bump version: 0.1.31-beta -> 0.1.32-beta

Resolve "Guardian"

Closes #37

See merge request BeryJu.org/passbook!23

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.1.29-beta
+current_version = 0.1.32-beta
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)

.gitlab-ci.yml

@@ -56,7 +56,7 @@ package-docker:
     before_script:
         - echo "{\"auths\":{\"docker.$NEXUS_URL\":{\"auth\":\"$NEXUS_AUTH\"}}}" > /kaniko/.docker/config.json
     script:
-        - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination docker.pkg.beryju.org/passbook:latest --destination docker.pkg.beryju.org/passbook:0.1.29-beta
+        - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination docker.pkg.beryju.org/passbook:latest --destination docker.pkg.beryju.org/passbook:0.1.32-beta
     stage: build
     only:
         - tags

client-packages/allauth/setup.py

@@ -3,7 +3,7 @@ from setuptools import setup
 
 setup(
     name='django-allauth-passbook',
-    version='0.1.29-beta',
+    version='0.1.32-beta',
     description='passbook support for django-allauth',
     # long_description='\n'.join(read_simple('docs/index.md')[2:]),
     long_description_content_type='text/markdown',

client-packages/sentry-auth-passbook/setup.py

@@ -18,7 +18,7 @@ tests_require = [
 
 setup(
     name='sentry-auth-passbook',
-    version='0.1.29-beta',
+    version='0.1.32-beta',
     author='BeryJu.org',
     author_email='support@beryju.org',
     url='https://passbook.beryju.org',

debian/changelog

@@ -1,3 +1,30 @@
+passbook (0.1.32) stable; urgency=medium
+
+  * bump version: 0.1.30-beta -> 0.1.31-beta
+  * automatically add response_type if not given in OAuth Request
+
+ -- Jens Langhammer <jens.langhammer@beryju.org>  Wed, 17 Apr 2019 12:25:58 +0000
+
+passbook (0.1.31) stable; urgency=medium
+
+  * bump version: 0.1.29-beta -> 0.1.30-beta
+  * allow setting authentication_header to empty string (disabling the header)
+  * use global urllib Pools
+  * try to fix app_gw being null
+  * only enable sentry when not DEBUG
+  * move logging to separate thread
+  * move actual proxying logic to separate class
+  * remove logging to increase speed, add more caching to policy and rewriter
+
+ -- Jens Langhammer <jens.langhammer@beryju.org>  Sat, 13 Apr 2019 15:56:55 +0000
+
+passbook (0.1.30) stable; urgency=medium
+
+  * bump version: 0.1.28-beta -> 0.1.29-beta
+  * don't use context manager in web command
+
+ -- Jens Langhammer <jens.langhammer@beryju.org>  Thu, 11 Apr 2019 12:21:58 +0000
+
 passbook (0.1.29) stable; urgency=medium
 
   * bump version: 0.1.27-beta -> 0.1.28-beta

helm/passbook/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "0.1.29-beta"
+appVersion: "0.1.32-beta"
 description: A Helm chart for passbook.
 name: passbook
-version: "0.1.29-beta"
+version: "0.1.32-beta"
 icon: https://passbook.beryju.org/images/logo.png

helm/passbook/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 
 image:
-  tag: 0.1.29-beta
+  tag: 0.1.32-beta
 
 nameOverride: ""
 

passbook/__init__.py

@@ -1,2 +1,2 @@
 """passbook"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/admin/__init__.py

@@ -1,2 +1,2 @@
 """passbook admin"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/api/__init__.py

@@ -1,2 +1,2 @@
 """passbook api"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/app_gw/__init__.py

@@ -1,2 +1,2 @@
 """passbook Application Security Gateway Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/app_gw/middleware.py

@@ -1,238 +1,33 @@
 """passbook app_gw middleware"""
-import mimetypes
-from logging import getLogger
-from random import SystemRandom
-from urllib.parse import urlparse
-
-import certifi
-import urllib3
-from django.core.cache import cache
-from django.utils.http import urlencode
 from django.views.generic import RedirectView
-from revproxy.exceptions import InvalidUpstream
 
-from passbook.app_gw.models import ApplicationGatewayProvider
+from passbook.app_gw.proxy.handler import RequestHandler
-from passbook.app_gw.proxy.response import get_django_response
-from passbook.app_gw.proxy.utils import encode_items, normalize_request_headers
-from passbook.app_gw.rewrite import Rewriter
-from passbook.core.models import Application
-from passbook.core.policies import PolicyEngine
 from passbook.lib.config import CONFIG
 
