tina4-python 0.1.43__tar.gz → 0.1.45__tar.gz

{tina4_python-0.1.43 → tina4_python-0.1.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: tina4-python
-Version: 0.1.43
+Version: 0.1.45
 Summary: Tina4Python - This is not another framework for Python
 Author: Andre van Zuydam
 Author-email: andrevanzuydam@gmail.com
@@ -169,6 +169,41 @@ Example:
 Authorization: Bearer <token>
 ```
 You can generate tokens using tina4_python.tina4_auth which takes in a payload parameter which is a dictionary:
+#### Example of a post with a form, assume the route is ```/capture```
+
+You need the following twig file in the ```src/templates``` folder called ```something.twig```
+
+```twig something.twig
+<form method="post">
+    <input name="email" type="text" placeholder="Email">
+    <button type="submit">Send</button>
+    <input type="hidden" name="formToken" value="{{ token }}" >
+</form>
+```
+
+You can add the following code to ```src/routes/example.py```
+
+```python
+# get router which renders the twig form html
+@get("/capture")
+async def capture_get(request, response):
+    # get a token to add to the form
+    token = tina4_python.tina4_auth.get_token({"data": {"formName": "capture"}})
+    html = Template.render_twig_template("somefile.twig", {"token": token})
+    return response(html)
+
+# returns back to the user the form data that has been posted
+@post("/capture")
+async def capture_post(request, response):
+    return response(request.body)
+```
+
+In your ```src/__init__.py``` add the following code
+
+```python
+from .routes.example import *
+```
+Generate tokens with the following code as per the example above, tokens carry a payload and we add an additional ```expires``` value to the token based on the env variable ```TINA4_TOKEN_LIMIT``` 
 
 ```python
 import tina4_python

{tina4_python-0.1.43 → tina4_python-0.1.45}/README.md

@@ -150,6 +150,41 @@ Example:
 Authorization: Bearer <token>
 ```
 You can generate tokens using tina4_python.tina4_auth which takes in a payload parameter which is a dictionary:
+#### Example of a post with a form, assume the route is ```/capture```
+
+You need the following twig file in the ```src/templates``` folder called ```something.twig```
+
+```twig something.twig
+<form method="post">
+    <input name="email" type="text" placeholder="Email">
+    <button type="submit">Send</button>
+    <input type="hidden" name="formToken" value="{{ token }}" >
+</form>
+```
+
+You can add the following code to ```src/routes/example.py```
+
+```python
+# get router which renders the twig form html
+@get("/capture")
+async def capture_get(request, response):
+    # get a token to add to the form
+    token = tina4_python.tina4_auth.get_token({"data": {"formName": "capture"}})
+    html = Template.render_twig_template("somefile.twig", {"token": token})
+    return response(html)
+
+# returns back to the user the form data that has been posted
+@post("/capture")
+async def capture_post(request, response):
+    return response(request.body)
+```
+
+In your ```src/__init__.py``` add the following code
+
+```python
+from .routes.example import *
+```
+Generate tokens with the following code as per the example above, tokens carry a payload and we add an additional ```expires``` value to the token based on the env variable ```TINA4_TOKEN_LIMIT``` 
 
 ```python
 import tina4_python

{tina4_python-0.1.43 → tina4_python-0.1.45}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "tina4-python"
-version = "0.1.43"
+version = "0.1.45"
 description = "Tina4Python - This is not another framework for Python"
 authors = ["Andre van Zuydam <andrevanzuydam@gmail.com>"]
 readme = "README.md"

