From 94bd3ccb1c7f614fac373e3241fa323beee2d349 Mon Sep 17 00:00:00 2001 From: yumoqing Date: Wed, 26 Feb 2020 17:24:07 +0800 Subject: [PATCH] bugfix --- ahserver/auth_api.py | 58 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 53 insertions(+), 5 deletions(-) diff --git a/ahserver/auth_api.py b/ahserver/auth_api.py index 18be00f..bb0a59a 100644 --- a/ahserver/auth_api.py +++ b/ahserver/auth_api.py @@ -6,7 +6,22 @@ import aiohttp_session from aiohttp_session import get_session, session_middleware from aiohttp_session.cookie_storage import EncryptedCookieStorage +from appPublic.jsonConfig import getConfig +from appPublic.rsa import RSA class AuthAPI: + + def getPrivateKey(self): + if not hasattr(self,'rsaEngine'): + self.rsaEngine = RSA() + self.conf = getConfig() + fname = self.conf.website.rsakey.privatekey + self.privatekey = self.rsaEngine.read_privatekey(fname) + return self.privatekey + + def rsaDecode(self,cdata): + self.getPrivateKey() + return self.rsaEngine.decode(self.privatekey,cdata) + def setupAuth(self,app): # setup session middleware in aiohttp fashion storage = EncryptedCookieStorage(urandom(32)) @@ -21,7 +36,7 @@ class AuthAPI: # setup aiohttp_auth.auth middleware in aiohttp fashion auth.setup(app, policy) app.middlewares.append(self.checkAuth) - app.router.add_route('POST','/login',self.login) + # app.router.add_route('POST','/login',self.login) app.router.add_route('GET', '/logout', self.logout) async def login(self,request): @@ -29,14 +44,45 @@ class AuthAPI: user_id = params.get('user',None) password = params.get('password',None) from_path = params.get('from_path',None) - if self.checkUserPassword(user_id,password): + if await self.checkUserPassword(user_id,password): await auth.remember(request, user) return web.HpptFound(from_path) raise web.HTTPUnauthorized() + async def checkLogin(self,request): + """ + authorization header has the format: + login_method:user_id:auth_code + """ + authinfo = request.headers.get('authorization') + if authinfo is None: + print('header not include "authorization" info', request.headers) + raise web.HTTPUnauthorized() + + authdata = self.rsaDecode(authinfo) + # print('authdata=',authdata) + alist = authdata.split('::') + if len(alist) != 3: + print('auth data format error') + raise web.HTTPUnauthorized() + + login_method=alist[0] + user_id = alist[1] + password = alist[2] + if login_method == 'password': + if await self.checkUserPassword(user_id,password): + await auth.remember(request,user_id) + print('auth success,',user_id, password) + return user_id + print('auth failed') + raise web.HTTPUnauthorized() + else: + print('auth method unrecognized------------------------') + raise web.HTTPUnauthorized() + async def logout(self,request): await auth.forget(request) - return web.REsponse(body='OK'.encode('utf-8')) + return web.Response(body='OK'.encode('utf-8')) @web.middleware async def checkAuth(self,request,handler): @@ -46,8 +92,10 @@ class AuthAPI: return await handler(request) user = await auth.get_auth(request) if user is None: - raise web.HTTPFound(f'/login_form?from_path={path}') - user_perms = await self.getUserPermission(user) + print('-----------auth.get_auth() return None--------------') + user = await self.checkLogin(request) + #raise web.HTTPFound(f'/login_form?from_path={path}') + user_perms = await self.getUserPermissions(user) need_perm = await self.getPermissionNeed(path) if need_perm in user_perms: return await handler(request)