paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-04 14:03:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

rest: Simplify authentication error handling.

Browse Source 
This pure refactor removes a now unnecessarily nested else clause,
helping keep this key piece of code readable.
This commit is contained in:
Tim Abbott
2020-08-25 16:55:06 -07:00
committed by Tim Abbott
parent fd5423a8f9
commit 5548ab8b99
1 changed files with 9 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
zerver/lib/rest.py
View File

@@ -140,19 +140,16 @@ def rest_dispatch(request: HttpRequest, **kwargs: Any) -> HttpResponse:
target_function = authenticated_rest_api_view( target_function = authenticated_rest_api_view(
is_webhook='allow_incoming_webhooks' in view_flags, is_webhook='allow_incoming_webhooks' in view_flags,
)(target_function) )(target_function)
# Pick a way to tell user they're not authed based on how the request was made elif request.path.startswith("/json") and 'allow_anonymous_user_web' in view_flags:
else: # For endpoints that support anonymous web access, we do that.
# Logged out user accessing an endpoint with anonymous user access on JSON; proceed.
# `allow_anonymous_user_web` calls are only restricted to /json calls used
# by our webapp.
# TODO: Allow /api calls when this is stable enough. # TODO: Allow /api calls when this is stable enough.
if request.path.startswith("/json") and 'allow_anonymous_user_web' in view_flags: auth_kwargs = dict(allow_unauthenticated=True)
auth_kwargs = dict(allow_unauthenticated=True) target_function = csrf_protect(authenticated_json_view(
target_function = csrf_protect(authenticated_json_view( target_function, **auth_kwargs))
target_function, **auth_kwargs)) else:
else: # Otherwise, throw an authentication error; our middleware
# Don't allow anonymous queries to endpoints witout `allow_anonymous_user_web` flag. # will generate the appropriate HTTP response.
raise MissingAuthenticationError() raise MissingAuthenticationError()
if request.method not in ["GET", "POST"]: if request.method not in ["GET", "POST"]:
# process_as_post needs to be the outer decorator, because # process_as_post needs to be the outer decorator, because