{tina4_python-0.1.43 → tina4_python-0.1.45}/tina4_python/Auth.py

@@ -105,6 +105,10 @@ class Auth:
 
     def get_token(self,  payload_data):
         private_key = self.load_private_key()
+        now = datetime.datetime.now()
+        token_limit_minutes = os.environ.get("TINA4_TOKEN_LIMIT", 2)
+        expiry_time = now + datetime.timedelta(minutes=token_limit_minutes)
+        payload_data["expires"] = expiry_time.isoformat()
         token = jwt.encode(
             payload=payload_data,
             key=private_key,
@@ -130,6 +134,15 @@ class Auth:
         public_key = self.load_public_key()
         try:
             payload = jwt.decode(token, key=public_key, algorithms=['RS256'])
+            if "expires" not in payload:
+                return False
+
+            if "expires" in payload:
+                now = datetime.datetime.now()
+                expiry_time = datetime.datetime.fromisoformat(payload["expires"])
+                print("TOKEN EXPIRY", now, expiry_time)
+                if now > expiry_time:
+                    return False
         except Exception:
             return False
 

{tina4_python-0.1.43 → tina4_python-0.1.45}/tina4_python/Router.py

@@ -61,15 +61,24 @@ class Router:
         if method in [Constant.TINA4_POST, Constant.TINA4_PUT, Constant.TINA4_PATCH, Constant.TINA4_DELETE]:
             content = Template.render_twig_template(
                 "errors/403.twig", {"server": {"url": url}})
-            # check for token in the headers
-            if "Authorization" not in headers:
-                return Response(content, Constant.HTTP_FORBIDDEN, Constant.TEXT_HTML)
 
-            token = headers["Authorization"].replace("Bearer", "").strip()
-            if not (tina4_python.tina4_auth.valid(token)):
-                return Response(content, Constant.HTTP_FORBIDDEN, Constant.TEXT_HTML)
+            validated = False
+            # check to see if we have an auth ability
+            if "Authorization" in headers:
+                token = headers["Authorization"].replace("Bearer", "").strip()
+                if tina4_python.tina4_auth.valid(token):
+                    validated = True
 
-            # @todo add other validations here for future security
+            if "formToken" in request["body"]:
+                token = request["body"]["formToken"]
+                if tina4_python.tina4_auth.valid(token):
+                    validated = True
+
+            if not validated:
+                return Response(content, Constant.HTTP_FORBIDDEN, Constant.TEXT_HTML)
+            else:
+                if "formToken" in request["body"]:
+                    del request["body"]["formToken"]
 
         # default response
         result = Response("", Constant.HTTP_NOT_FOUND, Constant.TEXT_HTML)

{tina4_python-0.1.43 → tina4_python-0.1.45}/tina4_python/Webserver.py

@@ -6,6 +6,7 @@
 import asyncio
 import json
 import random
+from urllib.parse import unquote
 from urllib.parse import urlparse, parse_qsl
 
 import tina4_python
@@ -26,15 +27,27 @@ class Webserver:
     async def get_content_body(self, content_length):
         # get lines of content where at the end of the request
         content = self.request_raw[-content_length:]
-
         try:
+            print("JSON", content)
             content = json.loads(content)
         except Exception as e:
-            content = ""
+            # check for form body
+            if content != "":
+                body = {}
+                variables = content.split("&", 1)
+                for variable in variables:
+                    variable = variable.split("=", 1)
+                    body[variable[0]] = unquote(variable[1])
+                return body
 
         return content
 
     async def get_response(self, method):
+        """
+
+        :param method: GET, POST, PATCH, DELETE, PUT
+        :return:
+        """
         headers = []
         if method == "OPTIONS":
             self.send_header("Access-Control-Allow-Origin", "*", headers)
@@ -48,7 +61,10 @@ class Webserver:
         params = dict(parse_qsl(urlparse(self.path).query, keep_blank_values=True))
 
         content_length = await self.get_content_length()
-        body = await self.get_content_body(content_length)
+        if method != TINA4_GET:
+            body = await self.get_content_body(content_length)
+        else:
+            body = None
         request = {"params": params, "body": body, "raw": self.request}
 
         tina4_python.tina4_current_request = request
@@ -143,9 +159,9 @@ class Webserver:
 
         self.method = self.request.split(" ")[0]
 
-        initial = self.request.split("\n\n")[0]
+        body_parts = self.request.split("\n\n")
 
-        self.headers = initial.split("\n")
+        self.headers = body_parts[0].split("\n")
 
         # parse headers into a dictionary for more efficient use
         headers_list = {}