lemoncurry/lemonauth/views/indie.py

126 lines
4.2 KiB
Python
Raw Normal View History

from annoying.decorators import render_to
from django.contrib.auth.decorators import login_required
from django.http import JsonResponse
from django.shortcuts import redirect
from django.utils.decorators import method_decorator
from django.views.generic import TemplateView
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_POST
from lemoncurry import breadcrumbs, requests, utils
from urllib.parse import urlencode, urljoin, urlunparse, urlparse
from .. import tokens
from ..models import IndieAuthCode
2023-08-10 02:52:37 -04:00
breadcrumbs.add("lemonauth:indie", parent="home:index")
def canonical(url):
2023-08-10 02:52:37 -04:00
if "//" not in url:
url = "//" + url
(scheme, netloc, path, params, query, fragment) = urlparse(url)
2023-08-10 02:52:37 -04:00
if not scheme or scheme == "http":
scheme = "https"
if not path:
2023-08-10 02:52:37 -04:00
path = "/"
return urlunparse((scheme, netloc, path, params, query, fragment))
2023-08-10 02:52:37 -04:00
@method_decorator(csrf_exempt, name="dispatch")
class IndieView(TemplateView):
2023-08-10 02:52:37 -04:00
template_name = "lemonauth/indie.html"
required_params = ("client_id", "redirect_uri")
@method_decorator(login_required)
@method_decorator(render_to(template_name))
def get(self, request):
params = request.GET.dict()
2023-08-10 02:52:37 -04:00
params.setdefault("response_type", "id")
for param in self.required_params:
if param not in params:
2023-08-10 02:52:37 -04:00
return utils.bad_req("parameter {0} is required".format(param))
me = request.user.full_url
2023-08-10 02:52:37 -04:00
if "me" in params:
param_me = canonical(params["me"])
if me != param_me:
return utils.forbid(
2023-08-10 02:52:37 -04:00
"you are logged in as {}, not as {}".format(me, param_me)
)
2023-08-10 02:52:37 -04:00
redirect_uri = urljoin(params["client_id"], params["redirect_uri"])
2023-08-10 02:52:37 -04:00
type = params["response_type"]
if type not in ("id", "code"):
return utils.bad_req("unknown response_type: {0}".format(type))
scopes = ()
2023-08-10 02:52:37 -04:00
if type == "code":
if "scope" not in params:
return utils.bad_req("scopes required for code type")
scopes = params["scope"].split(" ")
2023-08-10 02:52:37 -04:00
client = requests.mf2(params["client_id"])
rels = client.to_dict()["rel-urls"].get(redirect_uri, {}).get("rels", ())
verified = "redirect_uri" in rels
try:
2023-08-10 02:52:37 -04:00
app = client.to_dict(filter_by_type="h-x-app")[0]["properties"]
except IndexError:
app = None
return {
2023-08-10 02:52:37 -04:00
"app": app,
"me": me,
"redirect_uri": redirect_uri,
"verified": verified,
"params": params,
"scopes": scopes,
"title": "indieauth from {client_id}".format(**params),
}
def post(self, request):
post = request.POST.dict()
try:
2023-08-10 02:52:37 -04:00
code = IndieAuthCode.objects.get(pk=post.get("code"))
except IndieAuthCode.DoesNotExist:
# if anything at all goes wrong when decoding the auth code, bail
# out immediately.
2023-08-10 02:52:37 -04:00
return utils.forbid("invalid auth code")
code.delete()
if code.expired:
2023-08-10 02:52:37 -04:00
return utils.forbid("invalid auth code")
2023-08-10 02:52:37 -04:00
if code.response_type != "id":
return utils.bad_req("this endpoint only supports response_type=id")
if code.client_id != post.get("client_id"):
return utils.forbid("client id did not match")
if code.redirect_uri != post.get("redirect_uri"):
return utils.forbid("redirect uri did not match")
# If we got here, it's valid! Yay!
2023-08-10 02:52:37 -04:00
return utils.choose_type(
request,
{"me": code.me},
{
"application/x-www-form-urlencoded": utils.form_encoded_response,
"application/json": JsonResponse,
},
)
@login_required
@require_POST
def approve(request):
params = {
2023-08-10 02:52:37 -04:00
"me": urljoin(utils.origin(request), request.user.url),
"code": tokens.gen_auth_code(request),
}
2023-08-10 02:52:37 -04:00
if "state" in request.POST:
params["state"] = request.POST["state"]
2023-08-10 02:52:37 -04:00
uri = request.POST["redirect_uri"]
sep = "&" if "?" in uri else "?"
return redirect(uri + sep + urlencode(params))