Rename django_etesync to django_etebase.
This commit is contained in:
Tom Hacohen
1
django_etebase/__init__.py
Normal file
1
django_etebase/__init__.py
Normal file
@@ -0,0 +1 @@
|
||||
from .app_settings import app_settings
|
||||
3
django_etebase/admin.py
Normal file
3
django_etebase/admin.py
Normal file
@@ -0,0 +1,3 @@
|
||||
from django.contrib import admin
|
||||
|
||||
# Register your models here.
|
||||
54
django_etebase/app_settings.py
Normal file
54
django_etebase/app_settings.py
Normal file
@@ -0,0 +1,54 @@
|
||||
# Copyright © 2017 Tom Hacohen
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, version 3.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
class AppSettings:
|
||||
def __init__(self, prefix):
|
||||
self.prefix = prefix
|
||||
|
||||
def import_from_str(self, name):
|
||||
from importlib import import_module
|
||||
|
||||
path, prop = name.rsplit('.', 1)
|
||||
|
||||
mod = import_module(path)
|
||||
return getattr(mod, prop)
|
||||
|
||||
def _setting(self, name, dflt):
|
||||
from django.conf import settings
|
||||
return getattr(settings, self.prefix + name, dflt)
|
||||
|
||||
@property
|
||||
def API_PERMISSIONS(self): # pylint: disable=invalid-name
|
||||
perms = self._setting("API_PERMISSIONS", ('rest_framework.permissions.IsAuthenticated', ))
|
||||
ret = []
|
||||
for perm in perms:
|
||||
ret.append(self.import_from_str(perm))
|
||||
return ret
|
||||
|
||||
@property
|
||||
def API_AUTHENTICATORS(self): # pylint: disable=invalid-name
|
||||
perms = self._setting("API_AUTHENTICATORS", ('rest_framework.authentication.TokenAuthentication',
|
||||
'rest_framework.authentication.SessionAuthentication'))
|
||||
ret = []
|
||||
for perm in perms:
|
||||
ret.append(self.import_from_str(perm))
|
||||
return ret
|
||||
|
||||
@property
|
||||
def CHALLENGE_VALID_SECONDS(self): # pylint: disable=invalid-name
|
||||
return self._setting("CHALLENGE_VALID_SECONDS", 60)
|
||||
|
||||
|
||||
app_settings = AppSettings('ETEBASE_')
|
||||
5
django_etebase/apps.py
Normal file
5
django_etebase/apps.py
Normal file
@@ -0,0 +1,5 @@
|
||||
from django.apps import AppConfig
|
||||
|
||||
|
||||
class DjangoEtebaseConfig(AppConfig):
|
||||
name = 'django_etebase'
|
||||
91
django_etebase/migrations/0001_initial.py
Normal file
91
django_etebase/migrations/0001_initial.py
Normal file
@@ -0,0 +1,91 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-13 13:01
|
||||
|
||||
from django.conf import settings
|
||||
import django.core.validators
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
import django_etebase.models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
initial = True
|
||||
|
||||
dependencies = [
|
||||
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='Collection',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, max_length=44, validators=[django.core.validators.RegexValidator(message='Not a valid UID', regex='[a-zA-Z0-9]')])),
|
||||
('version', models.PositiveSmallIntegerField()),
|
||||
('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('uid', 'owner')},
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='CollectionItem',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, max_length=44, null=True, validators=[django.core.validators.RegexValidator(message='Not a valid UID', regex='[a-zA-Z0-9]')])),
|
||||
('version', models.PositiveSmallIntegerField()),
|
||||
('encryptionKey', models.BinaryField(editable=True, null=True)),
|
||||
('collection', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='items', to='django_etebase.Collection')),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('uid', 'collection')},
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='CollectionItemChunk',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, max_length=44, validators=[django.core.validators.RegexValidator(message='Expected a 256bit base64url.', regex='^[a-zA-Z0-9\\-_]{43}$')])),
|
||||
('chunkFile', models.FileField(max_length=150, unique=True, upload_to=django_etebase.models.chunk_directory_path)),
|
||||
('item', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='chunks', to='django_etebase.CollectionItem')),
|
||||
],
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='CollectionItemRevision',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, max_length=44, unique=True, validators=[django.core.validators.RegexValidator(message='Expected a 256bit base64url.', regex='^[a-zA-Z0-9\\-_]{43}$')])),
|
||||
('meta', models.BinaryField(editable=True)),
|
||||
('current', models.BooleanField(db_index=True, default=True, null=True)),
|
||||
('deleted', models.BooleanField(default=False)),
|
||||
('item', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='revisions', to='django_etebase.CollectionItem')),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('item', 'current')},
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='RevisionChunkRelation',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('chunk', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='revisions_relation', to='django_etebase.CollectionItemChunk')),
|
||||
('revision', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='chunks_relation', to='django_etebase.CollectionItemRevision')),
|
||||
],
|
||||
options={
|
||||
'ordering': ('id',),
|
||||
},
|
||||
),
|
||||
migrations.CreateModel(
|
||||
name='CollectionMember',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('encryptionKey', models.BinaryField(editable=True)),
|
||||
('accessLevel', models.CharField(choices=[('adm', 'Admin'), ('rw', 'Read Write'), ('ro', 'Read Only')], default='ro', max_length=3)),
|
||||
('collection', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='members', to='django_etebase.Collection')),
|
||||
('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('user', 'collection')},
|
||||
},
|
||||
),
|
||||
]
|
||||
25
django_etebase/migrations/0002_userinfo.py
Normal file
25
django_etebase/migrations/0002_userinfo.py
Normal file
@@ -0,0 +1,25 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-14 09:51
|
||||
|
||||
from django.conf import settings
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('myauth', '0001_initial'),
|
||||
('django_etebase', '0001_initial'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='UserInfo',
|
||||
fields=[
|
||||
('owner', models.OneToOneField(on_delete=django.db.models.deletion.CASCADE, primary_key=True, serialize=False, to=settings.AUTH_USER_MODEL)),
|
||||
('version', models.PositiveSmallIntegerField(default=1)),
|
||||
('pubkey', models.BinaryField(editable=True)),
|
||||
('salt', models.BinaryField(editable=True)),
|
||||
],
|
||||
),
|
||||
]
|
||||
31
django_etebase/migrations/0003_collectioninvitation.py
Normal file
31
django_etebase/migrations/0003_collectioninvitation.py
Normal file
@@ -0,0 +1,31 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-20 11:03
|
||||
|
||||
from django.conf import settings
|
||||
import django.core.validators
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
|
||||
('django_etebase', '0002_userinfo'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='CollectionInvitation',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, max_length=44, validators=[django.core.validators.RegexValidator(message='Expected a 256bit base64url.', regex='^[a-zA-Z0-9\\-_]{43}$')])),
|
||||
('signedEncryptionKey', models.BinaryField()),
|
||||
('accessLevel', models.CharField(choices=[('adm', 'Admin'), ('rw', 'Read Write'), ('ro', 'Read Only')], default='ro', max_length=3)),
|
||||
('fromMember', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='django_etebase.CollectionMember')),
|
||||
('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='incoming_invitations', to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('user', 'fromMember')},
|
||||
},
|
||||
),
|
||||
]
|
||||
@@ -0,0 +1,18 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-21 14:45
|
||||
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0003_collectioninvitation'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AddField(
|
||||
model_name='collectioninvitation',
|
||||
name='version',
|
||||
field=models.PositiveSmallIntegerField(default=1),
|
||||
),
|
||||
]
|
||||
18
django_etebase/migrations/0005_auto_20200526_1021.py
Normal file
18
django_etebase/migrations/0005_auto_20200526_1021.py
Normal file
@@ -0,0 +1,18 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 10:21
|
||||
|
||||
from django.db import migrations
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0004_collectioninvitation_version'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.RenameField(
|
||||
model_name='userinfo',
|
||||
old_name='pubkey',
|
||||
new_name='loginPubkey',
|
||||
),
|
||||
]
|
||||
25
django_etebase/migrations/0006_auto_20200526_1040.py
Normal file
25
