ownfoil 2.4.0.dev0__py3-none-any.whl

ownfoil/_app/auth.py

@@ -0,0 +1,370 @@
+from flask import Blueprint, render_template, redirect, url_for, request, jsonify
+from flask_login import login_user, login_required, logout_user, current_user
+from werkzeug.security import generate_password_hash, check_password_hash
+from functools import wraps
+from db import *
+from flask_login import LoginManager
+
+import logging
+import re
+
+# Retrieve main logger
+logger = logging.getLogger('main')
+
+def validate_password(password):
+    """
+    Validate password according to Basic Auth specifications and Tinfoil compatibility.
+    Rejects:
+    - Empty passwords
+    - Control characters (null, line breaks, etc.)
+    - Tinfoil forbidden characters: @ & / ? # =
+    - Non-UTF-8 characters
+    """
+    if not password:
+        return False, "Password cannot be empty"
+    
+    # Check for control characters (null, line breaks, etc.)
+    # This includes: null (\x00), tab (\x09), newline (\x0A), carriage return (\x0D), and other control chars
+    control_chars = r'[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]'
+    if re.search(control_chars, password):
+        return False, "Password contains invalid control characters"
+    
+    # Also check for tab, newline, and carriage return explicitly
+    if '\t' in password or '\n' in password or '\r' in password:
+        return False, "Password contains invalid control characters"
+    
+    # Check for Tinfoil forbidden characters
+    tinfoil_forbidden = r'[@&/?#=]'
+    if re.search(tinfoil_forbidden, password):
+        return False, "Password contains invalid characters. Please avoid: @ & / ? # ="
+    
+    # Check for UTF-8 encoding validity
+    try:
+        password.encode('utf-8')
+    except UnicodeEncodeError:
+        return False, "Password contains invalid UTF-8 characters"
+    
+    return True, "Password is valid"
+
+def validate_username(username):
+    """
+    Validate username according to Basic Auth specifications.
+    Rejects:
+    - Empty usernames
+    - Colons (:)
+    - Control characters (null, line breaks, etc.)
+    - Non-UTF-8 characters
+    """
+    if not username:
+        return False, "Username cannot be empty"
+    
+    # Check for colons (not allowed in Basic Auth usernames)
+    if ':' in username:
+        return False, "Username cannot contain colons (:)"
+    
+    # Check for control characters (null, line breaks, etc.)
+    control_chars = r'[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]'
+    if re.search(control_chars, username):
+        return False, "Username contains invalid control characters"
+    
+    # Also check for tab, newline, and carriage return explicitly
+    if '\t' in username or '\n' in username or '\r' in username:
+        return False, "Username contains invalid control characters"
+    
+    # Check for UTF-8 encoding validity
+    try:
+        username.encode('utf-8')
+    except UnicodeEncodeError:
+        return False, "Username contains invalid UTF-8 characters"
+    
+    return True, "Username is valid"
+
+def admin_account_created():
+    return len(User.query.filter_by(admin_access=True).all())
+
+def unauthorized_json():
+    response = login_manager.unauthorized()
+    resp = {
+        'success': False,
+        'status_code': response.status_code,
+        'location': response.location
+    }
+    return jsonify(resp)
+
+def access_required(access: str):
+    def _access_required(f):
+        @wraps(f)
+        def decorated_view(*args, **kwargs):
+            if not admin_account_created():
+                # Auth disabled, request ok
+                return f(*args, **kwargs)
+
+            if not current_user.is_authenticated:
+                # return unauthorized_json()
+                return login_manager.unauthorized()
+
+            if not current_user.has_access(access):
+                return 'Forbidden', 403
+            return f(*args, **kwargs)
+        return decorated_view
+    return _access_required
+
+
+def roles_required(roles: list, require_all=False):
+    def _roles_required(f):
+        @wraps(f)
+        def decorated_view(*args, **kwargs):
+            if not roles:
+                raise ValueError('Empty list used when requiring a role.')
