auth.py

from authlib.integrations.flask_client import OAuth, OAuthError
from flask import Blueprint
from flask import flash
from flask import redirect
from flask import request
from flask import session
from flask import url_for
from urllib.parse import unquote, urlparse

import config


auth = Blueprint('auth', __name__, template_folder='templates')
oauth = OAuth()
oauth.register(
    name='google',
    client_id=config.GOOGLE_OAUTH_CONSUMER_KEY,
    client_secret=config.GOOGLE_OAUTH_CONSUMER_SECRET,
    server_metadata_url='https://accounts.google.com/.well-known/openid-configuration',
    client_kwargs={
        'scope': 'openid email profile',
    },
)


def configure_auth(app):
    oauth.init_app(app)
    app.register_blueprint(auth, url_prefix='/auth')


@auth.route('/')
@auth.route('/login')
def login():
    next_path = request.args.get('next')
    if next_path:
        # Since passing along the "next" URL as a GET param requires
        # a different callback for each page, and Google requires us to
        # whitelist each allowed callback page, we can't pass it as a GET
        # param. Instead, we sanitize and put into the session.
        request_components = urlparse(request.url)
        path = unquote(next_path)
        if path[0] == '/':
            # This first slash is unnecessary since we force it in when we
            # format next_url.
            path = path[1:]

        next_url = "{scheme}://{netloc}/{path}".format(
            scheme=request_components.scheme,
            netloc=request_components.netloc,
            path=path,
        )
        session['next_url'] = next_url
    return oauth.google.authorize_redirect(
        redirect_uri=url_for('.authorized', _external=True))


@auth.route('/logout')
def logout():
    session.pop('user', None)
    return redirect(url_for('index'))


@auth.route('/login/authorized')
def authorized():
    next_url = session.pop('next_url', url_for('index'))

    try:
        token = oauth.google.authorize_access_token()

        session.permanent = True
        session['user'] = token['userinfo']

        return redirect(next_url)
    except OAuthError:
        flash("You didn't sign in.")
        return redirect(next_url)