ticketfrei/frontend/website.py

368 lines
13 KiB
Python

#!/usr/bin/env python3
import os
import base64
import bottle
import sqlite3
import sendmail
import pytoml as toml
import jwt
import pylibscrypt
import smtplib
import tweepy
from mastodon import Mastodon
# from bottle_auth import AuthPlugin
class Datagetter(object):
def __init__(self):
self.db = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "ticketfrei.sqlite")
self.conn = self.create_connection(self.db)
self.cur = self.conn.cursor()
def create_connection(self, db_file):
""" create a database connection to the SQLite database
specified by the db_file
:param db_file: database file
:return: Connection object or None
"""
try:
conn = sqlite3.connect(db_file)
return conn
except sqlite3.Error as e:
print(e)
return None
app = application = bottle.Bottle()
@app.route('/login', method="POST")
def login():
"""
Login to the ticketfrei account with credentials from the user table.
:return: bot.py Session Cookie
"""
email = bottle.request.forms.get('uname')
psw = bottle.request.forms.get('psw')
psw = psw.encode("utf-8")
db.cur.execute("SELECT pass_hashed FROM user WHERE email=?;", (email, ))
try:
pass_hashed = db.cur.fetchone()[0]
except TypeError:
return "Wrong Credentials." # no user with this email
if pylibscrypt.scrypt_mcf_check(pass_hashed, psw):
bottle.response.set_cookie("account", email, secret)
return bottle.redirect("/settings")
else:
return "Wrong Credentials." # passphrase is wrong
@app.route('/register', method="POST")
def register():
"""
Login to the ticketfrei account with credentials from the user table.
:return: bot.py Session Cookie
"""
email = bottle.request.forms.get('email')
psw = bottle.request.forms.get('psw')
pswrepeat = bottle.request.forms.get('psw-repeat')
if pswrepeat != psw:
return "ERROR: Passwords don't match. Try again."
# check if email is already in use
db.cur.execute("SELECT id FROM user WHERE email=?;", (email,))
if db.cur.fetchone() is not None:
return "E-Mail is already in use." # account already exists
# hash and format for being encoded in the confirmation mail
psw = psw.encode("utf-8")
pass_hashed = pylibscrypt.scrypt_mcf(psw) # hash password
pass_hashed = base64.encodebytes(pass_hashed)
pass_hashed = pass_hashed.decode("ascii")
payload = {"email": email, "pass_hashed": pass_hashed}
# create confirm_link
encoded_jwt = jwt.encode(payload, secret).decode('utf-8')
confirm_link = "http://" + bottle.request.get_header('host') + "/confirm/" + str(encoded_jwt) # :todo http -> https
# send the mail
m = sendmail.Mailer(config)
try:
m.send("Complete your registration here: " + confirm_link, email, "[Ticketfrei] Confirm your account")
except smtplib.SMTPRecipientsRefused:
return "Please enter a valid E-Mail address."
return "We sent you an E-Mail. Please click on the confirmation link."
@app.route('/confirm/<encoded_jwt>', method="GET")
def confirm_account(encoded_jwt):
"""
Confirm the account creation and create a database entry.
:return: Redirection to bot.html
"""
# get values from URL
payload = jwt.decode(encoded_jwt, secret)
email = payload["email"]
pass_hashed = base64.b64decode(payload["pass_hashed"])
# create db entry
db.cur.execute("INSERT INTO user(email, pass_hashed, enabled) VALUES(?, ?, ?);", (email, pass_hashed, 1))
# insert default good- & blacklist into db
with open(os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "goodlists", "nbg_goodlist"),
"r") as f:
default_goodlist = f.read()
db.cur.execute("INSERT INTO trigger_good(user_id, words) VALUES(?, ?);", (get_user_id(email), default_goodlist))
with open(os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "blacklists", "nbg_blacklist"),
"r") as f:
default_blacklist = f.read()
db.cur.execute("INSERT INTO trigger_bad(user_id, words) VALUES(?, ?);", (get_user_id(email), default_blacklist))
db.conn.commit()
bottle.response.set_cookie("account", email, secret, path="/")
return bottle.redirect("/settings")
@app.route('/settings')
def manage_bot():
"""
Restricted area. Deliver the bot settings page.
