580d7f0e0d
Base login now requests only openid/email/profile (non-sensitive), so a new user gets a clean Google consent with no "unverified app" warning and no 7-day refresh token expiry. YouTube read (youtube.readonly) and write (youtube) are granted later by the onboarding wizard via a parameterized /auth/upgrade?access=read|write. Security fixes folded in from the baseline audit: - config: refuse to boot in production (https OAUTH_REDIRECT_URL) with the placeholder/short SECRET_KEY or a missing TOKEN_ENCRYPTION_KEY, closing a session-forgery / admin-impersonation hole. - main: mark the session cookie Secure when served over HTTPS. - me: expose can_read; sync/subscriptions returns a friendly 403 (not a 500) until YouTube read access is granted.
241 lines
9 KiB
Python
241 lines
9 KiB
Python
import logging
|
|
import re
|
|
from datetime import datetime, timezone
|
|
|
|
from authlib.integrations.starlette_client import OAuth, OAuthError
|
|
from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Request
|
|
from fastapi.responses import JSONResponse, RedirectResponse
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app import email as email_mod
|
|
from app.config import settings
|
|
from app.db import get_db
|
|
from app.models import Invite, OAuthToken, User
|
|
from app.security import encrypt
|
|
|
|
_EMAIL_RE = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
|
|
|
|
# Base sign-in requests only the non-sensitive OpenID scopes (profile/email). These do
|
|
# NOT trigger Google's "unverified app" warning and do NOT expire after 7 days, so a new
|
|
# user gets a clean, familiar consent. YouTube access is granted later, one step at a
|
|
# time, by the onboarding wizard via /auth/upgrade (incremental authorization):
|
|
# - read -> youtube.readonly (read subscriptions, build the feed)
|
|
# - write -> youtube (full: unsubscribe / playlist export)
|
|
# Both YouTube scopes are "sensitive"; the wizard explains the Google warning before
|
|
# sending the user there, so the extra permission never feels like a surprise.
|
|
WRITE_SCOPE = "https://www.googleapis.com/auth/youtube"
|
|
READ_SCOPE = f"{WRITE_SCOPE}.readonly"
|
|
BASE_SCOPES = "openid email profile"
|
|
READ_SCOPES = f"{BASE_SCOPES} {READ_SCOPE}"
|
|
WRITE_SCOPES = f"{BASE_SCOPES} {READ_SCOPE} {WRITE_SCOPE}"
|
|
|
|
log = logging.getLogger("subfeed.auth")
|
|
|
|
router = APIRouter(prefix="/auth", tags=["auth"])
|
|
|
|
oauth = OAuth()
|
|
oauth.register(
|
|
name="google",
|
|
client_id=settings.google_client_id,
|
|
client_secret=settings.google_client_secret,
|
|
server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
|
|
client_kwargs={"scope": BASE_SCOPES},
|
|
)
|
|
|
|
|
|
def has_read_scope(user: User) -> bool:
|
|
"""Whether the user's stored grant lets us read their YouTube data (build the feed).
|
|
The full write scope is a superset, so it implies read."""
|
|
tok = user.token
|
|
if tok is None or not tok.scopes:
|
|
return False
|
|
granted = tok.scopes.split()
|
|
return READ_SCOPE in granted or WRITE_SCOPE in granted
|
|
|
|
|
|
def has_write_scope(user: User) -> bool:
|
|
"""Whether the user's stored grant includes YouTube write (unsubscribe / export)."""
|
|
tok = user.token
|
|
if tok is None or not tok.scopes:
|
|
return False
|
|
return WRITE_SCOPE in tok.scopes.split()
|
|
|
|
|
|
def is_allowed(db: Session, email: str) -> bool:
|
|
"""May this email sign in? An approved Invite is the source of truth; the env
|
|
ALLOWED_EMAILS/ADMIN_EMAILS remain a bootstrap fallback (e.g. a fresh DB)."""
|
|
if not email:
|
|
return False
|
|
email = email.lower()
|
|
inv = db.execute(select(Invite).where(Invite.email == email)).scalar_one_or_none()
|
|
if inv is not None:
|
|
return inv.status == "approved"
|
|
return email in settings.allowed_email_set or email in settings.admin_email_set
|
|
|
|
|
|
def upsert_pending_invite(db: Session, email: str) -> Invite | None:
|
|
"""Idempotently record an access request. Returns the Invite if a *new* pending row
|
|
was created (so the caller can notify admins), else None for already-known emails."""
|
|
email = (email or "").lower()
|
|
if not _EMAIL_RE.match(email):
|
|
return None
|
|
inv = db.execute(select(Invite).where(Invite.email == email)).scalar_one_or_none()
|
|
if inv is not None:
|
|
# Let a previously-denied person ask again; don't disturb approved/pending rows.
|
|
if inv.status == "denied":
|
|
inv.status = "pending"
|
|
inv.requested_at = datetime.now(timezone.utc)
|
|
inv.decided_at = None
|
|
inv.decided_by = None
|
|
db.commit()
|
|
return inv
|
|
return None
|
|
inv = Invite(email=email, status="pending")
|
|
db.add(inv)
|
|
db.commit()
|
|
return inv
|
|
|
|
|
|
@router.get("/login")
|
|
async def login(request: Request):
