path: root/application.py

import cgi
from collections import namedtuple
import ctypes
import cPickle as pickle
import os.path
import urllib
import sqlite3
import sys

from Cheetah.Template import Template

from werkzeug import ClosingIterator, Local, LocalManager, Request, Response
from werkzeug import redirect
from werkzeug.exceptions import HTTPException
from werkzeug.routing import Map, Rule

import openid
from openid.extensions import sreg
import openid.server.server
from openid.store.filestore import FileOpenIDStore
from openid.consumer import discover

import M2Crypto.X509


_LOCAL = Local()
_LOCAL_MANAGER = LocalManager([_LOCAL])
_APPLICATION = _LOCAL('application')
_URL_MAP = Map()


def expose(url_map, rule, **kwargs):
    def wrapper(wrapped):
        url_map.add(Rule(rule, endpoint=wrapped.__name__, **kwargs))
        return wrapped
    return wrapper


def fetch_template(wrapped):
    def wrapper(self, request, *args, **kwargs):
        template = self._get_template(wrapped.__name__, request)
        kwargs['template'] = template
        return wrapped(self, request, *args, **kwargs)
    return wrapper


Key = namedtuple('Key', ['pem', 'confirmed'])
EmailAddr = namedtuple('EmailAddr', ['address', 'public'])
Site = namedtuple('Site', ['trust_root'])
User = namedtuple('User', ['user_id', 'nick_name', 'keys', 'email_addrs', 'sites'])


class UserDatabase(object):
    def __init__(self, data_path):
        self._db_path = os.path.join(data_path, 'userdb', 'users.sqlite3')
        connection = self._connect()
        connection.executescript("BEGIN; PRAGMA FOREIGN_KEYS=on; COMMIT;")
        self._create_tables(connection)

    def _connect(self):
        connection = sqlite3.connect(self._db_path)
        connection.row_factory = sqlite3.Row
        return connection

    def _create_tables(self, connection):
        connection.executescript("""
        CREATE TABLE IF NOT EXISTS users (
            user_id TEXT PRIMARY KEY,
            nick_name TEXT
        );
        CREATE TABLE IF NOT EXISTS keys (
            pem TEXT PRIMARY KEY,
            user_id TEXT NOT NULL REFERENCES users (user_id),
            confirmed BOOLEAN
        );
        CREATE TABLE IF NOT EXISTS email_addrs (
            address TEXT PRIMARY KEY,
            user_id TEXT NOT NULL REFERENCES users (user_id),
            public BOOLEAN
        );
        CREATE TABLE IF NOT EXISTS sites (
            trust_root TEXT,
            user_id TEXT NOT NULL REFERENCES users (user_id),
            CONSTRAINT sites_pk PRIMARY KEY (trust_root, user_id)
        );
        """)
        connection.commit()

    def find_user_by_id(self, user_id, connection=None):
        connection = connection or self._connect()
        query = 'SELECT nick_name FROM users WHERE user_id=?;'
        rows = connection.execute(query, (user_id, )).fetchall()
        if not rows:
            return None

        return User(user_id,
            nick_name=rows[0]['nick_name'],
            keys=self._fetch_multi(connection, 'key', user_id, Key),
            email_addrs=self._fetch_multi(connection, 'email_addr', user_id,
                                          EmailAddr),
            sites=self._fetch_multi(connection, 'site', user_id, Site))

    def find_user_by_key_pem(self, key_pem):
        """Find the user with a matching key.pem value.

