| OLD | NEW |
|---|
| (Empty) |
| 1 # Copyright (C) 2010 Google Inc. | |
| 2 # | |
| 3 # Licensed under the Apache License, Version 2.0 (the "License"); | |
| 4 # you may not use this file except in compliance with the License. | |
| 5 # You may obtain a copy of the License at | |
| 6 # | |
| 7 # http://www.apache.org/licenses/LICENSE-2.0 | |
| 8 # | |
| 9 # Unless required by applicable law or agreed to in writing, software | |
| 10 # distributed under the License is distributed on an "AS IS" BASIS, | |
| 11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 12 # See the License for the specific language governing permissions and | |
| 13 # limitations under the License. | |
| 14 | |
| 15 """Utilities for Google App Engine | |
| 16 | |
| 17 Utilities for making it easier to use OAuth 2.0 on Google App Engine. | |
| 18 """ | |
| 19 | |
| 20 __author__ = 'jcgregorio@google.com (Joe Gregorio)' | |
| 21 | |
| 22 import base64 | |
| 23 import cgi | |
| 24 import httplib2 | |
| 25 import logging | |
| 26 import os | |
| 27 import pickle | |
| 28 import time | |
| 29 | |
| 30 from google.appengine.api import app_identity | |
| 31 from google.appengine.api import memcache | |
| 32 from google.appengine.api import users | |
| 33 from google.appengine.ext import db | |
| 34 from google.appengine.ext import webapp | |
| 35 from google.appengine.ext.webapp.util import login_required | |
| 36 from google.appengine.ext.webapp.util import run_wsgi_app | |
| 37 from oauth2client import GOOGLE_AUTH_URI | |
| 38 from oauth2client import GOOGLE_REVOKE_URI | |
| 39 from oauth2client import GOOGLE_TOKEN_URI | |
| 40 from oauth2client import clientsecrets | |
| 41 from oauth2client import util | |
| 42 from oauth2client import xsrfutil | |
| 43 from oauth2client.anyjson import simplejson | |
| 44 from oauth2client.client import AccessTokenRefreshError | |
| 45 from oauth2client.client import AssertionCredentials | |
| 46 from oauth2client.client import Credentials | |
| 47 from oauth2client.client import Flow | |
| 48 from oauth2client.client import OAuth2WebServerFlow | |
| 49 from oauth2client.client import Storage | |
| 50 | |
| 51 # TODO(dhermes): Resolve import issue. | |
| 52 # This is a temporary fix for a Google internal issue. | |
| 53 try: | |
| 54 from google.appengine.ext import ndb | |
| 55 except ImportError: | |
| 56 ndb = None | |
| 57 | |
| 58 | |
| 59 logger = logging.getLogger(__name__) | |
| 60 | |
| 61 OAUTH2CLIENT_NAMESPACE = 'oauth2client#ns' | |
| 62 | |
| 63 XSRF_MEMCACHE_ID = 'xsrf_secret_key' | |
| 64 | |
| 65 | |
| 66 def _safe_html(s): | |
| 67 """Escape text to make it safe to display. | |
| 68 | |
| 69 Args: | |
| 70 s: string, The text to escape. | |
| 71 | |
| 72 Returns: | |
| 73 The escaped text as a string. | |
| 74 """ | |
| 75 return cgi.escape(s, quote=1).replace("'", ''') | |
| 76 | |
| 77 | |
| 78 class InvalidClientSecretsError(Exception): | |
| 79 """The client_secrets.json file is malformed or missing required fields.""" | |
| 80 | |
| 81 | |
| 82 class InvalidXsrfTokenError(Exception): | |
| 83 """The XSRF token is invalid or expired.""" | |
| 84 | |
| 85 | |
| 86 class SiteXsrfSecretKey(db.Model): | |
| 87 """Storage for the sites XSRF secret key. | |
| 88 | |
| 89 There will only be one instance stored of this model, the one used for the | |
| 90 site. | |
| 91 """ | |
| 92 secret = db.StringProperty() | |
| 93 | |
| 94 if ndb is not None: | |
| 95 class SiteXsrfSecretKeyNDB(ndb.Model): | |
| 96 """NDB Model for storage for the sites XSRF secret key. | |
| 97 | |
| 98 Since this model uses the same kind as SiteXsrfSecretKey, it can be used | |
| 99 interchangeably. This simply provides an NDB model for interacting with the | |
| 100 same data the DB model interacts with. | |
| 101 | |
| 102 There should only be one instance stored of this model, the one used for the | |
| 103 site. | |
| 104 """ | |
| 105 secret = ndb.StringProperty() | |
| 106 | |
| 107 @classmethod | |
| 108 def _get_kind(cls): | |
| 109 """Return the kind name for this class.""" | |
| 110 return 'SiteXsrfSecretKey' | |
| 111 | |
| 112 | |
| 113 def _generate_new_xsrf_secret_key(): | |
| 114 """Returns a random XSRF secret key. | |
| 115 """ | |
| 116 return os.urandom(16).encode("hex") | |
| 117 | |
| 118 | |
| 119 def xsrf_secret_key(): | |
| 120 """Return the secret key for use for XSRF protection. | |
| 121 | |
