From 6f3c1d94a6a8858369256b63cec90d42d61706ae Mon Sep 17 00:00:00 2001 From: Santo Cariotti Date: Fri, 20 Mar 2020 11:06:20 +0100 Subject: feat: add auth --- frest/decorators.py | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 frest/decorators.py (limited to 'frest/decorators.py') diff --git a/frest/decorators.py b/frest/decorators.py new file mode 100644 index 0000000..181b62d --- /dev/null +++ b/frest/decorators.py @@ -0,0 +1,40 @@ +from flask import request, abort +from auth.models import Token +from functools import wraps + + +def check_token(f): + @wraps(f) + def inner(*args, **kwargs): + userid = request.url.split('/')[-1] + headers = request.headers + if not headers.get("Authentication"): + abort(403) + + auth = request.headers.get("Authentication") + token = Token.query.filter_by(string=auth).first() + if not token: + abort(403) + + if userid.isdigit(): + if int(userid) != token.user.userId and not token.user.is_admin: + abort(403) + + return f(*args, **kwargs) + + return inner + + +def admin_required(f): + @wraps(f) + def inner(*args, **kwargs): + header = request.headers + + auth = request.headers.get("Authentication") + token = Token.query.filter_by(string=auth).first() + if not token.user.is_admin: + abort(403) + + return f(*args, **kwargs) + + return inner -- cgit v1.2.3-71-g8e6c