auth.py

from functools import wraps
from flask import Flask, Blueprint, abort, render_template, request, url_for, redirect, flash, session, g, jsonify
from datetime import datetime
import requests
from os.path import join
import config
from models import User
from database import get_db
from Crypto.Hash import SHA256, SHA
# from Crypto.PublicKey import ECC

auth = Blueprint('auth', __name__, url_prefix='/auth')

#### FUNCTIONS ####

def isPwned(password):
    # password is encrypted as SHA1 for checking against haveibeenpwned's database
    encrypted_password = SHA.new(data=password.encode('utf-8')).hexdigest().upper()

    encrypted_prefix = encrypted_password[:5]

    url = 'https://api.pwnedpasswords.com/range/{}'.format(encrypted_prefix)
    res = requests.get(url)
    pwned_results = list(map(lambda x: encrypted_prefix + x.split(':')[0], res.text.split('\r\n')))

    return encrypted_password in pwned_results

def apple_get_pub_key():
    url = 'https://appleid.apple.com/auth/keys'
    res = requests.get(url)

    if res.status_code == 200:
        return res.json()
    else:
        return None

def apple_create_client_secret(client_id):
    alg = 'ES256'
    kid = '' # 10-character key identifier obtained from developer account

    iss = '' # 10-character team id from developer account
    iat = int(datetime.utcnow())
    offset = 15777000 # 6 months in seconds is the max
    exp = int(datetime.utcnow().time + offset)
    aud = 'https://appleid.apple.com'
    # sub = "com.mytest.app"
    sub = client_id

    header = {
        'alg': alg,
        'kid': kid
    }
    payload = {
        'iss': iss,
        'iat': iat,
        'exp': exp,
        'aud': aud,
        'sub': sub
    }

    # use ECDSA with P-256 curve and SHA256 hash algorithm
    # key = ECC.generate(curve='P-256')
    enc = None

    return enc

def apple_gen_tokens(client_id):
    url = 'https://appleid.apple.com/auth/token'

    form = None

    client_secret = apple_create_client_secret(client_id)

#### ROUTING ####

@auth.route('/redirect')
def redirect_uri():
    print(request)
    print(request.params)
    apple_pub = apple_get_pub_key()
    print(apple_pub)
    return 'YAY!'

@auth.route('/register', methods=['POST'])
def new_user():
    if session.get('logged_in', False):
        return redirect(url_for('index'))

    name = request.form.get('user_name', None)
    email = request.form.get('user_email', None)
    user = request.form.get('user_username', None)
    password = request.form.get('user_password', None)

    if User.query.filter(User.email == email).first() is None and User.query.filter(User.user == user).first() is None:
        if isPwned(password) is True:
            flash('Compromised password found (\'{}\')! This password has been checked against https://haveibeenpwned and cannot be used for this system.'.format(password))
            return redirect(url_for('register'))
        
        u = User(name, email, user, password)
        db = get_db()
        db.add(u)
        db.commit()
        flash("Success!")
    else:
        flash("Already created!")
    return redirect(url_for('login'))

@auth.route('/login', methods=['POST'])
def login_user():
    if session.get('logged_in', False):
        return redirect(url_for('index'))

    email = request.form.get('user_email', None)
    password = request.form.get('user_password', None)

    if email is '' or password is '':
        flash('Invalid login!')
        return redirect(url_for('login'))

    encrypted_password = SHA256.new(data=password.encode('utf-8')).hexdigest()

    try:
        query = User.query.filter(User.email == email).first() 
    except Exception as msg:
        session.rollback()
        return str(msg)

    if query is None or query.password != encrypted_password:
        flash("Invalid login!")
        return redirect(url_for('login'))
    else:
        session['logged_in'] = True
        session['name'] = query.name
        session['user'] = query.user
        session['email'] = query.email
        session['is_admin'] = query.is_admin

        session.get('connected_user', {})['user'] = {'user': session.get('user', 'guest'), 'logged_in': session.get('logged_in', False), 'is_admin': session.get('is_admin', False), 'email': session.get('email', None), 'name': session.get('name', 'Guest')}


        if session['is_admin'] is True:
            session['X-Redirect-To'] = 'index'
            return redirect(url_for('duo_auth.login'))

        flash('Successfully logged in as {}'.format(session['user']))
        return redirect(url_for('index'))

############# DECORATOR FUNCTIONS #############

def login_required(function_to_protect):
    @wraps(function_to_protect)
    def wrapper(*args, **kwargs):
        if session.get('logged_in', False) is True or (session.get('duo_logged_in', False) is True):
            return function_to_protect(*args, **kwargs)
        else:
            return redirect(url_for('login'))
    return wrapper

def admin_required(function_to_protect):
    @wraps(function_to_protect)
    def wrapper(*args, **kwargs):
        if session.get('is_admin', False) is True and session.get('duo_logged_in', False) is True:
            return function_to_protect(*args, **kwargs)
        else:
            return jsonify({'error': 'invalid permissions'}), 500
    return wrapper