secure admin panel with basic auth

README.md

@@ -114,7 +114,7 @@ Put the following code into the `post.hbs` of your ghost theme and replace `{{gh
 ```
 Example file [ghost-integration/post.hbs](ghost-integration/post.hbs)
 
-# Author address setup
+## Author address setup
 You can set `AUTHOR_ADDRESSES=true` in your `.env` file to allow authors to get paid individually.
 If so, the authors can paste in their current IOTA address in the `location` field in their ghost admin panel.  
 When an article is requested, the ghost API is fetched to get the latest address. If there is none, there is a fallback to the last address used or if this is not the case, the default address specified in the `.env` file is used.  
@@ -133,3 +133,7 @@ As an IOTA address is quite ugly in the location field of the author, you can mo
         </iota-button></span>
 {{/if}}
 ```
+
+## Author address setup
+You can set `ADMIN_PANEL=true` in your `.env` file to enable the admin panel on the `admin` path.  
+The admin panel is secured using basic authentication which credential are specified in the `.env` file as well.

admin/__init__.py

@@ -1,19 +1,56 @@
-from flask_admin import Admin 
+from flask_admin import Admin, AdminIndexView, BaseView, expose
+from flask_basicauth import BasicAuth
 from flask_admin.contrib.sqla import ModelView
 from database.db import db
 from database.models.access import Access
 from database.models.authors import Author
 from database.models.sessions import Session
 from database.models.slugs import Slug
 
-admin = Admin()
 
-class PkModelView(ModelView):
-    column_display_pk = True
+class AuthenticatedAdminView(AdminIndexView):
+
+    def is_accessible(self):
+        if not auth.authenticate():
+            return False
+        else:
+            return True
+
+    def inaccessible_callback(self, name, **kwargs):
+        return auth.challenge()
+
+    super(AdminIndexView)
+
+
+class AuthenticatedModelView(ModelView):
+    def is_accessible(self):
+        if not auth.authenticate():
+            return False
+        else:
+            return True
+
+    def inaccessible_callback(self, name, **kwargs):
+        return auth.challenge()
+
     super(ModelView)
 
-admin.add_view(PkModelView(Access, db.session))
-admin.add_view(PkModelView(Author, db.session))
-admin.add_view(PkModelView(Session, db.session))
-admin.add_view(PkModelView(Slug, db.session))
+class HomeView(BaseView):
+    @expose('/')
+    def index(self):
+        arg1 = 'Hello'
+        return self.render('admin/myhome.html', arg1=arg1)
+
+
+class PkModelView(AuthenticatedModelView):
+    column_display_pk = True
+
+    super(AuthenticatedModelView)
+
+
+admin = Admin(index_view=AuthenticatedAdminView(), template_mode='bootstrap4')
+auth = BasicAuth()
 
+admin.add_view(PkModelView(Access, db.session, name='Access', category='Database'))
+admin.add_view(PkModelView(Author, db.session, name='Authors', category='Database'))
+admin.add_view(PkModelView(Session, db.session, name='Sessions', category='Database'))
+admin.add_view(PkModelView(Slug, db.session, name='Posts', category='Database'))

app.py

@@ -2,7 +2,12 @@
 import secrets
 from utils.hash import hash_user_token
 from services.ghost_api import get_post, get_post_payment
-from config import SECRET_KEY, DATABASE_LOCATION, SESSION_LIFETIME, URL, ADMIN_PANEL
+from config import (SECRET_KEY,
+                    DATABASE_LOCATION,
+                    SESSION_LIFETIME,
+                    URL, ADMIN_PANEL,
+                    ADMIN_USER,
+                    ADMIN_PW)
 import os
 from services.iota import Listener
 from datetime import datetime, timedelta
@@ -14,7 +19,7 @@
                     send_from_directory,
                     redirect)
 from database.db import db
-from admin import admin
+from admin import admin, auth
 from database.operations import (check_slug,
                                 get_access,
                                 get_slug_data,
@@ -31,6 +36,10 @@
 
 app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
 
+app.config['BASIC_AUTH_USERNAME'] = ADMIN_USER
+
+app.config['BASIC_AUTH_PASSWORD'] = ADMIN_PW
+
 # create web socket for async communication
 socketio = SocketIO(app, async_mode='threading', cors_allowed_origins="*")
 
@@ -137,6 +146,7 @@ def await_payment(data):
 
         if ADMIN_PANEL:
             admin.init_app(app)
+            auth.init_app(app)
 
         socketio.start_background_task(iota_listener.start, app)
         socketio.run(app, host='0.0.0.0')

config/__init__.py

@@ -21,4 +21,8 @@
 
 GHOST_ADMIN_KEY = getenv('GHOST_ADMIN_KEY')
 
-ADMIN_PANEL = getenv('ADMIN_PANEL') == 'true'
+ADMIN_PANEL = getenv('ADMIN_PANEL') == 'true'
+
+ADMIN_USER = getenv('ADMIN_USER')
+
+ADMIN_PW = getenv('ADMIN_PW')

database/models/authors.py

@@ -3,4 +3,5 @@
 
 class Author(db.Model):
     id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(64))
     iota_address = db.Column(db.String(64), default=DEFAULT_IOTA_ADDRESS)

database/operations.py

@@ -38,7 +38,7 @@ def check_slug(slug, iota_listener):
                 # add author if not existant
                 if AUTHOR_ADDRESSES and not __exists(Author, post_data['primary_author']['id']):
 
-                    add_author(post_data['primary_author']['id'], post_data['primary_author']['location'])
+                    add_author(post_data['primary_author']['id'], post_data['primary_author']['name'], post_data['primary_author']['location'])
 
                     iota_listener.add_listening_address(post_data['primary_author']['location'])
 
@@ -114,9 +114,9 @@ def add_access(user_token_hash, exp_date=None):
     db.session.commit()
 
 
-def add_author(author_id, iota_address):
+def add_author(author_id, name, iota_address):
 
-    author = Author(id=author_id, iota_address=iota_address)
+    author = Author(id=author_id, name=name, iota_address=iota_address)
 
     db.session.add(author)
     db.session.commit()

example.env

@@ -25,3 +25,7 @@ AUTHOR_ADDRESSES=false
 
 # allow admin access via flask-admin
 ADMIN_PANEL=false
+
+ADMIN_USER=admin
+
+ADMIN_PW=secret_password

services/iota.py

@@ -52,7 +52,8 @@ def on_mqtt_event(self, event):
 
 
     def start(self, app):
-        self.client.subscribe_topics(get_iota_listening_addresses(), self.on_mqtt_event)
+        with app.app_context():
+            self.client.subscribe_topics(get_iota_listening_addresses(), self.on_mqtt_event)
         self.mqtt_worker(app)
 
 

templates/admin/index.html

@@ -0,0 +1,14 @@
+{% extends 'admin/master.html' %}
+
+{% block body %}
+{{ super() }}
+    <div style="margin: auto; text-align: center;">
+        <img src="{{ url_for('static', filename='logo.png') }}" style="max-width: 200px;"/>
+        <h2>Ghost IOTA Pay</h2>
+        <h3>Admin Panel</h3>
+        <p>Pay per content gateway for <a href="https://ghost.org/">Ghost Blogs</a></p>
+        <div style="margin-top: 50px;">
+            <p><a href="https://github.com/F-Node-Karlsruhe/ghost-iota-pay"><img width="16" src="{{ url_for('static', filename='github.png') }}"/></a></p>
+        </div>
+    </div>
+{% endblock body %}