From 7d7e19876dcaf16275b59cd429d9059163268478 Mon Sep 17 00:00:00 2001 From: sandro Date: Sun, 11 Oct 2026 20:27:43 +0200 Subject: [PATCH] =?UTF-8?q?Login=20auf=20api=20umgestellt=20und=20Passwort?= =?UTF-8?q?eingabe=20=C3=BCber=20URL=20erm=C3=B6glicht?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app.py | 58 ++++++++++++++++++++++++++++++++++++++++++++----- gettokentest.py | 31 ++++++++++++++++++++++++++ 2 files changed, 84 insertions(+), 5 deletions(-) create mode 100644 gettokentest.py diff --git a/app.py b/app.py index 0cb6dc8..2dd1cd3 100644 --- a/app.py +++ b/app.py @@ -103,7 +103,34 @@ def load_metadata(): # --------------------------------------------------------- # Toniecloud API & Playwright Hilfsfunktionen # --------------------------------------------------------- -async def get_tonie_api_token(username: str, password: str) -> str | None: +def get_tonie_api_token(username: str, password: str) -> str | None: + token_url = "https://login.tonies.com/auth/realms/tonies/protocol/openid-connect/token" + payload = { + "grant_type": "password", + "client_id": "my-tonies", + "username": username, + "password": password, + "scope": "openid" + } + headers = { + "Content-Type": "application/x-www-form-urlencoded" + } + + try: + resp = requests.post(token_url, data=payload, headers=headers, timeout=10) + if resp.status_code == 200: + data = resp.json() + return data.get("access_token") + else: + logger.error(f"Fehler bei Token-Anfrage: {resp.status_code} - {resp.text}") + log_to_db("FEHLER", f"Fehler bei Token-Anfrage: {resp.status_code} - {resp.text}") + return None + except Exception as e: + logger.error(f"Exception beim Token-Abruf: {e}") + log_to_db("FEHLER", f"Exception beim Token-Abruf: {e}") + return None + +async def get_tonie_api_token_playwright(username: str, password: str) -> str | None: async with async_playwright() as p: browser = await p.chromium.launch(headless=True) context = await browser.new_context(viewport={'width': 1280, 'height': 800}) @@ -814,24 +841,45 @@ TONIE_LOGIN_TEMPLATE = """ # --------------------------------------------------------- @app.before_request def require_login(): + # CORS Preflight oder öffentliche API-Routen ignorieren if request.method == 'OPTIONS' or request.path.startswith('/api/books'): return None - if request.args.get('pw') == PASSWORD: - return None + + # Passwort über URL-Parameter abfangen (?pw=... oder ?password=...) + url_pw = request.args.get('pw') or request.args.get('password') + if url_pw and url_pw == PASSWORD: + session['logged_in'] = True + + # Sauberer Redirect ohne Passwort-Parameter in der URL-Historie: + args = request.args.copy() + args.pop('pw', None) + args.pop('password', None) + clean_url = request.path + ('?' + args.to_encoded_string() if args else '') + return redirect(clean_url) + + # Prüfen, ob eingeloggt oder auf Login/Statics unterwegs if request.endpoint not in ['login', 'static'] and not session.get('logged_in'): return redirect(url_for('login', next=request.full_path if request.full_path != '/' else None)) @app.route('/login', methods=['GET', 'POST']) def login(): next_url = request.args.get('next') or url_for('index') + + # Schneller Login per GET-Parameter direkt auf /login + url_pw = request.args.get('pw') or request.args.get('password') + if url_pw == PASSWORD: + session['logged_in'] = True + return redirect(next_url) + if request.method == 'POST': if request.form.get('password') == PASSWORD: session['logged_in'] = True return redirect(next_url) else: return "Falsches Passwort!", 403 + return render_template_string(LOGIN_TEMPLATE) - + @app.route('/tonie-login', methods=['GET', 'POST']) def tonie_login(): error = None @@ -839,7 +887,7 @@ def tonie_login(): email = request.form.get('tonie_email') pwd = request.form.get('tonie_password') - token = asyncio.run(get_tonie_api_token(email, pwd)) + token = get_tonie_api_token(email, pwd) if token: session['tonie_token'] = token session['tonie_email'] = email diff --git a/gettokentest.py b/gettokentest.py new file mode 100644 index 0000000..50be2c9 --- /dev/null +++ b/gettokentest.py @@ -0,0 +1,31 @@ +import requests + +def get_tonie_api_token(username: str, password: str) -> str | None: + token_url = "https://login.tonies.com/auth/realms/tonies/protocol/openid-connect/token" + payload = { + "grant_type": "password", + "client_id": "my-tonies", + "username": username, + "password": password, + "scope": "openid" + } + headers = { + "Content-Type": "application/x-www-form-urlencoded" + } + + try: + resp = requests.post(token_url, data=payload, headers=headers, timeout=10) + if resp.status_code == 200: + data = resp.json() + return data.get("access_token") + else: + print(f"Fehler bei Token-Anfrage: {resp.status_code} - {resp.text}") + #log_to_db("FEHLER", f"Fehler bei Token-Anfrage: {resp.status_code} - {resp.text}") + return None + except Exception as e: + print(f"Exception beim Token-Abruf: {e}") + #log_to_db("FEHLER", f"Exception beim Token-Abruf: {e}") + return None + +if __name__ == "__main__": + print(get_tonie_api_token(username="sandromormile@gmail.com", password="Sandro92@tonies"))