Merge pull request 'Master' (#589) from master into Docker

Reviewed-on: #589

.env.sample

@@ -35,6 +35,7 @@ SCHNEIDER_AUTH_HEADER=auth
 
 # SSO
 SSO_SERVER_BASE_URL=https://login.naturschutz.rlp.de
+OAUTH_CODE_VERIFIER=CHANGE_ME
 OAUTH_CLIENT_ID=CHANGE_ME
 OAUTH_CLIENT_SECRET=CHANGE_ME
 PROPAGATION_SECRET=CHANGE_ME

Dockerfile

@@ -0,0 +1,36 @@
+# Nutze ein schlankes Python-Image
+FROM python:3.13-slim-trixie
+
+ENV PYTHONUNBUFFERED 1
+
+WORKDIR /konova
+
+# Installiere System-Abhängigkeiten
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gdal-bin redis-server nginx \
+    && rm -rf /var/lib/apt/lists/*  # Platz sparen
+
+# Erstelle benötigte Verzeichnisse & setze Berechtigungen
+RUN mkdir -p /var/log/nginx /var/log/gunicorn /var/lib/nginx /tmp/nginx_client_body \
+    && touch /var/log/nginx/access.log /var/log/nginx/error.log \
+    && chown -R root:root /var/log/nginx /var/lib/nginx /tmp/nginx_client_body
+
+# Kopiere und installiere Python-Abhängigkeiten
+COPY ./requirements.txt /konova/
+RUN pip install --upgrade pip && pip install --no-cache-dir -r requirements.txt
+
+# Entferne Standard-Nginx-Site und ersetze sie durch eigene Config
+RUN rm -rf /etc/nginx/sites-enabled/default
+COPY ./nginx.conf /etc/nginx/conf.d
+
+# Kopiere restliche Projektdateien
+COPY . /konova/
+
+# Sammle statische Dateien
+RUN python manage.py collectstatic --noinput
+
+# Exponiere Ports
+#EXPOSE 80 6379 8000
+
+# Setze Entrypoint
+ENTRYPOINT ["/konova/docker-entrypoint.sh"]

README.md

@@ -4,6 +4,7 @@ the database postgresql and the css library bootstrap as well as the icon packag
 fontawesome for a modern look, following best practices from the industry.
 
