authentication by reverse proxy

realms/modules/auth/__init__.py

@@ -5,8 +5,10 @@ from flask_login import login_url
 
 from realms import login_manager
 
+
 modules = set()
 
+
 @login_manager.unauthorized_handler
 def unauthorized():
     if request.method == 'GET':

realms/modules/auth/models.py

@@ -17,6 +17,7 @@ from . import modules
 def load_user(auth_id):
     return Auth.load_user(auth_id)
 
+
 auth_users = {}
 
 
@@ -40,7 +41,9 @@ class Auth(object):
     def login_forms():
         forms = []
         for t in modules:
-            forms.append(Auth.get_auth_user(t).login_form())
+            form = Auth.get_auth_user(t).login_form()
+            if form:
+                forms.append(form)
         return "<hr />".join(forms)
 
 

realms/modules/auth/proxy/__init__.py

@@ -0,0 +1,5 @@
+from __future__ import absolute_import
+
+from realms.modules.auth.models import Auth
+
+Auth.register('proxy')

realms/modules/auth/proxy/models.py

@@ -0,0 +1,42 @@
+from __future__ import absolute_import
+
+from flask_login import login_user
+
+from realms.modules.auth.models import BaseUser
+
+
+users = {}
+
+
+class User(BaseUser):
+    type = 'proxy'
+
+    def __init__(self, username, email='null@localhost.local', password="dummypassword"):
+        self.id = username
+        self.username = username
+        self.email = email
+        self.password = password
+
+    @property
+    def auth_token_id(self):
+        return self.password
+
+    @staticmethod
+    def load_user(*args, **kwargs):
+        return User.get_by_id(args[0])
+
+    @staticmethod
+    def get_by_id(user_id):
+        return users.get(user_id)
+
+    @staticmethod
+    def login_form():
+        return None
+
+    @staticmethod
+    def do_login(user_id):
+        user = User(user_id)
+        users[user_id] = user
+        login_user(user, remember=True)
+        return True
+

realms/modules/auth/views.py

@@ -1,7 +1,7 @@
 from __future__ import absolute_import
 
 from flask import current_app, render_template, request, redirect, Blueprint, flash, url_for, session
-from flask_login import logout_user
+from flask_login import logout_user, current_user
 
 from .models import Auth
 
@@ -12,6 +12,8 @@ blueprint = Blueprint('auth', __name__, template_folder='templates')
 @blueprint.route("/login", methods=['GET', 'POST'])
 def login():
     next_url = request.args.get('next') or url_for(current_app.config['ROOT_ENDPOINT'])
+    if current_user.is_authenticated():
+        return redirect(next_url)
     session['next_url'] = next_url
     return render_template("auth/login.html", forms=Auth.login_forms())
 

realms/modules/wiki/views.py

@@ -18,7 +18,7 @@ blueprint = Blueprint('wiki', __name__, template_folder='templates',
 
 @blueprint.route("/_commit/<sha>/<path:name>")
 def commit(name, sha):
-    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous:
+    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous():
         return current_app.login_manager.unauthorized()
 
     cname = to_canonical(name)
@@ -35,7 +35,7 @@ def commit(name, sha):
 
 @blueprint.route(r"/_compare/<path:name>/<regex('\w+'):fsha><regex('\.{2,3}'):dots><regex('\w+'):lsha>")
 def compare(name, fsha, dots, lsha):
-    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous:
+    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous():
         return current_app.login_manager.unauthorized()
 
     diff = g.current_wiki.get_page(name, sha=lsha).compare(fsha)
@@ -50,7 +50,7 @@ def revert():
     commit = request.form.get('commit')
     message = request.form.get('message', "Reverting %s" % cname)
 
-    if not current_app.config.get('ALLOW_ANON') and current_user.is_anonymous:
+    if not current_app.config.get('ALLOW_ANON') and current_user.is_anonymous():
         return dict(error=True, message="Anonymous posting not allowed"), 403
 
     if cname in current_app.config.get('WIKI_LOCKED_PAGES'):
@@ -72,7 +72,7 @@ def revert():
 
 @blueprint.route("/_history/<path:name>")
 def history(name):
-    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous:
+    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous():
         return current_app.login_manager.unauthorized()
     return render_template('wiki/history.html', name=name)
 
@@ -197,7 +197,7 @@ def _tree_index(items, path=""):
 @blueprint.route("/_index", defaults={"path": ""})
 @blueprint.route("/_index/<path:path>")
 def index(path):
-    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous:
+    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous():
         return current_app.login_manager.unauthorized()
 
     items = g.current_wiki.get_index()
@@ -218,7 +218,7 @@ def page_write(name):
     if not cname:
         return dict(error=True, message="Invalid name")
 
-    if not current_app.config.get('ALLOW_ANON') and current_user.is_anonymous:
+    if not current_app.config.get('ALLOW_ANON') and current_user.is_anonymous():
         return dict(error=True, message="Anonymous posting not allowed"), 403
 
     if request.method == 'POST':
@@ -261,7 +261,7 @@ def page_write(name):
 @blueprint.route("/", defaults={'name': 'home'})
 @blueprint.route("/<path:name>")
 def page(name):
-    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous:
+    if current_app.config.get('PRIVATE_WIKI') and current_user.is_anonymous():
         return current_app.login_manager.unauthorized()
 
     cname = to_canonical(name)