takahe/api/middleware.py

35 lines
1.1 KiB
Python
Raw Normal View History

2022-12-11 07:25:48 +00:00
from django.http import HttpResponse
from api.models import Token
class ApiTokenMiddleware:
"""
Adds request.user and request.identity if an API token appears.
Also nukes request.session so it can't be used accidentally.
"""
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
auth_header = request.headers.get("authorization", None)
2023-02-19 18:37:02 +00:00
request.token = None
2023-05-04 17:50:17 +00:00
request.identity = None
2022-12-11 07:25:48 +00:00
if auth_header and auth_header.startswith("Bearer "):
token_value = auth_header[7:]
if token_value == "__app__":
# Special client app token value
pass
else:
try:
token = Token.objects.get(token=token_value, revoked=None)
except Token.DoesNotExist:
return HttpResponse("Invalid Bearer token", status=400)
request.user = token.user
request.identity = token.identity
request.token = token
2022-12-11 07:25:48 +00:00
request.session = None
response = self.get_response(request)
return response