3 |
3 |
4 |
5 | # Welcome to BounCA - Personal Key Management
6 |
7 | ## Contributing
8 |
9 |
10 | ## Bug Reports & Feature Requests
11 |
12 | Please use the [issue tracker](https://gitlab.com/bounca/bounca/-/issues) to report any bugs or file feature requests.
13 |
14 | ## Contributing
15 |
16 | 1. Create an issue and describe your idea
17 | 2. Create your feature branch (`git checkout -b my-new-feature`)
18 | 3. Commit your changes (`git commit -am 'Add some feature'`)
19 | 4. Publish the branch (`git push origin my-new-feature`)
20 | 5. Create a new Pull Request
21 | 6. Thanks!
22 |
23 | ## License
24 |
25 | Apache License v2 - (c) 2016-2022, Repleo, Amstelveen
26 |
27 | ## Author Information
28 |
29 | Jeroen Arnoldus (jeroen@repleo.nl)
30 |
31 | [Repleo](https://www.repleo.nl), Amsterdam, Holland -- www.repleo.nl
32 |
33 |
34 |
--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
1 | PYTHON_FOLDERS = api bounca certificate_engine vuetifyforms x509_pki superuser_signup
2 | LOCAL_SERVER_PORT ?= 8000
3 |
4 | default:
5 | @echo "No default target!"
6 |
7 | frontend_collect:
8 | python manage.py collectstatic --link --noinput
9 |
10 | runserver:
11 | python manage.py runserver 0.0.0.0:$(LOCAL_SERVER_PORT)
12 |
13 | quality: flake8 black_check isort_check
14 |
15 | isort_check:
16 | find $(PYTHON_FOLDERS) -path '**/migrations' -prune -o -name '*.py' -print | xargs isort -c
17 |
18 | isort_fix:
19 | find $(PYTHON_FOLDERS) -path '**/migrations' -prune -o -name '*.py' -print | xargs isort
20 |
21 | flake8:
22 | flake8 $(PYTHON_FOLDERS)
23 |
24 | black_fix:
25 | black .
26 |
27 | black_check:
28 | black --check .
29 |
30 | website:
31 | $(MAKE) -C ./docs html
32 |
33 | runwebsiteserver:
34 | python3 -m http.server -d ./docs/build/html 8090
35 |
36 | createvueforms:
37 | python3 manage.py generate_forms
38 |
39 | docserver:
40 | python3 -m http.server --directory ./docs/build/html 8090
41 |
42 | update-python-packages:
43 | pur
44 |
45 | migrate:
46 | python manage.py migrate
47 |
--------------------------------------------------------------------------------
/api/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/repleo/bounca/fdd52ea3d16173040152a19a0dd61287c01ee674/api/__init__.py
--------------------------------------------------------------------------------
/api/admin.py:
--------------------------------------------------------------------------------
1 | from django.contrib import admin
2 | from django.forms import BooleanField, ModelForm
3 |
4 | from . import utils
5 | from .models import AuthorisedApp
6 |
7 |
8 | class AuthorisedAppForm(ModelForm):
9 | generate_new_token = BooleanField(required=False, initial=False)
10 |
11 | class Meta:
12 | model = AuthorisedApp
13 | fields = "__all__"
14 |
15 | def __init__(self, *args, **kwargs):
16 | super(AuthorisedAppForm, self).__init__(*args, **kwargs)
17 | self.fields["token"].disabled = not self.current_user.is_superuser
18 | self.fields["token"].required = False
19 |
20 | def clean(self):
21 | if self.cleaned_data.get("generate_new_token", False):
22 | self.cleaned_data["token"] = utils.new_token(44)
23 | return self.cleaned_data
24 |
25 | def save(self, commit=True):
26 | obj = super(AuthorisedAppForm, self).save(commit=False)
27 | obj.save(commit)
28 | if commit:
29 | obj.save()
30 | obj.save_m2m()
31 | return obj
32 |
33 |
34 | @admin.register(AuthorisedApp)
35 | class AppAdmin(admin.ModelAdmin):
36 | form = AuthorisedAppForm
37 | list_display = ("name", "token")
38 |
39 | def get_form(self, request, obj=None, **kwargs):
40 | form = super(AppAdmin, self).get_form(request, obj, **kwargs)
41 | form.current_user = request.user
42 | return form
43 |
--------------------------------------------------------------------------------
/api/apps.py:
--------------------------------------------------------------------------------
1 | """Api name"""
2 |
3 | from django.apps import AppConfig
4 |
5 |
6 | class ApiConfig(AppConfig):
7 | name = "api"
8 |
--------------------------------------------------------------------------------
/api/auth/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/repleo/bounca/fdd52ea3d16173040152a19a0dd61287c01ee674/api/auth/__init__.py
--------------------------------------------------------------------------------
/api/auth/adapter.py:
--------------------------------------------------------------------------------
1 | from allauth.account.adapter import DefaultAccountAdapter
2 | from allauth.utils import build_absolute_uri
3 | from rest_framework.reverse import reverse
4 |
5 |
6 | class DefaultAccountAdapterFrontendHost(DefaultAccountAdapter):
7 | def get_email_confirmation_url(self, request, emailconfirmation):
8 | """Constructs the email confirmation (activation) url.
