58 lines
2.2 KiB
Python
58 lines
2.2 KiB
Python
import os
|
|
|
|
import bcrypt
|
|
from flask import current_app
|
|
|
|
from flask_jwt_extended import get_jwt_identity
|
|
|
|
from database.models import AuthLevel, User
|
|
|
|
|
|
def auth_level_required(level: AuthLevel):
|
|
"""
|
|
Limit access to given authorization level.
|
|
|
|
:param level: Required authorization level to access this endpoint
|
|
:return: 403 Unauthorized upon auth failure or response of decorated function on auth success
|
|
"""
|
|
|
|
def auth_inner(func):
|
|
def auth_wrapper(*args, **kwargs):
|
|
user = User.objects.get(username=get_jwt_identity())
|
|
if AuthLevel(user.level) < level:
|
|
current_app.logger.warning("Attempted access to unauthorized resource by %s", user.username)
|
|
return '', 403
|
|
else:
|
|
return func(*args, **kwargs)
|
|
|
|
auth_wrapper.__name__ = func.__name__
|
|
return auth_wrapper
|
|
|
|
return auth_inner
|
|
|
|
|
|
def create_admin_user():
|
|
"""
|
|
Create default admin user if no admin users are present in the database
|
|
|
|
:return: None
|
|
"""
|
|
if User.objects(level=AuthLevel.ADMIN.value).count() == 0:
|
|
current_app.logger.info("No admin users exist. Creating default admin user...")
|
|
try:
|
|
admin_username = os.environ["TAILFIN_ADMIN_USERNAME"]
|
|
current_app.logger.info("Setting admin username to 'TAILFIN_ADMIN_USERNAME': %s", admin_username)
|
|
except KeyError:
|
|
admin_username = "admin"
|
|
current_app.logger.info("'TAILFIN_ADMIN_USERNAME' not set, using default username 'admin'")
|
|
try:
|
|
admin_password = os.environ["TAILFIN_ADMIN_PASSWORD"]
|
|
current_app.logger.info("Setting admin password to 'TAILFIN_ADMIN_PASSWORD'")
|
|
except KeyError:
|
|
admin_password = "admin"
|
|
current_app.logger.warning("'TAILFIN_ADMIN_PASSWORD' not set, using default password 'admin'\n"
|
|
"Change this as soon as possible")
|
|
hashed_password = bcrypt.hashpw(admin_password.encode('utf-8'), bcrypt.gensalt())
|
|
User(username=admin_username, password=hashed_password, level=AuthLevel.ADMIN.value).save()
|
|
current_app.logger.info("Default admin user created with username %s", User.objects.get(level=AuthLevel.ADMIN).username)
|