BenLubar/lemoncurry
1
0
Fork 0
forked from 00dani/lemoncurry
Code Issues Pull requests Releases Wiki Activity

Add the current user's ID to the auth code, will be handy when making a token since we need to know who the token's for

Browse source
This commit is contained in:
Danielle McLean 2017-11-03 15:51:27 +11:00
parent 40810d6310
commit 43a56e865e
Signed by untrusted user: 00dani
GPG key ID: 5A5D2D1AFF12EEC5
2 changed files with 7 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lemonauth/tokens.py
View file

@ -12,14 +12,16 @@ def decode(token):
return jwt.decode(token, settings.SECRET_KEY, algorithms=('HS256',)) return jwt.decode(token, settings.SECRET_KEY, algorithms=('HS256',))
def gen_auth_code(post): def gen_auth_code(req):
post = req.POST
params = {'me': post['me']} params = {'me': post['me']}
if 'state' in post: if 'state' in post:
params['state'] = post['state'] params['state'] = post['state']
code = { code = {
'me': post['me'], 'me': post['me'],
'id': post['client_id'], 'uid': req.user.id,
'cid': post['client_id'],
'uri': post['redirect_uri'], 'uri': post['redirect_uri'],
'typ': post.get('response_type', 'id'), 'typ': post.get('response_type', 'id'),
'iat': datetime.utcnow(), 'iat': datetime.utcnow(),
@ -29,7 +31,7 @@ def gen_auth_code(post):
code['sco'] = ' '.join(post.getlist('scope')) code['sco'] = ' '.join(post.getlist('scope'))
params['code'] = encode(code) params['code'] = encode(code)
return params return (post['redirect_uri'], params)
def verify_auth_code(c): def verify_auth_code(c):

7
lemonauth/views/indie.py
View file

@ -101,7 +101,7 @@ class IndieView(TemplateView):
return utils.bad_req( return utils.bad_req(
'this endpoint only supports response_type=id' 'this endpoint only supports response_type=id'
) )
if code['id'] != post.get('client_id'): if code['cid'] != post.get('client_id'):
return utils.forbid('client id did not match') return utils.forbid('client id did not match')
if code['uri'] != post.get('redirect_uri'): if code['uri'] != post.get('redirect_uri'):
return utils.forbid('redirect uri did not match') return utils.forbid('redirect uri did not match')
@ -116,9 +116,6 @@ class IndieView(TemplateView):
@login_required @login_required
@require_POST @require_POST
def approve(request): def approve(request):
post = request.POST uri, params = tokens.gen_auth_code(request)
params = tokens.gen_auth_code(post)
uri = post['redirect_uri']
sep = '&' if '?' in uri else '?' sep = '&' if '?' in uri else '?'
return redirect(uri + sep + urlencode(params)) return redirect(uri + sep + urlencode(params))