django_etebase/migrations/0006_auto_20200526_1040.py
Normal file
@@ -0,0 +1,25 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 10:40
|
||||
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0005_auto_20200526_1021'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AddField(
|
||||
model_name='userinfo',
|
||||
name='encryptedSeckey',
|
||||
field=models.BinaryField(default=b'', editable=True),
|
||||
preserve_default=False,
|
||||
),
|
||||
migrations.AddField(
|
||||
model_name='userinfo',
|
||||
name='pubkey',
|
||||
field=models.BinaryField(default=b'', editable=True),
|
||||
preserve_default=False,
|
||||
),
|
||||
]
|
||||
39
django_etebase/migrations/0007_auto_20200526_1336.py
Normal file
39
django_etebase/migrations/0007_auto_20200526_1336.py
Normal file
@@ -0,0 +1,39 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 13:36
|
||||
|
||||
import django.core.validators
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0006_auto_20200526_1040'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AlterField(
|
||||
model_name='collection',
|
||||
name='uid',
|
||||
field=models.CharField(db_index=True, max_length=43, validators=[django.core.validators.RegexValidator(message='Not a valid UID', regex='^[a-zA-Z0-9]*$')]),
|
||||
),
|
||||
migrations.AlterField(
|
||||
model_name='collectioninvitation',
|
||||
name='uid',
|
||||
field=models.CharField(db_index=True, max_length=43, validators=[django.core.validators.RegexValidator(message='Expected a base64url.', regex='^[a-zA-Z0-9\\-_]{42,43}$')]),
|
||||
),
|
||||
migrations.AlterField(
|
||||
model_name='collectionitem',
|
||||
name='uid',
|
||||
field=models.CharField(db_index=True, max_length=43, null=True, validators=[django.core.validators.RegexValidator(message='Not a valid UID', regex='^[a-zA-Z0-9]*$')]),
|
||||
),
|
||||
migrations.AlterField(
|
||||
model_name='collectionitemchunk',
|
||||
name='uid',
|
||||
field=models.CharField(db_index=True, max_length=43, validators=[django.core.validators.RegexValidator(message='Expected a base64url.', regex='^[a-zA-Z0-9\\-_]{42,43}$')]),
|
||||
),
|
||||
migrations.AlterField(
|
||||
model_name='collectionitemrevision',
|
||||
name='uid',
|
||||
field=models.CharField(db_index=True, max_length=43, unique=True, validators=[django.core.validators.RegexValidator(message='Expected a base64url.', regex='^[a-zA-Z0-9\\-_]{42,43}$')]),
|
||||
),
|
||||
]
|
||||
28
django_etebase/migrations/0008_auto_20200526_1535.py
Normal file
28
django_etebase/migrations/0008_auto_20200526_1535.py
Normal file
@@ -0,0 +1,28 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 15:35
|
||||
|
||||
import django.core.validators
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
import django_etebase.models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0007_auto_20200526_1336'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='Stoken',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('uid', models.CharField(db_index=True, default=django_etebase.models.generate_stoken_uid, max_length=43, unique=True, validators=[django.core.validators.RegexValidator(message='Expected a base64url.', regex='^[a-zA-Z0-9\\-_]{42,43}$')])),
|
||||
],
|
||||
),
|
||||
migrations.AddField(
|
||||
model_name='collectionitemrevision',
|
||||
name='stoken',
|
||||
field=models.OneToOneField(null=True, on_delete=django.db.models.deletion.PROTECT, to='django_etebase.Stoken'),
|
||||
),
|
||||
]
|
||||
23
django_etebase/migrations/0009_auto_20200526_1535.py
Normal file
23
django_etebase/migrations/0009_auto_20200526_1535.py
Normal file
@@ -0,0 +1,23 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 15:35
|
||||
|
||||
from django.db import migrations
|
||||
|
||||
|
||||
def create_stokens(apps, schema_editor):
|
||||
Stoken = apps.get_model('django_etebase', 'Stoken')
|
||||
CollectionItemRevision = apps.get_model('django_etebase', 'CollectionItemRevision')
|
||||
|
||||
for rev in CollectionItemRevision.objects.all():
|
||||
rev.stoken = Stoken.objects.create()
|
||||
rev.save()
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0008_auto_20200526_1535'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.RunPython(create_stokens),
|
||||
]
|
||||
19
django_etebase/migrations/0010_auto_20200526_1539.py
Normal file
19
django_etebase/migrations/0010_auto_20200526_1539.py
Normal file
@@ -0,0 +1,19 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-26 15:39
|
||||
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0009_auto_20200526_1535'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AlterField(
|
||||
model_name='collectionitemrevision',
|
||||
name='stoken',
|
||||
field=models.OneToOneField(on_delete=django.db.models.deletion.PROTECT, to='django_etebase.Stoken'),
|
||||
),
|
||||
]
|
||||
19
django_etebase/migrations/0011_collectionmember_stoken.py
Normal file
19
django_etebase/migrations/0011_collectionmember_stoken.py
Normal file
@@ -0,0 +1,19 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-27 07:43
|
||||
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0010_auto_20200526_1539'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AddField(
|
||||
model_name='collectionmember',
|
||||
name='stoken',
|
||||
field=models.OneToOneField(null=True, on_delete=django.db.models.deletion.PROTECT, to='django_etebase.Stoken'),
|
||||
),
|
||||
]
|
||||
23
django_etebase/migrations/0012_auto_20200527_0743.py
Normal file
23
django_etebase/migrations/0012_auto_20200527_0743.py
Normal file
@@ -0,0 +1,23 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-27 07:43
|
||||
|
||||
from django.db import migrations
|
||||
|
||||
|
||||
def create_stokens(apps, schema_editor):
|
||||
Stoken = apps.get_model('django_etebase', 'Stoken')
|
||||
CollectionMember = apps.get_model('django_etebase', 'CollectionMember')
|
||||
|
||||
for member in CollectionMember.objects.all():
|
||||
member.stoken = Stoken.objects.create()
|
||||
member.save()
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0011_collectionmember_stoken'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.RunPython(create_stokens),
|
||||
]
|
||||
28
django_etebase/migrations/0013_collectionmemberremoved.py
Normal file
28
django_etebase/migrations/0013_collectionmemberremoved.py
Normal file
@@ -0,0 +1,28 @@
|
||||
# Generated by Django 3.0.3 on 2020-05-27 11:29
|
||||
|
||||
from django.conf import settings
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
|
||||
('django_etebase', '0012_auto_20200527_0743'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='CollectionMemberRemoved',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('collection', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='removed_members', to='django_etebase.Collection')),
|
||||
('stoken', models.OneToOneField(null=True, on_delete=django.db.models.deletion.PROTECT, to='django_etebase.Stoken')),
|
||||
('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
options={
|
||||
'unique_together': {('user', 'collection')},
|
||||
},
|
||||
),
|
||||
]
|
||||
18
django_etebase/migrations/0014_auto_20200602_1558.py
Normal file
18
django_etebase/migrations/0014_auto_20200602_1558.py
Normal file
@@ -0,0 +1,18 @@
|
||||
# Generated by Django 3.0.3 on 2020-06-02 15:58
|
||||
|
||||
from django.db import migrations
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0013_collectionmemberremoved'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.RenameField(
|
||||
model_name='userinfo',
|
||||
old_name='encryptedSeckey',
|
||||
new_name='encryptedContent',
|
||||
),
|
||||
]
|
||||
@@ -0,0 +1,18 @@
|
||||
# Generated by Django 3.0.3 on 2020-06-04 12:18
|
||||
|
||||
from django.db import migrations, models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
dependencies = [
|
||||
('django_etebase', '0014_auto_20200602_1558'),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.AddField(
|
||||
model_name='collectionitemrevision',
|
||||
name='salt',
|
||||
field=models.BinaryField(default=b'', editable=True),
|
||||
),
|
||||
]
|
||||
0
django_etebase/migrations/__init__.py
Normal file
0
django_etebase/migrations/__init__.py
Normal file
222
django_etebase/models.py
Normal file
222
django_etebase/models.py
Normal file
@@ -0,0 +1,222 @@
|
||||
# Copyright © 2017 Tom Hacohen
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, version 3.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from pathlib import Path
|
||||
|
||||
from django.db import models, transaction
|
||||
from django.conf import settings
|
||||
from django.core.validators import RegexValidator
|
||||
from django.db.models import Q
|
||||
from django.utils.functional import cached_property
|
||||
from django.utils.crypto import get_random_string
|
||||
|
||||
|
||||
Base64Url256BitlValidator = RegexValidator(regex=r'^[a-zA-Z0-9\-_]{42,43}$', message='Expected a base64url.')
