Flight preview screen only sends GetMap requests to Geoserver
Project screen sends GetCapabilities, GetMap and GetFeature (only if vectorfiles exist) requests
General
[x] ~Implement authentication endpoint to check and allow/deny requests to Geoserver. TODO add more info!~
[x] ~Create new app geoserver_authorizer~
[x] ~Add urls.py on geoserver_authorizer, link it from the root urls.py~
[x] ~Add single URL entry on urls.py linking to authorize view~
[x] ~Implement authorize(request) view that extracts the request headers and determines authorization.~
[x] Add new config item on .env holding the Geoserver password, expose it on settings.py as GEOSERVER_PASSWORD
[x] Pass the GEOSERVER_PASSWORD envvar to the Django container
Geoserver
Read-only calls to the WMS services will NOT be authenticated, instead relying on the huge search space of UUID to hide the actual layers.
[x] Review all calls to the Geoserver API, replace the credentials with the exposed GEOSERVER_PASSWORD setting
models.py: 10 instances of credentials
views.py: 6 instances of credentials
[x] Ensure that the REST API cannot be called without authentication.
[x] ~Frontend: somehow inject auth info on all Geoserver requests triggered by OpenLayers. Maybe use https://github.com/openlayers/openlaye rs/issues/4213 as guidance (URL fractured to try and avoid this issue appearing in the original issue). TL;DR: specify a "custom tile loader function" where we can set headers as desired, fire off the request, encode the response as Base64 and set it as the img src attribute.~
[x] Add proper user verification on all proxied views on https://github.com/IS-AgroSmart/AgroSmart-Web/blob/master/nodeodm_proxy/views.py: extract the auth token, get the user, get the Flight that the UUID refers to, check if the User has rights to access the Flight, return 401 if false, fire off request and pass it along if true.
task_info and task_output: Allow only if user is Flight owner OR Flight is demo OR user is admin
cancel_task: Allow only if user is Flight owner OR user is admin
[x] ~Bonus task: on the /nodeodm/uuid/info view, if Flight is Complete, Canceled or Error, don't send subrequest. Instead, respond with data saved in Flight model (this ensures that info will keep working after the Flight gets deleted from NodeODM). Important keys: status.code (obtainable from the Model), processingTime (same), progress.~ Migrated to #123
This issue is linked with https://github.com/IS-AgroSmart/AgroSmart-Top/issues/5 Some code changes will be required to have authenticated requests on Geoserver and NodeODM
General
geoserver_authorizer
~urls.py
ongeoserver_authorizer
, link it from the rooturls.py
~urls.py
linking toauthorize
view~authorize(request)
view that extracts the request headers and determines authorization.~.env
holding the Geoserver password, expose it onsettings.py
asGEOSERVER_PASSWORD
GEOSERVER_PASSWORD
envvar to the Django containerGeoserver
Read-only calls to the WMS services will NOT be authenticated, instead relying on the huge search space of UUID to hide the actual layers.
GEOSERVER_PASSWORD
settingmodels.py
: 10 instances of credentialsviews.py
: 6 instances of credentialsNodeODM
task_info
andtask_output
: Allow only if user is Flight owner OR Flight is demo OR user is admincancel_task
: Allow only if user is Flight owner OR user is admin/nodeodm/uuid/info
view, if Flight is Complete, Canceled or Error, don't send subrequest. Instead, respond with data saved in Flight model (this ensures that info will keep working after the Flight gets deleted from NodeODM). Important keys:status.code
(obtainable from the Model),processingTime
(same),progress
.~ Migrated to #123