-SESSION_UPSTREAM_KEY = 'passbook_app_gw_upstream'
-IGNORED_HOSTNAMES_KEY = 'passbook_app_gw_ignored'
-LOGGER = getLogger(__name__)
-QUOTE_SAFE = r'<.;>\(}*+|~=-$/_:^@)[{]&\'!,"`'
-ERRORS_MESSAGES = {
-    'upstream-no-scheme': ("Upstream URL scheme must be either "
-                           "'http' or 'https' (%s).")
-}
 
-# pylint: disable=too-many-instance-attributes
 class ApplicationGatewayMiddleware:
     """Check if request should be proxied or handeled normally"""
 
-    ignored_hosts = []
+    _app_gw_cache = {}
-    request = None
-    app_gw = None
-    http = None
-    http_no_verify = None
-    host_header = ''
-
-    _parsed_url = None
-    _request_headers = None
 
     def __init__(self, get_response):
         self.get_response = get_response
-        self.ignored_hosts = cache.get(IGNORED_HOSTNAMES_KEY, [])
-        self.http_no_verify = urllib3.PoolManager()
-        self.http = urllib3.PoolManager(
-            cert_reqs='CERT_REQUIRED',
-            ca_certs=certifi.where())
-
-    def precheck(self, request):
-        """Check if a request should be proxied or forwarded to passbook"""
-        # Check if hostname is in cached list of ignored hostnames
-        # This saves us having to query the database on each request
-        self.host_header = request.META.get('HTTP_HOST')
-        if self.host_header in self.ignored_hosts:
-            LOGGER.debug("%s is ignored", self.host_header)
-            return True, None
-        # Look through all ApplicationGatewayProviders and check hostnames
-        matches = ApplicationGatewayProvider.objects.filter(
-            server_name__contains=[self.host_header],
-            enabled=True)
-        if not matches.exists():
-            # Mo matching Providers found, add host header to ignored list
-            self.ignored_hosts.append(self.host_header)
-            cache.set(IGNORED_HOSTNAMES_KEY, self.ignored_hosts)
-            LOGGER.debug("Ignoring %s", self.host_header)
-            return True, None
-        # At this point we're certain there's a matching ApplicationGateway
-        if len(matches) > 1:
-            # This should never happen
-            raise ValueError
-        app_gw = matches.first()
-        try:
-            # Check if ApplicationGateway is associated with application
-            getattr(app_gw, 'application')
-            return False, app_gw
-        except Application.DoesNotExist:
-            LOGGER.debug("ApplicationGateway not associated with Application")
-            return True, None
-        return True, None
 
     def __call__(self, request):
-        forward, self.app_gw = self.precheck(request)
+        # Rudimentary cache
-        if forward:
+        host_header = request.META.get('HTTP_HOST')
-            return self.get_response(request)
+        if host_header not in self._app_gw_cache:
-        self.request = request
+            self._app_gw_cache[host_header] = RequestHandler.find_app_gw_for_request(request)
-        return self.dispatch(request)
+        if self._app_gw_cache[host_header]:
+            return self.dispatch(request, self._app_gw_cache[host_header])
+        return self.get_response(request)
 