|
||||
UidValidator = RegexValidator(regex=r'^[a-zA-Z0-9]*$', message='Not a valid UID')
|
||||
|
||||
|
||||
class Collection(models.Model):
|
||||
uid = models.CharField(db_index=True, blank=False, null=False,
|
||||
max_length=43, validators=[UidValidator])
|
||||
version = models.PositiveSmallIntegerField()
|
||||
owner = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('uid', 'owner')
|
||||
|
||||
def __str__(self):
|
||||
return self.uid
|
||||
|
||||
@cached_property
|
||||
def main_item(self):
|
||||
return self.items.get(uid=None)
|
||||
|
||||
@property
|
||||
def content(self):
|
||||
return self.main_item.content
|
||||
|
||||
@property
|
||||
def etag(self):
|
||||
return self.content.uid
|
||||
|
||||
@cached_property
|
||||
def stoken(self):
|
||||
stoken = Stoken.objects.filter(
|
||||
Q(collectionitemrevision__item__collection=self) | Q(collectionmember__collection=self)
|
||||
).order_by('id').last()
|
||||
|
||||
if stoken is None:
|
||||
raise Exception('stoken is None. Should never happen')
|
||||
|
||||
return stoken.uid
|
||||
|
||||
|
||||
class CollectionItem(models.Model):
|
||||
uid = models.CharField(db_index=True, blank=False, null=True,
|
||||
max_length=43, validators=[UidValidator])
|
||||
collection = models.ForeignKey(Collection, related_name='items', on_delete=models.CASCADE)
|
||||
version = models.PositiveSmallIntegerField()
|
||||
encryptionKey = models.BinaryField(editable=True, blank=False, null=True)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('uid', 'collection')
|
||||
|
||||
def __str__(self):
|
||||
return '{} {}'.format(self.uid, self.collection.uid)
|
||||
|
||||
@cached_property
|
||||
def content(self):
|
||||
return self.revisions.get(current=True)
|
||||
|
||||
@property
|
||||
def etag(self):
|
||||
return self.content.uid
|
||||
|
||||
|
||||
def chunk_directory_path(instance, filename):
|
||||
item = instance.item
|
||||
col = item.collection
|
||||
user_id = col.owner.id
|
||||
item_uid = item.uid or 'main'
|
||||
return Path('user_{}'.format(user_id), col.uid, item_uid, instance.uid)
|
||||
|
||||
|
||||
class CollectionItemChunk(models.Model):
|
||||
uid = models.CharField(db_index=True, blank=False, null=False,
|
||||
max_length=43, validators=[Base64Url256BitlValidator])
|
||||
item = models.ForeignKey(CollectionItem, related_name='chunks', on_delete=models.CASCADE)
|
||||
chunkFile = models.FileField(upload_to=chunk_directory_path, max_length=150, unique=True)
|
||||
|
||||
def __str__(self):
|
||||
return self.uid
|
||||
|
||||
|
||||
def generate_stoken_uid():
|
||||
return get_random_string(32, allowed_chars='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_')
|
||||
|
||||
|
||||
class Stoken(models.Model):
|
||||
uid = models.CharField(db_index=True, unique=True, blank=False, null=False, default=generate_stoken_uid,
|
||||
max_length=43, validators=[Base64Url256BitlValidator])
|
||||
|
||||
|
||||
class CollectionItemRevision(models.Model):
|
||||
stoken = models.OneToOneField(Stoken, on_delete=models.PROTECT)
|
||||
uid = models.CharField(db_index=True, unique=True, blank=False, null=False,
|
||||
max_length=43, validators=[Base64Url256BitlValidator])
|
||||
salt = models.BinaryField(editable=True, blank=False, null=False, default=b'')
|
||||
item = models.ForeignKey(CollectionItem, related_name='revisions', on_delete=models.CASCADE)
|
||||
meta = models.BinaryField(editable=True, blank=False, null=False)
|
||||
current = models.BooleanField(db_index=True, default=True, null=True)
|
||||
deleted = models.BooleanField(default=False)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('item', 'current')
|
||||
|
||||
def __str__(self):
|
||||
return '{} {} current={}'.format(self.uid, self.item.uid, self.current)
|
||||
|
||||
|
||||
class RevisionChunkRelation(models.Model):
|
||||
chunk = models.ForeignKey(CollectionItemChunk, related_name='revisions_relation', on_delete=models.CASCADE)
|
||||
revision = models.ForeignKey(CollectionItemRevision, related_name='chunks_relation', on_delete=models.CASCADE)
|
||||
|
||||
class Meta:
|
||||
ordering = ('id', )
|
||||
|
||||
|
||||
class AccessLevels(models.TextChoices):
|
||||
ADMIN = 'adm'
|
||||
READ_WRITE = 'rw'
|
||||
READ_ONLY = 'ro'
|
||||
|
||||
|
||||
class CollectionMember(models.Model):
|
||||
stoken = models.OneToOneField(Stoken, on_delete=models.PROTECT, null=True)
|
||||
collection = models.ForeignKey(Collection, related_name='members', on_delete=models.CASCADE)
|
||||
user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
|
||||
encryptionKey = models.BinaryField(editable=True, blank=False, null=False)
|
||||
accessLevel = models.CharField(
|
||||
max_length=3,
|
||||
choices=AccessLevels.choices,
|
||||
default=AccessLevels.READ_ONLY,
|
||||
)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('user', 'collection')
|
||||
|
||||
def __str__(self):
|
||||
return '{} {}'.format(self.collection.uid, self.user)
|
||||
|
||||
def revoke(self):
|
||||
with transaction.atomic():
|
||||
CollectionMemberRemoved.objects.update_or_create(
|
||||
collection=self.collection, user=self.user,
|
||||
defaults={
|
||||
'stoken': Stoken.objects.create(),
|
||||
},
|
||||
)
|
||||
|
||||
self.delete()
|
||||
|
||||
|
||||
class CollectionMemberRemoved(models.Model):
|
||||
stoken = models.OneToOneField(Stoken, on_delete=models.PROTECT, null=True)
|
||||
collection = models.ForeignKey(Collection, related_name='removed_members', on_delete=models.CASCADE)
|
||||
user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('user', 'collection')
|
||||
|
||||
def __str__(self):
|
||||
return '{} {}'.format(self.collection.uid, self.user)
|
||||
|
||||
|
||||
class CollectionInvitation(models.Model):
|
||||
uid = models.CharField(db_index=True, blank=False, null=False,
|
||||
max_length=43, validators=[Base64Url256BitlValidator])
|
||||
version = models.PositiveSmallIntegerField(default=1)
|
||||
fromMember = models.ForeignKey(CollectionMember, on_delete=models.CASCADE)
|
||||
# FIXME: make sure to delete all invitations for the same collection once one is accepted
|
||||
# Make sure to not allow invitations if already a member
|
||||
|
||||
user = models.ForeignKey(settings.AUTH_USER_MODEL, related_name='incoming_invitations', on_delete=models.CASCADE)
|
||||
signedEncryptionKey = models.BinaryField(editable=False, blank=False, null=False)
|
||||
accessLevel = models.CharField(
|
||||
max_length=3,
|
||||
choices=AccessLevels.choices,
|
||||
default=AccessLevels.READ_ONLY,
|
||||
)
|
||||
|
||||
class Meta:
|
||||
unique_together = ('user', 'fromMember')
|
||||
|
||||
def __str__(self):
|
||||
return '{} {}'.format(self.fromMember.collection.uid, self.user)
|
||||
|
||||
@cached_property
|
||||
def collection(self):
|
||||
return self.fromMember.collection
|
||||
|
||||
|
||||
class UserInfo(models.Model):
|
||||
owner = models.OneToOneField(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, primary_key=True)
|
||||
version = models.PositiveSmallIntegerField(default=1)
|
||||
loginPubkey = models.BinaryField(editable=True, blank=False, null=False)
|
||||
pubkey = models.BinaryField(editable=True, blank=False, null=False)
|
||||
encryptedContent = models.BinaryField(editable=True, blank=False, null=False)
|
||||
salt = models.BinaryField(editable=True, blank=False, null=False)
|
||||
|
||||
def __str__(self):
|
||||
return "UserInfo<{}>".format(self.owner)
|
||||
84
django_etebase/permissions.py
Normal file
84
django_etebase/permissions.py
Normal file
@@ -0,0 +1,84 @@
|
||||
# Copyright © 2017 Tom Hacohen
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, version 3.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from rest_framework import permissions
|
||||
from django_etebase.models import Collection, AccessLevels
|
||||
|
||||
|
||||
def is_collection_admin(collection, user):
|
||||
member = collection.members.filter(user=user).first()
|
||||
return (member is not None) and (member.accessLevel == AccessLevels.ADMIN)
|
||||
|
||||
|
||||
class IsCollectionAdmin(permissions.BasePermission):
|
||||
"""
|
||||
Custom permission to only allow owners of a collection to view it
|
||||
"""
|
||||
message = 'Only collection admins can perform this operation.'
|
||||
code = 'admin_access_required'
|
||||
|
||||
def has_permission(self, request, view):
|
||||
collection_uid = view.kwargs['collection_uid']
|
||||
try:
|
||||
collection = view.get_collection_queryset().get(uid=collection_uid)
|
||||
return is_collection_admin(collection, request.user)
|
||||
except Collection.DoesNotExist:
|
||||
# If the collection does not exist, we want to 404 later, not permission denied.
|
||||
return True
|
||||
|
||||
|
||||
class IsCollectionAdminOrReadOnly(permissions.BasePermission):
|
||||
"""
|
||||
Custom permission to only allow owners of a collection to edit it
|
||||
"""
|
||||
message = 'Only collection admins can edit collections.'
|
||||
code = 'admin_access_required'
|
||||
|
||||
def has_permission(self, request, view):
|
||||
collection_uid = view.kwargs.get('collection_uid', None)
|
||||
|
||||
# Allow creating new collections
|
||||
if collection_uid is None:
|
||||
return True
|
||||
|
||||
try:
|
||||
collection = view.get_collection_queryset().get(uid=collection_uid)
|
||||
if request.method in permissions.SAFE_METHODS:
|
||||
return True
|
||||
|
||||
return is_collection_admin(collection, request.user)
|
||||
except Collection.DoesNotExist:
|
||||
# If the collection does not exist, we want to 404 later, not permission denied.
|
||||
return True
|
||||
|
||||
|
||||
class HasWriteAccessOrReadOnly(permissions.BasePermission):
|
||||
"""
|
||||
Custom permission to restrict write
|
||||
"""
|
||||
message = 'You need write access to write to this collection'
|
||||
code = 'no_write_access'
|
||||
|
||||
def has_permission(self, request, view):
|
||||
collection_uid = view.kwargs['collection_uid']
|
||||
try:
|
||||
collection = view.get_collection_queryset().get(uid=collection_uid)
|
||||
if request.method in permissions.SAFE_METHODS:
|
||||
return True
|
||||
else:
|
||||
member = collection.members.get(user=request.user)
|
||||
return member.accessLevel != AccessLevels.READ_ONLY
|
||||
except Collection.DoesNotExist:
