Merge lp:~canonical-isd-hackers/canonical-identity-provider/web_api-authentications into lp:~canonical-isd-hackers/canonical-identity-provider/web_api

[David Owen]

=== modified file 'doctests/stories/api-authentications.txt'
--- doctests/stories/api-authentications.txt	2011-01-24 18:28:24 +0000
+++ doctests/stories/api-authentications.txt	2011-02-02 20:13:30 +0000
@@ -120,19 +120,19 @@
     >>> api.authentications.list_tokens(consumer_key='myopenid')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
     >>> api.authentications.invalidate_token(consumer_key='myopenid',
     ...     token='mytoken')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
     >>> api.authentications.validate_token(consumer_key='myopenid',
     ...     token='mytoken')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...
 
 Test When OAuth Auth Credentials For Normal Users Are Supplied
@@ -218,5 +218,5 @@
     >>> api.authentications.authenticate(token_name='this-machine')
     Traceback (most recent call last):
     ...
-    HTTPError: HTTP Error 403: Forbidden
+    HTTPError: HTTP Error 403: FORBIDDEN
     ...

=== modified file 'identityprovider/webservice/models.py'
--- identityprovider/webservice/models.py	2011-02-02 20:13:30 +0000
+++ identityprovider/webservice/models.py	2011-02-02 20:13:30 +0000
@@ -156,33 +156,6 @@
 
 class AuthenticationSet(make_set('BaseAuthenticationSet', 'authentications',
                                  IAuthenticationSet, Account, 'id')):
-    """ All these methods assume that they're run behind Basic Auth """
-    @plain_user_required
-    def authenticate(self, token_name):
-        request = get_current_browser_request()
-        account = request.environment['authenticated_user']
-        token = account.create_oauth_token(token_name)
-        application_token_created.send(
-            sender=self, openid_identifier=account.openid_identifier)
-        return token.serialize()
-
-    @api_user_required
-    def list_tokens(self, consumer_key):
-        tokens = Token.objects.filter(
-            consumer__user__username=consumer_key)
-        result = [{'token': t.token, 'name': t.name} for t in tokens]
-        return result
-
-    @api_user_required
-    def validate_token(self, token, consumer_key):
-        try:
-            token = Token.objects.get(
-                consumer__user__username=consumer_key,
-                token=token)
-            return token.serialize()
-        except Token.DoesNotExist:
-            return False
-
     @api_user_required
     def invalidate_token(self, token, consumer_key):
         tokens = Token.objects.filter(token=token,
@@ -192,35 +165,6 @@
             sender=self, openid_identifier=consumer_key)
 
 
-    @api_user_required
-    def team_memberships(self, team_names, openid_identifier):
-        accounts = Account.objects.filter(openid_identifier=openid_identifier)
-        accounts = list(accounts)
-
-        if len(accounts) == 1:
-            account = accounts[0]
-            memberships = get_team_memberships(team_names, account, False)
-            return memberships
-        else:
-            return []
-
-    @api_user_required
-    def account_by_email(self, email):
-        account = Account.objects.get_by_email(email)
-        if account:
-            return _serialize_account(account)
-        else:
-            return None
-
-    @api_user_required
-    def account_by_openid(self, openid):
-        try:
-            account = Account.objects.get(openid_identifier=openid)
-        except Account.DoesNotExist:
-            return None
-        else:
-            return _serialize_account(account)
-
 class CanNotResetPasswordError(Exception):
     webservice_error(403)
 

=== modified file 'identityprovider/webservice/urlinfo.py'
--- identityprovider/webservice/urlinfo.py	2011-02-02 20:13:30 +0000
+++ identityprovider/webservice/urlinfo.py	2011-02-02 20:13:30 +0000
@@ -1,4 +1,5 @@
 # Copyright 2010 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
+AUTHENTICATIONS_VIEW = "api_authentications"
 CAPTCHAS_VIEW = "api_captchas"

=== modified file 'identityprovider/webservice/urls.py'
--- identityprovider/webservice/urls.py	2011-02-02 20:13:30 +0000
+++ identityprovider/webservice/urls.py	2011-02-02 20:13:30 +0000
@@ -12,5 +12,8 @@
 
 urlpatterns = patterns('identityprovider.webservice.views',
     (r'^$', views.root),
+    url(r'^authentications',
+        views.AuthenticationsHandler(),
+        name=AUTHENTICATIONS_VIEW),
     url(r'^captchas', views.CaptchasHandler(), name=CAPTCHAS_VIEW),
 )