        Returns the user and the matching key, or None, None if no match
        is found.
        """
        return self._find_by_multi('key', 'pem', key_pem, Key)

    def add_user(self, user):
        self._add_user(user)

    def update_user(self, user):
        self._add_user(user, allow_replace=True)

    def add_site_for_user(self, user, site):
        with self._connect() as connection:
            self._add_multi(connection, 'INSERT INTO', 'site', user.user_id,
                            site)
            user.sites.append(site)

    def add_key_for_user(self, user, key):
        with self._connect() as connection:
            self._add_multi(connection, 'INSERT INTO', 'key', user.user_id,
                            key)
            user.keys.append(key)

    def remove_key(self, key):
        with self._connect() as connection:
            connection.execute('DELETE FROM keys WHERE pem=?;', (key.pem, ))

    def update_key(self, key):
        with self._connect() as connection:
            query = 'UPDATE keys SET %s WHERE pem=?;' % \
                    (','.join(['%s=?' % (name, ) for name in key._fields]), )
            connection.execute(query, key + (key.pem, ))

    def _add_user(self, user, allow_replace=False):
        if allow_replace:
            command = 'INSERT OR REPLACE INTO'
        else:
            command = 'INSERT INTO'

        with self._connect() as connection:
            query = command + ' users (user_id, nick_name) VALUES (?,?);'
            connection.execute(query, (user.user_id, user.nick_name))

            for key in user.keys:
                self._add_multi(connection, command, 'key', user.user_id, key)

            for email_addr in user.email_addrs:
                self._add_multi(connection, command, 'email_addr',
                                user.user_id, email_addr)

            for site in user.sites:
                self._add_multi(connection, command, 'site', user.user_id, site)

            self._remove_old(connection, user.user_id, 'key', 'pem',
                             [key.pem for key in user.keys])
            self._remove_old(connection, user.user_id, 'email_addr',
                             'address',
                             [email_addr.address
                              for email_addr in user.email_addrs])
            self._remove_old(connection, user.user_id, 'site', 'trust_root',
                             [site.trust_root for site in user.sites])

    def _add_multi(self, connection, command, what, user_id, value):
        connection.execute('%s %ss (user_id, %s) VALUES (?,%s);' \
                           % (command, what, ','.join(value._fields),
                              ','.join(['?'] * len(value._fields))),
                           (user_id, ) + value)

    def _add_key(self, connection, command, user_id, key):
        connection.execute(command + ' keys (user_id, pem) '
                           'VALUES (?,?);', (user_id, key.pem))

    def _add_email_addr(self, connection, command, user_id, email_addr):
        connection.execute(command + ' email_addrs '
                           '(user_id, address, public) VALUES (?,?,?);',
                           (user_id, email_addr.address, email_addr.public))

    def _remove_old(self, connection, user_id, what, column, new_values):
        query = 'DELETE FROM %ss WHERE user_id=? AND %s NOT IN (%s);' \
                % (what, column, ','.join(['?'] * len(new_values)))
        connection.execute(query, (user_id, ) + tuple(new_values))

    def _fetch_multi(self, connection, what, user_id, result_type):
        """Return all values for the given user from a 1:n mapping."""
        query = 'SELECT %s FROM %ss where user_id=?' \
                % (', '.join(result_type._fields), what)
        cursor = connection.execute(query, (user_id, ))
        return [result_type(*row) for row in cursor]

    def _find_by_multi(self, what, column, value, result_type):
        """Find a user by looking up a value from a 1:n mapping.

        Returns the user and the matching value, or None, None if no match
        is found.
        """
        query = 'SELECT user_id, %s FROM %ss where %s=?' \
                % (','.join(result_type._fields), what, column)
        connection = self._connect()
        for row in connection.execute(query, (value, )):
            return (self.find_user_by_id(row['user_id'],
                    connection=connection), result_type(*list(row)[1:]))

        return None, None


class Application(object):

    _url_map = Map()

    def __init__(self, base_url, data_path):
        _LOCAL.application = self
        self._base_url = base_url
        self._data_path = data_path
        self._user_db = UserDatabase(data_path)
        self._openid_store = FileOpenIDStore(data_path)
        self._openid = openid.server.server.Server(self._openid_store,
                                                   base_url+'/openidserver')

    def init_database(self):
        pass

    @fetch_template
    @expose(_url_map, '/')
    def index(self, request, template):
        template.user, template.key = self._check_user(request)
        return Response(str(template), mimetype='text/html')

    @fetch_template
    @expose(_url_map, '/yadisserver')
    def yadis_server(self, request, template):
        return Response(str(template), mimetype='application/xrds+xml')

