- Aur-dev - lists.archlinux.org

[PATCH] Update the aurweb Git URLs to GitLab
by Frédéric Mangano-Tarumi 13 Jul '20

13 Jul '20

--- INSTALL | 2 +- README.md | 4 ++-- TESTING | 2 +- doc/i18n.txt | 2 +- web/lib/version.inc.php | 1 + web/template/footer.php | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) diff --git a/INSTALL b/INSTALL index 7087aca2..1db69a9c 100644 --- a/INSTALL +++ b/INSTALL @@ -12,7 +12,7 @@ read the instructions below. 1) Clone the aurweb project: $ cd /srv/http/ - $ git clone git://git.archlinux.org/aurweb.git + $ git clone https://gitlab.archlinux.org/archlinux/aurweb.git 2) Setup a web server with PHP and MySQL. Configure the web server to redirect all URLs to /index.php/foo/bar/. The following block can be used with nginx: diff --git a/README.md b/README.md index f7285a51..3105889a 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,8 @@ Directory Layout Links ----- -* The repository is hosted at git://git.archlinux.org/aurweb.git -- see - doc/CodingGuidelines for information on the patch submission process. +* The repository is hosted at <https://gitlab.archlinux.org/archlinux/aurweb.git>. + See doc/CodingGuidelines for information on the patch submission process. * Bugs can (and should) be submitted to the aurweb bug tracker: https://bugs.archlinux.org/index.php?project=2 diff --git a/TESTING b/TESTING index d7df3672..9a211877 100644 --- a/TESTING +++ b/TESTING @@ -7,7 +7,7 @@ INSTALL. 1) Clone the aurweb project: - $ git clone git://git.archlinux.org/aurweb.git + $ git clone https://gitlab.archlinux.org/archlinux/aurweb.git 2) Install the necessary packages: diff --git a/doc/i18n.txt b/doc/i18n.txt index 8216c084..44fb0f1f 100644 --- a/doc/i18n.txt +++ b/doc/i18n.txt @@ -21,7 +21,7 @@ strings for the translation to be usable, and it may have to be disabled. 1. Check out the aurweb source using git: -$ git clone git://git.archlinux.org/aurweb.git aurweb-git +$ git clone https://gitlab.archlinux.org/archlinux/aurweb.git aurweb-git 2. Go into the "po/" directory in the aurweb source and run msginit(1) to create a initial translation file from our translation catalog: diff --git a/web/lib/version.inc.php b/web/lib/version.inc.php index 27eef718..d96ce590 100644 --- a/web/lib/version.inc.php +++ b/web/lib/version.inc.php @@ -1,3 +1,4 @@ <?php +// The HTML footer expects AURWEB_VERSION to refer to a Git tag. define("AURWEB_VERSION", "v5.0.0"); diff --git a/web/template/footer.php b/web/template/footer.php index 572dbb26..59a97642 100644 --- a/web/template/footer.php +++ b/web/template/footer.php @@ -3,7 +3,7 @@ <div id="footer"> <?php if ($ver): ?> - aurweb <a href="https://git.archlinux.org/aurweb.git/log/?h=<?= htmlspecialchars($ver, ENT_QUOTES) ?>"><?= htmlspecialchars($ver) ?></a> + aurweb <a href="https://gitlab.archlinux.org/archlinux/aurweb/-/tags/<?= htmlspecialchars($ver, ENT_QUOTES) ?>"><?= htmlspecialchars($ver) ?></a> <?php endif; ?> <?= __('Copyright %s 2004-%d aurweb Development Team.', '©', date('Y')) ?> <?= __('AUR packages are user produced content. Any use of the provided files is at your own risk.') ?> -- 2.27.0

