diff --git a/README.rst b/README.rst index 6022ba09..9732940c 100644 --- a/README.rst +++ b/README.rst @@ -183,6 +183,13 @@ DB Models Changelog ========= +v. 0.5.4 +-------- + +* UI fixes for OAuth2 authorization view +* Bug fix for ``/oauth/token`` API endpoint + + v. 0.5.3 -------- diff --git a/messages.pot b/messages.pot index 9a1c6ab5..9bc46689 100644 --- a/messages.pot +++ b/messages.pot @@ -6,9 +6,9 @@ #, fuzzy msgid "" msgstr "" -"Project-Id-Version: xl_auth 0.5.1\n" +"Project-Id-Version: xl_auth 0.5.3\n" "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n" -"POT-Creation-Date: 2017-11-02 10:58+0100\n" +"POT-Creation-Date: 2017-11-06 15:19+0100\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" @@ -64,7 +64,7 @@ msgstr "" #: tests/end2end/test_editing_collection.py:80 tests/end2end/test_registering_collection.py:79 #: xl_auth/collection/forms.py:17 xl_auth/templates/collections/home.html:21 -#: xl_auth/templates/collections/home.html:65 xl_auth/templates/users/profile.html:42 +#: xl_auth/templates/collections/home.html:65 xl_auth/templates/users/profile.html:46 msgid "Code" msgstr "" @@ -128,16 +128,16 @@ msgstr "" #: tests/end2end/test_editing_user.py:45 xl_auth/templates/clients/home.html:29 #: xl_auth/templates/permissions/home.html:30 xl_auth/templates/permissions/home.html:31 #: xl_auth/templates/permissions/home.html:32 xl_auth/templates/users/home.html:34 -#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:58 -#: xl_auth/templates/users/profile.html:61 xl_auth/templates/users/profile.html:65 +#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:62 +#: xl_auth/templates/users/profile.html:65 xl_auth/templates/users/profile.html:69 msgid "Yes" msgstr "" #: tests/end2end/test_editing_user.py:45 xl_auth/templates/clients/home.html:31 #: xl_auth/templates/permissions/home.html:30 xl_auth/templates/permissions/home.html:31 #: xl_auth/templates/permissions/home.html:32 xl_auth/templates/users/home.html:34 -#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:58 -#: xl_auth/templates/users/profile.html:61 xl_auth/templates/users/profile.html:65 +#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:62 +#: xl_auth/templates/users/profile.html:65 xl_auth/templates/users/profile.html:69 msgid "No" msgstr "" @@ -163,7 +163,7 @@ msgid "User \"%(username)s\" does not exist" msgstr "" #: tests/end2end/test_editing_user.py:190 xl_auth/templates/users/home.html:43 -#: xl_auth/templates/users/home.html:88 xl_auth/templates/users/profile.html:17 +#: xl_auth/templates/users/home.html:88 xl_auth/templates/users/profile.html:18 msgid "Change Password" msgstr "" @@ -318,7 +318,7 @@ msgstr "" #: xl_auth/client/views.py:85 #, python-format -msgid "Thank you for updating client details for \"%(id)s\"." +msgid "Thank you for updating client details for \"%(client_id)s\"." msgstr "" #: xl_auth/collection/forms.py:19 @@ -361,17 +361,17 @@ msgid "Collection" msgstr "" #: xl_auth/permission/forms.py:22 xl_auth/templates/permissions/home.html:18 -#: xl_auth/templates/users/profile.html:45 +#: xl_auth/templates/users/profile.html:49 msgid "Registrant" msgstr "" #: xl_auth/permission/forms.py:23 xl_auth/templates/permissions/home.html:19 -#: xl_auth/templates/users/profile.html:46 +#: xl_auth/templates/users/profile.html:50 msgid "Cataloger" msgstr "" #: xl_auth/permission/forms.py:24 xl_auth/templates/permissions/home.html:20 -#: xl_auth/templates/users/profile.html:48 +#: xl_auth/templates/users/profile.html:52 msgid "Cataloguing Administrator" msgstr "" @@ -379,6 +379,22 @@ msgstr "" msgid "Permission" msgstr "" +#: xl_auth/permission/models.py:44 +msgid "registrant, cataloger" +msgstr "" + +#: xl_auth/permission/models.py:46 +msgid "registrant" +msgstr "" + +#: xl_auth/permission/models.py:48 +msgid "cataloger" +msgstr "" + +#: xl_auth/permission/models.py:50 +msgid "no permissions" +msgstr "" + #: xl_auth/public/forms.py:17 xl_auth/templates/public/home.html:39 msgid "Username" msgstr "" @@ -411,7 +427,7 @@ msgstr "" msgid "National Library of Sweden" msgstr "" -#: xl_auth/templates/footer.html:10 xl_auth/templates/public/about.html:7 +#: xl_auth/templates/footer.html:10 xl_auth/templates/public/about.html:5 msgid "About" msgstr "" @@ -494,7 +510,7 @@ msgid "Active Collections" msgstr "" #: xl_auth/templates/collections/home.html:22 xl_auth/templates/collections/home.html:66 -#: xl_auth/templates/users/profile.html:43 +#: xl_auth/templates/users/profile.html:47 msgid "Friendly Name" msgstr "" @@ -541,7 +557,20 @@ msgstr "" msgid "Delete grant" msgstr "" -#: xl_auth/templates/oauth/authorize.html:7 xl_auth/templates/oauth/authorize.html:20 +#: xl_auth/templates/oauth/authorize.html:5 +msgid "Authorization Request" +msgstr "" + +#: xl_auth/templates/oauth/authorize.html:6 +#, python-format +msgid "OAuth2 client \"%(name)s (%(description)s)\" is requesting access to your account details." +msgstr "" + +#: xl_auth/templates/oauth/authorize.html:8 +msgid "Press \"Authorize\" to approve and get redirected back to the service." +msgstr "" + +#: xl_auth/templates/oauth/authorize.html:17 msgid "Authorize" msgstr "" @@ -561,13 +590,13 @@ msgstr "" msgid "Register New Permission" msgstr "" -#: xl_auth/templates/public/about.html:9 +#: xl_auth/templates/public/about.html:7 msgid "" "Under construction. Please refer to our GitHub repo for ongoing progress." msgstr "" -#: xl_auth/templates/public/about.html:13 +#: xl_auth/templates/public/about.html:11 #, python-format msgid "" "Current release version is %(version)s. Please check out the libris@kb.se if your permissions " "are not correctly listed below." msgstr "" -#: xl_auth/templates/users/profile.html:34 +#: xl_auth/templates/users/profile.html:38 msgid "Permissions (Active Collections Only)" msgstr "" -#: xl_auth/templates/users/profile.html:35 +#: xl_auth/templates/users/profile.html:39 msgid "" "Note: Cataloguing Admin is a new privilege that, in the near future, will allow you to " "create new user accounts and grant registrant/cataloger privileges to others. " diff --git a/package-lock.json b/package-lock.json index a5367e11..b79f1bc3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "xl_auth", - "version": "0.5.3", + "version": "0.5.4", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 28e53c14..816b68f1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "xl_auth", - "version": "0.5.3", + "version": "0.5.4", "author": "National Library of Sweden", "license": "Apache-2.0", "description": "OAuth2 authorization for LibrisXL, replacing BibDB counterpart", diff --git a/tests/end2end/test_oauth.py b/tests/end2end/test_oauth.py index bf8a022d..583f8e67 100644 --- a/tests/end2end/test_oauth.py +++ b/tests/end2end/test_oauth.py @@ -34,9 +34,6 @@ def test_oauth_authorize_success(user, client, testapp): # Sees authorization confirm form authorize_form = res.forms['authorizeForm'] - # assert authorize_form['client_id'] == client.client_id - # assert authorize_form['response_type'] == 'code' # TODO: Review us. - # assert authorize_form['redirect_uri'] == client.default_redirect_uri assert authorize_form['confirm'].value == 'y' # Submits confirmation and is redirected to '/?code='. diff --git a/xl_auth/oauth/forms.py b/xl_auth/oauth/forms.py index d9f34876..c2f48889 100644 --- a/xl_auth/oauth/forms.py +++ b/xl_auth/oauth/forms.py @@ -5,14 +5,14 @@ from flask_babel import lazy_gettext as _ from flask_wtf import FlaskForm -from wtforms import BooleanField, StringField +from wtforms import HiddenField class AuthorizeForm(FlaskForm): """OAuth2'orize form.""" - scope = StringField(_('Scope')) - confirm = BooleanField(_('Confirm'), default=True) + scope = HiddenField(_('Scope')) + confirm = HiddenField(_('Confirm'), default='y') def __init__(self, *args, **kwargs): """Create instance.""" diff --git a/xl_auth/oauth/views.py b/xl_auth/oauth/views.py index 85048ad1..ad666b45 100644 --- a/xl_auth/oauth/views.py +++ b/xl_auth/oauth/views.py @@ -9,7 +9,7 @@ from flask_login import current_user, login_required from ..client.models import Client -from ..extensions import oauth_provider +from ..extensions import csrf_protect, oauth_provider from ..grant.models import Grant from ..token.models import Token from ..user.models import User @@ -95,10 +95,11 @@ def authorize(*_, **kwargs): kwargs['client'] = client return render_template('oauth/authorize.html', authorize_form=authorize_form, **kwargs) - confirm = authorize_form['confirm'].data + confirm = authorize_form['confirm'].data == 'y' return confirm +@csrf_protect.exempt @blueprint.route('/token', methods=['POST', 'GET']) @oauth_provider.token_handler def create_access_token(): diff --git a/xl_auth/templates/oauth/authorize.html b/xl_auth/templates/oauth/authorize.html index c5a856b4..3316cfcc 100644 --- a/xl_auth/templates/oauth/authorize.html +++ b/xl_auth/templates/oauth/authorize.html @@ -1,24 +1,22 @@ {% extends "layout.html" %} - {% block content %} -
+
+