-    def _get_upstream(self):
+    def dispatch(self, request, app_gw):
-        """Choose random upstream and save in session"""
-        if SESSION_UPSTREAM_KEY not in self.request.session:
-            self.request.session[SESSION_UPSTREAM_KEY] = {}
-        if self.app_gw.pk not in self.request.session[SESSION_UPSTREAM_KEY]:
-            upstream_index = SystemRandom().randrange(len(self.app_gw.upstream))
-            self.request.session[SESSION_UPSTREAM_KEY][self.app_gw.pk] = upstream_index
-        return self.app_gw.upstream[self.request.session[SESSION_UPSTREAM_KEY][self.app_gw.pk]]
-
-    def get_upstream(self):
-        """Get upstream as parsed url"""
-        upstream = self._get_upstream()
-
-        self._parsed_url = urlparse(upstream)
-
-        if self._parsed_url.scheme not in ('http', 'https'):
-            raise InvalidUpstream(ERRORS_MESSAGES['upstream-no-scheme'] %
-                                  upstream)
-
-        return upstream
-
-    def _format_path_to_redirect(self, request):
-        LOGGER.debug("Path before: %s", request.get_full_path())
-        rewriter = Rewriter(self.app_gw, request)
-        after = rewriter.build()
-        LOGGER.debug("Path after: %s", after)
-        return after
-
-    def get_proxy_request_headers(self, request):
-        """Get normalized headers for the upstream
-        Gets all headers from the original request and normalizes them.
-        Normalization occurs by removing the prefix ``HTTP_`` and
-        replacing and ``_`` by ``-``. Example: ``HTTP_ACCEPT_ENCODING``
-        becames ``Accept-Encoding``.
-        .. versionadded:: 0.9.1
-        :param request:  The original HTTPRequest instance
-        :returns:  Normalized headers for the upstream
-        """
-        return normalize_request_headers(request)
-
-    def get_request_headers(self):
-        """Return request headers that will be sent to upstream.
-        The header REMOTE_USER is set to the current user
-        if AuthenticationMiddleware is enabled and
-        the view's add_remote_user property is True.
-        .. versionadded:: 0.9.8
-        """
-        request_headers = self.get_proxy_request_headers(self.request)
-        request_headers[self.app_gw.authentication_header] = self.request.user.get_username()
-        LOGGER.info("%s set", self.app_gw.authentication_header)
-
-        return request_headers
-
-    def check_permission(self):
-        """Check if user is authenticated and has permission to access app"""
-        if not hasattr(self.request, 'user'):
-            return False
-        if not self.request.user.is_authenticated:
-            return False
-        policy_engine = PolicyEngine(self.app_gw.application.policies.all())
-        policy_engine.for_user(self.request.user).with_request(self.request).build()
-        passing, _messages = policy_engine.result
-
-        return passing
-
-    def get_encoded_query_params(self):
-        """Return encoded query params to be used in proxied request"""
-        get_data = encode_items(self.request.GET.lists())
-        return urlencode(get_data)
-
-    def _created_proxy_response(self, request, path):
-        request_payload = request.body
-
-        LOGGER.debug("Request headers: %s", self._request_headers)
-
-        request_url = self.get_upstream() + path
-        LOGGER.debug("Request URL: %s", request_url)
-
-        if request.GET:
-            request_url += '?' + self.get_encoded_query_params()
-            LOGGER.debug("Request URL: %s", request_url)
-
-        http = self.http
-        if not self.app_gw.upstream_ssl_verification:
-            http = self.http_no_verify
-
-        try:
-            proxy_response = http.urlopen(request.method,
-                                          request_url,
-                                          redirect=False,
-                                          retries=None,
-                                          headers=self._request_headers,
-                                          body=request_payload,
-                                          decode_content=False,
-                                          preload_content=False)
-            LOGGER.debug("Proxy response header: %s",
-                         proxy_response.getheaders())
-        except urllib3.exceptions.HTTPError as error:
-            LOGGER.exception(error)
-            raise
-
-        return proxy_response
-
-    def _replace_host_on_redirect_location(self, request, proxy_response):
-        location = proxy_response.headers.get('Location')
-        if location:
-            if request.is_secure():
-                scheme = 'https://'
-            else:
-                scheme = 'http://'
-            request_host = scheme + self.host_header
-
-            upstream_host_http = 'http://' + self._parsed_url.netloc
-            upstream_host_https = 'https://' + self._parsed_url.netloc
-
-            location = location.replace(upstream_host_http, request_host)
-            location = location.replace(upstream_host_https, request_host)
-            proxy_response.headers['Location'] = location
-            LOGGER.debug("Proxy response LOCATION: %s",
-                         proxy_response.headers['Location'])
-
-    def _set_content_type(self, request, proxy_response):
-        content_type = proxy_response.headers.get('Content-Type')
-        if not content_type:
-            content_type = (mimetypes.guess_type(request.path)[0] or
-                            self.app_gw.default_content_type)
-            proxy_response.headers['Content-Type'] = content_type
-            LOGGER.debug("Proxy response CONTENT-TYPE: %s",
-                         proxy_response.headers['Content-Type'])
-
-    def dispatch(self, request):
         """Build proxied request and pass to upstream"""
-        if not self.check_permission():
+        handler = RequestHandler(app_gw, request)
+
+        if not handler.check_permission():
             to_url = 'https://%s/?next=%s' % (CONFIG.get('domains')[0], request.get_full_path())
             return RedirectView.as_view(url=to_url)(request)
 
-        self._request_headers = self.get_request_headers()
+        return handler.get_response()
-
-        path = self._format_path_to_redirect(request)
-        proxy_response = self._created_proxy_response(request, path)
-
-        self._replace_host_on_redirect_location(request, proxy_response)
-        self._set_content_type(request, proxy_response)
-        response = get_django_response(proxy_response, strict_cookies=False)
-
-        LOGGER.debug("RESPONSE RETURNED: %s", response)
-        return response

passbook/app_gw/migrations/0003_auto_20190411_1314.py

@@ -0,0 +1,18 @@
+# Generated by Django 2.2 on 2019-04-11 13:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('passbook_app_gw', '0002_auto_20190321_1521'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='applicationgatewayprovider',
+            name='authentication_header',
+            field=models.TextField(blank=True, default='X-Remote-User'),
+        ),
+    ]

passbook/app_gw/models.py

@@ -15,7 +15,7 @@ class ApplicationGatewayProvider(Provider):
     upstream = ArrayField(models.TextField())
     enabled = models.BooleanField(default=True)
 