1 0

[PATCH] Add search_type url parameter
by Kevin Morris 06 Jul '20

06 Jul '20

This commit introduces new functionality: When `search_type` is `web`, search behavior matches aurweb's HTML search page. New parameters: `search_type` Valid search_type values: `rpc` (default), `web` The `rpc` search type uses the existing legacy search method. The `web` search type clones the web-based aurweb search page's behavior as closely as possible (see note at the bottom of this message). The following example searches for packages that contain `blah` AND `abc`: https://aur.archlinux.org/rpc/?v=5&type=search&search_type=web&arg=blah%20a… The legacy method still searches for packages that contain 'blah abc': https://aur.archlinux.org/rpc/?v=5&type=search&arg=blah%20abc https://aur.archlinux.org/rpc/?v=5&type=search&search_type=rpc&arg=blah%20a… An invalid `search_type` returns a json error message about it being unsupported. Additionally, `search_type` is only parsed and considered during a search of type `name` or `name-desc`. Note: This change was written as a solution to https://bugs.archlinux.org/task/49133. PS: + Some spacing issues fixed in comments. Signed-off-by: Kevin Morris <kevr.gtalk(a)gmail.com> --- doc/rpc.txt | 7 ++++ web/lib/aurjson.class.php | 75 +++++++++++++++++++++++++++++++++++---- 2 files changed, 76 insertions(+), 6 deletions(-) diff --git a/doc/rpc.txt b/doc/rpc.txt index 3148ebea..eb97547d 100644 --- a/doc/rpc.txt +++ b/doc/rpc.txt @@ -21,6 +21,11 @@ The _by_ parameter can be skipped and defaults to `name-desc`. If a maintainer search is performed and the search argument is left empty, a list of orphan packages is returned. +The _search_type_ parameter can be skipped and defaults to `rpc`. + +_search_type_ is only ever used during a `name` or `name-desc` search and +supports the following values: `rpc`, `web`. + Package Details --------------- @@ -39,6 +44,8 @@ Examples `/rpc/?v=5&type=search&by=makedepends&arg=boost` `search` with callback:: `/rpc/?v=5&type=search&arg=foobar&callback=jsonp1192244621103` +`search` with `web` _search_type_ for packages containing `cookie` AND `milk`:: + `/rpc/?v=5&type=search&search_type=web&arg=cookie%20milk` `info`:: `/rpc/?v=5&type=info&arg[]=foobar` `info` with multiple packages:: diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index 0ac586fe..0e94b578 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -23,6 +23,9 @@ class AurJSON { private static $exposed_depfields = array( 'depends', 'makedepends', 'checkdepends', 'optdepends' ); + private static $exposed_search_types = array( + 'rpc', 'web' + ); private static $fields_v1 = array( 'Packages.ID', 'Packages.Name', 'PackageBases.ID AS PackageBaseID', @@ -140,7 +143,7 @@ class AurJSON { } /* - * Check if an IP needs to be rate limited. + * Check if an IP needs to be rate limited. * * @param $ip IP of the current request * @@ -192,7 +195,7 @@ class AurJSON { $value = get_cache_value('ratelimit-ws:' . $ip, $status); if (!$status || ($status && $value < $deletion_time)) { if (set_cache_value('ratelimit-ws:' . $ip, $time, $window_length) && - set_cache_value('ratelimit:' . $ip, 1, $window_length)) { + set_cache_value('ratelimit:' . $ip, 1, $window_length)) { return; } } else { @@ -472,6 +475,33 @@ class AurJSON { return array('ids' => $id_args, 'names' => $name_args); } + /* + * Prepare a WHERE statement for each keyword: append $func($keyword) + * separated by $delim. Each keyword is sanitized as wildcards before + * it's passed to $func. + * + * @param $delim Delimiter to use in the middle of two keywords. + * @param $keywords Array of keywords to prepare. + * @param $func A function that returns a string. This value is concatenated. + * + * @return A WHERE condition statement of keywords separated by $delim. + */ + private function join_where($delim, $keywords, $func) { + // Applied to each item to concatenate our entire statement. + $reduce_func = function($carry, $item) use(&$func) { + array_push($carry, $func($item)); + return $carry; + }; + + // Manual array_reduce with a local lambda. + $acc = array(); // Initial + foreach ($keywords as &$keyword) { + $acc += $reduce_func($acc, $keyword); + } + + return join(" $delim ", $acc); + } + /* * Performs a fulltext mysql search of the package database. * @@ -480,6 +510,7 @@ class AurJSON { * @return mixed Returns an array of package matches. */ private function search($http_data) { + $keyword_string = $http_data['arg']; if (isset($http_data['by'])) { @@ -488,17 +519,49 @@ class AurJSON { $search_by = 'name-desc'; } + if (isset($http_data['search_type'])) { + $search_type = $http_data['search_type']; + } else { + // Default search_type: rpc + $search_type = 'rpc'; + } + + if (!in_array($search_type, self::$exposed_search_types)) { + return $this->json_error('Unsupported search type.'); + } + if ($search_by === 'name' || $search_by === 'name-desc') { if (strlen($keyword_string) < 2) { return $this->json_error('Query arg too small.'); } - $keyword_string = $this->dbh->quote("%" . addcslashes($keyword_string, '%_') . "%"); if ($search_by === 'name') { - $where_condition = "(Packages.Name LIKE $keyword_string)"; + if ($search_type === 'rpc') { + $keyword_string = $this->dbh->quote( + "%" . addcslashes($keyword_string, '%_') . "%"); + $where_condition = "(Packages.Name LIKE $keyword_string)"; + } else { + $keywords = explode(' ', $keyword_string); + $func = function($keyword) { + $str = $this->dbh->quote("%" . addcslashes($keyword, '%_') . "%"); + return "(Packages.Name LIKE $str)"; + }; + $where_condition = $this->join_where("AND", $keywords, $func); + } } else if ($search_by === 'name-desc') { - $where_condition = "(Packages.Name LIKE $keyword_string OR "; - $where_condition .= "Description LIKE $keyword_string)"; + if ($search_type === 'rpc') { + $keyword_string = $this->dbh->quote( + "%" . addcslashes($keyword_string, '%_') . "%"); + $where_condition = "(Packages.Name LIKE $keyword_string "; + $where_condition .= "OR Description LIKE $keyword_string)"; + } else { + $keywords = explode(' ', $keyword_string); + $func = function($keyword) { + $str = $this->dbh->quote("%" . addcslashes($keyword, '%_') . "%"); + return "(Packages.Name LIKE $str OR Description LIKE $str)"; + }; + $where_condition = $this->join_where("AND", $keywords, $func); + } } } else if ($search_by === 'maintainer') { if (empty($keyword_string)) { -- 2.20.1

2 26

[PATCH] Add POST support for RPC API
by Kevin Morris 03 Jul '20

03 Jul '20

When we received a POST method from a client, deduce our `$data` by determining which `Content-Type` is used. Supported `Content-Type`s ========================= * `application/json` * `multipart/form-data` `application/json` POST Example, searching for 'test': ``` curl -X POST -H 'Content-Type: application/data' \ --data '{"v": "5", "type": "search", "arg": "test"}' \ https://aur.archlinux.org/rpc/ ``` `multipart/form-data` POST Example, search for 'test': ``` curl -X POST -H 'Content-Type: multipart/form-data' \ -F v=5 -F type=search -F arg=test \ https://aur.archlinux.org/rpc/ ``` This change was written as a solution to https://bugs.archlinux.org/task/49089. NOTE: This commit is not final; would like a review and a bit more consideration on `multipart/form-data` and ensuring that we're handling everything we need to. Signed-off-by: Kevin Morris <kevr.gtalk(a)gmail.com> --- web/html/rpc.php | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/web/html/rpc.php b/web/html/rpc.php index 64c95622..41762aa3 100644 --- a/web/html/rpc.php +++ b/web/html/rpc.php @@ -2,16 +2,47 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aurjson.class.php"); -if ( $_SERVER['REQUEST_METHOD'] != 'GET' ) { +$exposed_methods = array('GET', 'POST'); +$request_method = strtoupper($_SERVER['REQUEST_METHOD']); + +if ( !in_array($request_method, $exposed_methods) ) { header('HTTP/1.1 405 Method Not Allowed'); exit(); } -if ( isset($_GET['type']) ) { +if ( $request_method === 'GET' ) { + $data = $_GET; +} else { + // Otherwise, we were given a POST method, and we'll do some more + // work to deduce our data input. + + // Extract Content-Type; remove any trailing arguments from the string. + $content_type = $_SERVER['CONTENT_TYPE']; + if ( strpos($content_type, ';') ) { + // Example: `multipart/form-data; boundary blahblah` is extracted as + // `multipart/form-data`. + $content_type = explode(';', $content_type)[0]; + } + $content_type = rtrim(trim($content_type)); + + if ($content_type === 'application/json') { + $json = file_get_contents('php://input'); + $data = json_decode($json, true); + } elseif ($content_type === 'multipart/form-data') { + $data = $_POST; + } else { + header('HTTP/1.1 400 Bad Request'); + echo "Error: Unsupported Content-Type header.\n"; + exit(); + } +} + +if ( isset($data['type']) ) { $rpc_o = new AurJSON(); - echo $rpc_o->handle($_GET); + echo $rpc_o->handle($data); } else { echo file_get_contents('../../doc/rpc.html'); } + ?> -- 2.20.1

