Use OAuth sessions for web API requests

web_view.py

@@ -207,6 +207,22 @@ def global_user() -> None:
     flask.g.oauth_session = mediawiki_oauth.get_oauth_session()
 
 
+def is_logged_in() -> bool:
+    """Return true when the current request has a Wikipedia OAuth session."""
+    return flask.g.oauth_session is not None
+
+
+def login_redirect() -> Response:
+    """Redirect the current browser request through Wikipedia OAuth."""
+    next_url = flask.request.full_path.rstrip("?")
+    return flask.redirect(flask.url_for("start_oauth", next=next_url))
+
+
+def login_required_json() -> tuple[werkzeug.wrappers.response.Response, int]:
+    """Return a JSON login-required response without making MediaWiki API calls."""
+    return flask.jsonify(error="login required"), 401
+
+
 @app.route("/")
 def index() -> str | Response:
     """Index page."""
@@ -406,6 +422,10 @@ def _record_skip(from_title: str, hit_title: str) -> None:
 
 def handle_post(url_title: str) -> Response:
     """Handle POST request."""
+    if not is_logged_in():
+        next_url = flask.url_for("article_page", url_title=url_title)
+        return flask.redirect(flask.url_for("start_oauth", next=next_url))
+
     from_title = url_title.replace("_", " ").strip()
     hit_title = flask.request.form["hit"]
     try:
@@ -436,6 +456,9 @@ def article_page(url_title: str) -> str | Response:
     if flask.request.method == "POST":
         return handle_post(url_title)
 
+    if not is_logged_in():
+        return login_redirect()
+
     from_title = url_title.replace("_", " ").strip()
 
     try:
@@ -525,6 +548,9 @@ def save_done() -> str:
 @app.route("/api/1/hits")
 def api_hits() -> werkzeug.wrappers.response.Response:
     """Return candidates for the given article title."""
+    if not is_logged_in():
+        return login_required_json()
+
     title = flask.request.args.get("title")
     assert title
     ret = core.do_search(title)
@@ -537,6 +563,9 @@ def api_hits() -> werkzeug.wrappers.response.Response:
 @app.route("/api/1/valid_hit")
 def api_valid_hit() -> werkzeug.wrappers.response.Response:
     """Check if a candidate article has a valid unlinked mention."""
+    if not is_logged_in():
+        return login_required_json()
+
     link_to = flask.request.args["link_to"]
     link_from = flask.request.args["link_from"]
     redirect_to = flask.request.args.get("redirect_to") or None