Merge pull request #8 from WHOIGit/codex/protect-api-endpoints-with-token-authentication

Secure admin endpoints with token auth

Author: joefutrelle

api/core/auth.py

@@ -1,17 +1,21 @@
+from ninja.security import HttpBearer
 from rest_framework.authentication import TokenAuthentication
 from rest_framework.exceptions import AuthenticationFailed
 from ninja.errors import HttpError
 
-
-class TokenAuthenticator:
+class TokenAuthenticator(HttpBearer):
     def __init__(self):
         self.auth = TokenAuthentication()
+        super().__init__()  # Make sure to call parent init!
 
-    def __call__(self, request):
+    def authenticate(self, request, token):
+        # This ensures the DRF token auth will see the header
+        request.META['HTTP_AUTHORIZATION'] = f"Token {token}"
         try:
-            user = self.auth.authenticate(request)
-            if user is None:
-                raise AuthenticationFailed('Unauthorized')
-            return user
-        except AuthenticationFailed:
+            user_auth_tuple = self.auth.authenticate(request)
+        except AuthenticationFailed as e:
+            raise HttpError(401, 'Unauthorized') from e
+        if user_auth_tuple is None:
             raise HttpError(401, 'Unauthorized')
+        user, _ = user_auth_tuple
+        return user

api/ctd/api.py

@@ -1,5 +1,6 @@
 from typing import List
 from ninja import Router
+from core.auth import TokenAuthenticator
 
 from .services import CtdService, NiskinInput, VesselOutput, AddVesselInput, \
     UpdateVesselInput, CruiseOutput, AddCruiseInput,  \
@@ -18,15 +19,15 @@ def get_vessel(request, vessel_name: str):
     return CtdService.get_vessel(vessel_name)
 
 
-@router.post('/vessels/create', tags=["Admin"])
+@router.post('/vessels/create', tags=["Admin"], auth=TokenAuthenticator())
 def create_vessel(request, input: AddVesselInput):
     try:
         new_vessel = CtdService.create_vessel(input)
         return {"status": "success", "vessel": new_vessel}
     except ValueError as e:
         return {"status": "error", "message": str(e)}
 
-@router.post('/vessels/update/{vessel_name}', tags=["Admin"])
+@router.post('/vessels/update/{vessel_name}', tags=["Admin"], auth=TokenAuthenticator())
 def update_vessel(request, vessel_name: str, input: UpdateVesselInput):
     try:
         result = CtdService.update_vessel(vessel_name, input)
@@ -44,7 +45,7 @@ def get_cruises(request):
 def get_cruise(request, cruise_name: str):
     return CtdService.get_cruise(cruise_name)
 
-@router.post('/cruises/create', tags=["Admin"])
+@router.post('/cruises/create', tags=["Admin"], auth=TokenAuthenticator())
 def create_cruise(request, input: AddCruiseInput):
     try:
         new_cruise = CtdService.create_cruise(input)
@@ -53,7 +54,7 @@ def create_cruise(request, input: AddCruiseInput):
         return {"status": "error", "message": str(e)}
 
 
-@router.post('/cruises/update/{cruise_name}', tags=["Admin"])
+@router.post('/cruises/update/{cruise_name}', tags=["Admin"], auth=TokenAuthenticator())
 def update_cruise(request, cruise_name: str, input: UpdateCruiseInput):
     try:
         result = CtdService.update_cruise(cruise_name, input)
@@ -62,7 +63,7 @@ def update_cruise(request, cruise_name: str, input: UpdateCruiseInput):
         return {"status": "error", "message": str(e)}
 
 
-@router.delete('/cruises/delete/{cruise_name}', tags=["Admin"])
+@router.delete('/cruises/delete/{cruise_name}', tags=["Admin"], auth=TokenAuthenticator())
 def delete_cruise(request, cruise_name: str):
     try:
         result = CtdService.delete_cruise(cruise_name)
@@ -80,15 +81,15 @@ def get_casts(request, cruise_name: str):
 def get_cast(request, cruise_name: str, cast_number: str):
     return CtdService.get_cast(cruise_name, cast_number)
 
-@router.post('/casts/create', tags=["Admin"])
+@router.post('/casts/create', tags=["Admin"], auth=TokenAuthenticator())
 def create_cast(request, input: CastInput):
     try:
         new_cast = CtdService.create_cast(input)
         return {"status": "success", "cast": new_cast}
     except ValueError as e:
         return {"status": "error", "message": str(e)}
 
