1

# encoding: utf-8

     2

     3

import datetime

     4

import werkzeug

     5

import werkzeug.urls

     6

     7

import pvl.web

     8

import pvl.web.response

     9

    10

from pvl.login import pubtkt

    11

from pvl.web import urls, html

    12

    13

import logging; log = logging.getLogger('pvl.login.server')

    14

    15

class Handler (pvl.web.Handler) :

    16

    # Bootstrap

    17

    DOCTYPE = 'html'

    18

    HTML_XMLNS = None

    19

    HTML_LANG = 'en'

    20

    CSS = (

    21

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    22

    )

    23

    JS = (

    24

            '//code.jquery.com/jquery.js',

    25

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    26

    )

    27

    28

    def process_cookie (self) :

    29

        """

    30

            Reverse the urlencoding used for the cookie...

    31

        """

    32

    33

        log.debug("cookies: %s", self.request.cookies)

    34

    35

        cookie = self.request.cookies.get(self.app.cookie_name)

    36

    37

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    38

    39

        if cookie :

    40

            cookie = werkzeug.urls.url_unquote(cookie)

    41

    42

        log.debug("cookie decoded: %s", cookie)

    43

    44

        if cookie :

    45

            return self.app.load(cookie)

    46

    47

class Index (Handler) :

    48

    TITLE = u"Päivölä Network Login"

    49

    50

    pubtkt = None

    51

    cookie_error = None

    52

    53

    def process (self) :

    54

        try :

    55

            self.pubtkt = self.process_cookie()

    56

        except pubtkt.Error as ex :

    57

            self.cookie_error = ex

    58

    59

    def render_info (self) :

    60

        if self.cookie_error :

    61

            return (

    62

                    html.h2("Invalid cookie"),

    63

                    html.p(self.cookie_error),

    64

            )

    65

        elif self.pubtkt :

    66

            return (

    67

                    html.h2("Login: {pubtkt.uid}".format(pubtkt=self.pubtkt)),

    68

            )

    69

        else :

    70

            return (

    71

                    html.a(href=self.url(Login), title="Login")(html.h2("No login")),

    72

            )

    73

    74

    def render (self) :

    75

    76

        return html.div(class_='container')(

    77

                self.render_info(),

    78

        )

    79

    80

class Login (Handler) :

    81

    TITLE = "Login"

    82

    83

    STYLE = """

    84

form#login {

    85

    max-width:  50%;

    86

    padding:    1em;

    87

    margin:     0 auto;

    88

}

    89

    90

    """

    91

    92

    93

    auth_error = None

    94

    95

    def process (self) :

    96

        if self.request.method == 'POST' :

    97

            back = self.app.login_server

    98

            username = self.request.form.get('username')

    99

            password = self.request.form.get('username')

   100

   101

            if username and password :

   102

                # preprocess

   103

                username = username.strip().lower()

   104

   105

                try :

   106

                    pt = self.app.auth(username, password)

   107

   108

                except pubtkt.Error as ex :

   109

                    self.auth_errors = ex

   110

   111

                else :

   112

                    # browsers seem to be very particular about quoting ;'s in cookie values...

   113

                    # this follows PHP's setcookie() encoding...

   114

                    cookie = werkzeug.urls.url_quote(self.app.sign(pt))

   115

   116

                    # redirect with cookie

   117

                    response = pvl.web.response.redirect(back)

   118

   119

                    response.set_cookie(self.app.cookie_name, cookie,

   120

                        domain      = self.app.cookie_domain,

   121

                        secure      = self.app.cookie_secure,

   122

                        httponly    = self.app.cookie_httponly,

   123

                    )

   124

   125

                    return response

   126

   127

    def render (self) :

   128

        return html.div(class_='container')(

   129

            html.form(action=self.request.path, method='POST', id='login')(

   130

                html.fieldset(

   131

                    html.legend("Log in"),

   132

   133

                    html.div(class_='form-group')(

   134

                        html.label(for_='username', class_='sr-only')("Username"),

   135

                        html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=True),

   136

   137

                        html.label(for_='password', class_='sr-only')("Password"),

   138

                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=True),

   139

                    ),

   140

   141

                    html.button(type='submit', class_='btn btn-primary')("Login"),

   142

                )

   143

            )

   144

        )

   145

   146

class LoginApplication (pvl.web.Application) :

   147

    URLS = urls.Map((

   148

        urls.rule('/',              Index),

   149

        urls.rule('/login',         Login),

   150

    ))

   151

   152

    PUBLIC_KEY = 'etc/login/public.pem'

   153

    PRIVATE_KEY = 'etc/login/private.pem'

   154

   155

    login_server = 'https://login.test.paivola.fi/'

   156

    login_expire = datetime.timedelta(hours=1)

   157

   158

    cookie_name = 'auth_pubtkt'

   159

    cookie_domain = 'test.paivola.fi'

   160

    cookie_secure = True

   161

    cookie_httponly = True

   162

   163

    def __init__ (self, public_key=PUBLIC_KEY, private_key=PRIVATE_KEY, **opts) :

   164

        super(LoginApplication, self).__init__(**opts)

   165

   166

        self.server_keys = pubtkt.ServerKeys.config(

   167

                public_key  = public_key,

   168

                private_key = private_key,

   169

        )

   170

   171

    def load (self, cookie) :

   172

        """

   173

            Load a pubtkt from a cookie, and verify it.

   174

        """

   175

   176

        return pubtkt.PubTkt.load(cookie, self.server_keys.public)

   177

   178

    def auth (self, username, password) :

   179

        """

   180

            Perform authentication, returning a PubTkt, signed

   181

        """

   182

   183

        return pubtkt.PubTkt.new(username,

   184

                expiry  = self.login_expire,

   185

        )

   186

   187

    def sign (self, pubtkt) :

   188

        """

   189

            Create a cookie by signing the given pubtkt.

   190

        """

   191

   192

        return pubtkt.sign(self.server_keys.private)

   193