 ## Background processes
+### !!! For non-docker run
 Konova uses celery for background processing. To start the worker you need to run
 ```shell
 $ celery -A konova worker -l INFO
@@ -18,3 +19,58 @@ Technical documention is provided in the projects git wiki.
 A user documentation is not available (and not needed, yet). 
 
 
+# Docker 
+To run the docker-compose as expected, you need to take the following steps:
+
+1. Create a database containing docker, using an appropriate Dockerfile, e.g. the following
+```
+version: '3.3'
+services:
+  postgis:
+    image: postgis/postgis
+    restart: always
+    container_name: postgis-docker
+    ports: 
+      - 5433:5432
+    volumes:
+      - db-volume:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_PASSWORD=postgres
+      - POSTGRES_USER=postgres
+    networks:
+      - db-network-bridge
+
+networks:
+  db-network-bridge:
+    driver: "bridge"
+
+volumes:
+  db-volume:
+```
+This Dockerfile creates a Docker container running postgresql and postgis, creates the default superuser postgres, 
+creates a named volume for persisting the database and creates a new network bridge, which **must be used by any other
+container, which wants to write/read on this database**. 
+
+2. Make sure the name of the network bridge above matches the network in the konova docker-compose.yml  
+3. Get into the running postgis container (`docker exec -it postgis-docker bash`) and create new databases, users and so on. Make sure the database `konova` exists now!
+4. Replace all `CHANGE_ME_xy` values inside of konova/docker-compose.yml for your installation. Make sure the `SSO_HOST` holds the proper SSO host, e.g. for the arnova project `arnova.example.org` (Arnova must be installed and the webserver configured as well, of course)
+5. Take a look on konova/settings.py and konova/sub_settings/django_settings.py. Again: Replace all occurences of `CHANGE_ME` with proper values for your installation.
+   1. Make sure you have the proper host strings added to `ALLOWED_HOSTS` inside of django_settings.py.  
+6. Build and run the docker setup using `docker-compose build` and `docker-compose start` from the main directory of this project (where the docker-compose.yml lives)
+7. Run migrations! To do so, get into the konova service container (`docker exec -it konova-docker bash`) and run the needed commands (`python manage.py makemigrations LIST_OF_ALL_MIGRATABLE_APPS`, then `python manage.py migrate`)
+8. Run the setup command `python manage.py setup` and follow the instructions on the CLI
+9. To enable **SMTP** mail support, make sure your host machine (the one where the docker container run) has the postfix service configured properly. Make sure the `mynetworks` variable is xtended using the docker network bridge ip, created in the postgis container and used by the konova services.
+   1. **Hint**: You can find out this easily by trying to perform a test mail in the running konova web application (which will fail, of course). Then take a look to the latest entries in `/var/log/mail.log` on your host machine. The failed IP will be displayed there.
+   2. **Please note**: This installation guide is based on SMTP using postfix! 
+   3. Restart the postfix service on your host machine to reload the new configuration (`service postfix restart`)
+10. Finally, make sure your host machine webserver passes incoming requests properly to the docker nginx webserver of konova. A proper nginx config for the host machine may look like this:
+```
+server {
+    server_name konova.domain.org;
+
+    location / {
+        proxy_pass http://localhost:KONOVA_NGINX_DOCKER_PORT/;
+        proxy_set_header Host $host;
+    }
+}
+```

api/admin.py

@@ -39,9 +39,6 @@ class ExternalIdentifierAdmin(admin.ModelAdmin):
         "external_id",
         "internal_id",
     ]
-    readonly_fields = [
-        "created",
-    ]
 
 admin.site.register(APIUserToken, APITokenAdmin)
 admin.site.register(OAuthToken, OAuthTokenAdmin)

api/models/token.py

@@ -1,9 +1,7 @@
-import datetime
 import json
 from datetime import timedelta
 
 import requests
-from authlib.oauth2.rfc6749 import OAuth2Token
 from django.core.exceptions import ObjectDoesNotExist
 from django.db import models
 from django.utils import timezone
@@ -80,25 +78,27 @@ class OAuthToken(UuidModel):
         return str(self.access_token)
 
     @staticmethod
-    def create_from_oauth2_token(oauth2_token: OAuth2Token):
+    def from_access_token_response(access_token_data: str, received_on):
         """
         Creates an OAuthToken based on retrieved access token data (OAuth2.0 specification)
 