-    authentication_header = models.TextField(default='X-Remote-User')
+    authentication_header = models.TextField(default='X-Remote-User', blank=True)
     default_content_type = models.TextField(default='application/octet-stream')
     upstream_ssl_verification = models.BooleanField(default=True)
 

passbook/app_gw/proxy/handler.py

@@ -0,0 +1,225 @@
+"""passbook app_gw request handler"""
+import mimetypes
+from logging import getLogger
+from random import SystemRandom
+from urllib.parse import urlparse
+
+import certifi
+import urllib3
+from django.core.cache import cache
+from django.utils.http import urlencode
+
+from passbook.app_gw.models import ApplicationGatewayProvider
+from passbook.app_gw.proxy.exceptions import InvalidUpstream
+from passbook.app_gw.proxy.response import get_django_response
+from passbook.app_gw.proxy.rewrite import Rewriter
+from passbook.app_gw.proxy.utils import encode_items, normalize_request_headers
+from passbook.core.models import Application
+from passbook.core.policies import PolicyEngine
+
+SESSION_UPSTREAM_KEY = 'passbook_app_gw_upstream'
+IGNORED_HOSTNAMES_KEY = 'passbook_app_gw_ignored'
+LOGGER = getLogger(__name__)
+QUOTE_SAFE = r'<.;>\(}*+|~=-$/_:^@)[{]&\'!,"`'
+ERRORS_MESSAGES = {
+    'upstream-no-scheme': ("Upstream URL scheme must be either "
+                           "'http' or 'https' (%s).")
+}
+HTTP_NO_VERIFY = urllib3.PoolManager()
+HTTP = urllib3.PoolManager(
+    cert_reqs='CERT_REQUIRED',
+    ca_certs=certifi.where())
+IGNORED_HOSTS = cache.get(IGNORED_HOSTNAMES_KEY, [])
+POLICY_CACHE = {}
+
+class RequestHandler:
+    """Forward requests"""
+
+    _parsed_url = None
+    _request_headers = None
+
+    def __init__(self, app_gw, request):
+        self.app_gw = app_gw
+        self.request = request
+        if self.app_gw.pk not in POLICY_CACHE:
+            POLICY_CACHE[self.app_gw.pk] = self.app_gw.application.policies.all()
+
+    @staticmethod
+    def find_app_gw_for_request(request):
+        """Check if a request should be proxied or forwarded to passbook"""
+        # Check if hostname is in cached list of ignored hostnames
+        # This saves us having to query the database on each request
+        host_header = request.META.get('HTTP_HOST')
+        if host_header in IGNORED_HOSTS:
+            # LOGGER.debug("%s is ignored", host_header)
+            return False
+        # Look through all ApplicationGatewayProviders and check hostnames
+        matches = ApplicationGatewayProvider.objects.filter(
+            server_name__contains=[host_header],
+            enabled=True)
+        if not matches.exists():
+            # Mo matching Providers found, add host header to ignored list
+            IGNORED_HOSTS.append(host_header)
+            cache.set(IGNORED_HOSTNAMES_KEY, IGNORED_HOSTS)
+            # LOGGER.debug("Ignoring %s", host_header)
+            return False
+        # At this point we're certain there's a matching ApplicationGateway
+        if len(matches) > 1:
+            # This should never happen
+            raise ValueError
+        app_gw = matches.first()
+        try:
+            # Check if ApplicationGateway is associated with application
+            getattr(app_gw, 'application')
+            if app_gw:
+                return app_gw
+        except Application.DoesNotExist:
+            pass
+            # LOGGER.debug("ApplicationGateway not associated with Application")
+        return True
+
+    def _get_upstream(self):
+        """Choose random upstream and save in session"""
+        if SESSION_UPSTREAM_KEY not in self.request.session:
+            self.request.session[SESSION_UPSTREAM_KEY] = {}
+        if self.app_gw.pk not in self.request.session[SESSION_UPSTREAM_KEY]:
+            upstream_index = int(SystemRandom().random() * len(self.app_gw.upstream))
+            self.request.session[SESSION_UPSTREAM_KEY][self.app_gw.pk] = upstream_index
+        return self.app_gw.upstream[self.request.session[SESSION_UPSTREAM_KEY][self.app_gw.pk]]
+
+    def get_upstream(self):
+        """Get upstream as parsed url"""
+        upstream = self._get_upstream()
+
+        self._parsed_url = urlparse(upstream)
+
+        if self._parsed_url.scheme not in ('http', 'https'):
+            raise InvalidUpstream(ERRORS_MESSAGES['upstream-no-scheme'] %
+                                  upstream)
+
+        return upstream
+
+    def _format_path_to_redirect(self):
+        # LOGGER.debug("Path before: %s", self.request.get_full_path())
+        rewriter = Rewriter(self.app_gw, self.request)
+        after = rewriter.build()
+        # LOGGER.debug("Path after: %s", after)
+        return after
+
+    def get_proxy_request_headers(self):
+        """Get normalized headers for the upstream
+        Gets all headers from the original request and normalizes them.
+        Normalization occurs by removing the prefix ``HTTP_`` and