| 122 If the Site entity does not have a secret key, this method will also create | |
| 123 one and persist it. | |
| 124 | |
| 125 Returns: | |
| 126 The secret key. | |
| 127 """ | |
| 128 secret = memcache.get(XSRF_MEMCACHE_ID, namespace=OAUTH2CLIENT_NAMESPACE) | |
| 129 if not secret: | |
| 130 # Load the one and only instance of SiteXsrfSecretKey. | |
| 131 model = SiteXsrfSecretKey.get_or_insert(key_name='site') | |
| 132 if not model.secret: | |
| 133 model.secret = _generate_new_xsrf_secret_key() | |
| 134 model.put() | |
| 135 secret = model.secret | |
| 136 memcache.add(XSRF_MEMCACHE_ID, secret, namespace=OAUTH2CLIENT_NAMESPACE) | |
| 137 | |
| 138 return str(secret) | |
| 139 | |
| 140 | |
| 141 class AppAssertionCredentials(AssertionCredentials): | |
| 142 """Credentials object for App Engine Assertion Grants | |
| 143 | |
| 144 This object will allow an App Engine application to identify itself to Google | |
| 145 and other OAuth 2.0 servers that can verify assertions. It can be used for the | |
| 146 purpose of accessing data stored under an account assigned to the App Engine | |
| 147 application itself. | |
| 148 | |
| 149 This credential does not require a flow to instantiate because it represents | |
| 150 a two legged flow, and therefore has all of the required information to | |
| 151 generate and refresh its own access tokens. | |
| 152 """ | |
| 153 | |
| 154 @util.positional(2) | |
| 155 def __init__(self, scope, **kwargs): | |
| 156 """Constructor for AppAssertionCredentials | |
| 157 | |
| 158 Args: | |
| 159 scope: string or iterable of strings, scope(s) of the credentials being | |
| 160 requested. | |
| 161 """ | |
| 162 self.scope = util.scopes_to_string(scope) | |
| 163 | |
| 164 # Assertion type is no longer used, but still in the parent class signature. | |
| 165 super(AppAssertionCredentials, self).__init__(None) | |
| 166 | |
| 167 @classmethod | |
| 168 def from_json(cls, json): | |
| 169 data = simplejson.loads(json) | |
| 170 return AppAssertionCredentials(data['scope']) | |
| 171 | |
| 172 def _refresh(self, http_request): | |
| 173 """Refreshes the access_token. | |
| 174 | |
| 175 Since the underlying App Engine app_identity implementation does its own | |
| 176 caching we can skip all the storage hoops and just to a refresh using the | |
| 177 API. | |
| 178 | |
| 179 Args: | |
| 180 http_request: callable, a callable that matches the method signature of | |
| 181 httplib2.Http.request, used to make the refresh request. | |
| 182 | |
| 183 Raises: | |
| 184 AccessTokenRefreshError: When the refresh fails. | |
| 185 """ | |
| 186 try: | |
| 187 scopes = self.scope.split() | |
| 188 (token, _) = app_identity.get_access_token(scopes) | |
| 189 except app_identity.Error, e: | |
| 190 raise AccessTokenRefreshError(str(e)) | |
| 191 self.access_token = token | |
| 192 | |
| 193 | |
| 194 class FlowProperty(db.Property): | |
| 195 """App Engine datastore Property for Flow. | |
| 196 | |
| 197 Utility property that allows easy storage and retrieval of an | |
| 198 oauth2client.Flow""" | |
| 199 | |
| 200 # Tell what the user type is. | |
| 201 data_type = Flow | |
| 202 | |
| 203 # For writing to datastore. | |
| 204 def get_value_for_datastore(self, model_instance): | |
| 205 flow = super(FlowProperty, | |
| 206 self).get_value_for_datastore(model_instance) | |
| 207 return db.Blob(pickle.dumps(flow)) | |
| 208 | |
| 209 # For reading from datastore. | |
| 210 def make_value_from_datastore(self, value): | |
| 211 if value is None: | |
| 212 return None | |
| 213 return pickle.loads(value) | |
| 214 | |
| 215 def validate(self, value): | |
| 216 if value is not None and not isinstance(value, Flow): | |
| 217 raise db.BadValueError('Property %s must be convertible ' | |
| 218 'to a FlowThreeLegged instance (%s)' % | |
| 219 (self.name, value)) | |
| 220 return super(FlowProperty, self).validate(value) | |
| 221 | |
| 222 def empty(self, value): | |
| 223 return not value | |
| 224 | |
| 225 | |
| 226 if ndb is not None: | |
| 227 class FlowNDBProperty(ndb.PickleProperty): | |
| 228 """App Engine NDB datastore Property for Flow. | |
| 229 | |
| 230 Serves the same purpose as the DB FlowProperty, but for NDB models. Since | |
| 231 PickleProperty inherits from BlobProperty, the underlying representation of | |
| 232 the data in the datastore will be the same as in the DB case. | |
| 233 | |
