Merge pull request #241 from City-of-Helsinki/KK-731-improve-authentication

KK-731 | Improve authentication implementation

Author: tuomas777

children/schema.py

@@ -13,13 +13,12 @@
 from graphene_django import DjangoConnectionField
 from graphene_django.filter import DjangoFilterConnectionField
 from graphene_django.types import DjangoObjectType
-from graphql_jwt.decorators import login_required
 from graphql_relay import from_global_id
 from graphql_relay.connection.arrayconnection import offset_to_cursor
 
 from children.notifications import NotificationType
 from common.schema import set_obj_languages_spoken_at_home
-from common.utils import update_object
+from common.utils import login_required, update_object
 from kukkuu.exceptions import (
     ApiUsageError,
     DataValidationError,

common/utils.py

@@ -1,10 +1,11 @@
 import binascii
 from copy import deepcopy
+from functools import wraps
 
+from django.core.exceptions import PermissionDenied
 from django.db import transaction
 from graphene import Node
-from graphql_jwt.decorators import user_passes_test
-from graphql_jwt.exceptions import PermissionDenied
+from graphql.execution.base import ResolveInfo
 from graphql_relay import from_global_id, to_global_id
 
 from kukkuu import __version__
@@ -78,6 +79,34 @@ def get_obj_if_user_can_administer(info, global_id, expected_obj_type):
     return obj
 
 
+def context(f):
+    def decorator(func):
+        def wrapper(*args, **kwargs):
+            info = next(arg for arg in args if isinstance(arg, ResolveInfo))
+            return func(info.context, *args, **kwargs)
+
+        return wrapper
+
+    return decorator
+
+
+def user_passes_test(test_func):
+    def decorator(f):
+        @wraps(f)
+        @context(f)
+        def wrapper(context, *args, **kwargs):
+            if test_func(context.user):
+                return f(*args, **kwargs)
+            raise PermissionDenied("You do not have permission to perform this action")
+
+        return wrapper
+
+    return decorator
+
+
+# copied from https://github.com/flavors/django-graphql-jwt/blob/704f24e7ebbea0b81015ef3c1f4a302e9d432ecf/graphql_jwt/decorators.py  # noqa
+login_required = user_passes_test(lambda u: u.is_authenticated)
+
 project_user_required = user_passes_test(
     lambda u: u.is_authenticated and u.administered_projects
 )

events/schema.py

@@ -12,7 +12,6 @@
 from graphene_django import DjangoObjectType
 from graphene_django.filter import DjangoFilterConnectionField
 from graphene_file_upload.scalars import Upload
-from graphql_jwt.decorators import login_required
 from graphql_relay import from_global_id
 
 from children.models import Child
@@ -21,6 +20,7 @@
 from common.utils import (
     get_node_id_from_global_id,
     get_obj_if_user_can_administer,
+    login_required,
     project_user_required,
     update_object,
     update_object_with_translations,

kukkuu/consts.py

@@ -26,3 +26,6 @@
 SINGLE_EVENTS_DISALLOWED_ERROR = "SINGLE_EVENTS_DISALLOWED_ERROR"
 TICKET_SYSTEM_URL_MISSING_ERROR = "TICKET_SYSTEM_URL_MISSING_ERROR"
 NO_FREE_TICKET_SYSTEM_PASSWORDS_ERROR = "NO_FREE_TICKET_SYSTEM_PASSWORDS_ERROR"
+UNAUTHENTICATED_ERROR = "UNAUTHENTICATED_ERROR"
+AUTHENTICATION_ERROR = "AUTHENTICATION_ERROR"
+AUTHENTICATION_EXPIRED_ERROR = "AUTHENTICATION_EXPIRED_ERROR"

kukkuu/exceptions.py

@@ -91,3 +91,7 @@ class TicketSystemUrlMissingError(KukkuuGraphQLError):
 
 class NoFreeTicketSystemPasswordsError(KukkuuGraphQLError):
     """A free ticket system password is needed but there isn't any."""
+
+
+class AuthenticationExpiredError(KukkuuGraphQLError):
+    """Authentication expired."""

kukkuu/graphene.py

@@ -0,0 +1,26 @@
+from helusers.oidc import AuthenticationError
+from jose import ExpiredSignatureError
+
+from kukkuu.exceptions import AuthenticationExpiredError
+
+
+# pretty much copied from https://github.com/City-of-Helsinki/open-city-profile/blob/4f46f9f9f195c4254f79f5dfbd97d03b7fa87a5b/open_city_profile/graphene.py#L18  # noqa
+class JWTMiddleware:
+    def resolve(self, next, root, info, **kwargs):
+        request = info.context
+
+        auth_error = getattr(request, "auth_error", None)
+        if isinstance(auth_error, Exception):
+            # TODO with the current version of django-helusers (v0.7.0) there is no
+            # proper way to catch only expired token errors, so this kind of hax is
+            # needed for that. If/when helusers offers a way to do this properly
+            # this implementation should be changed.
+            if isinstance(auth_error, AuthenticationError) and isinstance(
+                auth_error.__context__, ExpiredSignatureError
+            ):
+                raise AuthenticationExpiredError(
+                    "Invalid Authorization header. JWT has expired."
+                ) from auth_error
+            raise auth_error
+
+        return next(root, info, **kwargs)

kukkuu/middleware.py

@@ -0,0 +1,20 @@
+from helusers.oidc import RequestJWTAuthentication
+
+
+# copied from https://github.com/City-of-Helsinki/open-city-profile/blob/4f46f9f9f195c4254f79f5dfbd97d03b7fa87a5b/open_city_profile/middleware.py#L6  # noqa
+class JWTAuthentication:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not request.user.is_authenticated:
+            try:
+                authenticator = RequestJWTAuthentication()
+                user_auth = authenticator.authenticate(request)
+                if user_auth is not None:
+                    request.user_auth = user_auth
+                    request.user = user_auth.user
+            except Exception as e:
+                request.auth_error = e
+
+        return self.get_response(request)

kukkuu/oidc.py

@@ -174,6 +174,7 @@
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "kukkuu.middleware.JWTAuthentication",
 ]
 
 TEMPLATES = [
@@ -199,7 +200,6 @@
 
 AUTHENTICATION_BACKENDS = [
     "django.contrib.auth.backends.ModelBackend",
-    "kukkuu.oidc.GraphQLApiTokenAuthentication",
     "guardian.backends.ObjectPermissionBackend",
 ]
 
@@ -226,7 +226,7 @@
 
 GRAPHENE = {
     "SCHEMA": "kukkuu.schema.schema",
-    "MIDDLEWARE": ["graphql_jwt.middleware.JSONWebTokenMiddleware"],
+    "MIDDLEWARE": ["kukkuu.graphene.JWTMiddleware"],
 }
 
 GRAPHQL_JWT = {"JWT_AUTH_HEADER_PREFIX": "Bearer"}