Auth support (#25)

* initial auth implementation

* add create user parser

* add tests

* update dependencies list

* add login annd logout to index also improve auth

* realworld fixes

* add method set_option to Configuration and also use it everywhere
* split CreateUser handler to additional read method
* check user duplicate on auth mapping read
* generate salt by using passlib instead of random.choice
* case-insensetive usernames
* update dependencies
* update configuration reference
* improve tests

* fix codefactor errors

* hide fields if authorization is enabled, but no auth supplied

* add settings object for auth provider

* readme update

tests/ahriman/web/middlewares/conftest.py

@@ -2,8 +2,12 @@ import pytest
 
 from collections import namedtuple
 
+from ahriman.core.auth.auth import Auth
+from ahriman.core.configuration import Configuration
+from ahriman.models.user import User
+from ahriman.web.middlewares.auth_handler import AuthorizationPolicy
 
-_request = namedtuple("_request", ["path"])
+_request = namedtuple("_request", ["path", "method"])
 
 
 @pytest.fixture
@@ -12,4 +16,17 @@ def aiohttp_request() -> _request:
     fixture for aiohttp like object
     :return: aiohttp like request test instance
     """
-    return _request("path")
+    return _request("path", "GET")
+
+
+@pytest.fixture
+def authorization_policy(configuration: Configuration, user: User) -> AuthorizationPolicy:
+    """
+    fixture for authorization policy
+    :return: authorization policy fixture
+    """
+    configuration.set_option("auth", "target", "configuration")
+    validator = Auth.load(configuration)
+    policy = AuthorizationPolicy(validator)
+    policy.validator._users = {user.username: user}
+    return policy

tests/ahriman/web/middlewares/test_auth_handler.py

@@ -0,0 +1,100 @@
+from aiohttp import web
+from pytest_mock import MockerFixture
+from typing import Any
+from unittest.mock import AsyncMock, MagicMock
+
+from ahriman.core.auth.auth import Auth
+from ahriman.core.configuration import Configuration
+from ahriman.models.user import User
+from ahriman.models.user_access import UserAccess
+from ahriman.web.middlewares.auth_handler import auth_handler, AuthorizationPolicy, setup_auth
+
+
+async def test_authorized_userid(authorization_policy: AuthorizationPolicy, user: User) -> None:
+    """
+    must return authorized user id
+    """
+    assert await authorization_policy.authorized_userid(user.username) == user.username
+    assert await authorization_policy.authorized_userid("some random name") is None
+
+
+async def test_permits(authorization_policy: AuthorizationPolicy, user: User) -> None:
+    """
+    must call validator check
+    """
+    authorization_policy.validator = MagicMock()
+    authorization_policy.validator.verify_access.return_value = True
+
+    assert await authorization_policy.permits(user.username, user.access, "/endpoint")
+    authorization_policy.validator.verify_access.assert_called_with(user.username, user.access, "/endpoint")
+
+
+async def test_auth_handler_api(aiohttp_request: Any, auth: Auth, mocker: MockerFixture) -> None:
+    """
+    must ask for status permission for api calls
+    """
+    aiohttp_request = aiohttp_request._replace(path="/api")
+    request_handler = AsyncMock()
+    mocker.patch("ahriman.core.auth.auth.Auth.is_safe_request", return_value=False)
+    check_permission_mock = mocker.patch("aiohttp_security.check_permission")
+
+    handler = auth_handler(auth)
+    await handler(aiohttp_request, request_handler)
+    check_permission_mock.assert_called_with(aiohttp_request, UserAccess.Status, aiohttp_request.path)
+
+
+async def test_auth_handler_api_post(aiohttp_request: Any, auth: Auth, mocker: MockerFixture) -> None:
+    """
+    must ask for status permission for api calls with POST
+    """
+    aiohttp_request = aiohttp_request._replace(path="/api", method="POST")
+    request_handler = AsyncMock()
+    mocker.patch("ahriman.core.auth.auth.Auth.is_safe_request", return_value=False)
+    check_permission_mock = mocker.patch("aiohttp_security.check_permission")
+
+    handler = auth_handler(auth)
+    await handler(aiohttp_request, request_handler)
+    check_permission_mock.assert_called_with(aiohttp_request, UserAccess.Status, aiohttp_request.path)
+
+
+async def test_auth_handler_read(aiohttp_request: Any, auth: Auth, mocker: MockerFixture) -> None:
+    """
+    must ask for read permission for api calls with GET
+    """
+    for method in ("GET", "HEAD", "OPTIONS"):
+        aiohttp_request = aiohttp_request._replace(method=method)
+        request_handler = AsyncMock()
+        mocker.patch("ahriman.core.auth.auth.Auth.is_safe_request", return_value=False)
+        check_permission_mock = mocker.patch("aiohttp_security.check_permission")
+
+        handler = auth_handler(auth)
+        await handler(aiohttp_request, request_handler)
+        check_permission_mock.assert_called_with(aiohttp_request, UserAccess.Read, aiohttp_request.path)
+
+
+async def test_auth_handler_write(aiohttp_request: Any, auth: Auth, mocker: MockerFixture) -> None:
+    """
+    must ask for read permission for api calls with POST
+    """
+    for method in ("CONNECT", "DELETE", "PATCH", "POST", "PUT", "TRACE"):
+        aiohttp_request = aiohttp_request._replace(method=method)
+        request_handler = AsyncMock()
+        mocker.patch("ahriman.core.auth.auth.Auth.is_safe_request", return_value=False)
+        check_permission_mock = mocker.patch("aiohttp_security.check_permission")
+
+        handler = auth_handler(auth)
+        await handler(aiohttp_request, request_handler)
+        check_permission_mock.assert_called_with(aiohttp_request, UserAccess.Write, aiohttp_request.path)
+
+
+def test_setup_auth(
+        application_with_auth: web.Application,
+        configuration: Configuration,
+        mocker: MockerFixture) -> None:
+    """
+    must setup authorization
+    """
+    aiohttp_security_setup_mock = mocker.patch("aiohttp_security.setup")
+    application = setup_auth(application_with_auth, configuration)
+    assert application.get("validator") is not None
+    aiohttp_security_setup_mock.assert_called_once()