    @fetch_template
    @expose(_url_map, '/yadis/<user_id>')
    def yadis_page(self, request, user_id, template):
        template.user = self._user_db.find_user_by_id(user_id)
        return Response(str(template), mimetype='application/xrds+xml')

    @fetch_template
    @expose(_url_map, '/id/<user_id>')
    def id_page(self, request, user_id, template):
        template.page_user = self._user_db.find_user_by_id(user_id)
        template.request_user, template.key = self._check_user(request)
        if not template.key.confirmed:
            template.request_user = None
        return Response(str(template), mimetype='text/html')

    @expose(_url_map, '/openidserver')
    def openid_server(self, request):
        user, key = self._check_user(request)
        if user and not key.confirmed:
            user = None

        try:
            id_request = self._openid.decodeRequest(request.form)
        except openid.server.server.ProtocolError, exception:
            template = self._get_template('error', request)
            template.message = str(why)
            return Response(str(template), status=400)

        if id_request is None:
            return Response('This is an OpenID endpoint.',
                            mimetype='text/plain')

        if id_request.mode in ['checkid_immediate', 'checkid_setup']:
            return self._handle_check_id_request(request, user, id_request)

        return self._openid_response(self._openid.handleRequest(id_request))

    @expose(_url_map, '/allow')
    def allow_openid_request(self, request):
        """Process result of form asking the user for confirmation that (s)he
        wants to log in to the Relying Party."""
        user, key = self._check_user(request)

        if user and not key.confirmed:
            user = None

        id_request = self._retrieve_openid_request(user,
                                                   request.form['trust_root'])

        if 'yes' in request.form:
            if id_request.idSelect():
                identity = '%s/id/%s' % (self._base_url,
                                         urllib.quote(user.user_id, safe=''))
            else:
                identity = id_request.identity

            self._user_db.add_site_for_user(user, Site(id_request.trust_root))

            id_response = self._openid_approve(user, id_request, identity)
            return self._openid_response(id_response)

        elif 'no' in request.form:
            return self._openid_response(id_request.answer(False))

        else:
            return Response(status=400)

    @expose(_url_map, '/register')
    def register_user(self, request):
        user, key = self._check_user(request)
        if key is None:
            template = self._get_template('error', request)
            template.message = 'Client certificate was not presented.'
            return Response(str(template), status=400)

        if user is not None:
            template = self._get_template('error', request)
            template.message = 'You are already registered.'
            return Response(str(template), status=400)

        if self._user_db.find_user_by_id(request.form['user_id']):
            template = self._get_template('register_fail_duplicate_user_id',
                                          request)
            template.user_id = request.form['user_id']
            template.nick_name = request.form['nick_name']
            return Response(str(template), mimetype='text/html')

        key = Key(key.pem, True)
        user = User(request.form['user_id'], request.form['nick_name'],
                    keys=[key], email_addrs=[], sites=[])
        self._user_db.add_user(user)
        template = self._get_template('registered', request)
        template.user = user
        return Response(str(template), mimetype='text/html')

    @expose(_url_map, '/add_key')
    def add_key(self, request):
        user, key = self._check_user(request)
        if key is None:
            template = self._get_template('error', request)
            template.message = 'Client certificate was not presented.'
            return Response(str(template), status=400)

        if user is not None:
            template = self._get_template('error', request)
            template.message = 'You are already registered.'
            return Response(str(template), status=400)

        user = self._user_db.find_user_by_id(request.form['user_id'])
        if not user:
            template = self._get_template('add_key_fail_unknown_user_id',
                                          request)
            template.user_id = request.form['user_id']
            return Response(str(template), mimetype='text/html')

        key = Key(key.pem, False)
        self._user_db.add_key_for_user(user, key)
        template = self._get_template('add_key_verification_needed', request)
        template.user = user
        return Response(str(template), mimetype='text/html')

