支持用户传入重定向地址

@@ -14,7 +14,6 @@ import configure
 from app.decorators.auth_decorator import auth_decorator
 import time
 from app.models import SM3, AESHelper
-from PIL import Image
 
 
 def current_user():
@@ -48,14 +47,15 @@ class DataManager(BlueprintApi):
             except OAuth2Error as error:
                 return jsonify(dict(error.get_body()))
             if not user:
-                #生成验证码
+                # 生成验证码
                 
-                return render_template("auth/authorize.html", user=user, grant=grant)
+                return render_template("auth/authorize.html",
+                                       user=user,
+                                       grant=grant)
         error = ""
         if not user:
             # 验证码校验
-            
-            
+
             if not "username" in request.form or not request.form.get("username"):
                 error = "用户名不可为空"
             elif not "password" in request.form or not request.form.get("password"):
@@ -71,13 +71,14 @@ class DataManager(BlueprintApi):
         if user:
             session["id"] = user.id
             grant_user = user
-            return authorization.create_authorization_response(grant_user=grant_user)
+            return authorization.create_authorization_response(request=request, grant_user=grant_user)
 
         try:
             grant = authorization.validate_consent_request(end_user=user)
         except OAuth2Error as error:
             return jsonify(dict(error.get_body()))
-        return render_template("auth/authorize.html", user=user, grant=grant, error=error)
+        # return render_template("auth/authorize.html", user=user, grant=grant, error=error)
+        return authorization.create_authorization_response(grant_user=None)
 
     @staticmethod
     @bp.route("/token", methods=["POST"])

@@ -40,6 +40,13 @@ class OAuth2Client(db.Model, OAuth2ClientMixin):
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
     user = relationship('User')
 
+    def get_default_redirect_uri(self):
+        if self.redirect_uris:
+            return self.redirect_uris[0]
+
+    def check_redirect_uri(self, redirect_uri):
+        return redirect_uri in self.redirect_uris
+
 
 class OAuth2AuthorizationCode(db.Model, OAuth2AuthorizationCodeMixin):
     __tablename__ = 'dmap_oauth2_code'
@@ -57,4 +64,4 @@ class OAuth2Token(db.Model, OAuth2TokenMixin):
     user_id = Column(
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
     # name = Column(Text)
-    user = relationship('User')
\ No newline at end of file
+    user = relationship('User')

+from authlib.oauth2.rfc6749 import grants
 from os import access, remove
 from time import time
 from authlib.integrations.flask_oauth2 import (
@@ -29,10 +30,11 @@ DUMMY_JWT_CONFIG = {
     'exp': 7200,
 }
 
+
 class myCodeIDToken(CodeIDToken):
     def validate(self, now, leeway):
         return super().validate(now=now, leeway=leeway)
-    
+
     def validate_exp(self, now, leeway):
         return super().validate_exp(now, leeway)
 
@@ -68,7 +70,34 @@ def create_authorization_code(client, grant_user, request):
     return code
 
 
-class AuthorizationCodeGrant(_AuthorizationCodeGrant):
+class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
+
+    def save_authorization_code(self, code, request):
+        client = request.client
+        auth_code = OAuth2AuthorizationCode(
+            code=code,
+            client_id=client.client_id,
+            redirect_uri=request.redirect_uri,
+            scope=request.scope,
+            user_id=request.user.id,
+        )
+        db.session.add(auth_code)
+        db.session.commit()
+        return auth_code
+
+    def query_authorization_code(self, code, client):
+        item = OAuth2AuthorizationCode.query.filter_by(
+            code=code, client_id=client.client_id).first()
+        if item and not item.is_expired():
+            return item
+
+    def delete_authorization_code(self, authorization_code):
+        db.session.delete(authorization_code)
+        db.session.commit()
+
+    def authenticate_user(self, authorization_code):
+        return User.query.get(authorization_code.user_id)
+
     def create_authorization_code(self, client, grant_user, request):
         return create_authorization_code(client, grant_user, request)
 
@@ -120,15 +149,14 @@ class HybridGrant(_OpenIDHybridGrant):
 
     def generate_user_info(self, user, scope):
         return generate_user_info(user, scope)
-    
-from authlib.oauth2.rfc6749 import grants
+
 
 class PasswordGrant(grants.ResourceOwnerPasswordCredentialsGrant):
     def authenticate_user(self, username, password):
         user = User.query.filter_by(username=username).first()
         if user.check_password(password):
             return user
-        
+
     TOKEN_ENDPOINT_AUTH_METHODS = [
         'client_secret_basic', 'client_secret_post'
     ]

@@ -24,7 +24,7 @@ entry_data_thread = 3
 scan_module = ["app.modules"]  # API所在的模块
 SECRET_KEY = b'_5#y2L"F4Q8z\n\xec]/'
 # 权限
-PermissionActive = True
+PermissionActive = False
 UserPermission = ['admin']
 MonitorPermission = ['admin']
 DataPermission = ['admin', 'dataman']

 101映射域名
 dmap.apps.chinadci.com
+# 鉴权
+Authlib
+## 1 授权服务器
+为授权、颁发令牌、刷新令牌和撤销令牌提供多个端点。当资源拥有者（用户）获得授权时，授权服务器会向客户端颁发访问令牌。
+### 资源拥有者：用户
+### 客户端：客户端是一个代表资源拥有者并在授权情况下请求受保护资源的应用
+  * client_id是唯一标识
+  * client_secret是密码
+  * 客户端令牌端点认证方法 
+### 令牌
+使用令牌访问用户资源，令牌发布时带有有效期，有访问范围等等。它至少包括：
+*　access_token
+* refresh_token
+*...
+### 服务器
+authlib使用工具AuthorizationServer管理请求和响应
+
+
 
 # Web安全
 ## 1 接口权限控制