ahserver_g/ahserver/auth_api.py

75 lines
2.3 KiB
Python
Raw Normal View History

2019-07-10 17:34:45 +08:00
from aiohttp_auth import auth
from os import urandom
from aiohttp import web
import aiohttp_session
2023-04-05 23:28:17 +08:00
import base64
2019-07-10 17:34:45 +08:00
from aiohttp_session import get_session, session_middleware
from aiohttp_session.cookie_storage import EncryptedCookieStorage
2020-02-26 17:24:07 +08:00
from appPublic.jsonConfig import getConfig
2022-09-27 14:03:16 +08:00
from appPublic.rsawrap import RSA
2022-06-23 14:58:03 +08:00
from appPublic.app_logger import AppLogger
class AuthAPI(AppLogger):
def __init__(self):
super().__init__()
2023-06-12 14:05:23 +08:00
self.conf = getConfig()
2020-02-26 17:24:07 +08:00
def getPrivateKey(self):
if not hasattr(self,'rsaEngine'):
self.rsaEngine = RSA()
fname = self.conf.website.rsakey.privatekey
self.privatekey = self.rsaEngine.read_privatekey(fname)
return self.privatekey
def rsaDecode(self,cdata):
self.getPrivateKey()
return self.rsaEngine.decode(self.privatekey,cdata)
2019-07-10 17:34:45 +08:00
def setupAuth(self,app):
# setup session middleware in aiohttp fashion
storage = EncryptedCookieStorage(urandom(32))
aiohttp_session.setup(app, storage)
# Create an auth ticket mechanism that expires after 1 minute (60
# seconds), and has a randomly generated secret. Also includes the
# optional inclusion of the users IP address in the hash
2023-06-12 14:05:23 +08:00
session_max_time = 120
session_reissue_time = 30
if self.conf.website.session_max_time:
session_max_time = self.conf.website.session_max_time
if self.conf.website.session_reissue_time:
session_reissue_time = self.conf.website.session_reissue_time
policy = auth.SessionTktAuthentication(urandom(32), session_max_time,
reissue_time=30,
2019-07-10 17:34:45 +08:00
include_ip=True)
# setup aiohttp_auth.auth middleware in aiohttp fashion
2023-04-06 16:20:19 +08:00
# print('policy = ', policy)
2019-07-10 17:34:45 +08:00
auth.setup(app, policy)
app.middlewares.append(self.checkAuth)
app.router.add_route('GET', '/logout', self.logout)
async def logout(self,request):
await auth.forget(request)
2020-02-26 17:24:07 +08:00
return web.Response(body='OK'.encode('utf-8'))
2019-07-10 17:34:45 +08:00
@web.middleware
async def checkAuth(self,request,handler):
path = request.path
user = await auth.get_auth(request)
2023-04-04 10:34:02 +08:00
is_ok = await self.checkUserPermission(user, path)
if is_ok:
2023-06-12 14:49:28 +08:00
print(f'**{user=}, {path} access **')
2019-07-10 17:34:45 +08:00
return await handler(request)
2023-06-12 14:39:01 +08:00
print(f'**{user=}, {path} forbidden**')
2019-07-10 17:34:45 +08:00
raise web.HTTPForbidden()
2023-06-12 11:05:27 +08:00
async def checkUserPermission(self, user, path):
2023-06-12 10:38:00 +08:00
return True
2019-07-10 17:34:45 +08:00
async def needAuth(self,path):
return False