From 94bd3ccb1c7f614fac373e3241fa323beee2d349 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Wed, 26 Feb 2020 17:24:07 +0800
Subject: [PATCH] bugfix

---
 ahserver/auth_api.py | 58 ++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 53 insertions(+), 5 deletions(-)

diff --git a/ahserver/auth_api.py b/ahserver/auth_api.py
index 18be00f..bb0a59a 100644
--- a/ahserver/auth_api.py
+++ b/ahserver/auth_api.py
@@ -6,7 +6,22 @@ import aiohttp_session
 from aiohttp_session import get_session, session_middleware
 from aiohttp_session.cookie_storage import EncryptedCookieStorage
 
+from appPublic.jsonConfig import getConfig
+from appPublic.rsa import RSA
 class AuthAPI:
+
+	def getPrivateKey(self):
+		if not hasattr(self,'rsaEngine'):
+			self.rsaEngine = RSA()
+			self.conf = getConfig()
+			fname = self.conf.website.rsakey.privatekey
+			self.privatekey = self.rsaEngine.read_privatekey(fname)
+		return self.privatekey
+
+	def rsaDecode(self,cdata):
+		self.getPrivateKey()
+		return self.rsaEngine.decode(self.privatekey,cdata)
+
 	def setupAuth(self,app):
 		# setup session middleware in aiohttp fashion
 		storage = EncryptedCookieStorage(urandom(32))
@@ -21,7 +36,7 @@ class AuthAPI:
 		# setup aiohttp_auth.auth middleware in aiohttp fashion
 		auth.setup(app, policy)
 		app.middlewares.append(self.checkAuth)
-		app.router.add_route('POST','/login',self.login)
+		# app.router.add_route('POST','/login',self.login)
 		app.router.add_route('GET', '/logout', self.logout)
 
 	async def login(self,request):
@@ -29,14 +44,45 @@ class AuthAPI:
 		user_id = params.get('user',None)
 		password = params.get('password',None)
 		from_path = params.get('from_path',None)
-		if self.checkUserPassword(user_id,password):
+		if await self.checkUserPassword(user_id,password):
 			await auth.remember(request, user)
 			return web.HpptFound(from_path)
 		raise web.HTTPUnauthorized()
 
+	async def checkLogin(self,request):
+		"""
+		authorization header has the format:
+		login_method:user_id:auth_code
+		"""
+		authinfo = request.headers.get('authorization')
+		if authinfo is None:
+			print('header not include "authorization" info', request.headers)
+			raise web.HTTPUnauthorized()
+			
+		authdata = self.rsaDecode(authinfo)
+		# print('authdata=',authdata)
+		alist = authdata.split('::')
+		if len(alist) != 3:
+			print('auth data format error')
+			raise web.HTTPUnauthorized()
+
+		login_method=alist[0]
+		user_id = alist[1]
+		password = alist[2]
+		if login_method == 'password':
+			if await self.checkUserPassword(user_id,password):
+				await auth.remember(request,user_id)
+				print('auth success,',user_id, password)
+				return user_id
+			print('auth failed')
+			raise web.HTTPUnauthorized()
+		else:
+			print('auth method unrecognized------------------------')
+			raise web.HTTPUnauthorized()
+
 	async def logout(self,request):
 		await auth.forget(request)
-		return web.REsponse(body='OK'.encode('utf-8'))
+		return web.Response(body='OK'.encode('utf-8'))
 
 	@web.middleware
 	async def checkAuth(self,request,handler):
@@ -46,8 +92,10 @@ class AuthAPI:
 			return await handler(request)
 		user = await auth.get_auth(request)
 		if user is None:
-			raise web.HTTPFound(f'/login_form?from_path={path}')
-		user_perms = await self.getUserPermission(user)
+			print('-----------auth.get_auth() return None--------------')
+			user = await self.checkLogin(request)
+			#raise web.HTTPFound(f'/login_form?from_path={path}')
+		user_perms = await self.getUserPermissions(user)
 		need_perm = await self.getPermissionNeed(path)
 		if need_perm in user_perms:
 			return await handler(request)