86 lines
3.1 KiB
Python
86 lines
3.1 KiB
Python
import os
|
|
|
|
from pyramid.config import Configurator
|
|
from pyramid.authentication import SessionAuthenticationPolicy
|
|
from pyramid.authorization import ACLAuthorizationPolicy
|
|
from pyramid.session import SignedCookieSessionFactory
|
|
|
|
from .services.user import make_groupfinder
|
|
|
|
|
|
# Le cookie de session porte desormais l'identite : il est signe avec
|
|
# hashalg='sha512', donc le secret doit faire au moins 64 caracteres.
|
|
SESSION_SECRET = (
|
|
'M56kCo51EibaMo0cAo1HRNFGaRl90-Mg8i1T_FaI8ugo7pJW4imVWREQr8hlTs'
|
|
'aY3DxyMl211WY0oCK-nIFBg'
|
|
)
|
|
|
|
# Le defaut de SignedCookieSessionFactory est de 20 minutes, ce qui est trop
|
|
# court pour un ecran de consentement Google + une connexion + une 2FA.
|
|
# On garde les 10 heures (36000 s) de l'ancienne AuthTkt.
|
|
SESSION_TIMEOUT = 36000
|
|
|
|
class ConfigurationError(Exception):
|
|
"""Erreur de configuration detectee au demarrage."""
|
|
|
|
|
|
def read_google_settings(settings):
|
|
# Returnne un dict {google.client_id, google.client_secret}.
|
|
# Le reglage de l'ini, s'il existe, l'emporte sur l'environnement.
|
|
google = {}
|
|
key = 'google.client_id'
|
|
google[key] = settings.get(key)
|
|
key = 'google.client_secret'
|
|
google[key] = settings.get(key)
|
|
|
|
if not google[key]:
|
|
raise ConfigurationError(
|
|
"Configuration Google incomplete : les variables d'environnement "
|
|
"sont absentes. Renseignez-les avant de demarrer l'application.")
|
|
|
|
return google
|
|
|
|
|
|
def admin_emails(settings):
|
|
# Liste des emails qui portent le groupe 'group:administrators'.
|
|
# Configurable, donc immediate et sans requete SQL.
|
|
raw = settings.get('auth.admin_emails', '')
|
|
return [item.strip() for item in raw.replace(',', ' ').split() if item.strip()]
|
|
|
|
|
|
def main(global_config, **settings):
|
|
""" This function returns a Pyramid WSGI application.
|
|
"""
|
|
google = read_google_settings(settings)
|
|
settings['google.client_id'] = google['google.client_id']
|
|
settings['google.client_secret'] = google['google.client_secret']
|
|
|
|
admins = admin_emails(settings)
|
|
callback = make_groupfinder(admins)
|
|
|
|
# Le cookie porte l'identite : il doit etre protege contre le vol par XSS
|
|
# (httponly) et envoye en TLS seulement en production (secure).
|
|
secure = settings.get('session.cookie_secure', 'false').strip().lower() \
|
|
in ('true', '1', 'yes', 'on')
|
|
|
|
my_session_factory = SignedCookieSessionFactory(
|
|
SESSION_SECRET,
|
|
timeout=SESSION_TIMEOUT,
|
|
httponly=True,
|
|
secure=secure,
|
|
)
|
|
|
|
authentication_policy = SessionAuthenticationPolicy(callback=callback)
|
|
authorization_policy = ACLAuthorizationPolicy()
|
|
with Configurator(settings=settings,
|
|
root_factory='ctp_blogr.security.RootFactory',
|
|
authentication_policy=authentication_policy,
|
|
authorization_policy=authorization_policy) as config:
|
|
config.include('pyramid_jinja2')
|
|
config.include('.models')
|
|
config.include('.routes')
|
|
config.include('.services.google_oauth')
|
|
config.set_session_factory(my_session_factory)
|
|
config.scan()
|
|
return config.make_wsgi_app()
|