Changeset - 0e3e0864f210
Parent rev.
Child rev.
[Not reviewed]
default
0 7 0
Mads Kiilerich - 7 years ago 2019-01-03 01:16:36
mads@kiilerich.com
auth: drop api_access_controllers_whitelist and give API key auth same access as other kinds of auth

All authentication methods are created equal. There is no point in
discriminating api key authentication and limit it to few APIs.
7 files changed with 12 insertions and 111 deletions:
development.ini
12
docs/api/api.rst
2
18
kallithea/controllers/feed.py
1
1
kallithea/controllers/journal.py
4
4
kallithea/lib/auth.py
4
36
kallithea/lib/paster_commands/template.ini.mako
12
kallithea/tests/functional/test_login.py
1
28
0 comments (0 inline, 0 general)
development.ini
➞
Show inline comments
 
@@ -150,24 +150,12 @@ show_revision_number = false
 
## gist URL alias, used to create nicer urls for gist. This should be an
 
## url that does rewrites to _admin/gists/<gistid>.
 
## example: http://gist.example.com/{gistid}. Empty means use the internal
 
## Kallithea url, ie. http[s]://kallithea.example.com/_admin/gists/<gistid>
 
gist_alias_url =
 

			




	
	
	
		
 
## white list of API enabled controllers. This allows to add list of

			




	
	
	
		
 
## controllers to which access will be enabled by api_key. eg: to enable

			




	
	
	
		
 
## api access to raw_files put `FilesController:raw`, to enable access to patches

			




	
	
	
		
 
## add `ChangesetController:changeset_patch`. This list should be "," separated

			




	
	
	
		
 
## Syntax is <ControllerClass>:<function>. Check debug logs for generated names

			




	
	
	
		
 
## Recommended settings below are commented out:

			




	
	
	
		
 
api_access_controllers_whitelist =

			




	
	
	
		
 
#    ChangesetController:changeset_patch,

			




	
	
	
		
 
#    ChangesetController:changeset_raw,

			




	
	
	
		
 
#    FilesController:raw,

			




	
	
	
		
 
#    FilesController:archivefile

			




	
	
	
		
 

			




	
	
	
		
 
## default encoding used to convert from and to unicode

			




	
	
	
		
 
## can be also a comma separated list of encoding in case of mixed encodings

			




	
	
	
		
 
default_encoding = utf-8

			




	
	
	
		
 

			




	
	
	
		
 
## Set Mercurial encoding, similar to setting HGENCODING before launching Kallithea

			




	
	
	
		
 
hgencoding = utf-8

			




        

    


    
    

    

        

                

                    docs/api/api.rst
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -1235,30 +1235,14 @@ OUTPUT::

			




	
	
	
		
 
    error:  null

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
API access for web views

			




	
	
	
		
 
------------------------

			




	
	
	
		
 

			




	
	
	
		
 
API access can also be turned on for each web view in Kallithea that is

			




	
	
	
		
 
decorated with the ``@LoginRequired`` decorator. Some views use

			




	
	
	
		
 
``@LoginRequired(api_access=True)`` and are always available. By default only

			




	
	
	
		
 
RSS/Atom feed views are enabled. Other views are

			




	
	
	
		
 
only available if they have been whitelisted. Edit the

			




	
	
	
		
 
``api_access_controllers_whitelist`` option in your .ini file and define views

			




	
	
	
		
 
that should have API access enabled.

			




	
	
	
		
 

			




	
	
	
		
 
For example, to enable API access to patch/diff, raw file and archive::

			




	
	
	
		
 

			




	
	
	
		
 
    api_access_controllers_whitelist =

			




	
	
	
		
 
        ChangesetController:changeset_patch,

			




	
	
	
		
 
        ChangesetController:changeset_raw,

			




	
	
	
		
 
        FilesController:raw,

			




	
	
	
		
 
        FilesController:archivefile

			




	
	
	
		
 

			




	
	
	
		
 
After this change, a Kallithea view can be accessed without login using

			




	
	
	
		
 
bearer authentication, by including this header with the request::

			




	
	
	
		
 
Kallithea HTTP entry points can also be accessed without login using bearer

			




	
	
	
		
 
authentication by including this header with the request::

			




	
	
	
		
 

			




	
	
	
		
 
    Authentication: Bearer <api_key>

			




	
	
	
		
 

			




	
	
	
		
 
Alternatively, the API key can be passed in the URL query string using

			




	
	
	
		
 
``?api_key=<api_key>``, though this is not recommended due to the increased

			




	
	
	
		
 
risk of API key leaks, and support will likely be removed in the future.

