txhttputil 1.4.9__py3-none-any.whl

txhttputil/site/AuthSessionWrapper.py

@@ -0,0 +1,224 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+import logging
+from datetime import datetime
+
+import pytz
+from twisted.web.resource import IResource, ErrorPage
+from twisted.web.util import DeferredResource
+from txhttputil.site.AuthCredentials import AuthCredentials
+from txhttputil.site.AuthUserDetails import IUserSession
+from txhttputil.site.BasicResource import BasicResource
+from zope.interface import implementer
+
+from .AuthResource import LoginResource, LoginSucceededResource
+
+logger = logging.getLogger(name=__name__)
+
+__author__ = "Flying Ion Pty Ltd"
+
+
+@implementer(IResource)
+class FormBasedAuthSessionWrapper(object):
+    """
+    Copied partly from C{twisted.web._auth.wrapper.HTTPAuthSessionWrapper}
+    """
+
+    isLeaf = False
+
+    def __init__(
+        self,
+        siteRootResource: BasicResource,
+        credentialChecker: AuthCredentials,
+        allowedIpsList=None,
+    ):
+        self._siteRootResource = siteRootResource
+        self._credentialChecker = credentialChecker
+        self._allowedIpsList = allowedIpsList
+
+    def _authorizedResource(self, request):
+        """
+        Get the L{IResource} which the given request is authorized to receive.
+        If the proper authorization headers are present, the resource will be
+        requested from the portal.  If not, an anonymous login_page attempt will be
+        made.
+        """
+
+        # If the user has a logged in session, let them continue
+        # With out this, every HTTP request would result in a login screen.
+        userSession = IUserSession(request.getSession())
+        if userSession.userDetails.loggedIn:
+            request.getSession().touch()
+            return self._siteRootResource
+
+        # TRY Basic HTTP Authentication
+        # TODO, txHttpUtil is using FORM based authentication instead
+        # authheader = request.getHeader('authorization')
+        # if authheader:
+        #     factory, respString = self._selectParseHeader(authheader)
+        #     if factory is None:
+        #         return LoginResource()
+        #
+        #     try:
+        #         credentials = factory.decode(respString, request)
+        #     except error.LoginFailed:
+        #         return LoginResource()
+        #     except:
+        #         logger.error("Unexpected failure from credentials factory")
+        #         return ErrorPage(500, None, None)
+        #     else:
+        #         return DeferredResource(self._login(credentials))
+
+        # TRY form based authentication
+
+        a = request.args
+        if b"username" in a and b"password" in a:
+            user = a[b"username"][0]
+            pass_ = a[b"password"][0]
+
+            deferred = self._credentialChecker.check(user, pass_)
+
+            def checkResult(userDetails):
+                if not userDetails:
+                    return LoginResource()
+
+                userDetails.loggedIn = True
+                userDetails.loginDate = datetime.now(pytz.utc)
+
+                userSession = IUserSession(request.getSession())
+                userSession.userDetails = userDetails
+
+                return LoginSucceededResource()
+
+            def error(failure):
+                logger.error("Unexpected failure from credentials factory")
+                logger.error(failure.value)
+                return ErrorPage(500, None, None)
+
+            deferred.addCallback(checkResult)
+            deferred.addErrback(error)
+
+            return DeferredResource(deferred)
+
+        # Return login_page form
+        return LoginResource()
+
+    def render(self, request):
+        """
+        Find the L{IResource} avatar suitable for the given request, if
+        possible, and render it.  Otherwise, perhaps render an error page
+        requiring authorization or describing an internal server failure.
+        """
+        # Check IP filtering if configured
+        if self._allowedIpsList is not None:
+            clientIp = request.getClientAddress().host
+            if clientIp not in self._allowedIpsList:
+                request.setResponseCode(403)
+                return b"Forbidden: IP address not allowed"
+
+        return self._authorizedResource(request).render(request)
+
+    def getChildWithDefault(self, path, request):
+        """
+        Inspect the Authorization HTTP header, and return a deferred which,
+        when fired after successful authentication, will return an authorized