1 1

aurweb tests and ci
by Kevin Morris 03 Jul '20

03 Jul '20

Hello aur-dev, Working on some things in aurweb at the moment, and I noticed that on master tests are failing on my system, and .travis.yml doesn't seem to properly setup the environment needed to run tests (sqlalchemy is not installed, db tables missing) on travis. Just a few questions 1. What's the state of testing aurweb currently? 2. What are any test barriers to committing code and submitting patches? 2a. What are the testing goals? 3. Is there a thread on this mailing list about this topic? Thank you very much for your time. Regards, Kevin -- Kevin Morris Software Developer Personal Inquiries: kevr.gtalk(a)gmail.com Personal Phone: (415) 583-9687 Technologies: C, C++, Python, Django, Ruby, Rails, ReactJS, jQuery, Javascript, SQL, Redux

2 1

[PATCH 3/3] Open AUR sessions from SSO
by Frédéric Mangano-Tarumi 15 Jun '20

15 Jun '20

Only the core functionality is implemented here. See the TODOs. --- aurweb/routers/sso.py | 51 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index b16edffb..d0802c34 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -1,9 +1,18 @@ +import time +import uuid + import fastapi from authlib.integrations.starlette_client import OAuth +from fastapi import Depends, HTTPException +from fastapi.responses import RedirectResponse +from sqlalchemy.sql import select from starlette.requests import Request import aurweb.config +import aurweb.db + +from aurweb.schema import Sessions, Users router = fastapi.APIRouter() @@ -23,8 +32,46 @@ async def login(request: Request): return await oauth.sso.authorize_redirect(request, redirect_uri, prompt="login") +def open_session(conn, user_id): + """ + Create a new user session into the database. Return its SID. + """ + # TODO check for account suspension + # TODO apply [options] max_sessions_per_user + sid = uuid.uuid4().hex + conn.execute(Sessions.insert().values( + UsersID=user_id, + SessionID=sid, + LastUpdateTS=time.time(), + )) + # TODO update Users.LastLogin and Users.LastLoginIPAddress + return sid + + @router.get("/sso/authenticate") -async def authenticate(request: Request): +async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): + """ + Receive an OpenID Connect ID token, validate it, then process it to create + an new AUR session. + """ + # TODO check for banned IPs token = await oauth.sso.authorize_access_token(request) user = await oauth.sso.parse_id_token(request, token) - return dict(user) + sub = user.get("sub") # this is the SSO account ID in JWT terminology + if not sub: + raise HTTPException(status_code=400, detail="JWT is missing its `sub` field.") + + aur_accounts = conn.execute(select([Users.c.ID]).where(Users.c.SSOAccountID == sub)) \ + .fetchall() + if not aur_accounts: + return "Sorry, we don’t seem to know you Sir " + sub + elif len(aur_accounts) == 1: + sid = open_session(conn, aur_accounts[0][Users.c.ID]) + response = RedirectResponse("/") + # TODO redirect to the referrer + response.set_cookie(key="AURSID", value=sid, httponly=True, + secure=request.url.scheme == "https") + return response + else: + # We’ve got a severe integrity violation. + raise Exception("Multiple accounts found for SSO account " + sub) -- 2.27.0

2 1

[PATCH] aurweb.l10n: Translate without side effects
by Frédéric Mangano-Tarumi 10 Jun '20

