Authorization checks in server.py

[ndmlny-qs]

This commit adds a single parameter used in the
config.authorize_callback that allows the user supplied method to check if an app user is authorized to view the requested app at the given path.

Resolves #3179

[codecov]

Codecov Report

Merging #5386 (56893bb) into main (229f90e) will decrease coverage by 0.05%.
Report is 14 commits behind head on main.
The diff coverage is 36.84%.

@@            Coverage Diff             @@
##             main    #5386      +/-   ##
==========================================
- Coverage   72.69%   72.65%   -0.05%     
==========================================
  Files         274      274              
  Lines       39862    39922      +60     
==========================================
+ Hits        28978    29005      +27     
- Misses      10884    10917      +33     

Flag	Coverage Δ
unitexamples-tests	72.65% <36.84%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
panel/config.py	68.90% <ø> (ø)
panel/io/server.py	66.82% <36.84%> (-1.07%)	⬇️

... and 10 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[philippjfr]

Thanks, this makes sense but it's also not backward compatible. Could we maybe add a try/except or explicitly check the signature of the function to make sure the old signature is still supported?

Also we should update the docstring of the config. authorize_callback parameter.

[ndmlny-qs]

thanks @philippjfr I'll make those changes and update the docstring. If it makes sense, I'll also add a blurb to the documentation page with an example.

[el-abcd]

Hi,

I was trying to add oath to a small panel app (to run in "google cloud run").
It seems like with panel==1.2.2 that the authorize() method MUST have BOTH parameters?

def authorize(user_info, request_path):

i.e. when I tried
def authorize(user_info):
which is working for panel=1.2.1 I see:

2023-09-11 14:07:44,242 Uncaught exception GET /220514_01_awesome_panel (::1)
HTTPServerRequest(protocol='http', host='localhost:5006', method='GET', uri='/220514_01_awesome_panel', version='HTTP/1.1', remote_ip='::1')
Traceback (most recent call last):
File "/Users/ericlee/.pyenv/versions/3.10.4/lib/python3.10/site-packages/tornado/web.py", line 1704, in _execute
result = await result
File "/Users/ericlee/.pyenv/versions/3.10.4/lib/python3.10/site-packages/panel/io/server.py", line 517, in get
raise RuntimeError(
RuntimeError: Authorization callback must accept either one or two arguments.

Perhaps the check here:
b6d6b34#diff-aaf5dc2e57ff38e7660dbe2c7e08cd2b8a34242b382d40f049987b95f605e628R513
should be changed from
if len(auth_params) == 2:
to something like
if len(auth_params) in [1,2]:
?

Regards,
Eric

[maximlt]

Hi @el-abcd and thanks for reporting that. Indeed it seems there's a bug! I believe your suggestion not to be quite the right one, when len(auth_params) == 1 you do not want to expand to expand auth_args. The logic could be rewritten as:

                    if len(auth_params) == 1:
                        auth_args = (state.user_info,)
                    elif len(auth_params) == 2:
                        auth_args == (state.user_info, self.request.path)
                    else:
                        raise RuntimeError(
                            'Authorization callback must accept either one or two arguments.'
                        )

Would you be interested in making that change in a PR?

[el-abcd]

Hi Maxime,

Yes, I can give that a try.
It might take me a couple days to get a development environment setup, etc. but I will see if I can make the PR, etc.

Eric

[ndmlny-qs]

@el-abcd I see the problem, and can make a fix tomorrow. thanks for the report

[ndmlny-qs]

see #5504