9 |
10 | Note that if you have architected your system such that email
11 | confirmations are sent outside of the request context `request`
12 | can be `None` here.
13 | """
14 | url = reverse("account_confirm_email", args=[emailconfirmation.key])
15 | ret = build_absolute_uri(None, url)
16 | return ret
17 |
--------------------------------------------------------------------------------
/api/auth/serializers.py:
--------------------------------------------------------------------------------
1 | from dj_rest_auth.serializers import PasswordResetSerializer
2 | from django.conf import settings
3 |
4 |
5 | class PasswordResetSerializerFrontendHost(PasswordResetSerializer):
6 | """
7 | Serializer for requesting a password reset e-mail.
8 | """
9 |
10 | def save(self):
11 | if "allauth" in settings.INSTALLED_APPS:
12 | from allauth.account.forms import default_token_generator
13 | else:
14 | from django.contrib.auth.tokens import default_token_generator
15 |
16 | request = self.context.get("request")
17 | # Set some values to trigger the send_email method.
18 | opts = {
19 | "use_https": request.is_secure(),
20 | "from_email": getattr(settings, "DEFAULT_FROM_EMAIL"),
21 | "request": None, # None triggers to use the host from site object
22 | "token_generator": default_token_generator,
23 | }
24 |
25 | opts.update(self.get_email_options())
26 | self.reset_form.save(**opts)
27 |
--------------------------------------------------------------------------------
/api/authentication.py:
--------------------------------------------------------------------------------
1 | from functools import wraps
2 |
3 | from django.core.cache import cache
4 | from rest_framework.authentication import BaseAuthentication
5 |
6 | from api.models import AuthorisedApp
7 |
8 | KEYS_TTL = 1800
9 |
10 |
11 | def cache_value(func):
12 | @wraps(func)
13 | def new_func(self, app_token, *args, **kwargs):
14 | key = f":app_auth:authorised_app:{app_token}:"
15 | data = cache.get(key)
16 | if data is None:
17 | data = func(self, app_token, *args, **kwargs)
18 | cache.set(key, data, KEYS_TTL)
19 |
20 | return data
21 |
22 | return new_func
23 |
24 |
25 | class AppTokenAuthentication(BaseAuthentication):
26 | def authenticate(self, request):
27 | # The tokens to set: X-AUTH-TOKEN or X-USER-AUTH-TOKEN
28 | app_token = request.META.get("HTTP_X_AUTH_TOKEN")
29 | user_token = request.META.get("HTTP_X_USER_AUTH_TOKEN")
30 | app = self.authorised_app_for_token(app_token)
31 | if app:
32 | return app.user, AuthData(app_token, user_token)
33 | else:
34 | return None
35 |
36 | # @cache_value
37 | def authorised_app_for_token(self, app_token):
38 | return AuthorisedApp.objects.filter(token=app_token).first()
39 |
40 |
41 | class AuthData(object):
42 | """
43 | We store important data connected to the authorisation step in
44 | this object and we store this object to the request object so
45 | that the data here can be used through the view and related classes.