| 234 Utility property that allows easy storage and retrieval of an | |
| 235 oauth2client.Flow | |
| 236 """ | |
| 237 | |
| 238 def _validate(self, value): | |
| 239 """Validates a value as a proper Flow object. | |
| 240 | |
| 241 Args: | |
| 242 value: A value to be set on the property. | |
| 243 | |
| 244 Raises: | |
| 245 TypeError if the value is not an instance of Flow. | |
| 246 """ | |
| 247 logger.info('validate: Got type %s', type(value)) | |
| 248 if value is not None and not isinstance(value, Flow): | |
| 249 raise TypeError('Property %s must be convertible to a flow ' | |
| 250 'instance; received: %s.' % (self._name, value)) | |
| 251 | |
| 252 | |
| 253 class CredentialsProperty(db.Property): | |
| 254 """App Engine datastore Property for Credentials. | |
| 255 | |
| 256 Utility property that allows easy storage and retrieval of | |
| 257 oath2client.Credentials | |
| 258 """ | |
| 259 | |
| 260 # Tell what the user type is. | |
| 261 data_type = Credentials | |
| 262 | |
| 263 # For writing to datastore. | |
| 264 def get_value_for_datastore(self, model_instance): | |
| 265 logger.info("get: Got type " + str(type(model_instance))) | |
| 266 cred = super(CredentialsProperty, | |
| 267 self).get_value_for_datastore(model_instance) | |
| 268 if cred is None: | |
| 269 cred = '' | |
| 270 else: | |
| 271 cred = cred.to_json() | |
| 272 return db.Blob(cred) | |
| 273 | |
| 274 # For reading from datastore. | |
| 275 def make_value_from_datastore(self, value): | |
| 276 logger.info("make: Got type " + str(type(value))) | |
| 277 if value is None: | |
| 278 return None | |
| 279 if len(value) == 0: | |
| 280 return None | |
| 281 try: | |
| 282 credentials = Credentials.new_from_json(value) | |
| 283 except ValueError: | |
| 284 credentials = None | |
| 285 return credentials | |
| 286 | |
| 287 def validate(self, value): | |
| 288 value = super(CredentialsProperty, self).validate(value) | |
| 289 logger.info("validate: Got type " + str(type(value))) | |
| 290 if value is not None and not isinstance(value, Credentials): | |
| 291 raise db.BadValueError('Property %s must be convertible ' | |
| 292 'to a Credentials instance (%s)' % | |
| 293 (self.name, value)) | |
| 294 #if value is not None and not isinstance(value, Credentials): | |
| 295 # return None | |
| 296 return value | |
| 297 | |
| 298 | |
| 299 if ndb is not None: | |
| 300 # TODO(dhermes): Turn this into a JsonProperty and overhaul the Credentials | |
| 301 # and subclass mechanics to use new_from_dict, to_dict, | |
| 302 # from_dict, etc. | |
| 303 class CredentialsNDBProperty(ndb.BlobProperty): | |
| 304 """App Engine NDB datastore Property for Credentials. | |
| 305 | |
| 306 Serves the same purpose as the DB CredentialsProperty, but for NDB models. | |
| 307 Since CredentialsProperty stores data as a blob and this inherits from | |
| 308 BlobProperty, the data in the datastore will be the same as in the DB case. | |
| 309 | |
| 310 Utility property that allows easy storage and retrieval of Credentials and | |
| 311 subclasses. | |
| 312 """ | |
| 313 def _validate(self, value): | |
| 314 """Validates a value as a proper credentials object. | |
| 315 | |
| 316 Args: | |
| 317 value: A value to be set on the property. | |
| 318 | |
| 319 Raises: | |
| 320 TypeError if the value is not an instance of Credentials. | |
| 321 """ | |
| 322 logger.info('validate: Got type %s', type(value)) | |
| 323 if value is not None and not isinstance(value, Credentials): | |
| 324 raise TypeError('Property %s must be convertible to a credentials ' | |
| 325 'instance; received: %s.' % (self._name, value)) | |
| 326 | |
| 327 def _to_base_type(self, value): | |
| 328 """Converts our validated value to a JSON serialized string. | |
| 329 | |
| 330 Args: | |
| 331 value: A value to be set in the datastore. | |
| 332 | |
| 333 Returns: | |
| 334 A JSON serialized version of the credential, else '' if value is None. | |
| 335 """ | |
| 336 if value is None: | |
| 337 return '' | |
| 338 else: | |
| 339 return value.to_json() | |
| 340 | |
| 341 def _from_base_type(self, value): | |
| 342 """Converts our stored JSON string back to the desired type. | |
| 343 | |
| 344 Args: | |
| 345 value: A value from the datastore to be converted to the desired type. | |
| 346 | |
| 347 Returns: | |
| 348 A deserialized Credentials (or subclass) object, else None if the | |