10 Jun '20

The install method in Python’s gettext API aliases the translator’s gettext method to an application-global _(). We don’t use that anywhere, and it’s clear from aurweb’s Translator interface that we want to translate a piece of text without affecting any global namespace. --- aurweb/l10n.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/aurweb/l10n.py b/aurweb/l10n.py index 492200b3..51b56abb 100644 --- a/aurweb/l10n.py +++ b/aurweb/l10n.py @@ -15,5 +15,4 @@ class Translator: self._translator[lang] = gettext.translation("aurweb", self._localedir, languages=[lang]) - self._translator[lang].install() - return _(s) # _ is not defined, what is this? # noqa: F821 + return self._translator[lang].gettext(s) -- 2.27.0

2 1

[PATCH 2/3] Integrate SQLAlchemy into FastAPI
by Frédéric Mangano-Tarumi 08 Jun '20

08 Jun '20

--- aurweb/db.py | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/aurweb/db.py b/aurweb/db.py index 1ccd9a07..02aeba38 100644 --- a/aurweb/db.py +++ b/aurweb/db.py @@ -10,6 +10,8 @@ except ImportError: import aurweb.config +engine = None # See get_engine + def get_sqlalchemy_url(): """ @@ -38,6 +40,34 @@ def get_sqlalchemy_url(): raise ValueError('unsupported database backend') +def get_engine(): + """ + Return the global SQLAlchemy engine. + + The engine is created on the first call to get_engine and then stored in the + `engine` global variable for the next calls. + """ + from sqlalchemy import create_engine + global engine + if engine is None: + engine = create_engine(get_sqlalchemy_url(), + # check_same_thread is for a SQLite technicality + # https://fastapi.tiangolo.com/tutorial/sql-databases/#note + connect_args={"check_same_thread": False}) + return engine + + +def connect(): + """ + Return an SQLAlchemy connection. Connections are usually pooled. See + <https://docs.sqlalchemy.org/en/13/core/connections.html>. + + Since SQLAlchemy connections are context managers too, you should use it + with Python’s `with` operator, or with FastAPI’s dependency injection. + """ + return get_engine().connect() + + class Connection: _conn = None _paramstyle = None -- 2.27.0

1 0

[PATCH 1/3] Add SSO account ID in table Users
by Frédéric Mangano-Tarumi 08 Jun '20

08 Jun '20

This column holds a user ID issed by the single sign-on provider. For Keycloak, it is an UUID. For more flexibility, we will be using a standardly-sized VARCHAR field. --- aurweb/schema.py | 1 + ...6e1cd_add_sso_account_id_in_table_users.py | 30 +++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 migrations/versions/ef39fcd6e1cd_add_sso_account_id_in_table_users.py diff --git a/aurweb/schema.py b/aurweb/schema.py index 20f3e5ce..a1d56281 100644 --- a/aurweb/schema.py +++ b/aurweb/schema.py @@ -67,6 +67,7 @@ Users = Table( Column('CommentNotify', TINYINT(1), nullable=False, server_default=text("1")), Column('UpdateNotify', TINYINT(1), nullable=False, server_default=text("0")), Column('OwnershipNotify', TINYINT(1), nullable=False, server_default=text("1")), + Column('SSOAccountID', String(255), nullable=True, unique=True), Index('UsersAccountTypeID', 'AccountTypeID'), mysql_engine='InnoDB', ) diff --git a/migrations/versions/ef39fcd6e1cd_add_sso_account_id_in_table_users.py b/migrations/versions/ef39fcd6e1cd_add_sso_account_id_in_table_users.py new file mode 100644 index 00000000..9e125165 --- /dev/null +++ b/migrations/versions/ef39fcd6e1cd_add_sso_account_id_in_table_users.py @@ -0,0 +1,30 @@ +"""Add SSO account ID in table Users + +Revision ID: ef39fcd6e1cd +Revises: f47cad5d6d03 +Create Date: 2020-06-08 10:04:13.898617 + +""" +from alembic import op +import sqlalchemy as sa + + +# revision identifiers, used by Alembic. +revision = 'ef39fcd6e1cd' +down_revision = 'f47cad5d6d03' +branch_labels = None +depends_on = None + + +def upgrade(): + # ### commands auto generated by Alembic - please adjust! ### + op.add_column('Users', sa.Column('SSOAccountID', sa.String(length=255), nullable=True)) + op.create_unique_constraint(None, 'Users', ['SSOAccountID']) + # ### end Alembic commands ### + + +def downgrade(): + # ### commands auto generated by Alembic - please adjust! ### + op.drop_constraint(None, 'Users', type_='unique') + op.drop_column('Users', 'SSOAccountID') + # ### end Alembic commands ### -- 2.27.0

