def login_required_and(admin_required=False,
developer_required=False,
moderator_required=False,
child_user_allowed=True,
demo_user_allowed=False,
phantom_user_allowed=True):
"""Decorator for validating an authenticated request.
Checking oauth/cookie is the way to tell whether an API client is
'logged in', since they can only have gotten an oauth token (or
cookie token) via the login process.
In addition to checking whether the user is logged in, this
function also checks access based on the *type* of the user: if
demo_user_allowed==False, for instance, and the logged-in user is
a demo user, then access will be denied.
(Exception: if the user is an admin user, then access is *always*
allowed, and the only check we make is if they're logged in.)
The default values specify the default permissions: for instance,
phantom users are considered a valid user by this routine, and
under-13 users are allowed access all urls unless explicitly
stated otherwise.
(Exception: under-13 users are always disallowed for oauth requests
unless the oauth consumer is preapproved/anointed by us. No third party
apps can access under-13 account data.)
"""
def decorator(func):
@wraps(func)
def wrapper(*args, **kwargs):
try:
verify_and_cache_oauth_or_cookie(request)
except OAuthError, e:
return oauth_error_response(e)
except NotLoggedInError, e:
# TODO(csilvers): just count how often this happens intead
# of logging. Why warn about something we can't control?
# The only reason is it's possible this is caused by a bug.
logging.warning('No login info found via %s\nCookie: %s'
% (e, os.environ.get('HTTP_COOKIE', '')))
return unauthorized_response()
try:
user_util.verify_login(admin_required, developer_required,
moderator_required, child_user_allowed,
demo_user_allowed, phantom_user_allowed)
except user_util.LoginFailedError:
return unauthorized_response()
return func(*args, **kwargs)
def decorator(func):
@wraps(func)
def wrapper(*args, **kwargs):
try:
verify_and_cache_oauth_or_cookie(request)
except OAuthError, e:
return oauth_error_response(e)
try:
user_util.verify_login(admin_required, developer_required,
moderator_required, child_user_allowed,
demo_user_allowed, phantom_user_allowed)
except user_util.LoginFailedError:
return unauthorized_response()
return func(*args, **kwargs)
