use mysql.user table for climsoft auth

Author: faysal-ishtiaq

playground.py

@@ -0,0 +1,17 @@
+from sqlalchemy import create_engine
+from sqlalchemy import text as sa_text
+from sqlalchemy.orm import sessionmaker, Session
+
+if __name__ == "__main__":
+    climsoft_engine = create_engine("mysql+mysqldb://root:password@127.0.0.1:23306/mariadb_climsoft_test_db_v4")
+    ClimsoftSessionLocal = sessionmaker(climsoft_engine)
+    session: Session = ClimsoftSessionLocal()
+    username = "root"
+    password = "password"
+    user = session.execute(sa_text(f'''
+        SELECT * 
+        FROM mysql.user 
+        WHERE User="{username}" AND Password=password("{password}")
+    '''))
+
+    print(user.all())

src/opencdms_api/config.py

@@ -25,6 +25,7 @@ class Settings(BaseSettings):
 
     AUTH_ENABLED: bool
 
+    CLIMSOFT_DATABASE_URI: str
     DATABASE_URI: Optional[PostgresDsn] = None
 
     @validator("DATABASE_URI", pre=True)

src/opencdms_api/db.py

@@ -9,9 +9,9 @@
 
 
 engine = create_engine(settings.DATABASE_URI)
-
+climsoft_engine = create_engine(settings.CLIMSOFT_DATABASE_URI)
 SessionLocal = sessionmaker(engine)
-
+ClimsoftSessionLocal = sessionmaker(climsoft_engine)
 Base = declarative_base()
 
 ScopedSession = scoped_session(SessionLocal)

src/opencdms_api/deps.py

@@ -1,5 +1,5 @@
 from sqlalchemy.orm.session import Session
-from src.opencdms_api.db import SessionLocal
+from src.opencdms_api.db import SessionLocal, ClimsoftSessionLocal
 
 
 def get_session():
@@ -15,3 +15,19 @@ def get_session():
         raise e
     finally:
         session.close()
+
+
+def get_climsoft_session():
+    """
+    Api dependency to provide climsoft database session to a request
+    """
+    session: Session = ClimsoftSessionLocal()
+    try:
+        yield session
+        session.commit()
+    except Exception as e:
+        session.rollback()
+        raise e
+    finally:
+        session.close()
+

src/opencdms_api/middleware.py

@@ -12,7 +12,7 @@
 from src.opencdms_api.config import settings
 from src.opencdms_api.db import db_session_scope
 from src.opencdms_api import climsoft_rbac_config
-from src.opencdms_api.schema import CurrentUserSchema
+from src.opencdms_api.schema import CurrentUserSchema, CurrentClimsoftUserSchema
 from opencdms.models.climsoft import v4_1_1_core as climsoft_models
 from fastapi import Header, Depends
 from fastapi.security import OAuth2PasswordBearer
@@ -98,6 +98,23 @@ class ClimsoftRBACMiddleware(AuthMiddleWare):
     def __init__(self, app: ASGIApp):
         super().__init__(app)
 
+    def authenticate_request(self, request: Request):
+        authorization_header = request.headers.get("authorization")
+        if authorization_header is None:
+            raise HTTPException(401, "Unauthorized request")
+        scheme, token = get_authorization_scheme_param(authorization_header)
+        if scheme.lower() != "bearer":
+            raise HTTPException(401, "Invalid authorization header scheme")
+        try:
+            claims = jwt.decode(token, settings.SURFACE_SECRET_KEY)
+        except JWTError:
+            raise HTTPException(401, "Unauthorized request")
+        username = claims["sub"]
+        user = CurrentClimsoftUserSchema(username=username)
+        if user is None:
+            raise HTTPException(401, "Unauthorized request")
+        return user
+
     async def __call__(self, scope: Scope, receive: Receive, send: Send):
         request = Request(scope, receive, send)
         user = None
@@ -134,7 +151,7 @@ def get_authorized_climsoft_user(
 
     username = claims["sub"]
 
-    user = get_user(username)
+    user = CurrentClimsoftUserSchema(username=username)
 
     if user is None:
         raise HTTPException(401, "Unauthorized request")

src/opencdms_api/router.py

@@ -2,13 +2,15 @@
 from uuid import uuid4
 from fastapi import APIRouter, Depends
 from fastapi.exceptions import HTTPException
+from sqlalchemy import text as sa_text
 from sqlalchemy.orm.session import Session
 from passlib.hash import django_pbkdf2_sha256 as handler
 from src.opencdms_api import deps, models
 from src.opencdms_api.schema import (
     UserCreateSchema,
     AuthenticationSchema,
-    TokenSchema
+    TokenSchema,
+    ClimsoftTokenSchema
 )
 from src.opencdms_api.config import settings
 from jose import jwt
@@ -66,3 +68,32 @@ def authenticate(
     )
     return TokenSchema(access_token=access_token, first_name=user.first_name, last_name=user.last_name)
 
+
+@router.post("/climsoft-auth", response_model=TokenSchema)
+def authenticate(
+    payload: OAuth2PasswordRequestForm = Depends(),
+    session: Session = Depends(deps.get_climsoft_session())
+):
+    user = session.execute(sa_text(f'''
+        SELECT User
+        FROM mysql.user 
+        WHERE User="{payload.username}" AND Password=password("{payload.password}")
+    ''')).all()
+
+    if not user:
+        raise HTTPException(400, "Invalid login credentials")
+
+    user = user[0]
+
+    access_token = jwt.encode(
+        {
+            "sub": user[1],
+            "exp": datetime.utcnow() + timedelta(hours=24),
+            "token_type": "access",
+            "jti": str(uuid4()),
+            "user_id": int(user.id)
+        },
+        key=settings.SURFACE_SECRET_KEY,
+    )
+    return ClimsoftTokenSchema(access_token=access_token, username=user[1])
+

src/opencdms_api/schema.py

@@ -58,11 +58,20 @@ class TokenSchema(BaseModel):
     last_name: str
 
 
+class ClimsoftTokenSchema(BaseModel):
+    access_token: str
+    username: str
+
+
 class CurrentUserSchema(BaseSchema):
     email: EmailStr
     username: str
     first_name: str
     last_name: str
 
     class Config:
-        orm_mode = True
+        orm_mode = True
+
+
+class CurrentClimsoftUserSchema(BaseModel):
+    username: str