Produits Entr'ouvert » Fargo

# fargo - document box

# Copyright (C) 2016-2017  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.utils.translation import ugettext_lazy as _

from rest_framework.authentication import BasicAuthentication

from rest_framework.exceptions import AuthenticationFailed

from .models import OAuth2Client

class OAuth2User(object):

    """ Fake user class to return in case OAuth2 Client authentication

    """

    def __init__(self, oauth2_client):

        self.oauth2_client = oauth2_client

        self.authenticated = False

    def has_perm(self, *args, **kwargs):

        return True

    def has_perm_any(self, *args, **kwargs):

        return True

    def has_ou_perm(self, *args, **kwargs):

        return True

    def filter_by_perm(self, perms, queryset):

        return queryset

    def is_authenticated(self):

        return self.authenticated

    def is_staff(self):

        return False

class FargoOAUTH2Authentication(BasicAuthentication):

    def authenticate_credentials(self, client_id, client_secret):

        try:

            client = OAuth2Client.objects.get(

                client_id=client_id, client_secret=client_secret)

        except OAuth2Client.DoesNotExist:

            raise AuthenticationFailed(_('Invalid client_id/client_secret.'))

        user = OAuth2User(client)

        user.authenticated = True

        return user, True

from .models import OAuth2Authorize

                         HttpResponseRedirect)

from rest_framework.response import Response

from rest_framework.views import APIView

from .authentication import FargoOAUTH2Authentication

from .utils import authenticate_bearer, get_content_disposition_value

class OAUTH2APIViewMixin(APIView):

    http_method_names = ['post']

    authentication_classes = (FargoOAUTH2Authentication,)

    @csrf_exempt

    def dispatch(self, request, *args, **kwargs):

        return super(OAUTH2APIViewMixin, self).dispatch(request, *args, **kwargs)

class GetDocumentTokenView(OAUTH2APIViewMixin):

    def post(self, request, *args, **kwargs):

        client = request.user.oauth2_client

        data = request.data

        if not client.check_redirect_uri(data['redirect_uri']):

            return Response({'error': 'invalid_request'}, status=400)

        if data['grant_type'] != 'authorization_code':

            return Response({'error': 'unsopported_grant_type'}, status=400)

        try:

            token = OAuth2Authorize.objects.get(code=data['code']).access_token

        except OAuth2Authorize.DoesNotExist:

            return Response({'error': 'invalid_request'}, status=400)

        return Response({'access_token': token, 'expires': '3600'})

get_document_token = GetDocumentTokenView.as_view()

class PutDocumentAPIView(OAUTH2APIViewMixin):

    def post(self, request, *args, **kwargs):

        filename, error = get_content_disposition_value(request)

        if error:

            return HttpResponseBadRequest(error)

        f = ContentFile(request.body, name=filename)

        document = Document.objects.get_by_file(f)

        oauth2_document = OAuth2TempFile.objects.create(document=document,

                                                        filename=filename)

        uri = reverse('oauth2-put-document-authorize',

                      args=[oauth2_document.pk]) + '/'

        response = Response()

        response['Location'] = uri

        return response

put_document = PutDocumentAPIView.as_view()

    app.authorization = ('Basic', (oauth2_client.client_id, oauth2_client.client_secret))

    resp = app.post(url, params=data, status=401)