			




        

    


    
    

    

        

                

                    kallithea/controllers/feed.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -48,13 +48,13 @@ log = logging.getLogger(__name__)

			




	
	
	
		
 
language = 'en-us'

			




	
	
	
		
 
ttl = "5"

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class FeedController(BaseRepoController):

			




	
	
	
		
 

			




	
	
	
		
 
    @LoginRequired(api_access=True, allow_default_user=True)

			




	
	
	
		
 
    @LoginRequired(allow_default_user=True)

			




	
	
	
		
 
    @HasRepoPermissionLevelDecorator('read')

			




	
	
	
		
 
    def _before(self, *args, **kwargs):

			




	
	
	
		
 
        super(FeedController, self)._before(*args, **kwargs)

			




	
	
	
		
 

			




	
	
	
		
 
    def _get_title(self, cs):

			




	
	
	
		
 
        return h.shorter(cs.message, 160)

			




        

    


    
    

    

        

                

                    kallithea/controllers/journal.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -217,24 +217,24 @@ class JournalController(BaseController):

			




	
	
	
		
 
        repos_data = RepoModel().get_repos_as_dict(repos_list, admin=True)

			




	
	
	
		
 
        # data used to render the grid

			




	
	
	
		
 
        c.data = repos_data

			




	
	
	
		
 

			




	
	
	
		
 
        return render('journal/journal.html')

			




	
	
	
		
 

			




	
	
	
		
 
    @LoginRequired(api_access=True)

			




	
	
	
		
 
    @LoginRequired()

			




	
	
	
		
 
    def journal_atom(self):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Produce an atom-1.0 feed via feedgenerator module

			




	
	
	
		
 
        """

			




	
	
	
		
 
        following = UserFollowing.query() \

			




	
	
	
		
 
            .filter(UserFollowing.user_id == request.authuser.user_id) \

			




	
	
	
		
 
            .options(joinedload(UserFollowing.follows_repository)) \

			




	
	
	
		
 
            .all()

			




	
	
	
		
 
        return self._atom_feed(following, public=False)

			




	
	
	
		
 

			




	
	
	
		
 
    @LoginRequired(api_access=True)

			




	
	
	
		
 
    @LoginRequired()

			




	
	
	
		
 
    def journal_rss(self):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Produce an rss feed via feedgenerator module

			




	
	
	
		
 
        """

			




	
	
	
		
 
        following = UserFollowing.query() \

			




	
	
	
		
 
            .filter(UserFollowing.user_id == request.authuser.user_id) \

			




	
	
		
 
@@ -286,25 +286,25 @@ class JournalController(BaseController):

			




	
	
	
		
 

			




	
	
	
		
 
        if request.environ.get('HTTP_X_PARTIAL_XHR'):

			




	
	
	
		
 
            return render('journal/journal_data.html')

			




	
	
	
		
 

			




	
	
	
		
 
        return render('journal/public_journal.html')

			




	
	
	
		
 

			




	
	
	
		
 
    @LoginRequired(api_access=True, allow_default_user=True)

			




	
	
	
		
 
    @LoginRequired(allow_default_user=True)

			




	
	
	
		
 
    def public_journal_atom(self):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Produce an atom-1.0 feed via feedgenerator module

			




	
	
	
		
 
        """

			




	
	
	
		
 
        c.following = UserFollowing.query() \

			




	
	
	
		
 
            .filter(UserFollowing.user_id == request.authuser.user_id) \

			




	
	
	
		
 
            .options(joinedload(UserFollowing.follows_repository)) \

			




