✨ Added GitHub and Google OAuth

2022-06-11 16:48:24 +02:00
parent 7e12c05a9a
commit 39dce66b78
13 changed files with 480 additions and 63 deletions
@@ -2,6 +2,7 @@ import sentry_sdk
 from fastapi import FastAPI, Request
 from sentry_sdk.integrations.redis import RedisIntegration
 from socketio import ASGIApp
+from starlette.middleware.sessions import SessionMiddleware

 from classquiz.config import settings, meilisearch
 from classquiz.db import database
@@ -42,6 +43,7 @@ async def shutdown() -> None:
        await database_.disconnect()


+app.add_middleware(SessionMiddleware, secret_key=settings.secret_key)
 app.include_router(users.router, tags=["users"], prefix="/api/v1/users")
 app.include_router(quiz.router, tags=["quiz"], prefix="/api/v1/quiz")
 app.include_router(utils.router, tags=["utils"], prefix="/api/v1/utils")
@@ -3,6 +3,7 @@ from functools import lru_cache
 import redis.asyncio as redis_lib
 from pydantic import BaseSettings, RedisDsn, PostgresDsn
 import meilisearch as MeiliSearch
+from typing import Optional

 from classquiz.storage import Storage

@@ -28,6 +29,10 @@ class Settings(BaseSettings):
    sentry_dsn: str | None
    meilisearch_url: str
    meilisearch_index: str = "classquiz"
+    google_client_id: Optional[str]
+    google_client_secret: Optional[str]
+    github_client_id: Optional[str]
+    github_client_secret: Optional[str]

    # storage_backend
    storage_backend: str | None = "deta"
@@ -4,10 +4,16 @@ from typing import Optional

 import ormar
 from pydantic import BaseModel, Json
-
+from enum import Enum
 from . import metadata, database


+class UserAuthTypes(Enum):
+    LOCAL = "LOCAL"
+    GOOGLE = "GOOGLE"
+    GITHUB = "GITHUB"
+
+
 class User(ormar.Model):
    """
    The user model in the database
@@ -16,16 +22,21 @@ class User(ormar.Model):
    id: uuid.UUID = ormar.UUID(primary_key=True, default=uuid.uuid4())
    email: str = ormar.String(unique=True, max_length=100)
    username: str = ormar.String(unique=True, max_length=100)
-    password: str = ormar.String(unique=True, max_length=100)
+    password: Optional[str] = ormar.String(max_length=100, nullable=True)
    verified: bool = ormar.Boolean(default=False)
    verify_key: str = ormar.String(unique=True, max_length=100, nullable=True)
    created_at: datetime = ormar.DateTime(default=datetime.now())
+    auth_type: UserAuthTypes = ormar.Enum(enum_class=UserAuthTypes, default=UserAuthTypes.LOCAL)
+    google_uid: Optional[str] = ormar.String(unique=True, max_length=255, nullable=True)

    class Meta:
        tablename = "users"
        metadata = metadata
        database = database

