135 lines
4.2 KiB
Python
135 lines
4.2 KiB
Python
import time
|
|
|
|
from django.conf import settings
|
|
from django.http import HttpResponseRedirect, JsonResponse
|
|
from django.urls import Resolver404, resolve
|
|
|
|
try:
|
|
from django.utils.timezone import now
|
|
except Exception: # pragma: no cover
|
|
from datetime import datetime
|
|
|
|
def now():
|
|
return datetime.now()
|
|
|
|
|
|
class TimingMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
request._start_time = time.time()
|
|
response = self.get_response(request)
|
|
return response
|
|
|
|
|
|
def _is_whitelisted(request):
|
|
"""Check whether the resolved view is marked with @gate_whitelist."""
|
|
try:
|
|
resolver_match = resolve(request.path_info)
|
|
except Resolver404:
|
|
return False
|
|
func = resolver_match.func
|
|
if getattr(func, '__gate_whitelist__', False):
|
|
return True
|
|
view_class = getattr(func, 'view_class', None)
|
|
if view_class and getattr(view_class, '__gate_whitelist__', False):
|
|
return True
|
|
return False
|
|
|
|
|
|
def _is_token_request(request):
|
|
"""Token is honoured only for non-browser download/API requests."""
|
|
path = request.path_info
|
|
if path.startswith('/api/') or path.startswith('/media/'):
|
|
return True
|
|
accept = request.META.get('HTTP_ACCEPT', '')
|
|
if 'application/json' in accept:
|
|
return True
|
|
if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
|
|
return True
|
|
return False
|
|
|
|
|
|
def _is_api_request(request):
|
|
"""Requests that must 401 (never redirect to an HTML page)."""
|
|
path = request.path_info
|
|
if path.startswith('/api/') or path.startswith('/media/'):
|
|
return True
|
|
accept = request.META.get('HTTP_ACCEPT', '')
|
|
if 'application/json' in accept:
|
|
return True
|
|
if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
|
|
return True
|
|
return False
|
|
|
|
|
|
def _get_bearer_token(request):
|
|
auth = request.headers.get('Authorization', '')
|
|
if auth.lower().startswith('bearer '):
|
|
return auth.split(' ', 1)[1].strip()
|
|
explicit = request.headers.get('X-Auth-Token')
|
|
return explicit or None
|
|
|
|
|
|
def _authenticate_token(request, token):
|
|
import hmac
|
|
|
|
from django.utils import timezone
|
|
|
|
from profiles.models import ApiToken
|
|
|
|
if not token:
|
|
return False
|
|
prefix = token[:8]
|
|
# Matches on the prefix keyed index, then constant-time compares.
|
|
for candidate in ApiToken.objects.filter(key_prefix=prefix):
|
|
if hmac.compare_digest(candidate.token or '', token):
|
|
candidate.last_used = timezone.now()
|
|
candidate.save(update_fields=['last_used'])
|
|
setattr(request, 'user', candidate.user)
|
|
setattr(request, '_cached_user', candidate.user)
|
|
return True
|
|
return False
|
|
|
|
|
|
def gate_whitelist(view_func):
|
|
"""Mark a view as public (bypasses the gate)."""
|
|
view_func.__gate_whitelist__ = True
|
|
return view_func
|
|
|
|
|
|
class GateMiddleware:
|
|
"""Gate every request behind the master-password session or an API token.
|
|
|
|
Public views must be decorated with @gate_whitelist.
|
|
"""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
# Public static assets must load on the gate page itself.
|
|
if request.path_info.startswith(settings.STATIC_URL):
|
|
return self.get_response(request)
|
|
|
|
# @gate_whitelist views (gate page + its POST) pass through.
|
|
if _is_whitelisted(request):
|
|
return self.get_response(request)
|
|
|
|
# API/media requests are allowed a bearer token to bypass the gate
|
|
# (non-browser downloaders such as the Fabric mod).
|
|
if _is_token_request(request):
|
|
token = _get_bearer_token(request)
|
|
if _authenticate_token(request, token):
|
|
return self.get_response(request)
|
|
# fall through: reject with 401 for API/media.
|
|
|
|
# Browser session authorized by the master password.
|
|
if request.session.get('authorized'):
|
|
return self.get_response(request)
|
|
|
|
# Unauthorized: reject.
|
|
if _is_api_request(request):
|
|
return JsonResponse({'detail': 'Unauthorized'}, status=401)
|
|
return HttpResponseRedirect(settings.GATE_URL) |