Working .env setup

nonpacks/common/middleware.py

@@ -1,5 +1,18 @@
 import time
 
+from django.conf import settings
+from django.http import HttpResponseRedirect, JsonResponse
+from django.urls import Resolver404, resolve
+
+try:
+    from django.utils.timezone import now
+except Exception:  # pragma: no cover
+    from datetime import datetime
+
+    def now():
+        return datetime.now()
+
+
 class TimingMiddleware:
     def __init__(self, get_response):
         self.get_response = get_response
@@ -7,4 +20,116 @@ class TimingMiddleware:
     def __call__(self, request):
         request._start_time = time.time()
         response = self.get_response(request)
-        return response
+        return response
+
+
+def _is_whitelisted(request):
+    """Check whether the resolved view is marked with @gate_whitelist."""
+    try:
+        resolver_match = resolve(request.path_info)
+    except Resolver404:
+        return False
+    func = resolver_match.func
+    if getattr(func, '__gate_whitelist__', False):
+        return True
+    view_class = getattr(func, 'view_class', None)
+    if view_class and getattr(view_class, '__gate_whitelist__', False):
+        return True
+    return False
+
+
+def _is_token_request(request):
+    """Token is honoured only for non-browser download/API requests."""
+    path = request.path_info
+    if path.startswith('/api/') or path.startswith('/media/'):
+        return True
+    accept = request.META.get('HTTP_ACCEPT', '')
+    if 'application/json' in accept:
+        return True
+    if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+        return True
+    return False
+
+
+def _is_api_request(request):
+    """Requests that must 401 (never redirect to an HTML page)."""
+    path = request.path_info
+    if path.startswith('/api/') or path.startswith('/media/'):
+        return True
+    accept = request.META.get('HTTP_ACCEPT', '')
+    if 'application/json' in accept:
+        return True
+    if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+        return True
+    return False
+
+
+def _get_bearer_token(request):
+    auth = request.headers.get('Authorization', '')
+    if auth.lower().startswith('bearer '):
+        return auth.split(' ', 1)[1].strip()
+    explicit = request.headers.get('X-Auth-Token')
+    return explicit or None
+
+
+def _authenticate_token(request, token):
+    import hmac
+
+    from django.utils import timezone
+
+    from profiles.models import ApiToken
+
+    if not token:
+        return False
+    prefix = token[:8]
+    # Matches on the prefix keyed index, then constant-time compares.
+    for candidate in ApiToken.objects.filter(key_prefix=prefix):
+        if hmac.compare_digest(candidate.token or '', token):
+            candidate.last_used = timezone.now()
+            candidate.save(update_fields=['last_used'])
+            setattr(request, 'user', candidate.user)
+            setattr(request, '_cached_user', candidate.user)
+            return True
+    return False
+
+
+def gate_whitelist(view_func):
+    """Mark a view as public (bypasses the gate)."""
+    view_func.__gate_whitelist__ = True
+    return view_func
+
+
+class GateMiddleware:
+    """Gate every request behind the master-password session or an API token.
+
+    Public views must be decorated with @gate_whitelist.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        # Public static assets must load on the gate page itself.
+        if request.path_info.startswith(settings.STATIC_URL):
+            return self.get_response(request)
+
+        # @gate_whitelist views (gate page + its POST) pass through.
+        if _is_whitelisted(request):
+            return self.get_response(request)
+
+        # API/media requests are allowed a bearer token to bypass the gate
+        # (non-browser downloaders such as the Fabric mod).
+        if _is_token_request(request):
+            token = _get_bearer_token(request)
+            if _authenticate_token(request, token):
+                return self.get_response(request)
+            # fall through: reject with 401 for API/media.
+
+        # Browser session authorized by the master password.
+        if request.session.get('authorized'):
+            return self.get_response(request)
+
+        # Unauthorized: reject.
+        if _is_api_request(request):
+            return JsonResponse({'detail': 'Unauthorized'}, status=401)
+        return HttpResponseRedirect(settings.GATE_URL)