|
||||
# If the collection does not exist, we want to 404 later, not permission denied.
|
||||
return True
|
||||
444
django_etebase/serializers.py
Normal file
444
django_etebase/serializers.py
Normal file
@@ -0,0 +1,444 @@
|
||||
# Copyright © 2017 Tom Hacohen
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, version 3.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
import base64
|
||||
|
||||
from django.core.files.base import ContentFile
|
||||
from django.core import exceptions as django_exceptions
|
||||
from django.contrib.auth import get_user_model
|
||||
from django.db import transaction
|
||||
from rest_framework import serializers
|
||||
from . import models
|
||||
|
||||
User = get_user_model()
|
||||
|
||||
|
||||
def process_revisions_for_item(item, revision_data):
|
||||
chunks_objs = []
|
||||
chunks = revision_data.pop('chunks_relation')
|
||||
for chunk in chunks:
|
||||
uid = chunk[0]
|
||||
if len(chunk) > 1:
|
||||
content = chunk[1]
|
||||
chunk = models.CollectionItemChunk(uid=uid, item=item)
|
||||
chunk.chunkFile.save('IGNORED', ContentFile(content))
|
||||
chunk.save()
|
||||
chunks_objs.append(chunk)
|
||||
else:
|
||||
chunk = models.CollectionItemChunk.objects.get(uid=uid)
|
||||
chunks_objs.append(chunk)
|
||||
|
||||
stoken = models.Stoken.objects.create()
|
||||
|
||||
revision = models.CollectionItemRevision.objects.create(**revision_data, item=item, stoken=stoken)
|
||||
for chunk in chunks_objs:
|
||||
models.RevisionChunkRelation.objects.create(chunk=chunk, revision=revision)
|
||||
return revision
|
||||
|
||||
|
||||
def b64encode(value):
|
||||
return base64.urlsafe_b64encode(value).decode('ascii').strip('=')
|
||||
|
||||
|
||||
def b64decode(data):
|
||||
data += "=" * ((4 - len(data) % 4) % 4)
|
||||
return base64.urlsafe_b64decode(data)
|
||||
|
||||
|
||||
class BinaryBase64Field(serializers.Field):
|
||||
def to_representation(self, value):
|
||||
return b64encode(value)
|
||||
|
||||
def to_internal_value(self, data):
|
||||
return b64decode(data)
|
||||
|
||||
|
||||
class CollectionEncryptionKeyField(BinaryBase64Field):
|
||||
def get_attribute(self, instance):
|
||||
request = self.context.get('request', None)
|
||||
if request is not None:
|
||||
return instance.members.get(user=request.user).encryptionKey
|
||||
return None
|
||||
|
||||
|
||||
class CollectionContentField(BinaryBase64Field):
|
||||
def get_attribute(self, instance):
|
||||
request = self.context.get('request', None)
|
||||
if request is not None:
|
||||
return instance.members.get(user=request.user).encryptionKey
|
||||
return None
|
||||
|
||||
|
||||
class ChunksField(serializers.RelatedField):
|
||||
def to_representation(self, obj):
|
||||
obj = obj.chunk
|
||||
inline = self.context.get('inline', False)
|
||||
if inline:
|
||||
with open(obj.chunkFile.path, 'rb') as f:
|
||||
return (obj.uid, b64encode(f.read()))
|
||||
else:
|
||||
return (obj.uid, )
|
||||
|
||||
def to_internal_value(self, data):
|
||||
if data[0] is None or data[1] is None:
|
||||
raise serializers.ValidationError('null is not allowed')
|
||||
return (data[0], b64decode(data[1]))
|
||||
|
||||
|
||||
class CollectionItemChunkSerializer(serializers.ModelSerializer):
|
||||
class Meta:
|
||||
model = models.CollectionItemChunk
|
||||
fields = ('uid', 'chunkFile')
|
||||
|
||||
|
||||
class CollectionItemRevisionSerializer(serializers.ModelSerializer):
|
||||
chunks = ChunksField(
|
||||
source='chunks_relation',
|
||||
queryset=models.RevisionChunkRelation.objects.all(),
|
||||
many=True
|
||||
)
|
||||
salt = BinaryBase64Field()
|
||||
meta = BinaryBase64Field()
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionItemRevision
|
||||
fields = ('chunks', 'meta', 'uid', 'salt', 'deleted')
|
||||
|
||||
|
||||
class CollectionItemSerializer(serializers.ModelSerializer):
|
||||
encryptionKey = BinaryBase64Field()
|
||||
etag = serializers.CharField(allow_null=True, write_only=True)
|
||||
content = CollectionItemRevisionSerializer(many=False)
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionItem
|
||||
fields = ('uid', 'version', 'encryptionKey', 'content', 'etag')
|
||||
|
||||
def create(self, validated_data):
|
||||
"""Function that's called when this serializer creates an item"""
|
||||
validate_etag = self.context.get('validate_etag', False)
|
||||
etag = validated_data.pop('etag')
|
||||
revision_data = validated_data.pop('content')
|
||||
uid = validated_data.pop('uid')
|
||||
|
||||
Model = self.__class__.Meta.model
|
||||
|
||||
with transaction.atomic():
|
||||
instance, created = Model.objects.get_or_create(uid=uid, defaults=validated_data)
|
||||
cur_etag = instance.etag if not created else None
|
||||
|
||||
if validate_etag and cur_etag != etag:
|
||||
raise serializers.ValidationError('Wrong etag. Expected {} got {}'.format(cur_etag, etag))
|
||||
|
||||
if not created:
|
||||
# We don't have to use select_for_update here because the unique constraint on current guards against
|
||||
# the race condition. But it's a good idea because it'll lock and wait rather than fail.
|
||||
current_revision = instance.revisions.filter(current=True).select_for_update().first()
|
||||
current_revision.current = None
|
||||
current_revision.save()
|
||||
|
||||
process_revisions_for_item(instance, revision_data)
|
||||
|
||||
return instance
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
# We never update, we always update in the create method
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class CollectionItemDepSerializer(serializers.ModelSerializer):
|
||||
etag = serializers.CharField()
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionItem
|
||||
fields = ('uid', 'etag')
|
||||
|
||||
def validate(self, data):
|
||||
item = self.__class__.Meta.model.objects.get(uid=data['uid'])
|
||||
etag = data['etag']
|
||||
if item.etag != etag:
|
||||
raise serializers.ValidationError('Wrong etag. Expected {} got {}'.format(item.etag, etag))
|
||||
|
||||
return data
|
||||
|
||||
|
||||
class CollectionItemBulkGetSerializer(serializers.ModelSerializer):
|
||||
etag = serializers.CharField(required=False)
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionItem
|
||||
fields = ('uid', 'etag')
|
||||
|
||||
|
||||
class CollectionSerializer(serializers.ModelSerializer):
|
||||
encryptionKey = CollectionEncryptionKeyField()
|
||||
accessLevel = serializers.SerializerMethodField('get_access_level_from_context')
|
||||
stoken = serializers.CharField(read_only=True)
|
||||
etag = serializers.CharField(allow_null=True, write_only=True)
|
||||
content = CollectionItemRevisionSerializer(many=False)
|
||||
|
||||
class Meta:
|
||||
model = models.Collection
|
||||
fields = ('uid', 'version', 'accessLevel', 'encryptionKey', 'content', 'stoken', 'etag')
|
||||
|
||||
def get_access_level_from_context(self, obj):
|
||||
request = self.context.get('request', None)
|
||||
if request is not None:
|
||||
return obj.members.get(user=request.user).accessLevel
|
||||
return None
|
||||
|
||||
def create(self, validated_data):
|
||||
"""Function that's called when this serializer creates an item"""
|
||||
etag = validated_data.pop('etag')
|
||||
revision_data = validated_data.pop('content')
|
||||
encryption_key = validated_data.pop('encryptionKey')
|
||||
instance = self.__class__.Meta.model(**validated_data)
|
||||
|
||||
with transaction.atomic():
|
||||
if etag is not None:
|
||||
raise serializers.ValidationError('etag is not None')
|
||||
|
||||
instance.save()
|
||||
main_item = models.CollectionItem.objects.create(
|
||||
uid=None, encryptionKey=None, version=instance.version, collection=instance)
|
||||
|
||||
process_revisions_for_item(main_item, revision_data)
|
||||
|
||||
models.CollectionMember(collection=instance,
|
||||
stoken=models.Stoken.objects.create(),
|
||||
user=validated_data.get('owner'),
|
||||
accessLevel=models.AccessLevels.ADMIN,
|
||||
encryptionKey=encryption_key,
|
||||
).save()
|
||||
|
||||
return instance
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
"""Function that's called when this serializer is meant to update an item"""
|
||||
revision_data = validated_data.pop('content')
|
||||
|
||||
with transaction.atomic():