+        replacing and ``_`` by ``-``. Example: ``HTTP_ACCEPT_ENCODING``
+        becames ``Accept-Encoding``.
+        .. versionadded:: 0.9.1
+        :param request:  The original HTTPRequest instance
+        :returns:  Normalized headers for the upstream
+        """
+        return normalize_request_headers(self.request)
+
+    def get_request_headers(self):
+        """Return request headers that will be sent to upstream.
+        The header REMOTE_USER is set to the current user
+        if AuthenticationMiddleware is enabled and
+        the view's add_remote_user property is True.
+        .. versionadded:: 0.9.8
+        """
+        request_headers = self.get_proxy_request_headers()
+        if not self.app_gw.authentication_header:
+            return request_headers
+        request_headers[self.app_gw.authentication_header] = self.request.user.get_username()
+        # LOGGER.debug("%s set", self.app_gw.authentication_header)
+
+        return request_headers
+
+    def check_permission(self):
+        """Check if user is authenticated and has permission to access app"""
+        if not hasattr(self.request, 'user'):
+            return False
+        if not self.request.user.is_authenticated:
+            return False
+        policy_engine = PolicyEngine(POLICY_CACHE[self.app_gw.pk])
+        policy_engine.for_user(self.request.user).with_request(self.request).build()
+        passing, _messages = policy_engine.result
+
+        return passing
+
+    def get_encoded_query_params(self):
+        """Return encoded query params to be used in proxied request"""
+        get_data = encode_items(self.request.GET.lists())
+        return urlencode(get_data)
+
+    def _created_proxy_response(self, path):
+        request_payload = self.request.body
+
+        # LOGGER.debug("Request headers: %s", self._request_headers)
+
+        request_url = self.get_upstream() + path
+        # LOGGER.debug("Request URL: %s", request_url)
+
+        if self.request.GET:
+            request_url += '?' + self.get_encoded_query_params()
+            # LOGGER.debug("Request URL: %s", request_url)
+
+        http = HTTP
+        if not self.app_gw.upstream_ssl_verification:
+            http = HTTP_NO_VERIFY
+
+        try:
+            proxy_response = http.urlopen(self.request.method,
+                                          request_url,
+                                          redirect=False,
+                                          retries=None,
+                                          headers=self._request_headers,
+                                          body=request_payload,
+                                          decode_content=False,
+                                          preload_content=False)
+            # LOGGER.debug("Proxy response header: %s",
+            #              proxy_response.getheaders())
+        except urllib3.exceptions.HTTPError as error:
+            LOGGER.exception(error)
+            raise
+
+        return proxy_response
+
+    def _replace_host_on_redirect_location(self, proxy_response):
+        location = proxy_response.headers.get('Location')
+        if location:
+            if self.request.is_secure():
+                scheme = 'https://'
+            else:
+                scheme = 'http://'
+            request_host = scheme + self.request.META.get('HTTP_HOST')
+
+            upstream_host_http = 'http://' + self._parsed_url.netloc
+            upstream_host_https = 'https://' + self._parsed_url.netloc
+
+            location = location.replace(upstream_host_http, request_host)
+            location = location.replace(upstream_host_https, request_host)
+            proxy_response.headers['Location'] = location
+            # LOGGER.debug("Proxy response LOCATION: %s",
+            #              proxy_response.headers['Location'])
+
+    def _set_content_type(self, proxy_response):
+        content_type = proxy_response.headers.get('Content-Type')
+        if not content_type:
+            content_type = (mimetypes.guess_type(self.request.path)[0] or
+                            self.app_gw.default_content_type)
+            proxy_response.headers['Content-Type'] = content_type
+            # LOGGER.debug("Proxy response CONTENT-TYPE: %s",
+            #              proxy_response.headers['Content-Type'])
+
+    def get_response(self):
+        """Pass request to upstream and return response"""
+        self._request_headers = self.get_request_headers()
+
+        path = self._format_path_to_redirect()
+        proxy_response = self._created_proxy_response(path)
+
+        self._replace_host_on_redirect_location(proxy_response)
+        self._set_content_type(proxy_response)
+        response = get_django_response(proxy_response, strict_cookies=False)
+
+        # LOGGER.debug("RESPONSE RETURNED: %s", response)
+        return response

