Add authentication API
Omar Roth
6 years ago
parent
301871aec6
commit
2a6c81a89d
@ -0,0 +1,146 @@
|
||||
def generate_token(email, scopes, expire, key, db)
|
||||
session = "v1:#{Base64.urlsafe_encode(Random::Secure.random_bytes(32))}"
|
||||
PG_DB.exec("INSERT INTO session_ids VALUES ($1, $2, $3)", session, email, Time.now)
|
||||
|
||||
token = {
|
||||
"session" => session,
|
||||
"scopes" => scopes,
|
||||
"expire" => expire,
|
||||
}
|
||||
|
||||
if !expire
|
||||
token.delete("expire")
|
||||
end
|
||||
|
||||
token["signature"] = sign_token(key, token)
|
||||
|
||||
return token.to_json
|
||||
end
|
||||
|
||||
def generate_response(session, scopes, key, db, expire = 6.hours, use_nonce = false)
|
||||
expire = Time.now + expire
|
||||
|
||||
token = {
|
||||
"session" => session,
|
||||
"expire" => expire.to_unix,
|
||||
"scopes" => scopes,
|
||||
}
|
||||
|
||||
if use_nonce
|
||||
nonce = Random::Secure.hex(16)
|
||||
db.exec("INSERT INTO nonces VALUES ($1, $2) ON CONFLICT DO NOTHING", nonce, expire)
|
||||
token["nonce"] = nonce
|
||||
end
|
||||
|
||||
token["signature"] = sign_token(key, token)
|
||||
|
||||
return token.to_json
|
||||
end
|
||||
|
||||
def sign_token(key, hash)
|
||||
string_to_sign = [] of String
|
||||
|
||||
hash.each do |key, value|
|
||||
if key == "signature"
|
||||
next
|
||||
end
|
||||
|
||||
if value.is_a?(JSON::Any)
|
||||
case value
|
||||
when .as_a?
|
||||
value = value.as_a.map { |item| item.as_s }
|
||||
end
|
||||
end
|
||||
|
||||
case value
|
||||
when Array
|
||||
string_to_sign << "#{key}=#{value.sort.join(",")}"
|
||||
when Tuple
|
||||
string_to_sign << "#{key}=#{value.to_a.sort.join(",")}"
|
||||
else
|
||||
string_to_sign << "#{key}=#{value}"
|
||||
end
|
||||
end
|
||||
|
||||
string_to_sign = string_to_sign.sort.join("\n")
|
||||
return Base64.urlsafe_encode(OpenSSL::HMAC.digest(:sha256, key, string_to_sign)).strip
|
||||
end
|
||||
|
||||
def validate_request(token, session, request, key, db, locale = nil)
|
||||
case token
|
||||
when String
|
||||
token = JSON.parse(URI.unescape(token)).as_h
|
||||
when JSON::Any
|
||||
token = token.as_h
|
||||
when Nil
|
||||
raise translate(locale, "Hidden field \"token\" is a required field")
|
||||
end
|
||||
|
||||
if token["signature"] != sign_token(key, token)
|
||||
raise translate(locale, "Invalid signature")
|
||||
end
|
||||
|
||||
if token["session"] != session
|
||||
raise translate(locale, "Invalid token")
|
||||
end
|
||||
|
||||
if token["nonce"]? && (nonce = db.query_one?("SELECT * FROM nonces WHERE nonce = $1", token["nonce"], as: {String, Time}))
|
||||
if nonce[1] > Time.now
|
||||
db.exec("UPDATE nonces SET expire = $1 WHERE nonce = $2", Time.new(1990, 1, 1), nonce[0])
|
||||
else
|
||||
raise translate(locale, "Invalid token")
|
||||
end
|
||||
end
|
||||
|
||||
scopes = token["scopes"].as_a.map { |v| v.as_s }
|
||||
scope = "#{request.method}:#{request.path.lchop("/api/v1/auth/").lstrip("/")}"
|
||||
|
||||
if !scopes_include_scope(scopes, scope)
|
||||
raise translate(locale, "Invalid scope")
|
||||
end
|
||||
|
||||
expire = token["expire"]?.try &.as_i
|
||||
if expire.try &.< Time.now.to_unix
|
||||
raise translate(locale, "Token is expired, please try again")
|
||||
end
|
||||
|
||||
return {scopes, expire, token["signature"].as_s}
|
||||
end
|
||||
|
||||
def scope_includes_scope(scope, subset)
|
||||
methods, endpoint = scope.split(":")
|
||||
methods = methods.split(";").map { |method| method.upcase }.reject { |method| method.empty? }.sort
|
||||
endpoint = endpoint.downcase
|
||||
|
||||
subset_methods, subset_endpoint = subset.split(":")
|
||||
subset_methods = subset_methods.split(";").map { |method| method.upcase }.sort
|
||||
subset_endpoint = subset_endpoint.downcase
|
||||
|
||||
if methods.empty?