         Args:
-            oauth2_token (str): OAuth2.0 response data
+            access_token_data (str): OAuth2.0 response data
+            received_on (): Timestamp when the response has been received
 
         Returns:
 
         """
         oauth_token = OAuthToken()
+        data = json.loads(access_token_data)
 
-        oauth_token.access_token = oauth2_token.get("access_token")
-        oauth_token.refresh_token = oauth2_token.get("refresh_token")
-        oauth_token.expires_on = datetime.datetime.fromtimestamp(oauth2_token.get("expires_at"))
+        oauth_token.access_token = data.get("access_token")
+        oauth_token.refresh_token = data.get("refresh_token")
 
-        assert (oauth_token.access_token is not None and
-                oauth_token.refresh_token is not None and
-                oauth_token.expires_on is not None)
+        expires_on = received_on + timedelta(
+            seconds=(data.get("expires_in") + OAuthToken.ASSUMED_LATENCY)
+        )
+        oauth_token.expires_on = expires_on
 
         return oauth_token
 
@@ -155,34 +155,25 @@ class OAuthToken(UuidModel):
 
         return user
 
-    def revoke(self) -> None:
+    def revoke(self) -> int:
         """ Revokes the OAuth2 token of the user
 
         (/o/revoke_token/ indeed removes the corresponding access token on provider side and invalidates the
         submitted refresh token in one step)
 
         Returns:
-
+            revocation_status_code (int): HTTP status code for revocation of refresh_token
         """
         revoke_url = f"{SSO_SERVER_BASE}o/revoke_token/"
-        token_types = [
-            (self.refresh_token, "refresh_token"),
-            (self.access_token, "access_token"),
-        ]
-        status_codes = []
-        for entry in token_types:
-            status_codes.append(
-                requests.post(
-                    revoke_url,
-                    data={
-                        'token': entry[0],
-                        'token_type_hint': entry[1],
-                    },
-                    auth=(OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET),
-                ).status_code
-            )
-
-        assert len(status_codes) == 2
-        assert status_codes[0] == 200 and status_codes[1] == 200
+        token = self.refresh_token
+        revocation_status_code = requests.post(
+                revoke_url,
+                data={
+                    'token': token,
+                    'token_type_hint': "refresh_token",
+                },
+                auth=(OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET),
+            ).status_code
 
+        return revocation_status_code
 

docker-compose.yml

@@ -0,0 +1,21 @@
+services:
+  konova:
+    external_links:
+      - postgis:db
+      - arnova-nginx-server:arnova
+    build: .
+    image: "ksp/konova:x.y"
+    container_name: "konova-docker"
+    command: ./docker-entrypoint.sh
+    restart: always
+    volumes:
+      - /data/apps/konova/uploaded_files:/konova_uploaded_files
+    ports:
+      - "1337:80"
+
+# Instead of an own, new network, we need to connect to the existing one, which is provided by the postgis container
+# NOTE: THIS NETWORK MUST EXIST
+networks:
+  default:
+    name: postgis_nat_it_backend
+    external: true

docker-entrypoint.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e  # Beende Skript bei Fehlern
+set -o pipefail  # Fehler in Pipelines nicht ignorieren
+
+# Starte Redis
+redis-server --daemonize yes
+
+# Starte Celery Worker im Hintergrund
+celery -A konova worker --loglevel=info &
+
+# Starte Nginx als Hintergrundprozess
+nginx -g "daemon off;" &
+
+# Setze Gunicorn Worker-Anzahl (Standard: (2*CPUs)+1)
+WORKERS=${GUNICORN_WORKERS:-$((2 * $(nproc) + 1))}
+
+# Stelle sicher, dass Logs existieren
+mkdir -p /var/log/gunicorn
+touch /var/log/gunicorn/access.log /var/log/gunicorn/error.log
+
+# Starte Gunicorn als Hauptprozess
+exec gunicorn --workers="$WORKERS" konova.wsgi:application \
+    --bind=0.0.0.0:8000 \
+    --access-logfile /var/log/gunicorn/access.log \
+    --error-logfile /var/log/gunicorn/error.log \
+    --access-logformat '%({x-real-ip}i)s via %(h)s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"'

konova/sub_settings/django_settings.py

@@ -191,11 +191,10 @@ STATICFILES_DIRS = [
 ]
 
 # EMAIL (see https://docs.djangoproject.com/en/dev/topics/email/)
-
-# CHANGE_ME !!! ONLY FOR DEVELOPMENT !!!
 if DEBUG:
+    # ONLY FOR DEVELOPMENT NEEDED
     EMAIL_BACKEND = 'django.core.mail.backends.filebased.EmailBackend'