+            if not current_user.is_authenticated:
+                return login_manager.unauthorized()
+            if require_all and not all(current_user.has_role(role) for role in roles):
+                return 'Forbidden', 403
+            elif not require_all and not any(current_user.has_role(role) for role in roles):
+                return 'Forbidden', 403
+            return f(*args, **kwargs)
+
+        return decorated_view
+
+    return _roles_required
+
+def basic_auth(request):
+    success = True
+    error = ''
+    user = None
+
+    auth = request.authorization
+    if auth is None:
+        success = False
+        error = 'No authentication provided.'
+        return success, error, user
+
+    username = auth.username
+    password = auth.password
+    user = User.query.filter_by(user=username).first()
+    if user is None:
+        success = False
+        error = f'Unknown user {username}.'
+    
+    elif not check_password_hash(user.password, password):
+        success = False
+        error = f'Incorrect password for user {username}.'
+
+    return success, error, user
+
+auth_blueprint = Blueprint('auth', __name__)
+
+login_manager = LoginManager()
+login_manager.login_view = 'auth.login'
+
+def create_or_update_user(username, password, admin_access=False, shop_access=False, backup_access=False):
+    """
+    Create a new user or update an existing user with the given credentials and access rights.
+    """
+    # Validate username before creating/updating user
+    is_valid, error_message = validate_username(username)
+    if not is_valid:
+        logger.error(f'Username validation failed for user {username}: {error_message}')
+        raise ValueError(f"Username validation failed: {error_message}")
+    
+    # Validate password before creating/updating user
+    is_valid, error_message = validate_password(password)
+    if not is_valid:
+        logger.error(f'Password validation failed for user {username}: {error_message}')
+        raise ValueError(f"Password validation failed: {error_message}")
+    
+    user = User.query.filter_by(user=username).first()
+    if user:
+        logger.info(f'Updating existing user {username}')
+        user.admin_access = admin_access
+        user.shop_access = shop_access
+        user.backup_access = backup_access
+        user.password = generate_password_hash(password, method='scrypt')
+    else:
+        logger.info(f'Creating new user {username}')
+        new_user = User(user=username, password=generate_password_hash(password, method='scrypt'), admin_access=admin_access, shop_access=shop_access, backup_access=backup_access)
+        db.session.add(new_user)
+    db.session.commit()
+
+def init_user_from_environment(environment_name, admin=False):
+    """
+    allow to init some user from environment variable to init some users without using the UI
+    """
+    username = os.getenv(environment_name + '_NAME')
+    password = os.getenv(environment_name + '_PASSWORD')
+    if username and password:
+        if admin:
+            logger.info('Initializing an admin user from environment variable...')
+            admin_access = True
+            shop_access = True
+            backup_access = True
+        else:
+            logger.info('Initializing a regular user from environment variable...')
+            admin_access = False
+            shop_access = True
+            backup_access = False
+
+        if not admin:
+            existing_admin = admin_account_created()
+            if not existing_admin and not admin_access:
+                logger.error(f'Error creating user {username}, first account created must be admin')
+                return
+
+        create_or_update_user(username, password, admin_access, shop_access, backup_access)
+
+def init_users(app):
+    with app.app_context():
+        # init users from ENV
+        if os.environ.get('USER_ADMIN_NAME') is not None:
+            init_user_from_environment(environment_name="USER_ADMIN", admin=True)
+        if os.environ.get('USER_GUEST_NAME') is not None:
+            init_user_from_environment(environment_name="USER_GUEST", admin=False)
+
+@auth_blueprint.route("/login", methods=["GET", "POST"])
+def login():
+    if request.method == "GET":
+        next_url = request.args.get('next', '')
+        if current_user.is_authenticated:
+            return redirect(next_url if len(next_url) else '/')
+        return render_template('login.html', title='Login')
+        
+    # login code goes here
+    username = request.form.get('user')
+    password = request.form.get('password')
+    remember = bool(request.form.get('remember'))
+    next_url = request.form.get('next', '')
+
+    user = User.query.filter_by(user=username).first()
+
+    # check if the user actually exists
