auth: Do not allow logged-in users to register again

[ipfire.org.git] / src / web / auth.py

#!/usr/bin/python

import logging
import tornado.web

from . import base

class AuthenticationMixin(object):
	def authenticate(self, username, password):
		# Find account
		account = self.backend.accounts.find_account(username)
		if not account:
			raise tornado.web.HTTPError(401, "Unknown user: %s" % username)

		# Check credentials
		if not account.check_password(password):
			raise tornado.web.HTTPError(401, "Invalid password for %s" % account)

		return self.login(account)

	def login(self, account):
		# User has logged in, create a session
		with self.db.transaction():
			session_id, session_expires = self.backend.accounts.create_session(
				account, self.request.host)

		# Check if a new session was created
		if not session_id:
			raise tornado.web.HTTPError(500, "Could not create session")

		# Send session cookie to the client
		self.set_cookie("session_id", session_id,
			domain=self.request.host, expires=session_expires)

	def logout(self):
		session_id = self.get_cookie("session_id")
		if not session_id:
			return

		# Destroy session
		with self.db.transaction():
			success = self.backend.accounts.destroy_session(session_id, self.request.host)

		if success:
			self.clear_cookie("session_id")


class LoginHandler(AuthenticationMixin, base.BaseHandler):
	@base.blacklisted
	def get(self):
		next = self.get_argument("next", None)

		self.render("auth/login.html", next=next)

	@base.blacklisted
	def post(self):
		username = self.get_argument("username")
		password = self.get_argument("password")

		with self.db.transaction():
			self.authenticate(username, password)

		# Determine the page we should redirect to
		next = self.get_argument("next", None)

		return self.redirect(next or "/")


class LogoutHandler(AuthenticationMixin, base.BaseHandler):
	def get(self):
		with self.db.transaction():
			self.logout()

		# Get back to the start page
		self.redirect("/")


class RegisterHandler(base.BaseHandler):
	@base.blacklisted
	def get(self):
		# Redirect logged in users away
		if self.current_user:
			self.redirect("/")

		self.render("auth/register.html")

	@base.blacklisted
	def post(self):
		uid   = self.get_argument("uid")
		email = self.get_argument("email")

		first_name = self.get_argument("first_name")
		last_name  = self.get_argument("last_name")

		# Register account
		with self.db.transaction():
			self.backend.accounts.create(uid, email,
				first_name=first_name, last_name=last_name)

		self.render("auth/register-success.html")


class ActivateHandler(AuthenticationMixin, base.BaseHandler):
	def get(self, uid, activation_code):
		# Fetch the account
		account = self.backend.accounts.get_by_uid(uid)
		if not account:
			raise tornado.web.HTTPError(400, "Account not found: %s" % uid)

		# Validate activation code
		if not account.check_password(activation_code):
			raise tornado.web.HTTPError(400, "Activation code did not match: %s" % activation_code)

		self.render("auth/activate.html", account=account)

	def post(self, uid, activation_code):
		password = self.get_argument("password1")

		# Fetch the account
		account = self.backend.accounts.get_by_uid(uid)
		if not account:
			raise tornado.web.HTTPError(404, "Account not found: %s" % uid)

		# Validate activation code
		if not account.check_password(activation_code):
			raise tornado.web.HTTPError(403, "Activation code did not match: %s" % activation_code)

		# Set the new password
		account.passwd(password)

		# Create session
		self.login(account)

		# Redirect to main page
		self.redirect("/")


class CacheMixin(object):
	def prepare(self):
		# Mark this as private when someone is logged in
		if self.current_user:
			self.add_header("Cache-Control", "private")

		self.add_header("Vary", "Cookie")