141 lines
5.3 KiB
Python
141 lines
5.3 KiB
Python
import logging
|
|
|
|
import simplejson
|
|
import werkzeug.utils
|
|
from werkzeug.exceptions import BadRequest
|
|
|
|
import openerp
|
|
from openerp import SUPERUSER_ID
|
|
from openerp import http
|
|
from openerp.http import request, LazyResponse
|
|
from openerp.addons.web.controllers.main import db_monodb, set_cookie_and_redirect, login_and_redirect
|
|
from openerp.modules.registry import RegistryManager
|
|
from openerp.tools.translate import _
|
|
|
|
_logger = logging.getLogger(__name__)
|
|
|
|
#----------------------------------------------------------
|
|
# Controller
|
|
#----------------------------------------------------------
|
|
class OAuthLogin(openerp.addons.web.controllers.main.Home):
|
|
def list_providers(self):
|
|
try:
|
|
provider_obj = request.registry.get('auth.oauth.provider')
|
|
providers = provider_obj.search_read(request.cr, SUPERUSER_ID, [('enabled', '=', True)])
|
|
except Exception:
|
|
providers = []
|
|
for provider in providers:
|
|
return_url = request.httprequest.url_root + 'auth_oauth/signin'
|
|
state = dict(
|
|
d=request.session.db,
|
|
p=provider['id']
|
|
)
|
|
params = dict(
|
|
debug=request.debug,
|
|
response_type='token',
|
|
client_id=provider['client_id'],
|
|
redirect_uri=return_url,
|
|
scope=provider['scope'],
|
|
state=simplejson.dumps(state),
|
|
)
|
|
provider['auth_link'] = provider['auth_endpoint'] + '?' + werkzeug.url_encode(params)
|
|
|
|
return providers
|
|
|
|
@http.route()
|
|
def web_login(self, *args, **kw):
|
|
# TODO: ensure_db()
|
|
request.disable_db = False
|
|
|
|
response = super(OAuthLogin, self).web_login(*args, **kw)
|
|
if isinstance(response, LazyResponse):
|
|
error = request.params.get('oauth_error')
|
|
if error == '1':
|
|
error = _("Sign up is not allowed on this database.")
|
|
elif error == '2':
|
|
error = _("Access Denied")
|
|
elif error == '3':
|
|
error = _("You do not have access to this database or your invitation has expired. Please ask for an invitation and be sure to follow the link in your invitation email.")
|
|
else:
|
|
error = None
|
|
response.params['values'].update(
|
|
providers=self.list_providers(),
|
|
error=error,
|
|
)
|
|
|
|
# TODO: code in old js controller that should be converted in auth_oauth_signup
|
|
# if (this.oauth_providers.length === 1 && params.type === 'signup') {
|
|
# this.do_oauth_sign_in(this.oauth_providers[0]);
|
|
# }
|
|
|
|
return response
|
|
|
|
class OAuthController(http.Controller):
|
|
|
|
@http.route('/auth_oauth/signin', type='http', auth='none')
|
|
def signin(self, **kw):
|
|
state = simplejson.loads(kw['state'])
|
|
dbname = state['d']
|
|
provider = state['p']
|
|
context = state.get('c', {})
|
|
registry = RegistryManager.get(dbname)
|
|
with registry.cursor() as cr:
|
|
try:
|
|
u = registry.get('res.users')
|
|
credentials = u.auth_oauth(cr, SUPERUSER_ID, provider, kw, context=context)
|
|
cr.commit()
|
|
action = state.get('a')
|
|
menu = state.get('m')
|
|
url = '/web'
|
|
if action:
|
|
url = '/web#action=%s' % action
|
|
elif menu:
|
|
url = '/web#menu_id=%s' % menu
|
|
return login_and_redirect(*credentials, redirect_url=url)
|
|
except AttributeError:
|
|
# auth_signup is not installed
|
|
_logger.error("auth_signup not installed on database %s: oauth sign up cancelled." % (dbname,))
|
|
url = "/web/login?oauth_error=1"
|
|
except openerp.exceptions.AccessDenied:
|
|
# oauth credentials not valid, user could be on a temporary session
|
|
_logger.info('OAuth2: access denied, redirect to main page in case a valid session exists, without setting cookies')
|
|
url = "/web/login?oauth_error=3"
|
|
redirect = werkzeug.utils.redirect(url, 303)
|
|
redirect.autocorrect_location_header = False
|
|
return redirect
|
|
except Exception, e:
|
|
# signup error
|
|
_logger.exception("OAuth2: %s" % str(e))
|
|
url = "/web/login?oauth_error=2"
|
|
|
|
return set_cookie_and_redirect(url)
|
|
|
|
@http.route('/auth_oauth/oea', type='http', auth='none')
|
|
def oea(self, **kw):
|
|
"""login user via OpenERP Account provider"""
|
|
dbname = kw.pop('db', None)
|
|
if not dbname:
|
|
dbname = db_monodb()
|
|
if not dbname:
|
|
return BadRequest()
|
|
|
|
registry = RegistryManager.get(dbname)
|
|
with registry.cursor() as cr:
|
|
IMD = registry['ir.model.data']
|
|
try:
|
|
model, provider_id = IMD.get_object_reference(cr, SUPERUSER_ID, 'auth_oauth', 'provider_openerp')
|
|
except ValueError:
|
|
return set_cookie_and_redirect('/web?db=%s' % dbname)
|
|
assert model == 'auth.oauth.provider'
|
|
|
|
state = {
|
|
'd': dbname,
|
|
'p': provider_id,
|
|
'c': {'no_user_creation': True},
|
|
}
|
|
|
|
kw['state'] = simplejson.dumps(state)
|
|
return self.signin(**kw)
|
|
|
|
# vim:expandtab:tabstop=4:softtabstop=4:shiftwidth=4:
|