feat(client): Add multithreading support for refresh token, JWKS and revocation list on background. (#14)

* Add task module for background thread job.

* Add bg task to refresh token, jwks & revoke list

* Implement health check method.

* Update docs for multithreading support.

* Add exception handling on background task.

* Add background threads healthcheck.

* Add logger for background task exception.

Author: NurFaizin

CHANGELOG.rst

@@ -2,6 +2,12 @@
 Changelog
 =========
 
+0.10.0 (2021-11-05)
+-------------------
+
+* Add backgroud refresh token, jwks and revocation list.
+* Add Flask framework support.
+
 0.8.0 (2021-10-22)
 ------------------
 

README.rst

@@ -36,3 +36,5 @@ Features
 * Get role and validate permission
 * Validate scope, role and audience
 * Verify ban, phone and email user status
+* Backgroud refresh token, jwks and revocation list.
+* Flask framework support.

docs/frameworks.rst

@@ -64,3 +64,11 @@ You can customize these default configurations according to your service/apps ne
     app.config["IAM_TOKEN_HEADER_TYPE"] = "Bearer"
     app.config["IAM_TOKEN_COOKIE_NAME"] = "access_token"
     app.config["IAM_TOKEN_COOKIE_PATH"] = "/"
+
+.. note::
+    This module has been tested with Flask default WSGI server for development.
+    For production use, this module has been tested with *Gunicorn* and *uWSGI*.
+    You can use Gunicorn with sync and gthread worker. Since this SDK use multithreading, please
+    make sure you enable the thread support with **--enable-threads** options when you use uWSGI.
+    
+    For more information about Flask deployment, please read more information `here <https://flask.palletsprojects.com/en/latest/deploying/>`_

docs/iam_python_sdk.rst

@@ -76,6 +76,14 @@ iam\_python\_sdk\.models module
     :undoc-members:
     :show-inheritance:
 
+iam\_python\_sdk\.task module
+-----------------------------
+
+.. automodule:: iam_python_sdk.task
+    :members:
+    :undoc-members:
+    :show-inheritance:
+
 iam\_python\_sdk\.utils module
 ------------------------------
 

iam_python_sdk/__init__.py

@@ -17,7 +17,7 @@
 
 __author__ = """Analytics AccelByte"""
 __email__ = 'justice-analytics-team@accelbyte.net'
-__version__ = '0.8.0'
+__version__ = '0.10.0'
 __all__ = [
     'NewDefaultClient',
     'Config'

iam_python_sdk/client.py

@@ -21,15 +21,16 @@
 
 from .bloom import BloomFilter
 from .cache import Cache
-from .config import Config
-from .config import CLIENT_INFO_EXPIRATION, CLIENT_INFORMATION_PATH, GET_ROLE_PATH, GRANT_PATH, JWKS_PATH, \
-    MAX_BACKOFF_TIME, REVOCATION_LIST_PATH, SCOPE_SEPARATOR, VERIFY_PATH
+from .config import DEFAULT_JWKS_REFRESH_INTERVAL, DEFAULT_REVOCATION_LIST_REFRESH_INTERVAL, Config
+from .config import CLIENT_INFO_EXPIRATION, CLIENT_INFORMATION_PATH, DEFAULT_TOKEN_REFRESH_RATE, GET_ROLE_PATH, \
+    GRANT_PATH, JWKS_PATH, MAX_BACKOFF_TIME, REVOCATION_LIST_PATH, SCOPE_SEPARATOR, VERIFY_PATH
 from .errors import ClientTokenGrantError, GetClientInformationError, GetJWKSError, GetRevocationListError, \
     GetRolePermissionError, HTTPClientError, InvalidTokenSignatureKeyError, NilClaimError, NoLocalValidationError, \
     RefreshAccessTokenError, StartLocalValidationError, TokenRevokedError, UserRevokedError, ValidateAccessTokenError, \
     ValidateAndParseClaimsError, ValidateAudienceError, ValidateJWTError, ValidatePermissionError, ValidateScopeError
 from .models import ClientInformation, JWTClaims, Permission, RevocationList, Role, TokenResponse
 from .log import logger
+from .task import Task
 from .utils import parse_nanotimestamp
 
 
@@ -81,7 +82,9 @@ def __init__(self, config: Config,
                  httpClient: HttpClient
                  ) -> None:
         self._lock = RLock()
+        self._threads = {}
         self._clientAccessToken = ""
+        self._tokenRefreshActive = False
         self._localValidationActive = False
         self._jwks = {}
         self._revokedUsers = {}
@@ -390,7 +393,12 @@ def ClientTokenGrant(self) -> None:
             self._clientAccessToken = token_response.AccessToken
             logger.info("token grant success")
 