Deliver user settings with Cookies.
:return: If it returns something, it just refreshes the page.
"""
email = bottle.request.get_cookie("account", secret=secret)
if email is not None:
user_id = get_user_id(email)
# get Enable Status from db
db.cur.execute("SELECT enabled FROM user WHERE email = ?;", (email,))
enabled = db.cur.fetchone()[0]
# Set Enable Status with a Cookie
resp = bottle.static_file("../static/bot.html", root='../static')
if enabled:
resp.set_cookie("enabled", "True")
else:
resp.set_cookie("enabled", "False")
# Get goodlist from db
db.cur.execute("SELECT words FROM trigger_good WHERE user_id=?;", (user_id,))
words = db.cur.fetchone()[0]
# Deliver goodlist with a Cookie
resp.set_cookie("goodlist", words, path="/settings")
# Get blacklist from db
db.cur.execute("SELECT words FROM trigger_bad WHERE user_id=?;", (user_id,))
words = db.cur.fetchone()[0]
# Deliver badlist with a Cookie
resp.set_cookie("blacklist", words, path="/settings")
return resp
else:
bottle.abort(401, "Wrong username or passphrase. Try again!")
def get_user_id(email):
# get user_id from email
db.cur.execute("SELECT id FROM user WHERE email = ?", (email, ))
return db.cur.fetchone()[0]
@app.route('/settings/goodlist', method="POST")
def update_goodlist():
"""
Writes the goodlist textarea on /settings to the database.
This function expects a multi-line string, transmitted over the textarea form.
:return: redirect to settings page
"""
# get new goodlist
words = bottle.request.forms.get("goodlist")
user_id = get_user_id(bottle.request.get_cookie("account", secret=secret))
# write new goodlist to db
db.cur.execute("UPDATE trigger_good SET words = ? WHERE user_id = ?;", (words, user_id, ))
db.conn.commit()
return bottle.redirect("/settings")
@app.route('/settings/blacklist', method="POST")
def update_blacklist():
"""
Writes the blacklist textarea on /settings to the database.
This function expects a multi-line string, transmitted over the textarea form.
:return: redirect to settings page
"""
# get new blacklist
words = bottle.request.forms.get("blacklist")
# get user_id
user_id = get_user_id(bottle.request.get_cookie("account", secret=secret))
# write new goodlist to db
db.cur.execute("UPDATE trigger_bad SET words = ? WHERE user_id = ?;", (words, user_id, ))
db.conn.commit()
return bottle.redirect("/settings")
@app.route('/enable', method="POST")
def enable():
"""
Enable the bot. Called by the Enable button in bot.html
:return: redirect to settings page
"""
email = bottle.request.get_cookie("account", secret=secret)
db.cur.execute("UPDATE user SET enabled = 1 WHERE email=?;", (email,))
db.conn.commit()
bottle.response.set_cookie("enabled", "True")
return bottle.redirect("/settings")
@app.route('/disable', method="POST")
def disable():
"""
Disable the bot. Called by the Disable button in bot.html
:return: redirect to settings page
"""
email = bottle.request.get_cookie("account", secret=secret)
db.cur.execute("UPDATE user SET enabled = 0 WHERE email=?;", (email,))
db.conn.commit()
bottle.response.set_cookie("enabled", "False")
return bottle.redirect("/settings")
@app.route('/login/twitter')
def login_twitter():
"""
Starts the twitter OAuth authentication process.
:return: redirect to twitter.