| 349 value can't be parsed. | |
| 350 """ | |
| 351 if not value: | |
| 352 return None | |
| 353 try: | |
| 354 # Uses the from_json method of the implied class of value | |
| 355 credentials = Credentials.new_from_json(value) | |
| 356 except ValueError: | |
| 357 credentials = None | |
| 358 return credentials | |
| 359 | |
| 360 | |
| 361 class StorageByKeyName(Storage): | |
| 362 """Store and retrieve a credential to and from the App Engine datastore. | |
| 363 | |
| 364 This Storage helper presumes the Credentials have been stored as a | |
| 365 CredentialsProperty or CredentialsNDBProperty on a datastore model class, and | |
| 366 that entities are stored by key_name. | |
| 367 """ | |
| 368 | |
| 369 @util.positional(4) | |
| 370 def __init__(self, model, key_name, property_name, cache=None): | |
| 371 """Constructor for Storage. | |
| 372 | |
| 373 Args: | |
| 374 model: db.Model or ndb.Model, model class | |
| 375 key_name: string, key name for the entity that has the credentials | |
| 376 property_name: string, name of the property that is a CredentialsProperty | |
| 377 or CredentialsNDBProperty. | |
| 378 cache: memcache, a write-through cache to put in front of the datastore. | |
| 379 If the model you are using is an NDB model, using a cache will be | |
| 380 redundant since the model uses an instance cache and memcache for you. | |
| 381 """ | |
| 382 self._model = model | |
| 383 self._key_name = key_name | |
| 384 self._property_name = property_name | |
| 385 self._cache = cache | |
| 386 | |
| 387 def _is_ndb(self): | |
| 388 """Determine whether the model of the instance is an NDB model. | |
| 389 | |
| 390 Returns: | |
| 391 Boolean indicating whether or not the model is an NDB or DB model. | |
| 392 """ | |
| 393 # issubclass will fail if one of the arguments is not a class, only need | |
| 394 # worry about new-style classes since ndb and db models are new-style | |
| 395 if isinstance(self._model, type): | |
| 396 if ndb is not None and issubclass(self._model, ndb.Model): | |
| 397 return True | |
| 398 elif issubclass(self._model, db.Model): | |
| 399 return False | |
| 400 | |
| 401 raise TypeError('Model class not an NDB or DB model: %s.' % (self._model,)) | |
| 402 | |
| 403 def _get_entity(self): | |
| 404 """Retrieve entity from datastore. | |
| 405 | |
| 406 Uses a different model method for db or ndb models. | |
| 407 | |
| 408 Returns: | |
| 409 Instance of the model corresponding to the current storage object | |
| 410 and stored using the key name of the storage object. | |
| 411 """ | |
| 412 if self._is_ndb(): | |
| 413 return self._model.get_by_id(self._key_name) | |
| 414 else: | |
| 415 return self._model.get_by_key_name(self._key_name) | |
| 416 | |
| 417 def _delete_entity(self): | |
| 418 """Delete entity from datastore. | |
| 419 | |
| 420 Attempts to delete using the key_name stored on the object, whether or not | |
| 421 the given key is in the datastore. | |
| 422 """ | |
| 423 if self._is_ndb(): | |
| 424 ndb.Key(self._model, self._key_name).delete() | |
| 425 else: | |
| 426 entity_key = db.Key.from_path(self._model.kind(), self._key_name) | |
| 427 db.delete(entity_key) | |
| 428 | |
| 429 def locked_get(self): | |
| 430 """Retrieve Credential from datastore. | |
| 431 | |
| 432 Returns: | |
| 433 oauth2client.Credentials | |
| 434 """ | |
| 435 if self._cache: | |
| 436 json = self._cache.get(self._key_name) | |
| 437 if json: | |
| 438 return Credentials.new_from_json(json) | |
| 439 | |
| 440 credentials = None | |
| 441 entity = self._get_entity() | |
| 442 if entity is not None: | |
| 443 credentials = getattr(entity, self._property_name) | |
| 444 if credentials and hasattr(credentials, 'set_store'): | |
| 445 credentials.set_store(self) | |
| 446 if self._cache: | |
| 447 self._cache.set(self._key_name, credentials.to_json()) | |
| 448 | |
| 449 return credentials | |
| 450 | |
| 451 def locked_put(self, credentials): | |
| 452 """Write a Credentials to the datastore. | |
| 453 | |
| 454 Args: | |
| 455 credentials: Credentials, the credentials to store. | |
| 456 """ | |
| 457 entity = self._model.get_or_insert(self._key_name) | |
| 458 setattr(entity, self._property_name, credentials) | |
| 459 entity.put() | |
| 460 if self._cache: | |
| 461 self._cache.set(self._key_name, credentials.to_json()) | |
| 462 | |
| 463 def locked_delete(self): | |
