<s> from __future__ import print_function <EOL> from time import time <EOL> from traceback import format_exc <EOL> from uuid import uuid4 <EOL> from hashlib import sha1 <EOL> import hmac <EOL> import base64 <EOL> from eventlet import Timeout <EOL> import six <EOL> from six . moves . urllib . parse import unquote <EOL> from swift . common . swob import Response , Request <EOL> from swift . common . swob import HTTPBadRequest , HTTPForbidden , HTTPNotFound , HTTPUnauthorized <EOL> from swift . common . request_helpers import get_sys_meta_prefix <EOL> from swift . common . middleware . acl import ( <EOL> clean_acl , parse_acl , referrer_allowed , acls_from_account_info ) <EOL> from swift . common . utils import cache_from_env , get_logger , split_path , config_true_value , register_swift_info <EOL> from swift . common . utils import config_read_reseller_options <EOL> from swift . proxy . controllers . base import get_account_info <EOL> DEFAULT_TOKEN_LIFE = <NUM_LIT> <EOL> class TempAuth ( object ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self , app , conf ) : <EOL> self . app = app <EOL> self . conf = conf <EOL> self . logger = get_logger ( conf , log_route = '<STR_LIT>' ) <EOL> self . log_headers = config_true_value ( conf . get ( '<STR_LIT>' , '<STR_LIT:f>' ) ) <EOL> self . reseller_prefixes , self . account_rules = config_read_reseller_options ( conf , dict ( require_group = '<STR_LIT>' ) ) <EOL> self . reseller_prefix = self . reseller_prefixes [ <NUM_LIT:0> ] <EOL> self . logger . set_statsd_prefix ( '<STR_LIT>' % ( <EOL> self . reseller_prefix if self . reseller_prefix else '<STR_LIT>' , ) ) <EOL> self . auth_prefix = conf . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> if not self . auth_prefix or not self . auth_prefix . strip ( '<STR_LIT:/>' ) : <EOL> self . logger . warning ( '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' % self . auth_prefix ) <EOL> self . auth_prefix = '<STR_LIT>' <EOL> if not self . auth_prefix . startswith ( '<STR_LIT:/>' ) : <EOL> self . auth_prefix = '<STR_LIT:/>' + self . auth_prefix <EOL> if not self . auth_prefix . endswith ( '<STR_LIT:/>' ) : <EOL> self . auth_prefix += '<STR_LIT:/>' <EOL> self . token_life = int ( conf . get ( '<STR_LIT>' , DEFAULT_TOKEN_LIFE ) ) <EOL> self . allow_overrides = config_true_value ( <EOL> conf . get ( '<STR_LIT>' , '<STR_LIT:t>' ) ) <EOL> self . storage_url_scheme = conf . get ( '<STR_LIT>' , '<STR_LIT:default>' ) <EOL> self . users = { } <EOL> for conf_key in conf : <EOL> if conf_key . startswith ( '<STR_LIT>' ) or conf_key . startswith ( '<STR_LIT>' ) : <EOL> account , username = conf_key . split ( '<STR_LIT:_>' , <NUM_LIT:1> ) [ <NUM_LIT:1> ] . split ( '<STR_LIT:_>' ) <EOL> if conf_key . startswith ( '<STR_LIT>' ) : <EOL> account += '<STR_LIT:=>' * ( len ( account ) % <NUM_LIT:4> ) <EOL> account = base64 . b64decode ( account ) <EOL> username += '<STR_LIT:=>' * ( len ( username ) % <NUM_LIT:4> ) <EOL> username = base64 . b64decode ( username ) <EOL> values = conf [ conf_key ] . split ( ) <EOL> if not values : <EOL> raise ValueError ( '<STR_LIT>' % conf_key ) <EOL> key = values . pop ( <NUM_LIT:0> ) <EOL> if values and ( '<STR_LIT>' in values [ - <NUM_LIT:1> ] or '<STR_LIT>' in values [ - <NUM_LIT:1> ] ) : <EOL> url = values . pop ( ) <EOL> else : <EOL> url = '<STR_LIT>' % ( self . reseller_prefix , account ) <EOL> self . users [ account + '<STR_LIT::>' + username ] = { <EOL> '<STR_LIT:key>' : key , '<STR_LIT:url>' : url , '<STR_LIT>' : values } <EOL> def __call__ ( self , env , start_response ) : <EOL> """<STR_LIT>""" <EOL> if self . allow_overrides and env . get ( '<STR_LIT>' , False ) : <EOL> return self . app ( env , start_response ) <EOL> if env . get ( '<STR_LIT>' , '<STR_LIT>' ) . startswith ( self . auth_prefix ) : <EOL> return self . handle ( env , start_response ) <EOL> s3 = env . get ( '<STR_LIT>' ) <EOL> token = env . get ( '<STR_LIT>' , env . get ( '<STR_LIT>' ) ) <EOL> service_token = env . get ( '<STR_LIT>' ) <EOL> if s3 or ( token and token . startswith ( self . reseller_prefix ) ) : <EOL> groups = self . get_groups ( env , token ) <EOL> if service_token : <EOL> service_groups = self . get_groups ( env , service_token ) <EOL> if groups and service_groups : <EOL> groups += '<STR_LIT:U+002C>' + service_groups <EOL> if groups : <EOL> user = groups and groups . split ( '<STR_LIT:U+002C>' , <NUM_LIT:1> ) [ <NUM_LIT:0> ] or '<STR_LIT>' <EOL> trans_id = env . get ( '<STR_LIT>' ) <EOL> self . logger . debug ( '<STR_LIT>' % <EOL> ( user , '<STR_LIT>' if s3 else token , trans_id ) ) <EOL> env [ '<STR_LIT>' ] = groups <EOL> env [ '<STR_LIT>' ] = self . authorize <EOL> env [ '<STR_LIT>' ] = clean_acl <EOL> if '<STR_LIT>' in groups : <EOL> env [ '<STR_LIT>' ] = True <EOL> else : <EOL> if self . reseller_prefix and not s3 : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> try : <EOL> vrs , realm , rest = split_path ( env [ '<STR_LIT>' ] , <EOL> <NUM_LIT:2> , <NUM_LIT:3> , True ) <EOL> except ValueError : <EOL> realm = '<STR_LIT>' <EOL> return HTTPUnauthorized ( headers = { <EOL> '<STR_LIT>' : '<STR_LIT>' % realm } ) ( <EOL> env , start_response ) <EOL> elif '<STR_LIT>' not in env : <EOL> env [ '<STR_LIT>' ] = self . denied_response <EOL> else : <EOL> if self . _is_definitive_auth ( env . get ( '<STR_LIT>' , '<STR_LIT>' ) ) : <EOL> env [ '<STR_LIT>' ] = self . authorize <EOL> env [ '<STR_LIT>' ] = clean_acl <EOL> elif self . reseller_prefix == '<STR_LIT>' : <EOL> if '<STR_LIT>' not in env : <EOL> env [ '<STR_LIT>' ] = self . authorize <EOL> env [ '<STR_LIT>' ] = clean_acl <EOL> else : <EOL> if '<STR_LIT>' not in env : <EOL> env [ '<STR_LIT>' ] = self . denied_response <EOL> return self . app ( env , start_response ) <EOL> def _is_definitive_auth ( self , path ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> version , account , rest = split_path ( path , <NUM_LIT:1> , <NUM_LIT:3> , True ) <EOL> except ValueError : <EOL> return False <EOL> if account : <EOL> return bool ( self . _get_account_prefix ( account ) ) <EOL> return False <EOL> def _non_empty_reseller_prefixes ( self ) : <EOL> return iter ( [ pre for pre in self . reseller_prefixes if pre != '<STR_LIT>' ] ) <EOL> def _get_account_prefix ( self , account ) : <EOL> """<STR_LIT>""" <EOL> if account is None : <EOL> return None <EOL> for prefix in self . _non_empty_reseller_prefixes ( ) : <EOL> if account . startswith ( prefix ) : <EOL> return prefix <EOL> if '<STR_LIT>' in self . reseller_prefixes : <EOL> return '<STR_LIT>' <EOL> return None <EOL> def _dot_account ( self , account ) : <EOL> """<STR_LIT>""" <EOL> prefix = self . _get_account_prefix ( account ) <EOL> return prefix is not None and account [ len ( prefix ) ] == '<STR_LIT:.