This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/passbook/providers/oauth/views/oauth2.py

93 lines
3.6 KiB
Python
Raw Normal View History

2018-11-16 08:10:35 +00:00
"""passbook OAuth2 Views"""
from urllib.parse import urlencode
2019-03-12 09:56:01 +00:00
from django.contrib import messages
from django.contrib.auth.mixins import LoginRequiredMixin
2018-12-11 14:29:58 +00:00
from django.shortcuts import get_object_or_404, redirect, reverse
from django.utils.translation import ugettext as _
from oauth2_provider.views.base import AuthorizationView
2019-10-01 08:24:10 +00:00
from structlog import get_logger
from passbook.audit.models import Event, EventAction
from passbook.core.models import Application
from passbook.core.views.access import AccessMixin
2018-12-11 14:29:58 +00:00
from passbook.core.views.utils import LoadingView, PermissionDeniedView
2019-10-07 14:33:48 +00:00
from passbook.providers.oauth.models import OAuth2Provider
LOGGER = get_logger()
class PassbookAuthorizationLoadingView(LoginRequiredMixin, LoadingView):
"""Show loading view for permission checks"""
2019-12-31 11:51:16 +00:00
title = _("Checking permissions...")
def get_url(self):
querystring = urlencode(self.request.GET)
2019-12-31 11:51:16 +00:00
return (
reverse("passbook_providers_oauth:oauth2-ok-authorize") + "?" + querystring
)
2018-12-11 14:29:58 +00:00
class OAuthPermissionDenied(PermissionDeniedView):
"""Show permission denied view"""
class PassbookAuthorizationView(AccessMixin, AuthorizationView):
2019-02-16 09:24:31 +00:00
"""Custom OAuth2 Authorization View which checks policies, etc"""
_application = None
def _inject_response_type(self):
"""Inject response_type into querystring if not set"""
LOGGER.debug("response_type not set, defaulting to 'code'")
querystring = urlencode(self.request.GET)
2019-12-31 11:51:16 +00:00
querystring += "&response_type=code"
return redirect(
reverse("passbook_providers_oauth:oauth2-ok-authorize") + "?" + querystring
)
def dispatch(self, request, *args, **kwargs):
"""Update OAuth2Provider's skip_authorization state"""
# Get client_id to get provider, so we can update skip_authorization field
2019-12-31 11:51:16 +00:00
client_id = request.GET.get("client_id")
provider = get_object_or_404(OAuth2Provider, client_id=client_id)
try:
application = self.provider_to_application(provider)
except Application.DoesNotExist:
2019-12-31 11:51:16 +00:00
return redirect("passbook_providers_oauth:oauth2-permission-denied")
# Update field here so oauth-toolkit does work for us
provider.skip_authorization = application.skip_authorization
provider.save()
self._application = application
# Check permissions
passing, policy_messages = self.user_has_access(self._application, request.user)
2019-03-12 09:56:01 +00:00
if not passing:
for policy_message in policy_messages:
messages.error(request, policy_message)
2019-12-31 11:51:16 +00:00
return redirect("passbook_providers_oauth:oauth2-permission-denied")
# Some clients don't pass response_type, so we default to code
2019-12-31 11:51:16 +00:00
if "response_type" not in request.GET:
return self._inject_response_type()
actual_response = super().dispatch(request, *args, **kwargs)
if actual_response.status_code == 400:
2019-12-31 11:51:16 +00:00
LOGGER.debug(request.GET.get("redirect_uri"))
return actual_response
def render_to_response(self, context, **kwargs):
# Always set is_login to true for correct css class
2019-12-31 11:51:16 +00:00
context["is_login"] = True
return super().render_to_response(context, **kwargs)
def form_valid(self, form):
# User has clicked on "Authorize"
2019-12-31 11:51:16 +00:00
Event.new(
EventAction.AUTHORIZE_APPLICATION, authorized_application=self._application,
2019-12-31 11:51:16 +00:00
).from_http(self.request)
LOGGER.debug(
"User authorized Application",
user=self.request.user,
application=self._application,
)
return super().form_valid(form)