def testVerifyAPIToken(self):
result = connection.execute(auth_user_table.insert({'email': 'a'}))
user_id = result.inserted_primary_key[0]
token = generate_api_token()
connection.execute(set_api_token(token=token, auth_user_id=user_id))
self.assertTrue(
verify_api_token(connection, token=token, email='a'))
self.assertFalse(
verify_api_token(connection, token=generate_api_token(),
email='a'))
def testTokenExpires(self):
result = connection.execute(auth_user_table.insert({'email': 'a'}))
user_id = result.inserted_primary_key[0]
token = generate_api_token()
exp = timedelta(hours=1)
connection.execute(
set_api_token(token=token, auth_user_id=user_id, expiration=exp))
self.assertTrue(
verify_api_token(connection, token=token, email='a'))
token2 = generate_api_token()
exp2 = timedelta(hours=-1)
connection.execute(set_api_token(
token=token2,
auth_user_id=user_id,
expiration=exp2))
self.assertFalse(
verify_api_token(connection, token=token2, email='a'))
def prepare(self):
"""
If a request has not been made through the browser (so there is no
XSRF cookie supplied), check that a valid user is using the API (
even though the actual user account used does not matter).
:raise tornado.web.HTTPError: 403, if the check fails
"""
super().prepare()
headers = self.request.headers
if 'Token' in headers and 'Email' in headers:
token = headers['Token']
email = headers['Email']
if not verify_api_token(self.db, token=token, email=email):
raise tornado.web.HTTPError(403)
def prepare(self):
"""
Before an HTTP method runs, this checks that either the user is
logged in or a valid API token has been supplied.
:raise tornado.web.HTTPError: 403, if neither condition is true
"""
super().prepare()
if not self.current_user:
token = self.request.headers.get('Token', None)
email = self.request.headers.get('Email', None)
if (token is None) or (email is None):
raise tornado.web.HTTPError(403)
if not verify_api_token(self.db, token=token, email=email):
raise tornado.web.HTTPError(403)
def testNoDefaultToken(self):
connection.execute(auth_user_table.insert({'email': 'a'}))
self.assertFalse(
verify_api_token(connection, token=generate_api_token(),
email='a'))
def testVerifyAPITokenWhenEmailDoesNotExist(self):
self.assertFalse(
verify_api_token(connection, token=generate_api_token(),
email='nope'))
