diff --git a/json/userapp.json b/json/userapp.json index 4803a81..a2da0c7 100644 --- a/json/userapp.json +++ b/json/userapp.json @@ -6,7 +6,7 @@ "sortby":"appname", "browserfields": { "exclouded": ["id", "userid"], - "cwidth": {} + "alters": {} }, "editexclouded": [ "id", "userid" diff --git a/models/userapp.xlsx b/models/userapp.xlsx index f20392e..c03a1bb 100644 Binary files a/models/userapp.xlsx and b/models/userapp.xlsx differ diff --git a/rbac/check_perm.py b/rbac/check_perm.py index 1978369..f4d899c 100644 --- a/rbac/check_perm.py +++ b/rbac/check_perm.py @@ -7,6 +7,7 @@ from appPublic.rc4 import password, unpassword from appPublic.jsonConfig import getConfig from appPublic.log import debug, exception from appPublic.dictObject import DictObject +from appPublic.timeUtils import curDateString from appPublic.uniqueID import getID from ahserver.auth_api import AuthAPI, user_login from ahserver.globalEnv import password_encode @@ -137,30 +138,34 @@ async def checkUserPassword(request, username, password): return True return False +async def basic_auth(sor, auth): + auther = BasicAuth('x') + m = auther.decode(auth) + username = m.login + password = password_encode(m.password) + sql = "select * from users where username=${username}$ and password=${password}$" + recs = await sor.sqlExe(sql, {'username':username,'password':password}) + if len(recs) < 1: + return None + return recs[0].id + +async def bearer_auth(sor, auth): + # apikey = get_apikey_from_token(auth[7:]) + apikey = auth[7:] + if apikey is None: + return None + sql = "select * from userapp where apikey=${apikey}$ and expired_date > ${today}$" + recs = await sor.sqlExe(sql, {"apikey":apikey, 'today': curDateString()}) + if len(recs) < 1: + return None + return recs[0].userid + async def getAuthenticationUserid(sor, request): auth = request.headers.get('Authentication') - if auth is None: - return None - if auth.startswith('Basic '): - auther = BasicAuth('x') - m = auther.decode(auth) - username = m.login - password = password_encode(m.password) - sql = "select * from users where username=${username}$ and password=${password}$" - recs = await sor.sqlExe(sql, {'username':username,'password':password}) - if len(recs) < 1: - return None - return recs[0].id - - if auth.startswith('Bearer '): - apikey = get_apikey_from_token(auth[7:]) - if apikey is None: - return None - sql = "select * from userapp where apikey=${apikey}$" - recs = await sor.sqlExe(sql, {"apikey":apikey}) - if len(recs) < 1: - return None - return recs[0].userid + for h,f in registered_auth_methods.items(): + if auth.startswith(h): + return await f(auth) + return None async def objcheckperm(obj, request, userid, path): debug(f'check permission: {userid=}, {path=}') @@ -175,12 +180,12 @@ where c.userid = ${userid}$ dbname = await get_dbname() db = DBPools() async with db.sqlorContext(dbname) as sor: + if userid is None: + userid = await getAuthenticationUserid(sor, request) perms = await sor.R('permission', {'path':path}) if len(perms) == 0: debug(f'{path=} not found in permission, can access') return True - if userid is None: - userid = await getAuthenticationUserid(sor, request) if userid is None: debug(f'{userid=} is None, can not access {path=}') return False @@ -196,3 +201,10 @@ where c.userid = ${userid}$ debug(f'error happened {userid}, {path}') return False +registered_auth_methods = { + "Basic ": basic_auth, + "Bearer ": bearer_auth +} +register_auth_method(heading, func): + registered_auth_methods[heading] = func + diff --git a/rbac/init.py b/rbac/init.py index 804c782..383ec85 100644 --- a/rbac/init.py +++ b/rbac/init.py @@ -1,6 +1,6 @@ from ahserver.auth_api import AuthAPI from ahserver.serverenv import ServerEnv -from rbac.check_perm import objcheckperm, get_user_roles, checkUserPassword, register_user +from rbac.check_perm import objcheckperm, get_user_roles, checkUserPassword, register_user, register_auth_method from rbac.set_role_perms import set_role_perm, set_role_perms def load_rbac(): @@ -11,4 +11,5 @@ def load_rbac(): env.register_user = register_user env.set_role_perm = set_role_perm env.set_role_perms = set_role_perms + env.register_auth_method = register_auth_method