46 | """
47 |
48 | def __init__(self, app_token, user_token):
49 | self.app_token = app_token
50 | self.user_token = user_token
51 |
--------------------------------------------------------------------------------
/api/filters.py:
--------------------------------------------------------------------------------
1 | from typing import List, Optional, Tuple
2 |
3 | from django.db import models
4 | from rest_framework import filters
5 |
6 | # Code fragment from https://github.com/encode/django-rest-framework/issues/1005
7 |
8 |
9 | class RelatedOrderingFilter(filters.OrderingFilter):
10 | _max_related_depth = 3
11 |
12 | @staticmethod
13 | def _get_verbose_name(field: models.Field, non_verbose_name: str) -> str:
14 | return str(field.verbose_name) if hasattr(field, "verbose_name") else non_verbose_name.replace("_", " ")
15 |
16 | def _retrieve_all_related_fields(
17 | self, fields: Tuple[models.Field], model: models.Model, depth: int = 0
18 | ) -> List[Tuple[str, str]]:
19 | valid_fields: List[Tuple[str, str]] = []
20 | if depth > self._max_related_depth:
21 | return valid_fields
22 | for field in fields:
23 | if field.related_model and field.related_model != model:
24 | rel_fields = self._retrieve_all_related_fields(
25 | field.related_model._meta.get_fields(), field.related_model, depth + 1
26 | )
27 | for rel_field in rel_fields:
28 | valid_fields.append((f"{field.name}__{rel_field[0]}", self._get_verbose_name(field, rel_field[1])))
29 | else:
30 | valid_fields.append(
31 | (
32 | field.name,
33 | self._get_verbose_name(field, field.name),
34 | )
35 | )
36 | return valid_fields
37 |
38 | def get_valid_fields(
39 | self, queryset: models.QuerySet, view, context: Optional[dict] = None
40 | ) -> List[Tuple[str, str]]:
41 | ordering_fields = getattr(view, "ordering_fields", self.ordering_fields)
42 | valid_fields: List[Tuple[str, str]]
43 | if not ordering_fields == "__all_related__":
44 | if not context:
45 | context = {}
46 | valid_fields = super().get_valid_fields(queryset, view, context)
47 | else:
48 | valid_fields = [
49 | *self._retrieve_all_related_fields(queryset.model._meta.get_fields(), queryset.model),
50 | *[(key, key.title().split("__")) for key in queryset.query.annotations],
51 | ]
52 | return valid_fields
53 |
--------------------------------------------------------------------------------
/api/migrations/0001_initial.py:
--------------------------------------------------------------------------------
1 | # Generated by Django 4.0.4 on 2022-05-26 20:35
2 |
3 | import django.db.models.deletion
4 | from django.conf import settings
5 | from django.db import migrations, models
6 |
7 |
8 | class Migration(migrations.Migration):
9 |
10 | initial = True
11 |
12 | dependencies = [
13 | ('x509_pki', '0004_alter_certificate_type'),
14 | migrations.swappable_dependency(settings.AUTH_USER_MODEL),
15 | ]
16 |
17 | operations = [
18 | migrations.CreateModel(
19 | name='Scope',
20 | fields=[
21 | ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
22 | ('access', models.CharField(choices=[('RCRL', 'Read CRL of root and intermediate certificates'), ('RCERT', 'Read root and intermediate certificates'), ('RISSUED', 'Read issued certificates, including private key')], max_length=7)),
23 | ('certificate', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='x509_pki.certificate')),
24 | ('owner', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL)),
25 | ],
26 | options={
27 | 'ordering': ['owner', 'certificate', 'access'],
28 | 'unique_together': {('owner', 'access', 'certificate')},
29 | },
30 | ),
31 | migrations.CreateModel(
32 | name='AuthorisedApp',
33 | fields=[
34 | ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
35 | ('name', models.TextField(unique=True)),
36 | ('token', models.TextField(unique=True)),
37 | ('owner', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to=settings.AUTH_USER_MODEL)),
38 | ('scopes', models.ManyToManyField(to='api.scope')),
39 | ],
40 | options={
41 | 'ordering': ['name'],
42 | },
43 | ),
44 | ]
45 |
--------------------------------------------------------------------------------
/api/migrations/0002_remove_authorisedapp_scopes_delete_scope.py:
--------------------------------------------------------------------------------
1 | # Generated by Django 4.0.4 on 2022-05-28 06:55
2 |
3 | from django.db import migrations
4 |
5 |
6 | class Migration(migrations.Migration):
7 |
8 | dependencies = [
9 | ('api', '0001_initial'),
10 | ]
11 |
12 | operations = [
13 | migrations.RemoveField(
14 | model_name='authorisedapp',
15 | name='scopes',
16 | ),
17 | migrations.DeleteModel(
18 | name='Scope',
19 | ),
20 | ]
21 |
--------------------------------------------------------------------------------
/api/migrations/0003_rename_owner_authorisedapp_user.py:
--------------------------------------------------------------------------------
