Merge pull request #485 from alphagov/api_user-cleanup

Api user cleanup

app/__init__.py

@@ -47,7 +47,6 @@ def create_app(app_name=None):
     init_app(application)
     db.init_app(application)
     ma.init_app(application)
-    init_app(application)
     logging.init_app(application)
     statsd_client.init_app(application)
     firetext_client.init_app(application, statsd_client=statsd_client)

app/authentication/auth.py

@@ -1,72 +1,69 @@
 from flask import request, jsonify, _request_ctx_stack, current_app
 from notifications_python_client.authentication import decode_jwt_token, get_token_issuer
 from notifications_python_client.errors import TokenDecodeError, TokenExpiredError
-from werkzeug.exceptions import abort
-from app.dao.api_key_dao import get_unsigned_secrets
-from app import api_user
-from functools import wraps
+
+from app.dao.api_key_dao import get_model_api_keys
 
 
-def authentication_response(message, code):
-    return jsonify(result='error',
-                   message={"token": [message]}
-                   ), code
+class AuthError(Exception):
+    def __init__(self, message, code):
+        self.message = {"token": [message]}
+        self.code = code
 
 
-def requires_auth():
-    auth_header = request.headers.get('Authorization', None)
+def get_auth_token(req):
+    auth_header = req.headers.get('Authorization', None)
     if not auth_header:
-        return authentication_response('Unauthorized, authentication token must be provided', 401)
+        raise AuthError('Unauthorized, authentication token must be provided', 401)
 
     auth_scheme = auth_header[:7]
 
     if auth_scheme != 'Bearer ':
-        return authentication_response('Unauthorized, authentication bearer scheme must be used', 401)
+        raise AuthError('Unauthorized, authentication bearer scheme must be used', 401)
 
-    auth_token = auth_header[7:]
+    return auth_header[7:]
+
+
+def requires_auth():
+    auth_token = get_auth_token(request)
     try:
-        api_client = fetch_client(get_token_issuer(auth_token))
+        client = get_token_issuer(auth_token)
     except TokenDecodeError:
-        return authentication_response("Invalid token: signature", 403)
+        raise AuthError("Invalid token: signature", 403)
 
-    for secret in api_client['secret']:
-        try:
-            decode_jwt_token(
-                auth_token,
-                secret
-            )
-            _request_ctx_stack.top.api_user = api_client
-            return
-        except TokenExpiredError:
-            errors_resp = authentication_response("Invalid token: expired", 403)
-        except TokenDecodeError:
-            errors_resp = authentication_response("Invalid token: signature", 403)
-
-    if not api_client['secret']:
-        errors_resp = authentication_response("Invalid token: no api keys for service", 403)
-    current_app.logger.info(errors_resp)
-    return errors_resp
-
-
-def fetch_client(client):
     if client == current_app.config.get('ADMIN_CLIENT_USER_NAME'):
-        return {
-            "client": client,
-            "secret": [current_app.config.get('ADMIN_CLIENT_SECRET')]
-        }
+        return handle_admin_key(auth_token, current_app.config.get('ADMIN_CLIENT_SECRET'))
+
+    api_keys = get_model_api_keys(client)
+
+    for api_key in api_keys:
+        try:
+            get_decode_errors(auth_token, api_key.unsigned_secret)
+        except TokenDecodeError:
+            continue
+
+        if api_key.expiry_date:
+            raise AuthError("Invalid token: revoked", 403)
+
+        _request_ctx_stack.top.api_user = api_key
+        return
+
+    if not api_keys:
+        raise AuthError("Invalid token: no api keys for service", 403)
     else:
-        return {
-            "client": client,
-            "secret": get_unsigned_secrets(client)
-        }
+        raise AuthError("Invalid token: signature", 403)
 
 
-def require_admin():
-    def wrap(func):
-        @wraps(func)
-        def wrap_func(*args, **kwargs):
-            if not api_user['client'] == current_app.config.get('ADMIN_CLIENT_USER_NAME'):
-                abort(403)
-            return func(*args, **kwargs)
-        return wrap_func
-    return wrap
+def handle_admin_key(auth_token, secret):
+    try:
+        get_decode_errors(auth_token, secret)
+        return
+    except TokenDecodeError as e:
+        raise AuthError("Invalid token: signature", 403)
+
+
+def get_decode_errors(auth_token, unsigned_secret):
+    try:
+        decode_jwt_token(auth_token, unsigned_secret)
+    except TokenExpiredError as e:
+        raise AuthError("Invalid token: expired")