+    class Config:
+        use_enum_values = True
+

 class UserSession(ormar.Model):
    """
@@ -0,0 +1,6 @@
+from fastapi import APIRouter
+from classquiz.oauth import google, github
+
+router = APIRouter()
+router.include_router(google.router, prefix="/google")
+router.include_router(github.router, prefix="/github")
@@ -0,0 +1,70 @@
+from classquiz.db.models import User, UserSession
+from fastapi import Response, Request, HTTPException
+import os
+import uuid
+from classquiz.config import settings, redis
+from datetime import timedelta, datetime
+from classquiz.auth import create_access_token
+
+settings = settings()
+
+
+async def log_user_in(user: User, request: Request, response: Response):
+    print(user)
+    if user is None:
+        raise HTTPException(status_code=401, detail="User not matched!")
+    remote_ip = None
+    if request.headers.get("X-Forwarded-For") is None:
+        remote_ip = request.client.host
+
+    else:
+        if "," in request.headers.get("X-Forwarded-For"):
+            remote_ip = request.headers.get("X-Forwarded-For").split(", ")[0]
+        else:
+            remote_ip = request.headers.get("X-Forwarded-For")
+    session_key = os.urandom(32).hex()
+    user_session = UserSession(
+        user=user,
+        session_key=session_key,
+        ip_address=remote_ip,
+        user_agent=request.headers.get("User-Agent"),
+        id=uuid.uuid4(),
+    )
+    await user_session.save()
+    # await user_session.save()
+    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes)
+    access_token = create_access_token(data={"sub": user.email}, expires_delta=access_token_expires)
+    await redis.set(access_token, user.email, ex=settings.access_token_expire_minutes * 60)
+    response.set_cookie(
+        key="access_token",
+        value=f"Bearer {access_token}",
+        httponly=True,
+        samesite="lax",
+        max_age=settings.access_token_expire_minutes * 60,
+    )
+    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
+    response.set_cookie(key="rememberme", value="", max_age=60 * 60 * 24 * 365)
+    response.set_cookie(
+        key="rememberme_token", value=session_key, httponly=True, samesite="lax", max_age=60 * 60 * 24 * 365
+    )
+    return {"access_token": access_token, "token_type": "bearer"}
+
+
+async def rememberme_check(rememberme_token: str, response: Response):
+    user_session: UserSession | None = (
+        await UserSession.objects.filter(session_key=rememberme_token).select_related(UserSession.user).get_or_none()
+    )
+    if (user_session is None) or (user_session.user is None):
+        raise HTTPException(status_code=401, detail="No user session")
+    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes * 60)
+    access_token = create_access_token(data={"sub": user_session.user.email}, expires_delta=access_token_expires)
+    response.set_cookie(
+        key="access_token",
+        value=f"Bearer {access_token}",
+        httponly=True,
+        samesite="lax",
+        max_age=settings.access_token_expire_minutes * 60,
+    )
+    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
+    response.status_code = 200
+    await user_session.update(last_seen=datetime.now())
@@ -0,0 +1,123 @@
+from fastapi import APIRouter, Request, HTTPException, Response
+from classquiz.config import settings
+
+from authlib.integrations.starlette_client import OAuth
+from classquiz.db.models import User, UserAuthTypes
+from pydantic import BaseModel, ValidationError
+from classquiz.auth import check_token, credentials_exception
+from classquiz.oauth.authenticate_user import log_user_in, rememberme_check
+from datetime import datetime
+
+settings = settings()
+
+router = APIRouter()
+oauth = OAuth()
+oauth.register(
+    name="github",
+    client_kwargs={"scope": "read:user user:email"},
+    access_token_url="https://github.com/login/oauth/access_token",
+    access_token_params=None,
+    authorize_url="https://github.com/login/oauth/authorize",
+    authorize_params=None,
+    api_base_url="https://api.github.com/",
+    client_id=settings.github_client_id,
+    client_secret=settings.github_client_secret,
+)
+
+
+class Plan(BaseModel):
+    name: str
+    space: int
+    collaborators: int
+    private_repos: int
+
+
+class GitHubOauthResponse(BaseModel):
+    login: str
+    id: int
+    node_id: str
+    avatar_url: str
+    gravatar_id: str
+    url: str
+    html_url: str
+    followers_url: str
+    following_url: str
+    gists_url: str
+    starred_url: str
+    subscriptions_url: str
+    organizations_url: str
+    repos_url: str
+    events_url: str
+    received_events_url: str
+    type: str
+    site_admin: bool
+    name: str
+    company: None
+    blog: str
+    location: str
+    email: str
+    hireable: None
+    bio: str
+    twitter_username: str
+    public_repos: int
+    public_gists: int
+    followers: int
+    following: int
+    created_at: datetime
+    updated_at: datetime
+    private_gists: int
+    total_private_repos: int
+    owned_private_repos: int
+    disk_usage: int
+    collaborators: int
+    two_factor_authentication: bool
+    plan: Plan
+
+
+@router.get("/login")
+async def github_login(req: Request):
+    if settings.github_client_id is None or settings.github_client_secret is None:
+        raise HTTPException(status_code=501, detail="GitHub-Login isn't available on this server")
