lemoncurry/lemonauth/views/token.py

from django.views import View
from django.utils.decorators import method_decorator
from django.views.decorators.csrf import csrf_exempt

from .. import tokens
from ..models import IndieAuthCode
from lemoncurry import utils


@method_decorator(csrf_exempt, name='dispatch')
class TokenView(View):
    def get(self, req):
        token = tokens.auth(req)
        res = {
            'me': token.me,
            'client_id': token.client_id,
            'scope': token.scope,
        }
        return utils.choose_type(req, res)

    def post(self, req):
        post = req.POST
        try:
            code = IndieAuthCode.objects.get(pk=post.get('code'))
        except IndieAuthCode.DoesNotExist:
            return utils.forbid('invalid auth code')
        code.delete()
        if code.expired:
            return utils.forbid('invalid auth code')

        if code.response_type != 'code':
            return utils.bad_req(
                'this endpoint only supports response_type=code'
            )
        if 'client_id' in post and code.client_id != post['client_id']:
            return utils.forbid('client id did not match')
        if code.redirect_uri != post.get('redirect_uri'):
            return utils.forbid('redirect uri did not match')

        if 'me' in post and code.me != post['me']:
            return utils.forbid('me did not match')

        return utils.choose_type(req, {
            'access_token': tokens.gen_token(code),
            'me': code.me,
            'scope': code.scope,
        })