Merge pull request #54 from IcyNet/authstuff
Rewrite the user models to use Django's auth system.
This commit is contained in:
GitHub
commit
5f8d142508
|
|
@ -42,6 +42,13 @@ ALLOWED_HOSTS = []
|
|||
|
||||
# Application definition
|
||||
|
||||
AUTHENTICATION_BACKENDS = (
|
||||
'LandingPage.backends.OAuthBackend',
|
||||
'django.contrib.auth.backends.ModelBackend',
|
||||
)
|
||||
|
||||
AUTH_USER_MODEL = 'LandingPage.User'
|
||||
|
||||
INSTALLED_APPS = [
|
||||
'LandingPage.apps.LandingpageConfig',
|
||||
'Show.apps.ShowConfig',
|
||||
|
|
@ -65,6 +72,7 @@ MIDDLEWARE = [
|
|||
]
|
||||
|
||||
ROOT_URLCONF = 'EpisodesCommunity.urls'
|
||||
LOGIN_URL = '/login'
|
||||
|
||||
TEMPLATES = [
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,10 +1,18 @@
|
|||
from django.contrib import admin
|
||||
from django.contrib.auth.admin import UserAdmin
|
||||
from .models import *
|
||||
from .forms import SpecialUserChangeForm
|
||||
|
||||
class SpecialUserAdmin(UserAdmin):
|
||||
form = SpecialUserChangeForm
|
||||
|
||||
fieldsets = UserAdmin.fieldsets + (
|
||||
(None, {'fields': ('display_name',)}),
|
||||
)
|
||||
|
||||
# Register your models here.
|
||||
admin.site.register(Show)
|
||||
admin.site.register(User)
|
||||
admin.site.register(Admin)
|
||||
admin.site.register(User, SpecialUserAdmin)
|
||||
admin.site.register(Ban)
|
||||
admin.site.register(ShowModerator)
|
||||
admin.site.register(Report)
|
||||
|
|
@ -18,4 +26,3 @@ admin.site.register(Watch)
|
|||
admin.site.register(DiscussionBoard)
|
||||
admin.site.register(DiscussionReply)
|
||||
admin.site.register(DiscussionVote)
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,60 @@
|
|||
import requests
|
||||
import hashlib
|
||||
import json
|
||||
import logging
|
||||
from django.conf import settings
|
||||
from django.contrib.auth import get_user_model
|
||||
from django.contrib.auth.backends import ModelBackend
|
||||
|
||||
class OAuthBackend(ModelBackend):
|
||||
def authenticate(self, code=None):
|
||||
resp = requests.post(
|
||||
settings.AUTH_TOKEN_ENDPOINT+"token",
|
||||
data={
|
||||
'grant_type':'authorization_code',
|
||||
'code':code,
|
||||
'redirect_uri':settings.AUTH_REDIRECT_URL,
|
||||
'client_id':settings.AUTH_CLIENT_ID
|
||||
},
|
||||
headers = {
|
||||
'Authorization':'Basic %s'%settings.AUTH_B64
|
||||
}
|
||||
)
|
||||
resp_json = resp.json()
|
||||
if 'error' in resp_json:
|
||||
logging.warn('OAuth server returned an error: %s'%json.dumps(resp_json))
|
||||
else:
|
||||
user_info = requests.get(
|
||||
settings.AUTH_TOKEN_ENDPOINT+"user",
|
||||
headers = {
|
||||
'Authorization': 'Bearer ' + resp_json['access_token']
|
||||
}
|
||||
).json()
|
||||
|
||||
usermodel = get_user_model()
|
||||
matches = usermodel.objects.filter(icy_id=user_info['uuid'])
|
||||
match = None
|
||||
|
||||
if not len(matches):
|
||||
user = usermodel.objects.create_user(
|
||||
username = user_info['username'],
|
||||
email = user_info['email'],
|
||||
icy_id = user_info['uuid'],
|
||||
display_name = user_info['display_name']
|
||||
)
|
||||
|
||||
if 'privilege' in user_info:
|
||||
priv = user_info['privilege']
|
||||
user.is_superuser = (priv == 5)
|
||||
