Change config

auth-proxy.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+
+import configparser
+import json
+import sys
+from argparse import ArgumentParser
+from hmac import compare_digest
+from crypt import crypt
+import os
+import logging
+from subprocess import run
+from uuid import uuid4
+
+log = logging.getLogger('auth-proxy')
+logging.basicConfig(level='DEBUG')
+
+parser = ArgumentParser()
+parser.add_argument('--auth-file', default=os.environ.get('RCLONE_AUTH_PROXY_USERS', '/config/users.conf'))
+parser.add_argument('--backend-file', default=os.environ.get('RCLONE_AUTH_PROXY_BACKENDS', '/config/rclone.conf'))
+parser.add_argument('--input-file', default='')
+cli_args = parser.parse_args()
+
+auth_file_path = cli_args.auth_file
+backend_file_path = cli_args.backend_file
+input_file_path = cli_args.input_file
+
+def fail():
+    print('{}')
+    sys.exit(1)
+
+auth_config = configparser.ConfigParser()
+auth_config.read(auth_file_path)
+
+if input_file_path:
+    with open(input_file_path, 'r') as f:
+        auth_request = json.load(f)
+else:
+    auth_request = json.load(sys.stdin)
+
+
+req_user = auth_request.get('user', '')
+
+if not req_user in auth_config:
+    log.info(f'Fail - unknown username')
+    fail()
+
+user_config = auth_config[req_user]
+
+tokens = []
+req_public_key = auth_request.get('public_key', '')
+if req_public_key:
+    log.debug(f'Request public key is ' + req_public_key)
+    req_token = req_public_key
+    tokens = user_config.get('public_key', '').split()
+else:
+    req_pw = auth_request.get('pass', '')
+    if req_pw:
+        log.debug(f'Using password for auth')
+        req_token = req_pw
+        tokens = [user_config.get('pass', '')]
+
+if not req_token:
+    log.info('Fail - expected pass or public_key from rclone')
+    fail()
+
+if not tokens:
+    log.info('Fail - user has no pass or public_key configured')
+    fail()
+
+match = False
+for token in tokens:
+    if compare_digest(req_token, token):
+        match = True
+        break
+if not match:
+    log.info('Fail - bad authentication')
+    fail()
+
+if not (backend_name := user_config.get('backend', '')):
+    log.info(f'Fail - no backend specified')
+    fail()
+
+# Give rclone a chance to refresh any backend token, also checks the config
+try:
+    run(['rclone', '--config', backend_file_path, 'touch', '--no-create', f'{backend_name}:/{uuid4()}'], check=True)
+except:
+    fail()
+
+backend_config = configparser.ConfigParser()
+backend_config.read(backend_file_path)
+
+backend = { k: v for k, v in backend_config[backend_name].items() }
+if root := user_config.get('root', ''):
+    backend['_root'] = root
+
+print(json.dumps(backend))