src/api/views.py

   1 # This file is part of Wolnelektury, licensed under GNU Affero GPLv3 or later.
   2 # Copyright © Fundacja Nowoczesna Polska. See NOTICE for more information.
   3 #
   4 from django.contrib.auth.decorators import login_required
   5 from django import forms
   6 from django.http import HttpResponse
   7 from django.http import Http404
   8 from django.shortcuts import render
   9 from django.views.generic.base import View
  10 from oauthlib.common import urlencode
  11 from oauthlib.oauth1 import RequestTokenEndpoint, AccessTokenEndpoint
  12 from oauthlib.oauth1 import AuthorizationEndpoint, OAuth1Error
  13 from rest_framework.permissions import IsAuthenticated
  14 from rest_framework.response import Response
  15 from rest_framework.views import APIView
  16 from rest_framework.generics import RetrieveAPIView, get_object_or_404
  17 from catalogue.models import Book
  18 from .models import BookUserData, KEY_SIZE, SECRET_SIZE
  19 from . import serializers
  20 from .request_validator import PistonRequestValidator
  21 from .utils import oauthlib_request, oauthlib_response, vary_on_auth
  22
  23
  24 class OAuth1RequestTokenEndpoint(RequestTokenEndpoint):
  25     def _create_request(self, *args, **kwargs):
  26         r = super(OAuth1RequestTokenEndpoint, self)._create_request(*args, **kwargs)
  27         r.redirect_uri = 'oob'
  28         return r
  29
  30     def create_request_token(self, request, credentials):
  31         token = {
  32             'oauth_token': self.token_generator()[:KEY_SIZE],
  33             'oauth_token_secret': self.token_generator()[:SECRET_SIZE],
  34         }
  35         token.update(credentials)
  36         self.request_validator.save_request_token(token, request)
  37         return urlencode(token.items())
  38
  39
  40 # Never Cache
  41 class OAuth1RequestTokenView(View):
  42     def __init__(self):
  43         self.endpoint = OAuth1RequestTokenEndpoint(PistonRequestValidator())
  44
  45     def dispatch(self, request):
  46         return oauthlib_response(
  47             self.endpoint.create_request_token_response(
  48                 **oauthlib_request(request)
  49             )
  50         )
  51
  52
  53 class OAuthAuthenticationForm(forms.Form):
  54     oauth_token = forms.CharField(widget=forms.HiddenInput)
  55     oauth_callback = forms.CharField(widget=forms.HiddenInput)  # changed from URLField - too strict
  56     # removed authorize_access - redundant
  57
  58
  59 class OAuth1AuthorizationEndpoint(AuthorizationEndpoint):
  60     def create_verifier(self, request, credentials):
  61         verifier = super(OAuth1AuthorizationEndpoint, self).create_verifier(request, credentials)
  62         return {
  63             'oauth_token': verifier['oauth_token'],
  64         }
  65
  66
  67 @login_required
  68 def oauth_user_auth(request):
  69     endpoint = OAuth1AuthorizationEndpoint(PistonRequestValidator())
  70
  71     if request.method == "GET":
  72         # Why not just get oauth_token here?
  73         # This is fairly straightforward, in't?
  74         try:
  75             realms, credentials = endpoint.get_realms_and_credentials(
  76                 **oauthlib_request(request))
  77         except OAuth1Error as e:
  78             return HttpResponse(str(e), status=400)
  79         callback = request.GET.get('oauth_callback')
  80
  81         form = OAuthAuthenticationForm(initial={
  82             'oauth_token': credentials['resource_owner_key'],
  83             'oauth_callback': callback,
  84         })
  85
  86         return render(request, 'oauth/authorize_token.html', {'form': form})
  87
  88     if request.method == "POST":
  89         try:
  90             response = oauthlib_response(
  91                 endpoint.create_authorization_response(
  92                     credentials={"user": request.user},
  93                     **oauthlib_request(request)
  94                 )
  95             )
  96         except OAuth1Error as e:
  97             return HttpResponse(e.message, status=400)
  98         else:
  99             return response
 100
 101
 102 class OAuth1AccessTokenEndpoint(AccessTokenEndpoint):
 103     def _create_request(self, *args, **kwargs):
 104         r = super(OAuth1AccessTokenEndpoint, self)._create_request(*args, **kwargs)
 105         r.verifier = 'x' * 20
 106         return r
 107
 108     def create_access_token(self, request, credentials):
 109         request.realms = self.request_validator.get_realms(
 110             request.resource_owner_key, request)
 111         token = {
 112             'oauth_token': self.token_generator()[:KEY_SIZE],
 113             'oauth_token_secret': self.token_generator()[:SECRET_SIZE],
 114             'oauth_authorized_realms': ' '.join(request.realms)
 115         }
 116         token.update(credentials)
 117         self.request_validator.save_access_token(token, request)
 118         return urlencode(token.items())
 119
 120
 121 # Never cache
 122 class OAuth1AccessTokenView(View):
 123     def __init__(self):
 124         self.endpoint = OAuth1AccessTokenEndpoint(PistonRequestValidator())
 125
 126     def dispatch(self, request):
 127         return oauthlib_response(
 128             self.endpoint.create_access_token_response(
 129                 **oauthlib_request(request)
 130             )
 131         )
 132
 133
 134 @vary_on_auth
 135 class UserView(RetrieveAPIView):
 136     permission_classes = [IsAuthenticated]
 137     serializer_class = serializers.UserSerializer
 138
 139     def get_object(self):
 140         return self.request.user
 141
 142
 143 @vary_on_auth
 144 class BookUserDataView(RetrieveAPIView):
 145     permission_classes = [IsAuthenticated]
 146     serializer_class = serializers.BookUserDataSerializer
 147     lookup_field = 'book__slug'
 148     lookup_url_kwarg = 'slug'
 149
 150     def get_queryset(self):
 151         return BookUserData.objects.filter(user=self.request.user)
 152
 153     def get(self, *args, **kwargs):
 154         try:
 155             return super(BookUserDataView, self).get(*args, **kwargs)
 156         except Http404:
 157             return Response({"state": "not_started"})
 158
 159     def post(self, request, slug, state):
 160         if state not in ('reading', 'complete'):
 161             raise Http404
 162
 163         book = get_object_or_404(Book, slug=slug)
 164         instance = BookUserData.update(book, request.user, state)
 165         serializer = self.get_serializer(instance)
 166         return Response(serializer.data)
 167
 168
 169 class BlogView(APIView):
 170     def get(self, request):
 171         return Response([])