Update the VERSION

Author: whu-lyft

kmsauth/__init__.py

@@ -252,10 +252,10 @@ def decrypt_token(self, username, token):
                 version < self.minimum_token_version):
             raise TokenValidationError('Unacceptable token version.')
         if self.stats:
-            self.stats.incr('token_version_{0}'.format(version))
-            self.stats.incr(f'cache_key.from.{_from}')
-            self.stats.incr(f'cache_key.to.{self.to_auth_context}')
-            self.stats.incr(f'cache_key.user_type.{user_type}')
+            self.stats.incr('token_version_{version}')
+            self.stats.incr(f'cache_key_from_{_from}')
+            self.stats.incr(f'cache_key_to_{self.to_auth_context}')
+            self.stats.incr(f'cache_key_user_type_{user_type}')
         try:
             token_key = '{0}{1}{2}{3}'.format(
                 hashlib.sha256(ensure_bytes(token)).hexdigest(),
@@ -267,10 +267,10 @@ def decrypt_token(self, username, token):
             raise TokenValidationError('Authentication error.')
         if token_key not in self.TOKENS:
             if self.stats:
-                self.stats.incr('token_cache.miss')
-                self.stats.gauge('token_cache.size_at_miss', len(self.TOKENS))
+                self.stats.incr('token_cache_miss')
+                self.stats.gauge('token_cache_size_at_miss', len(self.TOKENS))
                 if len(self.TOKENS) >= self.token_cache_size:
-                    self.stats.incr('token_cache.eviction')
+                    self.stats.incr('token_cache_eviction')
 
             try:
                 token = base64.b64decode(token)
@@ -295,25 +295,27 @@ def decrypt_token(self, username, token):
                 # Decrypt doesn't take KeyId as an argument. We need to verify
                 # the correct key was used to do the decryption.
                 # Annoyingly, the KeyId from the data is actually an arn.
-                key_arn = data['KeyId']
-                if user_type == 'service':
-                    if not self._valid_service_auth_key(key_arn):
-                        raise TokenValidationError(
-                            'Authentication error (wrong KMS key).'
-                        )
-                elif user_type == 'user':
-                    if not self._valid_user_auth_key(key_arn):
-                        raise TokenValidationError(
-                            'Authentication error (wrong KMS key).'
-                        )
-                else:
-                    raise TokenValidationError(
-                        'Authentication error. Unsupported user_type.'
-                    )
-                plaintext = data['Plaintext']
-                payload = json.loads(plaintext)
-                key_alias = self._get_key_alias_from_cache(key_arn)
-                ret = {'payload': payload, 'key_alias': key_alias}
+                if self.stats:
+                    with self.stats.timer('kms_decrypt_token_post_validation'):
+                        key_arn = data['KeyId']
+                        if user_type == 'service':
+                            if not self._valid_service_auth_key(key_arn):
+                                raise TokenValidationError(
+                                    'Authentication error (wrong KMS key).'
+                                )
+                        elif user_type == 'user':
+                            if not self._valid_user_auth_key(key_arn):
+                                raise TokenValidationError(
+                                    'Authentication error (wrong KMS key).'
+                                )
+                        else:
+                            raise TokenValidationError(
+                                'Authentication error. Unsupported user_type.'
+                            )
+                        plaintext = data['Plaintext']
+                        payload = json.loads(plaintext)
+                        key_alias = self._get_key_alias_from_cache(key_arn)
+                        ret = {'payload': payload, 'key_alias': key_alias}
             except TokenValidationError:
                 raise
             except (ConnectionError, EndpointConnectionError):
@@ -330,40 +332,42 @@ def decrypt_token(self, username, token):
                 )
         else:
             if self.stats:
-                self.stats.incr('token_cache.hit')
+                self.stats.incr('token_cache_hit')
             ret = self.TOKENS[token_key]
         now = datetime.datetime.utcnow()
-        try:
-            not_before = datetime.datetime.strptime(
-                ret['payload']['not_before'],
-                TIME_FORMAT
-            )
-            not_after = datetime.datetime.strptime(
-                ret['payload']['not_after'],
-                TIME_FORMAT
-            )
-        except Exception:
-            logging.exception(
-                'Failed to get not_before and not_after from token payload.'
-            )
-            raise TokenValidationError(
-                'Authentication error. Missing validity.'
-            )
-        delta = (not_after - not_before).seconds / 60
-        if delta > self.auth_token_max_lifetime:
-            logging.warning('Token used which exceeds max token lifetime.')
-            raise TokenValidationError(
-                'Authentication error. Token lifetime exceeded.'
-            )
-        if (now < not_before) or (now > not_after):
-            logging.warning('Invalid time validity for token.')
-            raise TokenValidationError(
-                'Authentication error. Invalid time validity for token.'
-            )
         if self.stats:
-            self.stats.incr('token_cache.set')
-            self.stats.gauge('token_cache.size_at_set', len(self.TOKENS))
-        self.TOKENS[token_key] = ret
+            with self.stats.timer('kms_decrypt_token_final_validation'):
+                try:
+                    not_before = datetime.datetime.strptime(
+                        ret['payload']['not_before'],
+                        TIME_FORMAT
+                    )
+                    not_after = datetime.datetime.strptime(
+                        ret['payload']['not_after'],
+                        TIME_FORMAT
+                    )
+                except Exception:
+                    logging.exception(
+                        'Failed to get not_before and not_after from token payload.'  # noqa: E501
+                    )
+                    raise TokenValidationError(
+                        'Authentication error. Missing validity.'
+                    )
+                delta = (not_after - not_before).seconds / 60
+                if delta > self.auth_token_max_lifetime:
+                    logging.warning('Token used which exceeds max token lifetime.')  # noqa: E501
+                    raise TokenValidationError(
+                        'Authentication error. Token lifetime exceeded.'
+                    )
+                if (now < not_before) or (now > not_after):
+                    logging.warning('Invalid time validity for token.')
+                    raise TokenValidationError(
+                        'Authentication error. Invalid time validity for token.'
+                    )
+                if self.stats:
+                    self.stats.incr('token_cache_set')
+                    self.stats.gauge('token_cache_size_at_set', len(self.TOKENS))  # noqa: E501
+                self.TOKENS[token_key] = ret
         return self.TOKENS[token_key]
 
 

setup.py

@@ -13,7 +13,7 @@
 
 from setuptools import setup, find_packages
 
-VERSION = "0.6.3"
+VERSION = "0.6.4.dev1"
 
 requirements = [
     # Boto3 is the Amazon Web Services (AWS) Software Development Kit (SDK)