Work on handling auth token

changedetectionio/__init__.py

@@ -36,11 +36,12 @@ from flask import (
     url_for,
 )
 from flask_login import login_required
-from flask_restful import reqparse, abort, Api, Resource
+from flask_restful import abort, Api
 
 from flask_wtf import CSRFProtect
 
-from changedetectionio import api_v1, html_tools
+from changedetectionio import html_tools
+from changedetectionio.api import api_v1
 
 __version__ = '0.39.13.1'
 
@@ -696,6 +697,7 @@ def changedetection_app(config=None, datastore_o=None):
                                  form=form,
                                  current_base_url = datastore.data['settings']['application']['base_url'],
                                  hide_remove_pass=os.getenv("SALTED_PASS", False),
+                                 api_key=datastore.data['settings']['application'].get('api_access_token'),
                                  emailprefix=os.getenv('NOTIFICATION_MAIL_BUTTON_PREFIX', False))
 
         return output

changedetectionio/api/api_v1.py

@@ -1,6 +1,8 @@
 from flask_restful import abort, Resource
 from flask import request, make_response
 import validators
+from . import auth
+
 
 
 # https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
@@ -14,6 +16,7 @@ class Watch(Resource):
     # Get information about a single watch, excluding the history list (can be large)
     # curl http://localhost:4000/api/v1/watch/<string:uuid>
     # ?recheck=true
+    @auth.check_token
     def get(self, uuid):
         from copy import deepcopy
         watch = deepcopy(self.datastore.data['watching'].get(uuid))
@@ -29,6 +32,7 @@ class Watch(Resource):
         del (watch['history'])
         return watch
 
+    @auth.check_token
     def delete(self, uuid):
         if not self.datastore.data['watching'].get(uuid):
             abort(400, message='No watch exists with the UUID of {}'.format(uuid))
@@ -59,6 +63,7 @@ class WatchSingleHistory(Resource):
     # Read a given history snapshot and return its content
     # <string:timestamp> or "latest"
     # curl http://localhost:4000/api/v1/watch/<string:uuid>/history/<int:timestamp>
+    @auth.check_token
     def get(self, uuid, timestamp):
         watch = self.datastore.data['watching'].get(uuid)
         if not watch:
@@ -84,6 +89,7 @@ class CreateWatch(Resource):
         self.datastore = kwargs['datastore']
         self.update_q = kwargs['update_q']
 
+    @auth.check_token
     def post(self):
         # curl http://localhost:4000/api/v1/watch -H "Content-Type: application/json" -d '{"url": "https://my-nice.com", "tag": "one, two" }'
         json_data = request.get_json()
@@ -101,6 +107,7 @@ class CreateWatch(Resource):
     # Return concise list of available watches and some very basic info
     # curl http://localhost:4000/api/v1/watch|python -mjson.tool
     # ?recheck_all=1 to recheck all
+    @auth.check_token
     def get(self):
         list = {}
         for k, v in self.datastore.data['watching'].items():

changedetectionio/api/auth.py

@@ -0,0 +1,30 @@
+from flask import request, make_response, jsonify
+from functools import wraps
+
+
+# Simple API auth key comparison
+# @todo - Maybe short lived token in the future?
+
+def check_token(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        datastore = args[0].datastore
+
+        try:
+            api_key_header = request.headers['x-api-key']
+        except KeyError:
+            return make_response(
+                jsonify("No authorization x-api-key header."), 403
+            )
+
+        config_api_token = datastore.data['settings']['application'].get('api_access_token')
+        config_api_token_enabled = datastore.data['settings']['application'].get('api_access_token_enabled')
+
+        if config_api_token_enabled and api_key_header != config_api_token:
+            return make_response(
+                jsonify("Invalid access - API key invalid.", 403)
+            )
+
+        return f(*args, **kwargs)
+
+    return decorated

changedetectionio/forms.py

@@ -374,6 +374,8 @@ class globalSettingsApplicationForm(commonSettingsForm):
     empty_pages_are_a_change =  BooleanField('Treat empty pages as a change?', default=False)
     render_anchor_tag_content = BooleanField('Render anchor tag content', default=False)
     fetch_backend = RadioField('Fetch Method', default="html_requests", choices=content_fetcher.available_fetchers(), validators=[ValidateContentFetcherIsReady()])
+
+    api_access_token_enabled = BooleanField('API access token security check enabled', default=False)
     password = SaltyPasswordField()
 
