src/swf_remote_project/login_wall.py

0001 """Keep anonymous traffic off the tunnel.
0002
0003 Every page under /prod/ is rendered by swf-monitor at BNL and reached over the
0004 SSH tunnel, so an anonymous request that gets as far as a view costs an
0005 upstream page build. Refusing it here means it never crosses the tunnel at
0006 all, which is the point: enforcing the same rule upstream would still let the
0007 traffic arrive before rejecting it.
0008
0009 This runs as middleware rather than a per-view decorator because
0010 remote_app/urls.py ends in catch-all proxy routes, deliberately, so that new
0011 swf-monitor pages need no route here. A decorator would silently miss every
0012 one of them.
0013 """
0014
0015 from django.conf import settings
0016 from django.contrib.auth.views import redirect_to_login
0017
0018
0019 class LoginWallMiddleware:
0020     """Send anonymous requests to the login page, except on open paths.
0021
0022     Paths are matched on path_info, which excludes the /prod script name.
0023     """
0024
0025     OPEN_PREFIXES = (
0026         '/accounts/',   # login, logout, and the GitHub authorize callback
0027         '/static/',     # without this the login page renders unstyled
0028         # Validation interface (swf-epicprod EPICPROD_VALIDATION.md): open
0029         # read-only completion/catalog GETs, and the validation-results POST
0030         # whose token is validated upstream by swf-monitor.
0031         '/pcs/api/v1/',
0032         # REST API documentation (swf-epicprod API_DOCUMENTATION.md): the
0033         # OpenAPI schema and its Swagger UI / Redoc renderers, open read-only.
0034         '/api/schema/',
0035     )
0036     # The landing page: prod_home serves a self-contained local page to
0037     # anonymous visitors and the proxied hub to everyone else, so it stays
0038     # reachable without touching the tunnel. Machine clients that poll it for
0039     # liveness keep their 200.
0040     OPEN_EXACT = ('/', '/prod/')
0041
0042     def __init__(self, get_response):
0043         self.get_response = get_response
0044
0045     def is_open(self, path):
0046         return path in self.OPEN_EXACT or path.startswith(self.OPEN_PREFIXES)
0047
0048     def __call__(self, request):
0049         if not request.user.is_authenticated and not self.is_open(request.path_info):
0050             return redirect_to_login(request.get_full_path(), settings.LOGIN_URL)
0051         return self.get_response(request)