Test MeB OAuth provider

consul_config.py.ctmpl

@@ -21,10 +21,11 @@ MUSICBRAINZ_HOSTNAME = '''{{template "KEY" "musicbrainz/hostname"}}'''
 MUSICBRAINZ_USERAGENT = '''{{template "KEY" "musicbrainz/useragent"}}'''
 MUSICBRAINZ_CLIENT_ID = '''{{template "KEY" "musicbrainz/client_id"}}'''
 MUSICBRAINZ_CLIENT_SECRET = '''{{template "KEY" "musicbrainz/client_secret"}}'''
+MUSICBRAINZ_OAUTH_URL = '''{{template "KEY" "musicbrainz/oauth_url"}}'''
 
 {{if service "pgbouncer-master"}}
 {{with index (service "pgbouncer-master") 0}}
-SQLALCHEMY_DATABASE_URI = "postgresql://critiquebrainz:critiquebrainz@{{.Address}}:{{.Port}}/critiquebrainz_db"
+SQLALCHEMY_DATABASE_URI = "postgresql://{{template "KEY" "critiquebrainz/dbuser"}}:{{template "KEY" "critiquebrainz/dbpass"}}@{{.Address}}:{{.Port}}/{{template "KEY" "critiquebrainz/dbname"}}"
 BB_DATABASE_URI = "postgresql://{{template "KEY" "bookbrainz/dbuser"}}:{{template "KEY" "bookbrainz/dbpass"}}@{{.Address}}:{{.Port}}/{{template "KEY" "bookbrainz/dbname"}}"
 {{end}}
 {{end}}

critiquebrainz/frontend/__init__.py

@@ -110,9 +110,9 @@ def create_app(debug=None, config_path=None):
         name='musicbrainz',
         client_id=app.config['MUSICBRAINZ_CLIENT_ID'],
         client_secret=app.config['MUSICBRAINZ_CLIENT_SECRET'],
-        authorize_url="https://musicbrainz.org/oauth2/authorize",
-        access_token_url="https://musicbrainz.org/oauth2/token",
-        base_url="https://musicbrainz.org/",
+        authorize_url=app.config['MUSICBRAINZ_OAUTH_URL'] + "/authorize",
+        access_token_url=app.config['MUSICBRAINZ_OAUTH_URL'] + "/token",
+        base_url=app.config['MUSICBRAINZ_OAUTH_URL'],
     )
 
     # APIs

critiquebrainz/frontend/login/provider.py

@@ -74,7 +74,7 @@ def get_user(self):
                 data=data,
                 decoder=musicbrainz_auth_session_decoder,
             )
-            data = s.get('oauth2/userinfo').json()
+            data = s.get('userinfo').json()
             musicbrainz_id = data.get('sub')
             musicbrainz_row_id = data.get('metabrainz_user_id')
             user = db_users.get_or_create(musicbrainz_row_id, musicbrainz_id, new_user_data={

critiquebrainz/ws/oauth/provider.py

@@ -1,7 +1,8 @@
 from datetime import datetime, timedelta
 from functools import wraps
 
-from flask import request
+import requests
+from flask import request, current_app
 
 import critiquebrainz.db.exceptions as db_exceptions
 import critiquebrainz.db.oauth_client as db_oauth_client
@@ -184,24 +185,53 @@ def generate_token(self, client_id, refresh_token, user_id, scope=None):
 
         return access_token, 'Bearer', self.token_expire, refresh_token
 
+    def introspect_meb_token(self, access_token):
+        response = requests.post(
+            current_app.config["MUSICBRAINZ_OAUTH_URL"] + "/introspect",
+            data={
+                "client_id": current_app.config["MUSICBRAINZ_CLIENT_ID"],
+                "client_secret": current_app.config["MUSICBRAINZ_CLIENT_SECRET"],
+                "token": access_token,
+                "token_type_hint": "access_token",
+            }
+        )
+        return response.json()
+
     def get_authorized_user(self, scopes):
         authorization = request.headers.get('Authorization')
         if self.validate_authorization_header(authorization) is False:
             raise NotAuthorized
 
         access_token = authorization.split()[1]
-        token = self.fetch_access_token(access_token)
-        if token is None:
-            raise exceptions.InvalidToken
 
-        if token["expires"] < datetime.now():
-            raise exceptions.InvalidToken
+        if access_token.startswith("meba_"):
+            token = self.introspect_meb_token(access_token)
+            if not token["active"]:
+                raise exceptions.InvalidToken
+            if datetime.fromtimestamp(token["expires_at"]) < datetime.now():
+                raise exceptions.InvalidToken
 
-        for scope in scopes:
-            if scope not in db_oauth_token.get_scopes(token["id"]):
+            token_scopes = token["scope"]
+            for scope in scopes:
+                if scope not in token_scopes:
+                    raise exceptions.InvalidToken
+
+            user = User(db_users.get_by_mbid(token["sub"]))
+            return user
+        else:
+            token = self.fetch_access_token(access_token)
+            if token is None:
+                raise exceptions.InvalidToken
+            if token["expires"] < datetime.now():
                 raise exceptions.InvalidToken
-        user = User(db_users.get_by_id(token["user_id"]))
-        return user
+
+            token_scopes = db_oauth_token.get_scopes(token["id"])
+            for scope in scopes:
+                if scope not in token_scopes:
+                    raise exceptions.InvalidToken
+
+            user = User(db_users.get_by_id(token["user_id"]))
+            return user
 
     def require_auth(self, *scopes):
         def decorator(f):

custom_config.py.example

@@ -27,6 +27,7 @@ SECRET_KEY = "CHANGE_THIS"
 #MUSICBRAINZ_USERAGENT = "CritiqueBrainz Custom"
 MUSICBRAINZ_CLIENT_ID = ""
 MUSICBRAINZ_CLIENT_SECRET = ""
+MUSICBRAINZ_OAUTH_URL = ""
 
 # Server with Spotify mappings
 # https://github.com/metabrainz/mbspotify

default_config.py

@@ -63,6 +63,7 @@
 MUSICBRAINZ_USERAGENT = "CritiqueBrainz"
 MUSICBRAINZ_CLIENT_ID = ""
 MUSICBRAINZ_CLIENT_SECRET = ""
+MUSICBRAINZ_OAUTH_URL = ""
 
 # Spotify
 SPOTIFY_CLIENT_ID = ""

docker/docker-compose.dev.yml

@@ -1,6 +1,3 @@
-# Docker Compose file for development
-version: "3.4"
-
 volumes:
   cb_home:
   cb_postgres: