def post(self):
supplied_token = self.get_body_argument("token")
match = TokenValidate.validator.match(supplied_token)
if not match:
return self.error(((1, "Token format not recognized"),))
sess = Session()
token_name = match.group("token_name")
token_secret = match.group("token_secret")
owner = User.get(sess, name=match.group("name"))
token = UserToken.get(sess, owner, token_name)
if token is None:
return self.error(((2, "Token specified does not exist"),))
if not token.enabled:
return self.error(((3, "Token is disabled"),))
if not token.check_secret(token_secret):
return self.error(((4, "Token secret mismatch"),))
return self.success({
"owner": owner.username,
"identity": str(token),
"act_as_owner": True,
"valid": True,
})
def get(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
return self.render("user-token-disable.html", user=user, token=token)
def get(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
return self.render("user-token-disable.html", user=user, token=token)
def test_usertokens(standard_graph, session, users, groups, permissions): # noqa: F811
user = users["*****@*****.**"]
assert len(user.tokens) == 0
tok, secret = add_new_user_token(session, UserToken(user=user, name="Foo"))
assert len(user.tokens) == 1
assert tok.check_secret(secret)
assert tok.check_secret("invalid") == False
assert tok.enabled == True
disable_user_token(session, tok)
assert tok.enabled == False
assert user.tokens[0].enabled == False
assert UserToken.get(session, name="Foo", user=user).enabled == False
assert tok.check_secret(secret) == False
def post(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
disable_user_token(self.session, token)
AuditLog.log(self.session, self.current_user.id, 'disable_token',
'Disabled token: {}'.format(token.name),
on_user_id=user.id)
self.session.commit()
return self.render("user-token-disabled.html", token=token)
def post(self, user_id=None, name=None, token_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
token = UserToken.get(self.session, user=user, id=token_id)
disable_user_token(self.session, token)
AuditLog.log(
self.session,
self.current_user.id,
"disable_token",
"Disabled token: {}".format(token.name),
on_user_id=user.id,
)
self.session.commit()
return self.render("user-token-disabled.html", token=token)
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
supplied_token = self.get_body_argument("token")
match = TokenValidate.validator.match(supplied_token)
if not match:
return self.error(((1, "Token format not recognized"),))
token_name = match.group("token_name")
token_secret = match.group("token_secret")
username = match.group("name")
with closing(Session()) as session:
token = UserToken.get_by_value(session, username, token_name)
if token is None:
return self.error(((2, "Token specified does not exist"),))
if not token.enabled:
return self.error(((3, "Token is disabled"),))
if not token.check_secret(token_secret):
return self.error(((4, "Token secret mismatch"),))
return self.success(
{"owner": username, "identity": str(token), "act_as_owner": True, "valid": True}
)
def test_usertokens(users, session, http_client, base_url): # noqa: F811
user = users["*****@*****.**"]
tok, secret = add_new_user_token(session, UserToken(user=user, name="Foo"))
session.commit()
api_url = url(base_url, "/token/validate")
# Completely bogus input
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({"token": "invalid"}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 1
valid_token = str(tok) + ":" + secret
# Valid token
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({"token": valid_token}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "ok"
assert body["data"]["identity"] == str(tok)
assert body["data"]["owner"] == user.username
assert body["data"]["act_as_owner"]
assert body["data"]["valid"]
# Token with the last character changed to something invalid
bad_char = "1" if secret[-1].isalpha() else "a"
token_with_bad_secret = str(tok) + ":" + secret[:-1] + bad_char
resp = yield http_client.fetch(
api_url, method="POST", body=urlencode({"token": token_with_bad_secret})
)
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 4
# Token with the token name frobbed to be something invalid
token_with_bad_name = str(tok) + "z:" + secret
resp = yield http_client.fetch(
api_url, method="POST", body=urlencode({"token": token_with_bad_name})
)
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Token with the user frobbed to be something invalid
token_with_bad_user = "******" + str(tok) + ":" + secret
resp = yield http_client.fetch(
api_url, method="POST", body=urlencode({"token": token_with_bad_user})
)
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Token with the user changed to another valid, but wrong user
token_with_wrong_user = "******" + tok.name + ":" + secret
resp = yield http_client.fetch(
api_url, method="POST", body=urlencode({"token": token_with_wrong_user})
)
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 2
# Disabled, but otherwise valid token
disable_user_token(session, tok)
session.commit()
resp = yield http_client.fetch(api_url, method="POST", body=urlencode({"token": valid_token}))
body = json.loads(resp.body)
assert resp.code == 200
assert body["status"] == "error"
assert len(body["errors"]) == 1
assert body["errors"][0]["code"] == 3