    @expose(_url_map, '/confirm_key')
    def confirm_key(self, request):
        user, key = self._check_user(request)
        if user is None:
            template = self._get_template('error', request)
            template.message = 'You are not registered.'
            return Response(str(template), status=403)

        key_pem = request.form['key_pem'].strip().replace('\r', '')
        confirmed_key = None
        for key_candidate in user.keys:
            if key_pem == key_candidate.pem:
                confirmed_key = key_candidate

        if confirmed_key is None:
            template = self._get_template('error', request)
            template.message = 'Unknown key.'
            return Response(str(template), status=400)

        if confirmed_key.confirmed:
            template = self._get_template('error', request)
            template.message = 'Key has already been confirmed.'
            return Response(str(template), status=400)

        if 'remove' in request.form:
            self._user_db.remove_key(confirmed_key)
            return redirect('%s/id/%s' % (self._base_url, user.user_id))

        if not 'accept' in request.form:
            template = self._get_template('error', request)
            template.message = 'No action specified.'
            return Response(str(template), status=400)

        updated_key = Key(confirmed_key.pem, True)
        self._user_db.update_key(updated_key)
        template = self._get_template('key_confirmed', request)
        template.user = user
        template.key = updated_key
        return Response(str(template), mimetype='text/html')

    def _handle_check_id_request(self, request, user, id_request):
        is_authorized = self._is_authorized(user, id_request.identity,
                                            id_request.trust_root)
        if is_authorized:
            return self._openid_response(self._openid_approve(user,
                                                              id_request))
        elif user is None:
            # cannot identify user => reject
            sys.stderr.write('Rejecting request from unidentified user\n')
            return self._openid_response(id_request.answer(False))
        elif id_request.immediate:
            # confirmation from user required => reject
            sys.stderr.write('Rejecting immediate request from unknown site\n')
            return self._openid_response(id_request.answer(False))
        elif id_request.idSelect():
            # FIXME: we don't support choosing an identifier yet
            sys.stderr.write('Rejecting request without identifier\n')
            return self._openid_response(id_request.answer(False))
        else:
            self._store_openid_request(user, id_request)
            return self._ask_for_confirmation(request, user, id_request)

    def _ask_for_confirmation(self, request, user, id_request):
        id_url_base = self._base_url+'/id/'
        if id_request.identity.startswith(id_url_base) \
           and id_request.identity:
            expected_name = urllib.unquote(id_request.identity[len(id_url_base):])
        else:
            expected_name = None

        if expected_name != user.user_id:
            sys.stderr.write('%r != %r' % (expected_name, user.user_id))
            return self._openid_response(id_request.answer(False))

        template = self._get_template('ask_for_confirmation', request)
        template.user = user
        template.identity = id_request.identity
        template.trust_root = id_request.trust_root
        return Response(str(template), mimetype='text/html')

    def _check_user(self, request):
        key_pem = self._get_public_key(request)
        if not key_pem:
            return None, None

        user, key = self._user_db.find_user_by_key_pem(key_pem)
        if user is None:
            return None, Key(key_pem, False)