	
	
	
		
 
            .all()

			




	
	
	
		
 

			




	
	
	
		
 
        return self._atom_feed(c.following)

			




	
	
	
		
 

			




	
	
	
		
 
    @LoginRequired(api_access=True, allow_default_user=True)

			




	
	
	
		
 
    @LoginRequired(allow_default_user=True)

			




	
	
	
		
 
    def public_journal_rss(self):

			




	
	
	
		
 
        """

			




	
	
	
		
 
        Produce an rss2 feed via feedgenerator module

			




	
	
	
		
 
        """

			




	
	
	
		
 
        c.following = UserFollowing.query() \

			




	
	
	
		
 
            .filter(UserFollowing.user_id == request.authuser.user_id) \

			




        

    


    
    

    

        

                

                    kallithea/lib/auth.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -364,34 +364,12 @@ def _cached_perms_data(user_id, user_is_

			




	
	
	
		
 
            perm.UserUserGroupToPerm.user_group.users_group_name,

			




	
	
	
		
 
            perm.Permission.permission_name)

			




	
	
	
		
 

			




	
	
	
		
 
    return permissions

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def allowed_api_access(controller_name, whitelist=None, api_key=None):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Check if given controller_name is in whitelist API access

			




	
	
	
		
 
    """

			




	
	
	
		
 
    if not whitelist:

			




	
	
	
		
 
        from kallithea import CONFIG

			




	
	
	
		
 
        whitelist = aslist(CONFIG.get('api_access_controllers_whitelist'),

			




	
	
	
		
 
                           sep=',')

			




	
	
	
		
 
        log.debug('whitelist of API access is: %s', whitelist)

			




	
	
	
		
 
    api_access_valid = controller_name in whitelist

			




	
	
	
		
 
    if api_access_valid:

			




	
	
	
		
 
        log.debug('controller:%s is in API whitelist', controller_name)

			




	
	
	
		
 
    else:

			




	
	
	
		
 
        msg = 'controller: %s is *NOT* in API whitelist' % (controller_name)

			




	
	
	
		
 
        if api_key:

			




	
	
	
		
 
            # if we use API key and don't have access it's a warning

			




	
	
	
		
 
            log.warning(msg)

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            log.debug(msg)

			




	
	
	
		
 
    return api_access_valid

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class AuthUser(object):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Represents a Kallithea user, including various authentication and

			




	
	
	
		
 
    authorization information. Typically used to store the current user,

			




	
	
	
		
 
    but is also used as a generic user information data structure in

			




	
	
	
		
 
    parts of the code, e.g. user management.

			




	
	
		
 
@@ -686,41 +664,31 @@ class LoginRequired(object):

			




	
	
	
		
 
    """Client must be logged in as a valid User, or we'll redirect to the login

			




	
	
	
		
 
    page.

			




	
	
	
		
 

			




	
	
	
		
 
    If the "default" user is enabled and allow_default_user is true, that is

			




	
	
	
		
 
    considered valid too.

			




	
	
	
		
 

			




	
	
	
		
 
    Also checks that IP address is allowed, and if using API key instead

			




	
	
	
		
 
    of regular cookie authentication, checks that API key access is allowed

			




	
	
	
		
 
    (based on `api_access` parameter and the API view whitelist).

			




	
	
	
		
 
    Also checks that IP address is allowed.

			




	
	
	
		
 
    """

			




	
	
	
		
 

			




	
	
	
		
 
    def __init__(self, api_access=False, allow_default_user=False):

			




	
	
	
		
 
        self.api_access = api_access

			




	
	
	
		
 
    def __init__(self, allow_default_user=False):

			




	
	
	
		
 
        self.allow_default_user = allow_default_user

			




	
	
	
		
 

			




	
	
	
		
 
    def __call__(self, func):

			




	
	
	
		
 
        return decorator(self.__wrapper, func)

			




	
	
	
		
 

			




	
	
	
		
 
    def __wrapper(self, func, *fargs, **fkwargs):

			




	
	
	
		
 
        controller = fargs[0]

			




	
	