+    # take the user-supplied password, hash it, and compare it to the hashed password in the database
+    if not user or not check_password_hash(user.password, password):
+        logger.warning(f'Incorrect login for user {username}')
+        return redirect(url_for('auth.login')) # if the user doesn't exist or password is wrong, reload the page
+
+    # if the above check passes, then we know the user has the right credentials
+    logger.info(f'Sucessfull login for user {username}')
+    login_user(user, remember=remember)
+
+    return redirect(next_url if len(next_url) else '/')
+
+@auth_blueprint.route('/profile')
+@login_required
+@access_required('backup')
+def profile():
+    return render_template('profile.html')
+
+@auth_blueprint.route('/api/users')
+@access_required('admin')
+def get_users():
+    all_users = [
+        dict(db_user._mapping)
+        for db_user in db.session.query(User.id, User.user, User.admin_access, User.shop_access, User.backup_access).all()
+    ]
+    return jsonify(all_users)
+
+@auth_blueprint.route('/api/user', methods=['DELETE'])
+@login_required
+@access_required('admin')
+def delete_user():
+    success = True
+    data = request.json
+    user_id = data['user_id']
+    try:
+        User.query.filter_by(id=user_id).delete()
+        db.session.commit()
+        logger.info(f'Successfully deleted user with id {user_id}.')
+    except Exception as e:
+        logger.error(f'Could not delete user with id {user_id}: {e}')
+        success = False
+
+    resp = {
+        'success': success
+    } 
+    return jsonify(resp)
+
+@auth_blueprint.route('/api/user/signup', methods=['POST'])
+@access_required('admin')
+def signup_post():
+    signup_success = True
+    data = request.json
+
+    username = data['user']
+    password = data['password']
+    admin_access = data['admin_access']
+    if admin_access:
+        shop_access = True
+        backup_access = True
+    else:
+        shop_access = data['shop_access']
+        backup_access = data['backup_access']
+
+    # Validate username first
+    is_valid, error_message = validate_username(username)
+    if not is_valid:
+        logger.error(f'Username validation failed for user {username}: {error_message}')
+        resp = {
+            'success': False,
+            'error': f"Username validation failed: {error_message}"
+        }
+        return jsonify(resp)
+
+    # Validate password
+    is_valid, error_message = validate_password(password)
+    if not is_valid:
+        logger.error(f'Password validation failed for user {username}: {error_message}')
+        resp = {
+            'success': False,
+            'error': f"Password validation failed: {error_message}"
+        }
+        return jsonify(resp)
+
+    user = User.query.filter_by(user=username).first() # if this returns a user, then the user already exists in database
+    
+    if user: # if a user is found, we want to redirect back to signup page so user can try again
+        logger.error(f'Error creating user {username}, user already exists')
+        resp = {
+            'success': False,
+            'error': 'User already exists'
+        }
+        return jsonify(resp)
+    
+    existing_admin = admin_account_created()
+    if not existing_admin and not admin_access:
+        logger.error(f'Error creating user {username}, first account created must be admin')
+        resp = {
+            'success': False,
+            'status_code': 400,
+            'location': '/settings',
+        } 
+        return jsonify(resp)
+
+    try:
+        # create a new user with the form data. Hash the password so the plaintext version isn't saved.
+        create_or_update_user(username, password, admin_access, shop_access, backup_access)
+        logger.info(f'Successfully created user {username}.')
+    except ValueError as e:
+        # This should not happen since we validate above, but just in case
+        resp = {
+            'success': False,
+            'error': str(e)
+        }
+        return jsonify(resp)
+
+    resp = {
+        'success': signup_success
+    } 
+
+    if not existing_admin and admin_access:
+        logger.debug('First admin account created')
+        resp['status_code'] = 302,
+        resp['location'] = '/settings'
+    
+    return jsonify(resp)
+
+
+@auth_blueprint.route('/logout')
+@login_required
+def logout():
+    logout_user()
+    return redirect('/')

ownfoil/_app/clients/__init__.py

@@ -0,0 +1,9 @@
+"""
+Client module for handling different shop clients
+"""
+from .client import BaseClient
+from .tinfoil import TinfoilClient
+from .sphaira import SphairaClient, SPHAIRA_ENDPOINT
+from .cyberfoil import CyberFoilClient
+
+__all__ = ['BaseClient', 'CyberFoilClient', 'TinfoilClient', 'SphairaClient', 'SPHAIRA_ENDPOINT']

ownfoil/_app/clients/client.py

@@ -0,0 +1,171 @@
+"""
+Base client class for shop clients.
