Add authetication for API

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/api.py

@@ -22,6 +22,7 @@
 from vulnerabilities.models import Vulnerability
 from vulnerabilities.models import VulnerabilityReference
 from vulnerabilities.models import VulnerabilitySeverity
+from vulnerablecode.auth import ConditionalLoginRequired
 
 
 class VulnerabilitySeveritySerializer(serializers.ModelSerializer):
@@ -30,6 +31,10 @@ class Meta:
         fields = ["value", "scoring_system"]
 
 
+class AuthenticatedAPIViewSet(ConditionalLoginRequired, viewsets.ReadOnlyModelViewSet):
+    pass
+
+
 class VulnerabilityReferenceSerializer(serializers.ModelSerializer):
     scores = VulnerabilitySeveritySerializer(many=True, source="vulnerabilityseverity_set")
     reference_url = serializers.CharField(source="url")
@@ -206,7 +211,7 @@ def filter_purl(self, queryset, name, value):
         return self.queryset.filter(**attrs)
 
 
-class PackageViewSet(viewsets.ReadOnlyModelViewSet):
+class PackageViewSet(AuthenticatedAPIViewSet):
     queryset = Package.objects.all()
     serializer_class = PackageSerializer
     filter_backends = (filters.DjangoFilterBackend,)
@@ -253,7 +258,7 @@ class Meta:
         fields = ["vulnerability_id"]
 
 
-class VulnerabilityViewSet(viewsets.ReadOnlyModelViewSet):
+class VulnerabilityViewSet(AuthenticatedAPIViewSet):
     def get_fixed_packages_qs(self):
         """
         Filter the packages that fixes a vulnerability
@@ -295,7 +300,7 @@ def filter_cpe(self, queryset, name, value):
         return self.queryset.filter(vulnerabilityreference__reference_id__startswith=cpe).distinct()
 
 
-class CPEViewSet(viewsets.ReadOnlyModelViewSet):
+class CPEViewSet(AuthenticatedAPIViewSet):
     queryset = Vulnerability.objects.filter(
         vulnerabilityreference__reference_id__startswith="cpe"
     ).distinct()
@@ -336,7 +341,7 @@ def filter_alias(self, queryset, name, value):
         return self.queryset.filter(aliases__alias__icontains=alias)
 
 
-class AliasViewSet(viewsets.ReadOnlyModelViewSet):
+class AliasViewSet(AuthenticatedAPIViewSet):
     queryset = Vulnerability.objects.all()
     serializer_class = VulnerabilitySerializer
     filter_backends = (filters.DjangoFilterBackend,)

vulnerabilities/models.py

@@ -12,13 +12,16 @@
 import logging
 import uuid
 
+from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.validators import MaxValueValidator
 from django.core.validators import MinValueValidator
 from django.db import models
+from django.dispatch import receiver
 from django.utils.http import int_to_base36
 from packageurl import PackageURL
 from packageurl.contrib.django.models import PackageURLMixin
+from rest_framework.authtoken.models import Token
 
 from vulnerabilities.importer import AdvisoryData
 from vulnerabilities.importer import AffectedPackage
@@ -418,3 +421,12 @@ def to_advisory_data(self) -> AdvisoryData:
             references=[Reference.from_dict(ref) for ref in self.references],
             date_published=self.date_published,
         )
+
+
+@receiver(models.signals.post_save, sender=settings.AUTH_USER_MODEL)
+def create_auth_token(sender, instance=None, created=False, **kwargs):
+    """
+    Creates an API key token on user creation, using the signal system.
+    """
+    if created:
+        Token.objects.create(user_id=instance.pk)

vulnerabilities/templates/accounts/profile.html

@@ -0,0 +1,30 @@
+{% extends "base.html" %}
+
+{% block content %}
+<div class="container is-max-desktop">
+
+  <section class="section pt-0">
+    <div class="is-flex is-justify-content-space-between mb-2">
+      <nav class="breadcrumb is-medium mb-1" aria-label="breadcrumbs">
+        <ul>
+          <li class="is-active"><a href="#" aria-current="page">Profile settings</a></li>
+        </ul>
+      </nav>
+    </div>
+
+    <article class="message is-warning">
+      <div class="message-body">
+        <strong>An API key is like a password and should be treated with the same care.</strong>
+      </div>
+    </article>
+
+    <div class="field">
+      <label class="label">API Key</label>
+      <div class="control has-icons-left">
+        <input class="input" type="text" value="{{ request.user.auth_token.key|default:'Not available' }}" readonly>
+      </div>
+    </div>
+
+  </section>
+</div>
+{% endblock %}

vulnerabilities/templates/base.html

@@ -23,6 +23,20 @@
                 <a class="navbar-item" href="{% url 'vulnerability_search' %}">
                     Vulnerabilities
                 </a>
+                {% if user.is_authenticated %}
+                <div class="navbar-item has-dropdown is-hoverable">
+                  <a class="navbar-link">
+                    {{ user.username }}
+                  </a>
+                  <div class="navbar-dropdown is-right">
+                    <a class="navbar-item" href="{% url 'account_profile' %}">
+                      Profile settings
+                    </a>
+                    <a class="navbar-item" href="{% url 'logout' %}">
+                      Sign out
+                    </a>
+                  </div>
+                {% endif %}
             </div>
         </div>
     </nav>

