Revize 5dc6d077

security fix for all endpoints. Added view for Licenses and html template on "/" with information about server endpoints.

server/sql_app/api/devices_web.py

@@ -87 +87 @@
 
 
 @device_web.get("/device-license/{device_id}", response_class=HTMLResponse)
-async def connect_dev_lic(request: Request, device_id: int, db: Session = Depends(get_db)):
+async def connect_dev_lic(request: Request, device_id: int, db: Session = Depends(get_db),
+                          Authorize: AuthJWT = Depends()):
     """
     Returns template with one device and all available licenses that can be assigned to it.
     """
+    Authorize.jwt_optional()
+    current_user = Authorize.get_jwt_subject()
+    if current_user != "admin":
+        return RedirectResponse(url=f"/logs-web", status_code=303)
     device = crud.get_device(db, device_id)
     dev_licenses = crud.get_device_licenses(db, device_id)
     lic_names = []
@@ -109 +114 @@
 
 
 @device_web.post("/devices-web/{device_id}")
-async def connect_post(device_id: int, lic: str = Form(...), db: Session = Depends(get_db)):
+async def connect_post(device_id: int, lic: str = Form(...), db: Session = Depends(get_db),
+                       Authorize: AuthJWT = Depends()):
     """
     Endpoint called from template for connecting device with license. Adds entry to devices_licenses
     table and redirects to devices-web endpoint
     """
+    Authorize.jwt_optional()
+    current_user = Authorize.get_jwt_subject()
+    if current_user != "admin":
+        return RedirectResponse(url=f"/logs-web", status_code=303)
     crud.create_device_license(db, device_id, int(lic), datetime.now())
     return RedirectResponse(url=f"/devices-web", status_code=303)
 
 
 @device_web.post("/devices-web-del/{device_id}")
-async def delete_post(device_id: int, lic_del: str = Form(...), db: Session = Depends(get_db)):
+async def delete_post(device_id: int, lic_del: str = Form(...), db: Session = Depends(get_db),
+                      Authorize: AuthJWT = Depends()):
     """
     Endpoint called from template for deleting device-license connection. Adds entry to bodydevices_licenses
     table and redirects to devices-web endpoint
     """
+    Authorize.jwt_optional()
+    current_user = Authorize.get_jwt_subject()
+    if current_user != "admin":
+        return RedirectResponse(url=f"/logs-web", status_code=303)
     crud.delete_device_license(db, device_id, int(lic_del))
     return RedirectResponse(url=f"/devices-web", status_code=303)