Curious Cat to Mastodon crossposter
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

web.py 12KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252
  1. #!/usr/bin/env python3
  2. #Curious Greg - Curious Cat to Mastodon crossposter
  3. # This Source Code Form is subject to the terms of the Mozilla Public
  4. # License, v. 2.0. If a copy of the MPL was not distributed with this
  5. # file, You can obtain one at http://mozilla.org/MPL/2.0/.
  6. #TODO: ADD RETROSPRING SUPPORT!
  7. import json, hashlib, urllib, time, re, random
  8. import requests
  9. from mastodon import Mastodon
  10. from flask import Flask, render_template, request, session, redirect, url_for
  11. import mysql.connector
  12. import bcrypt
  13. cfg = json.load(open("meta.json"))
  14. scopes = ["read:accounts", "write:statuses"]
  15. settings = {
  16. "cw": False,
  17. # "disabled": False,
  18. }
  19. db = mysql.connector.connect(user=cfg['dbuser'], password=cfg['dbpass'], database=cfg['dbname'])
  20. c = db.cursor()
  21. dc = db.cursor(dictionary=True)
  22. # +---------------------+---------------+------+-----+------------------------------------------------+-------+
  23. # | Field | Type | Null | Key | Default | Extra |
  24. # +---------------------+---------------+------+-----+------------------------------------------------+-------+
  25. # | username | varchar(64) | NO | PRI | NULL | |
  26. # | instance | varchar(128) | NO | PRI | NULL | |
  27. # | password | tinytext | NO | | NULL | |
  28. # | avi | text | NO | | NULL | |
  29. # | secret | tinytext | NO | | NULL | |
  30. # | client_id | varchar(128) | NO | | NULL | |
  31. # | client_secret | tinytext | NO | | NULL | |
  32. # | cc | tinytext | YES | | NULL | |
  33. # | ccavi | varchar(128) | YES | | https://lynnesbian.space/res/ceres/cc-smol.png | |
  34. # | latest_post | tinytext | YES | | NULL | |
  35. # | last_check | int(11) | NO | | 0 | |
  36. # | time_between_checks | int(11) | NO | | 1 | |
  37. # | settings | varchar(4096) | YES | | {"cw": false} | |
  38. # +---------------------+---------------+------+-----+------------------------------------------------+-------+
  39. c.execute("CREATE TABLE IF NOT EXISTS `data` (username VARCHAR(64) NOT NULL, instance VARCHAR(128) NOT NULL, password TINYTEXT NOT NULL, avi TEXT NOT NULL, secret TINYTEXT NOT NULL, client_id VARCHAR(128) NOT NULL, client_secret TINYTEXT NOT NULL, cc TINYTEXT, ccavi VARCHAR(128) DEFAULT 'https://lynnesbian.space/res/ceres/cc-smol.png', latest_post TINYTEXT, last_check INT DEFAULT 0 NOT NULL, time_between_checks INT DEFAULT %s NOT NULL, settings VARCHAR(4096) DEFAULT %s, PRIMARY KEY(username, instance))", (cfg['min_time_between_checks'], json.dumps(settings),))
  40. app = Flask(cfg['name'])
  41. app.secret_key = cfg['flask_key']
  42. @app.route('/')
  43. def main():
  44. if 'acct' not in session:
  45. return render_template("landing_page.html")
  46. else:
  47. return redirect(url_for('home'))
  48. @app.route('/home')
  49. def home():
  50. if 'acct' in session:
  51. dc.execute("SELECT * FROM data WHERE username = %s AND instance = %s", (session['username'], session['instance']))
  52. #TODO: if this fails, redirect to /logout
  53. data = dc.fetchone()
  54. for item in ['username', 'instance', 'avi', 'secret', 'client_id', 'client_secret', 'cc', 'ccavi']:
  55. session[item] = data[item]
  56. if 'cc' not in session:
  57. session['cc'] = "None"
  58. if session['cc'] == "None" or 'ccavi' not in session:
  59. #every time home is rendered without cc being set
  60. c.execute("SELECT cc, ccavi FROM `data` WHERE client_id = %s AND instance = %s", (session['client_id'], session['instance']))
  61. cc = c.fetchone()
  62. if cc[0] != '':
  63. session['cc'] = cc[0]
  64. session['ccavi'] = cc[1]
  65. if 'last_avi_update' not in session or session['last_avi_update'] + (24 * 60 * 60) < time.time():
  66. #avatars haven't been updated for over 24 hours, update them now
  67. client = Mastodon(client_id=session['client_id'], client_secret=session['client_secret'], access_token=session['secret'], api_base_url=session['instance'])
  68. session['avi'] = client.account_verify_credentials()['avatar']
  69. if session['cc'] != "None" and session['cc'] != None:
  70. #update cc avi too
