Chore Account server

Check-in [80164f8171]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Drop some pdb hooks. Add version to redir target to sidestep cache
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | master | trunk
Files: files | file ages | folders
SHA3-256:80164f8171d4db47ae5a69dad268693215a611f1e6c75561c30702d6df55eef6
User & Date: ajv-899-334-8894@vsta.org 2016-10-26 23:13:14
Context
2016-10-26
23:15
Edge case check-in: 9177c5536e user: ajv-899-334-8894@vsta.org tags: master, trunk
23:13
Drop some pdb hooks. Add version to redir target to sidestep cache check-in: 80164f8171 user: ajv-899-334-8894@vsta.org tags: master, trunk
22:11
Bring up basic authen check-in: 8fa03b3227 user: ajv-899-334-8894@vsta.org tags: master, trunk
Changes
Hide Diffs Unified Diffs Show Whitespace Changes Patch

Changes to get.py.

1
2
3
4
5
6
7
8
9
10
11
12
..
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
..
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
..
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#
# get.py
#       Account portal & service interface
#
import pdb

class GET_mixin(object):
    # Top level
    #
    # We don't use chore-level authentication, as we're the
    #  ones who will deal with authentication in the first place.
    #
................................................................................
    #  we either display the portal (if they pointed their own
    #  browser at us) or else generate a redir to the service which
    #  kicked them over here to get (re-)authentcated.
    #
    # If there's no cookie, or not a good one, let them enter
    #  it here and we'll deal with authentication.
    def send_top(self):
        pdb.set_trace()
        res = self.auth_cookie()

        # If they're OK...
        if res is True:
            # TBD, redirect back.  But have to be really careful
            #  about validating destination; we don't want to send
            #  them anywhere but our own services.
................................................................................

            # Show the service portal
            return self.send_portal()

        # Please log in...
        buf = self.build_header("Please Log In")
        if self.vals:
            pdb.set_trace()
            buf += "<pre>%s</pre><br>" % (self.vals["msg"],)
        buf += "<h3>Please log in:</h3><br>\n"
        buf += '<form action="/login" method="post">\n'
        buf += ' Account name: <input type="text" name="acct"><br>\n'
        buf += ' Password: <input type="password" name="pw"><br>\n'
        buf += ' <input type="submit" value="Log In">\n'
        buf += "</form>\n"
................................................................................

        buf = self.build_header("Service Portal")
        buf += "<h3>Choose a service:</h3><br>\n"
        cfg = app.accts.get(self.user)
        if cfg is None:
            raise Exception, "Unknown account authenticated"
        services = cfg.get("serve")
        pdb.set_trace()

        # Hostname they used to reach us, should be
        #  <host>:<port#>
        host = self.headers.get("host").split(":")[0]
        if services is None:
            buf += "<i>No services are configured for you?</i>"
        else:




<







 







<







 







<







 







<







1
2
3
4

5
6
7
8
9
10
11
..
13
14
15
16
17
18
19

20
21
22
23
24
25
26
..
27
28
29
30
31
32
33

34
35
36
37
38
39
40
..
49
50
51
52
53
54
55

56
57
58
59
60
61
62
#
# get.py
#       Account portal & service interface
#


class GET_mixin(object):
    # Top level
    #
    # We don't use chore-level authentication, as we're the
    #  ones who will deal with authentication in the first place.
    #
................................................................................
    #  we either display the portal (if they pointed their own
    #  browser at us) or else generate a redir to the service which
    #  kicked them over here to get (re-)authentcated.
    #
    # If there's no cookie, or not a good one, let them enter
    #  it here and we'll deal with authentication.
    def send_top(self):

        res = self.auth_cookie()

        # If they're OK...
        if res is True:
            # TBD, redirect back.  But have to be really careful
            #  about validating destination; we don't want to send
            #  them anywhere but our own services.
................................................................................

            # Show the service portal
            return self.send_portal()

        # Please log in...
        buf = self.build_header("Please Log In")
        if self.vals:

            buf += "<pre>%s</pre><br>" % (self.vals["msg"],)
        buf += "<h3>Please log in:</h3><br>\n"
        buf += '<form action="/login" method="post">\n'
        buf += ' Account name: <input type="text" name="acct"><br>\n'
        buf += ' Password: <input type="password" name="pw"><br>\n'
        buf += ' <input type="submit" value="Log In">\n'
        buf += "</form>\n"
................................................................................

        buf = self.build_header("Service Portal")
        buf += "<h3>Choose a service:</h3><br>\n"
        cfg = app.accts.get(self.user)
        if cfg is None:
            raise Exception, "Unknown account authenticated"
        services = cfg.get("serve")


        # Hostname they used to reach us, should be
        #  <host>:<port#>
        host = self.headers.get("host").split(":")[0]
        if services is None:
            buf += "<i>No services are configured for you?</i>"
        else:

Changes to post.py.

2
3
4
5
6
7
8

9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
..
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# post.py
#	HTML POST/PUT handling
#
# /login
#       Form post, user/pass entered
#
import urllib, sys


class POST_mixin(object):

    def __init__(self):
        self.dispatchers.append( ("POST", self.post_login) )

    # Back to user/pass screen, with error message
    def failed_login(self, msg):
        msg = urllib.quote(msg)
        return True,self.send_redir("/?msg=%s" % (msg,))

    # They've entered a user,pass, see if it's OK
    def post_login(self, buf):
        app = self.server.approot

        # Decode form fields
        self.parseKV(buf)
................................................................................
        user = vals.get("acct")
        pw = vals.get("pw")
        if (not user) or (not pw):
            return False,None
        sys.stderr.write("login %s\n" % (user,))

        # Look up user
        import pdb
        pdb.set_trace()
        acct = app.accts.get(user)
        if acct is None:
            return self.failed_login("Invalid user or password")

        # TBD, hashed passwords
        acctpw = acct.get("pass")
        if acctpw is None:
            return self.failed_login("Account is locked")
        if pw != acctpw:
            return self.failed_login("Invalid user or password")

        # Ok, they're on
        self.new_cookie(user)
        return True,self.send_redir("/")







>









|







 







<
<













|
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
..
30
31
32
33
34
35
36


37
38
39
40
41
42
43
44
45
46
47
48
49
50
# post.py
#	HTML POST/PUT handling
#
# /login
#       Form post, user/pass entered
#
import urllib, sys
from chore.utils import tstamp

class POST_mixin(object):

    def __init__(self):
        self.dispatchers.append( ("POST", self.post_login) )

    # Back to user/pass screen, with error message
    def failed_login(self, msg):
        msg = urllib.quote(msg)
        return True,self.send_redir("/?msg=%s&ver=%s" % (msg,tstamp()))

    # They've entered a user,pass, see if it's OK
    def post_login(self, buf):
        app = self.server.approot

        # Decode form fields
        self.parseKV(buf)
................................................................................
        user = vals.get("acct")
        pw = vals.get("pw")
        if (not user) or (not pw):
            return False,None
        sys.stderr.write("login %s\n" % (user,))

        # Look up user


        acct = app.accts.get(user)
        if acct is None:
            return self.failed_login("Invalid user or password")

        # TBD, hashed passwords
        acctpw = acct.get("pass")
        if acctpw is None:
            return self.failed_login("Account is locked")
        if pw != acctpw:
            return self.failed_login("Invalid user or password")

        # Ok, they're on
        self.new_cookie(user)
        return True,self.send_redir("/?ver=%s" % (tstamp(),))