mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-10 20:26:48 +00:00
1c60696ea1
The REST API took only the login session, so a script could not use it without a browser. A user now makes API tokens on the profile page (API Tokens tab): a name, and an expiry of 30, 90 or 365 days or none. The token is shown once, on a page that is not cached, and then kept only as a SHA-512 digest; the list shows its name, first characters, creation and expiry, and a token is deleted there. Tools send it as "Authorization: Token wvc_...", and act as its user, with that user's permissions. Making and deleting a token is logged, without the token. A password alone (HTTP Basic) still does not reach the API, as it would skip the OTP second factor: a token is made in a session that passed the login and its OTP. The token class comes first, so a refused request gets 401 with its challenge instead of 403. django-rest-knox 5.1.0 provides the tokens (accounts.ApiToken adds the name); settings.py takes "knox", KNOX_TOKEN_MODEL and REST_KNOX from the template.
26 lines
644 B
Text
26 lines
644 B
Text
Django==5.2.18
|
|
django_bootstrap5==26.3
|
|
django-bootstrap-icons==0.9.0
|
|
django-otp==1.7.4
|
|
# for django-bootstrap-icons and websockify; a host's python3-requests would
|
|
# otherwise bring idna, requests and urllib3 with advisories
|
|
idna>=3.15
|
|
requests>=2.33.0
|
|
urllib3>=2.8.0
|
|
django-axes==8.3.1
|
|
djangorestframework==3.18.3
|
|
django-rest-knox==5.1.0
|
|
drf-nested-routers==0.95.3
|
|
drf-spectacular[sidecar]==0.30.0
|
|
gunicorn==26.2.0
|
|
libvirt-python>=9.0.0
|
|
lxml>=6.1
|
|
openpyxl==3.1.5
|
|
paramiko==5.0.0
|
|
psycopg[binary]==3.3.6
|
|
python-engineio==4.14.0
|
|
python-socketio==5.17.0
|
|
segno==1.6.6
|
|
websockify==0.13.0
|
|
whitenoise==6.12.0
|
|
crypt-r>=3.13.0; python_version >= "3.13"
|