group bugs and authorization improvements by codex

api.py

@@ -1,5 +1,5 @@
 from flask import Blueprint, render_template, redirect, url_for, request
-from flask_login import login_required, current_user
+from flask_login import login_required, current_user, login_user
 from models import db
 from models import User, Item
 import json
@@ -14,7 +14,6 @@ def validate_key():
     result['data'] = ''
     if "key" in request.form:
         key = request.form["key"]
-        print(key)
         if key == 'NogNietNodigHier':
             result['status'] = 1
         else:
@@ -29,12 +28,14 @@ def login():
     if "user" in request.form and "password" in request.form:
         user = request.form["user"]
         password = request.form["password"]
-        print(user)
         user = User.query.filter_by(name=user).first()
         if user and user.check_password(password):
             if not user.is_approved:
                 result['message'] = 'User is pending approval.'
+            elif user.group_id == 0:
+                result['message'] = 'User is not connected to a group.'
             else:
+                login_user(user)
                 result['status'] = 1
                 result['data'] = user.as_dict()
         else:
@@ -47,53 +48,51 @@ def register():
     result['status']=0
     result['data'] = ''
     if "user" in request.form and "password" in request.form:
-        username = request.form["user"]
+        username = request.form["user"].strip()
         password = request.form["password"]
-        print(username)
         user = User.query.filter_by(name=username).first()
         if user:
             result['message'] = 'Username is not unique. Pick something else please.'
         else:
+            user = User(name=username)
+            group_id = user.set_group_id(password)
+            if group_id == 0:
+                result['message'] = 'Unknown registration key.'
+                return json.dumps(result), 200
+
             result['status'] = 2
             result['message'] = 'Registration Ok. Awaiting approval.'
-            user = User(name=username)
             user.set_password(password)
+            user.group_id = group_id
             db.session.add(user)
             db.session.commit()
 
     return json.dumps(result), 200
 
 @api_bp.route("/load_lists", methods=["POST"])
+@login_required
 def load_lists():
-    print("Trying to load lists")
     result={}
     result['status']=1 # from this call the result is always 1, empty or not
-    result['data'] = ''
-    if "userid" in request.form:
-        userid = int(request.form["userid"])
-
-        print(userid)
-        user = User.query.filter_by(id=userid).first()
-        if user:
-            result['data'] = user.all_my_lists_as_dict()
+    result['data'] = current_user.all_my_lists_as_dict()
 
     return json.dumps(result), 200
 
 @api_bp.route("/load_items", methods=["POST"])
+@login_required
 def load_items():
-    print("Trying to load items")
     result={}
     result['status']=1 # from this call the result is always 1, empty or not
     result['data'] = ''
     if "listid" in request.form:
         listid = int(request.form["listid"])
+        if current_user.can_access_list(listid):
+            items=Item.query.filter_by(listofitems_id=listid, is_suggestion=False).order_by(text("is_checked, category, label")).all()
+            if items:
+                result['data'] = [ i.as_dict() for i in items]
+        else:
+            result['status'] = 0
+            result['message'] = 'Forbidden'
+            return json.dumps(result), 403
 
-        print(listid)
-        items=Item.query.filter_by(listofitems_id=listid, is_suggestion=False).order_by(text("is_checked, category, label")).all()
-        print(items)
-        if items:
-            result['data'] = [ i.as_dict() for i in items]
-
-    print(result)
     return json.dumps(result), 200
-