def createAccount(self, request):
""" Create new custom account """
status = StringMsg() # return status
status.data = 'error' # default to error
# Verify if user passed reCAPTCHA
# POST request to Google reCAPTCHA API
url = 'https://www.google.com/recaptcha/api/siteverify?secret=%s&response=%s' % (GRECAPTCHA_SECRET, request.recaptcha)
try:
result = urlfetch.Fetch(url, method=2)
except:
raise endpoints.BadRequestException('urlfetch error: Unable to POST to Google reCAPTCHA')
return status
data = json.loads(result.content)
if not data['success']:
status.data = 'recaptcha_fail'
return status
user_id = 'ca_' + request.email
# Get profile from datastore -- if profile not found, then profile=None
profile_key = ndb.Key(Profile, user_id)
profile = profile_key.get()
# If profile exists, return status
if profile:
status.data = 'user_exists'
return status
# Salt and hash the password
salt = Crypto.Random.new().read(16)
passkey = KDF.PBKDF2(request.password, salt).encode('hex')
salt_passkey = salt.encode('hex') + '|' + passkey
# Generate new session ID
session_id = Crypto.Random.new().read(16).encode('hex')
# Create new profile for user
Profile(
key = profile_key,
userId = user_id,
contactEmail = request.email,
salt_passkey = salt_passkey,
session_id = session_id,
loggedIn = True,
emailVerified = False,
notifications = [False, True]
).put()
# Generate user access token
token = self._genToken({'userId': user_id, 'session_id': session_id})
# If we get here, means we suceeded
status.data = 'success'
status.accessToken = token
return status
def login(self, request):
""" Check username/password to login """
status = StringMsg() # return status
status.data = 'error' # default to error
# Verify if user passed reCAPTCHA
# POST request to Google reCAPTCHA API
url = 'https://www.google.com/recaptcha/api/siteverify?secret=%s&response=%s' % (GRECAPTCHA_SECRET, request.recaptcha)
try:
result = urlfetch.Fetch(url, method=2)
except:
raise endpoints.BadRequestException('urlfetch error: Unable to POST to Google reCAPTCHA')
return status
data = json.loads(result.content)
if not data['success']:
status.data = 'recaptcha_fail'
return status
user_id = 'ca_' + request.email
# Get profile from datastore -- if profile not found, then profile=None
profile_key = ndb.Key(Profile, user_id)
profile = profile_key.get()
# If profile does not exist, return False
if not profile:
return status
# Parse salt and passkey from DB, compare it to provided version
db_salt, db_passkey = profile.salt_passkey.split('|')
passkey = KDF.PBKDF2(request.password, db_salt.decode('hex')).encode('hex')
# Passwords don't match, return False
if passkey != db_passkey:
return status
# Generate new session ID
session_id = Crypto.Random.new().read(16).encode('hex')
profile.session_id = session_id
# Update user's status to logged-in
profile.loggedIn = True
profile.put()
# Generate user access token
token = self._genToken({'userId': user_id, 'session_id': session_id})
# If we get here, means we suceeded
status.data = 'success'
status.accessToken = token
return status