✨ Added GitHub and Google OAuth

2022-06-11 16:48:24 +02:00
parent 7e12c05a9a
commit 39dce66b78
13 changed files with 480 additions and 63 deletions
@@ -0,0 +1,6 @@
+from fastapi import APIRouter
+from classquiz.oauth import google, github
+
+router = APIRouter()
+router.include_router(google.router, prefix="/google")
+router.include_router(github.router, prefix="/github")
@@ -0,0 +1,70 @@
+from classquiz.db.models import User, UserSession
+from fastapi import Response, Request, HTTPException
+import os
+import uuid
+from classquiz.config import settings, redis
+from datetime import timedelta, datetime
+from classquiz.auth import create_access_token
+
+settings = settings()
+
+
+async def log_user_in(user: User, request: Request, response: Response):
+    print(user)
+    if user is None:
+        raise HTTPException(status_code=401, detail="User not matched!")
+    remote_ip = None
+    if request.headers.get("X-Forwarded-For") is None:
+        remote_ip = request.client.host
+
+    else:
+        if "," in request.headers.get("X-Forwarded-For"):
+            remote_ip = request.headers.get("X-Forwarded-For").split(", ")[0]
+        else:
+            remote_ip = request.headers.get("X-Forwarded-For")
+    session_key = os.urandom(32).hex()
+    user_session = UserSession(
+        user=user,
+        session_key=session_key,
+        ip_address=remote_ip,
+        user_agent=request.headers.get("User-Agent"),
+        id=uuid.uuid4(),
+    )
+    await user_session.save()
+    # await user_session.save()
+    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes)
+    access_token = create_access_token(data={"sub": user.email}, expires_delta=access_token_expires)
+    await redis.set(access_token, user.email, ex=settings.access_token_expire_minutes * 60)
+    response.set_cookie(
+        key="access_token",
+        value=f"Bearer {access_token}",
+        httponly=True,
+        samesite="lax",
+        max_age=settings.access_token_expire_minutes * 60,
+    )
+    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
+    response.set_cookie(key="rememberme", value="", max_age=60 * 60 * 24 * 365)
+    response.set_cookie(
+        key="rememberme_token", value=session_key, httponly=True, samesite="lax", max_age=60 * 60 * 24 * 365
+    )
+    return {"access_token": access_token, "token_type": "bearer"}
+
+
+async def rememberme_check(rememberme_token: str, response: Response):
+    user_session: UserSession | None = (
+        await UserSession.objects.filter(session_key=rememberme_token).select_related(UserSession.user).get_or_none()
+    )
+    if (user_session is None) or (user_session.user is None):
+        raise HTTPException(status_code=401, detail="No user session")
+    access_token_expires = timedelta(minutes=settings.access_token_expire_minutes * 60)
+    access_token = create_access_token(data={"sub": user_session.user.email}, expires_delta=access_token_expires)
+    response.set_cookie(
+        key="access_token",
+        value=f"Bearer {access_token}",
+        httponly=True,
+        samesite="lax",
+        max_age=settings.access_token_expire_minutes * 60,
+    )
+    response.set_cookie(key="expiry", value="", max_age=settings.access_token_expire_minutes * 60)
+    response.status_code = 200
+    await user_session.update(last_seen=datetime.now())
@@ -0,0 +1,123 @@
+from fastapi import APIRouter, Request, HTTPException, Response
+from classquiz.config import settings
+
+from authlib.integrations.starlette_client import OAuth
+from classquiz.db.models import User, UserAuthTypes
+from pydantic import BaseModel, ValidationError
+from classquiz.auth import check_token, credentials_exception
+from classquiz.oauth.authenticate_user import log_user_in, rememberme_check
+from datetime import datetime
+
+settings = settings()
+
+router = APIRouter()
+oauth = OAuth()
+oauth.register(
+    name="github",
+    client_kwargs={"scope": "read:user user:email"},
+    access_token_url="https://github.com/login/oauth/access_token",
+    access_token_params=None,
+    authorize_url="https://github.com/login/oauth/authorize",
+    authorize_params=None,
+    api_base_url="https://api.github.com/",
+    client_id=settings.github_client_id,
+    client_secret=settings.github_client_secret,
+)
+
+
+class Plan(BaseModel):
+    name: str
+    space: int
+    collaborators: int
+    private_repos: int
+
+
+class GitHubOauthResponse(BaseModel):
+    login: str
+    id: int
+    node_id: str
+    avatar_url: str
+    gravatar_id: str
+    url: str
+    html_url: str
+    followers_url: str
+    following_url: str
+    gists_url: str
+    starred_url: str
+    subscriptions_url: str
+    organizations_url: str
+    repos_url: str
+    events_url: str
+    received_events_url: str
+    type: str
+    site_admin: bool
+    name: str
+    company: None
+    blog: str
+    location: str
+    email: str
+    hireable: None
+    bio: str
+    twitter_username: str
+    public_repos: int
+    public_gists: int
+    followers: int
+    following: int
+    created_at: datetime
+    updated_at: datetime
+    private_gists: int
+    total_private_repos: int
+    owned_private_repos: int
+    disk_usage: int
+    collaborators: int
+    two_factor_authentication: bool
+    plan: Plan
+
+
+@router.get("/login")
+async def github_login(req: Request):
+    if settings.github_client_id is None or settings.github_client_secret is None:
+        raise HTTPException(status_code=501, detail="GitHub-Login isn't available on this server")
+    return await oauth.github.authorize_redirect(req, f"{settings.root_address}/api/v1/users/oauth/github/auth")
+
+
+@router.get("/auth")
+async def auth(request: Request, response: Response):
+    if settings.github_client_id is None or settings.github_client_secret is None:
+        raise HTTPException(status_code=501, detail="GitHub-Login isn't available on this server")
+    access_token = request.cookies.get("access_token")
+    rememberme_token = request.cookies.get("rememberme_token")
+    print(access_token, rememberme_token)
+    if access_token is not None:
+        try:
+            data = await check_token(access_token)
+            if data is not None:
+                return
+        except:
+            pass
+    if rememberme_token is not None:
+        return await rememberme_check(rememberme_token=rememberme_token, response=response)
+    try:
+        token = await oauth.github.authorize_access_token(request)
+    except:
+        raise HTTPException(status_code=401, detail="OAuth didn't work!")