|
|
# access_type=offline ensures a refresh_token on first authorization. We avoid
|
|
# prompt=consent so returning users get a quick sign-in; the stored refresh token
|
|
# is kept when Google doesn't re-issue one (see the callback).
|
|
return await oauth.google.authorize_redirect(
|
|
request,
|
|
settings.oauth_redirect_url,
|
|
access_type="offline",
|
|
prompt="select_account",
|
|
include_granted_scopes="true",
|
|
scope=BASE_SCOPES,
|
|
)
|
|
|
|
|
|
@router.get("/callback")
|
|
async def callback(
|
|
request: Request,
|
|
background: BackgroundTasks,
|
|
db: Session = Depends(get_db),
|
|
):
|
|
try:
|
|
token = await oauth.google.authorize_access_token(request)
|
|
except OAuthError as exc:
|
|
raise HTTPException(status_code=400, detail=f"OAuth error: {exc.error}")
|
|
|
|
userinfo = token.get("userinfo")
|
|
if not userinfo or not userinfo.get("sub"):
|
|
raise HTTPException(status_code=400, detail="No user info returned by Google")
|
|
|
|
email = (userinfo.get("email") or "").lower()
|
|
if not is_allowed(db, email):
|
|
log.warning("Login denied (not approved): %s", email or "<no email>")
|
|
# A denied Google login doubles as an access request: record it for the admin and
|
|
# land the user on a friendly "request received" screen instead of a raw 403.
|
|
if email:
|
|
inv = upsert_pending_invite(db, email)
|
|
if inv is not None and settings.admin_email_set:
|
|
background.add_task(
|
|
email_mod.send_admin_new_request,
|
|
sorted(settings.admin_email_set),
|
|
email,
|
|
)
|
|
return RedirectResponse(url="/?access=requested")
|
|
return RedirectResponse(url="/?access=denied")
|
|
|
|
user = db.query(User).filter(User.google_sub == userinfo["sub"]).one_or_none()
|
|
if user is None:
|
|
user = User(google_sub=userinfo["sub"], email=email)
|
|
db.add(user)
|
|
user.email = email
|
|
user.display_name = userinfo.get("name")
|
|
user.avatar_url = userinfo.get("picture")
|
|
user.role = "admin" if email in settings.admin_email_set else "user"
|
|
db.flush()
|
|
|
|
tok = user.token or OAuthToken(user=user)
|
|
# Google only returns a refresh_token on (re)consent; keep the previous one otherwise.
|
|
if token.get("refresh_token"):
|
|
tok.refresh_token_enc = encrypt(token["refresh_token"])
|
|
tok.access_token = token.get("access_token")
|
|
expires_at = token.get("expires_at")
|
|
tok.expiry = (
|
|
datetime.fromtimestamp(expires_at, tz=timezone.utc) if expires_at else None
|
|
)
|
|
# include_granted_scopes=true means Google returns the union of all scopes the user
|
|
# has ever granted this app, so this correctly reflects read/write upgrades too.
|
|
tok.scopes = token.get("scope") or BASE_SCOPES
|
|
db.add(tok)
|
|
db.commit()
|
|
|
|
request.session["user_id"] = user.id
|
|
log.info("Login: %s (id=%s, role=%s)", email, user.id, user.role)
|
|
return RedirectResponse(url="/")
|
|
|
|
|
|
@router.post("/logout")
|
|
async def logout(request: Request):
|
|
request.session.clear()
|
|
return JSONResponse({"ok": True})
|
|
|
|
|
|
@router.post("/request-access")
|
|
async def request_access(
|
|
payload: dict,
|
|
background: BackgroundTasks,
|
|
db: Session = Depends(get_db),
|
|
) -> dict:
|
|
"""Public: ask for access. Idempotent — repeat requests for the same email don't
|
|
duplicate or re-spam admins (upsert returns None for an already-pending row)."""
|
|
email = (payload.get("email") or "").strip().lower()
|
|
if not _EMAIL_RE.match(email):
|
|
raise HTTPException(status_code=400, detail="Enter a valid email address.")
|
|
if is_allowed(db, email):
|
|
return {"status": "approved"} # already allowed — just sign in
|
|
inv = upsert_pending_invite(db, email)
|
|
if inv is not None and settings.admin_email_set:
|
|
background.add_task(
|
|
email_mod.send_admin_new_request, sorted(settings.admin_email_set), email
|
|
)
|
|
return {"status": "pending"}
|
|
|
|
|
|
def current_user(request: Request, db: Session = Depends(get_db)) -> User:
|
|
user_id = request.session.get("user_id")
|
|
if not user_id:
|
|
raise HTTPException(status_code=401, detail="Not authenticated")
|
|
user = db.get(User, user_id)
|
|
if user is None:
|
|
request.session.clear()
|
|
raise HTTPException(status_code=401, detail="Not authenticated")
|
|
return user
|
|
|
|
|
|
@router.get("/upgrade")
|
|
async def upgrade(
|
|
request: Request, access: str = "write", user: User = Depends(current_user)
|
|
):
|
|
"""Incremental consent for the onboarding wizard. `access=read` grants YouTube
|
|
read-only (enough to build the feed); `access=write` additionally grants management
|
|
(unsubscribe). The shared callback stores whatever Google returns, so `can_read` /
|
|
`can_write` flip on once granted."""
|
|
scope = READ_SCOPES if access == "read" else WRITE_SCOPES
|
|
return await oauth.google.authorize_redirect(
|
|
request,
|
|
settings.oauth_redirect_url,
|
|
access_type="offline",
|
|
prompt="consent",
|
|
include_granted_scopes="true",
|
|
scope=scope,
|
|
)
|
|
|
|
|
|
@router.get("/me")
|
|
async def me(user: User = Depends(current_user)) -> dict:
|
|
return {
|
|
"id": user.id,
|
|
"email": user.email,
|
|
"display_name": user.display_name,
|
|
"avatar_url": user.avatar_url,
|
|
"role": user.role,
|
|
}
|