Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Upgrade DOT to 1.1.2."

Browse Source 
There was an issue with migrations on sandboxes.

This reverts commit 58f6e92
This commit is contained in:
Robert Raposa
2018-07-12 13:12:09 -04:00
parent d5984de2d2
commit 4d8b9c36ae
11 changed files with 56 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
openedx/core/djangoapps/oauth_dispatch/dot_overrides/backends.py
View File

@@ -1,18 +0,0 @@
"""
Custom authentication backends.
"""
from django.contrib.auth.backends import AllowAllUsersModelBackend as UserModelBackend
from ratelimitbackend.backends import RateLimitMixin
class EdxRateLimitedAllowAllUsersModelBackend(RateLimitMixin, UserModelBackend):
"""
Authentication backend needed to incorporate rate limiting of login attempts - but also
enabling users with is_active of False in the Django auth_user model to still authenticate.
This is necessary for mobile users using 3rd party auth who have not activated their accounts,
Inactive users who use 1st party auth (username/password auth) will still fail login attempts,
just at a higher layer, in the login_user view.
See: https://openedx.atlassian.net/browse/TNL-4516
"""
pass

15
openedx/core/djangoapps/oauth_dispatch/dot_overrides/validators.py
View File

@@ -6,12 +6,14 @@ from __future__ import unicode_literals
from datetime import datetime
from django.contrib.auth import authenticate, get_user_model
from django.contrib.auth.backends import AllowAllUsersModelBackend as UserModelBackend
from django.db.models.signals import pre_save
from django.dispatch import receiver
from oauth2_provider.models import AccessToken
from oauth2_provider.oauth2_validators import OAuth2Validator
from oauth2_provider.scopes import get_scopes_backend
from pytz import utc
from ratelimitbackend.backends import RateLimitMixin
from ..models import RestrictedApplication
@@ -25,6 +27,19 @@ def on_access_token_presave(sender, instance, *args, **kwargs): # pylint: disab
instance.expires = datetime(1970, 1, 1, tzinfo=utc)
class EdxRateLimitedAllowAllUsersModelBackend(RateLimitMixin, UserModelBackend):
"""
Authentication backend needed to incorporate rate limiting of login attempts - but also
enabling users with is_active of False in the Django auth_user model to still authenticate.
This is necessary for mobile users using 3rd party auth who have not activated their accounts,
Inactive users who use 1st party auth (username/password auth) will still fail login attempts,
just at a higher layer, in the login_user view.
See: https://openedx.atlassian.net/browse/TNL-4516
"""
pass
class EdxOAuth2Validator(OAuth2Validator):
"""
Validator class that implements edX-specific custom behavior:

9
openedx/core/djangoapps/oauth_dispatch/dot_overrides/views.py
View File

@@ -5,7 +5,7 @@ from __future__ import unicode_literals
from oauth2_provider.exceptions import OAuthToolkitError
from oauth2_provider.http import HttpResponseUriRedirect
from oauth2_provider.models import get_access_token_model, get_application_model
from oauth2_provider.models import get_application_model
from oauth2_provider.scopes import get_scopes_backend
from oauth2_provider.settings import oauth2_settings
from oauth2_provider.views import AuthorizationView
@@ -69,12 +69,11 @@ class EdxOAuth2AuthorizationView(AuthorizationView):
uri, headers, body, status = self.create_authorization_response(
request=self.request, scopes=" ".join(scopes),
credentials=credentials, allow=True)
return HttpResponseUriRedirect(uri, application.get_allowed_schemes())
return HttpResponseUriRedirect(uri)
# *** Changed the if statement that checked for require_approval to an assert.
assert require_approval == 'auto_even_if_expired'
tokens = get_access_token_model().objects.filter(
user=request.user,
tokens = request.user.accesstoken_set.filter(
application=kwargs['application'],
# *** Purposefully keeping this commented out code to highlight that
# our version of the implementation does NOT filter by expiration date.
@@ -87,7 +86,7 @@ class EdxOAuth2AuthorizationView(AuthorizationView):
uri, headers, body, status = self.create_authorization_response(
request=self.request, scopes=" ".join(scopes),
credentials=credentials, allow=True)
return HttpResponseUriRedirect(uri, application.get_allowed_schemes())
return HttpResponseUriRedirect(uri)
# render an authorization prompt so the user can approve
# the application's requested scopes

31
openedx/core/djangoapps/oauth_dispatch/tests/test_views.py
View File

@@ -613,39 +613,36 @@ class TestRevokeTokenView(AccessTokenLoginMixin, _DispatchingViewTestCase): # p
'token': token,
}
def assert_refresh_token_status_code(self, refresh_token, expected_status_code):
def _assert_refresh_token_invalidated(self):
"""
Asserts the status code using oauth assigned refresh_token
Asserts that oauth assigned refresh_token is not valid
"""
response = self.client.post(
self.access_token_url,
self.access_token_post_body_with_refresh_token(refresh_token)
self.access_token_post_body_with_refresh_token(self.refresh_token)
)
self.assertEqual(response.status_code, expected_status_code)
self.assertEqual(response.status_code, 401)
def revoke_token(self, token):
def verify_revoke_token(self, token):
"""
Revokes the passed access or refresh token
Verifies access of token before and after revoking
"""
self._assert_access_token_is_valid()
response = self.client.post(self.revoke_token_url, self.revoke_token_post_body(token))
self.assertEqual(response.status_code, 200)
self._assert_access_token_invalidated()
self._assert_refresh_token_invalidated()
def test_revoke_refresh_token_dot(self):
"""
Tests invalidation/revoke of refresh token for django-oauth-toolkit
Tests invalidation/revoke of user tokens against refresh token for django-oauth-toolkit
"""
self.assert_refresh_token_status_code(self.refresh_token, expected_status_code=200)
self.revoke_token(self.refresh_token)
self.assert_refresh_token_status_code(self.refresh_token, expected_status_code=401)
self.verify_revoke_token(self.refresh_token)
def test_revoke_access_token_dot(self):
"""
Tests invalidation/revoke of user access token for django-oauth-toolkit
"""
self._assert_access_token_is_valid(self.access_token)
self.revoke_token(self.access_token)
self._assert_access_token_invalidated(self.access_token)
self.verify_revoke_token(self.access_token)