+All client implementations must inherit from this class and implement the required methods.
+"""
+from abc import ABC, abstractmethod
+from flask import Request, Response
+from typing import Tuple, Optional, Dict, Any
+from functools import wraps
+from db import get_filtered_files
+from auth import basic_auth
+import logging
+
+logger = logging.getLogger('main')
+
+
+class BaseClient(ABC):
+    """Base class for shop clients implementing common interface for authentication, shop serving, and file delivery."""
+
+    # Class variables - should be overridden by subclasses
+    CLIENT_NAME = "BaseClient"
+
+    # ==================== Initialization ====================
+
+    def __init__(self, app_settings: dict):
+        """Initialize the client with application settings and database."""
+        self.app_settings = app_settings
+        logger.debug(f"Initialized {self.CLIENT_NAME} client")
+
+    # ==================== Authentication Decorator ====================
+
+    @staticmethod
+    def authenticate(handler):
+        """Decorator that handles authentication for handle_<method> functions."""
+        @wraps(handler)
+        def wrapper(self, request: Request) -> Response:
+            # Initialize auth flags on request object
+            request.basic_auth_success = False
+            request.basic_auth_error = None
+            request.client_auth_success = False
+            request.client_auth_error = None
+            request.user = None
+            request.auth_data = {}
+
+            # Perform host verification only for HTTPS requests
+            if request.is_secure or request.headers.get("X-Forwarded-Proto") == "https":
+                shop_host = self.app_settings["shop"].get("host")
+                if not shop_host:
+                    self.log_error("Missing shop host configuration, Host verification is disabled.")
+                elif request.host != shop_host:
+                    return self.error_response(f"Incorrect URL referrer detected: {request.host}.")
+
+            # Generic Basic Auth
+            request.basic_auth_success, request.basic_auth_error, request.user = basic_auth(request)
+            if request.basic_auth_success:
+                self.log_info(f"Basic authentication successful for user: {request.user.user}")
+            else:
+                self.log_warning(f"Authentication failed: {request.basic_auth_error}")
+
+            # Client-specific authentication
+            request.client_auth_success, request.client_auth_error, client_auth_data = self._client_authenticate(request)
+            if request.client_auth_success:
+                self.log_info("Client-specific authentication successful.")
+                if client_auth_data:
+                    request.auth_data.update(client_auth_data)
+
+            else:
+                self.log_warning(f"Client-specific auth failed: {request.client_auth_error}")
+
+            # Call the actual handler
+            return handler(self, request)
+
+        return wrapper
+
+    @staticmethod
+    def verify_shop_access(handler):
+        """Decorator that enforces authenticated access to the shop."""
+        @wraps(handler)
+        def wrapper(self, request: Request) -> Response:
+            # Check if shop requires authentication
+            if not self.app_settings['shop']['public']:
+                if not request.basic_auth_success:
+                    return self.error_response("Shop requires authentication.\n" + (request.basic_auth_error))
+                # Check if user has shop access
+                if request.user and not request.user.has_shop_access():
+                    return self.error_response(f'User {request.user.user} does not have access to the shop.')
+
+            # Call the actual handler
+            return handler(self, request)
+
+        return wrapper
+
+    def _client_authenticate(self, request: Request) -> Tuple[bool, Optional[str], Optional[Dict[str, Any]]]:
+        """
+        Client-specific authentication logic. Override in subclasses for custom behavior.