"""
email = bottle.request.get_cookie("account", secret=secret)
consumer_key = config["tapp"]["consumer_key"]
consumer_secret = config["tapp"]["consumer_secret"]
callback_url = host + "/login/twitter/callback"
auth = tweepy.OAuthHandler(consumer_key, consumer_secret, callback_url)
try:
redirect_url = auth.get_authorization_url()
except tweepy.TweepError:
return 'Error! Failed to get request token.'
db.cur.execute("INSERT INTO twitter_request_tokens(user_id, request_token) VALUES(?, ?);", (get_user_id(email), auth.request_token))
db.conn.commit()
return bottle.redirect(redirect_url)
@app.route('/login/twitter/callback')
def twitter_callback():
"""
Gets the callback
:return:
"""
# twitter passes the verifier/oauth token secret in a GET request.
verifier = bottle.request.query('oauth_verifier')
email = bottle.request.get_cookie("account", secret=secret)
consumer_key = config["tapp"]["consumer_key"]
consumer_secret = config["tapp"]["consumer_secret"]
auth = tweepy.OAuthHandler(consumer_key, consumer_secret)
db.cur.execute("SELECT request_token FROM twitter_request_tokens WHERE user_id = ?;", (get_user_id(email)))
try:
request_token = db.cur.fetchone()[0]
except ValueError:
return "Could not get request token from db."
db.cur.execute("DELETE FROM twitter_request_tokens WHERE user_id = ?;", (get_user_id(email)))
db.conn.commit()
auth.request_token = { "oauth_token" : request_token,
"oauth_token_secret" : verifier}
try:
auth.get_access_token(verifier)
except tweepy.TweepError:
print('Error! Failed to get access token.')
db.cur.execute("INSERT INTO twitter_accounts(user_id, access_token_key, access_token_secret) VALUES(?, ?, ?);",
(get_user_id(email), auth.access_token, auth.access_token_secret))
db.conn.commit()
return bottle.redirect("/settings")
@app.route('/login/mastodon', method="POST")
def login_mastodon():
"""
Starts the mastodon OAuth authentication process.
:return: redirect to twitter.
"""
email = bottle.request.get_cookie("account", secret=secret)
# get app tokens
instance_url = bottle.request.forms.get('instance_url')
db.cur.execute("SELECT client_id, client_secret FROM mastodon_instances WHERE instance = ?;", (instance_url))
try:
client_id, client_secret = db.cur.fetchone()[0]
except TypeError:
id = "ticketfrei" + str(secret)[0:4]
client_id, client_secret = Mastodon.create_app(id, api_base_url=instance_url)
db.cur.execute("INSERT INTO mastodon_instances(instance, client_id, client_secret) VALUES(?, ?, ?);",
(instance_url, client_id, client_secret))
db.conn.commit()
# get access token and write it to db
uname = bottle.request.forms.get('uname')
psw = bottle.request.forms.get('psw')
mastodon = Mastodon(
client_id=client_id,
client_secret=client_secret,
api_base_url=instance_url
)
access_token = mastodon.log_in(uname, psw)
db.cur.execute("SELECT id FROM mastodon_instances WHERE instance = ?;", (instance_url))
instance_id = db.cur.fetchone()[0]
db.cur.execute("INSERT INTO mastodon_accounts(user_id, access_token, instance_id, active) VALUES(?, ?, ?, ?);",
(get_user_id(email), access_token, instance_id, 1))
return bottle.redirect("/settings")
@app.route('/static/<filename:path>')
def static(filename):
"""
Serve static files
"""
if filename == "bot.html":
bottle.abort(401, "Sorry, access denied.")
return bottle.static_file(filename, root='../static')
@app.route('/')
def show_index():
"""
The front "index" page
:return: /static/index.html
"""
return bottle.static_file("../static/index.html", root='../static')
class StripPathMiddleware(object):
"""
Get that slash out of the request
"""
def __init__(self, a):
self.a = a
def __call__(self, e, h):
e['PATH_INFO'] = e['PATH_INFO'].rstrip('/')
return self.a(e, h)
if __name__ == "__main__":
global config
with open('../config.toml') as configfile:
config = toml.load(configfile)
global db
global secret
global twitter
secret = os.urandom(32)
db = Datagetter()
host = '0.0.0.0'
# from bottle_auth.social import twitter as twitterplugin
# callback_url = host + '/login/twitter/callback'
# twitter = twitterplugin.Twitter(config['tapp']['consumer_key'], config['tapp']['consumer_secret'], callback_url)
# bottle.install(AuthPlugin(twitter))
try:
bottle.run(app=StripPathMiddleware(app), host=host, port=8080)
finally:
db.conn.close()