| 464 """Delete Credential from datastore.""" | |
| 465 | |
| 466 if self._cache: | |
| 467 self._cache.delete(self._key_name) | |
| 468 | |
| 469 self._delete_entity() | |
| 470 | |
| 471 | |
| 472 class CredentialsModel(db.Model): | |
| 473 """Storage for OAuth 2.0 Credentials | |
| 474 | |
| 475 Storage of the model is keyed by the user.user_id(). | |
| 476 """ | |
| 477 credentials = CredentialsProperty() | |
| 478 | |
| 479 | |
| 480 if ndb is not None: | |
| 481 class CredentialsNDBModel(ndb.Model): | |
| 482 """NDB Model for storage of OAuth 2.0 Credentials | |
| 483 | |
| 484 Since this model uses the same kind as CredentialsModel and has a property | |
| 485 which can serialize and deserialize Credentials correctly, it can be used | |
| 486 interchangeably with a CredentialsModel to access, insert and delete the | |
| 487 same entities. This simply provides an NDB model for interacting with the | |
| 488 same data the DB model interacts with. | |
| 489 | |
| 490 Storage of the model is keyed by the user.user_id(). | |
| 491 """ | |
| 492 credentials = CredentialsNDBProperty() | |
| 493 | |
| 494 @classmethod | |
| 495 def _get_kind(cls): | |
| 496 """Return the kind name for this class.""" | |
| 497 return 'CredentialsModel' | |
| 498 | |
| 499 | |
| 500 def _build_state_value(request_handler, user): | |
| 501 """Composes the value for the 'state' parameter. | |
| 502 | |
| 503 Packs the current request URI and an XSRF token into an opaque string that | |
| 504 can be passed to the authentication server via the 'state' parameter. | |
| 505 | |
| 506 Args: | |
| 507 request_handler: webapp.RequestHandler, The request. | |
| 508 user: google.appengine.api.users.User, The current user. | |
| 509 | |
| 510 Returns: | |
| 511 The state value as a string. | |
| 512 """ | |
| 513 uri = request_handler.request.url | |
| 514 token = xsrfutil.generate_token(xsrf_secret_key(), user.user_id(), | |
| 515 action_id=str(uri)) | |
| 516 return uri + ':' + token | |
| 517 | |
| 518 | |
| 519 def _parse_state_value(state, user): | |
| 520 """Parse the value of the 'state' parameter. | |
| 521 | |
| 522 Parses the value and validates the XSRF token in the state parameter. | |
| 523 | |
| 524 Args: | |
| 525 state: string, The value of the state parameter. | |
| 526 user: google.appengine.api.users.User, The current user. | |
| 527 | |
| 528 Raises: | |
| 529 InvalidXsrfTokenError: if the XSRF token is invalid. | |
| 530 | |
| 531 Returns: | |
| 532 The redirect URI. | |
| 533 """ | |
| 534 uri, token = state.rsplit(':', 1) | |
| 535 if not xsrfutil.validate_token(xsrf_secret_key(), token, user.user_id(), | |
| 536 action_id=uri): | |
| 537 raise InvalidXsrfTokenError() | |
| 538 | |
| 539 return uri | |
| 540 | |
| 541 | |
| 542 class OAuth2Decorator(object): | |
| 543 """Utility for making OAuth 2.0 easier. | |
| 544 | |
| 545 Instantiate and then use with oauth_required or oauth_aware | |
| 546 as decorators on webapp.RequestHandler methods. | |
| 547 | |
| 548 Example: | |
| 549 | |
| 550 decorator = OAuth2Decorator( | |
| 551 client_id='837...ent.com', | |
| 552 client_secret='Qh...wwI', | |
| 553 scope='https://www.googleapis.com/auth/plus') | |
| 554 | |
| 555 | |
| 556 class MainHandler(webapp.RequestHandler): | |
| 557 | |
| 558 @decorator.oauth_required | |
| 559 def get(self): | |
| 560 http = decorator.http() | |
| 561 # http is authorized with the user's Credentials and can be used | |
| 562 # in API calls | |
| 563 | |
| 564 """ | |
| 565 | |
| 566 @util.positional(4) | |
| 567 def __init__(self, client_id, client_secret, scope, | |
| 568 auth_uri=GOOGLE_AUTH_URI, | |
| 569 token_uri=GOOGLE_TOKEN_URI, | |
| 570 revoke_uri=GOOGLE_REVOKE_URI, | |
| 571 user_agent=None, | |
| 572 message=None, | |
| 573 callback_path='/oauth2callback', | |
| 574 token_response_param=None, | |
| 575 **kwargs): | |
| 576 | |
| 577 """Constructor for OAuth2Decorator | |
| 578 | |
| 579 Args: | |
| 580 client_id: string, client identifier. | |
| 581 client_secret: string client secret. | |
| 582 scope: string or iterable of strings, scope(s) of the credentials being | |
| 583 requested. | |
| 584 auth_uri: string, URI for authorization endpoint. For convenience | |
| 585 defaults to Google's endpoints but any OAuth 2.0 provider can be used. | |
| 586 token_uri: string, URI for token endpoint. For convenience | |