+        C{Avatar}. On authentication failure, an C{UnauthorizedResource} will
+        be returned, essentially halting further dispatch on the wrapped
+        resource and all children
+        """
+        # Check IP filtering if configured
+        if self._allowedIpsList is not None:
+            clientIp = request.getClientAddress().host
+            if clientIp not in self._allowedIpsList:
+                from twisted.web.resource import ErrorPage
+
+                return ErrorPage(403, b"Forbidden", b"IP address not allowed")
+
+        # Don't consume any segments of the request - this class should be
+        # transparent!
+        request.postpath.insert(0, request.prepath.pop())
+        return self._authorizedResource(request)
+
+        # def _login(self, credentials):
+        #     """
+        #     Get the L{IResource} avatar for the given credentials.
+        #
+        #     @return: A L{Deferred} which will be called back with an L{IResource}
+        #         avatar or which will errback if authentication fails.
+        #     """
+        #     d = self._portal.login(credentials, None, IResource)
+        #     d.addCallbacks(self._loginSucceeded, self._loginFailed)
+        #     return d
+        #
+        # def _loginSucceeded(self, (interface, avatar, logout)):
+        #     """
+        #     Handle login_page success by wrapping the resulting L{IResource} avatar
+        #     so that the C{logout} callback will be invoked when rendering is
+        #     complete.
+        #     """
+        #
+        #     class ResourceWrapper(proxyForInterface(IResource, 'resource')):
+        #         """
+        #         Wrap an L{IResource} so that whenever it or a child of it
+        #         completes rendering, the cred logout hook will be invoked.
+        #
+        #         An assumption is made here that exactly one L{IResource} from
+        #         among C{avatar} and all of its children will be rendered.  If
+        #         more than one is rendered, C{logout} will be invoked multiple
+        #         times and probably earlier than desired.
+        #         """
+        #
+        #         def getChildWithDefault(self, name, request):
+        #             """
+        #             Pass through the lookup to the wrapped resource, wrapping
+        #             the result in L{ResourceWrapper} to ensure C{logout} is
+        #             called when rendering of the child is complete.
+        #             """
+        #             return ResourceWrapper(self.resource.getChildWithDefault(name, request))
+        #
+        #         def render(self, request):
+        #             """
+        #             Hook into response generation so that when rendering has
+        #             finished completely (with or without error), C{logout} is
+        #             called.
+        #             """
+        #             request.notifyFinish().addBoth(lambda ign: logout())
+        #             return super(ResourceWrapper, self).render(request)
+        #
+        #     return ResourceWrapper(avatar)
+        #
+        # def _loginFailed(self, result):
+        #     """
+        #     Handle login_page failure by presenting either another challenge (for
+        #     expected authentication/authorization-related failures) or a server
+        #     error page (for anything else).
+        #     """
+        #     if result.check(error.Unauthorized, error.LoginFailed):
+        #         return UnauthorizedResource(self._credentialFactories)
+        #     else:
+        #         logger.error(str(result) +
+        #                      "HTTPAuthSessionWrapper.getChildWithDefault encountered "
+        #                      "unexpected error")
+        #     return ErrorPage(500, None, None)
+        #
+        # def _selectParseHeader(self, header):
+        #     """
+        #     Choose an C{ICredentialFactory} from C{_credentialFactories}
+        #     suitable to use to decode the given I{Authenticate} header.
+        #
+        #     @return: A two-tuple of a factory and the remaining portion of the
+        #         header value to be decoded or a two-tuple of C{None} if no
+        #         factory can decode the header value.
+        #     """
+        #     elements = header.split(' ')
+        #     scheme = elements[0].lower()
+        #     for fact in self._credentialFactories:
+        #         if fact.scheme == scheme:
+        #             return (fact, ' '.join(elements[1:]))
+        #     return (None, None)

