remove oidc from OAuth2, add dedicated OIDC provider

passbook/oidc_provider/lib.py

@@ -0,0 +1,30 @@
+"""OIDC Permission checking"""
+from logging import getLogger
+
+from django.contrib import messages
+from django.shortcuts import redirect
+
+from passbook.core.models import Application
+from passbook.core.policies import PolicyEngine
+
+LOGGER = getLogger(__name__)
+
+def check_permissions(request, user, client):
+    """Check permissions, used for
+    https://django-oidc-provider.readthedocs.io/en/latest/
+    sections/settings.html#oidc-after-userlogin-hook"""
+    try:
+        application = client.openidprovider.application
+    except Application.DoesNotExist:
+        return redirect('passbook_oauth_provider:oauth2-permission-denied')
+    LOGGER.debug("Checking permissions of %s on application %s...", user, application)
+    policy_engine = PolicyEngine(application.policies.all())
+    policy_engine.for_user(user).with_request(request).build()
+
+    # Check permissions
+    passing, policy_messages = policy_engine.result
+    if not passing:
+        for policy_message in policy_messages:
+            messages.error(request, policy_message)
+        return redirect('passbook_oauth_provider:oauth2-permission-denied')
+    return None