Add Microsoft Entra ID authentication with OAuth2

pdf_renamer.py

@@ -1,16 +1,41 @@
 import os
 import tempfile
 import zipfile
-from flask import Flask, request, render_template_string, send_from_directory
+from functools import wraps
+from flask import Flask, request, render_template_string, send_from_directory, redirect, url_for, session
 from werkzeug.utils import secure_filename
 from PyPDF2 import PdfReader
+from authlib.integrations.flask_client import OAuth
 
 app = Flask(__name__)
 app.config['UPLOAD_FOLDER'] = tempfile.mkdtemp()
 app.config['MAX_CONTENT_LENGTH'] = 100 * 1024 * 1024  # 100MB limit
+app.secret_key = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')
+
+# Entra ID Configuration
+TENANT_ID = os.getenv('TENANT_ID', 'your-tenant-id')
+CLIENT_ID = os.getenv('CLIENT_ID', 'your-client-id')
+CLIENT_SECRET = os.getenv('CLIENT_SECRET', 'your-client-secret')
+
+oauth = OAuth(app)
+microsoft = oauth.register(
+    name='microsoft',
+    client_id=CLIENT_ID,
+    client_secret=CLIENT_SECRET,
+    server_metadata_url=f'https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid_configuration',
+    client_kwargs={'scope': 'openid profile email'}
+)
 
 ALLOWED_EXTENSIONS = {'pdf', 'zip'}
 
+def login_required(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        if 'user' not in session:
+            return redirect(url_for('login'))
+        return f(*args, **kwargs)
+    return decorated_function
+
 def allowed_file(filename):
     return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
 
@@ -27,7 +52,26 @@ def extract_names_from_pdf(pdf_path):
     except Exception as e:
         return None
 
+@app.route('/login')
+def login():
+    redirect_uri = url_for('auth', _external=True)
+    return microsoft.authorize_redirect(redirect_uri)
+
+@app.route('/auth')
+def auth():
+    token = microsoft.authorize_access_token()
+    user = microsoft.parse_id_token(token)
+    session['user'] = user
+    return redirect(url_for('upload_files'))
+
+@app.route('/logout')
+@login_required
+def logout():
+    session.pop('user', None)
+    return redirect(url_for('login'))
+
 @app.route('/', methods=['GET', 'POST'])
+@login_required
 def upload_files():
     if request.method == 'POST':
         files = request.files.getlist('files')
@@ -104,9 +148,12 @@ def upload_files():
                 a:hover { background-color: #0056b3; }
                 ul { list-style-type: none; padding: 0; }
                 li { background-color: #fff; margin: 5px 0; padding: 10px; border-radius: 5px; box-shadow: 0 0 5px rgba(0,0,0,0.1); }
+                .logout { position: absolute; top: 20px; right: 20px; background-color: #dc3545; }
+                .logout:hover { background-color: #c82333; }
             </style>
         </head>
         <body>
+            <a href="/logout" class="logout">Logout</a>
             <img src="/static/trbc-logo-full.png" alt="Logo" width="200">
             <h1>Processing Results</h1>
             {% if zip_name %}
@@ -135,9 +182,12 @@ def upload_files():
             input[type="file"] { margin: 10px 0; }
             input[type="submit"] { background-color: #28a745; color: white; border: none; padding: 10px 20px; border-radius: 5px; cursor: pointer; }
             input[type="submit"]:hover { background-color: #218838; }
+            .logout { position: absolute; top: 20px; right: 20px; background-color: #dc3545; color: white; text-decoration: none; padding: 10px 20px; border-radius: 5px; }
+            .logout:hover { background-color: #c82333; }
         </style>
     </head>
     <body>
+        <a href="/logout" class="logout">Logout</a>
         <img src="/static/trbc-logo-full.png" alt="Logo" width="200">
         <h1>Upload PDF Files or ZIP to Rename</h1>
         <form method="post" enctype="multipart/form-data">
@@ -150,6 +200,7 @@ def upload_files():
     ''')
 
 @app.route('/download/<filename>')
+@login_required
 def download_file(filename):
     return send_from_directory(app.config['UPLOAD_FOLDER'], filename, as_attachment=True)