Skip to content

Carry the validated bearer token to scope checks #3628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adamtheturtle merged 1 commit into from
Sep 12, 2026
Merged

Carry the validated bearer token to scope checks #3628

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 18 additions & 21 deletions src/mock_vws/_model_target_web_api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,11 +361,11 @@ def _jwt_scopes(*, bearer_token: str) -> frozenset[str]:


@beartype
def _require_bearer_token(
def _bearer_token_or_error(
request: RequestData,
dataset_type: ModelTargetDatasetType,
) -> _ResponseType | None:
"""Return an error response if the request has no bearer token."""
) -> str | _ResponseType:
"""Return a validated bearer token or an error response."""
auth_header = _get_header(request=request, name="Authorization")
if auth_header is None or not auth_header.startswith("Bearer "):
return _error_response(
Expand Down Expand Up @@ -421,18 +421,15 @@ def _require_bearer_token(
},
body,
)
return None
return bearer_token


@beartype
def _require_state_based_scope(
request: RequestData,
bearer_token: str,
dataset_type: ModelTargetDatasetType,
) -> _ResponseType | None:
"""Return an error when a token lacks the State-Based MT scope."""
auth_header = _get_header(request=request, name="Authorization")
assert auth_header is not None # noqa: S101
bearer_token = auth_header.removeprefix("Bearer ").strip()
required_scope = (
"modeltargets.statebasedmodeltarget.all"
if dataset_type == ModelTargetDatasetType.STANDARD
Expand Down Expand Up @@ -1442,12 +1439,12 @@ def create_model_target_dataset(
if content_length_error is not None:
return content_length_error

auth_error = _require_bearer_token(
bearer_token_or_error = _bearer_token_or_error(
request=request,
dataset_type=dataset_type,
)
if auth_error is not None:
return auth_error
if not isinstance(bearer_token_or_error, str):
return bearer_token_or_error

request_json_or_error = _load_request_json(request=request)
if not isinstance(request_json_or_error, dict):
Expand All @@ -1461,7 +1458,7 @@ def create_model_target_dataset(
)
if is_state_based:
state_scope_error = _require_state_based_scope(
request=request,
bearer_token=bearer_token_or_error,
dataset_type=dataset_type,
)
if state_scope_error is not None:
Expand Down Expand Up @@ -1533,12 +1530,12 @@ def get_model_target_dataset_status(
if content_length_error is not None:
return content_length_error

auth_error = _require_bearer_token(
bearer_token_or_error = _bearer_token_or_error(
request=request,
dataset_type=dataset_type,
)
if auth_error is not None:
return auth_error
if not isinstance(bearer_token_or_error, str):
return bearer_token_or_error
dataset = _find_dataset(
dataset_store=dataset_store,
dataset_uuid=dataset_uuid,
Expand Down Expand Up @@ -1600,12 +1597,12 @@ def download_model_target_dataset(
if content_length_error is not None:
return content_length_error

auth_error = _require_bearer_token(
bearer_token_or_error = _bearer_token_or_error(
request=request,
dataset_type=dataset_type,
)
if auth_error is not None:
return auth_error
if not isinstance(bearer_token_or_error, str):
return bearer_token_or_error
dataset = _find_dataset(
dataset_store=dataset_store,
dataset_uuid=dataset_uuid,
Expand Down Expand Up @@ -1650,12 +1647,12 @@ def delete_model_target_dataset(
if content_length_error is not None:
return content_length_error

auth_error = _require_bearer_token(
bearer_token_or_error = _bearer_token_or_error(
request=request,
dataset_type=dataset_type,
)
if auth_error is not None:
return auth_error
if not isinstance(bearer_token_or_error, str):
return bearer_token_or_error
dataset = _find_dataset(
dataset_store=dataset_store,
dataset_uuid=dataset_uuid,
Expand Down
Loading