Work in progress: bitbucket support

endpoints/oauthlogin.py

@@ -0,0 +1,238 @@
+import logging
+import requests
+
+from flask import request, redirect, url_for, Blueprint
+from flask.ext.login import current_user
+
+from endpoints.common import render_page_template, common_login, route_show_if
+from app import app, analytics, get_app_url, github_login, google_login
+from data import model
+from util.names import parse_repository_name
+from util.validation import generate_valid_usernames
+from util.http import abort
+from auth.auth import require_session_login
+from peewee import IntegrityError
+
+import features
+
+logger = logging.getLogger(__name__)
+client = app.config['HTTPCLIENT']
+oauthlogin = Blueprint('oauthlogin', __name__)
+
+def render_ologin_error(service_name,
+                        error_message='Could not load user data. The token may have expired.'):
+  return render_page_template('ologinerror.html', service_name=service_name,
+                              error_message=error_message,
+                              service_url=get_app_url(),
+                              user_creation=features.USER_CREATION)
+
+
+def get_user(service, token):
+  token_param = {
+    'access_token': token,
+    'alt': 'json',
+  }
+  get_user = client.get(service.user_endpoint(), params=token_param)
+  if get_user.status_code != requests.codes.ok:
+    return {}
+
+  return get_user.json()
+
+
+def conduct_oauth_login(service, user_id, username, email, metadata={}):
+  service_name = service.service_name()
+  to_login = model.verify_federated_login(service_name.lower(), user_id)
+  if not to_login:
+    # See if we can create a new user.
+    if not features.USER_CREATION:
+      error_message = 'User creation is disabled. Please contact your administrator'
+      return render_ologin_error(service_name, error_message)
+
+    # Try to create the user
+    try:
+      new_username = None
+      for valid in generate_valid_usernames(username):
+        if model.get_user_or_org(valid):
+          continue
+
+        new_username = valid
+        break
+
+      to_login = model.create_federated_user(new_username, email, service_name.lower(),
+                                             user_id, set_password_notification=True,
+                                             metadata=metadata)
+
+      # Success, tell analytics
+      analytics.track(to_login.username, 'register', {'service': service_name.lower()})
+
+      state = request.args.get('state', None)
+      if state:
+        logger.debug('Aliasing with state: %s' % state)
+        analytics.alias(to_login.username, state)
+
+    except model.InvalidEmailAddressException as ieex:
+      message = "The e-mail address %s is already associated " % (email, )
+      message = message + "with an existing %s account." % (app.config['REGISTRY_TITLE_SHORT'], )
+      message = message + "\nPlease log in with your username and password and "
+      message = message + "associate your %s account to use it in the future." % (service_name, )
+
+      return render_ologin_error(service_name, message)
+
+    except model.DataModelException as ex:
+      return render_ologin_error(service_name, ex.message)
+
+  if common_login(to_login):
+    return redirect(url_for('web.index'))
+
+  return render_ologin_error(service_name)
+
+def get_google_username(user_data):
+  username = user_data['email']
+  at = username.find('@')
+  if at > 0:
+    username = username[0:at]
+
+  return username
+
+
+@oauthlogin.route('/google/callback', methods=['GET'])
+@route_show_if(features.GOOGLE_LOGIN)
+def google_oauth_callback():
+  error = request.args.get('error', None)
+  if error:
+    return render_ologin_error('Google', error)
+
+  code = request.args.get('code')
+  token = google_login.exchange_code_for_token(app.config, client, code, form_encode=True)
+  user_data = get_user(google_login, token)
+  if not user_data or not user_data.get('id', None) or not user_data.get('email', None):
+    return render_ologin_error('Google')
+
+  username = get_google_username(user_data)
+  metadata = {
+    'service_username': user_data['email']
+  }
+
+  return conduct_oauth_login(google_login, user_data['id'], username, user_data['email'],
+                             metadata=metadata)
+
+
+@oauthlogin.route('/github/callback', methods=['GET'])
+@route_show_if(features.GITHUB_LOGIN)
+def github_oauth_callback():
+  error = request.args.get('error', None)
+  if error:
+    return render_ologin_error('GitHub', error)
+
+  # Exchange the OAuth code.