+    return await oauth.github.authorize_redirect(req, f"{settings.root_address}/api/v1/users/oauth/github/auth")
+
+
+@router.get("/auth")
+async def auth(request: Request, response: Response):
+    if settings.github_client_id is None or settings.github_client_secret is None:
+        raise HTTPException(status_code=501, detail="GitHub-Login isn't available on this server")
+    access_token = request.cookies.get("access_token")
+    rememberme_token = request.cookies.get("rememberme_token")
+    print(access_token, rememberme_token)
+    if access_token is not None:
+        try:
+            data = await check_token(access_token)
+            if data is not None:
+                return
+        except:
+            pass
+    if rememberme_token is not None:
+        return await rememberme_check(rememberme_token=rememberme_token, response=response)
+    try:
+        token = await oauth.github.authorize_access_token(request)
+    except:
+        raise HTTPException(status_code=401, detail="OAuth didn't work!")
+    resp = await oauth.github.get("user", token=token)
+    user_data = GitHubOauthResponse(**resp.json())
+    user_in_db = await User.objects.get_or_none(email=user_data.email)
+    if user_in_db is None:
+        # REGISTER USER
+        create_user = User(
+            email=user_data.email,
+            username=user_data.login,
+            verified=True,
+            auth_type=UserAuthTypes.GITHUB,
+        )
+        try:
+            await create_user.save()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=str(e))
+    user = await User.objects.get_or_none(
+        email=user_data.email, username=user_data.login, auth_type=UserAuthTypes.GITHUB, verified=True
+    )
+
+    return await log_user_in(user=user, request=request, response=response)
@@ -0,0 +1,100 @@
+from fastapi import APIRouter, Request, HTTPException, Response
+from classquiz.config import settings
+
+from authlib.integrations.starlette_client import OAuth
+from classquiz.db.models import User, UserAuthTypes
+from pydantic import BaseModel, ValidationError
+from classquiz.auth import check_token, credentials_exception
+from classquiz.oauth.authenticate_user import log_user_in, rememberme_check
+
+settings = settings()
+
+router = APIRouter()
+oauth = OAuth()
+oauth.register(
+    name="github",
+    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
+    client_kwargs={"scope": "openid email profile"},
+    client_id=settings.google_client_id,
+    client_secret=settings.google_client_secret,
+)
+
+
+class Userinfo(BaseModel):
+    iss: str
+    azp: str
+    aud: str
+    sub: str
+    email: str
+    email_verified: bool
+    at_hash: str
+    nonce: str
+    name: str
+    picture: str
+    given_name: str
+    locale: str
+    iat: int
+    exp: int
+
+
+class OauthGoogleResponse(BaseModel):
+    access_token: str
+    expires_in: int
+    scope: str
+    token_type: str
+    id_token: str
+    expires_at: int
+    userinfo: Userinfo
+
+
+@router.get("/login")
+async def google_login(req: Request):
+    if settings.google_client_secret is None or settings.google_client_id is None:
+        raise HTTPException(status_code=501, detail="Google-Login isn't available on this server")
+    return await oauth.google.authorize_redirect(req, f"{settings.root_address}/api/v1/users/oauth/google/auth")
+
+
+@router.get("/auth")
+async def auth(request: Request, response: Response):
+    if settings.google_client_secret is None or settings.google_client_id is None:
+        raise HTTPException(status_code=501, detail="Google-Login isn't available on this server")
+    access_token = request.cookies.get("access_token")
+    rememberme_token = request.cookies.get("rememberme_token")
+    print(rememberme_token, access_token)
+    if access_token is not None:
+        try:
+            data = await check_token(access_token)
+            if data is not None:
+                return
+        except:
+            pass
+    if rememberme_token is not None:
+        return await rememberme_check(rememberme_token=rememberme_token, response=response)
+
+    try:
+        user_data = await oauth.google.authorize_access_token(request)
+    except:
+        raise HTTPException(status_code=401, detail="OAuth didn't work!")
+    try:
+        user_data = OauthGoogleResponse(**user_data).userinfo
+    except (TypeError, ValidationError):
+        raise HTTPException(status_code=401, detail="Something went wrong.")
+    user_in_db = await User.objects.get_or_none(email=user_data.email)
+    if user_in_db is None:
+        # REGISTER USER
+        create_user = User(
+            email=user_data.email,
+            username=user_data.name,
+            verified=user_data.email_verified,
+            auth_type=UserAuthTypes.GOOGLE,
+            google_uid=user_data.sub,
+        )
+        try:
+            await create_user.save()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=str(e))
+    user = await User.objects.get_or_none(
+        email=user_data.email, google_uid=user_data.sub, auth_type=UserAuthTypes.GOOGLE, verified=True
+    )
+
+    return await log_user_in(user=user, request=request, response=response)
@@ -8,6 +8,8 @@ from fastapi.background import BackgroundTasks
 from fastapi.responses import JSONResponse, RedirectResponse
 from fastapi.security import OAuth2PasswordRequestForm
 import html
+from classquiz import oauth
+from classquiz.oauth.authenticate_user import rememberme_check, log_user_in

