feat: Add framework for token based authentication

Author: kesara

purple/permissions.py

@@ -0,0 +1,20 @@
+# Copyright The IETF Trust 2025, All Rights Reserved
+
+from rest_framework import permissions
+
+from purple.utils import is_valid_token
+
+
+class HasApiKey(permissions.BasePermission):
+    """Permissions class that validates a token using is_valid_token
+
+    The view class must indicate the relevant endpoint by setting `api_key_endpoint`.
+    Must be used with an Authentication class that puts a token in request.auth.
+    """
+
+    def has_permission(self, request, view):
+        endpoint = getattr(view, "api_key_endpoint", None)
+        auth_token = getattr(request, "auth", None)
+        if endpoint is not None and auth_token is not None:
+            return is_valid_token(endpoint, auth_token)
+        return False

purple/tests_utils.py

@@ -0,0 +1,14 @@
+# Copyright The IETF Trust 2025, All Rights Reserve
+
+from django.test import TestCase
+from django.test.utils import override_settings
+
+from purple.utils import is_valid_token
+
+
+class UtilsTests(TestCase):
+    @override_settings(APP_API_TOKENS={"purple.api.foobar": ["valid-token"]})
+    def test_is_valid_token(self):
+        self.assertFalse(is_valid_token("purple.fake.endpoint", "valid-token"))
+        self.assertFalse(is_valid_token("purple.api.foobar", "invalid-token"))
+        self.assertTrue(is_valid_token("purple.api.foobar", "valid-token"))

purple/utils.py

@@ -0,0 +1,18 @@
+# Copyright The IETF Trust 2025, All Rights Reserved
+
+from django.conf import settings
+
+
+def is_valid_token(endpoint, token):
+    # This is where we would consider integration with vault
+    # Settings implementation for now.
+    if hasattr(settings, "APP_API_TOKENS"):
+        token_store = settings.APP_API_TOKENS
+        if endpoint in token_store:
+            endpoint_tokens = token_store[endpoint]
+            # Be sure endpoints is a list or tuple so we don't accidentally use substring matching!
+            if not isinstance(endpoint_tokens, (list, tuple)):
+                endpoint_tokens = [endpoint_tokens]
+            if token in endpoint_tokens:
+                return True
+    return False