auth providers

pytorrent/routes/auth_api.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from flask import abort, jsonify, request
 
-from ..services.auth import current_user, list_users, save_user, delete_user, login_user, logout_user, enabled as auth_enabled, list_api_tokens, create_api_token, revoke_api_token
+from ..services.auth import current_user, list_users, save_user, delete_user, login_user, logout_user, enabled as auth_enabled, provider as auth_provider, list_api_tokens, create_api_token, revoke_api_token
 
 
 def _ok(payload=None):
@@ -21,13 +21,13 @@ def register_auth_routes(bp):
         user = login_user(str(data.get("username") or ""), str(data.get("password") or ""))
         if not user:
             return jsonify({"ok": False, "error": "Invalid username or password"}), 401
-        return _ok({"user": user, "auth_enabled": auth_enabled()})
+        return _ok({"user": user, "auth_enabled": auth_enabled(), "auth_provider": auth_provider()})
 
     @bp.get("/auth/me")
     def auth_me():
         if not auth_enabled():
             abort(404)
-        return _ok({"user": current_user(), "auth_enabled": auth_enabled()})
+        return _ok({"user": current_user(), "auth_enabled": auth_enabled(), "auth_provider": auth_provider()})
 
     @bp.post("/auth/logout")
     def auth_logout():

pytorrent/routes/main.py

@@ -174,13 +174,23 @@ def login():
     # Note: When optional authentication is disabled, /login is intentionally unavailable.
     if not auth.enabled():
         abort(404)
+    next_url = request.args.get("next") or url_for("main.index")
+    if auth.uses_external_provider():
+        user = auth.authenticate_external_user()
+        if user:
+            return redirect(next_url)
+        return render_template(
+            "login.html",
+            error="External authentication headers were not accepted by pyTorrent.",
+            external_provider=auth.provider(),
+        ), 401
     error = ""
     if request.method == "POST":
         user = auth.login_user(request.form.get("username", ""), request.form.get("password", ""))
         if user:
-            return redirect(request.args.get("next") or url_for("main.index"))
+            return redirect(next_url)
         error = "Invalid username or password"
-    return render_template("login.html", error=error)
+    return render_template("login.html", error=error, external_provider=None)
 
 
 @bp.get("/logout")