=== modified file 'identityprovider/webservice/views.py'
--- identityprovider/webservice/views.py	2011-02-02 20:13:30 +0000
+++ identityprovider/webservice/views.py	2011-02-02 20:13:30 +0000
@@ -1,3 +1,4 @@
+from functools import wraps
 from urlparse import urljoin
 
 from django.conf import settings
@@ -5,19 +6,29 @@
 from django.core.urlresolvers import reverse
 from django.http import (
     HttpResponse,
+    HttpResponseForbidden,
+    HttpResponseNotAllowed,
     HttpResponseRedirect,
-    HttpResponseNotAllowed,
 )
 from django.shortcuts import render_to_response, get_object_or_404
 from django.template import RequestContext
 from django.utils.translation import ugettext as _
 
+from oauth_backend.models import Token
+
 from piston.handler import BaseHandler
 
 import simplejson as json
 
 from identityprovider.auth import basic_authenticate, oauth_authenticate
+from identityprovider.models import APIUser, Account
 from identityprovider.models.captcha import Captcha, NewCaptchaError
+from identityprovider.signals import (
+    application_token_invalidated,
+    application_token_created,
+    account_email_validated,
+    account_created,
+)
 from urlinfo import *
 
 
@@ -44,7 +55,7 @@
 def root(request):
     if is_wadl_request(request):
         from wadl import wadl
-        return HttpResponse(wadl.replace('@@SERVICE_ROOT@@', api_reverse(request, root)), mimetype='application/vnd.sun.wadl+xml')
+        return HttpResponse(wadl.replace('@@SERVICE_ROOT@@/', api_reverse(request, root)), mimetype='application/vnd.sun.wadl+xml')
 
     return JsonResponse({
         "registrations_collection_link": "http://openid.launchpad.dev/api/1.0/registration",
@@ -63,32 +74,204 @@
 #                          Captcha, 'id')):
 
 
-class NotAllowed(Exception):
-    pass
+class BasicUnauthorized(HttpResponse):
+    def __init__(self):
+        super(BasicUnauthorized, self).__init__("401 Unauthorized", status=401)
+        self["WWW-Authenticate"] = 'Basic realm="Restricted area"'
+
+
+class OauthUnauthorized(HttpResponse):
+    def __init__(self):
+        super(OauthUnauthorized, self).__init__("401 Unauthorized", status=401)
+        self["WWW-Authenticate"] = 'OAuth realm="Restricted area"'
+
+
+class Forbidden(HttpResponse):
+    """
+    This class exists solely to satisfy the tests, and maybe
+    lazr.restfulclient, which wants the forbidden response to be
+    title-cases, not upper-cased.
+    """
+    def __init__(self):
+        super(Forbidden, self).__init__("403 Forbidden", status=403)
 
 
 class JsonHandler(object):
 
+    verbs = ["delete", "get", "post", "put"]
+
     def _not_allowed(self, request):
-        raise NotAllowed()
+        allowed = [v.upper() for v in self.verbs
+                   if getattr(self, v) != self._not_allowed]
+        return HttpResponseNotAllowed(allowed)
 
     delete = _not_allowed
     get = _not_allowed
     post = _not_allowed
     put = _not_allowed
 
