Python authentication.BasicAuthentication類代碼示例

    def test_check_active_false(self):
        auth = BasicAuthentication(require_active=False)
        request = HttpRequest()

        bob_doe = User.objects.get(username='bobdoe')
        create_api_key(User, instance=bob_doe, created=True)
        request.META['HTTP_AUTHORIZATION'] = 'ApiKey bobdoe:%s' % bob_doe.api_key.key
        self.assertTrue(auth.is_authenticated(request))

    def test_check_active_false(self):
        user_class = get_user_model()
        auth = BasicAuthentication(require_active=False)
        request = HttpRequest()

        bob_doe = user_class.objects.get(**{user_class.USERNAME_FIELD: 'bobdoe'})
        create_api_key(User, instance=bob_doe, created=True)
        request.META['HTTP_AUTHORIZATION'] = 'ApiKey bobdoe:%s' % bob_doe.api_key.key
        self.assertTrue(auth.is_authenticated(request))

    def test_check_active_true(self):
        auth = BasicAuthentication()
        request = HttpRequest()

        bob_doe = User.objects.get(username='bobdoe')
        bob_doe.set_password('pass')
        bob_doe.save()
        request.META['HTTP_AUTHORIZATION'] = 'Basic %s' % base64.b64encode('bobdoe:pass'.encode('utf-8')).decode('utf-8')
        auth_res = auth.is_authenticated(request)
        # is_authenticated() returns HttpUnauthorized for inactive users in Django >= 1.10, False for < 1.10
        self.assertTrue(auth_res is False or isinstance(auth_res, HttpUnauthorized))

    def test_is_authenticated(self):
        auth = BasicAuthentication()
        request = HttpRequest()

        # No HTTP Basic auth details should fail.
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # HttpUnauthorized with auth type and realm
        self.assertEqual(auth.is_authenticated(request)['WWW-Authenticate'], 'Basic Realm="django-tastypie"')

        # Wrong basic auth details.
        request.META['HTTP_AUTHORIZATION'] = 'abcdefg'
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # No password.
        request.META['HTTP_AUTHORIZATION'] = base64.b64encode('daniel')
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # Wrong user/password.
        request.META['HTTP_AUTHORIZATION'] = base64.b64encode('daniel:pass')
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # Correct user/password.
        john_doe = User.objects.get(username='johndoe')
        john_doe.set_password('pass')
        john_doe.save()
        request.META['HTTP_AUTHORIZATION'] = 'Basic %s' % base64.b64encode('johndoe:pass')
        self.assertEqual(auth.is_authenticated(request), True)

        # Regression: Password with colon.
        john_doe = User.objects.get(username='johndoe')
        john_doe.set_password('pass:word')
        john_doe.save()
        request.META['HTTP_AUTHORIZATION'] = 'Basic %s' % base64.b64encode('johndoe:pass:word')
        self.assertEqual(auth.is_authenticated(request), True)

def api_user_follow(request):
    if request.method == 'POST':
        basic_auth = BasicAuthentication()
        if basic_auth.is_authenticated(request):
            to_user_id = int(request.POST.get("to_user", 0))
            try:
                to_user = User.objects.get(id=to_user_id)
            except User.DoesNotExist:
                raise Http404
            from_user = request.user
            from_user.relationships.add(to_user)

            response_data={'status':'success'}
            return HttpResponse(simplejson.dumps(response_data), mimetype='application/json')
    raise Http404

    def test_whitelisting(self):
        auth = BasicAuthentication(whitelisted_methods=['a_method'])
        request = HttpRequest()

        # Calling with a whitelisted method_name without credentials should work
        self.assertEqual(auth.is_authenticated(request, method_name='a_method'), True)
        
        # Calling any other method should require auth
        self.assertEqual(isinstance(auth.is_authenticated(request, method_name='another_method'), HttpUnauthorized), True)

        # Correct user/password.
        john_doe = User.objects.get(username='johndoe')
        john_doe.set_password('pass')
        john_doe.save()
        request.META['HTTP_AUTHORIZATION'] = 'Basic %s' % base64.b64encode('johndoe:pass')
        self.assertEqual(auth.is_authenticated(request, method_name="another_method"), True)
        self.assertEqual(auth.is_authenticated(request, method_name="a_method"), True)

    def test_is_authenticated(self):
        auth = BasicAuthentication()
        request = HttpRequest()

        # No HTTP Basic auth details should fail.
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # HttpUnauthorized with auth type and realm
        self.assertEqual(auth.is_authenticated(request)["WWW-Authenticate"], 'Basic Realm="django-tastypie"')

        # Wrong basic auth details.
        request.META["HTTP_AUTHORIZATION"] = "abcdefg"
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # No password.
        request.META["HTTP_AUTHORIZATION"] = base64.b64encode("daniel")
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # Wrong user/password.
        request.META["HTTP_AUTHORIZATION"] = base64.b64encode("daniel:pass")
        self.assertEqual(isinstance(auth.is_authenticated(request), HttpUnauthorized), True)

