aurweb/aurweb/git/auth.py

#!/usr/bin/env python3

import re
import shlex
import sys

import aurweb.config
import aurweb.db


def format_command(env_vars, command, ssh_opts, ssh_key):
    environment = ''
    for key, var in env_vars.items():
        environment += '{}={} '.format(key, shlex.quote(var))

    command = shlex.quote(command)
    command = '{}{}'.format(environment, command)

    # The command is being substituted into an authorized_keys line below,
    # so we need to escape the double quotes.
    command = command.replace('"', '\\"')
    msg = 'command="{}",{} {}'.format(command, ssh_opts, ssh_key)
    return msg


def main():
    valid_keytypes = aurweb.config.get('auth', 'valid-keytypes').split()
    username_regex = aurweb.config.get('auth', 'username-regex')
    git_serve_cmd = aurweb.config.get('auth', 'git-serve-cmd')
    ssh_opts = aurweb.config.get('auth', 'ssh-options')

    keytype = sys.argv[1]
    keytext = sys.argv[2]
    if keytype not in valid_keytypes:
        exit(1)

    conn = aurweb.db.Connection()

    cur = conn.execute("SELECT Users.Username, Users.AccountTypeID FROM Users "
                       "INNER JOIN SSHPubKeys ON SSHPubKeys.UserID = Users.ID "
                       "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0 "
                       "AND NOT Users.Passwd = ''",
                       (keytype + " " + keytext,))

    row = cur.fetchone()
    if not row or cur.fetchone():
        exit(1)

    user, account_type = row
    if not re.match(username_regex, user):
        exit(1)

    env_vars = {
        'AUR_USER': user,
        'AUR_PRIVILEGED': '1' if account_type > 1 else '0',
    }
    key = keytype + ' ' + keytext

    print(format_command(env_vars, git_serve_cmd, ssh_opts, key))


if __name__ == '__main__':
    main()