97 lines
8.9 KiB
Plaintext
97 lines
8.9 KiB
Plaintext
|
a
|
|||
|
|
é¤Lj)2 ã @ sP d Z ddlZddlZddlZddlZddlmZmZ ddlmZ ddl m
|
|||
|
|
Z
|
|||
|
|
m Z m Z m
|
|||
|
|
Z
|
|||
|
|
mZ ddlmZ ddlmZmZ ddlZe
|
|||
|
|
dd gd
|
|||
|
|
�Zeje d d ¡ee d
|
|||
|
|
d¡ƒee dd¡ƒdd�ZdZdZdZ dZ G dd„ deƒZ G dd„ deƒZ G dd„ deƒZ G d d „ d eƒZ!G d d „ d eƒZ"G d d!„ d!eƒZ#e$d"œd#d$„Z%e$d"œd%d&„Z&e$d"œd'd(„Z'e
|
|||
|
|
e$d)œd*d+„Z(dJe$eee)d-œd.d/„Z*e$e$e$d0œd1d2„Z+e$e$e$d3œd4d5„Z,ej-d6e d7�e
|
|||
|
|
e d8œd9d:„ƒZ.ej-d;e!d7�e dƒfe
|
|||
|
|
e ee$ d<œd=d>„ƒZ/e 0d?¡e
|
|||
|
|
e$e$d@œdAdB„ƒZ1e -dC¡e dƒfe
|
|||
|
|
e#ee$ d<œdDdE„ƒZ2e -dF¡e$e$dGœdHdI„ƒZ3dS )KzS
|
|||
|
|
Passwordless authentication routes
|
|||
|
|
Handles cross-device login between app and web
|
|||
|
|
é N)ÚdatetimeÚ timedelta)ÚOptional)Ú APIRouterÚ
|
|||
|
|
HTTPExceptionÚHeaderÚRequestÚDepends)Ú JSONResponse)Ú BaseModelÚFieldz/auth/passwordlessÚ passwordless)ÚprefixZtagsZ
|
|||
|
|
REDIS_HOSTZ localhostZ
|
|||
|
|
REDIS_PORTië ZREDIS_DBT)ÚhostZportZdbZdecode_responsesi„ iÐ é
|
|||
|
|
é c @ sL e Zd ZU edd�Zeed< edd�Zee ed< edd�Z ee
|
|||
|
|
ed< dS )ÚInitiateRequestz
|
|||
|
|
web-dashboard)ÚdefaultÚ client_idú https://quixzoom.se/dashboardÚ redirect_urlNÚ device_info) Ú__name__Ú
|
|||
|
|
__module__Ú __qualname__r r ÚstrÚ__annotations__r r r Údict© r r úR/home/bernt/.openclaw/workspace/iom/quixzoom-auth-service/./routes/passwordless.pyr $ s
|
|||
|
|
r c @ s: e Zd ZU eed< eed< eed< eed< eZeed< dS )ÚInitiateResponseÚ
|
|||
|
|
session_idÚ
|
|||
|
|
request_tokenÚqr_dataÚ
|
|||
|
|
expires_atÚpoll_interval_msN)r r r r r ÚPOLL_INTERVAL_MSr% Úintr r r r r * s
|
|||
|
|
|
|||
|
|
r c @ s6 e Zd ZU eed< eed< eed< eed< eed< dS )ÚApproveRequestr! r" Z signatureÚ timestampÚapproving_device_idN©r r r r r r r r r r( 2 s
|
|||
|
|
|
|||
|
|
r( c @ s& e Zd ZU eed< eed< eed< dS )ÚApproveResponseÚstatusr! Ú approved_atNr+ r r r r r, : s
|
|||
|
|
r, c @ s~ e Zd ZU eed< eed< eed< eed< dZee ed< dZee ed< dZee ed< dZ ee ed < dZ
|
|||
|
|
ee ed
|
|||
|
|
< dS ) ÚStatusResponser- r! r" r$ Nr. Ú completed_atÚ access_tokenÚ
|
|||
|
|
refresh_tokenÚ
|
|||
|
|
error_message) r r r r r r. r r0 r1 r2 r3 r r r r r/ @ s
|
|||
|
|
r/ c @ s& e Zd ZU eed< eed< eed< dS )Ú
|
|||
|
|
RejectRequestr! r" Ú device_idNr+ r r r r r4 L s
|
|||
|
|
r4 )Úreturnc C s dt d¡› �S )zGenerate unique session IDZpls_é ©ÚsecretsÚ
|
|||
|
|
token_urlsafer r r r Úgenerate_session_idT s r; c C s
|
|||
|
|
t d¡S )z/Generate cryptographically secure request tokené r8 r r r r Úgenerate_request_tokenX s r= c C s
|
|||
|
|
t d¡S )z Generate nonce for challenger7 )r9 Z token_hexr r r r Úgenerate_nonce\ s r> )Úrequestr6 c C s4 | j d¡}|r"| d¡d ¡ S | jr0| jjS dS )z Extract client IP from requestzX-Forwarded-Forú,r Úunknown)ÚheadersÚgetÚsplitÚstripZclientr )r? Z forwardedr r r Ú
|
|||
|
|
get_client_ip` s rF é< )ÚkeyÚlimitÚwindowr6 c C sT t d| › �¡}|s,t d| › �|d¡ dS t|ƒ}||kr@dS t d| › �¡ dS )z Check if rate limit is exceededz
|
|||
|
|
ratelimit:é TF)Ú redis_clientrC Úsetexr' Zincr)rH rI rJ ZcurrentÚcountr r r Úcheck_rate_limitg s rO )r! r" r6 c C s d| › d|› �S )zCreate QR code data stringzquixzoom://auth?sid=z&token=r ©r! r" r r r Úcreate_qr_datau s rQ )Ú
|
|||
|
|
user_agentÚipr6 c C s | › d|› �}t | ¡ ¡ ¡ S )z!Create hash of device fingerprintú:)ÚhashlibZsha256ÚencodeZ hexdigest)rR rS Údatar r r Úhash_fingerprinty s rX z /initiate)Zresponse_model)r? Úbodyc
|
|||
|
|
à sð t | ƒ}| j dd¡}td|› �tƒs2tddd�‚tƒ }tƒ }tƒ }t
|
|||
|
|
d¡}t ¡ t
|
|||
|
|
td� }||||d |j|jpvd
|
|||
|
|
||t||ƒt ¡ ¡ | ¡ d œ } d |› �}
|
|||
|
|
tj|
|
|||
|
|
| d
|
|||
|
|
� t |
|
|||
|
|
t¡ t d|› �t|¡ t||t||ƒ| ¡ d td�S )zq
|
|||
|
|
Initiate a new passwordless authentication session.