        # Correct user/password.
        john_doe = User.objects.get(username="johndoe")
        john_doe.set_password("pass")
        john_doe.save()
        request.META["HTTP_AUTHORIZATION"] = "Basic %s" % base64.b64encode("johndoe:pass")
        self.assertEqual(auth.is_authenticated(request), True)

    def is_authenticated(self, request, **kwargs):  # noqa # too complex
        '''
        handles backends explicitly so that it can return False when
        credentials are given but wrong and return Anonymous User when
        credentials are not given or the session has expired (web use).
        '''
        auth_info = request.META.get('HTTP_AUTHORIZATION')

        if 'HTTP_AUTHORIZATION' not in request.META:
            if hasattr(request.user, 'allowed_tokens'):
                tokens = request.user.allowed_tokens
            session_auth = SessionAuthentication()
            check = session_auth.is_authenticated(request, **kwargs)
            if check:
                if isinstance(check, HttpUnauthorized):
                    session_auth_result = False
                else:
                    request._authentication_backend = session_auth
                    session_auth_result = check
            else:
                request.user = AnonymousUser()
                session_auth_result = True
            request.user.allowed_tokens = tokens
            return session_auth_result
        else:
            if auth_info.startswith('Basic'):
                basic_auth = BasicAuthentication()
                check = basic_auth.is_authenticated(request, **kwargs)
                if check:
                    if isinstance(check, HttpUnauthorized):
                        return False
                    else:
                        request._authentication_backend = basic_auth
                        return check
            if auth_info.startswith('ApiKey'):
                apikey_auth = ApiKeyAuthentication()
                check = apikey_auth.is_authenticated(request, **kwargs)
                if check:
                    if isinstance(check, HttpUnauthorized):
                        return False
                    else:
                        request._authentication_backend = apikey_auth
                        return check

def api_upload_photo(request):
    if request.method == 'POST':
        basic_auth = BasicAuthentication()
        if basic_auth.is_authenticated(request):
            photo = Photo(user=request.user, title=request.POST.get('title', None), file=request.FILES['file'])
            photo.save()

            at_users = request.POST.get('atusers', '').split(',')
            for user_id in at_users:
                try:
                    to_user = User.objects.get(id=int(user_id))
                    message = Message(from_user=request.user, to_user=to_user, description=get_photo_info(photo)).save()
                except Exception:
                    pass

            # TODO the api resource_uri need to dynamic
            response_data={"resource_uri": "/api/v1/photo/%d/" % (photo.id) , "file_url": photo.file.url}
            return HttpResponse(simplejson.dumps(response_data), mimetype='application/json')
    raise Http404

    def is_authenticated(self, request, **kwargs):
        '''
        handles backends explicitly so that it can return False when
        credentials are given but wrong and return Anonymous User when
        credentials are not given or the session has expired (web use).
        '''
        auth_info = request.META.get('HTTP_AUTHORIZATION')

        if 'HTTP_AUTHORIZATION' not in request.META:
            session_auth = SessionAuthentication()
            check = session_auth.is_authenticated(request, **kwargs)
            if check:
                if isinstance(check, HttpUnauthorized):
                    return(False)
                else:
                    request._authentication_backend = session_auth
                    return(check)
            else:
                request.user = AnonymousUser()
                return(True)
        else:
            if auth_info.startswith('Basic'):
                basic_auth = BasicAuthentication()
                check = basic_auth.is_authenticated(request, **kwargs)
                if check:
                    if isinstance(check, HttpUnauthorized):
                        return(False)
                    else:
                        request._authentication_backend = basic_auth
                        return(check)
            if auth_info.startswith('ApiKey'):
                apikey_auth = ApiKeyAuthentication()
                check = apikey_auth.is_authenticated(request, **kwargs)
                if check:
                    if isinstance(check, HttpUnauthorized):
                        return(False)
                    else:
                        request._authentication_backend = apikey_auth
                        return(check)

class Authentication(ApiKeyAuthentication):
    def __init__(self):
        self.api_key_auth = ApiKeyAuthentication()
        self.basic_auth = BasicAuthentication(backend=ApiKeyBackend())

    def is_authenticated(self, request, **kwargs):
        if request.user.is_authenticated():
            return True
        ret = self.basic_auth.is_authenticated(request, **kwargs)
        if isinstance(ret, HttpUnauthorized):
            ret2 = self.api_key_auth.is_authenticated(request, **kwargs)
            if not isinstance(ret2, HttpUnauthorized):
                return ret2
        return ret

    def get_identifier(self, request):
        if request.user.is_authenticated():
            return request.user.username
        ret = self.basic_auth.get_identifier(request)
        if isinstance(ret, HttpUnauthorized):
            ret2 = self.api_key_auth.get_identifier(request)
            if not isinstance(ret2, HttpUnauthorized):
                return ret2
        return ret

 def __init__(self):
     self.api_key_auth = ApiKeyAuthentication()
     self.basic_auth = BasicAuthentication(backend=ApiKeyBackend())