passbook/app_gw/proxy/rewrite.py

@@ -2,6 +2,7 @@
 
 from passbook.app_gw.models import RewriteRule
 
+RULE_CACHE = {}
 
 class Context:
     """Empty class which we dynamically add attributes to"""
@@ -15,6 +16,9 @@ class Rewriter:
     def __init__(self, application, request):
         self.__application = application
         self.__request = request
+        if self.__application.pk not in RULE_CACHE:
+            RULE_CACHE[self.__application.pk] = RewriteRule.objects.filter(
+                provider__in=[self.__application])
 
     def __build_context(self, matches):
         """Build object with .0, .1, etc as groups and give access to request"""
@@ -27,7 +31,7 @@ class Rewriter:
     def build(self):
         """Run all rules over path and return final path"""
         path = self.__request.get_full_path()
-        for rule in RewriteRule.objects.filter(provider__in=[self.__application]):
+        for rule in RULE_CACHE[self.__application.pk]:
             matches = rule.compiled_matcher.search(path)
             if not matches:
                 continue

passbook/app_gw/signals.py

@@ -6,8 +6,8 @@ from django.core.cache import cache
 from django.db.models.signals import post_save
 from django.dispatch import receiver
 
-from passbook.app_gw.middleware import IGNORED_HOSTNAMES_KEY
 from passbook.app_gw.models import ApplicationGatewayProvider
+from passbook.app_gw.proxy.handler import IGNORED_HOSTNAMES_KEY
 
 LOGGER = getLogger(__name__)
 

passbook/audit/__init__.py

@@ -1,2 +1,2 @@
 """passbook audit Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/captcha_factor/__init__.py

@@ -1,2 +1,2 @@
 """passbook captcha_factor Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/core/__init__.py

@@ -1,2 +1,2 @@
 """passbook core"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/core/management/commands/web.py

@@ -21,10 +21,9 @@ class Command(BaseCommand):
     def daphne_server(self):
         """Run daphne server within autoreload"""
         autoreload.raise_last_exception()
-        with CONFIG.cd('web'):
+        CommandLineInterface().run([
-            CommandLineInterface().run([
+            '-p', str(CONFIG.y('web.port', 8000)),
-                '-p', str(CONFIG.get('port', 8000)),
+            '-b', CONFIG.y('web.listen', '0.0.0.0'),  # nosec
-                '-b', CONFIG.get('listen', '0.0.0.0'),  # nosec
+            '--access-log', '/dev/null',
-                '--access-log', '/dev/null',
+            'passbook.core.asgi:application'
-                'passbook.core.asgi:application'
+        ])
-            ])

passbook/core/migrations/0023_remove_user_applications.py

@@ -0,0 +1,17 @@
+# Generated by Django 2.2 on 2019-04-13 15:51
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('passbook_core', '0022_nonce_expiring'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='user',
+            name='applications',
+        ),
+    ]

passbook/core/models.py

@@ -47,7 +47,6 @@ class User(AbstractUser):
     name = models.TextField()
 
     sources = models.ManyToManyField('Source', through='UserSourceConnection')
-    applications = models.ManyToManyField('Application')
     groups = models.ManyToManyField('Group')
     password_change_date = models.DateTimeField(auto_now_add=True)
 

passbook/core/policies.py

@@ -1,6 +1,5 @@
 """passbook core policy engine"""
-from logging import getLogger
+# from logging import getLogger
-
 from amqp.exceptions import UnexpectedFrame
 from celery import group
 from celery.exceptions import TimeoutError as CeleryTimeoutError
@@ -10,7 +9,7 @@ from ipware import get_client_ip
 from passbook.core.celery import CELERY_APP
 from passbook.core.models import Policy, User
 
-LOGGER = getLogger(__name__)
+# LOGGER = getLogger(__name__)
 
 def _cache_key(policy, user):
     return "%s#%s" % (policy.uuid, user.pk)
@@ -24,8 +23,8 @@ def _policy_engine_task(user_pk, policy_pk, **kwargs):
     user_obj = User.objects.get(pk=user_pk)
     for key, value in kwargs.items():
         setattr(user_obj, key, value)
-    LOGGER.debug("Running policy `%s`#%s for user %s...", policy_obj.name,
+    # LOGGER.debug("Running policy `%s`#%s for user %s...", policy_obj.name,
-                 policy_obj.pk.hex, user_obj)
+    #              policy_obj.pk.hex, user_obj)
     policy_result = policy_obj.passes(user_obj)
     # Handle policy result correctly if result, message or just result
     message = None
@@ -34,10 +33,10 @@ def _policy_engine_task(user_pk, policy_pk, **kwargs):
     # Invert result if policy.negate is set
     if policy_obj.negate:
         policy_result = not policy_result
-    LOGGER.debug("Policy %r#%s got %s", policy_obj.name, policy_obj.pk.hex, policy_result)
+    # LOGGER.debug("Policy %r#%s got %s", policy_obj.name, policy_obj.pk.hex, policy_result)
     cache_key = _cache_key(policy_obj, user_obj)
     cache.set(cache_key, (policy_obj.action, policy_result, message))
-    LOGGER.debug("Cached entry as %s", cache_key)
+    # LOGGER.debug("Cached entry as %s", cache_key)
     return policy_obj.action, policy_result, message
 
