Add authentication via UniAuth

agenda/auth.py

@@ -0,0 +1,29 @@
+"""Authentication via UniAuth."""
+
+import flask
+import werkzeug
+from itsdangerous.url_safe import URLSafeTimedSerializer
+
+max_age = 60 * 60 * 24 * 90
+
+
+def verify_auth_token(token: str) -> str | None:
+    """Verify the authentication token."""
+    serializer = URLSafeTimedSerializer(flask.current_app.config["SECRET_KEY"])
+    try:
+        username = serializer.loads(token, salt="auth", max_age=max_age)
+    except Exception:
+        return None
+
+    assert isinstance(username, str)
+    return username
+
+
+def require_authentication() -> werkzeug.Response | None:
+    """Require authentication."""
+    token = flask.request.cookies.get("auth_token")
+    return (
+        None
+        if token and verify_auth_token(token)
+        else flask.redirect(flask.current_app.config["UNIAUTH_LOGIN_URL"])
+    )

web_view.py

@@ -15,6 +15,7 @@ import werkzeug
 import werkzeug.debug.tbtools
 import yaml
 
+import agenda.auth
 import agenda.data
 import agenda.error_mail
 import agenda.holidays
@@ -27,6 +28,8 @@ app = flask.Flask(__name__)
 app.debug = False
 app.config.from_object("config.default")
 
+app.before_request(agenda.auth.require_authentication)
+
 agenda.error_mail.setup_error_mail(app)