##// END OF EJS Templates
security: use 404 instead of 403 in case missing permissions for comment deletion....
security: use 404 instead of 403 in case missing permissions for comment deletion. - prevents resource discovery

File last commit:

r1820:0c30378e default
r1826:76aa3640 default
Show More
auth_token.py
100 lines | 3.4 KiB | text/x-python | PythonLexer
# -*- coding: utf-8 -*-
# Copyright (C) 2013-2017 RhodeCode GmbH
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License, version 3
# (only), as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# This program is dual-licensed. If you wish to learn more about the
# RhodeCode Enterprise Edition, including its added features, Support services,
# and proprietary license terms, please see https://rhodecode.com/licenses/
"""
authentication tokens model for RhodeCode
"""
import time
import logging
import traceback
from sqlalchemy import or_
from rhodecode.model import BaseModel
from rhodecode.model.db import UserApiKeys
from rhodecode.model.meta import Session
log = logging.getLogger(__name__)
class AuthTokenModel(BaseModel):
cls = UserApiKeys
def create(self, user, description, lifetime=-1, role=UserApiKeys.ROLE_ALL):
"""
:param user: user or user_id
:param description: description of ApiKey
:param lifetime: expiration time in minutes
:param role: role for the apikey
"""
from rhodecode.lib.auth import generate_auth_token
user = self._get_user(user)
new_auth_token = UserApiKeys()
new_auth_token.api_key = generate_auth_token(user.username)
new_auth_token.user_id = user.user_id
new_auth_token.description = description
new_auth_token.role = role
new_auth_token.expires = time.time() + (lifetime * 60) \
if lifetime != -1 else -1
Session().add(new_auth_token)
return new_auth_token
def delete(self, auth_token_id, user=None):
"""
Deletes given api_key, if user is set it also filters the object for
deletion by given user.
"""
auth_token = UserApiKeys.query().filter(
UserApiKeys.user_api_key_id == auth_token_id)
if user:
user = self._get_user(user)
auth_token = auth_token.filter(UserApiKeys.user_id == user.user_id)
auth_token = auth_token.scalar()
try:
Session().delete(auth_token)
except Exception:
log.error(traceback.format_exc())
raise
def get_auth_tokens(self, user, show_expired=True):
user = self._get_user(user)
user_auth_tokens = UserApiKeys.query()\
.filter(UserApiKeys.user_id == user.user_id)
if not show_expired:
user_auth_tokens = user_auth_tokens\
.filter(or_(UserApiKeys.expires == -1,
UserApiKeys.expires >= time.time()))
user_auth_tokens = user_auth_tokens.order_by(
UserApiKeys.user_api_key_id)
return user_auth_tokens
def get_auth_token(self, auth_token):
auth_token = UserApiKeys.query().filter(
UserApiKeys.api_key == auth_token)
auth_token = auth_token \
.filter(or_(UserApiKeys.expires == -1,
UserApiKeys.expires >= time.time()))\
.first()
return auth_token