|
||||
main_item = instance.main_item
|
||||
# We don't have to use select_for_update here because the unique constraint on current guards against
|
||||
# the race condition. But it's a good idea because it'll lock and wait rather than fail.
|
||||
current_revision = main_item.revisions.filter(current=True).select_for_update().first()
|
||||
current_revision.current = None
|
||||
current_revision.save()
|
||||
|
||||
process_revisions_for_item(main_item, revision_data)
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
class CollectionMemberSerializer(serializers.ModelSerializer):
|
||||
username = serializers.SlugRelatedField(
|
||||
source='user',
|
||||
slug_field=User.USERNAME_FIELD,
|
||||
queryset=User.objects
|
||||
)
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionMember
|
||||
fields = ('username', 'accessLevel')
|
||||
|
||||
def create(self, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
with transaction.atomic():
|
||||
# We only allow updating accessLevel
|
||||
access_level = validated_data.pop('accessLevel')
|
||||
if instance.accessLevel != access_level:
|
||||
instance.stoken = models.Stoken.objects.create()
|
||||
instance.accessLevel = access_level
|
||||
instance.save()
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
class CollectionInvitationSerializer(serializers.ModelSerializer):
|
||||
username = serializers.SlugRelatedField(
|
||||
source='user',
|
||||
slug_field=User.USERNAME_FIELD,
|
||||
queryset=User.objects
|
||||
)
|
||||
collection = serializers.CharField(source='collection.uid')
|
||||
fromPubkey = BinaryBase64Field(source='fromMember.user.userinfo.pubkey', read_only=True)
|
||||
signedEncryptionKey = BinaryBase64Field()
|
||||
|
||||
class Meta:
|
||||
model = models.CollectionInvitation
|
||||
fields = ('username', 'uid', 'collection', 'signedEncryptionKey', 'accessLevel', 'fromPubkey', 'version')
|
||||
|
||||
def validate_user(self, value):
|
||||
request = self.context['request']
|
||||
|
||||
if request.user == value.lower():
|
||||
raise serializers.ValidationError('Inviting yourself is not allowed')
|
||||
return value
|
||||
|
||||
def create(self, validated_data):
|
||||
request = self.context['request']
|
||||
collection = validated_data.pop('collection')
|
||||
|
||||
member = collection.members.get(user=request.user)
|
||||
|
||||
with transaction.atomic():
|
||||
return type(self).Meta.model.objects.create(**validated_data, fromMember=member)
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
with transaction.atomic():
|
||||
instance.accessLevel = validated_data.pop('accessLevel')
|
||||
instance.signedEncryptionKey = validated_data.pop('signedEncryptionKey')
|
||||
instance.save()
|
||||
|
||||
return instance
|
||||
|
||||
|
||||
class InvitationAcceptSerializer(serializers.Serializer):
|
||||
encryptionKey = BinaryBase64Field()
|
||||
|
||||
def create(self, validated_data):
|
||||
|
||||
with transaction.atomic():
|
||||
invitation = self.context['invitation']
|
||||
encryption_key = validated_data.get('encryptionKey')
|
||||
|
||||
member = models.CollectionMember.objects.create(
|
||||
collection=invitation.collection,
|
||||
stoken=models.Stoken.objects.create(),
|
||||
user=invitation.user,
|
||||
accessLevel=invitation.accessLevel,
|
||||
encryptionKey=encryption_key,
|
||||
)
|
||||
|
||||
models.CollectionMemberRemoved.objects.filter(
|
||||
user=invitation.user, collection=invitation.collection).delete()
|
||||
|
||||
invitation.delete()
|
||||
|
||||
return member
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class UserSerializer(serializers.ModelSerializer):
|
||||
pubkey = BinaryBase64Field(source='userinfo.pubkey')
|
||||
encryptedContent = BinaryBase64Field(source='userinfo.encryptedContent')
|
||||
|
||||
class Meta:
|
||||
model = User
|
||||
fields = (User.USERNAME_FIELD, User.EMAIL_FIELD, 'pubkey', 'encryptedContent')
|
||||
|
||||
|
||||
class UserInfoPubkeySerializer(serializers.ModelSerializer):
|
||||
pubkey = BinaryBase64Field()
|
||||
|
||||
class Meta:
|
||||
model = models.UserInfo
|
||||
fields = ('pubkey', )
|
||||
|
||||
|
||||
class UserSignupSerializer(serializers.ModelSerializer):
|
||||
class Meta:
|
||||
model = User
|
||||
fields = (User.USERNAME_FIELD, User.EMAIL_FIELD)
|
||||
extra_kwargs = {
|
||||
'username': {'validators': []}, # We specifically validate in SignupSerializer
|
||||
}
|
||||
|
||||
|
||||
class AuthenticationSignupSerializer(serializers.Serializer):
|
||||
user = UserSignupSerializer(many=False)
|
||||
salt = BinaryBase64Field()
|
||||
loginPubkey = BinaryBase64Field()
|
||||
pubkey = BinaryBase64Field()
|
||||
encryptedContent = BinaryBase64Field()
|
||||
|
||||
def create(self, validated_data):
|
||||
"""Function that's called when this serializer creates an item"""
|
||||
user_data = validated_data.pop('user')
|
||||
|
||||
with transaction.atomic():
|
||||
instance, _ = User.objects.get_or_create(**user_data)
|
||||
if hasattr(instance, 'userinfo'):
|
||||
raise serializers.ValidationError('User already exists')
|
||||
|
||||
instance.set_unusable_password()
|
||||
|
||||
try:
|
||||
instance.clean_fields()
|
||||
except django_exceptions.ValidationError as e:
|
||||
raise serializers.ValidationError(e)
|
||||
# FIXME: send email verification
|
||||
|
||||
models.UserInfo.objects.create(**validated_data, owner=instance)
|
||||
|
||||
return instance
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class AuthenticationLoginChallengeSerializer(serializers.Serializer):
|
||||
username = serializers.CharField(required=True)
|
||||
|
||||
def create(self, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class AuthenticationLoginSerializer(serializers.Serializer):
|
||||
response = BinaryBase64Field()
|
||||
signature = BinaryBase64Field()
|
||||
|
||||
def create(self, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class AuthenticationLoginInnerSerializer(AuthenticationLoginChallengeSerializer):
|
||||
challenge = BinaryBase64Field()
|
||||
host = serializers.CharField()
|
||||
|
||||
def create(self, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
|
||||
class AuthenticationChangePasswordSerializer(serializers.ModelSerializer):
|
||||
loginPubkey = BinaryBase64Field()
|
||||
encryptedContent = BinaryBase64Field()
|
||||
|
||||
class Meta:
|
||||
model = models.UserInfo
|
||||
fields = ('loginPubkey', 'encryptedContent')
|
||||
|
||||
def create(self, validated_data):
|
||||
raise NotImplementedError()
|
||||
|
||||
def update(self, instance, validated_data):
|
||||
with transaction.atomic():
|
||||
instance.loginPubkey = validated_data.pop('loginPubkey')
|
||||
instance.encryptedContent = validated_data.pop('encryptedContent')
|
||||
instance.save()
|
||||
|
||||
return instance
|
||||
3
django_etebase/tests.py
Normal file
3
django_etebase/tests.py
Normal file
@@ -0,0 +1,3 @@
|
||||
from django.test import TestCase
|
||||
|
||||
# Create your tests here.
|
||||
0
django_etebase/token_auth/__init__.py
Normal file
0
django_etebase/token_auth/__init__.py
Normal file
0
django_etebase/token_auth/admin.py
Normal file
0
django_etebase/token_auth/admin.py
Normal file
5
django_etebase/token_auth/apps.py
Normal file
5
django_etebase/token_auth/apps.py
Normal file
@@ -0,0 +1,5 @@
|
||||
from django.apps import AppConfig
|
||||
|
||||
|
||||
class TokenAuthConfig(AppConfig):
|
||||
name = 'django_etebase.token_auth'
|
||||
46
django_etebase/token_auth/authentication.py
Normal file
46
django_etebase/token_auth/authentication.py
Normal file
@@ -0,0 +1,46 @@
|
||||
from django.utils import timezone
|
||||
from django.utils.translation import gettext_lazy as _
|
||||
|
||||
from rest_framework import exceptions
|
||||
from rest_framework.authentication import TokenAuthentication as DRFTokenAuthentication
|
||||
|
||||
from .models import AuthToken, get_default_expiry
|
||||
|
||||
|
||||
AUTO_REFRESH = True
|
||||
MIN_REFRESH_INTERVAL = 60
|
||||
|
||||
|
||||
class TokenAuthentication(DRFTokenAuthentication):
|
||||
keyword = 'Token'
|
||||
model = AuthToken
|
||||
|
||||
def authenticate_credentials(self, key):
|
||||
msg = _('Invalid token.')
|
||||
model = self.get_model()
|
||||
try:
|
||||
token = model.objects.select_related('user').get(key=key)
|
||||
except model.DoesNotExist:
|
||||
raise exceptions.AuthenticationFailed(msg)
|
||||
|
||||
if not token.user.is_active:
|
||||
raise exceptions.AuthenticationFailed(_('User inactive or deleted.'))
|
||||
|
||||
if token.expiry is not None:
|
||||
if token.expiry < timezone.now():
|
||||
token.delete()
|
||||
raise exceptions.AuthenticationFailed(msg)
|
||||
|
||||
if AUTO_REFRESH:
|
||||
self.renew_token(token)
|
||||
|
||||
return (token.user, token)
|
||||
|
||||
def renew_token(self, auth_token):
|
||||
current_expiry = auth_token.expiry
|
||||
new_expiry = get_default_expiry()
|
||||
# Throttle refreshing of token to avoid db writes
|
||||
delta = (new_expiry - current_expiry).total_seconds()
|
||||
if delta > MIN_REFRESH_INTERVAL:
|
||||
auth_token.expiry = new_expiry
|
||||
auth_token.save(update_fields=('expiry',))
|
||||
28
django_etebase/token_auth/migrations/0001_initial.py
Normal file
28
django_etebase/token_auth/migrations/0001_initial.py
Normal file
@@ -0,0 +1,28 @@
|
||||
# Generated by Django 3.0.3 on 2020-06-03 12:49
|
||||
|
||||
from django.conf import settings
|
||||
from django.db import migrations, models
|
||||
import django.db.models.deletion
|
||||
from django_etebase.token_auth import models as token_auth_models
|
||||
|
||||
|
||||
class Migration(migrations.Migration):
|
||||
|
||||
initial = True
|
||||
|
||||
dependencies = [
|
||||
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
|
||||
]
|
||||
|
||||
operations = [
|
||||
migrations.CreateModel(
|
||||
name='AuthToken',
|
||||
fields=[
|
||||
('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
|
||||
('key', models.CharField(db_index=True, default=token_auth_models.generate_key, max_length=40, unique=True)),
|
||||
('created', models.DateTimeField(auto_now_add=True)),
|
||||
('expiry', models.DateTimeField(blank=True, default=token_auth_models.get_default_expiry, null=True)),
|
||||
('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='auth_token_set', to=settings.AUTH_USER_MODEL)),
|
||||
],
|
||||
),
|
||||
]
|
||||
0
django_etebase/token_auth/migrations/__init__.py
Normal file
0
django_etebase/token_auth/migrations/__init__.py
Normal file
26
django_etebase/token_auth/models.py
Normal file
26
django_etebase/token_auth/models.py
Normal file
@@ -0,0 +1,26 @@
|
||||
from django.contrib.auth import get_user_model
|
||||
from django.db import models
|
||||
from django.utils import timezone
|
||||
from django.utils.crypto import get_random_string
|
||||
|
||||
User = get_user_model()
|
||||
|
||||
|
||||
def generate_key():
|
||||
return get_random_string(40)
|
||||
|
||||
|
||||
def get_default_expiry():
|
||||
return timezone.now() + timezone.timedelta(days=14)
|
||||
|
||||
|
||||
class AuthToken(models.Model):
|
||||
|
||||
key = models.CharField(max_length=40, unique=True, db_index=True, default=generate_key)
|
||||
user = models.ForeignKey(User, null=False, blank=False,
|
||||
related_name='auth_token_set', on_delete=models.CASCADE)
|
||||
created = models.DateTimeField(auto_now_add=True)
|
||||
expiry = models.DateTimeField(null=True, blank=True, default=get_default_expiry)
|
||||
|
||||
def __str__(self):
|
||||
return '{}: {}'.format(self.key, self.user)
|
||||
689
django_etebase/views.py
Normal file
689
django_etebase/views.py
Normal file
@@ -0,0 +1,689 @@
|
||||
# Copyright © 2017 Tom Hacohen
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Affero General Public License as
