mia/bumper
1
0
Fork 0
Code Issues 47 Pull requests 11 Projects Releases Packages Wiki Activity Actions

Remove old tokens and authcodes

Browse source 
Remove old tokens and authcodes
This commit is contained in:
Brian Martin 2019-03-09 10:45:45 -05:00
parent 8806e804f0
commit 6994f5ae5e
1 changed files with 75 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

123
bumper/confserver.py
View file

@ -166,7 +166,7 @@ class ConfServer:
async def handle_base(self, request): async def handle_base(self, request):
try: try:
#TODO - API Options here for viewing clients, tokens, restarting the server, etc.
text = "Bumper!" text = "Bumper!"
return web.json_response(text) return web.json_response(text)
@ -188,7 +188,6 @@ class ConfServer:
users = bumper.db_get().table('users').all() users = bumper.db_get().table('users').all()
for user in users: for user in users:
if user_devid in user['devices']: if user_devid in user['devices']:
tmpaccesstoken = ""
if "checkLogin" in request.path: if "checkLogin" in request.path:
if request.query[ if request.query[
"accessToken" "accessToken"
@ -197,11 +196,11 @@ class ConfServer:
] == "fuid_{}".format( ] == "fuid_{}".format(
user['userid'] user['userid']
): ):
tmpaccesstoken = request.query["accessToken"]
body = { body = {
"code": bumper.RETURN_API_SUCCESS, "code": bumper.RETURN_API_SUCCESS,
"data": { "data": {
"accessToken": tmpaccesstoken, # Random chars 32 length "accessToken": request.query["accessToken"],
"country": countrycode, "country": countrycode,
"email": "null@null.com", "email": "null@null.com",
"uid": "fuid_{}".format(user['userid']), "uid": "fuid_{}".format(user['userid']),
@ -212,6 +211,8 @@ class ConfServer:
"msg": "操作成功", "msg": "操作成功",
"time": bumper.get_milli_time(time.time()), "time": bumper.get_milli_time(time.time()),
} }
return web.json_response(body)
else: else:
body = { body = {
"code": bumper.ERR_TOKEN_INVALID, "code": bumper.ERR_TOKEN_INVALID,
@ -219,15 +220,20 @@ class ConfServer:
"msg": "当前密码错误", "msg": "当前密码错误",
"time": bumper.get_milli_time(time.time()), "time": bumper.get_milli_time(time.time()),
} }
return web.json_response(body)
else: else:
if tmpaccesstoken == "":
tmpaccesstoken = uuid.uuid4().hex #Deactivate old tokens and authcodes
bumper.user_add_token(user['userid'],tmpaccesstoken) for token in user['tokens']:
bumper.user_revoke_token(user['userid'], token)
for authcode in user['authcodes']:
bumper.user_revoke_authcode(user['userid'], authcode)
body = { body = {
"code": bumper.RETURN_API_SUCCESS, "code": bumper.RETURN_API_SUCCESS,
"data": { "data": {
"accessToken": tmpaccesstoken, # Random chars 32 length "accessToken": self.generate_token(user), # generate a new token
"country": countrycode, "country": countrycode,
"email": "null@null.com", "email": "null@null.com",
"uid": "fuid_{}".format(user['userid']), "uid": "fuid_{}".format(user['userid']),
@ -236,8 +242,7 @@ class ConfServer:
"msg": "操作成功", "msg": "操作成功",
"time": bumper.get_milli_time(time.time()), "time": bumper.get_milli_time(time.time()),
} }
return web.json_response(body)
return web.json_response(body)
body = { body = {
"code": bumper.ERR_USER_NOT_ACTIVATED, "code": bumper.ERR_USER_NOT_ACTIVATED,
@ -247,6 +252,7 @@ class ConfServer:
} }
return web.json_response(body) return web.json_response(body)
else: else:
return web.json_response( return web.json_response(
self._auth_any(user_devid, countrycode, request) self._auth_any(user_devid, countrycode, request)
@ -255,58 +261,69 @@ class ConfServer:
except Exception as e: except Exception as e:
confserverlog.exception("{}".format(e)) confserverlog.exception("{}".format(e))
def generate_token(self, user):
tmpaccesstoken = uuid.uuid4().hex
bumper.user_add_token(user['userid'],tmpaccesstoken)
return tmpaccesstoken
def generate_authcode(self, countrycode, user):
tmpauthcode = "{}_{}".format(countrycode, uuid.uuid4().hex)
bumper.user_add_authcode(user['userid'], tmpauthcode)
return tmpauthcode
def _auth_any(self, devid, country, request): def _auth_any(self, devid, country, request):
try: try:
user_devid = devid user_devid = devid
countrycode = country countrycode = country
tmpaccesstoken = ""
