Secure TileCache Tutorial¶

install_requires=[
    "Pylons>=0.9.7",
    "SQLAlchemy>=0.5",
],

install_requires=[
    "Pylons>=0.9.7",
    "SQLAlchemy>=0.5",
    "repoze.what-quickstart>=1.0.3,<=1.0.99",
    "repoze.what-pylons>=1.0,<=1.0.99",
    "TileCache>=2.10,<=2.10.99",
],

import logging

from pylons import request, response, session, tmpl_context as c
from pylons.controllers.util import abort, redirect_to

from securetilecache.lib.base import BaseController, render

from TileCache.Service import wsgiApp

log = logging.getLogger(__name__)

class TilecacheController(BaseController):

    def basic(self, environ, start_response):
        return wsgiApp(environ, start_response)

    def coastline_01(self, environ, start_response):
        return wsgiApp(environ, start_response)

    def coastline_02(self, environ, start_response):
        return wsgiApp(environ, start_response)

def layer_to_action(environ, result):
    parsed, source = environ["paste.parsed_dict_querystring"]
    result["action"] = parsed["LAYERS"]
    return True
map.connect('/tilecache',
            controller='tilecache', action='{action}',
            conditions=dict(function=layer_to_action))

import os
from hashlib import sha1

from sqlalchemy.ext.declarative import declarative_base
DeclarativeBase = declarative_base(metadata=meta.metadata)

group_permission_table = sa.Table('group_permission', meta.metadata,
    sa.Column('group_id', sa.types.Integer, sa.ForeignKey('group.group_id',
        onupdate="CASCADE", ondelete="CASCADE")),
    sa.Column('permission_id', sa.types.Integer, sa.ForeignKey('permission.permission_id',
        onupdate="CASCADE", ondelete="CASCADE"))
)


user_group_table = sa.Table('user_group', meta.metadata,
    sa.Column('user_id', sa.types.Integer, sa.ForeignKey('user.user_id',
        onupdate="CASCADE", ondelete="CASCADE")),
    sa.Column('group_id', sa.types.Integer, sa.ForeignKey('group.group_id',
        onupdate="CASCADE", ondelete="CASCADE"))
)

class Group(DeclarativeBase):
    """An ultra-simple group definition."""
    __tablename__ = 'group'

    group_id = sa.Column(sa.types.Integer, autoincrement=True, primary_key=True)
    group_name = sa.Column(sa.types.Unicode(16), unique=True)
    users = orm.relation('User', secondary=user_group_table, backref='groups')


class User(DeclarativeBase):
    """
    Reasonably basic User definition. Probably would want additional
    attributes.

    """
    __tablename__ = 'user'

    user_id = sa.Column(sa.types.Integer, autoincrement=True, primary_key=True)
    user_name = sa.Column(sa.types.Unicode(16), unique=True)
    _password = sa.Column('password', sa.types.Unicode(80))

    def _set_password(self, password):
        """Hash password on the fly."""
        hashed_password = password

        if isinstance(password, unicode):
            password_8bit = password.encode('UTF-8')
        else:
            password_8bit = password

        salt = sha1()
        salt.update(os.urandom(60))
        hash = sha1()
        hash.update(password_8bit + salt.hexdigest())
        hashed_password = salt.hexdigest() + hash.hexdigest()

        # Make sure the hased password is an UTF-8 object at the end of the
        # process because SQLAlchemy _wants_ a unicode object for Unicode
        # fields
        if not isinstance(hashed_password, unicode):
            hashed_password = hashed_password.decode('UTF-8')

        self._password = hashed_password

    def _get_password(self):
        """Return the password hashed"""
        return self._password

    password = orm.synonym('_password', descriptor=property(_get_password,
                                                            _set_password))

    def validate_password(self, password):
        """
        Check the password against existing credentials.

        :param password: the password that was provided by the user to
            try and authenticate. This is the clear text version that we will
            need to match against the hashed one in the database.
        :type password: unicode object.
        :return: Whether the password is valid.
        :rtype: bool

        """
        hashed_pass = sha1()
        hashed_pass.update(password + self.password[:40])
        return self.password[40:] == hashed_pass.hexdigest()


class Permission(DeclarativeBase):
    """A relationship that determines what each Group can do"""
    __tablename__ = 'permission'

    permission_id = sa.Column(sa.types.Integer, autoincrement=True, primary_key=True)
    permission_name = sa.Column(sa.types.Unicode(16), unique=True)
    groups = orm.relation(Group, secondary=group_permission_table,
                          backref='permissions')

from securetilecache import model

# Create two users, user1 and user2
u1 = model.User()
u1.user_name = u'user1'
u1.password = u'password'
meta.Session.add(u1)

u2 = model.User()
u2.user_name = u'user2'
u2.password = u'password'
meta.Session.add(u2)

# Create two groups, g1 and g2, add u1 to g1
# and u2 to g2
g1 = model.Group()
g1.group_name = u'g1'
g1.users.append(u1)
meta.Session.add(g1)

g2 = model.Group()
g2.group_name = u'g2'
g2.users.append(u2)
meta.Session.add(g2)

# Create two permissions, basic and coastline, give
# g1 the permission basic, and g1 the permission
# coastline
p = model.Permission()
p.permission_name = u'basic'
p.groups.append(g1)
meta.Session.add(p)

p = model.Permission()
p.permission_name = u'coastline'
p.groups.append(g2)
meta.Session.add(p)

meta.Session.commit()

# CUSTOM MIDDLEWARE HERE (filtered by error handling middlewares)
from repoze.what.plugins.quickstart import setup_sql_auth
from securetilecache import model
app = setup_sql_auth(app,
                     model.User, model.Group, model.Permission,
                     model.meta.Session,
                     cookie_secret="cookie_secret",
                     login_url="/signin",
                     login_handler="/login",
                     logout_handler="/logout",
                     post_logout_url="/signin",
                    )

from routes import url_for

import logging
import os

from pylons import request, response, session, config, tmpl_context as c
from pylons.controllers.util import abort, redirect_to

from repoze.what.plugins.pylonshq import ActionProtector, is_met
from repoze.what.predicates import Not, NotAuthorizedError, not_anonymous, has_all_permissions

from securetilecache.lib.base import BaseController, render
from securetilecache.model import Group, User, meta

log = logging.getLogger(__name__)

class MainController(BaseController):

    def signin(self):
        if is_met(not_anonymous()):
            c.user = request.environ.get('repoze.what.credentials')['repoze.what.userid']
        return render("/signin.html")

    @ActionProtector(not_anonymous())
    def signout(self):
        session['flash'] = 'You have just logged out. Please log in again.'
        session.save()
        redirect_to('/logout')

map.connect('/signin', controller='main', action='signin')
map.connect('/signout', controller='main', action='signout')

import logging

from pylons import request, response, session, tmpl_context as c
from pylons.controllers.util import abort, redirect_to
from repoze.what.predicates import has_permission
from repoze.what.plugins.pylonshq import ActionProtector

from securetilecache.lib.base import BaseController, render

from TileCache.Service import wsgiApp

log = logging.getLogger(__name__)

class TilecacheController(BaseController):

    @ActionProtector(has_permission('basic'))
    def basic(self, environ, start_response):
        return wsgiApp(environ, start_response)

    @ActionProtector(has_permission('coastline'))
    def coastline_01(self, environ, start_response):
        return wsgiApp(environ, start_response)

    @ActionProtector(has_permission('coastline'))
    def coastline_02(self, environ, start_response):
        return wsgiApp(environ, start_response)