|
||||
# published by the Free Software Foundation, version 3.
|
||||
#
|
||||
# This library is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
import json
|
||||
from functools import reduce
|
||||
|
||||
from django.conf import settings
|
||||
from django.contrib.auth import get_user_model, user_logged_in, user_logged_out
|
||||
from django.core.exceptions import PermissionDenied
|
||||
from django.db import transaction, IntegrityError
|
||||
from django.db.models import Max, Q
|
||||
from django.http import HttpResponseBadRequest, HttpResponse, Http404
|
||||
from django.shortcuts import get_object_or_404
|
||||
|
||||
from rest_framework import status
|
||||
from rest_framework import viewsets
|
||||
from rest_framework import parsers
|
||||
from rest_framework.decorators import action as action_decorator
|
||||
from rest_framework.response import Response
|
||||
|
||||
import nacl.encoding
|
||||
import nacl.signing
|
||||
import nacl.secret
|
||||
import nacl.hash
|
||||
|
||||
from .token_auth.models import AuthToken
|
||||
|
||||
from . import app_settings, permissions
|
||||
from .models import (
|
||||
Collection,
|
||||
CollectionItem,
|
||||
CollectionItemRevision,
|
||||
CollectionMember,
|
||||
CollectionMemberRemoved,
|
||||
CollectionInvitation,
|
||||
Stoken,
|
||||
UserInfo,
|
||||
)
|
||||
from .serializers import (
|
||||
b64encode,
|
||||
AuthenticationChangePasswordSerializer,
|
||||
AuthenticationSignupSerializer,
|
||||
AuthenticationLoginChallengeSerializer,
|
||||
AuthenticationLoginSerializer,
|
||||
AuthenticationLoginInnerSerializer,
|
||||
CollectionSerializer,
|
||||
CollectionItemSerializer,
|
||||
CollectionItemBulkGetSerializer,
|
||||
CollectionItemDepSerializer,
|
||||
CollectionItemRevisionSerializer,
|
||||
CollectionItemChunkSerializer,
|
||||
CollectionMemberSerializer,
|
||||
CollectionInvitationSerializer,
|
||||
InvitationAcceptSerializer,
|
||||
UserInfoPubkeySerializer,
|
||||
UserSerializer,
|
||||
)
|
||||
|
||||
|
||||
User = get_user_model()
|
||||
|
||||
|
||||
class BaseViewSet(viewsets.ModelViewSet):
|
||||
authentication_classes = tuple(app_settings.API_AUTHENTICATORS)
|
||||
permission_classes = tuple(app_settings.API_PERMISSIONS)
|
||||
stoken_id_fields = None
|
||||
|
||||
def get_serializer_class(self):
|
||||
serializer_class = self.serializer_class
|
||||
|
||||
if self.request.method == 'PUT':
|
||||
serializer_class = getattr(self, 'serializer_update_class', serializer_class)
|
||||
|
||||
return serializer_class
|
||||
|
||||
def get_collection_queryset(self, queryset=Collection.objects):
|
||||
user = self.request.user
|
||||
return queryset.filter(members__user=user)
|
||||
|
||||
def get_stoken_obj(self, request):
|
||||
stoken = request.GET.get('stoken', None)
|
||||
|
||||
if stoken is not None:
|
||||
return get_object_or_404(Stoken.objects.all(), uid=stoken)
|
||||
|
||||
return None
|
||||
|
||||
def filter_by_stoken(self, request, queryset):
|
||||
stoken_rev = self.get_stoken_obj(request)
|
||||
if stoken_rev is not None:
|
||||
filter_by_map = map(lambda x: Q(**{x + '__gt': stoken_rev.id}), self.stoken_id_fields)
|
||||
filter_by = reduce(lambda x, y: x | y, filter_by_map)
|
||||
queryset = queryset.filter(filter_by).distinct()
|
||||
|
||||
return queryset, stoken_rev
|
||||
|
||||
def get_queryset_stoken(self, queryset):
|
||||
aggr_fields = {x: Max(x) for x in self.stoken_id_fields}
|
||||
aggr = queryset.aggregate(**aggr_fields)
|
||||
maxid = max(map(lambda x: x or -1, aggr.values()))
|
||||
new_stoken = (maxid >= 0) and Stoken.objects.get(id=maxid).uid
|
||||
|
||||
return queryset, new_stoken
|
||||
|
||||
def filter_by_stoken_and_limit(self, request, queryset):
|
||||
limit = int(request.GET.get('limit', 50))
|
||||
|
||||
queryset, stoken_rev = self.filter_by_stoken(request, queryset)
|
||||
stoken = stoken_rev.uid if stoken_rev is not None else None
|
||||
|
||||
queryset = queryset[:limit]
|
||||
queryset, new_stoken = self.get_queryset_stoken(queryset)
|
||||
new_stoken = new_stoken or stoken
|
||||
|
||||
return queryset, new_stoken
|
||||
|
||||
# Change how our list works by default
|
||||
def list(self, request, collection_uid=None):
|
||||
queryset = self.get_queryset()
|
||||
serializer = self.get_serializer(queryset, many=True)
|
||||
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
}
|
||||
|
||||
return Response(ret)
|
||||
|
||||
|
||||
class CollectionViewSet(BaseViewSet):
|
||||
allowed_methods = ['GET', 'POST', 'DELETE']
|
||||
permission_classes = BaseViewSet.permission_classes + (permissions.IsCollectionAdminOrReadOnly, )
|
||||
queryset = Collection.objects.all()
|
||||
serializer_class = CollectionSerializer
|
||||
lookup_field = 'uid'
|
||||
stoken_id_fields = ['items__revisions__stoken__id', 'members__stoken__id']
|
||||
|
||||
def get_queryset(self, queryset=None):
|
||||
if queryset is None:
|
||||
queryset = type(self).queryset
|
||||
return self.get_collection_queryset(queryset)
|
||||
|
||||
def get_serializer_context(self):
|
||||
context = super().get_serializer_context()
|
||||
inline = 'inline' in self.request.query_params
|
||||
context.update({'request': self.request, 'inline': inline})
|
||||
return context
|
||||
|
||||
def destroy(self, request, uid=None):
|
||||
# FIXME: implement
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def partial_update(self, request, uid=None):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def update(self, request, *args, **kwargs):
|
||||
instance = self.get_object()
|
||||
|
||||
stoken = request.GET.get('stoken', None)
|
||||
|
||||
if stoken is not None and stoken != instance.stoken:
|
||||
content = {'code': 'stale_stoken', 'detail': 'Stoken is too old'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
serializer = self.get_serializer(instance, data=request.data)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
self.perform_update(serializer)
|
||||
|
||||
return Response({})
|
||||
|
||||
def create(self, request, *args, **kwargs):
|
||||
serializer = self.get_serializer(data=request.data)
|
||||
if serializer.is_valid():
|
||||
try:
|
||||
serializer.save(owner=self.request.user)
|
||||
except IntegrityError:
|
||||
content = {'code': 'integrity_error'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
return Response({}, status=status.HTTP_201_CREATED)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
def list(self, request):
|
||||
queryset = self.get_queryset()
|
||||
queryset, new_stoken = self.filter_by_stoken_and_limit(request, queryset)
|
||||
|
||||
serializer = self.get_serializer(queryset, many=True)
|
||||
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
'stoken': new_stoken,
|
||||
}
|
||||
|
||||
stoken_obj = self.get_stoken_obj(request)
|
||||
if stoken_obj is not None:
|
||||
# FIXME: honour limit? (the limit should be combined for data and this because of stoken)
|
||||
remed = CollectionMemberRemoved.objects.filter(user=request.user, stoken__id__gt=stoken_obj.id) \
|
||||
.values_list('collection__uid', flat=True)
|
||||
if len(remed) > 0:
|
||||
ret['removedMemberships'] = [{'uid': x} for x in remed]
|
||||
|
||||
return Response(ret)
|
||||
|
||||
|
||||
class CollectionItemViewSet(BaseViewSet):
|
||||
allowed_methods = ['GET', 'POST', 'PUT']
|
||||
permission_classes = BaseViewSet.permission_classes + (permissions.HasWriteAccessOrReadOnly, )
|
||||
queryset = CollectionItem.objects.all()
|
||||
serializer_class = CollectionItemSerializer
|
||||
lookup_field = 'uid'
|
||||
stoken_id_fields = ['revisions__stoken__id']
|
||||
|
||||
def get_queryset(self):
|
||||
collection_uid = self.kwargs['collection_uid']
|
||||
try:
|
||||
collection = self.get_collection_queryset(Collection.objects).get(uid=collection_uid)
|
||||
except Collection.DoesNotExist:
|
||||
raise Http404("Collection does not exist")
|
||||
# XXX Potentially add this for performance: .prefetch_related('revisions__chunks')
|
||||
queryset = type(self).queryset.filter(collection__pk=collection.pk,
|
||||
uid__isnull=False,
|
||||
revisions__current=True,
|
||||
revisions__deleted=False)
|
||||
|
||||
return queryset
|
||||
|
||||
def get_serializer_context(self):
|
||||
context = super().get_serializer_context()
|
||||
inline = 'inline' in self.request.query_params
|
||||
context.update({'request': self.request, 'inline': inline})
|
||||
return context
|
||||
|
||||
def create(self, request, collection_uid=None):
|
||||
# We create using batch and transaction
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def destroy(self, request, collection_uid=None, uid=None):