-            # TODO: Background refresh token
+            if not self._tokenRefreshActive:
+                self._tokenRefreshActive = True
+                self._threads["refresh_token"] = Task(
+                    token_response.ExpiresIn * DEFAULT_TOKEN_REFRESH_RATE,
+                    self._refresh_access_token
+                )
 
         except (json.JSONDecodeError, ValueError) as e:
             raise ClientTokenGrantError("unable to unmarshal response body") from e
@@ -410,9 +418,17 @@ def StartLocalValidation(self) -> None:
         try:
             self._get_jwks()
             self._get_revocation_list()
-            self._localValidationActive = True
 
-            # TODO: Background refresh JWKS and Revocation list
+            if not self._localValidationActive:
+                self._localValidationActive = True
+                self._threads["refresh_jwks"] = Task(
+                    DEFAULT_JWKS_REFRESH_INTERVAL,
+                    self._get_jwks
+                )
+                self._threads["refresh_revocation"] = Task(
+                    DEFAULT_REVOCATION_LIST_REFRESH_INTERVAL,
+                    self._get_revocation_list
+                )
 
         except GetJWKSError as e:
             raise StartLocalValidationError("unable to get JWKS") from e
@@ -641,7 +657,33 @@ def HealthCheck(self) -> bool:
         Returns:
             bool: health status
         """
-        return False
+        with self._lock:
+            refresh_token = self._threads.get("refresh_token")
+            refresh_jwks = self._threads.get("refresh_jwks")
+            refresh_revocation = self._threads.get("refresh_revocation")
+
+        if not refresh_token or not refresh_jwks or not refresh_revocation:
+            logger.warning("refresh token, jwks or revocation list background thread not started")
+            return False
+
+        if refresh_token.error is not None:
+            logger.warning("error refresh token")
+            logger.error(refresh_token.error)
+            return False
+
+        if refresh_jwks.error is not None:
+            logger.warning("error refresh jwks")
+            logger.error(refresh_jwks.error)
+            return False
+
+        if refresh_revocation.error is not None:
+            logger.warning("error refresh revocation list")
+            logger.error(refresh_revocation.error)
+            return False
+
+        logger.info("all OK")
+
+        return True
 
     def ValidateAudience(self, claims: Union[JWTClaims, None]) -> None:
         """Validate audience of user access token

iam_python_sdk/models.py

@@ -115,7 +115,7 @@ class TokenResponse(Model):
     """Token response class on successful token request."""
     AccessToken: str = ""
     RefreshToken: str = ""
-    ExpiresIn: str = ""
+    ExpiresIn: int = -1
     TokenType: str = ""
     Roles: List[str] = [""]
     AcceptedPolicyVersion: List[str] = [""]

iam_python_sdk/task.py

@@ -0,0 +1,72 @@
+# Copyright 2021 AccelByte Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Task module."""
+
+
+from threading import RLock, Timer
+from typing import Any, Callable, Union
+
+from .log import logger
+
+
+class Task:
+    """Task module for background task.
+    """
+    def __init__(self, interval: Union[int, float], function: Callable[..., Any], *args, **kwargs) -> None:
+        self._lock = RLock()
+        self._timer = None
+        self.interval = interval
+        self.function = function
+        self.args = args
+        self.kwargs = kwargs
+        self.status = 'STOP'
+        self.error = None
+
+        if kwargs.pop('autostart', True):
+            self.start()
+
+    def _run(self) -> None:
+        with self._lock:
+            self.status = 'RUNNING'
+
+        try:
+            self.function(*self.args, **self.kwargs)
+        except Exception as e:
+            # We catch all exceptions here because we dont know what error will occur on background task
+            logger.error(e)
+            self.error = e
+
+        self.start(repeat=True)
+
+    def start(self, repeat: bool = False) -> None:
+        """Start the thread in background(daemon).
+
+        Args:
+            repeat (bool, optional): Status if the task is repetitive. Defaults to False.
+        """
+        with self._lock:
+            if repeat or self.status == 'STOP':
+                self.status = 'WAITING'
+                self._timer = Timer(self.interval, self._run)
+                self._timer.daemon = True
+                self._timer.start()
+
+    def stop(self) -> None:
+        """Stop the background task.
+        """
+        with self._lock:
+            self.status = 'STOP'
+            if self._timer:
+                self._timer.cancel()

setup.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.8.0
+current_version = 0.10.0
 commit = True
 tag = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(rc(?P<rc>\d+))?

setup.py

@@ -50,6 +50,6 @@
     test_suite='tests',
     tests_require=test_requirements,
     url='https://accelbyte.github.io/iam-python-sdk',
-    version='0.8.0',
+    version='0.10.0',
     zip_safe=False,
 )