|
||||
methods = %w(GET POST PUT HEAD DELETE PATCH OPTIONS)
|
||||
end
|
||||
|
||||
if methods & subset_methods != subset_methods
|
||||
return false
|
||||
end
|
||||
|
||||
if endpoint.ends_with?("*") && !subset_endpoint.starts_with? endpoint.rchop("*")
|
||||
return false
|
||||
end
|
||||
|
||||
if !endpoint.ends_with?("*") && subset_endpoint != endpoint
|
||||
return false
|
||||
end
|
||||
|
||||
return true
|
||||
end
|
||||
|
||||
def scopes_include_scope(scopes, subset)
|
||||
scopes.each do |scope|
|
||||
if scope_includes_scope(scope, subset)
|
||||
return true
|
||||
end
|
||||
end
|
||||
|
||||
return false
|
||||
end
|
||||
@ -0,0 +1,78 @@
|
||||
<% content_for "header" do %>
|
||||
<title><%= translate(locale, "Token") %> - Invidious</title>
|
||||
<% end %>
|
||||
|
||||
<% if env.get? "access_token" %>
|
||||
<div class="pure-g h-box">
|
||||
<div class="pure-u-1-3">
|
||||
<h3>
|
||||
<%= translate(locale, "Token") %>
|
||||
</h3>
|
||||
</div>
|
||||
<div class="pure-u-1-3" style="text-align:center">
|
||||
<h3>
|
||||
<a href="/token_manager"><%= translate(locale, "Token manager") %></a>
|
||||
</h3>
|
||||
</div>
|
||||
<div class="pure-u-1-3" style="text-align:right">
|
||||
<h3>
|
||||
<a href="/preferences"><%= translate(locale, "Preferences") %></a>
|
||||
</h3>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="h-box">
|
||||
<h4 style="padding-left:0.5em">
|
||||
<code><%= env.get "access_token" %></code>
|
||||
</h4>
|
||||
</div>
|
||||
<% else %>
|
||||
<div class="h-box">
|
||||
<form class="pure-form pure-form-aligned" action="/authorize_token" method="post">
|
||||
<% if callback_url %>
|
||||
<legend><%= translate(locale, "Authorize token for `x`?", "#{callback_url.scheme}://#{callback_url.host}") %></legend>
|
||||
<% else %>
|
||||
<legend><%= translate(locale, "Authorize token?") %></legend>
|
||||
<% end %>
|
||||
|
||||
<div class="pure-g">
|
||||
<div class="pure-u-1">
|
||||
<ul>
|
||||
<% scopes.each do |scope| %>
|
||||
<li><%= scope %></li>
|
||||
<% end %>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="pure-g">
|
||||
<div class="pure-u-1-2">
|
||||
<button type="submit" name="submit" value="clear_watch_history" class="pure-button pure-button-primary">
|
||||
<%= translate(locale, "Yes") %>
|
||||
</button>
|
||||
</div>
|
||||
<div class="pure-u-1-2">
|
||||
<% if callback_url %>
|
||||
<a class="pure-button" href="<%= callback_url %>">
|
||||
<% else %>
|
||||
<a class="pure-button" href="/">
|
||||
<% end %>
|
||||
<%= translate(locale, "No") %>
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% scopes.each_with_index do |scope, i| %>
|
||||
<input type="hidden" name="scopes[<%= i %>]" value="<%= scope %>">
|
||||
<% end %>
|
||||
<% if callback_url %>
|
||||
<input type="hidden" name="callbackUrl" value="<%= callback_url %>">
|
||||
<% end %>
|
||||
<% if expire %>
|
||||
<input type="hidden" name="expire" value="<%= expire %>">
|
||||
<% end %>
|
||||
|
||||
