotFoundError("No default path provided to DbAuth configuration file")
85 else:
86 secretPath = os.path.expanduser(path)
87 if not os.path.isfile(secretPath):
88 raise DbAuthNotFoundError(f"No DbAuth configuration file: {secretPath}")
89 mode = os.stat(secretPath).st_mode
90 if mode & (stat.S_IRWXG | stat.S_IRWXO) != 0:
91 raise DbAuthPermissionsError(
92 f"DbAuth configuration file {secretPath} has incorrect permissions: {mode:o}"
93 )
95 try:
96 with open(secretPath) as secretFile:
97 self.authList = yaml.safe_load(secretFile)
98 except Exception as exc:
99 raise DbAuthError(f"Unable to load DbAuth configuration file: {secretPath}.") from exc
101 # dialectname, hose, and database are tagged as Optional only because other
102 # routines delegate to this one in order to raise a consistent exception
103 # for that condition.
104 def getAuth(
105 self,
106 dialectname: str | None,
107 username: str | None,
108 host: str | None,
109 port: int | str | None,
110 database: str | None,
111 ) -> tuple[str | None, str]:
112 """Retrieve a username and password for a database connection.
114 This function matches elements from the database connection URL with
115 glob-like URL patterns in a list of configuration dictionaries.
117 Parameters
118 ----------
119 dialectname : `str`
120 Database dialect, for example sqlite, mysql, postgresql, oracle,
121 or mssql.
122 username : `str` or None
123 Username from connection URL if present.
124 host : `str`
125 Host name from connection URL if present.
126 port : `str` or `int` or None
127 Port from connection URL if present.
128 database : `str`
129 Database name from connection URL.
131 Returns
132 -------
133 username: `str`
134 Username to use for database connection; same as parameter if
135 present.
136 password: `str`
137 Password to use for database connection.
139 Raises
140 ------
141 DbAuthError
142 Raised if the input is missing elements, an authorization
143 dictionary is missing elements, the authorization file is
144 misconfigured, or no matching authorization is found.
146 Notes
147 -----
148 The list of authorization configuration dictionaries is tested in
149 order, with the first matching dictionary used. Each dictionary must
150 contain a ``url`` item with a pattern to match against the database
151 connection URL and a ``password`` item. If no username is provided in
152 the database connection URL, the dictionary must also contain a
153 ``username`` item.
155 The ``url`` item must begin with a dialect and is not allowed to
156 specify dialect+driver.
158 Glob-style patterns (using "``*``" and "``?``" as wildcards) can be
159 used to match the host and database name portions of the connection
160 URL. For the username, port, and database name portions, omitting them
161 from the pattern matches against any value in the connection URL.
163 Examples
164 --------
166 The connection URL
167 ``postgresql://user@host.example.com:5432/my_database`` matches against
168 the identical string as a pattern. Other patterns that would match
169 include:
171 * ``postgresql://*``
172 * ``postgresql://*.example.com``
173 * ``postgresql://*.example.com/my_*``
174 * ``postgresql://host.example.com/my_database``
175 * ``postgresql://host.example.com:5432/my_database``
176 * ``postgresql://user@host.example.com/my_database``
178 Note that the connection URL
179 ``postgresql://host.example.com/my_database`` would not match against
180 the pattern ``postgresql://host.example.com:5432``, even if the default
181 port for the connection is 5432.
182 """
183 # Check inputs, squashing MyPy warnings that they're unnecessary
184 # (since they're only unnecessary if everyone else runs MyPy).
185 if dialectname is None or dialectname == "":
186 raise DbAuthError("Missing dialectname parameter")
187 if host is None or host == "":
188 raise DbAuthError("Missing host parameter")
189 if database is None or database == "":
190 raise DbAuthError("Missing database parameter")
192 for authDict in self.authList:
193 # Check for mandatory entries
194 if "url" not in authDict:
195 raise DbAuthError("Missing URL in DbAuth configuration")
197 # Parse pseudo-URL from db-auth.yaml
198 components = urllib.parse.urlparse(authDict["url"])
200 # Check for same database backend type/dialect
201 if components.scheme == "":
202 raise DbAuthError("Missing database dialect in URL: " + authDict["url"])
204 if "+" in components.scheme:
205 raise DbAuthError(
206 "Authorization dictionary URLs should only specify "
207 f"dialects, got: {components.scheme}. instead."
208 )
210 # dialect and driver are allowed in db string, since functionality
211 # could change. Connecting to a DB using different driver does not
212 # change dbname/user/pass and other auth info so we ignore it.
213 # https://docs.sqlalchemy.org/en/13/core/engines.html#database-urls
214 dialect = dialectname.split("+")[0]
215 if dialect != components.scheme:
216 continue
218 # Check for same database name
219 if components.path != "" and components.path != "/":
220 if not fnmatch.fnmatch(database, components.path.lstrip("/")):
221 continue
223 # Check username
224 if components.username is not None:
225 if username is None or username == "":
226 continue
227 if username != components.username:
228 continue
230 # Check hostname
231 if components.hostname is None:
232 raise DbAuthError("Missing host in URL: " + authDict["url"])
233 if not fnmatch.fnmatch(host, components.hostname):
234 continue
236 # Check port
237 if components.port is not None and (port is None or str(port) != str(components.port)):
238 continue
240 # Don't override username from connection string
241 if username is not None and username != "":
242 return (username, authDict["password"])
243 else:
244 if "username" not in authDict:
245 return (None, authDict["password"])
246 return (authDict["username"], authDict["password"])
248 raise DbAuthNotFoundError(
249 f"No matching DbAuth configuration for: ({dialectname}, {username}, {host}, {port}, {database})"
250 )
252 def getUrl(self, url: str) -> str:
253 """Fill in a username and password in a database connection URL.
255 This function parses the URL and calls `getAuth`.
257 Parameters
258 ----------
259 url : `str`
260 Database connection URL.
262 Returns
263 -------
264 url : `str`
265 Database connection URL with username and password.
267 Raises
268 ------
269 DbAuthError
270 Raised if the input is missing elements, an authorization
271 dictionary is missing elements, the authorization file is
272 misconfigured, or no matching authorization is found.
274 See also
275 --------
276 getAuth
277 """
278 components = urllib.parse.urlparse(url)
279 username, password = self.getAuth(
280 components.scheme,
281 components.username,
282 components.hostname,
283 components.port,
284 components.path.lstrip("/"),
285 )
286 hostname = components.hostname
287 assert hostname is not None
288 if ":" in hostname: # ipv6
289 hostname = f"[{hostname}]"
290 assert username is not None
291 netloc = "{}:{}@{}".format(
292 urllib.parse.quote(username, safe=""), urllib.parse.quote(password, safe=""), hostname
293 )
294 if components.port is not None:
295 netloc += ":" + str(components.port)
296 return urllib.parse.urlunparse(
297 (
298 components.scheme,
299 netloc,
300 components.path,
301 components.params,
302 components.query,
303 components.fragment,
304 )
305 )