|
||||
# We can't have destroy because we need to get data from the user (in the body) such as hmac.
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def update(self, request, collection_uid=None, uid=None):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def partial_update(self, request, collection_uid=None, uid=None):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
def list(self, request, collection_uid=None):
|
||||
queryset = self.get_queryset()
|
||||
queryset, new_stoken = self.filter_by_stoken_and_limit(request, queryset)
|
||||
|
||||
serializer = self.get_serializer(queryset, many=True)
|
||||
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
'stoken': new_stoken,
|
||||
}
|
||||
return Response(ret)
|
||||
|
||||
@action_decorator(detail=True, methods=['GET'])
|
||||
def revision(self, request, collection_uid=None, uid=None):
|
||||
# FIXME: need pagination support
|
||||
col = get_object_or_404(self.get_collection_queryset(Collection.objects), uid=collection_uid)
|
||||
col_it = get_object_or_404(col.items, uid=uid)
|
||||
|
||||
serializer = CollectionItemRevisionSerializer(col_it.revisions.order_by('-id'), many=True)
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
}
|
||||
return Response(ret)
|
||||
|
||||
# FIXME: rename to something consistent with what the clients have - maybe list_updates?
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def fetch_updates(self, request, collection_uid=None):
|
||||
queryset = self.get_queryset()
|
||||
|
||||
serializer = CollectionItemBulkGetSerializer(data=request.data, many=True)
|
||||
if serializer.is_valid():
|
||||
# FIXME: make configurable?
|
||||
item_limit = 200
|
||||
|
||||
if len(serializer.validated_data) > item_limit:
|
||||
content = {'code': 'too_many_items',
|
||||
'detail': 'Request has too many items. Limit: {}'. format(item_limit)}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
queryset, stoken_rev = self.filter_by_stoken(request, queryset)
|
||||
|
||||
uids, etags = zip(*[(item['uid'], item.get('etag')) for item in serializer.validated_data])
|
||||
revs = CollectionItemRevision.objects.filter(uid__in=etags, current=True)
|
||||
queryset = queryset.filter(uid__in=uids).exclude(revisions__in=revs)
|
||||
|
||||
queryset, new_stoken = self.get_queryset_stoken(queryset)
|
||||
stoken = stoken_rev and stoken_rev.uid
|
||||
new_stoken = new_stoken or stoken
|
||||
|
||||
serializer = self.get_serializer(queryset, many=True)
|
||||
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
'stoken': new_stoken,
|
||||
}
|
||||
return Response(ret)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def batch(self, request, collection_uid=None):
|
||||
return self.transaction(request, collection_uid, validate_etag=False)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def transaction(self, request, collection_uid=None, validate_etag=True):
|
||||
stoken = request.GET.get('stoken', None)
|
||||
with transaction.atomic(): # We need this for locking on the collection object
|
||||
collection_object = get_object_or_404(
|
||||
self.get_collection_queryset(Collection.objects).select_for_update(), # Lock writes on the collection
|
||||
uid=collection_uid)
|
||||
|
||||
if stoken is not None and stoken != collection_object.stoken:
|
||||
content = {'code': 'stale_stoken', 'detail': 'Stoken is too old'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
items = request.data.get('items')
|
||||
deps = request.data.get('deps', None)
|
||||
# FIXME: It should just be one serializer
|
||||
context = self.get_serializer_context()
|
||||
context.update({'validate_etag': validate_etag})
|
||||
serializer = self.get_serializer_class()(data=items, context=context, many=True)
|
||||
deps_serializer = CollectionItemDepSerializer(data=deps, context=context, many=True)
|
||||
|
||||
ser_valid = serializer.is_valid()
|
||||
deps_ser_valid = (deps is None or deps_serializer.is_valid())
|
||||
if ser_valid and deps_ser_valid:
|
||||
try:
|
||||
items = serializer.save(collection=collection_object)
|
||||
except IntegrityError:
|
||||
# FIXME: return the items with a bad token (including deps) so we don't have to fetch them after
|
||||
content = {'code': 'integrity_error'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
ret = {
|
||||
}
|
||||
return Response(ret, status=status.HTTP_200_OK)
|
||||
|
||||
return Response(
|
||||
{
|
||||
"items": serializer.errors,
|
||||
"deps": deps_serializer.errors if deps is not None else [],
|
||||
},
|
||||
status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
|
||||
class CollectionItemChunkViewSet(viewsets.ViewSet):
|
||||
allowed_methods = ['GET', 'POST']
|
||||
parser_classes = (parsers.MultiPartParser, )
|
||||
authentication_classes = BaseViewSet.authentication_classes
|
||||
permission_classes = BaseViewSet.permission_classes
|
||||
serializer_class = CollectionItemChunkSerializer
|
||||
lookup_field = 'uid'
|
||||
|
||||
def get_serializer_class(self):
|
||||
return self.serializer_class
|
||||
|
||||
def get_collection_queryset(self, queryset=Collection.objects):
|
||||
user = self.request.user
|
||||
return queryset.filter(members__user=user)
|
||||
|
||||
def create(self, request, collection_uid=None, collection_item_uid=None):
|
||||
col = get_object_or_404(self.get_collection_queryset(), uid=collection_uid)
|
||||
col_it = get_object_or_404(col.items, uid=collection_item_uid)
|
||||
|
||||
serializer = self.get_serializer_class()(data=request.data)
|
||||
if serializer.is_valid():
|
||||
try:
|
||||
serializer.save(item=col_it)
|
||||
except IntegrityError:
|
||||
content = {'code': 'integrity_error'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
return Response({}, status=status.HTTP_201_CREATED)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
@action_decorator(detail=True, methods=['GET'])
|
||||
def download(self, request, collection_uid=None, collection_item_uid=None, uid=None):
|
||||
import os
|
||||
from django.views.static import serve
|
||||
|
||||
col = get_object_or_404(self.get_collection_queryset(), uid=collection_uid)
|
||||
col_it = get_object_or_404(col.items, uid=collection_item_uid)
|
||||
chunk = get_object_or_404(col_it.chunks, uid=uid)
|
||||
|
||||
filename = chunk.chunkFile.path
|
||||
dirname = os.path.dirname(filename)
|
||||
basename = os.path.basename(filename)
|
||||
|
||||
# FIXME: DO NOT USE! Use django-send file or etc instead.
|
||||
return serve(request, basename, dirname)
|
||||
|
||||
|
||||
class CollectionMemberViewSet(BaseViewSet):
|
||||
allowed_methods = ['GET', 'PUT', 'DELETE']
|
||||
our_base_permission_classes = BaseViewSet.permission_classes
|
||||
permission_classes = our_base_permission_classes + (permissions.IsCollectionAdmin, )
|
||||
queryset = CollectionMember.objects.all()
|
||||
serializer_class = CollectionMemberSerializer
|
||||
lookup_field = 'user__' + User.USERNAME_FIELD
|
||||
lookup_url_kwarg = 'username'
|
||||
|
||||
# FIXME: need to make sure that there's always an admin, and maybe also don't let an owner remove adm access
|
||||
# (if we want to transfer, we need to do that specifically)
|
||||
|
||||
def get_queryset(self, queryset=None):
|
||||
collection_uid = self.kwargs['collection_uid']
|
||||
try:
|
||||
collection = self.get_collection_queryset(Collection.objects).get(uid=collection_uid)
|
||||
except Collection.DoesNotExist:
|
||||
raise Http404('Collection does not exist')
|
||||
|
||||
if queryset is None:
|
||||
queryset = type(self).queryset
|
||||
|
||||
return queryset.filter(collection=collection)
|
||||
|
||||
def list(self, request, collection_uid=None):
|
||||
queryset = self.get_queryset()
|
||||
serializer = self.get_serializer(queryset, many=True)
|
||||
|
||||
ret = {
|
||||
'data': serializer.data,
|
||||
}
|
||||
|
||||
return Response(ret)