-    verbs = ["delete", "get", "post", "put"]
-
     def __call__(self, request):
         method = request.method.lower()
-        if method in self.verbs:
-            try:
-                return JsonResponse(getattr(self, method)(request))
-            except NotAllowed:
-                pass
-        allowed = [v.upper() for v in self.verbs
-                   if getattr(self, v) != self._not_allowed]
-        return HttpResponseNotAllowed(allowed)
+        if method not in self.verbs:
+            return self._not_allowed(request)
+        r = getattr(self, method)(request)
+        return r if isinstance(r, HttpResponse) else JsonResponse(r)
+
+
+def basic_auth_required(func):
+    """
+    Requires the user to successfully authenticate (as any type of
+    user) using HTTP Basic authentication.  Sets request.basic_user.
+    """
+    @wraps(func)
+    def wrapper(self, request, *args, **kwargs):
+        authorization = request.META.get('HTTP_AUTHORIZATION')
+        if authorization is not None:
+            method, auth = authorization.split(' ', 1)
+            if method.lower() == 'basic':
+                auth = auth.strip().decode('base64')
+                username, password = auth.split(':', 1)
+                credentials = username, password
+                request.basic_user = basic_authenticate(username, password)
+                if request.basic_user is not None:
+                    return func(self, request, *args, **kwargs)
+        return BasicUnauthorized()
+    return wrapper
+
+
+def plain_user_required(func):
+    """
+    Requires that the basic-authenticated user is an Account.  Assumes
+    that @basic_auth_required has already been applied.
+    """
+    @wraps(func)
+    def wrapper(self, request, *args, **kwargs):
+        if isinstance(request.basic_user, Account):
+            return func(self, request, *args, **kwargs)
+        return HttpResponseForbidden()
+    return wrapper
+
+
+def api_user_required(func):
+    """
+    Requires that the basic-authenticated user is an APIUser.  Assumes
+    that @basic_auth_required has already been applied.
+    """
+    @wraps(func)
+    def wrapper(self, request, *args, **kwargs):
+        if isinstance(request.basic_user, APIUser):
+            return func(self, request, *args, **kwargs)
+        return HttpResponseForbidden()
+    return wrapper
+
+
+class AuthenticationsHandler(JsonHandler):
+
+    @plain_user_required
+    def authenticate(self, request, token_name=None):
+        account = request.basic_user
+        token = account.create_oauth_token(token_name)
+        application_token_created.send(
+            sender=self, openid_identifier=account.openid_identifier)
+        return token.serialize()
+
+    @api_user_required
+    def list_tokens(self, request, consumer_key=None):
+        tokens = Token.objects.filter(
+            consumer__user__username=consumer_key)
+        result = [{'token': t.token, 'name': t.name} for t in tokens]
+        return result
+
+    @api_user_required
+    def validate_token(self, request, token=None, consumer_key=None):
+        try:
+            token = Token.objects.get(
+                consumer__user__username=consumer_key,
+                token=token)
+            return token.serialize()
+        except Token.DoesNotExist:
+            return False
+
+    @api_user_required
+    def invalidate_token(self, request, token=None, consumer_key=None):
+        tokens = Token.objects.filter(token=token,
+            consumer__user__username=consumer_key)
+        tokens.delete()
+        application_token_invalidated.send(
+            sender=self, openid_identifier=consumer_key)
+
+    @api_user_required
+    def team_memberships(self, request, team_names=None,
+                         openid_identifier=None):
+        accounts = Account.objects.filter(openid_identifier=openid_identifier)
+        accounts = list(accounts)
+
+        if len(accounts) == 1:
+            account = accounts[0]
+            memberships = get_team_memberships(team_names, account, False)
+            return memberships
+        else:
+            return []
+
+    @api_user_required
+    def account_by_email(self, request, email=None):
+        account = Account.objects.get_by_email(email)
+        if account:
+            return _serialize_account(account)
+        else:
+            return None
+
+    @api_user_required
+    def account_by_openid(self, request, openid=None):
+        try:
+            account = Account.objects.get(openid_identifier=openid)
+        except Account.DoesNotExist:
+            return None
+        else:
+            return _serialize_account(account)
+
+    read_ops = ["authenticate", "list_tokens", "validate_token",
+                "team_memberships", "account_by_email", "account_by_openid"]
+
+    @api_user_required
+    def invalidate_token(self, request, token=None, consumer_key=None):
+        tokens = Token.objects.filter(
+            token=token, consumer__user__username=consumer_key)
+        tokens.delete()
+        application_token_invalidated.send(
+            sender=self, openid_identifier=consumer_key)
+
+    write_ops = ["invalidate_token"]
+
+    def _dispatch(self, request, allowed, noop_fn=lambda: "fail"):
+        ws_op = request.REQUEST.get("ws.op")
+
+        if ws_op is None:
+            return noop_fn()
+
+        if ws_op not in allowed:
+            return "fail"
+
+        args = dict(request.REQUEST.items())
+        del args["ws.op"]
+        fn = getattr(self, ws_op)
+        import pdb
+        if len(allowed)==1: pdb.set_trace()
+        return fn(request, **args)
+
+    @basic_auth_required
+    def get(self, request):
+        def noop():
+            return {"total_size": 0,
+                    "start": None,
+                    "resource_type_link": api_reverse(
+                        request, root, fragment="#authentications"),
+                    "entries": []}
+        return self._dispatch(request, self.read_ops, noop)
+
+    @basic_auth_required
+    def post(self, request):
+        return self._dispatch(request, self.write_ops)
 
 
 class CaptchasHandler(JsonHandler):

=== modified file 'identityprovider/wsgi.py'
--- identityprovider/wsgi.py	2011-02-02 20:13:30 +0000
+++ identityprovider/wsgi.py	2011-02-02 20:13:30 +0000
@@ -90,6 +90,7 @@
 
     dispatch = WSGIDispatch(
         [(r'^/api/1.0/?$', django),
+         (r'^/api/1.0/authentications', django),
          (r'^/api/1.0/captchas', django),
          (r'^/api/1.0', api)],
         django)