vulnerabilities/templates/registration/login.html

@@ -0,0 +1,41 @@
+{% extends "base.html" %}
+
+{% block content %}
+  <div class="container is-max-desktop">
+    {% if form.errors %}
+      <article class="message is-danger">
+        <div class="message-body">
+          Your username and password didn't match. Please try again.
+        </div>
+      </article>
+    {% endif %}
+
+    <section class="section mt-6 pt-0 columns is-mobile">
+      <div class="column is-half is-offset-one-quarter">
+        <form class="box" method="post" action="{% url 'login' %}">
+          {% csrf_token %}
+
+          <div class="field">
+            <label class="label">Username</label>
+            <div class="control has-icons-left">
+              <input class="input" type="text" name="username" autofocus autocomplete="username" maxlength="150" required id="id_username">
+            </div>
+          </div>
+
+          <div class="field mb-5">
+            <label class="label">Password</label>
+            <div class="control has-icons-left">
+              <input class="input" type="password" name="password" autocomplete="current-password" required id="id_password">
+            </div>
+          </div>
+
+          <input type="hidden" name="next" value="{{ next }}">
+          <div class="control">
+            <input type="submit" class="button is-link is-fullwidth has-text-weight-bold" value="Sign in">
+          </div>
+        </form>
+      </div>
+
+    </section>
+  </div>
+{% endblock %}

vulnerabilities/views.py

@@ -9,6 +9,7 @@
 
 from urllib.parse import urlencode
 
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.core.paginator import PageNotAnInteger
 from django.core.paginator import Paginator
 from django.db.models import Count
@@ -17,6 +18,7 @@
 from django.shortcuts import render
 from django.urls import reverse
 from django.views import View
+from django.views import generic
 from django.views.generic.edit import UpdateView
 from django.views.generic.list import ListView
 
@@ -167,3 +169,7 @@ def schema_view(request):
     if request.method != "GET":
         return HttpResponseNotAllowed()
     return render(request, "api_doc.html")
+
+
+class AccountProfileView(LoginRequiredMixin, generic.TemplateView):
+    template_name = "accounts/profile.html"

vulnerablecode/auth.py

@@ -0,0 +1,49 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/nexB/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+# This is copied from https://github.com/nexB/scancode.io/commit/eab8eeb13989c26a1600cc64e8b054f171341063
+#
+
+from django.conf import settings
+from django.contrib.auth.decorators import user_passes_test
+from django.contrib.auth.mixins import UserPassesTestMixin
+
+
+def is_authenticated_when_required(user):
+    """
+    Returns True if the `user` is authenticated when the
+    `VULNERABLECODEIO_REQUIRE_AUTHENTICATION` setting is enabled.
+    Always True when the Authentication is not enabled.
+    """
+    if not settings.VULNERABLECODEIO_REQUIRE_AUTHENTICATION:
+        return True
+
+    if user.is_authenticated:
+        return True
+
+    return False
+
+
+def conditional_login_required(function=None):
+    """
+    Decorator for views that checks that the current user is authenticated when
+    authentication is enabled.
+    """
+    actual_decorator = user_passes_test(is_authenticated_when_required)
+    if function:
+        return actual_decorator(function)
+    return actual_decorator
+
+
+class ConditionalLoginRequired(UserPassesTestMixin):
+    """
+    CBV mixin for views that checks that the current user is authenticated when
+    authentication is enabled.
+    """
+
+    def test_func(self):
+        return is_authenticated_when_required(self.request.user)

vulnerablecode/settings.py

@@ -129,6 +129,13 @@
 
 USE_I18N = True
 
+VULNERABLECODEIO_REQUIRE_AUTHENTICATION = env.bool(
+    "VULNERABLECODEIO_REQUIRE_AUTHENTICATION", default=False
+)
+
+LOGIN_REDIRECT_URL = "/"
+LOGOUT_REDIRECT_URL = "/"
+
 USE_L10N = True
 
 USE_TZ = True
@@ -163,3 +170,6 @@
     # Limit the load on the Database returning a small number of records by default. https://github.com/nexB/vulnerablecode/issues/819
     "PAGE_SIZE": 10,
 }
+
+if not VULNERABLECODEIO_REQUIRE_AUTHENTICATION:
+    REST_FRAMEWORK["DEFAULT_PERMISSION_CLASSES"] = ("rest_framework.permissions.AllowAny",)

vulnerablecode/urls.py

@@ -8,6 +8,7 @@
 #
 
 from django.contrib import admin
+from django.contrib.auth import views as auth_views
 from django.urls import include
 from django.urls import path
 from rest_framework.routers import DefaultRouter
@@ -16,6 +17,7 @@
 from vulnerabilities.api import CPEViewSet
 from vulnerabilities.api import PackageViewSet
 from vulnerabilities.api import VulnerabilityViewSet
+from vulnerabilities.views import AccountProfileView
 from vulnerabilities.views import HomePage
 from vulnerabilities.views import PackageSearchView
 from vulnerabilities.views import PackageUpdate
@@ -47,5 +49,12 @@ def __init__(self, *args, **kwargs):
     path("vulnerabilities/<int:pk>", VulnerabilityDetails.as_view(), name="vulnerability_view"),
     path("vulnerabilities/search", VulnerabilitySearchView.as_view(), name="vulnerability_search"),
     path("", HomePage.as_view(), name="home"),
+    path("accounts/profile/", AccountProfileView.as_view(), name="account_profile"),
+    path("accounts/login/", auth_views.LoginView.as_view(), name="login"),
+    path(
+        "accounts/logout/",
+        auth_views.LogoutView.as_view(next_page="login"),
+        name="logout",
+    ),
     path(r"api/", include(api_router.urls)),
 ]