def register_by_password():
"""使用密码验证注册
JSON 参数：
- student_id
- password
- jw_password
- captcha_ticket
- captcha_rand
- remote_addr
"""
passed, ret_msg, student_id, password, jw_password = check_payloads(
("student_id", return_err(E_EMPTY_USERNAME)),
("password", return_err(E_EMPTY_PASSWORD)),
("jw_password", return_err(E_EMPTY_PASSWORD)))
if not passed:
return ret_msg
# todo 这里可以通过 api-server 查询判断一下学号是否存在
# captcha
if not TencentCaptcha.verify():
return return_err(E_INVALID_CAPTCHA)
# 密码强度检查
pwd_strength_report = zxcvbn(password=password)
if pwd_strength_report['score'] < 2:
SimplePassword.new(password=password,
sid_orig=student_id)
return return_err(E_WEAK_PASSWORD)
request_id = IdentityVerification.new_register_request(student_id,
"password",
ID_STATUS_WAIT_VERIFY,
password=password)
# call everyclass-auth to verify password
try:
rpc_result = Auth.register_by_password(request_id=str(request_id),
student_id=student_id,
password=jw_password)
except Exception as e:
return handle_exception_with_json(e, True)
if rpc_result['acknowledged']:
return jsonify({"success" : True,
"message" : "Acknowledged",
"request_id": str(request_id)})
else:
return return_err(E_BE_INTERNAL)
def login():
"""
用户登录
采用JSON POST。如果正确则返回 JWT Token
JSON 参数：
- student_id
- password
- captcha_ticket
- captcha_rand
- remote_addr
"""
passed, ret_msg, student_id, password = check_payloads(("student_id", return_err(E_EMPTY_USERNAME)),
("password", return_err(E_EMPTY_PASSWORD)))
if not passed:
return ret_msg
# captcha
if not TencentCaptcha.verify():
return return_err(E_INVALID_CAPTCHA)
# 检查学号是否存在
try:
student = APIServer.get_student(student_id)
except RpcResourceNotFound:
return return_err(E_STUDENT_UNEXIST)
except Exception as e:
return handle_exception_with_json(e, lazy=True)
try:
success = User.check_password(student_id, password)
except ValueError:
# 未注册
return return_err(E_STUDENT_NOT_REGISTERED)
if success:
return jsonify({"success": True,
"token" : generate_token({"sub": student.student_id,
"pol": current_app.config.TYK_POLICY_ID})})
else:
return return_err(E_WRONG_PASSWORD)