Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
# Use Basic Auth
if auth and project_id and auth.username == project_id:
project = Project.query.get(auth.username)
if project and check_password_hash(project.password, auth.password):
# The whole project object will be passed instead of project_id
kwargs.pop("project_id")
return f(*args, project=project, **kwargs)
else:
# Use Bearer token Auth
auth_header = request.headers.get("Authorization", "")
auth_token = ""
try:
auth_token = auth_header.split(" ")[1]
except IndexError:
abort(401)
project_id = Project.verify_token(auth_token, token_type="non_timed_token")
if auth_token and project_id:
project = Project.query.get(project_id)
if project:
kwargs.pop("project_id")
return f(*args, project=project, **kwargs)
abort(401)
def demo():
"""
Authenticate the user for the demonstration project and redirect him to
the bills list for this project.
Create a demo project if it doesn't exists yet (or has been deleted)
If the demo project is deactivated, one is redirected to the create project form
"""
is_demo_project_activated = current_app.config["ACTIVATE_DEMO_PROJECT"]
project = Project.query.get("demo")
if not project and not is_demo_project_activated:
raise Redirect303(url_for(".create_project", project_id="demo"))
if not project and is_demo_project_activated:
project = Project(
id="demo",
name="demonstration",
password=generate_password_hash("demo"),
contact_email="demo@notmyidea.org",
)
db.session.add(project)
db.session.commit()
session[project.id] = True
return redirect(url_for(".list_bills", project_id=project.id))
def get(self, project, id):
try:
return (
self.join(Person, Project)
.filter(Bill.payer_id == Person.id)
.filter(Person.project_id == Project.id)
.filter(Project.id == project.id)
.filter(Bill.id == id)
.one()
)
except orm.exc.NoResultFound:
return None
def validate_id(form, field):
if not Project.query.get(field.data):
raise ValidationError(_("This project does not exists"))
def save(self):
"""Create a new project with the information given by this form.
Returns the created instance
"""
project = Project(
name=self.name.data,
id=self.id.data,
password=generate_password_hash(self.password.data),
contact_email=self.contact_email.data,
)
return project
def get_member_bills(self, member_id):
"""Return the list of bills related to a specific member"""
return (
Bill.query.join(Person, Project)
.filter(Bill.payer_id == Person.id)
.filter(Person.project_id == Project.id)
.filter(Person.id == member_id)
.filter(Project.id == self.id)
.order_by(Bill.date.desc())
.order_by(Bill.id.desc())
)