user.is_staff = (priv > 0)
|
||||
|
||||
user.save()
|
||||
|
||||
match = user
|
||||
else:
|
||||
match = matches[0]
|
||||
|
||||
match.access_token = resp_json['access_token']
|
||||
|
||||
return match
|
||||
return None
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
from django.contrib.auth.forms import UserChangeForm
|
||||
from .models import User
|
||||
|
||||
class SpecialUserChangeForm(UserChangeForm):
|
||||
class Meta(UserChangeForm.Meta):
|
||||
model = User
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
from django.db import models
|
||||
from django.contrib.auth.models import AbstractUser
|
||||
from django.core.files.storage import FileSystemStorage
|
||||
from django.conf import settings
|
||||
import os
|
||||
|
|
@ -71,14 +72,11 @@ class Show(TimestampedModel):
|
|||
def __str__(self):
|
||||
return '%s [%s]'%(self.name,self.abbr)
|
||||
|
||||
class User(TimestampedModel):
|
||||
user_id = models.CharField(
|
||||
class User(AbstractUser):
|
||||
icy_id = models.CharField(
|
||||
max_length=36,
|
||||
help_text='The UUID assigned to this user by IcyNet\'s auth servers'
|
||||
)
|
||||
email = models.EmailField(
|
||||
help_text='This user\'s email address'
|
||||
)
|
||||
display_name=models.CharField(
|
||||
max_length=20,
|
||||
help_text="The name shown to other users",
|
||||
|
|
@ -94,11 +92,6 @@ class User(TimestampedModel):
|
|||
related_name='watched_by',
|
||||
through='Watch'
|
||||
)
|
||||
def __str__(self):
|
||||
return self.email
|
||||
|
||||
class Admin(User):
|
||||
pass
|
||||
|
||||
class Ban(TimestampedModel):
|
||||
user = models.OneToOneField(
|
||||
|
|
@ -108,7 +101,7 @@ class Ban(TimestampedModel):
|
|||
verbose_name="Banned User"
|
||||
)
|
||||
admin = models.ForeignKey(
|
||||
Admin,
|
||||
User,
|
||||
on_delete=models.SET_NULL,
|
||||
null=True,
|
||||
help_text='The admin which banned this user',
|
||||
|
|
@ -286,7 +279,7 @@ class Submission(TimestampedModel):
|
|||
verbose_name='Submitted For'
|
||||
)
|
||||
user = models.ForeignKey(
|
||||
'User',
|
||||
User,
|
||||
on_delete=models.SET_NULL,
|
||||
null=True,
|
||||
related_name='submissions',
|
||||
|
|
@ -310,7 +303,7 @@ class SubmissionVote(TimestampedModel):
|
|||
help_text='What this submission was cast on'
|
||||
)
|
||||
user = models.ForeignKey(
|
||||
'User',
|
||||
User,
|
||||
on_delete=models.CASCADE,
|
||||
related_name='votes',
|
||||
help_text='The user who cast this vote'
|
||||
|
|
|
|||
|
|
@ -20,8 +20,8 @@
|
|||
<div class="unibar">
|
||||
<span class="logo">Episodes<span class="period">.</span>Community</span>
|
||||
<div class="userdata">
|
||||
{% if request.session.user_id %}
|
||||
{{ request.session.disp_name }}
|
||||
{% if user.is_authenticated %}
|
||||
{{ user.display_name }}
|
||||
{% else %}
|
||||
<a href="/login">Log in</a>
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@ from django.conf.urls import url
|
|||
from . import views
|
||||
|
||||
urlpatterns = [
|
||||
url(r'^logout/$', views.LogoutView),
|
||||
url(r'^login/redirect$', views.LoginRedirect.as_view()),
|
||||
url(r'^login$', views.Login.as_view()),
|
||||
url(r'^$', views.LandingPage.as_view()),
|
||||
|
|
|
|||
|
|
