1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
# Copyright (C) 2018 Ivan Dolgov
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import urllib.parse
import bottle
import qvisqve
class AuthRouter(qvisqve.Router):
def __init__(self, apps, users):
super().__init__()
self._apps = apps
self._users = users
def get_routes(self):
return [
{
'method': 'POST',
'path': '/auth',
'callback': self._auth,
'needs-authorization': False,
},
]
def _auth(self, content_type, body, *args, **kwargs):
qvisqve.log.log(
'xxx', msg_text='_auth called', content_type=content_type,
body=body, args=args, kwargs=kwargs)
if content_type != 'application/x-www-form-urlencoded':
return qvisqve.bad_request_response('Wrong content type')
params = self._get_form_params(body)
username = self._get_param(params, 'username')
password = self._get_param(params, 'password')
if not self._users.is_valid_secret(username, password):
return qvisqve.unauthorized_response('Access denied')
# TODO:
# - perform actual auth
# - create and store auth code
# - use callback url provided in request
# FIXME use real app name here
callbacks = self._apps.get_callbacks('facade')
callback_url = callbacks[0]
params = urllib.parse.urlencode({'code': 123})
url = '{}?{}'.format(callback_url, params)
qvisqve.log.log('xxx', msg_text='Returning redirect', url=url)
return qvisqve.found_response('Redirect to callback url', url)
def _get_param(self, params, name):
return params[name][0]
def _get_form_params(self, body):
body = body.decode('UTF-8')
return urllib.parse.parse_qs(body)
|