	
		
 
        user = request.authuser

			




	
	
	
		
 
        loc = "%s:%s" % (controller.__class__.__name__, func.__name__)

			




	
	
	
		
 
        log.debug('Checking access for user %s @ %s', user, loc)

			




	
	
	
		
 

			




	
	
	
		
 
        # Check if we used an API key to authenticate.

			




	
	
	
		
 
        api_key = user.authenticating_api_key

			




	
	
	
		
 
        if api_key is not None:

			




	
	
	
		
 
            # Check that controller is enabled for API key usage.

			




	
	
	
		
 
            if not self.api_access and not allowed_api_access(loc, api_key=api_key):

			




	
	
	
		
 
                # controller does not allow API access

			




	
	
	
		
 
                log.warning('API access to %s is not allowed', loc)

			




	
	
	
		
 
                raise HTTPForbidden()

			




	
	
	
		
 

			




	
	
	
		
 
        if user.authenticating_api_key is not None:

			




	
	
	
		
 
            log.info('user %s authenticated with API key ****%s @ %s',

			




	
	
	
		
 
                     user, api_key[-4:], loc)

			




	
	
	
		
 
                     user, user.authenticating_api_key[-4:], loc)

			




	
	
	
		
 
            return func(*fargs, **fkwargs)

			




	
	
	
		
 

			




	
	
	
		
 
        # CSRF protection: Whenever a request has ambient authority (whether

			




	
	
	
		
 
        # through a session cookie or its origin IP address), it must include

			




	
	
	
		
 
        # the correct token, unless the HTTP method is GET or HEAD (and thus

			




	
	
	
		
 
        # guaranteed to be side effect free. In practice, the only situation

			




        

    


    
    

    

        

                

                    kallithea/lib/paster_commands/template.ini.mako
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -247,24 +247,12 @@ show_revision_number = false

			




	
	
	
		
 
<%text>## gist URL alias, used to create nicer urls for gist. This should be an</%text>

			




	
	
	
		
 
<%text>## url that does rewrites to _admin/gists/<gistid>.</%text>

			




	
	
	
		
 
<%text>## example: http://gist.example.com/{gistid}. Empty means use the internal</%text>

			




	
	
	
		
 
<%text>## Kallithea url, ie. http[s]://kallithea.example.com/_admin/gists/<gistid></%text>

			




	
	
	
		
 
gist_alias_url =

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## white list of API enabled controllers. This allows to add list of</%text>

			




	
	
	
		
 
<%text>## controllers to which access will be enabled by api_key. eg: to enable</%text>

			




	
	
	
		
 
<%text>## api access to raw_files put `FilesController:raw`, to enable access to patches</%text>

			




	
	
	
		
 
<%text>## add `ChangesetController:changeset_patch`. This list should be "," separated</%text>

			




	
	
	
		
 
<%text>## Syntax is <ControllerClass>:<function>. Check debug logs for generated names</%text>

			




	
	
	
		
 
<%text>## Recommended settings below are commented out:</%text>

			




	
	
	
		
 
api_access_controllers_whitelist =

			




	
	
	
		
 
#    ChangesetController:changeset_patch,

			




	
	
	
		
 
#    ChangesetController:changeset_raw,

			




	
	
	
		
 
#    FilesController:raw,

			




	
	
	
		
 
#    FilesController:archivefile

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## default encoding used to convert from and to unicode</%text>

			




	
	
	
		
 
<%text>## can be also a comma separated list of encoding in case of mixed encodings</%text>

			




	
	
	
		
 
default_encoding = utf-8

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## Set Mercurial encoding, similar to setting HGENCODING before launching Kallithea</%text>

			




	
	
	
		
 
hgencoding = utf-8

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_login.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -438,16 +438,12 @@ class TestLoginController(TestController

			




	
	
	
		
 
        response = response.follow()

			




	
	
	
		
 

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 
    # API

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 

			




	
	
	
		
 
    def _get_api_whitelist(self, values=None):

			




	
	
	
		
 
        config = {'api_access_controllers_whitelist': values or []}

			




	
	
	
		
 
        return config

			




	
	
	
		
 

			




	
	
	
		
 
    def _api_key_test(self, api_key, status):

			




	
	
	
		
 
        """Verifies HTTP status code for accessing an auth-requiring page,

			




	
	
	
		
 
        using the given api_key URL parameter as well as using the API key

			




	
	
	
		
 
        with bearer authentication.