 

changedetectionio/model/App.py

@@ -27,6 +27,7 @@ class model(dict):
                     'proxy': None # Preferred proxy connection
                 },
                 'application': {
+                    'api_access_token_enabled': True,
                     'password': False,
                     'base_url' : None,
                     'extract_title_as_title': False,

changedetectionio/static/js/global-settings.js

@@ -1,4 +1,4 @@
-$(document).ready(function() {
+$(document).ready(function () {
     function toggle() {
         if ($('input[name="application-fetch_backend"]:checked').val() != 'html_requests') {
             $('#requests-override-options').hide();
@@ -8,9 +8,29 @@ $(document).ready(function() {
             $('#webdriver-override-options').hide();
         }
     }
+
     $('input[name="application-fetch_backend"]').click(function (e) {
         toggle();
     });
     toggle();
 
+    $("#api-key").hover(
+        function () {
+            $("#api-key-copy").html('copy').fadeIn();
+        },
+        function () {
+            $("#api-key-copy").hide();
+        }
+    ).click(function (e) {
+        $("#api-key-copy").html('copied');
+        var range = document.createRange();
+        var n = $("#api-key")[0];
+        range.selectNode(n);
+        window.getSelection().removeAllRanges();
+        window.getSelection().addRange(range);
+        document.execCommand("copy");
+        window.getSelection().removeAllRanges();
+
+    });
 });
+

changedetectionio/static/styles/styles.css

@@ -456,3 +456,9 @@ ul {
 
 #webdriver-override-options input[type="number"] {
   width: 5em; }
+
+#api-key:hover {
+  cursor: pointer; }
+
+#api-key-copy {
+  color: #0078e7; }

changedetectionio/static/styles/styles.scss

@@ -653,4 +653,14 @@ ul {
         input[type="number"] {
             width: 5em;
         }
-}
+}
+
+#api-key {
+  &:hover {
+    cursor: pointer;
+  }
+}
+
+#api-key-copy {
+  color: #0078e7;
+}

changedetectionio/store.py

@@ -12,6 +12,7 @@ from os import mkdir, path, unlink
 from threading import Lock
 import re
 import requests
+import secrets
 
 from . model import App, Watch
 
@@ -107,10 +108,13 @@ class ChangeDetectionStore:
 
         # Generate the URL access token for RSS feeds
         if not 'rss_access_token' in self.__data['settings']['application']:
-            import secrets
             secret = secrets.token_hex(16)
             self.__data['settings']['application']['rss_access_token'] = secret
 
+        # Generate the API access token
+        if not 'api_access_token' in self.__data['settings']['application']:
+            secret = secrets.token_hex(16)
+            self.__data['settings']['application']['api_access_token'] = secret
 
         # Proxy list support - available as a selection in settings when text file is imported
         # CSV list

changedetectionio/templates/settings.html

@@ -20,6 +20,7 @@
             <li class="tab"><a href="#notifications">Notifications</a></li>
             <li class="tab"><a href="#fetching">Fetching</a></li>
             <li class="tab"><a href="#filters">Global Filters</a></li>
+            <li class="tab"><a href="#api">API</a></li>
         </ul>
     </div>
     <div class="box-wrap inner">
@@ -43,6 +44,7 @@
                             <span class="pure-form-message-inline">Password is locked.</span>
                         {% endif %}
                     </div>
+
                     <div class="pure-control-group">
                         {{ render_field(form.application.form.base_url, placeholder="http://yoursite.com:5000/",
                         class="m-d") }}
@@ -105,7 +107,6 @@
                 </fieldset>
             </div>
 
-
             <div class="tab-pane-inner" id="filters">
 
                     <fieldset class="pure-group">
@@ -150,12 +151,26 @@ nav
                     </fieldset>
            </div>
 
+            <div class="tab-pane-inner" id="api">
+
+                <p>Drive your changedetection.io via API, More about <a href="https://github.com/dgtlmoon/changedetection.io/wiki/API-Reference">API access here</a></p>
+
+                <div class="pure-control-group">
+                    {{ render_checkbox_field(form.application.form.api_access_token_enabled) }}
+                    <div class="pure-form-message-inline">Restrict API access limit by using <code>x-api-key</code> header</div><br/>
+                    <div class="pure-form-message-inline"><br/>API Key <span id="api-key">{{api_key}}</span>
+                        <span style="display:none;" id="api-key-copy" >copy</span>
+                    </div>
+                </div>
+            </div>
+
             <div id="actions">
                 <div class="pure-control-group">
                     {{ render_button(form.save_button) }}
                     <a href="{{url_for('index')}}" class="pure-button button-small button-cancel">Back</a>
                     <a href="{{url_for('scrub_page')}}" class="pure-button button-small button-cancel">Delete History Snapshot Data</a>
                 </div>
+
             </div>
         </form>
     </div>