
import bcrypt
from apps.auth.service import AuthService
from superdesk import get_resource_service
from superdesk.errors import CredentialsAuthError
from flask import current_app as app


class DbAuthService(AuthService):

    def authenticate(self, credentials):
        user = get_resource_service('auth_users').find_one(req=None, username=credentials.get('username'))
        if not user:
            raise CredentialsAuthError(credentials)

        password = credentials.get('password').encode('UTF-8')
        hashed = user.get('password').encode('UTF-8')

        if not (password and hashed):
            raise CredentialsAuthError(credentials)

        try:
            rehashed = bcrypt.hashpw(password, hashed)
            if hashed != rehashed:
                raise CredentialsAuthError(credentials)
        except ValueError:
            raise CredentialsAuthError(credentials)

        return user

    def on_deleted(self, doc):
        '''
        :param doc: A deleted auth doc AKA a session
        :return:
        '''
        # notify that the session has ended
        app.on_session_end(doc['user'], doc['_id'])


import bcrypt
from apps.auth.service import AuthService
from superdesk import get_resource_service
from superdesk.errors import CredentialsAuthError
from flask import g, current_app as app


class DbAuthService(AuthService):

    def authenticate(self, credentials):
        user = get_resource_service('auth_users').find_one(req=None, username=credentials.get('username'))
        if not user:
            raise CredentialsAuthError(credentials)

        password = credentials.get('password').encode('UTF-8')
        hashed = user.get('password').encode('UTF-8')

        if not (password and hashed):
            raise CredentialsAuthError(credentials)

        try:
            rehashed = bcrypt.hashpw(password, hashed)
            if hashed != rehashed:
                raise CredentialsAuthError(credentials)
        except ValueError:
            raise CredentialsAuthError(credentials)

        return user

    def on_deleted(self, doc):
        '''
        :param doc: A deleted auth doc AKA a session
        :return:
        '''
        # notify that the session has ended
        app.on_session_end(doc['user'], doc['_id'])

    def is_authorized(self, **kwargs):
        if kwargs.get("user_id") is None:
            return False

        auth = self.find_one(_id=kwargs.get("user_id"), req=None)
        return str(g.auth['_id']) == str(auth.get("_id"))

Check that the session is the right one
[SD-1422] Check that the session is the right one

  
  import bcrypt
  from apps.auth.service import AuthService
  from superdesk import get_resource_service
  from superdesk.errors import CredentialsAuthError
- from flask import current_app as app
+ from flask import g, current_app as app
  
  
  class DbAuthService(AuthService):
  
      def authenticate(self, credentials):
          user = get_resource_service('auth_users').find_one(req=None, username=credentials.get('username'))
          if not user:
              raise CredentialsAuthError(credentials)
  
          password = credentials.get('password').encode('UTF-8')
          hashed = user.get('password').encode('UTF-8')
  
          if not (password and hashed):
              raise CredentialsAuthError(credentials)
  
          try:
              rehashed = bcrypt.hashpw(password, hashed)
              if hashed != rehashed:
                  raise CredentialsAuthError(credentials)
          except ValueError:
              raise CredentialsAuthError(credentials)
  
          return user
  
      def on_deleted(self, doc):
          '''
          :param doc: A deleted auth doc AKA a session
          :return:
          '''
          # notify that the session has ended
          app.on_session_end(doc['user'], doc['_id'])
  
+     def is_authorized(self, **kwargs):
+         if kwargs.get("user_id") is None:
+             return False
+ 
+         auth = self.find_one(_id=kwargs.get("user_id"), req=None)
+         return str(g.auth['_id']) == str(auth.get("_id"))
+ 
Check that the session is the right one
## Code Before:

import bcrypt
from apps.auth.service import AuthService
from superdesk import get_resource_service
from superdesk.errors import CredentialsAuthError
from flask import current_app as app


class DbAuthService(AuthService):

    def authenticate(self, credentials):
        user = get_resource_service('auth_users').find_one(req=None, username=credentials.get('username'))
        if not user:
            raise CredentialsAuthError(credentials)

        password = credentials.get('password').encode('UTF-8')
        hashed = user.get('password').encode('UTF-8')

        if not (password and hashed):
            raise CredentialsAuthError(credentials)

        try:
            rehashed = bcrypt.hashpw(password, hashed)
            if hashed != rehashed:
                raise CredentialsAuthError(credentials)
        except ValueError:
            raise CredentialsAuthError(credentials)

        return user

    def on_deleted(self, doc):
        '''
        :param doc: A deleted auth doc AKA a session
        :return:
        '''
        # notify that the session has ended
        app.on_session_end(doc['user'], doc['_id'])

## Instruction:
Check that the session is the right one
## Code After:

import bcrypt
from apps.auth.service import AuthService
from superdesk import get_resource_service
from superdesk.errors import CredentialsAuthError
from flask import g, current_app as app


class DbAuthService(AuthService):

    def authenticate(self, credentials):
        user = get_resource_service('auth_users').find_one(req=None, username=credentials.get('username'))
        if not user:
            raise CredentialsAuthError(credentials)

        password = credentials.get('password').encode('UTF-8')
        hashed = user.get('password').encode('UTF-8')

        if not (password and hashed):
            raise CredentialsAuthError(credentials)

        try:
            rehashed = bcrypt.hashpw(password, hashed)
            if hashed != rehashed:
                raise CredentialsAuthError(credentials)
        except ValueError:
            raise CredentialsAuthError(credentials)

        return user

    def on_deleted(self, doc):
        '''
        :param doc: A deleted auth doc AKA a session
        :return:
        '''
        # notify that the session has ended
        app.on_session_end(doc['user'], doc['_id'])

    def is_authorized(self, **kwargs):
        if kwargs.get("user_id") is None:
            return False

        auth = self.find_one(_id=kwargs.get("user_id"), req=None)
        return str(g.auth['_id']) == str(auth.get("_id"))