@ -1,10 +1,12 @@
|
|||
from django.shortcuts import render
|
||||
from django.views import View
|
||||
from django.views.generic.base import TemplateView
|
||||
from django.contrib.auth import login as auth_login, authenticate
|
||||
from django.conf import settings
|
||||
from django.http import HttpResponse
|
||||
from django.http import HttpResponseRedirect
|
||||
from django.db.models import Max
|
||||
from django.contrib.auth.views import logout
|
||||
import requests
|
||||
import hashlib
|
||||
import json
|
||||
|
|
@ -29,57 +31,30 @@ class LoginRedirect(View):
|
|||
userstate = generateState(req)
|
||||
if userstate == req.GET['state']:
|
||||
code = req.GET['code']
|
||||
resp = requests.post(
|
||||
settings.AUTH_TOKEN_ENDPOINT+"token",
|
||||
data={
|
||||
'grant_type':'authorization_code',
|
||||
'code':code,
|
||||
'redirect_uri':settings.AUTH_REDIRECT_URL,
|
||||
'client_id':settings.AUTH_CLIENT_ID
|
||||
},
|
||||
headers = {
|
||||
'Authorization':'Basic %s'%settings.AUTH_B64
|
||||
}
|
||||
)
|
||||
resp_json = resp.json()
|
||||
if 'error' in resp_json:
|
||||
r = HttpResponse('<h1>OAuth Error</h1><pre>%s</pre>'%json.dumps(resp_json))
|
||||
r.status = 500
|
||||
return r
|
||||
else:
|
||||
user_info = requests.get(
|
||||
settings.AUTH_TOKEN_ENDPOINT+"user",
|
||||
headers = {
|
||||
'Authorization': 'Bearer ' + resp_json['access_token']
|
||||
}
|
||||
).json()
|
||||
req.session['user_id'] = user_info['uuid']
|
||||
matches = User.objects.filter(user_id=user_info['uuid'])
|
||||
match = None
|
||||
if not len(matches):
|
||||
user = User(
|
||||
user_id = user_info['uuid'],
|
||||
email = user_info['email'],
|
||||
display_name = user_info['display_name']
|
||||
)
|
||||
user.save()
|
||||
match = user
|
||||
else:
|
||||
match = matches[0]
|
||||
req.session['token'] = resp_json['access_token']
|
||||
req.session['disp_name'] = match.display_name
|
||||
|
||||
user = authenticate(code=code)
|
||||
|
||||
if user is not None and user.is_active:
|
||||
auth_login(req, user)
|
||||
|
||||
return HttpResponseRedirect('/')
|
||||
else:
|
||||
return HttpResponse('<h1>Unmatching state tokens</h1><br><p>It looks like the request to login wasn\'t started by you. Try going back to the home page and logging in again.</p>', status=400)
|
||||
|
||||
return HttpResponse('<h1>Error</h1><br><p>It looks like something went wrong while trying to authenticate you. Please try again later.</p>', status=500)
|
||||
|
||||
return HttpResponse('<h1>Unmatching state tokens</h1><br><p>It looks like the request to login wasn\'t started by you. Try going back to the home page and logging in again.</p>', status=400)
|
||||
|
||||
class Login(View):
|
||||
def get(self, req):
|
||||
url = '%sauthorize?response_type=code&client_id=%s&redirect_uri=%s&scope=email&state=%s'%(settings.AUTH_TOKEN_ENDPOINT,settings.AUTH_CLIENT_ID,settings.AUTH_REDIRECT_URL, generateState(req))
|
||||
url = '%sauthorize?response_type=code&client_id=%s&redirect_uri=%s&scope=email privilege&state=%s'%(settings.AUTH_TOKEN_ENDPOINT,settings.AUTH_CLIENT_ID,settings.AUTH_REDIRECT_URL, generateState(req))
|
||||
response = HttpResponse("Redirecting you to the IcyNet auth page...")