| 587 defaults to Google's endpoints but any OAuth 2.0 provider can be used. | |
| 588 revoke_uri: string, URI for revoke endpoint. For convenience | |
| 589 defaults to Google's endpoints but any OAuth 2.0 provider can be used. | |
| 590 user_agent: string, User agent of your application, default to None. | |
| 591 message: Message to display if there are problems with the OAuth 2.0 | |
| 592 configuration. The message may contain HTML and will be presented on the | |
| 593 web interface for any method that uses the decorator. | |
| 594 callback_path: string, The absolute path to use as the callback URI. Note | |
| 595 that this must match up with the URI given when registering the | |
| 596 application in the APIs Console. | |
| 597 token_response_param: string. If provided, the full JSON response | |
| 598 to the access token request will be encoded and included in this query | |
| 599 parameter in the callback URI. This is useful with providers (e.g. | |
| 600 wordpress.com) that include extra fields that the client may want. | |
| 601 **kwargs: dict, Keyword arguments are be passed along as kwargs to the | |
| 602 OAuth2WebServerFlow constructor. | |
| 603 """ | |
| 604 self.flow = None | |
| 605 self.credentials = None | |
| 606 self._client_id = client_id | |
| 607 self._client_secret = client_secret | |
| 608 self._scope = util.scopes_to_string(scope) | |
| 609 self._auth_uri = auth_uri | |
| 610 self._token_uri = token_uri | |
| 611 self._revoke_uri = revoke_uri | |
| 612 self._user_agent = user_agent | |
| 613 self._kwargs = kwargs | |
| 614 self._message = message | |
| 615 self._in_error = False | |
| 616 self._callback_path = callback_path | |
| 617 self._token_response_param = token_response_param | |
| 618 | |
| 619 def _display_error_message(self, request_handler): | |
| 620 request_handler.response.out.write('<html><body>') | |
| 621 request_handler.response.out.write(_safe_html(self._message)) | |
| 622 request_handler.response.out.write('</body></html>') | |
| 623 | |
| 624 def oauth_required(self, method): | |
| 625 """Decorator that starts the OAuth 2.0 dance. | |
| 626 | |
| 627 Starts the OAuth dance for the logged in user if they haven't already | |
| 628 granted access for this application. | |
| 629 | |
| 630 Args: | |
| 631 method: callable, to be decorated method of a webapp.RequestHandler | |
| 632 instance. | |
| 633 """ | |
| 634 | |
| 635 def check_oauth(request_handler, *args, **kwargs): | |
| 636 if self._in_error: | |
| 637 self._display_error_message(request_handler) | |
| 638 return | |
| 639 | |
| 640 user = users.get_current_user() | |
| 641 # Don't use @login_decorator as this could be used in a POST request. | |
| 642 if not user: | |
| 643 request_handler.redirect(users.create_login_url( | |
| 644 request_handler.request.uri)) | |
| 645 return | |
| 646 | |
| 647 self._create_flow(request_handler) | |
| 648 | |
| 649 # Store the request URI in 'state' so we can use it later | |
| 650 self.flow.params['state'] = _build_state_value(request_handler, user) | |
| 651 self.credentials = StorageByKeyName( | |
| 652 CredentialsModel, user.user_id(), 'credentials').get() | |
| 653 | |
| 654 if not self.has_credentials(): | |
| 655 return request_handler.redirect(self.authorize_url()) | |
| 656 try: | |
| 657 return method(request_handler, *args, **kwargs) | |
| 658 except AccessTokenRefreshError: | |
| 659 return request_handler.redirect(self.authorize_url()) | |
| 660 | |
| 661 return check_oauth | |
| 662 | |
| 663 def _create_flow(self, request_handler): | |
| 664 """Create the Flow object. | |
| 665 | |
| 666 The Flow is calculated lazily since we don't know where this app is | |
| 667 running until it receives a request, at which point redirect_uri can be | |
| 668 calculated and then the Flow object can be constructed. | |
| 669 | |
| 670 Args: | |
| 671 request_handler: webapp.RequestHandler, the request handler. | |
| 672 """ | |
| 673 if self.flow is None: | |
| 674 redirect_uri = request_handler.request.relative_url( | |
| 675 self._callback_path) # Usually /oauth2callback | |
| 676 self.flow = OAuth2WebServerFlow(self._client_id, self._client_secret, | |
| 677 self._scope, redirect_uri=redirect_uri, | |
| 678 user_agent=self._user_agent, | |
| 679 auth_uri=self._auth_uri, | |
| 680 token_uri=self._token_uri, | |
| 681 revoke_uri=self._revoke_uri, | |
| 682 **self._kwargs) | |
| 683 | |