>' <EOL> def _get_user_groups ( self , account , account_user , account_id ) : <EOL> """<STR_LIT>""" <EOL> groups = [ account , account_user ] <EOL> groups . extend ( self . users [ account_user ] [ '<STR_LIT>' ] ) <EOL> if '<STR_LIT>' in groups : <EOL> groups . remove ( '<STR_LIT>' ) <EOL> for prefix in self . _non_empty_reseller_prefixes ( ) : <EOL> groups . append ( '<STR_LIT>' % ( prefix , account ) ) <EOL> if account_id not in groups : <EOL> groups . append ( account_id ) <EOL> groups = '<STR_LIT:U+002C>' . join ( groups ) <EOL> return groups <EOL> def get_groups ( self , env , token ) : <EOL> """<STR_LIT>""" <EOL> groups = None <EOL> memcache_client = cache_from_env ( env ) <EOL> if not memcache_client : <EOL> raise Exception ( '<STR_LIT>' ) <EOL> memcache_token_key = '<STR_LIT>' % ( self . reseller_prefix , token ) <EOL> cached_auth_data = memcache_client . get ( memcache_token_key ) <EOL> if cached_auth_data : <EOL> expires , groups = cached_auth_data <EOL> if expires < time ( ) : <EOL> groups = None <EOL> if env . get ( '<STR_LIT>' ) : <EOL> account_user , sign = env [ '<STR_LIT>' ] . split ( '<STR_LIT:U+0020>' ) [ <NUM_LIT:1> ] . rsplit ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> if account_user not in self . users : <EOL> return None <EOL> account , user = account_user . split ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> account_id = self . users [ account_user ] [ '<STR_LIT:url>' ] . rsplit ( '<STR_LIT:/>' , <NUM_LIT:1> ) [ - <NUM_LIT:1> ] <EOL> path = env [ '<STR_LIT>' ] <EOL> env [ '<STR_LIT>' ] = path . replace ( account_user , account_id , <NUM_LIT:1> ) <EOL> msg = base64 . urlsafe_b64decode ( unquote ( token ) ) <EOL> key = self . users [ account_user ] [ '<STR_LIT:key>' ] <EOL> s = base64 . encodestring ( hmac . new ( key , msg , sha1 ) . digest ( ) ) . strip ( ) <EOL> if s != sign : <EOL> return None <EOL> groups = self . _get_user_groups ( account , account_user , account_id ) <EOL> return groups <EOL> def account_acls ( self , req ) : <EOL> """<STR_LIT>""" <EOL> info = get_account_info ( req . environ , self . app , swift_source = '<STR_LIT>' ) <EOL> try : <EOL> acls = acls_from_account_info ( info ) <EOL> except ValueError as e1 : <EOL> self . logger . warning ( "<STR_LIT>" % e1 ) <EOL> return None <EOL> except NotImplementedError as e2 : <EOL> self . logger . warning ( <EOL> "<STR_LIT>" <EOL> % e2 ) <EOL> return None <EOL> return acls <EOL> def extract_acl_and_report_errors ( self , req ) : <EOL> """<STR_LIT>""" <EOL> acl_header = '<STR_LIT>' <EOL> acl_data = req . headers . get ( acl_header ) <EOL> result = parse_acl ( version = <NUM_LIT:2> , data = acl_data ) <EOL> if result is None : <EOL> return '<STR_LIT>' % acl_data <EOL> tempauth_acl_keys = '<STR_LIT>' . split ( ) <EOL> for key in result : <EOL> if key not in tempauth_acl_keys : <EOL> return "<STR_LIT>" % key <EOL> for key in tempauth_acl_keys : <EOL> if key not in result : <EOL> continue <EOL> if not isinstance ( result [ key ] , list ) : <EOL> return "<STR_LIT>" % key <EOL> for grantee in result [ key ] : <EOL> if not isinstance ( grantee , six . string_types ) : <EOL> return "<STR_LIT>" % key <EOL> internal_hdr = get_sys_meta_prefix ( '<STR_LIT>' ) + '<STR_LIT>' <EOL> req . headers [ internal_hdr ] = req . headers . pop ( acl_header ) <EOL> return None <EOL> def authorize ( self , req ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> _junk , account , container , obj = req . split_path ( <NUM_LIT:1> , <NUM_LIT:4> , True ) <EOL> except ValueError : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> return HTTPNotFound ( request = req ) <EOL> if self . _get_account_prefix ( account ) is None : <EOL> self . logger . debug ( "<STR_LIT>" <EOL> "<STR_LIT>" <EOL> % ( account , '<STR_LIT:U+002C>' . join ( self . reseller_prefixes ) ) ) <EOL> return self . denied_response ( req ) <EOL> acl_data = req . headers . get ( '<STR_LIT>' ) <EOL> if acl_data is not None : <EOL> error = self . extract_acl_and_report_errors ( req ) <EOL> if error : <EOL> msg = '<STR_LIT>' % ( <EOL> error , acl_data ) <EOL> headers = [ ( '<STR_LIT:Content-Type>' , '<STR_LIT>' ) ] <EOL> return HTTPBadRequest ( request = req , headers = headers , body = msg ) <EOL> user_groups = ( req . remote_user or '<STR_LIT>' ) . split ( '<STR_LIT:U+002C>' ) <EOL> account_user = user_groups [ <NUM_LIT:1> ] if len ( user_groups ) > <NUM_LIT:1> else None <EOL> if '<STR_LIT>' in user_groups and account not in self . reseller_prefixes and not self . _dot_account ( account ) : <EOL> req . environ [ '<STR_LIT>' ] = True <EOL> self . logger . debug ( "<STR_LIT>" <EOL> % account_user ) <EOL> return None <EOL> if account in user_groups and ( req . method not in ( '<STR_LIT>' , '<STR_LIT>' ) or container ) : <EOL> account_prefix = self . _get_account_prefix ( account ) <EOL> require_group = self . account_rules . get ( account_prefix ) . get ( <EOL> '<STR_LIT>' ) <EOL> if require_group and require_group in user_groups : <EOL> req . environ [ '<STR_LIT>' ] = True <EOL> self . logger . debug ( "<STR_LIT>" <EOL> "<STR_LIT>" % ( account_user , <EOL> require_group ) ) <EOL> return None <EOL> elif not require_group : <EOL> req . environ [ '<STR_LIT>' ] = True <EOL> self . logger . debug ( "<STR_LIT>" <EOL> % account_user ) <EOL> return None <EOL> if ( req . environ . get ( '<STR_LIT>' ) <EOL> and ( req . environ [ '<STR_LIT>' ] == <EOL> req . headers . get ( '<STR_LIT>' , None ) ) <EOL> and '<STR_LIT>' in req . headers ) : <EOL> self . logger . debug ( "<STR_LIT>" <EOL> % req . environ [ '<STR_LIT>' ] ) <EOL> return None <EOL> if req . method == '<STR_LIT>' : <EOL> self . logger . debug ( "<STR_LIT>" ) <EOL> return None <EOL> referrers , groups = parse_acl ( getattr ( req , '<STR_LIT>' , None ) ) <EOL> if referrer_allowed ( req . referer , referrers ) : <EOL> if obj or '<STR_LIT>' in groups : <EOL> self . logger . debug ( "<STR_LIT>" <EOL> % req . referer ) <EOL> return None <EOL> for user_group in user_groups : <EOL> if user_group in groups : <EOL> self . logger . debug ( "<STR_LIT>" <EOL> % ( account_user , user_group ) ) <EOL> return None <EOL> acct_acls = self . account_acls ( req ) <EOL> if acct_acls : <EOL> user_group_set = set ( user_groups ) <EOL> if user_group_set . intersection ( acct_acls [ '<STR_LIT>' ] ) : <EOL> req . environ [ '<STR_LIT>' ] = True <EOL> self . logger . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' % account_user ) <EOL> return None <EOL> if ( user_group_set . intersection ( acct_acls [ '<STR_LIT>' ] ) and <EOL> ( container or req . method in ( '<STR_LIT:GET>' , '<STR_LIT>' ) ) ) : <EOL> self . logger . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' % account_user ) <EOL> return None <EOL> if ( user_group_set . intersection ( acct_acls [ '<STR_LIT>' ] ) and <EOL> req . method in ( '<STR_LIT:GET>' , '<STR_LIT>' ) ) : <EOL> self . logger . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' % account_user ) <EOL> return None <EOL> return self . denied_response ( req ) <EOL> def denied_response ( self , req ) : <EOL> """<STR_LIT>""" <EOL> if req . remote_user : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> return HTTPForbidden ( request = req ) <EOL> else : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> return HTTPUnauthorized ( request = req ) <EOL> def handle ( self , env , start_response ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> req = Request ( env ) <EOL> if self . auth_prefix : <EOL> req . path_info_pop ( ) <EOL> req . bytes_transferred = '<STR_LIT:->' <EOL> req . client_disconnect = False <EOL> if '<STR_LIT>' in req . headers and '<STR_LIT>' not in req . headers : <EOL> req . headers [ '<STR_LIT>' ] = req . headers [ '<STR_LIT>' ] <EOL> return self . handle_request ( req ) ( env , start_response ) <EOL> except ( Exception , Timeout ) : <EOL> print ( "<STR_LIT>" % ( format_exc ( ) , env ) ) <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> start_response ( '<STR_LIT>' , <EOL> [ ( '<STR_LIT:Content-Type>' , '<STR_LIT>' ) ] ) <EOL> return [ '<STR_LIT>' ] <EOL> def handle_request ( self , req ) : <EOL> """<STR_LIT>""" <EOL> req . start_time = time ( ) <EOL> handler = None <EOL> try : <EOL> version , account , user , _junk = split_path ( req . path_info , <EOL> <NUM_LIT:1> , <NUM_LIT:4> , True ) <EOL> except ValueError : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> return HTTPNotFound ( request = req ) <EOL> if version in ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) : <EOL> if req . method == '<STR_LIT:GET>' : <EOL> handler = self . handle_get_token <EOL> if not handler : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> req . response = HTTPBadRequest ( request = req ) <EOL> else : <EOL> req . response = handler ( req ) <EOL> return req . response <EOL> def handle_get_token ( self , req ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> pathsegs = split_path ( req . path_info , <NUM_LIT:1> , <NUM_LIT:3> , True ) <EOL> except ValueError : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> return HTTPNotFound ( request = req ) <EOL> if pathsegs [ <NUM_LIT:0> ] == '<STR_LIT>' and pathsegs [ <NUM_LIT:2> ] == '<STR_LIT>' : <EOL> account = pathsegs [ <NUM_LIT:1> ] <EOL> user = req . headers . get ( '<STR_LIT>' ) <EOL> if not user : <EOL> user = req . headers . get ( '<STR_LIT>' ) <EOL> if not user or '<STR_LIT::>' not in user : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> auth = '<STR_LIT>' % account <EOL> return HTTPUnauthorized ( request = req , <EOL> headers = { '<STR_LIT>' : auth } ) <EOL> account2 , user = user . split ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> if account != account2 : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> auth = '<STR_LIT>' % account <EOL> return HTTPUnauthorized ( request = req , <EOL> headers = { '<STR_LIT>' : auth } ) <EOL> key = req . headers . get ( '<STR_LIT>' ) <EOL> if not key : <EOL> key = req . headers . get ( '<STR_LIT>' ) <EOL> elif pathsegs [ <NUM_LIT:0> ] in ( '<STR_LIT>' , '<STR_LIT>' ) : <EOL> user = req . headers . get ( '<STR_LIT>' ) <EOL> if not user : <EOL> user = req . headers . get ( '<STR_LIT>' ) <EOL> if not user or '<STR_LIT::>' not in user : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> auth = '<STR_LIT>' <EOL> return HTTPUnauthorized ( request = req , <EOL> headers = { '<STR_LIT>' : auth } ) <EOL> account , user = user . split ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> key = req . headers . get ( '<STR_LIT>' ) <EOL> if not key : <EOL> key = req . headers . get ( '<STR_LIT>' ) <EOL> else : <EOL> return HTTPBadRequest ( request = req ) <EOL> if not all ( ( account , user , key ) ) : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> realm = account or '<STR_LIT>' <EOL> return HTTPUnauthorized ( request = req , headers = { '<STR_LIT>' : <EOL> '<STR_LIT>' % <EOL> realm } ) <EOL> account_user = account + '<STR_LIT::>' + user <EOL> if account_user not in self . users : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> auth = '<STR_LIT>' % account <EOL> return HTTPUnauthorized ( request = req , <EOL> headers = { '<STR_LIT>' : auth } ) <EOL> if self . users [ account_user ] [ '<STR_LIT:key>' ] != key : <EOL> self . logger . increment ( '<STR_LIT>' ) <EOL> auth = '<STR_LIT>' <EOL> return HTTPUnauthorized ( request = req , <EOL> headers = { '<STR_LIT>' : auth } ) <EOL> account_id = self . users [ account_user ] [ '<STR_LIT:url>' ] . rsplit ( '<STR_LIT:/>' , <NUM_LIT:1> ) [ - <NUM_LIT:1> ] <EOL> memcache_client = cache_from_env ( req . environ ) <EOL> if not memcache_client : <EOL> raise Exception ( '<STR_LIT>' ) <EOL> token = None <EOL> memcache_user_key = '<STR_LIT>' % ( self . reseller_prefix , account_user ) <EOL> candidate_token = memcache_client . get ( memcache_user_key ) <EOL> if candidate_token : <EOL> memcache_token_key = '<STR_LIT>' % ( self . reseller_prefix , candidate_token ) <EOL> cached_auth_data = memcache_client . get ( memcache_token_key ) <EOL> if cached_auth_data : <EOL> expires , old_groups = cached_auth_data <EOL> old_groups = old_groups . split ( '<STR_LIT:U+002C>' ) <EOL> new_groups = self . _get_user_groups ( account , account_user , <EOL> account_id ) <EOL> if expires > time ( ) and set ( old_groups ) == set ( new_groups . split ( '<STR_LIT:U+002C>' ) ) : <EOL> token = candidate_token <EOL> if not token : <EOL> token = '<STR_LIT>' % ( self . reseller_prefix , uuid4 ( ) . hex ) <EOL> expires = time ( ) + self . token_life <EOL> groups = self . _get_user_groups ( account , account_user , account_id ) <EOL> memcache_token_key = '<STR_LIT>' % ( self . reseller_prefix , token ) <EOL> memcache_client . set ( memcache_token_key , ( expires , groups ) , <EOL> time = float ( expires - time ( ) ) ) <EOL> memcache_user_key = '<STR_LIT>' % ( self . reseller_prefix , account_user ) <EOL> memcache_client . set ( memcache_user_key , token , <EOL> time = float ( expires - time ( ) ) ) <EOL> resp = Response ( request = req , headers = { <EOL> '<STR_LIT>' : token , '<STR_LIT>' : token , <EOL> '<STR_LIT>' : str ( int ( expires - time ( ) ) ) } ) <EOL> url = self . users [ account_user ] [ '<STR_LIT:url>' ] . replace ( '<STR_LIT>' , resp . host_url ) <EOL> if self . storage_url_scheme != '<STR_LIT:default>' : <EOL> url = self . storage_url_scheme + '<STR_LIT::>' + url . split ( '<STR_LIT::>' , <NUM_LIT:1> ) [ <NUM_LIT:1> ] <EOL> resp . headers [ '<STR_LIT>' ] = url <EOL> return resp <EOL> def filter_factory ( global_conf , ** local_conf ) : <EOL> """<STR_LIT>""" <EOL> conf = global_conf . copy ( ) <EOL> conf . update ( local_conf ) <EOL> register_swift_info ( '<STR_LIT>' , account_acls = True ) <EOL> def auth_filter ( app ) : <EOL> return TempAuth ( app , conf ) <EOL> return auth_filter </s>