+  code = request.args.get('code')
+  token = google_login.exchange_code_for_token(app.config, client, code)
+
+  # Retrieve the user's information.
+  user_data = get_user(github_login, token)
+  if not user_data or not 'login' in user_data:
+    return render_ologin_error('GitHub')
+
+  username = user_data['login']
+  github_id = user_data['id']
+
+  v3_media_type = {
+    'Accept': 'application/vnd.github.v3'
+  }
+
+  token_param = {
+    'access_token': token,
+  }
+
+  # Retrieve the user's orgnizations (if organization filtering is turned on)
+  if github_login.allowed_organizations() is not None:
+    get_orgs = client.get(github_login.orgs_endpoint(), params=token_param,
+                           headers={'Accept': 'application/vnd.github.moondragon+json'})
+
+    organizations = set([org.get('login').lower() for org in get_orgs.json()])
+    if not (organizations & set(github_login.allowed_organizations())):
+      err = """You are not a member of an allowed GitHub organization.
+               Please contact your system administrator if you believe this is in error."""
+      return render_ologin_error('GitHub', err)
+
+  # Find the e-mail address for the user: we will accept any email, but we prefer the primary
+  get_email = client.get(github_login.email_endpoint(), params=token_param,
+                         headers=v3_media_type)
+
+  found_email = None
+  for user_email in get_email.json():
+    if not github_login.is_enterprise() and not user_email['verified']:
+      continue
+
+    found_email = user_email['email']
+    if user_email['primary']:
+      break
+
+  if found_email is None:
+    err = 'There is no verified e-mail address attached to the GitHub account.'
+    return render_ologin_error('GitHub', err)
+
+  metadata = {
+    'service_username': username
+  }
+
+  return conduct_oauth_login(github_login, github_id, username, found_email, metadata=metadata)
+
+
+@oauthlogin.route('/google/callback/attach', methods=['GET'])
+@route_show_if(features.GOOGLE_LOGIN)
+@require_session_login
+def google_oauth_attach():
+  code = request.args.get('code')
+  token = google_login.exchange_code_for_token(app.config, client, code,
+                                               redirect_suffix='/attach', form_encode=True)
+
+  user_data = get_user(google_login, token)
+  if not user_data or not user_data.get('id', None):
+    return render_ologin_error('Google')
+
+  google_id = user_data['id']
+  user_obj = current_user.db_user()
+
+  username = get_google_username(user_data)
+  metadata = {
+    'service_username': user_data['email']
+  }
+
+  try:
+    model.attach_federated_login(user_obj, 'google', google_id, metadata=metadata)
+  except IntegrityError:
+    err = 'Google account %s is already attached to a %s account' % (
+      username, app.config['REGISTRY_TITLE_SHORT'])
+    return render_ologin_error('Google', err)
+
+  return redirect(url_for('web.user'))
+
+
+@oauthlogin.route('/github/callback/attach', methods=['GET'])
+@route_show_if(features.GITHUB_LOGIN)
+@require_session_login
+def github_oauth_attach():
+  code = request.args.get('code')
+  token = google_login.exchange_code_for_token(app.config, client, code)
+  user_data = get_user(github_login, token)
+  if not user_data:
+    return render_ologin_error('GitHub')
+
+  github_id = user_data['id']
+  user_obj = current_user.db_user()
+
+  username = user_data['login']
+  metadata = {
+    'service_username': username
+  }
+
+  try:
+    model.attach_federated_login(user_obj, 'github', github_id, metadata=metadata)
+  except IntegrityError:
+    err = 'Github account %s is already attached to a %s account' % (
+      username, app.config['REGISTRY_TITLE_SHORT'])
+
+    return render_ologin_error('GitHub', err)
+
+  return redirect(url_for('web.user'))