<input type="hidden" name="csrf_token" value="<%= URI.escape(csrf_token) %>">
|
||||
</form>
|
||||
</div>
|
||||
<% end %>
|
||||
@ -0,0 +1,72 @@
|
||||
<% content_for "header" do %>
|
||||
<title><%= translate(locale, "Token manager") %> - Invidious</title>
|
||||
<% end %>
|
||||
|
||||
<div class="pure-g h-box">
|
||||
<div class="pure-u-1-3">
|
||||
<h3>
|
||||
<%= translate(locale, "`x` tokens", %(<span id="count">#{tokens.size}</span>)) %>
|
||||
</h3>
|
||||
</div>
|
||||
<div class="pure-u-1-3"></div>
|
||||
<div class="pure-u-1-3" style="text-align:right">
|
||||
<h3>
|
||||
<a href="/preferences?referer=<%= referer %>"><%= translate(locale, "Preferences") %></a>
|
||||
</h3>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% tokens.each do |token| %>
|
||||
<div class="h-box">
|
||||
<div class="pure-g<% if token[:session] == sid %> deleted <% end %>">
|
||||
<div class="pure-u-3-5">
|
||||
<h4 style="padding-left:0.5em">
|
||||
<code><%= token[:session] %></code>
|
||||
</h4>
|
||||
</div>
|
||||
<div class="pure-u-1-5" style="text-align:center">
|
||||
<h4><%= translate(locale, "`x` ago", recode_date(token[:issued], locale)) %></h4>
|
||||
</div>
|
||||
<div class="pure-u-1-5" style="text-align:right">
|
||||
<h3 style="padding-right:0.5em">
|
||||
<form onsubmit="return false" action="/token_ajax?action_revoke_token=1&session=<%= token[:session] %>&referer=<%= env.get("current_page") %>" method="post">
|
||||
<input type="hidden" name="csrf_token" value="<%= URI.escape(env.get?("csrf_token").try &.as(String) || "") %>">
|
||||
<a onclick="revoke_token(this)" data-session="<%= token[:session] %>" href="#">
|
||||
<input style="all:unset" type="submit" value="<%= translate(locale, "revoke") %>">
|
||||
</a>
|
||||
</form>
|
||||
</h3>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<% if tokens[-1].try &.[:session]? != token[:session] %>
|
||||
<hr>
|
||||
<% end %>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<script>
|
||||
function revoke_token(target) {
|
||||
var row = target.parentNode.parentNode.parentNode.parentNode.parentNode;
|
||||
row.style.display = "none";
|
||||
var count = document.getElementById("count")
|
||||
count.innerText = count.innerText - 1;
|
||||
|
||||
var url = "/token_ajax?action_revoke_token=1&redirect=false&referer=<%= env.get("current_page") %>&session=" + target.getAttribute("data-session");
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.responseType = "json";
|
||||
xhr.timeout = 20000;
|
||||
xhr.open("POST", url, true);
|
||||
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
xhr.send("csrf_token=<%= URI.escape(env.get?("csrf_token").try &.as(String) || "") %>");
|
||||
|
||||
xhr.onreadystatechange = function() {
|
||||
if (xhr.readyState == 4) {
|
||||
if (xhr.status != 200) {
|
||||
count.innerText = count.innerText - 1 + 2;
|
||||
row.style.display = "";
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
</script>
|
||||
Loading…
Reference in New Issue