diff options
| -rw-r--r-- | src/leap/soledad/__init__.py | 4 | ||||
| -rw-r--r-- | src/leap/soledad/backends/leap_backend.py | 12 | ||||
| -rw-r--r-- | src/leap/soledad/server.py | 46 |
3 files changed, 38 insertions, 24 deletions
diff --git a/src/leap/soledad/__init__.py b/src/leap/soledad/__init__.py index a736d32b..06f7c755 100644 --- a/src/leap/soledad/__init__.py +++ b/src/leap/soledad/__init__.py @@ -667,7 +667,7 @@ class Soledad(object): """ return self._db.resolve_doc(doc, conflicted_doc_revs) - def sync(self, url): + def sync(self, url, creds=None): """ Synchronize the local encrypted replica with a remote replica. @@ -679,7 +679,7 @@ class Soledad(object): @rtype: str """ # TODO: create authentication scheme for sync with server. - local_gen = self._db.sync(url, creds=None, autocreate=True) + local_gen = self._db.sync(url, creds=creds, autocreate=True) events.signal(events.events_pb2.SOLEDAD_DONE_DATA_SYNC, self._address) return local_gen diff --git a/src/leap/soledad/backends/leap_backend.py b/src/leap/soledad/backends/leap_backend.py index 05c27bc1..51c471eb 100644 --- a/src/leap/soledad/backends/leap_backend.py +++ b/src/leap/soledad/backends/leap_backend.py @@ -394,3 +394,15 @@ class LeapSyncTarget(HTTPSyncTarget): res = self._parse_sync_stream(data, return_doc_cb, ensure_callback) data = None return res['new_generation'], res['new_transaction_id'] + + def set_token_credentials(self, address, token): + self._creds = {'token': (address, token)} + + def _sign_request(self, method, url_query, params): + if 'token' in self._creds: + address, token = self._creds['token'] + auth = '%s:%s' % (address, token) + return [('Authorization', 'Token %s' % auth.encode('base64'))] + else: + return HTTPSyncTarget._sign_request( + self, method, url_query, params) diff --git a/src/leap/soledad/server.py b/src/leap/soledad/server.py index fdb98916..3d3c6f69 100644 --- a/src/leap/soledad/server.py +++ b/src/leap/soledad/server.py @@ -116,36 +116,34 @@ class SoledadAuthMiddleware(object): """ if self.prefix and not environ['PATH_INFO'].startswith(self.prefix): return self._error(start_response, 400, "bad request") + auth = environ.get('HTTP_AUTHORIZATION') + if not auth: + return self._error(start_response, 401, "unauthorized", + "Missing Token Authentication.") + scheme, encoded = auth.split(None, 1) + if scheme.lower() != 'token': + return self._error( + start_response, 401, "unauthorized", + "Missing Token Authentication") + address, token = encoded.decode('base64').split(':', 1) + try: + self.verify_token(environ, address, token) + except Unauthorized: + return self._error( + start_response, 401, "unauthorized", + "Incorrect address or token.") + del environ['HTTP_AUTHORIZATION'] shift_path_info(environ) - qs = parse_qs(environ.get('QUERY_STRING'), strict_parsing=True) - if 'auth_token' not in qs: - if self.need_auth(environ): - return self._error(start_response, 401, "unauthorized", - "Missing Authentication Token.") - else: - token = qs['auth_token'][0] - try: - self.verify_token(environ, token) - except Unauthorized: - return self._error( - start_response, 401, "unauthorized", - "Incorrect password or login.") - # remove auth token from query string. - del qs['auth_token'] - qs_str = '' - if qs: - qs_str = reduce(lambda x, y: '&'.join([x, y]), - map(lambda (x, y): '='.join([x, str(y)]), - qs.iteritems())) - environ['QUERY_STRING'] = qs_str return self.app(environ, start_response) - def verify_token(self, environ, token): + def verify_token(self, environ, address, token): """ Verify if token is valid for authenticating this request. @param environ: Dictionary containing CGI variables. @type environ: dict + @param token: The user address. + @type token: str @param token: The authentication token. @type token: str @@ -195,6 +193,10 @@ class SoledadApp(http_app.HTTPApp): @return: HTTP application results. @rtype: list """ + # TODO: this is a hack for tests to pass, we should remove it asap. + #if environ['CONTENT_LENGTH'] == '': + # environ['CONTENT_LENGTH'] = 1 + #import ipdb; ipdb.set_trace() return http_app.HTTPApp.__call__(self, environ, start_response) |