builders: Fix API authentication

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/web/base.py b/src/web/base.py
index cea68c5cb947acadfcba6fd50e9fe679771ae249..91e1855ee1234a149cf529d9ba66c89202adbb85 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -336,10 +336,13 @@ class APIError(tornado.web.HTTPError):
                return self.message
 
 
-class APIMixin(KerberosAuthMixin, BackendMixin):
+class APIMixin(KerberosAuthMixin):
        # Generally do not permit users to authenticate against the API
        allow_users = False
 
+       # Allow builders to authenticate?
+       allow_builders = True
+
        # Do not perform any XSRF cookie validation on API calls
        def check_xsrf_cookie(self):
                pass
@@ -361,17 +364,14 @@ class APIMixin(KerberosAuthMixin, BackendMixin):
                principal, delimiter, realm = principal.partition("@")
 
                # Return any builders
-               if principal.startswith("host/"):
+               if self.allow_builders and principal.startswith("host/"):
                        hostname = principal.removeprefix("host/")
 
                        return self.backend.builders.get_by_name(hostname)
 
-               # End here if users are not allowed to authenticate
-               if not self.allow_users:
-                       return
-
-               # Return users
-               return self.backend.users.get_by_name(principal)
+               # Return any users
+               if self.allow_users:
+                       return self.backend.users.get_by_name(principal)
 
        def get_user_locale(self):
                return self.get_browser_locale()

diff --git a/src/web/builders.py b/src/web/builders.py
index f3705b77666f294476256024bc8b958e7672ab66..fa11c644c437c5fb2e8ca9190babf4a61b2a7d9e 100644 (file)
--- a/src/web/builders.py
+++ b/src/web/builders.py
@@ -9,8 +9,13 @@ from . import ui_modules
 # Setup logging
 log = logging.getLogger("pbs.web.builders")
 
-class APIv1ControlHandler(base.APIMixin, tornado.websocket.WebSocketHandler):
-       @tornado.web.authenticated
+class APIv1ControlHandler(base.APIMixin, base.BackendMixin, tornado.websocket.WebSocketHandler):
+       @base.negotiate
+       def prepare(self):
+               # This is here to require authentication before
+               # the websocket connection is being negotiated.
+               pass
+
        async def open(self):
                # The builder has opened a new connection
                self.current_user.connected(self)

diff --git a/src/web/uploads.py b/src/web/uploads.py
index dbce3d47c9102bb541cfbcf4e2bbdf1530a727a4..f31c52353d462ca263391f4fa4714d588f703fbf 100644 (file)
--- a/src/web/uploads.py
+++ b/src/web/uploads.py
@@ -27,7 +27,7 @@ from . import base
 from .. import uploads
 from .. import users
 
-class APIv1IndexHandler(base.APIMixin, tornado.web.RequestHandler):
+class APIv1IndexHandler(base.APIMixin, base.BaseHandler):
        # Allow users to perform uploads
        allow_users = True
 
@@ -103,7 +103,7 @@ class APIv1IndexHandler(base.APIMixin, tornado.web.RequestHandler):
 
 
 @tornado.web.stream_request_body
-class APIv1DetailHandler(base.APIMixin, tornado.web.RequestHandler):
+class APIv1DetailHandler(base.APIMixin, base.BaseHandler):
        # Allow users to perform uploads
        allow_users = True