yumoqing/dapi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugfix

Browse Source
This commit is contained in:
yumoqing 2025-07-31 15:29:29 +08:00
parent b584cf07c3
commit ccd01a82ab
1 changed files with 21 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
dapi/dapi.py
View File

@ -30,37 +30,51 @@ async def get_secretkey(sor, appid):
f = get_serverenv('password_decode') f = get_serverenv('password_decode')
return f(secret_key).encode('utf-8') return f(secret_key).encode('utf-8')
async def get_apikey_user(sor, apikey): async def get_apikey_user(sor, apikey, client_ip):
f = get_serverenv('password_encode') f = get_serverenv('password_encode')
apikey = f(apikey) apikey = f(apikey)
sql = """select u.* from downapikey a, users u sql = """select u.*, b.allowedips from downapikey a, users u, downapp b
where a.userid = b.id where a.userid = b.id
and b.id = a.dappid
and apikey=${apikey}$ and apikey=${apikey}$
and expired_date > ${today}$""" and expired_date > ${today}$"""
recs = await sor.sqlExe(sql, {"apikey":apikey, 'today': curDateString()}) recs = await sor.sqlExe(sql, {"apikey":apikey, 'today': curDateString()})
if len(recs) < 1: if len(recs) < 1:
debug(f'{apikey=} not registered')
return None
ips = rec[i].allowedips.split(',')
ips = [ ip.strip() for ip in ips ]
if client_ip not in ips:
debug(f' {client_ip} not in {ips=}')
return None return None
return recs[0] return recs[0]
async def bearer_auth(auth): async def bearer_auth(request):
auth = request.headers.get('Authorization')
if auth is None:
return None
if not auth.startswith('Bearer '): if not auth.startswith('Bearer '):
return None return None
apikey = auth[7:] apikey = auth[7:]
client_ip = request['client_ip']
if apikey is None: if apikey is None:
return None return None
db = DBPools() db = DBPools()
dbname = get_dbname() dbname = get_dbname()
async with db.sqlorContext(dbname) as sor: async with db.sqlorContext(dbname) as sor:
user = await get_apikey_user(sor, apikey) user = await get_apikey_user(sor, apikey, client_ip)
await user_login(user.id, username=user.username, userorgid=user.orgid) await user_login(user.id, username=user.username, userorgid=user.orgid)
return user.id return user.id
return None return None
async def deerer_auth(auth): async def deerer_auth(request):
auth = request.headers.get('Authorization')
if auth is None:
return None
if not auth.startswith('Deerer '): if not auth.startswith('Deerer '):
return None return None
client_ip = request['client_ip']
deer_data = auth[7:] deer_data = auth[7:]
appid, cyber = bear_data.split('-:-') appid, cyber = bear_data.split('-:-')
db = DBPools() db = DBPools()
@ -69,7 +83,7 @@ async def deerer_auth(auth):
secretkey = await get_secretkey(sor, appid) secretkey = await get_secretkey(sor, appid)
txt = aes_decrypt_ecb(secretkey, cyber) txt = aes_decrypt_ecb(secretkey, cyber)
t, apikey = txt.split(':') t, apikey = txt.split(':')
user = await get_apikey_user(apikey) user = await get_apikey_user(sor, apikey, client_ip)
await user_login(user.id, username=user.username, userorgid=user.orgid) await user_login(user.id, username=user.username, userorgid=user.orgid)
return user.id return user.id