* the endpoint will receive "type" (expires|onetime)
and "expires" (positive integer representing seconds)
* type will define the expiray method for the token;
onetime: the token expires as soon as it's used, or
after "expires" seconds if not used
expires: the token can be used multiple times until
it expires according to the "expires" param value
* login_jwt endpoint for generating the JWT token for
subscribers has been enhanced to accept the "token"
param, containing the token generated using the
/api/authtokens endpoint
* admin_login_jwt endpoint for generating the JWT token
for admins has been enhanced to accept the "token"
param, containing the token generated using the
/api/authtokens endpoint
* login_jwt and amin_login_jwt will respond with 403
"Forbidden" if the token role stored in Redis does
not match the role of the user that generated it
* /api/authtokens is hidden from documentation for now
Change-Id: I4eb76c2b08f2e24774fa84ba0ccf7412ce8670e8
(cherry picked from commit 9b422ddabf)
mr9.5.4
Flaviu Mates
4 years ago
committed by
Kirill Solomko
parent
944823b780
commit
db8f0feff6
@ -0,0 +1,74 @@
|
|||||||
|
package NGCP::Panel::Controller::API::AuthTokens;
|
||||||
|
|
||||||
|
use Sipwise::Base;
|
||||||
|
|
||||||
|
use Data::HAL qw();
|
||||||
|
use Data::HAL::Link qw();
|
||||||
|
use File::Basename;
|
||||||
|
use File::Find::Rule;
|
||||||
|
use HTTP::Headers qw();
|
||||||
|
use HTTP::Status qw(:constants);
|
||||||
|
|
||||||
|
|
||||||
|
sub allowed_methods{
|
||||||
|
return [qw/POST OPTIONS/];
|
||||||
|
}
|
||||||
|
|
||||||
|
use parent qw/NGCP::Panel::Role::Entities NGCP::Panel::Role::API::AuthTokens/;
|
||||||
|
|
||||||
|
sub api_description {
|
||||||
|
return '';
|
||||||
|
};
|
||||||
|
|
||||||
|
sub query_params {
|
||||||
|
return [
|
||||||
|
];
|
||||||
|
}
|
||||||
|
|
||||||
|
sub resource_name{
|
||||||
|
return 'authtokens';
|
||||||
|
}
|
||||||
|
|
||||||
|
sub dispatch_path{
|
||||||
|
return '/api/authtokens/';
|
||||||
|
}
|
||||||
|
|
||||||
|
sub relation{
|
||||||
|
return 'http://purl.org/sipwise/ngcp-api/#rel-authtokens';
|
||||||
|
}
|
||||||
|
|
||||||
|
__PACKAGE__->set_config({
|
||||||
|
allowed_roles => [qw/admin reseller ccare ccareadmin subscriber subscriberadmin/],
|
||||||
|
});
|
||||||
|
|
||||||
|
sub POST :Allow {
|
||||||
|
my ($self, $c) = @_;
|
||||||
|
|
||||||
|
my $resource = $self->get_valid_post_data(
|
||||||
|
c => $c,
|
||||||
|
media_type => 'application/json',
|
||||||
|
);
|
||||||
|
return unless $resource;
|
||||||
|
|
||||||
|
my $form = $self->get_form($c);
|
||||||
|
return unless $self->validate_form(
|
||||||
|
c => $c,
|
||||||
|
resource => $resource,
|
||||||
|
form => $form,
|
||||||
|
);
|
||||||
|
if($c->user->roles eq "reseller") {
|
||||||
|
$resource->{reseller_id} = $c->user->reseller_id;
|
||||||
|
}
|
||||||
|
|
||||||
|
my $res = {};
|
||||||
|
|
||||||
|
$res->{token} = $self->generate_auth_token($c, $resource);
|
||||||
|
|
||||||
|
$c->response->status(HTTP_CREATED);
|
||||||
|
$c->response->body(JSON::to_json($res));