| 684 def oauth_aware(self, method): | |
| 685 """Decorator that sets up for OAuth 2.0 dance, but doesn't do it. | |
| 686 | |
| 687 Does all the setup for the OAuth dance, but doesn't initiate it. | |
| 688 This decorator is useful if you want to create a page that knows | |
| 689 whether or not the user has granted access to this application. | |
| 690 From within a method decorated with @oauth_aware the has_credentials() | |
| 691 and authorize_url() methods can be called. | |
| 692 | |
| 693 Args: | |
| 694 method: callable, to be decorated method of a webapp.RequestHandler | |
| 695 instance. | |
| 696 """ | |
| 697 | |
| 698 def setup_oauth(request_handler, *args, **kwargs): | |
| 699 if self._in_error: | |
| 700 self._display_error_message(request_handler) | |
| 701 return | |
| 702 | |
| 703 user = users.get_current_user() | |
| 704 # Don't use @login_decorator as this could be used in a POST request. | |
| 705 if not user: | |
| 706 request_handler.redirect(users.create_login_url( | |
| 707 request_handler.request.uri)) | |
| 708 return | |
| 709 | |
| 710 self._create_flow(request_handler) | |
| 711 | |
| 712 self.flow.params['state'] = _build_state_value(request_handler, user) | |
| 713 self.credentials = StorageByKeyName( | |
| 714 CredentialsModel, user.user_id(), 'credentials').get() | |
| 715 return method(request_handler, *args, **kwargs) | |
| 716 return setup_oauth | |
| 717 | |
| 718 def has_credentials(self): | |
| 719 """True if for the logged in user there are valid access Credentials. | |
| 720 | |
| 721 Must only be called from with a webapp.RequestHandler subclassed method | |
| 722 that had been decorated with either @oauth_required or @oauth_aware. | |
| 723 """ | |
| 724 return self.credentials is not None and not self.credentials.invalid | |
| 725 | |
| 726 def authorize_url(self): | |
| 727 """Returns the URL to start the OAuth dance. | |
| 728 | |
| 729 Must only be called from with a webapp.RequestHandler subclassed method | |
| 730 that had been decorated with either @oauth_required or @oauth_aware. | |
| 731 """ | |
| 732 url = self.flow.step1_get_authorize_url() | |
| 733 return str(url) | |
| 734 | |
| 735 def http(self): | |
| 736 """Returns an authorized http instance. | |
| 737 | |
| 738 Must only be called from within an @oauth_required decorated method, or | |
| 739 from within an @oauth_aware decorated method where has_credentials() | |
| 740 returns True. | |
| 741 """ | |
| 742 return self.credentials.authorize(httplib2.Http()) | |
| 743 | |
| 744 @property | |
| 745 def callback_path(self): | |
| 746 """The absolute path where the callback will occur. | |
| 747 | |
| 748 Note this is the absolute path, not the absolute URI, that will be | |
| 749 calculated by the decorator at runtime. See callback_handler() for how this | |
| 750 should be used. | |
| 751 | |
| 752 Returns: | |
| 753 The callback path as a string. | |
| 754 """ | |
| 755 return self._callback_path | |
| 756 | |
| 757 | |
| 758 def callback_handler(self): | |
| 759 """RequestHandler for the OAuth 2.0 redirect callback. | |
| 760 | |
| 761 Usage: | |
| 762 app = webapp.WSGIApplication([ | |
| 763 ('/index', MyIndexHandler), | |
| 764 ..., | |
| 765 (decorator.callback_path, decorator.callback_handler()) | |
| 766 ]) | |
| 767 | |
| 768 Returns: | |
| 769 A webapp.RequestHandler that handles the redirect back from the | |
| 770 server during the OAuth 2.0 dance. | |
| 771 """ | |
| 772 decorator = self | |
| 773 | |
| 774 class OAuth2Handler(webapp.RequestHandler): | |
| 775 """Handler for the redirect_uri of the OAuth 2.0 dance.""" | |
| 776 | |
| 777 @login_required | |
| 778 def get(self): | |
| 779 error = self.request.get('error') | |
| 780 if error: | |
| 781 errormsg = self.request.get('error_description', error) | |
| 782 self.response.out.write( | |
| 783 'The authorization request failed: %s' % _safe_html(errormsg)) | |
| 784 else: | |
| 785 user = users.get_current_user() | |
| 786 decorator._create_flow(self) | |
| 787 credentials = decorator.flow.step2_exchange(self.request.params) | |
| 788 StorageByKeyName( | |
| 789 CredentialsModel, user.user_id(), 'credentials').put(credentials) | |
| 790 redirect_uri = _parse_state_value(str(self.request.get('state')), | |
| 791 user) | |
| 792 | |
| 793 if decorator._token_response_param and credentials.token_response: | |
| 794 resp_json = simplejson.dumps(credentials.token_response) | |
