Build Pigway Frame Flow with bilingual UI, complete KoKonna driver and safe automation

pigway_frame_flow/core/auth.py

@@ -0,0 +1,64 @@
+import hashlib
+import hmac
+import json
+
+from fastapi import Request, Security
+from fastapi.security import HTTPBearer
+
+from pigway_frame_flow.errors import ErrorCode as E
+from pigway_frame_flow.errors import FlowError
+from pigway_frame_flow.storage.database import encode, now_iso
+
+bearer = HTTPBearer(auto_error=False)
+ALL_SCOPES = [
+    "devices:read",
+    "images:read",
+    "images:delete",
+    "display:write",
+    "templates:read",
+    "render:write",
+    "jobs:read",
+    "jobs:write",
+    "history:read",
+    "settings:write",
+    "admin",
+]
+
+
+def seed_client(db, token):
+    if token:
+        digest = hashlib.sha256(token.encode()).hexdigest()
+        db.execute(
+            "INSERT INTO clients VALUES(?,?,?,?,?,?,?) ON CONFLICT(client_id) DO UPDATE SET token_hash=excluded.token_hash, enabled=1",
+            ("admin", digest, "Administrator", encode(ALL_SCOPES), now_iso(), None, 1),
+        )
+    else:
+        db.execute("UPDATE clients SET enabled=0 WHERE client_id='admin'")
+
+
+def require(scope):
+    def authorize(request: Request, credentials=Security(bearer)):
+        db = request.app.state.service.db
+        if not credentials:
+            raise FlowError(E.UNAUTHORIZED, "Frame Flow API token required", 401)
+        digest = hashlib.sha256(credentials.credentials.encode()).hexdigest()
+        for row in db.all("SELECT * FROM clients WHERE enabled=1"):
+            if hmac.compare_digest(digest, row["token_hash"]):
+                permissions = json.loads(row["permissions"])
+                if scope not in permissions and "admin" not in permissions:
+                    raise FlowError(
+                        E.FORBIDDEN, "Token scope does not allow this action", 403
+                    )
+                request.state.client_id = row["client_id"]
+                # Avoid writing last_used on every image or poll.
+                if not row["last_used_at"] or (
+                    now_iso()[:16] != row["last_used_at"][:16]
+                ):
+                    db.execute(
+                        "UPDATE clients SET last_used_at=? WHERE client_id=?",
+                        (now_iso(), row["client_id"]),
+                    )
+                return row["client_id"]
+        raise FlowError(E.UNAUTHORIZED, "Invalid Frame Flow API token", 401)
+
+    return authorize