支持用户传入重定向地址

@@ -14,7 +14,6 @@ import configure
 from app.decorators.auth_decorator import auth_decorator
 from app.decorators.auth_decorator import auth_decorator
 import time
 import time
 from app.models import SM3, AESHelper
 from app.models import SM3, AESHelper
-from PIL import Image
 
 
 
 
 def current_user():
 def current_user():
@@ -48,14 +47,15 @@ class DataManager(BlueprintApi):
             except OAuth2Error as error:
             except OAuth2Error as error:
                 return jsonify(dict(error.get_body()))
                 return jsonify(dict(error.get_body()))
             if not user:
             if not user:
-                #生成验证码
+                # 生成验证码
                 
                 
-                return render_template("auth/authorize.html", user=user, grant=grant)
+                return render_template("auth/authorize.html",
+                                       user=user,
+                                       grant=grant)
         error = ""
         error = ""
         if not user:
         if not user:
             # 验证码校验
             # 验证码校验
-            
-            
+
             if not "username" in request.form or not request.form.get("username"):
             if not "username" in request.form or not request.form.get("username"):
                 error = "用户名不可为空"
                 error = "用户名不可为空"
             elif not "password" in request.form or not request.form.get("password"):
             elif not "password" in request.form or not request.form.get("password"):
@@ -71,13 +71,14 @@ class DataManager(BlueprintApi):
         if user:
         if user:
             session["id"] = user.id
             session["id"] = user.id
             grant_user = user
             grant_user = user
-            return authorization.create_authorization_response(grant_user=grant_user)
+            return authorization.create_authorization_response(request=request, grant_user=grant_user)
 
 
         try:
         try:
             grant = authorization.validate_consent_request(end_user=user)
             grant = authorization.validate_consent_request(end_user=user)
         except OAuth2Error as error:
         except OAuth2Error as error:
             return jsonify(dict(error.get_body()))
             return jsonify(dict(error.get_body()))
-        return render_template("auth/authorize.html", user=user, grant=grant, error=error)
+        # return render_template("auth/authorize.html", user=user, grant=grant, error=error)
+        return authorization.create_authorization_response(grant_user=None)
 
 
     @staticmethod
     @staticmethod
     @bp.route("/token", methods=["POST"])
     @bp.route("/token", methods=["POST"])

@@ -40,6 +40,13 @@ class OAuth2Client(db.Model, OAuth2ClientMixin):
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
     user = relationship('User')
     user = relationship('User')
 
 
+    def get_default_redirect_uri(self):
+        if self.redirect_uris:
+            return self.redirect_uris[0]
+
+    def check_redirect_uri(self, redirect_uri):
+        return redirect_uri in self.redirect_uris
+
 
 
 class OAuth2AuthorizationCode(db.Model, OAuth2AuthorizationCodeMixin):
 class OAuth2AuthorizationCode(db.Model, OAuth2AuthorizationCodeMixin):
     __tablename__ = 'dmap_oauth2_code'
     __tablename__ = 'dmap_oauth2_code'
@@ -57,4 +64,4 @@ class OAuth2Token(db.Model, OAuth2TokenMixin):
     user_id = Column(
     user_id = Column(
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
         Integer, ForeignKey('dmap_user.id', ondelete='CASCADE'))
     # name = Column(Text)
     # name = Column(Text)
-    user = relationship('User')
+    user = relationship('User')

+from authlib.oauth2.rfc6749 import grants
 from os import access, remove
 from os import access, remove
 from time import time
 from time import time
 from authlib.integrations.flask_oauth2 import (
 from authlib.integrations.flask_oauth2 import (
@@ -29,10 +30,11 @@ DUMMY_JWT_CONFIG = {
     'exp': 7200,
     'exp': 7200,
 }
 }
 
 
+
 class myCodeIDToken(CodeIDToken):
 class myCodeIDToken(CodeIDToken):
     def validate(self, now, leeway):
     def validate(self, now, leeway):
         return super().validate(now=now, leeway=leeway)
         return super().validate(now=now, leeway=leeway)
-    
+
     def validate_exp(self, now, leeway):
     def validate_exp(self, now, leeway):
         return super().validate_exp(now, leeway)
         return super().validate_exp(now, leeway)
 