| 795 redirect_uri = util._add_query_parameter( | |
| 796 redirect_uri, decorator._token_response_param, resp_json) | |
| 797 | |
| 798 self.redirect(redirect_uri) | |
| 799 | |
| 800 return OAuth2Handler | |
| 801 | |
| 802 def callback_application(self): | |
| 803 """WSGI application for handling the OAuth 2.0 redirect callback. | |
| 804 | |
| 805 If you need finer grained control use `callback_handler` which returns just | |
| 806 the webapp.RequestHandler. | |
| 807 | |
| 808 Returns: | |
| 809 A webapp.WSGIApplication that handles the redirect back from the | |
| 810 server during the OAuth 2.0 dance. | |
| 811 """ | |
| 812 return webapp.WSGIApplication([ | |
| 813 (self.callback_path, self.callback_handler()) | |
| 814 ]) | |
| 815 | |
| 816 | |
| 817 class OAuth2DecoratorFromClientSecrets(OAuth2Decorator): | |
| 818 """An OAuth2Decorator that builds from a clientsecrets file. | |
| 819 | |
| 820 Uses a clientsecrets file as the source for all the information when | |
| 821 constructing an OAuth2Decorator. | |
| 822 | |
| 823 Example: | |
| 824 | |
| 825 decorator = OAuth2DecoratorFromClientSecrets( | |
| 826 os.path.join(os.path.dirname(__file__), 'client_secrets.json') | |
| 827 scope='https://www.googleapis.com/auth/plus') | |
| 828 | |
| 829 | |
| 830 class MainHandler(webapp.RequestHandler): | |
| 831 | |
| 832 @decorator.oauth_required | |
| 833 def get(self): | |
| 834 http = decorator.http() | |
| 835 # http is authorized with the user's Credentials and can be used | |
| 836 # in API calls | |
| 837 """ | |
| 838 | |
| 839 @util.positional(3) | |
| 840 def __init__(self, filename, scope, message=None, cache=None): | |
| 841 """Constructor | |
| 842 | |
| 843 Args: | |
| 844 filename: string, File name of client secrets. | |
| 845 scope: string or iterable of strings, scope(s) of the credentials being | |
| 846 requested. | |
| 847 message: string, A friendly string to display to the user if the | |
| 848 clientsecrets file is missing or invalid. The message may contain HTML | |
| 849 and will be presented on the web interface for any method that uses the | |
| 850 decorator. | |
| 851 cache: An optional cache service client that implements get() and set() | |
| 852 methods. See clientsecrets.loadfile() for details. | |
| 853 """ | |
| 854 client_type, client_info = clientsecrets.loadfile(filename, cache=cache) | |
| 855 if client_type not in [ | |
| 856 clientsecrets.TYPE_WEB, clientsecrets.TYPE_INSTALLED]: | |
| 857 raise InvalidClientSecretsError( | |
| 858 'OAuth2Decorator doesn\'t support this OAuth 2.0 flow.') | |
| 859 constructor_kwargs = { | |
| 860 'auth_uri': client_info['auth_uri'], | |
| 861 'token_uri': client_info['token_uri'], | |
| 862 'message': message, | |
| 863 } | |
| 864 revoke_uri = client_info.get('revoke_uri') | |
| 865 if revoke_uri is not None: | |
| 866 constructor_kwargs['revoke_uri'] = revoke_uri | |
| 867 super(OAuth2DecoratorFromClientSecrets, self).__init__( | |
| 868 client_info['client_id'], client_info['client_secret'], | |
| 869 scope, **constructor_kwargs) | |
| 870 if message is not None: | |
| 871 self._message = message | |
| 872 else: | |
| 873 self._message = 'Please configure your application for OAuth 2.0.' | |
| 874 | |
| 875 | |
| 876 @util.positional(2) | |
| 877 def oauth2decorator_from_clientsecrets(filename, scope, | |
| 878 message=None, cache=None): | |
| 879 """Creates an OAuth2Decorator populated from a clientsecrets file. | |
| 880 | |
| 881 Args: | |
| 882 filename: string, File name of client secrets. | |
| 883 scope: string or list of strings, scope(s) of the credentials being | |
| 884 requested. | |
| 885 message: string, A friendly string to display to the user if the | |
| 886 clientsecrets file is missing or invalid. The message may contain HTML and | |
| 887 will be presented on the web interface for any method that uses the | |
| 888 decorator. | |
| 889 cache: An optional cache service client that implements get() and set() | |
| 890 methods. See clientsecrets.loadfile() for details. | |
| 891 | |
| 892 Returns: An OAuth2Decorator | |
| 893 | |
| 894 """ | |
| 895 return OAuth2DecoratorFromClientSecrets(filename, scope, | |
| 896 message=message, cache=cache) | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 23531026:
Remove the review bot app. (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/tools/