bugfix

rbac/check_perm.py

@@ -1,9 +1,86 @@
+import time
+
+from aiohttp import BasicAuth
 from sqlor.dbpools import DBPools
 from appPublic.registerfunction import RegisterFunction
+from appPublic.rc4 import password, unpassword
+from appPublic.jsonConfig import getConfig
 from appPublic.log import debug, exception
 from ahserver.auth_api import AuthAPI
+from ahserver.serverenv import ServerEnv
+import jwt
 
-def objcheckperm(obj, userid, path):
+defualt_password_key =  "!@#$%^&*(*&^%$QWERTYUIqwertyui234567"
+
+defualt_secret_key="test1234!@#$2222354"
+def generate_token(ak):
+	tim = int(round(time.time()))
+	exp = tim + 5 * 60
+	d = {
+		'apikey':ak,
+		'exp':exp,
+		'timestamp':exp
+	}
+	return jwt.encode(
+		d,
+		defualt_secret_key,
+		algorithm="HS256",
+		headers={"alg":"HS256","sign_type":"SIGN"}
+	)
+
+def get_apikey_from_token(token):
+	try:
+		dt = jwt.decode(token, defualt_secret_key, algorithms=["HS256"])
+		t = time.time()
+		d = DictObject(**dt)
+		if t > d.exp:
+			return None
+		return d.apikey	
+	except:
+		return None
+
+
+def mypassword(passwd):
+	config = getConfig()
+	key = config.password_key or default_password_key
+	return password(passwd, key = key)
+
+def myunpassword(passwd):
+	config = getConfig()
+	key = config.password_key or default_password_key
+	return unpassword(passwd)
+
+def load_rbac():
+	env = ServerEnv()
+	env.password = mypassword
+	env.unpassword = myunpassword
+
+async def getAuthenticationUserid(sor, request):
+	auth = request.headers.get('Authentication')
+	if auth is None:
+		return None
+	if auth.startswith('Basic '):
+		auther = BasicAuth('x')
+		m = auther.decode(auth)
+		username = m.login
+		password = password(m.password)
+		sql = "select * from users where username=${username}$ and password=${password}$"
+		recs = await sor.sqlExe(sql, {'username':username,'password':password})
+		if len(recs) < 1:
+			return None
+		return recs[0].id
+		
+	if auth.startswith('Bearer '):
+		apikey = get_apikey_from_token(auth[7:])
+		if apikey is None:
+			return None
+		sql = "select * from userapp where apikey=${apikey}$"
+		recs = await sor.sqlExe(sql, {"apikey":apikey})
+		if len(recs) < 1:
+			return None
+		return recs[0].userid
+	
+async def objcheckperm(obj, userid, path, request):
 	sql = """select distinct a.*, c.userid from
 (select id, path from permission where path=${path}$ and del_flg='0') a
 right join
@@ -21,6 +98,11 @@ and c.del_flg='0'"""
 		if len(perms) == 0:
 			debug(f'{path=} not found in permission, can access')
 			return True
+		if userid is None:
+			userid = await getAPIkeyUserid(sor, request)
+		if userid is None:
+			debug(f'{userid=} is None, can not access {path=}')
+			return False
 
 		recs = await sor.sqlExe(sql, {'path':path, 'userid':userid})
 		for r in recs: