Commit 035b9b92 authored by Alex Kakiris's avatar Alex Kakiris
Browse files

add regular user login with role-based API access

parent 86034c16

capif_backend/backoffice_service/controllers/apis_controller.py

+2 −1
Original line number Diff line number Diff line
@@ -6,10 +6,11 @@ from flask_jwt_extended import jwt_required, get_jwt_identity 
from flask_cors import cross_origin

import requests

from flask import request



from ..utils.utils import admin_only



# create blueprint backoffice_routes

apis_routes = Blueprint("apis_routes", __name__)

apis_routes.before_request(admin_only)

operations = Operations()   # create operations object -> operations.py

capif_backend/backoffice_service/controllers/configuration_controller.py

+2 −1
Original line number Diff line number Diff line
@@ -8,11 +8,12 @@ import requests 
from flask import request, make_response

import jsonschema

from jsonschema import validate, ValidationError

from ..utils.utils import is_snake_case, validate_snake_case_keys

from ..utils.utils import is_snake_case, validate_snake_case_keys, admin_only





# create blueprint backoffice_routes

configuration_routes = Blueprint("configuration_routes", __name__)

configuration_routes.before_request(admin_only)

operations = Operations()   # create operations object -> operations.py

capif_backend/backoffice_service/controllers/default_controller.py

+2 −0
Original line number Diff line number Diff line
@@ -6,11 +6,13 @@ from flask_jwt_extended import jwt_required, get_jwt_identity 
from flask_cors import cross_origin

import requests

from flask import request

from ..utils.utils import admin_only



GRAFANA_URL = 'http://grafana.mon.svc.cluster.local:3000'



# create blueprint backoffice_routes

backoffice_routes = Blueprint("backoffice_routes", __name__)

backoffice_routes.before_request(admin_only)

operations = Operations()   # create operations object -> operations.py

capif_backend/backoffice_service/controllers/invokers_controller.py

+2 −1
Original line number Diff line number Diff line
@@ -6,10 +6,11 @@ from flask_jwt_extended import jwt_required, get_jwt_identity 
from flask_cors import cross_origin

import requests

from flask import request



from ..utils.utils import admin_only



# create blueprint backoffice_routes

invokers_routes = Blueprint("invokers_routes", __name__)

invokers_routes.before_request(admin_only)

operations = Operations()   # create operations object -> operations.py

capif_backend/backoffice_service/controllers/login.py

+21 −10
Original line number Diff line number Diff line 
#!/usr/bin/env python3

from flask import Blueprint, jsonify, request

from flask_jwt_extended import JWTManager, create_access_token, create_refresh_token, get_jwt_identity, jwt_required

from flask_jwt_extended import JWTManager, create_access_token, create_refresh_token, get_jwt_identity, get_jwt, jwt_required

from flask_cors import cross_origin

from datetime import timedelta



from ..core.operations import Operations



# create blueprint backoffice_routes

access_routes = Blueprint("access_routes", __name__)

operations = Operations()   # create operations object -> operations.py



@cross_origin()

@access_routes.route("/login", methods=["POST", "OPTIONS"])
@@ -17,13 +20,16 @@ def login(): 
    password = request.form.get("password", None)



    print("username: ", username)

    print("password: ", password)



    role = "admin"

    # Check if the username and password are correct

    # TODO: Implement proper authentication mechanism (e.g., check against a database)

    if username != "superadmin" or password != "admin":

        _, status_code = operations.user_login(username, password)

        if status_code != 200:

            print("Bad username or password")

            return jsonify({"msg": "Bad username or password"}), 401

        role = "user"



    # Configure token expiration to 24 hours

    # expires = timedelta(hours=8)
@@ -35,10 +41,12 @@ def login(): 
    expires_refresh = timedelta(minutes=240)



    # identity is a data that can be serialized in json -> username = superadmin

    access_token = create_access_token(identity=username, expires_delta=expires)

    refresh_token = create_refresh_token(identity=username, expires_delta=expires_refresh)

    access_token = create_access_token(identity=username, expires_delta=expires,

                                       additional_claims={"role": role})

    refresh_token = create_refresh_token(identity=username, expires_delta=expires_refresh,

                                         additional_claims={"role": role})



    return jsonify(access_token=access_token, refresh_token=refresh_token)

    return jsonify(access_token=access_token, refresh_token=refresh_token, role=role)



@cross_origin()

@access_routes.route('/refresh', methods=["POST", "OPTIONS"])
@@ -48,12 +56,14 @@ def refresh(): 
        return jsonify(message="CORS options OK"), 200



    current_user = get_jwt_identity()

    role = get_jwt().get("role", "user") # Get the role from the refresh token claims



    # Configure new access token expiration to 8 hours

    expires = timedelta(hours=8)

    new_access_token = create_access_token(identity=current_user, expires_delta=expires)

    new_access_token = create_access_token(identity=current_user, expires_delta=expires,

                                           additional_claims={"role": role}) # New access token with the same role as the refresh token



    return jsonify(access_token=new_access_token)

    return jsonify(access_token=new_access_token, user=current_user, role=role)



# when pressing F5 on the page, if there is a JWT in cookies, you must verify whether that JWT is valid

# and fetch any user data from the backend that may be relevant
@@ -68,6 +78,7 @@ def authme(): 


    # You can get the user identity from the token with get_jwt_identity()

    current_user = get_jwt_identity()

    role = get_jwt().get("role")  # Get the role from the token claims



    # If we get here, the token is valid, so you can return 200 OK

    return jsonify(message="Valid token", user=current_user), 200
 
    return jsonify(message="Valid token", user=current_user, role=role), 200 # Return the current user and role in the response