txhttputil/site/AuthUserDetails.py

@@ -0,0 +1,51 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+from twisted.python.components import registerAdapter
+from twisted.web.server import Session
+from zope.interface import Attribute
+from zope.interface import Interface
+from zope.interface import implementer
+
+
+# TODO, Expand on this to allow restrictions to files, etc
+class GroupDetails:
+    def __init__(self, name):
+        self.name = name
+        self.readOnly = False
+
+
+everyoneGroup = GroupDetails("everyone")
+
+
+# TODO, Expand on this to allow username, etc
+class UserDetails:
+    def __init__(self):
+        self.loggedIn = False
+        self.loginDate = None
+        self.groupDetails = None
+
+
+class IUserSession(Interface):
+    userDetails = Attribute("The details of the user.")
+
+
+@implementer(IUserSession)
+class UserSession(object):
+    ''' User Access
+    This class stores the details about the user that are required by the
+    elements and resources to be able to allow access.
+    '''
+
+    def __init__(self, session):
+        self.userDetails = UserDetails()
+        self.readOnly = True
+        self.groupId = None
+
+
+registerAdapter(UserSession, Session, IUserSession)

txhttputil/site/BasicResource.py

@@ -0,0 +1,155 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+import logging
+
+from twisted.python.compat import nativeString
+from twisted.web.error import UnsupportedMethod
+from twisted.web.resource import EncodingResourceWrapper, IResource, NoResource, \
+    _computeAllowedMethods
+from twisted.web.server import GzipEncoderFactory
+from zope.interface import implementer
+
+logger = logging.getLogger(__name__)
+
+import mimetypes
+
+mimetypes.init()
+
+
+def get_extensions_for_type(general_type):
+    for ext in mimetypes.types_map:
+        if mimetypes.types_map[ext].split('/')[0] == general_type:
+            yield ext
+
+
+IMAGE_EXTENSIONS = list(get_extensions_for_type('image'))
+FONT_EXTENSIONS = list(get_extensions_for_type('font'))
+
+
+@implementer(IResource)
+class BasicResource:
+    """ Basic Resource
+
+    This class is a node for the resource tree, It's a slightly simpler version of
+    C{twisted.web.resource.Resource}
+
+    """
+    isGzipped = False
+    entityType = IResource
+    server = None
+    isLeaf = False
+
+    def __init__(self, allowedIpsList=None):
+        """
+        Initialize.
+        """
+        self._children = {}
+        self._allowedIpsList = allowedIpsList
+
+    def getChildWithDefault(self, path, request):
+        """ Get Child With Default
+
+        This is the method queried by the site/server, if we implement this and then
+        only use getChild, we have greater control when something fails
+        @see C{FileUnderlayResource}
+
+
+        def getChildForRequest(resource, request):
+            # Traverse resource tree to find who will handle the request.
+            while request.postpath and not resource.isLeaf:
+                pathElement = request.postpath.pop(0)
+                request.prepath.append(pathElement)
+                resource = resource.getChildWithDefault(pathElement, request)
+            return resource
+
+        """
+
+        resource = self
+
+        from txhttputil.site.FileUnderlayResource import FileUnderlayResource
+        fileUnderlayResourceStack = []
+
+        if isinstance(self, FileUnderlayResource):
+            fileUnderlayResourceStack.append((resource, [path] + request.postpath))
+
+        while True:
+            resource = resource.getChild(path, request)
+
+            if isinstance(resource, FileUnderlayResource):
+                fileUnderlayResourceStack.append((resource, list(request.postpath)))
+
+            # If we've run into a dead end, return it.
+            if isinstance(resource, NoResource):
+                break
+
+            # If the resource is a leaf, this IS the resource we should render
+            if resource.isLeaf:
+                # Break before popping the path
+                break
+
+            # If there are no more paths to pop, this must be it
+            if not request.postpath:
+                break
+
+            path = request.postpath.pop(0)
+            request.prepath.append(path)
+
+        # Look back through the file resources and see if there are any matches
+        if isinstance(resource, NoResource) or isinstance(resource, FileUnderlayResource):
+            while fileUnderlayResourceStack:
+                resource, postPath = fileUnderlayResourceStack.pop()
+                fileResource = resource.getFileResource(postPath)
+                if not isinstance(fileResource, NoResource):
+                    return fileResource
+
+        return resource
+
+    def getChild(self, path, request):
+        if path in self._children:
+            return self._children[path]
+        return NoResource()
+
+    def putChild(self, path: bytes, child):
+        if b'/' in path:
+            raise Exception("Path %s can not start or end with '/' ", path)
+
+        self._children[path] = child
+        child.server = self.server
+
+    def deleteChild(self, path: bytes):
+        if b'/' in path:
+            raise Exception("Path %s can not start or end with '/' ", path)
+
+        del self._children[path]
+
+    def render(self, request):
+        # Check IP filtering if configured
+        if self._allowedIpsList is not None:
+            clientIp = request.getClientAddress().host
+            if clientIp not in self._allowedIpsList:
+                request.setResponseCode(403)
+                return b'Forbidden: IP address not allowed'
+
+        # Optionally, Do some checking with userSession.userDetails.group
+        # userSession = IUserSession(request.getSession())
+
+        m = getattr(self, 'render_' + nativeString(request.method), None)
+        if not m:
+            raise UnsupportedMethod(_computeAllowedMethods(self))
+        return m(request)
+
+    def render_HEAD(self, request):
+        return self.render_GET(request)
+
+    def _gzipIfRequired(self, resource):
+        if (not isinstance(resource, EncodingResourceWrapper)
+            and hasattr(resource, 'isGzipped')
+            and resource.isGzipped):
+            return EncodingResourceWrapper(resource, [GzipEncoderFactory()])
+        return resource