 class PolicyEngine:
@@ -82,16 +81,16 @@ class PolicyEngine:
         for policy in self.policies:
             cached_policy = cache.get(_cache_key(policy, self.__user), None)
             if cached_policy:
-                LOGGER.debug("Taking result from cache for %s", policy.pk.hex)
+                # LOGGER.debug("Taking result from cache for %s", policy.pk.hex)
                 cached_policies.append(cached_policy)
             else:
-                LOGGER.debug("Evaluating policy %s", policy.pk.hex)
+                # LOGGER.debug("Evaluating policy %s", policy.pk.hex)
                 signatures.append(_policy_engine_task.signature(
                     args=(self.__user.pk, policy.pk.hex),
                     kwargs=kwargs,
                     time_limit=policy.timeout))
                 self.__get_timeout += policy.timeout
-        LOGGER.debug("Set total policy timeout to %r", self.__get_timeout)
+        # LOGGER.debug("Set total policy timeout to %r", self.__get_timeout)
         # If all policies are cached, we have an empty list here.
         if signatures:
             self.__group = group(signatures)()
@@ -120,7 +119,7 @@ class PolicyEngine:
         for policy_action, policy_result, policy_message in result:
             passing = (policy_action == Policy.ACTION_ALLOW and policy_result) or \
                       (policy_action == Policy.ACTION_DENY and not policy_result)
-            LOGGER.debug('Action=%s, Result=%r => %r', policy_action, policy_result, passing)
+            # LOGGER.debug('Action=%s, Result=%r => %r', policy_action, policy_result, passing)
             if policy_message:
                 messages.append(policy_message)
             if not passing:

passbook/core/requirements.txt

@@ -1,5 +1,6 @@
 celery
 colorlog
+django-guardian
 django-ipware
 django-model-utils
 django-redis

passbook/core/settings.py

@@ -58,7 +58,8 @@ SESSION_CACHE_ALIAS = "default"
 LANGUAGE_COOKIE_NAME = 'passbook_language'
 
 AUTHENTICATION_BACKENDS = [
-    'django.contrib.auth.backends.ModelBackend'
+    'django.contrib.auth.backends.ModelBackend',
+    'guardian.backends.ObjectPermissionBackend',
 ]
 
 # Application definition
@@ -73,6 +74,7 @@ INSTALLED_APPS = [
     'django.contrib.postgres',
     'rest_framework',
     'drf_yasg',
+    'guardian',
     'passbook.core.apps.PassbookCoreConfig',
     'passbook.admin.apps.PassbookAdminConfig',
     'passbook.api.apps.PassbookAPIConfig',
@@ -217,19 +219,21 @@ CELERY_BEAT_SCHEDULE = {
     }
 }
 
-sentry_init(
+
-    dsn=("https://55b5dd780bc14f4c96bba69b7a9abbcc:449af483bd0745"
+if not DEBUG:
-         "0d83be640d834e5458@sentry.services.beryju.org/8"),
+    sentry_init(
-    integrations=[
+        dsn=("https://55b5dd780bc14f4c96bba69b7a9abbcc:449af483bd0745"
-        DjangoIntegration(),
+             "0d83be640d834e5458@sentry.services.beryju.org/8"),
-        CeleryIntegration(),
+        integrations=[
-        LoggingIntegration(
+            DjangoIntegration(),
-            level=logging.INFO,
+            CeleryIntegration(),
-            event_level=logging.ERROR
+            LoggingIntegration(
-        )
+                level=logging.INFO,
-    ],
+                event_level=logging.ERROR
-    send_default_pii=True
+            )
-)
+        ],
+        send_default_pii=True,
+    )
 
 # Static files (CSS, JavaScript, Images)
 # https://docs.djangoproject.com/en/2.1/howto/static-files/
@@ -237,8 +241,6 @@ sentry_init(
 STATIC_URL = '/static/'
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
 
-LOG_HANDLERS = ['console', 'syslog', 'file']
-
 with CONFIG.cd('log'):
     LOGGING = {
         'version': 1,
@@ -281,41 +283,50 @@ with CONFIG.cd('log'):
                 'formatter': 'verbose',
                 'filename': CONFIG.get('file'),
             },
+            'queue': {
+                'level': CONFIG.get('level').get('console'),
+                'class': 'passbook.lib.log.QueueListenerHandler',
+                'handlers': [
+                    'cfg://handlers.console',
+                    # 'cfg://handlers.syslog',
+                    'cfg://handlers.file',
+                ],
+            }
         },
         'loggers': {
             'passbook': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'DEBUG',
                 'propagate': True,
             },
             'django': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'INFO',
                 'propagate': True,
             },
             'tasks': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'DEBUG',
                 'propagate': True,
             },
             'cherrypy': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'DEBUG',
                 'propagate': True,
             },
             'oauthlib': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'DEBUG',
                 'propagate': True,
             },
             'oauth2_provider': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
                 'level': 'DEBUG',
                 'propagate': True,
             },
             'daphne': {
-                'handlers': LOG_HANDLERS,
+                'handlers': ['queue'],
-                'level': 'DEBUG',
+                'level': 'INFO',
                 'propagate': True,
             }
         }

