Fix API auth crash and add more error messages

diff --git a/app/blueprints/api/auth.py b/app/blueprints/api/auth.py
index 6eeadde970e2fab840ab69c3bae77be40900e57a..234d481a55d6a8f813fc86dd4d2cdbb1ed2295e0 100644 (file)
--- a/app/blueprints/api/auth.py
+++ b/app/blueprints/api/auth.py
@@ -16,6 +16,7 @@
 
 from flask import request, make_response, jsonify, abort
 from app.models import APIToken
+from .support import error
 from functools import wraps
 
 def is_api_authd(f):
@@ -29,13 +30,13 @@ def is_api_authd(f):
                elif value[0:7].lower() == "bearer ":
                        access_token = value[7:]
                        if len(access_token) < 10:
-                               abort(400)
+                               error(400, "API token is too short")
 
                        token = APIToken.query.filter_by(access_token=access_token).first()
                        if token is None:
-                               abort(403)
+                               error(403, "Unknown API token")
                else:
-                       abort(403)
+                       abort(403, "Unsupported authentication method")
 
                return f(token=token, *args, **kwargs)
 

diff --git a/app/blueprints/api/endpoints.py b/app/blueprints/api/endpoints.py
index 65af3b0855f4e4c661fa86b56a24fd0559aa5eb7..29a9ec2c6519dd0765a518afae36e03f083fd880 100644 (file)
--- a/app/blueprints/api/endpoints.py
+++ b/app/blueprints/api/endpoints.py
@@ -143,19 +143,21 @@ def markdown():
 @is_package_page
 @is_api_authd
 def create_release(token, package):
+       if not token:
+               error(401, "Authentication needed")
+
        if not package.checkPerm(token.owner, Permission.APPROVE_RELEASE):
-               return error(403, "You do not have the permission to approve releases")
+               error(403, "You do not have the permission to approve releases")
 
        json = request.json
        if json is None:
-               return error(400, "JSON post data is required")
+               error(400, "JSON post data is required")
 
        for option in ["method", "title", "ref"]:
                if json.get(option) is None:
-                       return error(400, option + " is required in the POST data")
-
+                       error(400, option + " is required in the POST data")
 
        if json["method"].lower() != "git":
-               return error(400, "Release-creation methods other than git are not supported")
+               error(400, "Release-creation methods other than git are not supported")
 
        return handleCreateRelease(token, package, json["title"], json["ref"])

diff --git a/app/blueprints/api/support.py b/app/blueprints/api/support.py
index 0adf3dbde8fd310df99e6f0a00e7e6d923a49f14..92bce2b81a1849c3f52ec4f4e35aec872a5ba3a9 100644 (file)
--- a/app/blueprints/api/support.py
+++ b/app/blueprints/api/support.py
@@ -1,12 +1,12 @@
 from app.models import PackageRelease, db, Permission
 from app.tasks.importtasks import makeVCSRelease
 from celery import uuid
-from flask import jsonify, make_response, url_for
+from flask import jsonify, abort, url_for
 import datetime
 
 
 def error(status, message):
-       return make_response(jsonify({ "success": False, "error": message }), status)
+       abort(status, jsonify({ "success": False, "error": message }))
 
 
 def handleCreateRelease(token, package, title, ref):

diff --git a/app/flatpages/help/api.md b/app/flatpages/help/api.md
index 8387caafef2b564ea407cbe2c6f399875dcf3e46..2b7bacd09ed102bad82b3c9f54408fd52e7a8ca7 100644 (file)
--- a/app/flatpages/help/api.md
+++ b/app/flatpages/help/api.md
@@ -9,6 +9,8 @@ Authentication is done using Bearer tokens:
 
 You can use the `/api/whoami` to check authentication.
 
+Tokens can be attained by visiting "API Tokens" on your profile page.
+
 ## Endpoints
 
 ### Misc
@@ -16,7 +18,7 @@ You can use the `/api/whoami` to check authentication.
 * GET `/api/whoami/` - Json dictionary with the following keys:
        * `is_authenticated` - True on successful API authentication
        * `username` - Username of the user authenticated as, null otherwise.
-       * 403 will be thrown on unsupported authentication type, invalid access token, or other errors.
+       * 4xx status codes will be thrown on unsupported authentication type, invalid access token, or other errors.
 
 ### Packages