txhttputil/site/BasicResourceTest.py

@@ -0,0 +1,112 @@
+# Copyright (c) 2016-2026 Flying Ion Pty Ltd
+#
+# This software is open source; the MIT license applies.
+# See LICENSE for the full license text.
+#
+# Website : https://flyingion.com
+# Support : contact@flyingion.com
+
+import logging
+
+from twisted.trial import unittest
+from twisted.web.resource import NoResource
+from twisted.web.test.requesthelper import DummyRequest
+from txhttputil.site.BasicResource import BasicResource
+
+logger = logging.getLogger(__name__)
+
+
+class MockAddress:
+    def __init__(self, host):
+        self.host = host
+
+
+class TestBasicResource(BasicResource):
+    def render_GET(self, request):
+        return b"GET response"
+
+    def render_POST(self, request):
+        return b"POST response"
+
+
+class BasicResourceTest(unittest.TestCase):
+
+    def setUp(self):
+        self.resource = TestBasicResource()
+
+    def testBasicGetChild(self):
+        child = self.resource.getChild(b"nonexistent", None)
+        self.assertIsInstance(child, NoResource)
+
+    def testPutAndGetChild(self):
+        childResource = TestBasicResource()
+        self.resource.putChild(b"child", childResource)
+
+        retrievedChild = self.resource.getChild(b"child", None)
+        self.assertEqual(retrievedChild, childResource)
+
+    def testDeleteChild(self):
+        childResource = TestBasicResource()
+        self.resource.putChild(b"child", childResource)
+
+        self.resource.deleteChild(b"child")
+
+        retrievedChild = self.resource.getChild(b"child", None)
+        self.assertIsInstance(retrievedChild, NoResource)
+
+    def testRenderGetMethod(self):
+        request = DummyRequest([])
+        request.method = b"GET"
+
+        response = self.resource.render(request)
+        self.assertEqual(response, b"GET response")
+
+    def testRenderPostMethod(self):
+        request = DummyRequest([])
+        request.method = b"POST"
+
+        response = self.resource.render(request)
+        self.assertEqual(response, b"POST response")
+
+    def testIpFilteringAllowed(self):
+        allowedIps = ["127.0.0.1", "192.168.1.100"]
+        resource = TestBasicResource(allowedIpsList=allowedIps)
+
+        request = DummyRequest([])
+        request.method = b"GET"
+        request.getClientAddress = lambda: MockAddress("127.0.0.1")
+
+        response = resource.render(request)
+        self.assertEqual(response, b"GET response")
+
+    def testIpFilteringBlocked(self):
+        allowedIps = ["127.0.0.1", "192.168.1.100"]
+        resource = TestBasicResource(allowedIpsList=allowedIps)
+
+        request = DummyRequest([])
+        request.method = b"GET"
+        request.getClientAddress = lambda: MockAddress("10.0.0.1")
+
+        response = resource.render(request)
+        self.assertEqual(response, b"Forbidden: IP address not allowed")
+        self.assertEqual(request.responseCode, 403)
+
+    def testIpFilteringDisabled(self):
+        resource = TestBasicResource(allowedIpsList=None)
+
+        request = DummyRequest([])
+        request.method = b"GET"
+        request.getClientAddress = lambda: MockAddress("10.0.0.1")
+
+        response = resource.render(request)
+        self.assertEqual(response, b"GET response")
+
+
+if __name__ == "__main__":
+    from twisted.trial import runner, reporter
+    import sys
+
+    trialRunner = runner.TrialRunner(reporter.VerboseTextReporter)
+    suite = runner.TestLoader().loadClass(BasicResourceTest)
+    result = trialRunner.run(suite)
+    sys.exit(not result.wasSuccessful())