+
+        Returns:
+            Tuple of (success: bool, error_message: Optional[str], auth_data: Optional[Dict])
+            - success: True if authentication passed
+            - error_message: Error message if authentication failed
+            - auth_data: Additional authentication data to be stored in request.auth_data
+        """
+        # Default implementation: no additional authentication required
+        return True, None, {}
+
+    # ==================== Abstract Methods (Required) ====================
+
+    @classmethod
+    @abstractmethod
+    def identify_client(cls, request: Request) -> bool:
+        """Identify if the request is from this client type."""
+        pass
+
+    @abstractmethod
+    def error_response(self, error_message: str) -> Response:
+        """Generate an error response in the format expected by the client."""
+        pass
+
+    @abstractmethod
+    def info_response(self, info_message: str) -> Response:
+        """Generate an info response in the format expected by the client."""
+        pass
+
+    @abstractmethod
+    def _handle_get(self, request: Request) -> Response:
+        """Handle GET requests for specific paths."""
+        pass
+
+    # ==================== Public Methods ====================
+
+    def handle_request(self, request: Request) -> Response:
+        """Handle an incoming HTTP request and route to appropriate handler."""
+        method = request.method
+        path = request.path
+        headers = request.headers
+
+        # Route request based on method and path
+        if method == "OPTIONS":
+            return self._handle_options(path, headers)
+        elif method == "HEAD":
+            return self._handle_head(request)
+        elif method == "GET":
+            return self._handle_get(request)
+
+    def get_filtered_files(self, content_filter: Optional[str] = None) -> list:
+        """Get filtered files from the database based on content type."""
+        return get_filtered_files(content_filter)
+
+    def log_info(self, message: str):
+        """Log an info message with client context."""
+        logger.info(f"({self.CLIENT_NAME}) {message}")
+
+    def log_warning(self, message: str):
+        """Log a warning message with client context."""
+        logger.warning(f"({self.CLIENT_NAME}) {message}")
+
+    def log_error(self, message: str):
+        """Log an error message with client context."""
+        logger.error(f"({self.CLIENT_NAME}) {message}")
+
+    # ==================== Private/Helper Methods ====================
+
+    def _handle_options(self, path: str, headers: dict) -> Response:
+        """Handle OPTIONS requests for CORS preflight."""
+        pass
+
+    def _handle_head(self, request: Request) -> Response:
+        """
+        Handle HEAD requests. Override in subclasses if needed.
+        Default implementation returns 404.
+        """
+        return self.error_response("HEAD method not implemented"), 404

ownfoil/_app/clients/cyberfoil.py

@@ -0,0 +1,137 @@
+"""
+CyberFoil client implementation.
+"""
+from flask import Request, Response, jsonify
+from typing import Tuple, Optional, Dict, Any
+import json
+
+from .client import BaseClient
+from settings import set_shop_settings
+from constants import APP_TYPE_FILTERS
+
+CYBERFOIL_HEADERS = [
+    'Theme',
+    'Uid',
+    'Version',
+    'Revision',
+    'Language',
+    'Hauth',
+    'Uauth'
+]
+
+class CyberFoilClient(BaseClient):
+    """CyberFoil client with header-based identification, Hauth verification."""
+
+    # Class variables
+    CLIENT_NAME = "CyberFoil"
+
+    # ==================== Abstract Method Implementations (Required) ====================
+
+    @classmethod
+    def identify_client(cls, request: Request) -> bool:
+        """Identify CyberFoil client by checking for required headers."""
+        return all(header in request.headers for header in CYBERFOIL_HEADERS) and request.headers.get('User-Agent') == 'cyberfoil'
+
+    def error_response(self, error_message: str) -> Response:
+        """Generate CyberFoil error response in JSON format."""
+        return jsonify({'error': error_message})
+
+    def info_response(self, info_message: str) -> Response:
+        """Generate CyberFoil info response in JSON format."""
+        return jsonify({'success': info_message})
+
+    @BaseClient.authenticate
+    @BaseClient.verify_shop_access
+    def _handle_get(self, request: Request) -> Response:
+        """Handle GET requests for specific paths."""
