Merge 7f3ae7a into f22a888

RasaHQ · Oct 3, 2018 · 0e7241c · 0e7241c
2 parents f22a888 + 7f3ae7a
commit 0e7241c
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 18 deletions.
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -33,6 +33,7 @@ Fixed
 - use utf8 everywhere when handling file IO
 - argument ``--connector`` on run script accepts custom channel module names
 - properly handle non ascii categorical slot values, e.g. ``大于100亿元``
+- fixed HTTP server attempting to authenticate based on incorrect path to the correct JWT data field
 
 [0.11.8] - 2018-09-28
 ^^^^^^^^^^^^^^^^^^^^^

diff --git a/rasa_core/server.py b/rasa_core/server.py
@@ -88,8 +88,10 @@ def sender_id_from_args(f, args, kwargs):
 
         def sufficient_scope(*args, **kwargs):
             jwt_data = view_decorators._decode_jwt_from_headers()
-            role = jwt_data.get("role", None)
-            username = jwt_data.get("username", None)
+            user = jwt_data.get("user", {})
+
+            username = user.get("user", None)
+            role = user.get("role", None)
 
             if role == "admin":
                 return True

diff --git a/tests/test_server.py b/tests/test_server.py
@@ -212,21 +212,21 @@ def test_list_conversations_with_jwt(secured_app):
     # token generated with secret "core" and algorithm HS256
     # on https://jwt.io/
 
-    # {"username": "testadmin", "role": "admin"}
+    # {"user": {"user": "testadmin", "role": "admin"}}
     jwt_header = {
-        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ"
-                         "1c2VybmFtZSI6InRlc3RhZG1pbiIsInJvbGUiOiJhZG1pbi"
-                         "J9.3gp-0pEEUJpU_NoR76lVYMrW86Aedx_QULKUcw3ODbo"
+        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
+                         "eyJ1c2VyIjp7InVzZXIiOiJ0ZXN0YWRtaW4iLCJyb2xlIjoiYWRt"
+                         "aW4ifX0.VUOiT2DL3LWoesfKm7wWv5Yp8mSnc5v2OXFSq6Tiis0"
     }
     response = secured_app.get("/conversations",
                                headers=jwt_header)
     assert response.status_code == 200
 
-    # {"username": "testuser", "role": "user"}
+    # {"user": {"user": "testuser", "role": "user"}}
     jwt_header = {
-        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ"
-                         "1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6InVzZXIifQ"
-                         ".X4wN0sLRW0Urd9E-ProsCK_IQHjuNZ5SJwm4RXiX6fQ"
+        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
+                         "eyJ1c2VyIjp7InVzZXIiOiJ0ZXN0dXNlciIsInJvbGUiOiJ1c2Vy"
+                         "In19._Gu7YX6euPvq9pfDFHzgH4qPNMbJH1XGXGCVRnXiP24"
     }
     response = secured_app.get("/conversations",
                                headers=jwt_header)
@@ -237,11 +237,11 @@ def test_get_tracker_with_jwt(secured_app):
     # token generated with secret "core" and algorithm HS256
     # on https://jwt.io/
 
-    # {"username": "testadmin", "role": "admin"}
+    # {"user": {"user": "testadmin", "role": "admin"}}
     jwt_header = {
-        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ"
-                         "1c2VybmFtZSI6InRlc3RhZG1pbiIsInJvbGUiOiJhZG1pbi"
-                         "J9.3gp-0pEEUJpU_NoR76lVYMrW86Aedx_QULKUcw3ODbo"
+        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
+                         "eyJ1c2VyIjp7InVzZXIiOiJ0ZXN0YWRtaW4iLCJyb2xlIjoiYWRt"
+                         "aW4ifX0.VUOiT2DL3LWoesfKm7wWv5Yp8mSnc5v2OXFSq6Tiis0"
     }
     response = secured_app.get("/conversations/testadmin/tracker",
                                headers=jwt_header)
@@ -251,11 +251,11 @@ def test_get_tracker_with_jwt(secured_app):
                                headers=jwt_header)
     assert response.status_code == 200
 
-    # {"username": "testuser", "role": "user"}
+    # {"user": {"user": "testuser", "role": "user"}}
     jwt_header = {
-        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ"
-                         "1c2VybmFtZSI6InRlc3R1c2VyIiwicm9sZSI6InVzZXIifQ"
-                         ".X4wN0sLRW0Urd9E-ProsCK_IQHjuNZ5SJwm4RXiX6fQ"
+        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
+                         "eyJ1c2VyIjp7InVzZXIiOiJ0ZXN0dXNlciIsInJvbGUiOiJ1c2Vy"
+                         "In19._Gu7YX6euPvq9pfDFHzgH4qPNMbJH1XGXGCVRnXiP24"
     }
     response = secured_app.get("/conversations/testadmin/tracker",
                                headers=jwt_header)