|
||||
|
||||
def create(self, request):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
# FIXME: block leaving if we are the last admins - should be deleted / assigned in this case depending if there
|
||||
# are other memebers.
|
||||
def perform_destroy(self, instance):
|
||||
instance.revoke()
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'], permission_classes=our_base_permission_classes)
|
||||
def leave(self, request, collection_uid=None):
|
||||
collection_uid = self.kwargs['collection_uid']
|
||||
col = get_object_or_404(self.get_collection_queryset(Collection.objects), uid=collection_uid)
|
||||
|
||||
member = col.members.get(user=request.user)
|
||||
self.perform_destroy(member)
|
||||
|
||||
return Response({})
|
||||
|
||||
|
||||
class InvitationOutgoingViewSet(BaseViewSet):
|
||||
allowed_methods = ['GET', 'POST', 'PUT', 'DELETE']
|
||||
permission_classes = BaseViewSet.permission_classes
|
||||
queryset = CollectionInvitation.objects.all()
|
||||
serializer_class = CollectionInvitationSerializer
|
||||
lookup_field = 'uid'
|
||||
lookup_url_kwarg = 'invitation_uid'
|
||||
|
||||
def get_queryset(self, queryset=None):
|
||||
if queryset is None:
|
||||
queryset = type(self).queryset
|
||||
|
||||
return queryset.filter(fromMember__user=self.request.user)
|
||||
|
||||
def create(self, request, *args, **kwargs):
|
||||
serializer = self.get_serializer(data=request.data)
|
||||
if serializer.is_valid():
|
||||
collection_uid = serializer.validated_data.get('collection', {}).get('uid')
|
||||
|
||||
try:
|
||||
collection = self.get_collection_queryset(Collection.objects).get(uid=collection_uid)
|
||||
except Collection.DoesNotExist:
|
||||
raise Http404('Collection does not exist')
|
||||
|
||||
if not permissions.is_collection_admin(collection, request.user):
|
||||
raise PermissionDenied('User is not an admin of this collection')
|
||||
|
||||
serializer.save(collection=collection)
|
||||
|
||||
return Response({}, status=status.HTTP_201_CREATED)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
@action_decorator(detail=False, allowed_methods=['GET'], methods=['GET'])
|
||||
def fetch_user_profile(self, request):
|
||||
username = request.GET.get('username')
|
||||
kwargs = {'owner__' + User.USERNAME_FIELD: username}
|
||||
user_info = get_object_or_404(UserInfo.objects.all(), **kwargs)
|
||||
serializer = UserInfoPubkeySerializer(user_info)
|
||||
return Response(serializer.data)
|
||||
|
||||
|
||||
class InvitationIncomingViewSet(BaseViewSet):
|
||||
allowed_methods = ['GET', 'DELETE']
|
||||
queryset = CollectionInvitation.objects.all()
|
||||
serializer_class = CollectionInvitationSerializer
|
||||
lookup_field = 'uid'
|
||||
lookup_url_kwarg = 'invitation_uid'
|
||||
|
||||
def get_queryset(self, queryset=None):
|
||||
if queryset is None:
|
||||
queryset = type(self).queryset
|
||||
|
||||
return queryset.filter(user=self.request.user)
|
||||
|
||||
@action_decorator(detail=True, allowed_methods=['POST'], methods=['POST'])
|
||||
def accept(self, request, invitation_uid=None):
|
||||
invitation = get_object_or_404(self.get_queryset(), uid=invitation_uid)
|
||||
context = self.get_serializer_context()
|
||||
context.update({'invitation': invitation})
|
||||
|
||||
serializer = InvitationAcceptSerializer(data=request.data, context=context)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
serializer.save()
|
||||
return Response(status=status.HTTP_201_CREATED)
|
||||
|
||||
|
||||
class AuthenticationViewSet(viewsets.ViewSet):
|
||||
allowed_methods = ['POST']
|
||||
authentication_classes = BaseViewSet.authentication_classes
|
||||
|
||||
def get_encryption_key(self, salt):
|
||||
key = nacl.hash.blake2b(settings.SECRET_KEY.encode(), encoder=nacl.encoding.RawEncoder)
|
||||
return nacl.hash.blake2b(b'', key=key, salt=salt[:nacl.hash.BLAKE2B_SALTBYTES], person=b'etebase-auth',
|
||||
encoder=nacl.encoding.RawEncoder)
|
||||
|
||||
def get_queryset(self):
|
||||
return User.objects.all()
|
||||
|
||||
def login_response_data(self, user):
|
||||
return {
|
||||
'token': AuthToken.objects.create(user=user).key,
|
||||
'user': UserSerializer(user).data,
|
||||
}
|
||||
|
||||
def list(self, request):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def signup(self, request):
|
||||
serializer = AuthenticationSignupSerializer(data=request.data)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
user = serializer.save()
|
||||
|
||||
data = self.login_response_data(user)
|
||||
return Response(data, status=status.HTTP_201_CREATED)
|
||||
|
||||
def get_login_user(self, username):
|
||||
kwargs = {User.USERNAME_FIELD: username}
|
||||
return get_object_or_404(self.get_queryset(), **kwargs)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def login_challenge(self, request):
|
||||
from datetime import datetime
|
||||
|
||||
serializer = AuthenticationLoginChallengeSerializer(data=request.data)
|
||||
if serializer.is_valid():
|
||||
username = serializer.validated_data.get('username')
|
||||
user = self.get_login_user(username)
|
||||
|
||||
salt = bytes(user.userinfo.salt)
|
||||
enc_key = self.get_encryption_key(salt)
|
||||
box = nacl.secret.SecretBox(enc_key)
|
||||
|
||||
challenge_data = {
|
||||
"timestamp": int(datetime.now().timestamp()),
|
||||
"userId": user.id,
|
||||
}
|
||||
challenge = box.encrypt(json.dumps(
|
||||
challenge_data, separators=(',', ':')).encode(), encoder=nacl.encoding.RawEncoder)
|
||||
|
||||
ret = {
|
||||
"salt": b64encode(salt),
|
||||
"challenge": b64encode(challenge),
|
||||
"version": user.userinfo.version,
|
||||
}
|
||||
return Response(ret, status=status.HTTP_200_OK)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def login(self, request):
|
||||
from datetime import datetime
|
||||
|
||||
outer_serializer = AuthenticationLoginSerializer(data=request.data)
|
||||
if outer_serializer.is_valid():
|
||||
response_raw = outer_serializer.validated_data['response']
|
||||
response = json.loads(response_raw.decode())
|
||||
signature = outer_serializer.validated_data['signature']
|
||||
|
||||
serializer = AuthenticationLoginInnerSerializer(data=response, context={'host': request.get_host()})
|
||||
if serializer.is_valid():
|
||||
username = serializer.validated_data.get('username')
|
||||
user = self.get_login_user(username)
|
||||
host = serializer.validated_data['host']
|
||||
challenge = serializer.validated_data['challenge']
|
||||
|
||||
salt = bytes(user.userinfo.salt)
|
||||
enc_key = self.get_encryption_key(salt)
|
||||
box = nacl.secret.SecretBox(enc_key)
|
||||
|
||||
challenge_data = json.loads(box.decrypt(challenge).decode())
|
||||
now = int(datetime.now().timestamp())
|
||||
if now - challenge_data['timestamp'] > app_settings.CHALLENGE_VALID_SECONDS:
|
||||
content = {'code': 'challenge_expired', 'detail': 'Login challange has expired'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
elif challenge_data['userId'] != user.id:
|
||||
content = {'code': 'wrong_user', 'detail': 'This challenge is for the wrong user'}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
elif not settings.DEBUG and host != request.get_host():
|
||||
detail = 'Found wrong host name. Got: "{}" expected: "{}"'.format(host, request.get_host())
|
||||
content = {'code': 'wrong_host', 'detail': detail}
|
||||
return Response(content, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
verify_key = nacl.signing.VerifyKey(bytes(user.userinfo.loginPubkey), encoder=nacl.encoding.RawEncoder)
|
||||
|
||||
try:
|
||||
verify_key.verify(response_raw, signature)
|
||||
except nacl.exceptions.BadSignatureError:
|
||||
return Response({'code': 'login_bad_signature'}, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
data = self.login_response_data(user)
|
||||
|
||||
user_logged_in.send(sender=user.__class__, request=request, user=user)
|
||||
|
||||
return Response(data, status=status.HTTP_200_OK)
|
||||
|
||||
return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'], permission_classes=BaseViewSet.permission_classes)
|
||||
def logout(self, request):
|
||||
request.auth.delete()
|
||||
user_logged_out.send(sender=request.user.__class__, request=request, user=request.user)
|
||||
return Response(status=status.HTTP_204_NO_CONTENT)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'], permission_classes=BaseViewSet.permission_classes)
|
||||
def change_password(self, request):
|
||||
serializer = AuthenticationChangePasswordSerializer(request.user.userinfo, data=request.data)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
serializer.save()
|
||||
|
||||
return Response(status=status.HTTP_200_OK)
|
||||
|
||||
|
||||
class TestAuthenticationViewSet(viewsets.ViewSet):
|
||||
allowed_methods = ['POST']
|
||||
|
||||
def list(self, request):
|
||||
return Response(status=status.HTTP_405_METHOD_NOT_ALLOWED)
|
||||
|
||||
@action_decorator(detail=False, methods=['POST'])
|
||||
def reset(self, request, *args, **kwargs):
|
||||
# Only run when in DEBUG mode! It's only used for tests
|
||||
if not settings.DEBUG:
|
||||
return HttpResponseBadRequest("Only allowed in debug mode.")
|
||||
|
||||
user = get_object_or_404(User.objects.all(), username=request.data.get('user').get('username'))
|
||||
|
||||
# Only allow test users for extra safety
|
||||
if not getattr(user, User.USERNAME_FIELD).startswith('test_user'):
|
||||
return HttpResponseBadRequest("Endpoint not allowed for user.")
|
||||
|
||||
if hasattr(user, 'userinfo'):
|
||||
user.userinfo.delete()
|
||||
|
||||
serializer = AuthenticationSignupSerializer(data=request.data)
|
||||
serializer.is_valid(raise_exception=True)
|
||||
serializer.save()
|
||||
|
||||
# Delete all of the journal data for this user for a clear test env
|
||||
user.collection_set.all().delete()
|
||||
user.incoming_invitations.all().delete()
|
||||
|
||||
# FIXME: also delete chunk files!!!
|
||||
|
||||
return HttpResponse()
|
||||
Reference in New Issue
Block a user