+        # Access auth flags from request object (set by @authenticate decorator)
+        if not request.client_auth_success:
+            return self.error_response(request.client_auth_error)
+
+        # Get client-specific settings
+        client_settings = self.app_settings['shop']['clients']['cyberfoil']
+
+        paths = request.path.strip('/').split('/')
+        content_filter = paths[0] if paths and paths[0] in APP_TYPE_FILTERS else None
+        # Build shop content
+        shop = {"success": self.app_settings['shop']['motd']}
+        shop["files"] = self._generate_shop_files(content_filter)
+
+        # Get verified_host from auth_data
+        verified_host = request.auth_data.get('verified_host')
+        if verified_host:
+            # Enforce client side host verification
+            shop["referrer"] = f"https://{verified_host}"
+
+        # Serve the shop
+        return jsonify(shop)
+
+    # ==================== Private/Helper Methods ====================
+
+    def _client_authenticate(self, request: Request) -> Tuple[bool, Optional[str], Optional[Dict[str, Any]]]:
+        """Cyberfoil-specific authentication: Host verification for HTTPS requests."""
+        success = True
+        error = None
+        verified_host = None
+
+        # Perform host verification only for HTTPS requests
+        if request.is_secure or request.headers.get("X-Forwarded-Proto") == "https":
+            success, error, verified_host = self._verify_host(request)
+
+        # Return auth data with verified_host
+        auth_data = {'verified_host': verified_host}
+        return success, error, auth_data
+
+    def _verify_host(self, request: Request) -> Tuple[bool, Optional[str], Optional[str]]:
+        """Verify Hauth to prevent hotlinking."""
+        request_host = request.host
+        request_hauth = request.headers.get('Hauth')
+        shop_host = self.app_settings["shop"].get("host")
+        client_settings = self.app_settings["shop"]["clients"]["cyberfoil"]
+        hauth_dict = client_settings.get("hauth", {})
+
+        # Get hauth for this specific host
+        shop_hauth = hauth_dict.get(request_host)
+
+        self.log_info(f"Secure request from remote host {request_host}, proceeding with host verification.")
+
+        if not shop_host:
+            self.log_error("Missing shop host configuration, Host verification is disabled.")
+            return True, None, None
+
+        if not shop_hauth:
+            return self._handle_missing_hauth(request, request_host, request_hauth)
+
+        if request_hauth != shop_hauth:
+            self.log_warning(f"Incorrect Hauth detected for host: {request_host}.")
+            return False, f"Incorrect Hauth for URL `{request_host}`.", None
+
+        return True, None, shop_host
+
+    def _handle_missing_hauth(self, request: Request, request_host: str, request_hauth: str) -> Tuple[bool, Optional[str], Optional[str]]:
+        """Handle case when Hauth is not configured."""
+        basic_auth_success = request.basic_auth_success
+        user_is_admin = request.user.has_admin_access() if request.user else False
+
+        if basic_auth_success and user_is_admin:
+            # Save hauth to client-specific settings as a dict with host as key
+            shop_settings = self.app_settings['shop']
+            hauth_dict = shop_settings['clients']['cyberfoil'].get('hauth', {})
+            
+            # Set hauth for this specific host
+            hauth_dict[request_host] = request_hauth
+            shop_settings['clients']['cyberfoil']['hauth'] = hauth_dict
+            set_shop_settings(shop_settings)
+            self.log_info(f"Successfully set Hauth value for host {request_host}.")
+            return True, None, request_host
+
+        self.log_warning(
+            f"Hauth value not set for host {request_host}, Host verification is disabled. "
+            f"Connect to the shop from Cyberfoil with an admin account to set it."
+        )
+        return True, None, None
+
+    def _generate_shop_files(self, content_filter: Optional[str] = None) -> list:
+        """Generate the files list for the shop with optional content type filtering."""
+        files = self.get_filtered_files(content_filter)
+        return [{'url': f'/api/get_game/{f.id}#{f.filename}', 'size': f.size} for f in files]