  71. r = requests.get("https://curiouscat.me/api/v2/profile?username={}".format(session['cc']))
  72. j = r.json()
  73. session['ccavi'] = j['userData']['avatar']
  74. c.execute("UPDATE data SET avi = %s, ccavi = %s WHERE client_id = %s AND instance = %s", (session['avi'], session['ccavi'], session['client_id'], session['instance']))
  75. else:
  76. c.execute("UPDATE data SET avi = %s WHERE client_id = %s AND instance = %s", (session['avi'], session['client_id'], session['instance']))
  77. session['last_avi_update'] = int(time.time())
  78. return render_template("home.html", mabg="background-image:url('{}')".format(session['avi']), ccbg="background-image:url('{}')".format(session['ccavi']))
  79. else:
  80. return redirect(url_for('main'))
  81. @app.route('/debug')
  82. def print_debug_info():
  83. if cfg['debug']:
  84. return json.dumps(session._get_current_object())
  85. else:
  86. return redirect('/home')
  87. @app.route('/logout')
  88. def reset_session():
  89. session.clear()
  90. return redirect(url_for('main'))
  91. @app.route('/login')
  92. def log_in():
  93. if 'acct' in session:
  94. #user is probably already logged in. if they aren't, home() will handle things and redirect them back here
  95. return redirect(url_for('home'))
  96. return render_template("login.html")
  97. # return(json.dumps(client_info))
  98. #internal stuff
  99. @app.route('/internal/auth_a')
  100. def internal_auth_a(): #TODO: prevent these endpoints from being spammed somehow
  101. session['instance'] = request.args.get('instance', default='mastodon.social', type=str)
  102. if not session['instance'].startswith("https://"):
  103. session['instance'] = "https://{}".format(session['instance'])
  104. session['client_id'], session['client_secret'] = Mastodon.create_app(cfg['name'],
  105. api_base_url=session['instance'],
  106. scopes=scopes,
  107. website=cfg['website'],
  108. redirect_uris=['{}/internal/auth_b'.format(cfg['base_uri'])]
  109. )
  110. client = Mastodon(client_id=session['client_id'], client_secret=session['client_secret'], api_base_url=session['instance'])
  111. url = client.auth_request_url(client_id=session['client_id'], redirect_uris='{}/internal/auth_b'.format(cfg['base_uri']), scopes=scopes)
  112. return redirect(url, code=307)
  113. @app.route('/internal/auth_b')
  114. def internal_auth_b():
  115. #write details to DB
  116. client = Mastodon(client_id=session['client_id'], client_secret=session['client_secret'], api_base_url=session['instance'])
  117. session['secret'] = client.log_in(code = request.args.get('code'), scopes=scopes, redirect_uri='{}/internal/auth_b'.format(cfg['base_uri']))
  118. acct_info = client.account_verify_credentials()
  119. session['username'] = acct_info['username']
  120. session['avi'] = acct_info['avatar']
  121. session['acct'] = "@{}@{}".format(session['username'], session['instance'].replace("https://", ""))
  122. c.execute("SELECT COUNT(*) FROM data WHERE username = %s AND instance = %s", (session['username'], session['instance']))
  123. if c.fetchone()[0] > 0:
  124. #user already has an account with CG
  125. #update the user's info to use the new info we just got, then redirect them to the login page
  126. c.execute("UPDATE data SET client_id = %s, client_secret = %s, secret = %s, avi = %s WHERE username = %s AND instance = %s", (session['client_id'], session['client_secret'], session['secret'], session['avi'], session['username'], session['instance']))
  127. return redirect(url_for('log_in'))
  128. else:
  129. return redirect(url_for('create_password'))
  130. @app.route('/internal/do_login', methods = ['POST'])
  131. def do_login():
  132. pw_in = request.form['pw']
  133. pw_hashed = hashlib.sha256(pw_in.encode('utf-8')).digest()
  134. acct = request.form['acct']
  135. session['username'] = re.match("^@([^@]+)@", acct).group(1)
  136. session['instance'] = "https://{}".format(re.search("@([^@]+)$", acct).group(1))
  137. dc.execute("SELECT * FROM data WHERE username = %s AND instance = %s", (session['username'], session['instance']))
  138. data = dc.fetchone()
  139. if bcrypt.checkpw(pw_hashed, data['password'].encode('utf-8')):
  140. #password is correct, log the user in
  141. for item in ['username', 'instance', 'avi', 'secret', 'client_id', 'client_secret', 'cc', 'ccavi']:
  142. session[item] = data[item]
  143. session['acct'] = "@{}@{}".format(session['username'], re.match("https://(.*)", session['instance']).group(1))
  144. return redirect('/home')
  145. else:
  146. return redirect('/login?invalid')
  147. @app.route('/create_password')
  148. def create_password():
  149. c.execute("SELECT COUNT(*) FROM data WHERE username = %s AND instance = %s", (session['username'], session['instance']))
  150. if c.fetchone()[0] == 0:
  151. return render_template("create_password.html", bg = "background-image:url('{}')".format(session['avi']))
  152. else:
  153. #user already exists in database, so they already have a password
  154. return redirect(url_for('main'))
  155. @app.route('/internal/create_account', methods=['POST'])
  156. def create_account():
  157. pw_in = request.form['pw']
  158. if len(pw_in) < 6 or pw_in == 'password': #TODO: this is a pretty crappy check
  159. return redirect('/create_password?invalid')
  160. pw_hashed = hashlib.sha256(pw_in.encode('utf-8')).digest()
  161. pw = bcrypt.hashpw(pw_hashed, bcrypt.gensalt(15))
  162. c.execute("INSERT INTO data (username, instance, avi, password, secret, client_id, client_secret) VALUES (%s, %s, %s, %s, %s, %s, %s)", (session['username'], session['instance'], session['avi'], pw, session['secret'], session['client_id'], session['client_secret']))
  163. db.commit()
  164. return redirect(url_for('home'))
  165. #cc connection
  166. @app.route('/cc_connect')
  167. def cc_connect():
  168. return render_template('cc_connect.html')
  169. @app.route('/internal/ccc_a', methods=['POST'])
  170. def ccc_a(): #step one of curiouscat connection: retreive details
  171. r = requests.get("https://curiouscat.me/api/v2/profile?username={}&count=1".format(request.form['cc']))
  172. j = r.json()
  173. if 'error' in j:
  174. return redirect('/cc_connect?invalid')
  175. session['cctemp'] = {
  176. "cc":j['userData']['username'],
  177. "ccavi":j['userData']['avatar'],
  178. "ccid":j['userData']['id'],
  179. "latest_post":j['posts'][0]['timestamp'] if len(j['posts']) != 0 else 0 #only post new answers from this point onwards, rather than posting all the old ones
  180. }
  181. return redirect('/cc_connect/confirm')
  182. @app.route('/cc_connect/confirm')
  183. def cc_connect_confirm():
  184. return render_template('cc_connect_confirm.html', bg="background-image:url('{}')".format(session['cctemp']['ccavi']))
  185. @app.route('/internal/ccc_b') #TODO: don't allow people to spam this
  186. def ccc_b():
  187. session['cctemp']['challenge'] = random.randint(100000, 999999)
  188. session.modified = True
  189. form_data = {
  190. "addressees": session['cctemp']['ccid'],
  191. "anon": "true",
  192. "question": "Hi {}! Your Curious Greg authentication code is: {}. You may safely delete this question after entering the code. If you didn't request this, you can ignore this question.".format(session['acct'], session['cctemp']['challenge'])
  193. }
  194. r = requests.post("https://curiouscat.me/api/v2/post/create", data=form_data)
  195. j = r.json()
  196. if 'success' in j and j['success'] == True:
  197. return redirect('/cc_connect/code')
  198. else:
  199. #todo: handle error properly
  200. return False
  201. @app.route('/cc_connect/code')
  202. def cc_connect_code():
  203. return render_template('cc_connect_code.html')
  204. @app.route('/internal/ccc_c', methods=['POST'])
  205. def ccc_c():
  206. if int(request.form['challenge']) != session['cctemp']['challenge']:
  207. return redirect('/cc_connect/code?invalid')
  208. for item in ['cc', 'ccavi']:
  209. session[item] = session['cctemp'][item]
  210. c.execute("UPDATE data SET cc = %s, ccavi = %s, latest_post = %s WHERE username = %s AND instance = %s", (session['cc'], session['ccavi'], session['cctemp']['latest_post'], session['username'], session['instance']))
  211. db.commit()
  212. del session['cctemp']
  213. return redirect('/cc_connect/complete')
  214. @app.route('/cc_connect/complete')
  215. def cc_connect_complete():
  216. return render_template('cc_connect_complete.html', bg="background-image:url('{}')".format(session['ccavi']))
  217. if __name__ == "__main__":
  218. app.run(host="0.0.0.0", port=4734) #4734 is t9 for 'greg'