app/authentication/utils.py

@@ -0,0 +1,12 @@
+from flask import current_app
+from itsdangerous import URLSafeSerializer
+
+
+def get_secret(secret):
+    serializer = URLSafeSerializer(current_app.config.get('SECRET_KEY'))
+    return serializer.loads(secret, salt=current_app.config.get('DANGEROUS_SALT'))
+
+
+def generate_secret(token):
+    serializer = URLSafeSerializer(current_app.config.get('SECRET_KEY'))
+    return serializer.dumps(str(token), current_app.config.get('DANGEROUS_SALT'))

app/dao/api_key_dao.py

@@ -1,9 +1,6 @@
 import uuid
 from datetime import datetime
 
-from flask import current_app
-from itsdangerous import URLSafeSerializer
-
 from app import db
 from app.models import ApiKey
 
@@ -11,6 +8,7 @@ from app.dao.dao_utils import (
     transactional,
     version_class
 )
+from app.authentication.utils import generate_secret
 
 
 @transactional
@@ -18,7 +16,7 @@ from app.dao.dao_utils import (
 def save_model_api_key(api_key):
     if not api_key.id:
         api_key.id = uuid.uuid4()  # must be set now so version history model can use same id
-    api_key.secret = _generate_secret()
+    api_key.secret = generate_secret(uuid.uuid4())
     db.session.add(api_key)
 
 
@@ -41,7 +39,7 @@ def get_unsigned_secrets(service_id):
     This method can only be exposed to the Authentication of the api calls.
     """
     api_keys = ApiKey.query.filter_by(service_id=service_id, expiry_date=None).all()
-    keys = [_get_secret(x.secret) for x in api_keys]
+    keys = [x.unsigned_secret for x in api_keys]
     return keys
 
 
@@ -50,15 +48,4 @@ def get_unsigned_secret(key_id):
     This method can only be exposed to the Authentication of the api calls.
     """
     api_key = ApiKey.query.filter_by(id=key_id, expiry_date=None).one()
-    return _get_secret(api_key.secret)
-
-
-def _generate_secret():
-    token = uuid.uuid4()
-    serializer = URLSafeSerializer(current_app.config.get('SECRET_KEY'))
-    return serializer.dumps(str(token), current_app.config.get('DANGEROUS_SALT'))
-
-
-def _get_secret(signed_secret):
-    serializer = URLSafeSerializer(current_app.config.get('SECRET_KEY'))
-    return serializer.loads(signed_secret, salt=current_app.config.get('DANGEROUS_SALT'))
+    return api_key.unsigned_secret

app/errors.py

@@ -5,6 +5,7 @@ from flask import (
 from sqlalchemy.exc import SQLAlchemyError, DataError
 from sqlalchemy.orm.exc import NoResultFound
 from marshmallow import ValidationError
+from app.authentication.auth import AuthError
 
 
 class InvalidRequest(Exception):
@@ -23,6 +24,10 @@ class InvalidRequest(Exception):
 
 def register_errors(blueprint):
 
+    @blueprint.app_errorhandler(AuthError)
+    def authentication_error(error):
+        return jsonify(result='error', message=error.message), error.code
+
     @blueprint.app_errorhandler(ValidationError)
     def validation_error(error):
         current_app.logger.error(error)

app/job/rest.py

@@ -1,7 +1,8 @@
 from flask import (
     Blueprint,
     jsonify,
-    request
+    request,
+    current_app
 )
 
 from app.dao.jobs_dao import (
@@ -15,11 +16,14 @@ from app.dao.services_dao import (
 )
 
 from app.dao.templates_dao import (dao_get_template_by_id)
+from app.dao.notifications_dao import get_notifications_for_job
 
-from app.schemas import job_schema, unarchived_template_schema
+from app.schemas import job_schema, unarchived_template_schema, notifications_filter_schema, notification_status_schema
 
 from app.celery.tasks import process_job
 
+from app.utils import pagination_links
+
 job = Blueprint('job', __name__, url_prefix='/service/<uuid:service_id>/job')
 
 from app.errors import (
@@ -37,6 +41,33 @@ def get_job_by_service_and_job_id(service_id, job_id):
     return jsonify(data=data)
 