1 0

[PATCH 3/4] Crude OpenID Connect client using Authlib
by Frédéric Mangano-Tarumi 06 Jun '20

06 Jun '20

Developers can go to /sso/login to get redirected to the SSO. On successful login, the ID token is displayed. --- .gitlab-ci.yml | 3 ++- TESTING | 3 ++- aurweb/asgi.py | 13 +++++++++++++ aurweb/routers/__init__.py | 5 +++++ aurweb/routers/sso.py | 30 ++++++++++++++++++++++++++++++ aurweb/spawn.py | 3 +++ conf/config.defaults | 8 ++++++++ conf/config.dev | 9 +++++++++ 8 files changed, 72 insertions(+), 2 deletions(-) create mode 100644 aurweb/routers/__init__.py create mode 100644 aurweb/routers/sso.py diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index f6260ebb..9dc951aa 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -11,7 +11,8 @@ before_script: base-devel git gpgme protobuf pyalpm python-mysql-connector python-pygit2 python-srcinfo python-bleach python-markdown python-sqlalchemy python-alembic python-pytest python-werkzeug - python-pytest-tap python-fastapi uvicorn nginx + python-pytest-tap python-fastapi uvicorn nginx python-authlib + python-itsdangerous python-httpx test: script: diff --git a/TESTING b/TESTING index 7261df92..d7df3672 100644 --- a/TESTING +++ b/TESTING @@ -13,7 +13,8 @@ INSTALL. # pacman -S --needed php php-sqlite sqlite words fortune-mod \ python python-sqlalchemy python-alembic \ - python-fastapi uvicorn nginx + python-fastapi uvicorn nginx \ + python-authlib python-itsdangerous python-httpx Ensure to enable the pdo_sqlite extension in php.ini. diff --git a/aurweb/asgi.py b/aurweb/asgi.py index 9bb71ecc..60c7ade7 100644 --- a/aurweb/asgi.py +++ b/aurweb/asgi.py @@ -1,3 +1,16 @@ from fastapi import FastAPI +from starlette.middleware.sessions import SessionMiddleware + +import aurweb.config + +from aurweb.routers import sso app = FastAPI() + +session_secret = aurweb.config.get("fastapi", "session_secret") +if not session_secret: + raise Exception("[fastapi] session_secret must not be empty") + +app.add_middleware(SessionMiddleware, secret_key=session_secret) + +app.include_router(sso.router) diff --git a/aurweb/routers/__init__.py b/aurweb/routers/__init__.py new file mode 100644 index 00000000..35d43c03 --- /dev/null +++ b/aurweb/routers/__init__.py @@ -0,0 +1,5 @@ +""" +API routers for FastAPI. + +See https://fastapi.tiangolo.com/tutorial/bigger-applications/ +""" diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py new file mode 100644 index 00000000..b16edffb --- /dev/null +++ b/aurweb/routers/sso.py @@ -0,0 +1,30 @@ +import fastapi + +from authlib.integrations.starlette_client import OAuth +from starlette.requests import Request + +import aurweb.config + +router = fastapi.APIRouter() + +oauth = OAuth() +oauth.register( + name="sso", + server_metadata_url=aurweb.config.get("sso", "openid_configuration"), + client_kwargs={"scope": "openid"}, + client_id=aurweb.config.get("sso", "client_id"), + client_secret=aurweb.config.get("sso", "client_secret"), +) + + +(a)router.get("/sso/login") +async def login(request: Request): + redirect_uri = aurweb.config.get("options", "aur_location") + "/sso/authenticate" + return await oauth.sso.authorize_redirect(request, redirect_uri, prompt="login") + + +(a)router.get("/sso/authenticate") +async def authenticate(request: Request): + token = await oauth.sso.authorize_access_token(request) + user = await oauth.sso.parse_id_token(request, token) + return dict(user) diff --git a/aurweb/spawn.py b/aurweb/spawn.py index e86f29fe..5da8587e 100644 --- a/aurweb/spawn.py +++ b/aurweb/spawn.py @@ -60,6 +60,9 @@ def generate_nginx_config(): location / {{ proxy_pass http://{aurweb.config.get("php", "bind_address")}; }} + location /sso {{ + proxy_pass http://{aurweb.config.get("fastapi", "bind_address")}; + }} }} }} """) diff --git a/conf/config.defaults b/conf/config.defaults index 447dacac..49259754 100644 --- a/conf/config.defaults +++ b/conf/config.defaults @@ -68,6 +68,14 @@ username-regex = [a-zA-Z0-9]+[.\-_]?[a-zA-Z0-9]+$ git-serve-cmd = /usr/local/bin/aurweb-git-serve ssh-options = restrict +[sso] +openid_configuration = +client_id = +client_secret = + +[fastapi] +session_secret = + [serve] repo-path = /srv/http/aurweb/aur.git/ repo-regex = [a-z0-9][a-z0-9.+_-]*$ diff --git a/conf/config.dev b/conf/config.dev index d752f61f..27e981f8 100644 --- a/conf/config.dev +++ b/conf/config.dev @@ -20,6 +20,12 @@ aur_location = http://127.0.0.1:8080 disable_http_login = 0 enable-maintenance = 0 +; Single sign-on +[sso] +openid_configuration = http://127.0.0.1:8083/auth/realms/aurweb/.well-known/openid-configuration +client_id = aurweb +client_secret = + [php] ; Address PHP should bind when spawned in development mode by aurweb.spawn. bind_address = 127.0.0.1:8081 @@ -30,3 +36,6 @@ htmldir = YOUR_AUR_ROOT/web/html [fastapi] ; Address uvicorn should bind when spawned in development mode by aurweb.spawn. bind_address = 127.0.0.1:8082 + +; Passphrase FastAPI uses to sign client-side sessions. +session_secret = 極秘、訳すな！あ、遅過ぎた。 -- 2.27.0

