186 lines
6.6 KiB
Python
186 lines
6.6 KiB
Python
"""A user's API tokens for their Files library (`app.apitokens`): list, make, revoke.
|
|
|
|
Signed-in only — `current_user`, never a token: a token cannot make itself a wider one. A new
|
|
token's value is in the answer that made it and nowhere after; only its hash is kept.
|
|
|
|
The Hub preset is the one machine a user swaps files with: it makes (or reuses) their Hub folder
|
|
and gives the token every right in it, so the hub both drops files there and picks up the ones put
|
|
there for it.
|
|
"""
|
|
|
|
from datetime import datetime, timedelta, timezone
|
|
from typing import Literal
|
|
|
|
from fastapi import APIRouter, Depends
|
|
from pydantic import BaseModel, Field
|
|
from sqlalchemy import func, select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app import apitokens, audit
|
|
from app.apitokens import GRANT_COLUMNS, Right
|
|
from app.audit import AuditAction
|
|
from app.auth import current_user
|
|
from app.db import get_db
|
|
from app.downloads import folders
|
|
from app.models import ApiToken, ApiTokenGrant, FileFolder, User
|
|
from app.refusal import refused
|
|
from app.routes._common import owned_or_404
|
|
from app.security import hash_token
|
|
from app.utils import iso
|
|
|
|
router = APIRouter(prefix="/api/tokens", tags=["tokens"])
|
|
|
|
# Far more than one person's machines; a ceiling, so a script gone wrong cannot mint without end.
|
|
MAX_TOKENS = 20
|
|
_MAX_GRANTS = 50
|
|
_MAX_EXPIRY_DAYS = 3650
|
|
|
|
|
|
class GrantIn(BaseModel):
|
|
folder_id: int
|
|
rights: list[Right] = Field(min_length=1, max_length=len(Right))
|
|
|
|
|
|
class TokenIn(BaseModel):
|
|
name: str = Field(min_length=1, max_length=80)
|
|
# None = never expires.
|
|
expires_days: int | None = Field(default=None, ge=1, le=_MAX_EXPIRY_DAYS)
|
|
preset: Literal["hub"] | None = None
|
|
grants: list[GrantIn] = Field(default_factory=list, max_length=_MAX_GRANTS)
|
|
|
|
|
|
def _serialize(db: Session, token: ApiToken) -> dict:
|
|
rows = db.execute(
|
|
select(ApiTokenGrant, FileFolder)
|
|
.join(FileFolder, FileFolder.id == ApiTokenGrant.folder_id)
|
|
.where(ApiTokenGrant.token_id == token.id)
|
|
.order_by(FileFolder.id)
|
|
).all()
|
|
now = datetime.now(timezone.utc)
|
|
return {
|
|
"id": token.id,
|
|
"name": token.name,
|
|
"prefix": token.prefix,
|
|
"created_at": iso(token.created_at),
|
|
"expires_at": iso(token.expires_at),
|
|
"expired": token.expires_at is not None and token.expires_at <= now,
|
|
"expiring": apitokens.expiring(token, now),
|
|
"last_used_at": iso(token.last_used_at),
|
|
"grants": [
|
|
{
|
|
"folder_id": folder.id,
|
|
"kind": folder.kind,
|
|
"source_key": folder.source_key,
|
|
"name": folder.name,
|
|
"rights": sorted(apitokens.grant_rights(grant)),
|
|
}
|
|
for grant, folder in rows
|
|
],
|
|
}
|
|
|
|
|
|
@router.get("")
|
|
def list_tokens(user: User = Depends(current_user), db: Session = Depends(get_db)) -> list[dict]:
|
|
tokens = (
|
|
db.execute(select(ApiToken).where(ApiToken.user_id == user.id).order_by(ApiToken.id))
|
|
.scalars()
|
|
.all()
|
|
)
|
|
return [_serialize(db, t) for t in tokens]
|
|
|
|
|
|
def _wanted_grants(db: Session, user: User, body: TokenIn) -> dict[int, set[Right]]:
|
|
"""Folder id → the rights the new token gets there; every folder checked to be the user's, and
|
|
writing only where an upload may land (`folders.upload_target`)."""