 
+@job.route('/<job_id>/notifications', methods=['GET'])
+def get_all_notifications_for_service_job(service_id, job_id):
+    data = notifications_filter_schema.load(request.args).data
+    page = data['page'] if 'page' in data else 1
+    page_size = data['page_size'] if 'page_size' in data else current_app.config.get('PAGE_SIZE')
+
+    pagination = get_notifications_for_job(
+        service_id,
+        job_id,
+        filter_dict=data,
+        page=page,
+        page_size=page_size)
+    kwargs = request.args.to_dict()
+    kwargs['service_id'] = service_id
+    kwargs['job_id'] = job_id
+    return jsonify(
+        notifications=notification_status_schema.dump(pagination.items, many=True).data,
+        page_size=page_size,
+        total=pagination.total,
+        links=pagination_links(
+            pagination,
+            '.get_all_notifications_for_service_job',
+            **kwargs
+        )
+    ), 200
+
+
 @job.route('', methods=['GET'])
 def get_jobs_by_service(service_id):
     if request.args.get('limit_days'):

app/models.py

@@ -5,14 +5,13 @@ from sqlalchemy.dialects.postgresql import (
     UUID,
     JSON
 )
-
 from sqlalchemy import UniqueConstraint
 
 from app.encryption import (
     hashpw,
     check_hash
 )
-
+from app.authentication.utils import get_secret
 from app import (
     db,
     encryption
@@ -135,6 +134,10 @@ class ApiKey(db.Model, Versioned):
         UniqueConstraint('service_id', 'name', name='uix_service_to_key_name'),
     )
 
+    @property
+    def unsigned_secret(self):
+        return get_secret(self.secret)
+
 
 KEY_TYPE_NORMAL = 'normal'
 KEY_TYPE_TEAM = 'team'

app/notifications/rest.py

@@ -5,14 +5,12 @@ from flask import (
     jsonify,
     request,
     current_app,
-    url_for,
     json
 )
 from notifications_utils.recipients import allowed_to_send_to, first_column_heading
 from notifications_utils.template import Template
 from app.clients.email.aws_ses import get_aws_responses
 from app import api_user, encryption, create_uuid, DATETIME_FORMAT, DATE_FORMAT, statsd_client
-from app.authentication.auth import require_admin
 from app.dao import (
     templates_dao,
     services_dao,
@@ -33,6 +31,7 @@ from app.schemas import (
     unarchived_template_schema
 )
 from app.celery.tasks import send_sms, send_email
+from app.utils import pagination_links
 
 notifications = Blueprint('notifications', __name__)
 
@@ -171,7 +170,7 @@ def process_firetext_response():
 
 @notifications.route('/notifications/<uuid:notification_id>', methods=['GET'])
 def get_notifications(notification_id):
-    notification = notifications_dao.get_notification(api_user['client'], notification_id)
+    notification = notifications_dao.get_notification(str(api_user.service_id), notification_id)
     return jsonify(data={"notification": notification_status_schema.dump(notification).data}), 200
 
 
@@ -183,7 +182,7 @@ def get_all_notifications():
     limit_days = data.get('limit_days')
 
     pagination = notifications_dao.get_notifications_for_service(
-        api_user['client'],
+        str(api_user.service_id),
         filter_dict=data,
         page=page,
         page_size=page_size,
@@ -200,81 +199,13 @@ def get_all_notifications():
     ), 200
 