1 | # Generated by Django 4.0.4 on 2022-05-28 06:58
2 |
3 | from django.db import migrations
4 |
5 |
6 | class Migration(migrations.Migration):
7 |
8 | dependencies = [
9 | ('api', '0002_remove_authorisedapp_scopes_delete_scope'),
10 | ]
11 |
12 | operations = [
13 | migrations.RenameField(
14 | model_name='authorisedapp',
15 | old_name='owner',
16 | new_name='user',
17 | ),
18 | ]
19 |
--------------------------------------------------------------------------------
/api/migrations/0004_alter_authorisedapp_name_and_more.py:
--------------------------------------------------------------------------------
1 | # Generated by Django 4.0.4 on 2022-06-18 22:28
2 |
3 | from django.conf import settings
4 | from django.db import migrations, models
5 |
6 |
7 | class Migration(migrations.Migration):
8 |
9 | dependencies = [
10 | migrations.swappable_dependency(settings.AUTH_USER_MODEL),
11 | ('api', '0003_rename_owner_authorisedapp_user'),
12 | ]
13 |
14 | operations = [
15 | migrations.AlterField(
16 | model_name='authorisedapp',
17 | name='name',
18 | field=models.TextField(),
19 | ),
20 | migrations.AlterUniqueTogether(
21 | name='authorisedapp',
22 | unique_together={('name', 'user')},
23 | ),
24 | ]
25 |
--------------------------------------------------------------------------------
/api/migrations/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/repleo/bounca/fdd52ea3d16173040152a19a0dd61287c01ee674/api/migrations/__init__.py
--------------------------------------------------------------------------------
/api/mixins.py:
--------------------------------------------------------------------------------
1 | """Create serializer validation errors from django validation errors for automatic handling"""
2 |
3 | from django.core.exceptions import ValidationError as DjangoValidationError
4 | from rest_framework import serializers
5 |
6 | from certificate_engine.ssl.certificate import PolicyError
7 |
8 |
9 | class TrapDjangoValidationErrorCreateMixin(object):
10 | def perform_create(self, serializer):
11 | try:
12 | serializer.save()
13 | except DjangoValidationError as detail:
14 | raise serializers.ValidationError({"non_field_errors": detail.messages})
15 | except PolicyError as detail:
16 | raise serializers.ValidationError(detail.args[0])
17 |
18 |
19 | class TrapDjangoValidationErrorUpdateMixin(object):
20 | def perform_update(self, serializer):
21 | try:
22 | serializer.save()
23 | except DjangoValidationError as detail:
24 | raise serializers.ValidationError({"non_field_errors": detail.messages})
25 | except PolicyError as detail:
26 | raise serializers.ValidationError(detail.args[0])
27 |
--------------------------------------------------------------------------------
/api/models.py:
--------------------------------------------------------------------------------
1 | from django.contrib.auth.models import User
2 | from django.db import models
3 |
4 | from api import utils
5 |
6 |
7 | class AuthorisedApp(models.Model):
8 | name = models.TextField()
9 | token = models.TextField(unique=True)
10 | user = models.ForeignKey(User, on_delete=models.PROTECT)
11 |
12 | class Meta:
13 | ordering = ["name"]
14 | unique_together = ("name", "user")
15 |
16 | def save(self, *args, **kwargs):
17 | if not self.id:
18 | self.token = utils.new_token(44)
19 | super(AuthorisedApp, self).save(*args, **kwargs)
20 |
21 | def __str__(self):
22 | return "{} - {}".format(self.name, self.token)
23 |
--------------------------------------------------------------------------------
/api/permissions.py:
--------------------------------------------------------------------------------
1 | """Permission classes for retrieving certificates"""
2 |
3 | from rest_framework import permissions
4 |
5 |
6 | class BounCAUserPermissions(permissions.BasePermission):
7 | def has_permission(self, request, view):
8 | if view.action == "list":
9 | return request.user.is_admin
10 | elif view.action == "retrieve":
11 | return True
12 | else:
13 | return False
14 |
15 | def has_object_permission(self, request, view, obj):
16 | if view.action == "retrieve":
17 | return request.user.is_admin or obj == request.user
18 | else:
19 | return False
20 |
--------------------------------------------------------------------------------
/api/templates/rest_framework/api.html:
--------------------------------------------------------------------------------
1 | {% extends "rest_framework/base.html" %}
2 |
3 |
4 | {% block title %}BounCA API{% endblock %}
5 |
6 | {% block branding %}
7 | BounCA API
8 |
9 | Admin
10 |
11 | {% endblock %}
12 |
--------------------------------------------------------------------------------
/api/templates/rest_framework/login.html:
--------------------------------------------------------------------------------
1 | {% extends "rest_framework/login_base.html" %}
2 |
3 | {% block branding %}
4 |