Files
Arcaea-server/latest version/server/auth.py
Lost-MSth 88d949fc18 [Bug fix] block headers without app version
- Fix a bug that headers without `AppVersion` are allowed in client version checking.
2023-01-22 22:09:15 +08:00

66 lines
2.1 KiB
Python
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import base64
from functools import wraps
from core.config_manager import Config
from core.error import ArcError, NoAccess
from core.sql import Connect
from core.user import UserAuth, UserLogin
from flask import Blueprint, g, jsonify, request
from .func import arc_try, error_return
bp = Blueprint('auth', __name__, url_prefix='/auth')
@bp.route('/login', methods=['POST']) # 登录接口
@arc_try
def login():
headers = request.headers
if Config.ALLOW_APPVERSION: # 版本检查
if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
raise NoAccess('Invalid app version.', 1203)
request.form['grant_type']
with Connect() as c:
id_pwd = headers['Authorization']
id_pwd = base64.b64decode(id_pwd[6:]).decode()
name, password = id_pwd.split(':', 1)
if 'DeviceId' in headers:
device_id = headers['DeviceId']
else:
device_id = 'low_version'
user = UserLogin(c)
user.login(name, password, device_id, request.remote_addr)
return jsonify({"success": True, "token_type": "Bearer", 'user_id': user.user_id, 'access_token': user.token})
def auth_required(request):
# arcaea登录验证写成了修饰器
def decorator(view):
@wraps(view)
def wrapped_view(*args, **kwargs):
headers = request.headers
if Config.ALLOW_APPVERSION: # 版本检查
if 'AppVersion' not in headers or headers['AppVersion'] not in Config.ALLOW_APPVERSION:
return error_return(NoAccess('Invalid app version.', 1203))
with Connect() as c:
try:
user = UserAuth(c)
token = headers.get('Authorization')
if not token:
raise NoAccess('No token.', -4)
user.token = token[7:]
user_id = user.token_get_id()
g.user = user
except ArcError as e:
return error_return(e)
return view(user_id, *args, **kwargs)
return wrapped_view
return decorator