|
|||
|
|
Returns session details including QR code data.
|
|||
|
|
ú
|
|||
|
|
User-AgentrA zip:i z*Too many requests. Please try again later.©Z status_codeZdetailr< )ZsecondsÚpendingr ) r! r" ÚnonceÚ challenger- r r Zweb_ipZweb_user_agentZweb_fingerprintÚ
|
|||
|
|
created_atr$ ú
|
|||
|
|
passwordless:©Úmappingzpasswordless_token:ÚZ)r! r" r# r$ r% )rF rB rC rO ÚRATE_LIMIT_PER_IPr r; r= r> r9 r: r Úutcnowr ÚSESSION_TTL_SECONDSr r rX Ú isoformatrL ÚhsetÚexpirerM r rQ r& ) r? rY Z client_iprR r! r" r] r^ r$ Ú session_dataÚ redis_keyr r r Úinitiate_passwordless� sP þ
|
|||
|
|
|
|||
|
|
ô
|
|||
|
|
ý
|
|||
|
|
ûrl z/approve)r? rY Ú
|
|||
|
|
authorizationc
|
|||
|
|
à sZ |r| d¡stddd�‚| dd¡}t|ƒdk r>tddd�‚d|j› �}t |¡}|sdtd d
|
|||
|
|
d�‚| d ¡|jkr€td d
|
|||
|
|
d�‚| d¡dkr¦tdd| d¡› �d�‚z:t
|
|||
|
|
|j dd¡¡}t ¡ | t
|
|||
|
|
dd�krÞtd dd�‚W n tyþ tddd�‚Y n0 t ¡ }tj|d| ¡ |jt| ƒ| j dd¡d œd � t |d ¡ td|j| ¡ d d �S ) zy
|
|||
|
|
Approve a passwordless authentication request from the app.
|
|||
|
|
Requires valid app JWT in Authorization header.
|
|||
|
|
úBearer é‘ z Missing or invalid authorizationr[ Ú r z
|
|||
|
|
Invalid tokenr` iš z Session not found or expiredr" é“ úInvalid request tokenr- r\ é™ zSession already rc z+00:00r )ZminuteszTimestamp too oldi� zInvalid timestamp formatÚapprovedrZ rA )r- r. r* Z device_ipZdevice_user_agentra i, )r- r! r. )Ú
|
|||
|
|
startswithr ÚreplaceÚlenr! rL ÚhgetallrC r" r Z
|
|||
|
|
fromisoformatr) re r Ú
|
|||
|
|
ValueErrorrh rg r* rF rB ri r, )r? rY rm Z app_tokenrk rj r) r. r r r Úapprove_passwordless¿ sH
|
|||
|
|
þ û
|
|||
|
|
|
|||
|
|
ýrz z/status)r? r! r" c
|
|||
|
|
à sH d|› �}t |¡}|s$tddd�‚| d¡|kr>tddd�‚| dd ¡}|||| d
|
|||
|
|
¡d œ}|d k�r| d
|
|||
|
|
¡|d
|
|||
|
|
< d}t d¡}t d¡} d|› �}
|
|||
|
|
t j|
|
|||
|
|
||t ¡ ¡ t
|
|||
|
|
| ƒ| j dd ¡dœd� t |
|
|||
|
|
d¡ t j|dt ¡ ¡ |dœd� |
|
|||
|
|
dt ¡ ¡ d || dœ¡ n&|dk�r(d|d< n|d k�r:d |d< tf i |¤ŽS ) zj
|
|||
|
|
Check the status of a passwordless authentication session.
|
|||
|
|
Called by web client via polling.
|
|||
|
|
r` é” úSession not foundr[ r" rq rr r- rA r$ )r- r! r" r$ rt r. Zuser_from_app_tokenr< z web_session:rZ )Úuser_idr! r_ rS rR ra i€Q Z completed)r- r0 Úweb_session_tokenrc )r- r0 r1 r2 Úrejectedz Authentication rejected by userr3 ZexpiredzSession expired)rL rx r rC r9 r: rh r re rg rF rB ri Úupdater/ ) r? r! r" rk rj r- Zresponser} r~ r2 Zweb_session_keyr r r Ú check_status sT
|
|||
|
|
|
|||
|
|
|
|||
|
|
ü
|
|||
|
|
|
|||
|
|
|