|
||||
response.status_code = 302
|
||||
response['Location'] = url
|
||||
return response
|
||||
|
||||
def LogoutView(request):
|
||||
logout(request)
|
||||
return HttpResponseRedirect('/')
|
||||
|
||||
def generateState(request):
|
||||
request.session.save()
|
||||
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@
|
|||
</section>
|
||||
<section class="submissions">
|
||||
<a href="/show/{{show.abbr}}" class="button"><i class="fa fa-fw fa-home"></i> Show Index</a>
|
||||
{% if request.session.user_id %}
|
||||
{% if user.is_authenticated %}
|
||||
<a href="/show/{{show.abbr}}/episode/{{episode.season.number}}/{{episode.episode}}/submit" class="button"><i class="fa fa-fw fa-plus"></i> Submit New Link</a>
|
||||
{% else %}
|
||||
<span class="fillertext"><a href="/login">Log in</a> to submit a link</span>
|
||||
|
|
|
|||
|
|
@ -2,11 +2,13 @@ from django.template import RequestContext
|
|||
from django.shortcuts import render
|
||||
from django.views import View
|
||||
from django.views.generic.base import TemplateView
|
||||
from django.contrib.auth.decorators import login_required
|
||||
from django.conf import settings
|
||||
from django.http import Http404
|
||||
from django.http import HttpResponse
|
||||
from django.http import HttpResponseRedirect
|
||||
from django.db.models import Case, When, Value, IntegerField, Count, F
|
||||
from django.contrib.auth.mixins import LoginRequiredMixin
|
||||
|
||||
from LandingPage.models import User
|
||||
from LandingPage.models import Show
|
||||
|
|
@ -85,15 +87,11 @@ class EpisodeView(TemplateView):
|
|||
return ctx
|
||||
|
||||
# Submission form GET and POST
|
||||
@login_required
|
||||
def SubmissionForm(req, abbreviation, season, episode):
|
||||
show = Show.objects.get(abbr=abbreviation)
|
||||
episode = Episode.objects.filter(show=show,season__number=season,episode=episode).first()
|
||||
|
||||
# Check for login status
|
||||
if not 'user_id' in req.session:
|
||||
return HttpResponse('<h1>Error</h1><p>You need to be logged in to submit. Please <a href=/login>log in</a></p>', status=400)
|
||||
|
||||
user = User.objects.get(user_id=req.session['user_id'])
|
||||
user = req.user
|
||||
|
||||
# 404's
|
||||
if not show:
|
||||
|
|
@ -144,16 +142,12 @@ def SubmissionForm(req, abbreviation, season, episode):
|
|||
|
||||
# Vote request
|
||||
# /show/{{abbr}}/vote/{{submission id}}/{{positive == 1}}
|
||||
class SubmissionVoteSubmit(View):
|
||||
class SubmissionVoteSubmit(LoginRequiredMixin, View):
|
||||
def post (self, req, abbreviation, subid, positive):
|
||||
# Convert positive parameter into a boolean
|
||||
pos_bool = int(positive) == 1
|
||||
|
||||
# Check for login status
|
||||
if not 'user_id' in req.session:
|
||||
return HttpResponse('<h1>Error</h1><p>You need to be logged in to vote. Please <a href=/login>log in</a></p>', status=400)
|
||||
|
||||
user = User.objects.get(user_id=req.session['user_id'])
|
||||
user = req.user
|
||||
|
||||
# Get the submission from the database
|
||||
submission = Submission.objects.filter(id=subid).first()
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ class TestLogin(TestCase):
|
|||
# Set up responses to control network flow
|
||||
with responses.RequestsMock() as rm:
|
||||
rm.add(responses.POST,'http://icynet.test/api/token',json={'access_token':'1accesstoken1'})
|
||||
rm.add(responses.GET,'http://icynet.test/api/user',json={'uuid':'935a41b5-b38d-42c3-96ef-653402fc44ca','email':'johnsmith@gmail.com','display_name':'Mr. Smith'})
|
