Wrote an oidc wrapper to stop intro members from accessing upperclassmen packet

Author: JoelEager

packet/routes/api.py

@@ -1,10 +1,10 @@
-from packet import auth, app, db
-from packet.utils import before_request
+from packet import app, db
+from packet.utils import before_request, packet_auth
 from packet.models import Packet, MiscSignature
 
 
 @app.route("/api/v1/sign/<packet_id>/", methods=["POST"])
-@auth.oidc_auth
+@packet_auth
 @before_request
 def sign(packet_id, info):
     packet = Packet.by_id(packet_id)

packet/routes/freshmen.py

@@ -4,13 +4,13 @@
 
 from flask import redirect, render_template, request, url_for
 
-from packet import auth, app, db
+from packet import app, db
 from packet.models import Packet
-from packet.utils import before_request
+from packet.utils import before_request, packet_auth
 
 
 @app.route("/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def index(info=None):
     most_recent_packet = Packet.query.filter_by(freshman_username=info['uid']).order_by(Packet.id.desc()).first()
@@ -22,7 +22,7 @@ def index(info=None):
 
 
 @app.route("/essays/<packet_id>/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def essays(packet_id, info=None):
     packet = Packet.by_id(packet_id)
@@ -34,7 +34,7 @@ def essays(packet_id, info=None):
 
 
 @app.route("/essays/<packet_id>/", methods=["POST"])
-@auth.oidc_auth
+@packet_auth
 @before_request
 def submit_essays(packet_id, info=None):
     packet = Packet.by_id(packet_id)

packet/routes/shared.py

@@ -5,7 +5,7 @@
 from flask import render_template, redirect
 
 from packet import auth, app
-from packet.utils import before_request
+from packet.utils import before_request, packet_auth
 from packet.models import Packet
 
 
@@ -16,7 +16,7 @@ def logout():
 
 
 @app.route("/packet/<packet_id>/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def freshman_packet(packet_id, info=None):
     packet = Packet.by_id(packet_id)
@@ -43,7 +43,7 @@ def freshman_packet(packet_id, info=None):
 
 
 @app.route("/packets/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def packets(info=None):
     open_packets = Packet.open_packets()

packet/routes/upperclassmen.py

@@ -6,19 +6,19 @@
 from itertools import chain
 from operator import itemgetter
 
-from packet import auth, app
+from packet import app
 from packet.models import Packet, MiscSignature
-from packet.utils import before_request
+from packet.utils import before_request, packet_auth
 
 
 @app.route("/")
-@auth.oidc_auth
+@packet_auth
 def index():
     return redirect(url_for("packets"), 302)
 
 
 @app.route("/member/<uid>/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def upperclassman(uid, info=None):
     open_packets = Packet.open_packets()
@@ -37,7 +37,7 @@ def upperclassman(uid, info=None):
 
 
 @app.route("/upperclassmen/")
-@auth.oidc_auth
+@packet_auth
 @before_request
 def upperclassmen_total(info=None):
     open_packets = Packet.open_packets()

packet/utils.py

@@ -5,13 +5,14 @@
 import requests
 from flask import session
 
-from packet import _ldap
+from packet import _ldap, auth, app
 from packet.models import Freshman
 from packet.ldap import (ldap_get_member,
                          ldap_is_active,
                          ldap_is_onfloor,
                          ldap_get_roomnumber,
-                         ldap_get_groups)
+                         ldap_get_groups,
+                         ldap_is_intromember)
 
 INTRO_REALM = "https://sso.csh.rit.edu/auth/realms/intro"
 
@@ -67,4 +68,20 @@ def is_on_floor(uid):
     if freshman is not None:
         return freshman.onfloor
     else:
-        return False
+        return False
+
+
+def packet_auth(func):
+    """
+    Decorator for easily configuring oidc
+    """
+    @auth.oidc_auth
+    @wraps(func)
+    def wrapped_function(*args, **kwargs):
+        if app.config["REALM"] == "csh":
+            if ldap_is_intromember(ldap_get_member(str(session["userinfo"].get("preferred_username", "")))):
+                return "Sorry, upperclassmen packet is not available to intro members.", 401
+
+        return func(*args, **kwargs)
+
+    return wrapped_function