 from classquiz.auth import (
    get_password_hash,
@@ -37,9 +39,12 @@ async def _sign_out_everywhere(user: User) -> None:
    await clear_cache_for_account(user)


+router.include_router(oauth.router, tags=["users", "oauth"], prefix="/oauth")
+
+
@router.post(
    "/create",
-    response_model=User,
+    # response_model=User,
    response_model_include={"id": ..., "verified": ..., "email": ...},
 )
 async def create_user(user: route_user, background_task: BackgroundTasks) -> User | JSONResponse:
@@ -77,41 +82,7 @@ async def login_for_cookie_access_token(
            detail="Incorrect username or password",
        )

-    remote_ip = None
-    if request.headers.get("X-Forwarded-For") is None:
-        remote_ip = request.client.host
-
-    else:
-        if "," in request.headers.get("X-Forwarded-For"):
-            remote_ip = request.headers.get("X-Forwarded-For").split(", ")[0]
-        else:
-            remote_ip = request.headers.get("X-Forwarded-For")
-    session_key = os.urandom(32).hex()
-    user_session = UserSession(
-        user=user,
-        session_key=session_key,
-        ip_address=remote_ip,
-        user_agent=request.headers.get("User-Agent"),
-        id=uuid.uuid4(),
-    )
-    await user_session.save()
-    # await user_session.save()
-    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes)
-    access_token = create_access_token(data={"sub": user.email}, expires_delta=access_token_expires)
-    await redis.set(access_token, user.email, ex=settings.access_token_expire_minutes * 60)
-    response.set_cookie(
-        key="access_token",
-        value=f"Bearer {access_token}",
-        httponly=True,
-        samesite="strict",
-        max_age=settings.access_token_expire_minutes * 60,
-    )
-    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
-    response.set_cookie(key="rememberme", value="", max_age=60 * 60 * 24 * 365)
-    response.set_cookie(
-        key="rememberme_token", value=session_key, httponly=True, samesite="strict", max_age=60 * 60 * 24 * 365
-    )
-    return {"access_token": access_token, "token_type": "bearer"}
+    return await log_user_in(response=response, request=request, user=user)


@router.get("/token/rememberme")
@@ -119,26 +90,7 @@ async def rememberme_token(request: Request, response: Response):
    rememberme_token_lol = request.cookies.get("rememberme_token")
    if rememberme_token_lol is None:
        raise HTTPException(status_code=400, detail="No rememberme cookie")
-    user_session: UserSession | None = (
-        await UserSession.objects.filter(session_key=rememberme_token_lol)
-        .select_related(UserSession.user)
-        .get_or_none()
-    )
-    if (user_session is None) or (user_session.user is None):
-        raise HTTPException(status_code=401, detail="No user session")
-    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes * 60)
-    access_token = create_access_token(data={"sub": user_session.user.email}, expires_delta=access_token_expires)
-    response.set_cookie(
-        key="access_token",
-        value=f"Bearer {access_token}",
-        httponly=True,
-        samesite="strict",
-        max_age=settings.access_token_expire_minutes * 60,
-    )
-    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
-    response.status_code = 200
-    await user_session.update(last_seen=datetime.now())
-    return response
+    return await rememberme_check(rememberme_token=rememberme_token_lol, response=response)


@router.get("/logout")