			




	
	
	
		
 

			




	
	
	
		
 
        If api_key is None, no api_key is passed at all. If api_key is True,

			




	
	
		
 
@@ -473,48 +469,25 @@ class TestLoginController(TestController

			




	
	
	
		
 
                         status=status)

			




	
	
	
		
 

			




	
	
	
		
 
    @parametrize('test_name,api_key,code', [

			




	
	
	
		
 
        ('none', None, 302),

			




	
	
	
		
 
        ('empty_string', '', 403),

			




	
	
	
		
 
        ('fake_number', '123456', 403),

			




	
	
	
		
 
        ('proper_api_key', True, 403)

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_access_not_whitelisted_page_via_api_key(self, test_name, api_key, code):

			




	
	
	
		
 
        whitelist = self._get_api_whitelist([])

			




	
	
	
		
 
        with mock.patch('kallithea.CONFIG', whitelist):

			




	
	
	
		
 
            assert [] == whitelist['api_access_controllers_whitelist']

			




	
	
	
		
 
            self._api_key_test(api_key, code)

			




	
	
	
		
 

			




	
	
	
		
 
    @parametrize('test_name,api_key,code', [

			




	
	
	
		
 
        ('none', None, 302),

			




	
	
	
		
 
        ('empty_string', '', 403),

			




	
	
	
		
 
        ('fake_number', '123456', 403),

			




	
	
	
		
 
        ('fake_not_alnum', 'a-z', 403),

			




	
	
	
		
 
        ('fake_api_key', '0123456789abcdef0123456789ABCDEF01234567', 403),

			




	
	
	
		
 
        ('proper_api_key', True, 200)

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_access_whitelisted_page_via_api_key(self, test_name, api_key, code):

			




	
	
	
		
 
        whitelist = self._get_api_whitelist(['ChangesetController:changeset_raw'])

			




	
	
	
		
 
        with mock.patch('kallithea.CONFIG', whitelist):

			




	
	
	
		
 
            assert ['ChangesetController:changeset_raw'] == whitelist['api_access_controllers_whitelist']

			




	
	
	
		
 
    def test_access_page_via_api_key(self, test_name, api_key, code):

			




	
	
	
		
 
            self._api_key_test(api_key, code)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_access_page_via_extra_api_key(self):

			




	
	
	
		
 
        whitelist = self._get_api_whitelist(['ChangesetController:changeset_raw'])

			




	
	
	
		
 
        with mock.patch('kallithea.CONFIG', whitelist):

			




	
	
	
		
 
            assert ['ChangesetController:changeset_raw'] == whitelist['api_access_controllers_whitelist']

			




	
	
	
		
 

			




	
	
	
		
 
            new_api_key = ApiKeyModel().create(TEST_USER_ADMIN_LOGIN, u'test')

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
            self._api_key_test(new_api_key.api_key, status=200)

			




	
	
	
		
 

			




	
	
	
		
 
    def test_access_page_via_expired_api_key(self):

			




	
	
	
		
 
        whitelist = self._get_api_whitelist(['ChangesetController:changeset_raw'])

			




	
	
	
		
 
        with mock.patch('kallithea.CONFIG', whitelist):

			




	
	
	
		
 
            assert ['ChangesetController:changeset_raw'] == whitelist['api_access_controllers_whitelist']

			




	
	
	
		
 

			




	
	
	
		
 
            new_api_key = ApiKeyModel().create(TEST_USER_ADMIN_LOGIN, u'test')

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
            # patch the API key and make it expired

			




	
	
	
		
 
            new_api_key.expires = 0

			




	
	
	
		
 
            Session().commit()

			




	
	
	
		
 
            self._api_key_test(new_api_key.api_key, status=403)

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.