+    resp = await oauth.github.get("user", token=token)
+    user_data = GitHubOauthResponse(**resp.json())
+    user_in_db = await User.objects.get_or_none(email=user_data.email)
+    if user_in_db is None:
+        # REGISTER USER
+        create_user = User(
+            email=user_data.email,
+            username=user_data.login,
+            verified=True,
+            auth_type=UserAuthTypes.GITHUB,
+        )
+        try:
+            await create_user.save()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=str(e))
+    user = await User.objects.get_or_none(
+        email=user_data.email, username=user_data.login, auth_type=UserAuthTypes.GITHUB, verified=True
+    )
+
+    return await log_user_in(user=user, request=request, response=response)
@@ -0,0 +1,100 @@
+from fastapi import APIRouter, Request, HTTPException, Response
+from classquiz.config import settings
+
+from authlib.integrations.starlette_client import OAuth
+from classquiz.db.models import User, UserAuthTypes
+from pydantic import BaseModel, ValidationError
+from classquiz.auth import check_token, credentials_exception
+from classquiz.oauth.authenticate_user import log_user_in, rememberme_check
+
+settings = settings()
+
+router = APIRouter()
+oauth = OAuth()
+oauth.register(
+    name="github",
+    server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
+    client_kwargs={"scope": "openid email profile"},
+    client_id=settings.google_client_id,
+    client_secret=settings.google_client_secret,
+)
+
+
+class Userinfo(BaseModel):
+    iss: str
+    azp: str
+    aud: str
+    sub: str
+    email: str
+    email_verified: bool
+    at_hash: str
+    nonce: str
+    name: str
+    picture: str
+    given_name: str
+    locale: str
+    iat: int
+    exp: int
+
+
+class OauthGoogleResponse(BaseModel):
+    access_token: str
+    expires_in: int
+    scope: str
+    token_type: str
+    id_token: str
+    expires_at: int
+    userinfo: Userinfo
+
+
+@router.get("/login")
+async def google_login(req: Request):
+    if settings.google_client_secret is None or settings.google_client_id is None:
+        raise HTTPException(status_code=501, detail="Google-Login isn't available on this server")
+    return await oauth.google.authorize_redirect(req, f"{settings.root_address}/api/v1/users/oauth/google/auth")
+
+
+@router.get("/auth")
+async def auth(request: Request, response: Response):
+    if settings.google_client_secret is None or settings.google_client_id is None:
+        raise HTTPException(status_code=501, detail="Google-Login isn't available on this server")
+    access_token = request.cookies.get("access_token")
+    rememberme_token = request.cookies.get("rememberme_token")
+    print(rememberme_token, access_token)
+    if access_token is not None:
+        try:
+            data = await check_token(access_token)
+            if data is not None:
+                return
+        except:
+            pass
+    if rememberme_token is not None:
+        return await rememberme_check(rememberme_token=rememberme_token, response=response)
+
+    try:
+        user_data = await oauth.google.authorize_access_token(request)
+    except:
+        raise HTTPException(status_code=401, detail="OAuth didn't work!")
+    try:
+        user_data = OauthGoogleResponse(**user_data).userinfo
+    except (TypeError, ValidationError):
+        raise HTTPException(status_code=401, detail="Something went wrong.")
+    user_in_db = await User.objects.get_or_none(email=user_data.email)
+    if user_in_db is None:
+        # REGISTER USER
+        create_user = User(
+            email=user_data.email,
+            username=user_data.name,
+            verified=user_data.email_verified,
+            auth_type=UserAuthTypes.GOOGLE,
+            google_uid=user_data.sub,
+        )
+        try:
+            await create_user.save()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=str(e))
+    user = await User.objects.get_or_none(
+        email=user_data.email, google_uid=user_data.sub, auth_type=UserAuthTypes.GOOGLE, verified=True
+    )
+
+    return await log_user_in(user=user, request=request, response=response)