{{ _('Authorization Request') }}

+

{{ _('OAuth2 client "%(name)s (%(description)s)" is \ +requesting access to your account details.', name=client.name, description=client.description) }}

+

{{ _('Press "Authorize" to approve and get redirected back to the service.') }}

+
-

{{ _('Authorize') }}

-

client_id: {{ client_id }}

-

scopes: {{ scopes }}

-

state: {{ state }}

-

redirect_uri: {{ redirect_uri }}

-

response_type: {{ response_type }}

- -
- -
+
+ + {{ authorize_form.scope(value=' '.join(scopes)) }} - {{ authorize_form.confirm(class_="form-control") }} -
-

- + {{ authorize_form.confirm() }} + + +
{% endblock %} diff --git a/xl_auth/templates/public/about.html b/xl_auth/templates/public/about.html index 7fc611be..819491f7 100644 --- a/xl_auth/templates/public/about.html +++ b/xl_auth/templates/public/about.html @@ -1,19 +1,16 @@ {% extends "layout.html" %} - {% block content %} -
-
-

{{ _('About') }}

-

- {{ _('Under construction. Please refer to our +

{{ _('About') }}

+

+ {{ _('Under construction. Please refer to our GitHub repo for ongoing progress.') }} -

-

- {{ _('Current release version is %(version)s. Please check out \ +

+

+ {{ _('Current release version is %(version)s. Please check out \ the releases overview page for \ recent changes.', version=version) }} -