 
-@notifications.route('/service/<service_id>/notifications', methods=['GET'])
-@require_admin()
-def get_all_notifications_for_service(service_id):
-    data = notifications_filter_schema.load(request.args).data
-    page = data['page'] if 'page' in data else 1
-    page_size = data['page_size'] if 'page_size' in data else current_app.config.get('PAGE_SIZE')
-    limit_days = data.get('limit_days')
-
-    pagination = notifications_dao.get_notifications_for_service(
-        service_id,
-        filter_dict=data,
-        page=page,
-        page_size=page_size,
-        limit_days=limit_days)
-    kwargs = request.args.to_dict()
-    kwargs['service_id'] = service_id
-    return jsonify(
-        notifications=notification_status_schema.dump(pagination.items, many=True).data,
-        page_size=page_size,
-        total=pagination.total,
-        links=pagination_links(
-            pagination,
-            '.get_all_notifications_for_service',
-            **kwargs
-        )
-    ), 200
-
-
-@notifications.route('/service/<service_id>/job/<job_id>/notifications', methods=['GET'])
-@require_admin()
-def get_all_notifications_for_service_job(service_id, job_id):
-    data = notifications_filter_schema.load(request.args).data
-    page = data['page'] if 'page' in data else 1
-    page_size = data['page_size'] if 'page_size' in data else current_app.config.get('PAGE_SIZE')
-
-    pagination = notifications_dao.get_notifications_for_job(
-        service_id,
-        job_id,
-        filter_dict=data,
-        page=page,
-        page_size=page_size)
-    kwargs = request.args.to_dict()
-    kwargs['service_id'] = service_id
-    kwargs['job_id'] = job_id
-    return jsonify(
-        notifications=notification_status_schema.dump(pagination.items, many=True).data,
-        page_size=page_size,
-        total=pagination.total,
-        links=pagination_links(
-            pagination,
-            '.get_all_notifications_for_service_job',
-            **kwargs
-        )
-    ), 200
-
-
-def pagination_links(pagination, endpoint, **kwargs):
-    if 'page' in kwargs:
-        kwargs.pop('page', None)
-    links = dict()
-    if pagination.has_prev:
-        links['prev'] = url_for(endpoint, page=pagination.prev_num, **kwargs)
-    if pagination.has_next:
-        links['next'] = url_for(endpoint, page=pagination.next_num, **kwargs)
-        links['last'] = url_for(endpoint, page=pagination.pages, **kwargs)
-    return links
-
-
 @notifications.route('/notifications/<string:notification_type>', methods=['POST'])
 def send_notification(notification_type):
     if notification_type not in ['sms', 'email']:
         assert False
 
-    service_id = api_user['client']
-    service = services_dao.dao_fetch_service_by_id(api_user['client'])
+    service_id = str(api_user.service_id)
+    service = services_dao.dao_fetch_service_by_id(service_id)
 
     service_stats = notifications_dao.dao_get_notification_statistics_for_service_and_day(
         service_id,

app/service/rest.py

@@ -1,14 +1,11 @@
-from datetime import (
-    datetime,
-    date
-)
+from datetime import date
 
 from flask import (
     jsonify,
     request,
-    Blueprint
+    Blueprint,
+    current_app
 )
-
 from sqlalchemy.orm.exc import NoResultFound
 
 from app.dao.api_key_dao import (
@@ -26,19 +23,19 @@ from app.dao.services_dao import (
     dao_add_user_to_service,
     dao_remove_user_from_service
 )
-
+from app.dao import notifications_dao
 from app.dao.provider_statistics_dao import get_fragment_count
-
 from app.dao.users_dao import get_model_users
-
 from app.schemas import (
     service_schema,
     api_key_schema,
     user_schema,
     from_to_date_schema,
-    permission_schema
+    permission_schema,
+    notification_status_schema,
+    notifications_filter_schema,
 )
-
+from app.utils import pagination_links
 from app.errors import (
     register_errors,
     InvalidRequest
@@ -208,3 +205,30 @@ def get_service_history(service_id):
         'events': events_data}
 
     return jsonify(data=data)
+
+
+@service.route('/<uuid:service_id>/notifications', methods=['GET'])
+def get_all_notifications_for_service(service_id):
+    data = notifications_filter_schema.load(request.args).data
+    page = data['page'] if 'page' in data else 1
+    page_size = data['page_size'] if 'page_size' in data else current_app.config.get('PAGE_SIZE')
+    limit_days = data.get('limit_days')
+
+    pagination = notifications_dao.get_notifications_for_service(
+        service_id,
+        filter_dict=data,
+        page=page,
+        page_size=page_size,
+        limit_days=limit_days)
+    kwargs = request.args.to_dict()
+    kwargs['service_id'] = service_id
+    return jsonify(
+        notifications=notification_status_schema.dump(pagination.items, many=True).data,
+        page_size=page_size,
+        total=pagination.total,
+        links=pagination_links(
+            pagination,
+            '.get_all_notifications_for_service',
+            **kwargs
+        )
+    ), 200

app/utils.py

@@ -0,0 +1,13 @@
+from flask import url_for
+
+
+def pagination_links(pagination, endpoint, **kwargs):
+    if 'page' in kwargs:
+        kwargs.pop('page', None)
+    links = dict()
+    if pagination.has_prev:
+        links['prev'] = url_for(endpoint, page=pagination.prev_num, **kwargs)
+    if pagination.has_next:
+        links['next'] = url_for(endpoint, page=pagination.next_num, **kwargs)
+        links['last'] = url_for(endpoint, page=pagination.pages, **kwargs)
+    return links