mirror of
https://git.selfprivacy.org/SelfPrivacy/selfprivacy-rest-api.git
synced 2024-09-19 15:07:51 +00:00
ceee6e4db9
Websockets do not provide headers, and sending a token as a query param is also not good (it gets into server's logs), As an alternative, we can provide a token in the first ws payload. Read more: https://strawberry.rocks/docs/general/subscriptions#authenticating-subscriptions
26 lines
945 B
Python
26 lines
945 B
Python
"""GraphQL API for SelfPrivacy."""
|
|
# pylint: disable=too-few-public-methods
|
|
import typing
|
|
from strawberry.permission import BasePermission
|
|
from strawberry.types import Info
|
|
|
|
from selfprivacy_api.actions.api_tokens import is_token_valid
|
|
|
|
|
|
class IsAuthenticated(BasePermission):
|
|
"""Is authenticated permission"""
|
|
|
|
message = "You must be authenticated to access this resource."
|
|
|
|
def has_permission(self, source: typing.Any, info: Info, **kwargs) -> bool:
|
|
token = info.context["request"].headers.get("Authorization")
|
|
if token is None:
|
|
token = info.context["request"].query_params.get("token")
|
|
if token is None:
|
|
connection_params = info.context.get("connection_params")
|
|
if connection_params is not None:
|
|
token = connection_params.get("Authorization")
|
|
if token is None:
|
|
return False
|
|
return is_token_valid(token.replace("Bearer ", ""))
|