PLACEHOLDER: Add feide authentication endpoints

lego/api/v1.py

@@ -65,6 +65,7 @@
 from lego.apps.users.views.abakus_groups import AbakusGroupViewSet
 from lego.apps.users.views.membership_history import MembershipHistoryViewSet
 from lego.apps.users.views.memberships import MembershipViewSet
+from lego.apps.users.views.oidc import OIDCViewSet
 from lego.apps.users.views.password_change import ChangePasswordViewSet
 from lego.apps.users.views.password_reset import (
     PasswordResetPerformViewSet,
@@ -212,4 +213,5 @@
     StudentConfirmationRequestViewSet,
     basename="student-confirmation-request",
 )
+router.register(r"oidc", OIDCViewSet, basename="oidc")
 router.register(r"webhooks-stripe", StripeWebhook, basename="webhooks-stripe")

lego/apps/users/constants.py

@@ -74,6 +74,8 @@
 
 STUDENT_EMAIL_DOMAIN = "stud.ntnu.no"
 
+STUDENT_VERIFICATION_DAYS = 365
+
 GROUP_COMMITTEE = "komite"
 GROUP_INTEREST = "interesse"
 GROUP_BOARD = "styre"

lego/apps/users/models.py

@@ -334,6 +334,9 @@ class User(
         validators=[student_username_validator, ReservedNameValidator()],
         error_messages={"unique": "A user has already verified that student username."},
     )
+    student_verified_at = models.DateTimeField(
+        "Date last verfied student status.", null=True, default=None
+    )
     first_name = models.CharField("first name", max_length=50, blank=False)
     last_name = models.CharField("last name", max_length=30, blank=False)
     allergies = models.CharField("allergies", max_length=500, blank=True)
@@ -434,7 +437,13 @@ def profile_picture(self, value):
         self.picture = value
 
     def is_verified_student(self):
-        return self.student_username is not None
+        if self.student_username is None:
+            return False
+
+        if timezone.now() - self.student_verified_at > timezone.timedelta(
+            days=constants.STUDENT_VERIFICATION_DAYS
+        ):
+            return False
 
     def get_short_name(self):
         return self.first_name

lego/apps/users/views/oidc.py

@@ -0,0 +1,42 @@
+from django.conf import settings
+from django.urls import reverse
+from rest_framework import viewsets
+from rest_framework.decorators import action
+from rest_framework.permissions import IsAuthenticated
+
+from authlib.integrations.django_client import OAuth
+from icecream import ic
+from structlog import get_logger
+
+from lego.apps.users.models import User
+from lego.apps.users.serializers.users import PublicUserSerializer
+
+log = get_logger()
+
+oauth = OAuth()
+oauth.register(
+    name="feide",
+    client_id=settings.FEIDE_OIDC_CLIENT_ID,
+    client_secret=settings.FEIDE_OIDC_CLIENT_SECRET,
+    server_metadata_url=settings.FEIDE_OIDC_CONFIGURATION_ENDPOINT,
+    client_kwargs={"scope": "openid"},
+)
+
+
+class OIDCViewSet(viewsets.GenericViewSet):
+
+    permission_classes = (IsAuthenticated,)
+
+    @action(detail=False, methods=["GET"])
+    def authorize(self, request):
+        redirect_uri = request.build_absolute_uri(reverse("api:v1:oidc-callback"))
+        return oauth.feide.authorize_redirect(request, redirect_uri)
+
+    @action(detail=False, methods=["GET"])
+    def callback(self, request):
+        token = oauth.feide.authorize_access_token(request)
+        ic(token)
+        return request.redirect(settings.FRONTEND_URL)
+
+    def get_queryset(self):
+        pass

lego/settings/base.py

@@ -189,6 +189,13 @@
 SMTP_SSL_CERTIFICATE = os.environ.get("SMTP_SSL_CERTIFICATE")
 SMTP_SSL_KEY = os.environ.get("SMTP_SSL_KEY")
 
+FEIDE_OIDC_CLIENT_ID = os.environ.get("FEIDE_OIDC_CLIENT_ID")
+FEIDE_OIDC_CLIENT_SECRET = os.environ.get("FEIDE_OIDC_CLIENT_SECRET")
+FEIDE_OIDC_CONFIGURATION_ENDPOINT = os.environ.get(
+    "FEIDE_OIDC_CONFIGURATION_ENDPOINT",
+    "https://auth.dataporten.no/.well-known/openid-configuration",
+)
+
 if os.environ.get("GSUITE_CREDENTIALS"):
     GSUITE_CREDENTIALS = json.loads(
         base64.b64decode(os.environ.get("GSUITE_CREDENTIALS")), strict=False  # type: ignore

requirements/base.txt

@@ -59,3 +59,4 @@ Pygments==2.14.0
 Markdown==3.4.1
 coreapi==2.3.3
 aiosmtpd==1.4.4.post2
+Authlib==1.2.0