-@router.post('/casts/update/{cruise_name}/{cast_number}', tags=["Admin"])
+@router.post('/casts/update/{cruise_name}/{cast_number}', tags=["Admin"], auth=TokenAuthenticator())
 def update_cast(request, cruise_name: str, cast_number: str, input: UpdateCastInput):
     try:
         cast = CtdService.update_cast(cruise_name, cast_number, input)
@@ -97,7 +98,7 @@ def update_cast(request, cruise_name: str, cast_number: str, input: UpdateCastIn
         return {"status": "error", "message": str(e)}
 
 
-@router.delete('/casts/delete/{cruise_name}/{cast_number}', tags=["Admin"])
+@router.delete('/casts/delete/{cruise_name}/{cast_number}', tags=["Admin"], auth=TokenAuthenticator())
 def delete_cast(request, cruise_name: str, cast_number: str):
     try:
         result = CtdService.delete_cast(cruise_name, cast_number)
@@ -106,7 +107,7 @@ def delete_cast(request, cruise_name: str, cast_number: str):
         return {"status": "error", "message": str(e)}
 
 
-@router.post('/niskins/create', tags=["Admin"])
+@router.post('/niskins/create', tags=["Admin"], auth=TokenAuthenticator())
 def create_niskin(request, input: NiskinInput):
     try:
         niskin = CtdService.create_niskin(input)
@@ -126,15 +127,15 @@ def get_niskin(request, cruise_name: str, cast_number: str, niskin_number: int):
     return CtdService.get_niskin(cruise_name, cast_number, niskin_number)
 
 
-@router.post('/niskins/update/{cruise_name}/{cast_number}/{niskin_number}', tags=["Admin"])
+@router.post('/niskins/update/{cruise_name}/{cast_number}/{niskin_number}', tags=["Admin"], auth=TokenAuthenticator())
 def update_niskin(request, cruise_name: str, cast_number: str, niskin_number: str, input: UpdateNiskinInput):
     try:
         niskin = CtdService.update_niskin(cruise_name, cast_number, niskin_number, input)
         return {"status": "success", "niskin updated": niskin}
     except ValueError as e:
         return {"status": "error", "message": str(e)}
 
-@router.delete('/niksins/delete/{cruise_name}/{cast_number}/{niskin_number}', tags=["Admin"])
+@router.delete('/niskins/delete/{cruise_name}/{cast_number}/{niskin_number}', tags=["Admin"], auth=TokenAuthenticator())
 def delete_niskin(request, cruise_name: str, cast_number: str, niskin_number: int):
     try:
         result = CtdService.delete_niskin(cruise_name, cast_number, niskin_number)

api/events/api.py

@@ -1,6 +1,7 @@
 from typing import List
 from datetime import datetime
 from ninja import Router
+from core.auth import TokenAuthenticator
 
 from .services import EventService, EventOutput, FilterEventInput, EditEventInput
 
@@ -15,7 +16,7 @@ def get_events(request, cruise_name: str):
 def filter_events(request, cruise_name: str, input: FilterEventInput):
     return EventService.filter_events(cruise_name, input)
 
-@router.post("/edit/{cruise_name}/{message_id}", response=EventOutput, tags=["Admin"])
+@router.post("/edit/{cruise_name}/{message_id}", response=EventOutput, tags=["Admin"], auth=TokenAuthenticator())
 def edit_events(request, cruise_name: str, message_id: int, input: EditEventInput):
     return EventService.edit_events(cruise_name, message_id, input)
 
@@ -25,7 +26,7 @@ def history_events(request, cruise_name: str):
     return EventService.history_events(cruise_name)
 
 
-@router.delete('/delete/{cruise_name}', tags=["Admin"])
+@router.delete('/delete/{cruise_name}', tags=["Admin"], auth=TokenAuthenticator())
 def delete_events(request, cruise_name: str):
     try:
         result = EventService.delete_events(cruise_name)

api/stations/api.py

@@ -2,6 +2,7 @@
 from datetime import datetime
 
 from ninja import Router
+from core.auth import TokenAuthenticator
 from django.http import FileResponse
 
 from .services import StationService, StationInput, StationLocationInput, StationQueryOutput, \
@@ -28,13 +29,13 @@ def get_stations_file(request):
 #    return StationService.get_nearest_station(query)
 
 
-@router.post('/create', tags=["Admin"])
+@router.post('/create', tags=["Admin"], auth=TokenAuthenticator())
 def create_station(request, input: StationInput):
     StationService.create_station(input)
     return 204
 
 
-@router.post('/set_location', tags=["Admin"])
+@router.post('/set_location', tags=["Admin"], auth=TokenAuthenticator())
 def set_location(request, input: StationLocationInput):
     StationService.set_location(input)
     return 204
@@ -46,4 +47,4 @@ def add_nearest_station(request, input: AddNearestStationInput):
         latitude=input.latitude,
         longitude=input.longitude,
         timestamp=input.timestamp
-    )
+    )