actor_from_request for dstok_ tokens, refs #1852

datasette/default_permissions.py

@@ -1,5 +1,7 @@
 from datasette import hookimpl
 from datasette.utils import actor_matches_allow
+import itsdangerous
+import time
 
 
 @hookimpl(tryfirst=True)
@@ -45,3 +47,26 @@ def permission_allowed(datasette, actor, action, resource):
             return actor_matches_allow(actor, database_allow_sql)
 
     return inner
+
+
+@hookimpl
+def actor_from_request(datasette, request):
+    prefix = "dstok_"
+    authorization = request.headers.get("authorization")
+    if not authorization:
+        return None
+    if not authorization.startswith("Bearer "):
+        return None
+    token = authorization[len("Bearer ") :]
+    if not token.startswith(prefix):
+        return None
+    token = token[len(prefix) :]
+    try:
+        decoded = datasette.unsign(token, namespace="token")
+    except itsdangerous.BadSignature:
+        return None
+    expires_at = decoded.get("e")
+    if expires_at is not None:
+        if expires_at < time.time():
+            return None
+    return {"id": decoded["a"], "dstok": True}

datasette/utils/testing.py

@@ -62,6 +62,7 @@ class TestClient:
         method="GET",
         cookies=None,
         if_none_match=None,
+        headers=None,
     ):
         return await self._request(
             path=path,
@@ -70,6 +71,7 @@ class TestClient:
             method=method,
             cookies=cookies,
             if_none_match=if_none_match,
+            headers=headers,
         )
 
     @async_to_sync