||||
rm.add(responses.GET,'http://icynet.test/api/user',json={'uuid':'935a41b5-b38d-42c3-96ef-653402fc44ca','email':'johnsmith@gmail.com','display_name':'Mr. Smith','username':'jsmith'})
|
||||
|
||||
# Make initial request to redirect endpoint
|
||||
client = Client()
|
||||
|
|
@ -26,7 +26,7 @@ class TestLogin(TestCase):
|
|||
self.assertEqual(query['client_id'][0],'clid')
|
||||
self.assertEqual(query['response_type'][0],'code')
|
||||
self.assertEqual(query['redirect_uri'][0],'http://redirect.test')
|
||||
self.assertEqual(query['scope'][0],'email')
|
||||
self.assertEqual(query['scope'][0],'email privilege')
|
||||
|
||||
# Make connection to the real endpoint
|
||||
resp = client.get('/login/redirect?state=%s&code=%s'%(state, 'code'))
|
||||
|
|
@ -36,14 +36,12 @@ class TestLogin(TestCase):
|
|||
users = User.objects.all()
|
||||
self.assertEqual(len(users), 1)
|
||||
user = users[0]
|
||||
self.assertEqual(user.user_id,'935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(user.icy_id,'935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(user.email,'johnsmith@gmail.com')
|
||||
self.assertEqual(user.display_name, 'Mr. Smith')
|
||||
|
||||
# Check appropriate values are in the session
|
||||
self.assertEqual(client.session['user_id'], '935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(client.session['token'],'1accesstoken1')
|
||||
self.assertEqual(client.session['disp_name'], 'Mr. Smith')
|
||||
# Check that the user has been logged in
|
||||
self.assertEqual(client.get('/').context['user'], user)
|
||||
|
||||
def test_reject_bad_state(self):
|
||||
with responses.RequestsMock() as rm:
|
||||
|
|
@ -55,10 +53,10 @@ class TestLogin(TestCase):
|
|||
# Set up responses to control network flow
|
||||
with responses.RequestsMock() as rm:
|
||||
rm.add(responses.POST,'http://icynet.test/api/token',json={'access_token':'1accesstoken1'})
|
||||
rm.add(responses.GET,'http://icynet.test/api/user',json={'uuid':'935a41b5-b38d-42c3-96ef-653402fc44ca','email':'johnsmith@gmail.com','display_name':'Mr. Smith'})
|
||||
rm.add(responses.GET,'http://icynet.test/api/user',json={'uuid':'935a41b5-b38d-42c3-96ef-653402fc44ca','email':'johnsmith@gmail.com','display_name':'Mr. Smith','username':'jsmith'})
|
||||
|
||||
# Set up the database
|
||||
user = User(user_id='935a41b5-b38d-42c3-96ef-653402fc44ca',email='johnsmith@gmail.com',display_name='Mr. Smith')
|
||||
user = User(icy_id='935a41b5-b38d-42c3-96ef-653402fc44ca',email='johnsmith@gmail.com',display_name='Mr. Smith')
|
||||
user.save()
|
||||
|
||||
# Make initial request to redirect endpoint
|
||||
|
|
@ -74,14 +72,12 @@ class TestLogin(TestCase):
|
|||
users = User.objects.all()
|
||||
self.assertEqual(len(users), 1)
|
||||
user = users[0]
|
||||
self.assertEqual(user.user_id,'935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(user.icy_id,'935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(user.email,'johnsmith@gmail.com')
|
||||
self.assertEqual(user.display_name, 'Mr. Smith')
|
||||
|
||||
# Check appropriate values are in the session
|
||||
self.assertEqual(client.session['user_id'], '935a41b5-b38d-42c3-96ef-653402fc44ca')
|
||||
self.assertEqual(client.session['token'],'1accesstoken1')
|
||||
self.assertEqual(client.session['disp_name'], 'Mr. Smith')
|
||||
# Check that the user has been logged in
|
||||
self.assertEqual(client.get('/').context['user'], user)
|
||||
|
||||
def test_states_unique(self):
|
||||
with responses.RequestsMock() as rm:
|
||||
|
|
|
|||
Reference in New Issue