        return user, key

    def _get_public_key(self, request):
#        class a: pass
#        request = a()
#        request.remote_user = '-----BEGIN CERTIFICATE-----\nMIIFBTCCAu2gAwIBAgICdXwwDQYJKoZIhvcNAQEFBQAwVDEUMBIGA1UEChMLQ0Fj\nZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZzEcMBoGA1UE\nAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDAeFw0wOTAzMTExMDI1MTBaFw0xMTAzMTEx\nMDI1MTBaMDgxFTATBgNVBAMTDFNhc2NoYSBTaWxiZTEfMB0GCSqGSIb3DQEJARYQ\nc2FzY2hhQHNpbGJlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAL0HChbY6UB3SHXwbv28H5o57xXIGloXk8gZzrzzP70ICnb4ZLwHYnbRrUD8At7g\n2KQZcM1kd68VsBBKDFzu15V043uFgU3KAjOIRyP2hS+FM/MXeNHSOKrT5M3V+vMG\nYaSYNSHqYFjpFD32TW2FZnyJNg39/b4eiLsZWPaatQI9yJ/n/CKKD4HT/9xFm4Rq\nP0DHbU2b9RyCLPRLQ4fuZYf9fMDkyZbXJOMchkDIBHE88jSkC/5ujmU6sjhkV6T4\nzDfXXhrJnrcCJ0Nynde8sO6qFLcKNk1uXoqB32RCDVSSU1NCABn4oA2a7CVRnlEv\nM0VgqdinL5XTzbN2kZ9q25MCAwEAAaOB/DCB+TAMBgNVHRMBAf8EAjAAMFYGCWCG\nSAGG+EIBDQRJFkdUbyBnZXQgeW91ciBvd24gY2VydGlmaWNhdGUgZm9yIEZSRUUg\naGVhZCBvdmVyIHRvIGh0dHA6Ly93d3cuQ0FjZXJ0Lm9yZzBABgNVHSUEOTA3Bggr\nBgEFBQcDBAYIKwYBBQUHAwIGCisGAQQBgjcKAwQGCisGAQQBgjcKAwMGCWCGSAGG\n+EIEATAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLmNh\nY2VydC5vcmcwGwYDVR0RBBQwEoEQc2FzY2hhQHNpbGJlLm9yZzANBgkqhkiG9w0B\nAQUFAAOCAgEAjhvCuEkCeJyrOA+CyojIC+PO56wGacZzvQk/pks4PNo+2v7CQj+8\nAyE5xmooQhVr8zKNXCKljUkdDfoT6Sfy5t6EkZITa4hDZncI7AA6jCWiTq7zs6+u\npckzpVusYBfcFVjlFlLfhjHseI5rJ15hoUlimFVTv5/D4ZULp6qAyrQVikniLz2n\nstXwDz8Gdl1J+NJIr0M1iCqvbtvdAfwinJFmW7Mr3eV/LrNC2bJpFbSDP2ptnV3Y\ns1jPWozscZ2sb2IkVCaaqab/04MLjmoIzSvTbCjRZXiMkgRbMfg31z015f3gN1OC\nCEGb5gH/YlzzL1rn8LdZ7x7VAG/Vd6TNe6R6HPuviu1urRoBVZR7CWc1eMGGAHCF\njn+BtHye9Wna1c1lH+3hV2aXPQxgZKQPKcUnvC+zPBqvVA25UsrNCGNPp4LUPtpA\noiZTNzzYetaXxuj5aT+TA43Fe9lhRRwAOdXvtvbIkKqNn4AzelSzi77thVY0EoJy\n7ZEHR3CjRtyMmZ3kWpRzGFkPchRb1nNs98Dtk+PaAYLJUEDZmruYGvSPrx9bVWDz\nwC91uXOYX24FEqjAl/A1V+oLA+WaXvSYuabfE+WM/pUzcb7fsn+PbStt26lyU+Zj\n7U3/gCOjzPPw5EIBm6uE4eR8ktIKEOJHJETouhBh/V1T+q9s8wjGPx8=\n-----END CERTIFICATE-----'
#        request.remote_user = '-----BEGIN CERTIFICATE-----\nMIICwzCCAaugAwIBAgIETpA+YTANBgkqhkiG9w0BAQUFADAfMR0wGwYDVQQDExRC\ncm93c2UtU1NPLVBzZXVkby1DQTAgFw0xMTAxMzEyMjM5MzJaGA8yMDk0MDUwMTIy\nMzkzMlowJjEkMCIGA1UEAxMbU2FzY2hhIFNpbGJlICh0d2luLWpoYnVpbGQpMIIB\nIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmUzxtfRv8aLLwGNYgkbEbcFN\n/G2+vFjgjyjJn0bkWfIbDScksCJqaIYbDZDgS2ifThk9icvjyScY2FsGgFc4Hivw\ndnKJiAslorplY/Hx/GlTMaz/TI0ETiG+TCf0TeigC9KX3rAlCy2r9vL2vurcGFtp\nja1qf/LRkJSfckRnfS231Uhn3zCZl1PkDHXya/3AQMIHKu5kJnLfcg25lTp+JpfB\nB2YrX7/mBA2gwdEjDi9b+p+aQ4K5fFWMQVeh1pHL8gvd7O+blb8OTEXRJjqgj7cP\nfEVtxdhBGcK1kdGrb34/VPN56mrUgHt+Y6lBR/LyQvLHe7H59FMasTSmhJQw6wID\nAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCc6idqzhbiW0B0P6u86Sk93qmLt4O7VPLn\n+dwK6sBg+tYuE0gDsXO1XAFJIOKdLLyslmMf+sRnTvUK4byhmDhGbssSGjMwWems\nEKkb9M3kBtYTpUGuWK1lsObnRBGyWP3ANcGPGEU+m5qtrX6CYyLnZb/ii2Y++SYG\nPBY0uOKYpEdhe/WR3jEy2WbBqLzkLCyz2g0VuhVplUfy/BkqwUWqypyy9/K/5f2w\nh5luGNBgIYm9niX+XI8rkQqk2twZGfVsBsLoA0M2ENWPnGx+DFCqgZBRlNBtoMKy\nM5fNM06XyKj1P374xQTpCMISd2pbwrlgsk4vg3MllBYvi7oG9H0O\n-----END CERTIFICATE-----'

