run.py

# Copyright (C) 2016  Theoretical Physics, ETH Zurich
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

from flask import Flask, flash, redirect, render_template, \
     request, url_for, session
from flask_oauthlib.client import OAuth, parse_response
from wtforms import Form, TextField, validators, PasswordField
from wtforms.fields.html5 import EmailField
from wtforms.csrf.session import SessionCSRF

import requests, json
import string
import random
import smtplib
from email.mime.text import MIMEText
from email.header import Header

class ReverseProxied(object):
    '''Wrap the application in this middleware and configure the
    front-end server to add these headers, to let you quietly bind
    this to a URL other than / and to an HTTP scheme that is
    different than what is used locally.

    In nginx:
    location /myprefix {
        proxy_pass http://192.168.0.1:5001;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Script-Name /myprefix;
        }

    :param app: the WSGI application
    '''
    def __init__(self, app):
        self.app = app

    def __call__(self, environ, start_response):
        script_name = environ.get('HTTP_X_SCRIPT_NAME', '')
        if script_name:
            environ['SCRIPT_NAME'] = script_name
            path_info = environ['PATH_INFO']
            if path_info.startswith(script_name):
                environ['PATH_INFO'] = path_info[len(script_name):]

        scheme = environ.get('HTTP_X_SCHEME', '')
        if scheme:
            environ['wsgi.url_scheme'] = scheme
        return self.app(environ, start_response)

app = Flask(__name__)
app.config.from_pyfile('settings.cfg')
app.wsgi_app = ReverseProxied(app.wsgi_app)

app.secret_key = 'some_secret'

oauth = OAuth()
remote_app = oauth.remote_app('remote_app',
    base_url=app.config['GITLAB_BASE']+'/api/v3/',
    request_token_url=None,
    access_token_url=app.config['GITLAB_BASE']+'/oauth/token',
    authorize_url=app.config['GITLAB_BASE']+'/oauth/authorize',
    app_key='GITLAB',
    access_token_method='POST'
)
oauth.init_app(app)


@remote_app.tokengetter
def get_gitlab_token():
    return session.get('gitlab_token')


@app.route('/account')
def account():
    logged_in = get_gitlab_token() is not None
    next_url = request.args.get('next') or request.referrer
    user = session['gitlab_user'] if 'gitlab_user' in session else None
    return render_template('account.html', logged_in=logged_in, next_url=next_url, user=user)

@app.route('/account/login')
def login():
    return remote_app.authorize(callback=url_for('oauth_authorized', _external=True,
        next=request.args.get('next') or request.referrer or None))

@app.route('/account/logout')
def logout():
    session.clear()
    flash(u'You logged out successfully.')
    return redirect(url_for('account'))

@app.route('/oauth-authorized')
def oauth_authorized():
    resp = remote_app.authorized_response()
    next_url = request.args.get('next') or url_for('index')
    if resp is None:
        flash(u'You denied the request to sign in.')
        return redirect(next_url)

    r = remote_app.get('user', token=(resp['access_token'],''))
    if r.status != 200:
        flash(u'Request of /user information failed.', 'error')
        print r.text
        return redirect(next_url)

    user = r.data
    if user['external']:
        flash('The user %s is flagged as external.' % user['username'], 'error')
        return redirect(next_url)

    session['gitlab_token'] = (resp['access_token'], '')
    session['gitlab_user'] = user
    flash('You were signed in as %s' % user['username'])
    return redirect(next_url)

def generate_password():
    chars = string.letters + string.digits + string.punctuation
    pwdSize = 10
    return ''.join((random.choice(chars)) for x in range(pwdSize))

def send_confirmation_mail(data, sender_name='Gitlab'):
    msgcontent = """Hello {name},

an Gitlab-Account was created for you!

Please sign in under {GITLAB_BASE} with the credentials
listed below and change your password!

Username: {username}
Password: {password}

Cheers,
{gitlab_user}
""".format(GITLAB_BASE=app.config['GITLAB_BASE'], gitlab_user=sender_name, **data)

    msg = MIMEText(msgcontent, 'plain')
    subj = Header('A Gitlab account has been created for you!')
    msg['Subject'] = subj
    msg['From'] = app.config['MAILSENDER']
    msg['To'] = data['email']
    msg['Content-Type'] = "text/html"
    msg['Content-Transfer-Encoding'] = "quoted-printable"

    try:
        s = smtplib.SMTP('localhost')
    except:
        pass
    else:
        s.sendmail(app.config['MAILSENDER'], data['email'], msg.as_string())
        s.quit()

class RegistrationForm(Form):
    name = TextField('Name', [validators.Required()], render_kw={"placeholder": "Name"})
    username = TextField('Username', [validators.Required()], render_kw={"placeholder": "Username"})
    email = EmailField('Email Address', [validators.Required(), validators.Email()], render_kw={"placeholder": "Email"})

    class Meta:
        csrf = True
        csrf_secret = app.config['CSRF_SECRET']


@app.route('/', methods=['GET', 'POST'])
def index():
    token = get_gitlab_token()
    if token is None:
        return redirect(url_for('account', next=url_for('index')))


    form = RegistrationForm(request.form, meta={'csrf_context': session})
    if request.method == 'POST' and form.validate():
        data = {}
        data['name'] = form.name.data
        data['username'] = form.username.data
        data['email'] = form.email.data
        data['password'] = generate_password()
        data['projects_limit'] = 0
        data['skip_confirmation'] = True
        data['external'] = True

        r = requests.post(app.config['GITLAB_BASE']+'/api/v4/users', data=json.dumps(data),
                          headers={'Private-Token': app.config['GITLAB_ADMIN_TOKEN'], 'content-type': 'application/json'})
        if r.status_code == 201:
            flash('The user {} has been successfully created.'.format(form.username.data), 'success')
            send_confirmation_mail(data, session['gitlab_user']['name'])
        else:
            flash('Problems when creating the user: {}'.format(r.json()['message']), 'error')

    return render_template('index.html', form=form, user=session['gitlab_user'])

@app.route('/test')
def test():
    return "The URL for index page is {}".format(url_for("index"))


if __name__ == "__main__":
    app.run()