Skip to content

Polish authentication and fix bugs #125

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChrisLovering merged 6 commits into from
Dec 30, 2021
Merged

Polish authentication and fix bugs #125

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
67650b6
Check for wrong token before all other checks
Bluenix2 Aug 12, 2021
a4ec55f
Fix wrong grant types used when generating tokens
Bluenix2 Aug 12, 2021
745c06c
Touch up api_token.html template after access token introduction
Bluenix2 Aug 12, 2021
f113b9e
Correctly send enum value to HTTPException detail
Bluenix2 Aug 12, 2021
d10564c
Validate that an access token isn't used to generate a new access token
Bluenix2 Aug 12, 2021
3d1668f
Merge branch 'main' into fix-grant_type
ChrisLovering Dec 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion pixels/templates/api_token.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,14 @@
</a>
</div>
<div class="content-box">
<h2>API token:</h2>
<h2>Refresh token:</h2>
<div id="token-div" onclick="copyToClipboard()">
<input type="text" id="api-token" value="{{ token }}" readonly>
<button id="token-button"><span>Copy</span></button>
</div>
<br />
<p>You're not done quite yet! You need to turn this into an access token before making requests to the API.</p>
<p>Refer to the documentation for how to do this.</p>
<div style="height: 25px"></div>
</div>
</div>
Expand Down
12 changes: 8 additions & 4 deletions pixels/utils/auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,11 +39,12 @@ async def __call__(self, request: Request):

# Handle bad scenarios

if token_data["grant_type"] != "access_token":
raise HTTPException(status_code=403, detail=AuthState.WRONG_TOKEN.value)

expired = int(token_data["expiration"]) < datetime.now(timezone.utc).timestamp()
if user_state is None or user_state["key_salt"] != token_data["salt"] or expired:
raise HTTPException(status_code=403, detail=AuthState.INVALID_TOKEN.value)
elif token_data["grant_type"] != "refresh_token":
raise HTTPException(status_code=403, detail=AuthState.WRONG_TOKEN)
elif user_state["is_banned"]:
raise HTTPException(status_code=403, detail=AuthState.BANNED.value)
elif self.is_mod_endpoint and not user_state["is_mod"]:
Expand Down Expand Up @@ -78,7 +79,7 @@ async def reset_user_token(conn: Connection, user_id: str) -> str:
return jwt.encode(
{
"id": user_id,
"grant_type": "authorization_code",
"grant_type": "refresh_token",
"salt": token_salt
},
Server.JWT_SECRET,
Expand All @@ -98,6 +99,9 @@ async def generate_access_token(conn: Connection, refresh_token: str) -> str:
except JWTError:
raise HTTPException(status_code=403, detail=AuthState.INVALID_TOKEN.value)

if token_data["grant_type"] != "refresh_token":
raise HTTPException(status_code=403, detail=AuthState.WRONG_TOKEN.value)

is_banned, key_salt = await conn.fetchrow(
"SELECT is_banned, key_salt FROM users WHERE user_id = $1", int(token_data["id"])
)
Expand All @@ -110,7 +114,7 @@ async def generate_access_token(conn: Connection, refresh_token: str) -> str:
return jwt.encode(
{
"id": token_data["id"],
"grant_type": "refresh_token",
"grant_type": "access_token",
"expiration": expiration.timestamp(),
"salt": key_salt
},
Expand Down