        if not request.remote_user:
            return None

        try:
            certificate = M2Crypto.X509.load_cert_string(request.remote_user)
            return certificate.get_pubkey().get_rsa().as_pem().strip()

        except (M2Crypto.X509.X509Error, ValueError):
            return None

    def _addSRegResponse(self, user, id_request, id_response):
        sreg_req = sreg.SRegRequest.fromOpenIDRequest(id_request)
        # TODO: ask for permission, more fields
        sreg_data = {
            'nickname': user.nick_name,
        }

        sreg_resp = sreg.SRegResponse.extractResponse(sreg_req, sreg_data)
        id_response.addExtension(sreg_resp)

    def _openid_approve(self, user, id_request, identifier=None):
        id_response = id_request.answer(True, identity=identifier)
        self._addSRegResponse(user, id_request, id_response)
        return id_response

    def _is_authorized(self, user, identity_url, trust_root):
        if user is None:
            return False

        if identity_url != '%s/id/%s' % (self._base_url,
                                         urllib.quote(user.user_id, safe='')):
            return False

        return bool([True for site in user.sites
                     if site.trust_root == trust_root])

    def _openid_response(self, id_response):
        try:
            encoded_response = self._openid.encodeResponse(id_response)
        except openid.server.server.EncodingError, exception:
            template = self._get_template('error', request)
            template.message = exception.response.encodeToKVForm()
            return Response(str(template), status=400)

        return Response(encoded_response.body,
                        headers=encoded_response.headers,
                        status=encoded_response.code)

    def _store_openid_request(self, user, id_request):
        # FIXME: add cleanup
        handle = repr((user.user_id, id_request.trust_root))
        file_name = self._openid_store.getAssociationFilename(self._base_url,
                                                              handle)
        with open(file_name, 'w') as f:
            pickle.dump(id_request, f)

    def _retrieve_openid_request(self, user, trust_root):
        handle = repr((user.user_id, trust_root))
        file_name = self._openid_store.getAssociationFilename(self._base_url,
                                                              handle)
        try:
            return pickle.load(file(file_name))
        except IOError:
            return None

    def __call__(self, environment, start_response):
        _LOCAL.application = self
        request = Request(environment)
        _LOCAL.url_adapter = self._url_map.bind_to_environ(environment)
        try:
            endpoint, values = _LOCAL.url_adapter.match()
            handler = getattr(self, endpoint)
            response = handler(request, **values)
        except HTTPException, exception:
            response = exception
        return ClosingIterator(response(environment, start_response),
                               [_LOCAL_MANAGER.cleanup])

    def _get_template(self, name, request):
        # FIXME: i18n
        file_name = os.path.join(self._data_path, 'templates', name+'.tmpl')
        template = Template(file=file_name)
        template.base_url = self._base_url
        return template