passbook/core/views/overview.py

@@ -2,8 +2,7 @@
 
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.views.generic import TemplateView
-
+from guardian.shortcuts import get_objects_for_user
-from passbook.core.models import Application
 
 
 class OverviewView(LoginRequiredMixin, TemplateView):
@@ -13,7 +12,6 @@ class OverviewView(LoginRequiredMixin, TemplateView):
     template_name = 'overview/index.html'
 
     def get_context_data(self, **kwargs):
-        kwargs['applications'] = self.request.user.applications.all()
+        kwargs['applications'] = get_objects_for_user(self.request.user,
-        if self.request.user.is_superuser:
+                                                      'passbook_core.view_application')
-            kwargs['applications'] = Application.objects.all()
         return super().get_context_data(**kwargs)

passbook/hibp_policy/__init__.py

@@ -1,2 +1,2 @@
 """passbook hibp_policy"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/ldap/__init__.py

@@ -1,2 +1,2 @@
 """Passbook ldap app Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/lib/__init__.py

@@ -1,2 +1,2 @@
 """passbook lib"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/lib/log.py

@@ -0,0 +1,37 @@
+"""QueueListener that can be configured from logging.dictConfig"""
+from atexit import register
+from logging.config import ConvertingList
+from logging.handlers import QueueHandler, QueueListener
+from queue import Queue
+
+
+def _resolve_handlers(_list):
+    """Evaluates ConvertingList by iterating over it"""
+    if not isinstance(_list, ConvertingList):
+        return _list
+
+    # Indexing the list performs the evaluation.
+    return [_list[i] for i in range(len(_list))]
+
+
+class QueueListenerHandler(QueueHandler):
+    """QueueListener that can be configured from logging.dictConfig"""
+
+    def __init__(self, handlers, auto_run=True, queue=Queue(-1)):
+        super().__init__(queue)
+        handlers = _resolve_handlers(handlers)
+        self._listener = QueueListener(
+            self.queue,
+            *handlers,
+            respect_handler_level=True)
+        if auto_run:
+            self.start()
+            register(self.stop)
+
+    def start(self):
+        """start background thread"""
+        self._listener.start()
+
+    def stop(self):
+        """stop background thread"""
+        self._listener.stop()

passbook/oauth_client/__init__.py

@@ -1,2 +1,2 @@
 """passbook oauth_client Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/oauth_provider/__init__.py

@@ -1,2 +1,2 @@
 """passbook oauth_provider Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/oauth_provider/views/oauth2.py

@@ -36,6 +36,13 @@ class PassbookAuthorizationView(AccessMixin, AuthorizationView):
 
     _application = None
 
+    def _inject_response_type(self):
+        """Inject response_type into querystring if not set"""
+        LOGGER.debug("response_type not set, defaulting to 'code'")
+        querystring = urlencode(self.request.GET)
+        querystring += '&response_type=code'
+        return redirect(reverse('passbook_oauth_provider:oauth2-ok-authorize') + '?' + querystring)
+
     def dispatch(self, request, *args, **kwargs):
         """Update OAuth2Provider's skip_authorization state"""
         # Get client_id to get provider, so we can update skip_authorization field
@@ -55,6 +62,9 @@ class PassbookAuthorizationView(AccessMixin, AuthorizationView):
             for policy_meaage in policy_meaages:
                 messages.error(request, policy_meaage)
             return redirect('passbook_oauth_provider:oauth2-permission-denied')
+        # Some clients don't pass response_type, so we default to code
+        if 'response_type' not in request.GET:
+            return self._inject_response_type()
         actual_response = super().dispatch(request, *args, **kwargs)
         if actual_response.status_code == 400:
             LOGGER.debug(request.GET.get('redirect_uri'))

passbook/otp/__init__.py

@@ -1,2 +1,2 @@
 """passbook otp Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/password_expiry_policy/__init__.py

@@ -1,2 +1,2 @@
 """passbook password_expiry"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/saml_idp/__init__.py

@@ -1,2 +1,2 @@
 """passbook saml_idp Header"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'

passbook/suspicious_policy/__init__.py

@@ -1,2 +1,2 @@
 """passbook suspicious_policy"""
-__version__ = '0.1.29-beta'
+__version__ = '0.1.32-beta'