-
+

{% endblock %} diff --git a/xl_auth/translations/sv/LC_MESSAGES/messages.po b/xl_auth/translations/sv/LC_MESSAGES/messages.po index 03e65bc6..5430881c 100644 --- a/xl_auth/translations/sv/LC_MESSAGES/messages.po +++ b/xl_auth/translations/sv/LC_MESSAGES/messages.po @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: 0.2.1\n" "Report-Msgid-Bugs-To: mats.blomdahl@gmail.com\n" -"POT-Creation-Date: 2017-11-02 10:58+0100\n" +"POT-Creation-Date: 2017-11-06 15:19+0100\n" "PO-Revision-Date: 2017-09-19 12:23+0200\n" "Last-Translator: Mats Blomdahl \n" "Language: sv\n" @@ -65,7 +65,7 @@ msgstr "Kategori saknas" #: tests/end2end/test_editing_collection.py:80 tests/end2end/test_registering_collection.py:79 #: xl_auth/collection/forms.py:17 xl_auth/templates/collections/home.html:21 -#: xl_auth/templates/collections/home.html:65 xl_auth/templates/users/profile.html:42 +#: xl_auth/templates/collections/home.html:65 xl_auth/templates/users/profile.html:46 msgid "Code" msgstr "Sigel" @@ -129,16 +129,16 @@ msgstr "Användare" #: tests/end2end/test_editing_user.py:45 xl_auth/templates/clients/home.html:29 #: xl_auth/templates/permissions/home.html:30 xl_auth/templates/permissions/home.html:31 #: xl_auth/templates/permissions/home.html:32 xl_auth/templates/users/home.html:34 -#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:58 -#: xl_auth/templates/users/profile.html:61 xl_auth/templates/users/profile.html:65 +#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:62 +#: xl_auth/templates/users/profile.html:65 xl_auth/templates/users/profile.html:69 msgid "Yes" msgstr "Ja" #: tests/end2end/test_editing_user.py:45 xl_auth/templates/clients/home.html:31 #: xl_auth/templates/permissions/home.html:30 xl_auth/templates/permissions/home.html:31 #: xl_auth/templates/permissions/home.html:32 xl_auth/templates/users/home.html:34 -#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:58 -#: xl_auth/templates/users/profile.html:61 xl_auth/templates/users/profile.html:65 +#: xl_auth/templates/users/home.html:79 xl_auth/templates/users/profile.html:62 +#: xl_auth/templates/users/profile.html:65 xl_auth/templates/users/profile.html:69 msgid "No" msgstr "Nej" @@ -164,7 +164,7 @@ msgid "User \"%(username)s\" does not exist" msgstr "Användaren \"%(username)s\" existerar inte" #: tests/end2end/test_editing_user.py:190 xl_auth/templates/users/home.html:43 -#: xl_auth/templates/users/home.html:88 xl_auth/templates/users/profile.html:17 +#: xl_auth/templates/users/home.html:88 xl_auth/templates/users/profile.html:18 msgid "Change Password" msgstr "Byt lösenord" @@ -319,8 +319,8 @@ msgstr "Klient \"%(name)s\" skapad." #: xl_auth/client/views.py:85 #, python-format -msgid "Thank you for updating client details for \"%(id)s\"." -msgstr "Tack för att du uppdaterade detaljer för klient \"%(id)s\"." +msgid "Thank you for updating client details for \"%(client_id)s\"." +msgstr "Inställningar för \"%(client_id)s\" uppdaterade." #: xl_auth/collection/forms.py:19 msgid "Bibliography" @@ -362,17 +362,17 @@ msgid "Collection" msgstr "Sigel" #: xl_auth/permission/forms.py:22 xl_auth/templates/permissions/home.html:18 -#: xl_auth/templates/users/profile.html:45 +#: xl_auth/templates/users/profile.html:49 msgid "Registrant" msgstr "Beståndsregistrerare" #: xl_auth/permission/forms.py:23 xl_auth/templates/permissions/home.html:19 -#: xl_auth/templates/users/profile.html:46 +#: xl_auth/templates/users/profile.html:50 msgid "Cataloger" msgstr "Katalogisatör" #: xl_auth/permission/forms.py:24 xl_auth/templates/permissions/home.html:20 -#: xl_auth/templates/users/profile.html:48 +#: xl_auth/templates/users/profile.html:52 msgid "Cataloguing Administrator" msgstr "Katalogiseringsadmin" @@ -380,6 +380,22 @@ msgstr "Katalogiseringsadmin" msgid "Permission" msgstr "Behörighet" +#: xl_auth/permission/models.py:44 +msgid "registrant, cataloger" +msgstr "beståndsregistrerare, katalogisatör" + +#: xl_auth/permission/models.py:46 +msgid "registrant" +msgstr "beståndsregistrerare" + +#: xl_auth/permission/models.py:48 +msgid "cataloger" +msgstr "katalogisatör" + +#: xl_auth/permission/models.py:50 +msgid "no permissions" +msgstr "inga behörigheter" + #: xl_auth/public/forms.py:17 xl_auth/templates/public/home.html:39 msgid "Username" msgstr "Användarnamn" @@ -412,7 +428,7 @@ msgstr "Serverfel" msgid "National Library of Sweden" msgstr "Kungliga Biblioteket" -#: xl_auth/templates/footer.html:10 xl_auth/templates/public/about.html:7 +#: xl_auth/templates/footer.html:10 xl_auth/templates/public/about.html:5 msgid "About" msgstr "Om webbplatsen" @@ -495,7 +511,7 @@ msgid "Active Collections" msgstr "Aktiva sigler" #: xl_auth/templates/collections/home.html:22 xl_auth/templates/collections/home.html:66 -#: xl_auth/templates/users/profile.html:43 +#: xl_auth/templates/users/profile.html:47 msgid "Friendly Name" msgstr "Namn" @@ -542,7 +558,20 @@ msgstr "Åtgärder" msgid "Delete grant" msgstr "Radera grant" -#: xl_auth/templates/oauth/authorize.html:7 xl_auth/templates/oauth/authorize.html:20 +#: xl_auth/templates/oauth/authorize.html:5 +msgid "Authorization Request" +msgstr "Auktoriseringsbegäran" + +#: xl_auth/templates/oauth/authorize.html:6 +#, python-format +msgid "OAuth2 client \"%(name)s (%(description)s)\" is requesting access to your account details." +msgstr "\"%(name)s\" (%(description)s) begär tillgång till dina användaruppgifter." + +#: xl_auth/templates/oauth/authorize.html:8 +msgid "Press \"Authorize\" to approve and get redirected back to the service." +msgstr "Klicka på \"Auktorisera\" för att godkänna och återvända till tjänsten." + +#: xl_auth/templates/oauth/authorize.html:17 msgid "Authorize" msgstr "Auktorisera" @@ -562,7 +591,7 @@ msgstr "Befintliga behörigheter" msgid "Register New Permission" msgstr "Registrera ny behörighet" -#: xl_auth/templates/public/about.html:9 +#: xl_auth/templates/public/about.html:7 msgid "" "Under construction. Please refer to our GitHub repo for ongoing progress." @@ -570,7 +599,7 @@ msgstr "" "Tjänsten är under konstruktion. Vänligen se vårt GitHub-repo för löpande utveckling." -#: xl_auth/templates/public/about.html:13 +#: xl_auth/templates/public/about.html:11 #, python-format msgid "" "Current release version is %(version)s. Please check out the libris@kb.se if your permissions " "are not correctly listed below." @@ -673,11 +702,11 @@ msgstr "" "Kontakta omgående kundservice på libris@kb.se för rättning " "ifall dina behörigheter inte är 100 %% korrekt listade." -#: xl_auth/templates/users/profile.html:34 +#: xl_auth/templates/users/profile.html:38 msgid "Permissions (Active Collections Only)" msgstr "Behörigheter på aktiva sigel" -#: xl_auth/templates/users/profile.html:35 +#: xl_auth/templates/users/profile.html:39 msgid "" "Note: Cataloguing Admin is a new privilege that, in the near future, will allow you to " "create new user accounts and grant registrant/cataloger privileges to others. "