Commit d21a0904 authored by Grégor JOUET's avatar Grégor JOUET 🔧
Browse files

fixed jwt

parent 2d6b18af
Loading
Loading
Loading
Loading

back/myfab/__init__.py

0 → 100644
+0 −0

Empty file added.

+148 B

File added.

No diff preview for this file type.

+30 −18
Original line number Diff line number Diff line
import myfab.log as log
from flask import Flask, request
from flask_jwt import JWT, jwt_required, current_identity
from flask_jwt_extended import (
    JWTManager, jwt_required, create_refresh_token, get_raw_jwt,
    current_user
)

from myfab.model import *
from flask_api import status
from flask import jsonify
import string
import os

init_db_connection()

app = Flask(__name__)
app.debug = True
app.config['SECRET_KEY'] = 'super-secret' #! CHANGEME
app.config['JWT_IDENTITY_CLAIM'] = "login_name"

FILE_SAVE_PATH = "./files"

def identity(payload):
    return get_or_create_user(payload['login_name'])

jwt = JWT(app, None, identity)

jwt = JWTManager(app)

@jwt.user_loader_callback_loader
def identity(payload):
    payload = get_raw_jwt()
    return get_or_create_user(payload['login_name'], payload['firstname'] + ' '+ payload['lastname'])
### ENUMS ###

REQUEST_STATUS_PENDING_REVIEW = 0
@@ -67,8 +74,8 @@ def loop_requests(reqs):
            stl: req.stl,
            status: req.status,
            project: req.project,
            operator: req.operator.username if req.operator is not None else ""        
            queue: req.queue.name if req.queue is not None else ""
            operator: req.operator.username if req.operator is not None else "",        
            queue: req.queue.name if req.queue is not None else "",
            recup: req.recup_id
        })

@@ -78,14 +85,19 @@ def get_access_level_to_request(req, user):

#### ROUTES ####

@app.route("/whoami")
@jwt_required
def whoami():
    return jsonify({'username': current_user.username, 'fullname': current_user.fullname, 'access': current_user.access})

@app.route("/requests/my")
@jwt_required()
@jwt_required
def get_my_requests():
    return jsonify(loop_requests(lookup_requests(current_identity.username)))
    return jsonify(loop_requests(lookup_requests(current_user.username)))
    

@app.route("/requests/new", methods=['POST'])
@jwt_required()
@jwt_required
def add_new_request():
    data = request.get_json()
    if not 'title' in data or data['title'] == "":
@@ -97,17 +109,17 @@ def add_new_request():
        
    req = PrintRequest.create(title = data['title'],
                             description = data['description'],
                             author = current_identity,
                             author = current_user,
                             project = data['project'])
    log.info("Created print request '%s' by user %s (%s)"%(req.title, current_identity.username, current_identity.fullname))
    log.info("Created print request '%s' by user %s (%s)"%(req.title, current_user.username, current_user.fullname))
    add_request_event(req, "Request created")

    return jsonify({
        request_id = req.id
        request_id: req.id
    })

@app.route("/files/<kind>/upload/<req_id>", method=['POST'])
@jwt_required()
@app.route("/files/<kind>/upload/<req_id>", methods=['POST'])
@jwt_required
def stl_upload(kind, req_id):
    if not kind in ['stl', 'gcode']:
        return jsonify({'error': 'Invalid file kind'}, status.HTTP_400_BAD_REQUEST)
@@ -117,7 +129,7 @@ def stl_upload(kind, req_id):
        return jsonify({'error': 'No such print request'}, status.HTTP_404_NOT_FOUND)
    required_access = REQUEST_ACCESS_USER if kind == "stl" else REQUEST_ACCESS_OPERATOR    

    if get_access_level_to_request(req_id, current_identity) < required_access:
    if get_access_level_to_request(req_id, current_user) < required_access:
        return jsonify({'error': 'Access denied'}, status.HTTP_401_UNAUTHORIZED)
    file = request.files['file']
    if file.filename == '':
@@ -132,7 +144,7 @@ def stl_upload(kind, req_id):
    return jsonify({'ok': True})

@app.route("/requests/list", methods=['POST'])
@jwt_required()
@jwt_required
def get_requests():
    params = request.get_json()
    if not 'username' in params:
Loading