2 2

[PATCH 4/4] Guide to setting up Keycloak for the SSO
by Frédéric Mangano-Tarumi 06 Jun '20

06 Jun '20

--- conf/config.dev | 2 +- doc/SSO | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 doc/SSO diff --git a/conf/config.dev b/conf/config.dev index 27e981f8..fb0cc99a 100644 --- a/conf/config.dev +++ b/conf/config.dev @@ -20,7 +20,7 @@ aur_location = http://127.0.0.1:8080 disable_http_login = 0 enable-maintenance = 0 -; Single sign-on +; Single sign-on. See doc/SSO [sso] openid_configuration = http://127.0.0.1:8083/auth/realms/aurweb/.well-known/openid-configuration client_id = aurweb diff --git a/doc/SSO b/doc/SSO new file mode 100644 index 00000000..1b0b1f7d --- /dev/null +++ b/doc/SSO @@ -0,0 +1,38 @@ +Single Sign-On (SSO) +==================== + +This guide will walk you through setting up Keycloak for use with aurweb. For +extensive documentation, see <https://www.keycloak.org/documentation.html>. + +Installing Keycloak +------------------- + +Keycloak is in the official Arch repositories: + + # pacman -S keycloak + +The default port is 8080, which conflicts with aurweb’s default port. You need +to edit `/etc/keycloak/standalone.xml`, looking for this line: + + <socket-binding name="http" port="${jboss.http.port:8080}"/> + +The default developer configuration assumes it is set to 8083. Alternatively, +you may customize [options] aur_location and [sso] openid_configuration in +`conf/config`. + +You may then start `keycloak.service` through systemd. + +See also ArchWiki <https://wiki.archlinux.org/index.php/Keycloak>. + +Configuring a realm +------------------- + +Go to <http://127.0.0.1:8083/auth> and log in as administrator. Then, hover the +text right below the Keycloak logo at the top left, by default *Master*. Click +*Add realm* and name it *aurweb*. + +Open the *Clients* tab, and create a new *openid-connect* client. Call it +*aurweb*, and set the root URL to <http://127.0.0.1:8080> (your aur_location). + +Create a user from the *Users* tab and try logging in from +<http://127.0.0.1:8083/auth/realms/aurweb/account/>. -- 2.27.0

2 1