mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 19:56:48 +00:00
1c60696ea1
The REST API took only the login session, so a script could not use it without a browser. A user now makes API tokens on the profile page (API Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The token is shown once, on a page that is not cached, and then kept only as a SHA-512 digest; the list shows its name, first characters, creation and expiry, and a token is deleted there. Tools send it as "Authorization: Token wvc_...", and act as its user, with that user's permissions. Making and deleting a token is logged, without the token. A password alone (HTTP Basic) still does not reach the API, as it would skip the OTP second factor: a token is made in a session that passed the login and its OTP. The token class comes first, so a refused request gets 401 with its challenge instead of 403. django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the template.
59 lines
2 KiB
Python
59 lines
2 KiB
Python
from django.conf import settings
|
|
from django.contrib.auth.views import LoginView, LogoutView
|
|
from django.urls import path
|
|
|
|
from . import views
|
|
from .forms import LoginForm
|
|
from .otp import SingleDeviceOTPForm
|
|
|
|
app_name = "accounts"
|
|
|
|
urlpatterns = [
|
|
path("logout/", LogoutView.as_view(template_name="logout.html"), name="logout"),
|
|
path("profile/", views.profile, name="profile"),
|
|
path("profile/<int:user_id>/", views.account, name="account"),
|
|
path("change_password/", views.change_password, name="change_password"),
|
|
path(
|
|
"user_instance/create/<int:user_id>/",
|
|
views.user_instance_create,
|
|
name="user_instance_create",
|
|
),
|
|
path(
|
|
"user_instance/<int:pk>/update/",
|
|
views.user_instance_update,
|
|
name="user_instance_update",
|
|
),
|
|
path(
|
|
"user_instance/<int:pk>/delete/",
|
|
views.user_instance_delete,
|
|
name="user_instance_delete",
|
|
),
|
|
path("ssh_key/create/", views.ssh_key_create, name="ssh_key_create"),
|
|
path("ssh_key/<int:pk>/delete/", views.ssh_key_delete, name="ssh_key_delete"),
|
|
path("api_token/create/", views.api_token_create, name="api_token_create"),
|
|
path("api_token/<str:token_key>/delete/", views.api_token_delete, name="api_token_delete"),
|
|
path("email_otp/", views.email_otp, name="email_otp"),
|
|
path(
|
|
"admin_email_otp/<int:user_id>/",
|
|
views.admin_email_otp,
|
|
name="admin_email_otp",
|
|
),
|
|
]
|
|
|
|
if settings.OTP_ENABLED:
|
|
urlpatterns += [
|
|
path(
|
|
"login/",
|
|
LoginView.as_view(
|
|
template_name="accounts/otp_login.html",
|
|
authentication_form=SingleDeviceOTPForm,
|
|
redirect_authenticated_user=True,
|
|
),
|
|
name="login",
|
|
),
|
|
]
|
|
else:
|
|
urlpatterns += (
|
|
path("login/", LoginView.as_view(template_name="login.html", authentication_form=LoginForm,
|
|
redirect_authenticated_user=True), name="login"),
|
|
)
|