From 41d490ea80522e95c1d52cb5d2695f223c6fac02 Mon Sep 17 00:00:00 2001 From: Danielle McLean Date: Thu, 2 Nov 2017 16:16:04 +1100 Subject: [PATCH] Put the shortcuts for returning 40* responses into lemoncurry.utils --- lemonauth/views/indie.py | 39 ++++++++++++++------------------------- lemoncurry/utils.py | 9 +++++++++ 2 files changed, 23 insertions(+), 25 deletions(-) diff --git a/lemonauth/views/indie.py b/lemonauth/views/indie.py index 30c26a3..bdeacd0 100644 --- a/lemonauth/views/indie.py +++ b/lemonauth/views/indie.py @@ -2,7 +2,6 @@ import mf2py from annoying.decorators import render_to from django.contrib.auth.decorators import login_required -from django.http import HttpResponseForbidden, HttpResponseBadRequest from django.http import JsonResponse from django.shortcuts import redirect from django.utils.decorators import method_decorator @@ -17,14 +16,6 @@ from ..models import IndieAuthCode breadcrumbs.add('lemonauth:indie', label='indieauth', parent='home:index') -def bad_req(message): - return HttpResponseBadRequest(message, content_type='text/plain') - - -def forbid(message): - return HttpResponseForbidden(message, content_type='text/plain') - - def canonical(url): (scheme, loc, path, params, q, fragment) = urlparse(url) if not path: @@ -49,32 +40,28 @@ class IndieView(TemplateView): for param in self.required_params: if param not in params: - return HttpResponseBadRequest( - 'parameter {0} is required'.format(param), - content_type='text/plain', + return utils.bad_req( + 'parameter {0} is required'.format(param) ) me = canonical(params['me']) user = urljoin(utils.origin(request), request.user.url) if user != me: - return HttpResponseForbidden( - 'you are logged in but not as {0}'.format(me), - content_type='text/plain', + return utils.forbid( + 'you are logged in but not as {0}'.format(me) ) type = params['response_type'] if type not in ('id', 'code'): - return HttpResponseBadRequest( - 'unknown response_type: {0}'.format(type), - content_type='text/plain' + return utils.bad_req( + 'unknown response_type: {0}'.format(type) ) scopes = () if type == 'code': if 'scope' not in params: - return HttpResponseBadRequest( - 'scopes required for code type', - content_type='text/plain', + return utils.bad_req( + 'scopes required for code type' ) scopes = params['scope'].split(' ') @@ -103,7 +90,7 @@ class IndieView(TemplateView): try: code = IndieAuthCode.objects.get(code=post.get('code')) except IndieAuthCode.DoesNotExist: - return forbid('invalid auth code') + return utils.forbid('invalid auth code') # We always delete the code immediately to ensure it's only single-use. # If you pass the right code but the wrong other info, bad luck, you @@ -113,11 +100,13 @@ class IndieView(TemplateView): # After deleting the code from the DB, we verify the other parameters # of the request. if code.response_type != 'id': - return bad_req('this endpoint only supports response_type=id') + return utils.bad_req( + 'this endpoint only supports response_type=id' + ) if post.get('client_id') != code.client_id: - return forbid('client id did not match') + return utils.forbid('client id did not match') if post.get('redirect_uri') != code.redirect_uri: - return forbid('redirect uri did not match') + return utils.forbid('redirect uri did not match') # If we got here, it's valid! Yay! return utils.choose_type(request, {'me': code.me}, { diff --git a/lemoncurry/utils.py b/lemoncurry/utils.py index 6ce735a..db222d8 100644 --- a/lemoncurry/utils.py +++ b/lemoncurry/utils.py @@ -2,6 +2,7 @@ import json from accept_types import get_best_match from django.conf import settings from django.http import HttpResponse +from django.http import HttpResponseForbidden, HttpResponseBadRequest from os.path import join from shorturls import default_converter as converter from shorturls.templatetags.shorturl import ShortURL @@ -48,3 +49,11 @@ def shortlink(obj): if hasattr(settings, 'SHORT_BASE_URL') and settings.SHORT_BASE_URL: return urljoin(settings.SHORT_BASE_URL, prefix + tinyid) return '/' + prefix + tinyid + + +def bad_req(message): + return HttpResponseBadRequest(message, content_type='text/plain') + + +def forbid(message): + return HttpResponseForbidden(message, content_type='text/plain')