 
@@ -68,7 +70,34 @@ def create_authorization_code(client, grant_user, request):
     return code
     return code
 
 
 
 
-class AuthorizationCodeGrant(_AuthorizationCodeGrant):
+class AuthorizationCodeGrant(grants.AuthorizationCodeGrant):
+
+    def save_authorization_code(self, code, request):
+        client = request.client
+        auth_code = OAuth2AuthorizationCode(
+            code=code,
+            client_id=client.client_id,
+            redirect_uri=request.redirect_uri,
+            scope=request.scope,
+            user_id=request.user.id,
+        )
+        db.session.add(auth_code)
+        db.session.commit()
+        return auth_code
+
+    def query_authorization_code(self, code, client):
+        item = OAuth2AuthorizationCode.query.filter_by(
+            code=code, client_id=client.client_id).first()
+        if item and not item.is_expired():
+            return item
+
+    def delete_authorization_code(self, authorization_code):
+        db.session.delete(authorization_code)
+        db.session.commit()
+
+    def authenticate_user(self, authorization_code):
+        return User.query.get(authorization_code.user_id)
+
     def create_authorization_code(self, client, grant_user, request):
     def create_authorization_code(self, client, grant_user, request):
         return create_authorization_code(client, grant_user, request)
         return create_authorization_code(client, grant_user, request)
 
 
@@ -120,15 +149,14 @@ class HybridGrant(_OpenIDHybridGrant):
 
 
     def generate_user_info(self, user, scope):
     def generate_user_info(self, user, scope):
         return generate_user_info(user, scope)
         return generate_user_info(user, scope)
-    
-from authlib.oauth2.rfc6749 import grants
+
 
 
 class PasswordGrant(grants.ResourceOwnerPasswordCredentialsGrant):
 class PasswordGrant(grants.ResourceOwnerPasswordCredentialsGrant):
     def authenticate_user(self, username, password):
     def authenticate_user(self, username, password):
         user = User.query.filter_by(username=username).first()
         user = User.query.filter_by(username=username).first()
         if user.check_password(password):
         if user.check_password(password):
             return user
             return user
-        
+
     TOKEN_ENDPOINT_AUTH_METHODS = [
     TOKEN_ENDPOINT_AUTH_METHODS = [
         'client_secret_basic', 'client_secret_post'
         'client_secret_basic', 'client_secret_post'
     ]
     ]

@@ -24,7 +24,7 @@ entry_data_thread = 3
 scan_module = ["app.modules"]  # API所在的模块
 scan_module = ["app.modules"]  # API所在的模块
 SECRET_KEY = b'_5#y2L"F4Q8z\n\xec]/'
 SECRET_KEY = b'_5#y2L"F4Q8z\n\xec]/'
 # 权限
 # 权限
-PermissionActive = True
+PermissionActive = False
 UserPermission = ['admin']
 UserPermission = ['admin']
 MonitorPermission = ['admin']
 MonitorPermission = ['admin']
 DataPermission = ['admin', 'dataman']
 DataPermission = ['admin', 'dataman']

 101映射域名
 101映射域名
 dmap.apps.chinadci.com
 dmap.apps.chinadci.com
+# 鉴权
+Authlib
+## 1 授权服务器
+为授权、颁发令牌、刷新令牌和撤销令牌提供多个端点。当资源拥有者（用户）获得授权时，授权服务器会向客户端颁发访问令牌。
+### 资源拥有者：用户
+### 客户端：客户端是一个代表资源拥有者并在授权情况下请求受保护资源的应用
+  * client_id是唯一标识
+  * client_secret是密码
+  * 客户端令牌端点认证方法 
+### 令牌
+使用令牌访问用户资源，令牌发布时带有有效期，有访问范围等等。它至少包括：
+*　access_token
+* refresh_token
+*...
+### 服务器
+authlib使用工具AuthorizationServer管理请求和响应
+
+
 
 
 # Web安全
 # Web安全
 ## 1 接口权限控制
 ## 1 接口权限控制