users = bumper.db_get().table('users').all() users = bumper.db_get().table('users').all()
bots = bumper.db_get().table('bots').all() bots = bumper.db_get().table('bots').all()
if len(users) > 0: if len(users) > 0: #Default to user 0
tmpuser = users[0] tmpuser = users[0]
bumper.user_add_device(tmpuser['userid'], user_devid) bumper.user_add_device(tmpuser['userid'], user_devid)
else: else:
bumper.user_add("tmpuser") bumper.user_add("tmpuser") #Add a new user
tmpuser = bumper.user_get("tmpuser") tmpuser = bumper.user_get("tmpuser")
bumper.user_add_device(tmpuser['userid'], user_devid) bumper.user_add_device(tmpuser['userid'], user_devid)
for bot in bots: for bot in bots: #Add all bots to the user
bumper.user_add_bot(tmpuser['userid'], bot['did']) bumper.user_add_bot(tmpuser['userid'], bot['did'])
if "checkLogin" in request.path: if "checkLogin" in request.path: #If request was to check a token do so
tmpaccesstoken = request.query["accessToken"] if request.query["accessToken"] in tmpuser['tokens']:
bumper.user_add_token(tmpuser['userid'], tmpaccesstoken) return {
body = { "code": bumper.RETURN_API_SUCCESS,
"code": bumper.RETURN_API_SUCCESS, "data": {
"data": { "accessToken": request.query["accessToken"], # Random chars 32 length
"accessToken": tmpaccesstoken, # Random chars 32 length "country": countrycode,
"country": countrycode, "email": "null@null.com",
"email": "null@null.com", "uid": "fuid_{}".format(tmpuser['userid']),
"uid": "fuid_{}".format(tmpuser['userid']), "username": "fusername_{}".format(tmpuser['userid']),
"username": "fusername_{}".format(tmpuser['userid']), },
}, "msg": "操作成功",
"msg": "操作成功", "time": bumper.get_milli_time(time.time()),
"time": bumper.get_milli_time(time.time()), }
}
else:
if tmpaccesstoken == "":
tmpaccesstoken = uuid.uuid4().hex
bumper.user_add_token(tmpuser['userid'], tmpaccesstoken)
body = { #Deactivate old tokens and authcodes
"code": bumper.RETURN_API_SUCCESS, for token in tmpuser['tokens']:
"data": { bumper.user_revoke_token(tmpuser['userid'], token)
"accessToken": tmpaccesstoken, # Random chars 32 length
"country": countrycode, for authcode in tmpuser['authcodes']:
"email": "null@null.com", bumper.user_revoke_authcode(tmpuser['userid'], authcode)
"uid": "fuid_{}".format(tmpuser['userid']),
"username": "fusername_{}".format(tmpuser['userid']), body = {
}, "code": bumper.RETURN_API_SUCCESS,
"msg": "操作成功", "data": {
"time": bumper.get_milli_time(time.time()), "accessToken": self.generate_token(tmpuser), # Generate a token
} "country": countrycode,
"email": "null@null.com",
"uid": "fuid_{}".format(tmpuser['userid']),
"username": "fusername_{}".format(tmpuser['userid']),
},
"msg": "操作成功",
"time": bumper.get_milli_time(time.time()),
}
return body return body
@ -325,7 +342,14 @@ class ConfServer:
request.query["uid"] == "fuid_{}".format(user['userid']) request.query["uid"] == "fuid_{}".format(user['userid'])
and request.query["accessToken"] in user['tokens'] and request.query["accessToken"] in user['tokens']
): ):
bumper.user_revoke_token(user['userid'],request.query["accessToken"]) #Deactivate old tokens and authcodes
for token in user['tokens']:
bumper.user_revoke_token(user['userid'], token)
#bumper.user_revoke_token(user['userid'],request.query["accessToken"])
for authcode in user['authcodes']:
bumper.user_revoke_authcode(user['userid'], authcode)
body = { body = {
"code": bumper.RETURN_API_SUCCESS, "code": bumper.RETURN_API_SUCCESS,
@ -351,14 +375,11 @@ class ConfServer:
user_devid in user['devices'] user_devid in user['devices']
and request.query["accessToken"] in user['tokens'] and request.query["accessToken"] in user['tokens']
): ):
countrycode = request.match_info.get("country", "us")
tmpauthcode = "{}_{}".format(countrycode, uuid.uuid4().hex)
bumper.user_add_authcode(user['userid'], tmpauthcode)
body = { body = {
"code": bumper.RETURN_API_SUCCESS, "code": bumper.RETURN_API_SUCCESS,
"data": { "data": {
"authCode": tmpauthcode, "authCode": self.generate_authcode(request.match_info.get("country", "us"), user),
"ecovacsUid": request.query["uid"], "ecovacsUid": request.query["uid"],
}, },
"msg": "操作成功", "msg": "操作成功",