|
|
if body.preset == "hub":
|
|
if body.grants:
|
|
raise refused(400, "api_token_preset_grants")
|
|
return {folders.hub_folder(db, user.id).id: set(Right)}
|
|
if not body.grants:
|
|
raise refused(400, "api_token_no_grants")
|
|
wanted: dict[int, set[Right]] = {}
|
|
for grant in body.grants:
|
|
wanted.setdefault(grant.folder_id, set()).update(grant.rights)
|
|
for folder_id, rights in wanted.items():
|
|
try:
|
|
if Right.WRITE in rights:
|
|
folders.upload_target(db, user.id, folder_id)
|
|
else:
|
|
folders.own_folder(db, user.id, folder_id)
|
|
except folders.FolderError as e:
|
|
raise refused(409, e.reason) from e
|
|
return wanted
|
|
|
|
|
|
@router.post("")
|
|
def create_token(
|
|
body: TokenIn, user: User = Depends(current_user), db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Make a token; its value is in this answer only."""
|
|
name = body.name.strip()
|
|
if not name:
|
|
raise refused(400, "api_token_name_required")
|
|
# The user's row, locked: two requests at once cannot both slip under the ceiling, and a
|
|
# session ended since `current_user` read the epoch (unlocked) cannot mint a token that outlives
|
|
# it — `bump_session_epoch` takes this lock before it revokes them all. No key update: a row that
|
|
# only refers to the user (a folder delete's audit line) must not wait on it, or the two deadlock.
|
|
epoch = db.execute(
|
|
select(User.session_epoch).where(User.id == user.id).with_for_update(key_share=True)
|
|
).scalar_one()
|
|
if (epoch or 0) != (user.session_epoch or 0):
|
|
raise refused(401, "not_authenticated")
|
|
count = db.execute(
|
|
select(func.count(ApiToken.id)).where(ApiToken.user_id == user.id)
|
|
).scalar_one()
|
|
if count >= MAX_TOKENS:
|
|
raise refused(409, "api_token_limit", limit=MAX_TOKENS)
|
|
wanted = _wanted_grants(db, user, body)
|
|
raw = apitokens.mint()
|
|
token = ApiToken(
|
|
user_id=user.id,
|
|
name=name,
|
|
prefix=raw[: apitokens.SHOWN_LEN],
|
|
token_hash=hash_token(raw),
|
|
expires_at=None
|
|
if body.expires_days is None
|
|
else datetime.now(timezone.utc) + timedelta(days=body.expires_days),
|
|
)
|
|
db.add(token)
|
|
db.flush()
|
|
for folder_id, rights in wanted.items():
|
|
db.add(
|
|
ApiTokenGrant(
|
|
token_id=token.id,
|
|
folder_id=folder_id,
|
|
**{col: right in rights for right, col in GRANT_COLUMNS.items()},
|
|
)
|
|
)
|
|
db.flush()
|
|
audit.record(
|
|
db,
|
|
user.id,
|
|
AuditAction.API_TOKEN_CREATE,
|
|
target_type="api_token",
|
|
target_id=token.id,
|
|
after={
|
|
"grants": {str(f): sorted(r) for f, r in wanted.items()},
|
|
"expires_at": iso(token.expires_at),
|
|
},
|
|
)
|
|
db.commit()
|
|
return {"ok": True, **_serialize(db, token), "token": raw}
|
|
|
|
|
|
@router.delete("/{token_id}")
|
|
def revoke_token(
|
|
token_id: int, user: User = Depends(current_user), db: Session = Depends(get_db)
|
|
) -> dict:
|
|
"""Revoke a token: it stops working at its next request (its grants go with it)."""
|
|
token = owned_or_404(db, ApiToken, token_id, user, what="api_token")
|
|
db.delete(token)
|
|
audit.record(
|
|
db, user.id, AuditAction.API_TOKEN_REVOKE, target_type="api_token", target_id=token_id
|
|
)
|
|
db.commit()
|
|
return {"ok": True, "deleted": token_id}
|