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
|
|
||||||
|
# vim: set tabstop=4 expandtab:
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
package NGCP::Panel::Form::AuthToken;
|
||||||
|
|
||||||
|
use HTML::FormHandler::Moose;
|
||||||
|
use NGCP::Panel::Utils::Form;
|
||||||
|
extends 'HTML::FormHandler';
|
||||||
|
|
||||||
|
has_field 'type' => (
|
||||||
|
type => 'Select',
|
||||||
|
options => [
|
||||||
|
{ label => 'Onetime', value => 'onetime' },
|
||||||
|
{ label => 'Expires', value => 'expires' },
|
||||||
|
],
|
||||||
|
label => 'Type',
|
||||||
|
required => 1,
|
||||||
|
);
|
||||||
|
|
||||||
|
has_field 'expires' => (
|
||||||
|
type => '+NGCP::Panel::Field::PosInteger',
|
||||||
|
required => 1,
|
||||||
|
label => 'Expires',
|
||||||
|
);
|
||||||
|
|
||||||
|
has_block 'fields' => (
|
||||||
|
tag => 'div',
|
||||||
|
class => [qw/modal-body/],
|
||||||
|
render_list => [qw/type expires/],
|
||||||
|
);
|
||||||
|
|
||||||
|
1;
|
||||||
@ -0,0 +1,35 @@
|
|||||||
|
package NGCP::Panel::Role::API::AuthTokens;
|
||||||
|
|
||||||
|
use Sipwise::Base;
|
||||||
|
use NGCP::Panel::Utils::Redis;
|
||||||
|
|
||||||
|
use parent 'NGCP::Panel::Role::API';
|
||||||
|
|
||||||
|
use Redis;
|
||||||
|
use UUID;
|
||||||
|
|
||||||
|
sub get_form {
|
||||||
|
my ($self, $c) = @_;
|
||||||
|
return NGCP::Panel::Form::get("NGCP::Panel::Form::AuthToken", $c);
|
||||||
|
}
|
||||||
|
|
||||||
|
sub generate_auth_token {
|
||||||
|
my ($self, $c, $resource) = @_;
|
||||||
|
|
||||||
|
my ($uuid_bin, $uuid_string);
|
||||||
|
UUID::generate($uuid_bin);
|
||||||
|
UUID::unparse($uuid_bin, $uuid_string);
|
||||||
|
#remove '-' from the token
|
||||||
|
$uuid_string =~ s/\-//g;
|
||||||
|
my $redis = NGCP::Panel::Utils::Redis::get_redis_connection($c, {database => $c->config->{'Plugin::Session'}->{redis_db}});
|
||||||
|
return unless $redis;
|
||||||
|
$redis->hset("auth_token:$uuid_string", 'type', $resource->{type});
|
||||||
|
$redis->hset("auth_token:$uuid_string", 'role', $c->user->roles);
|
||||||
|
$redis->hset("auth_token:$uuid_string", 'user_id', $c->user->id);
|
||||||
|
$redis->expire("auth_token:$uuid_string", $resource->{expires});
|
||||||
|
|
||||||
|
return $uuid_string;
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
|
# vim: set tabstop=4 expandtab:
|
||||||
@ -0,0 +1,23 @@
|
|||||||
|
package NGCP::Panel::Utils::Redis;
|
||||||
|
|
||||||
|
use warnings;
|
||||||
|
use strict;
|
||||||
|
|
||||||
|
use Redis;
|
||||||
|
|
||||||
|
sub get_redis_connection {
|
||||||
|
my ($c, $params) = @_;
|
||||||
|
my $redis = Redis->new(
|
||||||
|
server => $c->config->{redis}->{central_url},
|
||||||
|
reconnect => 10, every => 500000, # 500ms
|
||||||
|
cnx_timeout => 3,
|
||||||
|
);
|
||||||
|
unless ($redis) {
|
||||||
|
$c->log->error("Failed to connect to central redis url " . $c->config->{redis}->{central_url});
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
$redis->select($params->{database});
|
||||||
|
return $redis;
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
Loading…
Reference in new issue