-    EMAIL_FILE_PATH = '/tmp/app-messages' # change this to a proper location
+    EMAIL_FILE_PATH = '/tmp/app-messages'
 
 DEFAULT_FROM_EMAIL = env("DEFAULT_FROM_EMAIL")  # The default email address for the 'from' element
 SERVER_EMAIL = DEFAULT_FROM_EMAIL  # The default email sender address, which is used by Django to send errors via mail

konova/sub_settings/sso_settings.py

@@ -12,6 +12,8 @@ SSO_SERVER_BASE = env("SSO_SERVER_BASE_URL")
 SSO_SERVER = f"{SSO_SERVER_BASE}sso/"
 
 # OAuth settings
+OAUTH_CODE_VERIFIER = env("OAUTH_CODE_VERIFIER")
+
 OAUTH_CLIENT_ID = env("OAUTH_CLIENT_ID")
 OAUTH_CLIENT_SECRET = env("OAUTH_CLIENT_SECRET")
 

konova/utils/generators.py

@@ -8,9 +8,6 @@ Created on: 09.11.20
 import secrets
 import string
 
-from authlib.common.security import generate_token as authlib_generate_token
-
-
 
 def generate_token(length: int = 64) -> str:
     """ Shortcut for default generating of e.g. API token
@@ -18,7 +15,11 @@ def generate_token(length: int = 64) -> str:
     Returns:
         token (str)
     """
-    return authlib_generate_token(length)
+    return generate_random_string(
+        length=length,
+        use_numbers=True,
+        use_letters_lc=True
+    )
 
 
 def generate_random_string(length: int, use_numbers: bool = False, use_letters_lc: bool = False, use_letters_uc: bool = False) -> str:

konova/utils/geometry/geometry_validator.py

@@ -180,24 +180,6 @@ class GeometryProcessor:
         is_area_valid = geom.area > 1  # > 1m² (SRID:25832)
         return is_area_valid
 
-    @staticmethod
-    def is_valid_geometry(geom: gdal.OGRGeometry) -> bool:
-        """ Checks whether the geometry is technically valid
-
-        Args:
-            geom (OGRGeometry): The geom
-
-        Returns:
-
-        """
-        try:
-            # Check geometry validity by triggering some low cost processing like centroid calculation
-            geom.centroid
-            geom.boundary
-            return True
-        except gdal.GDALException as e:
-            return False
-
 
 class GeoJsonValidator:
     """ GeoJson Validator validates geojson (e.g. from API or form input)
@@ -277,10 +259,10 @@ class GeoJsonValidator:
         """
         features = self._input_geojson.get("features", [])
 
-        is_input_geojson_empty_str = len(self._input_geojson) == 0
+        is_input_geojson_empty = len(self._input_geojson) == 0
         no_features_in_input_found = len(features) == 0
 
-        if not is_input_geojson_empty_str and no_features_in_input_found:
+        if not is_input_geojson_empty and no_features_in_input_found:
             # check if _input_geojson is a feature itself
             if self.__is_geojson_feature():
                 features = [
@@ -288,9 +270,6 @@ class GeoJsonValidator:
                         "geometry": self._input_geojson
                     }
                 ]
-            elif self.__is_geojson_featurecollection():
-                # special case if empty featurecollection received
-                pass
             else:
                 self.__add_error("Input does not seem to be geojson")
                 return
@@ -326,10 +305,6 @@ class GeoJsonValidator:
             g = gdal.OGRGeometry(feature_geom, srs=self._srs)
             if g.empty:
                 continue
-
-            if not GeometryProcessor.is_valid_geometry(g):
-                raise AssertionError(_("This feature holds malicious parts and can not be processed!"))
-
             g = GeometryProcessor.cast_to_rlp_srid(g)
             if not GeometryProcessor.is_valid_25832(g):
                 raise AssertionError(_("This feature does not hold valid EPSG:25832 coordinates:\n {}".format(g.geojson)))
@@ -374,14 +349,4 @@ class GeoJsonValidator:
         has_type = self._input_geojson.get("type", None) is not None
         has_coordinates = self._input_geojson.get("coordinates", None) is not None
         has_properties = self._input_geojson.get("properties", None) is not None
-        return has_type and has_coordinates and has_properties
-
-    def __is_geojson_featurecollection(self):
-        """ Checks whether _input_geojson is a geojson featurecollection
-
-        Returns:
-
-        """
-        is_fc_type = self._input_geojson.get("type", None) == "FeatureCollection"
-        has_feature_attribute = isinstance(self._input_geojson.get("features", None), list)
-        return is_fc_type and has_feature_attribute
+        return has_type and has_coordinates and has_properties

konova/views/logout.py

@@ -29,7 +29,6 @@ class LogoutView(View):
             oauth_token = user.oauth_token
             if oauth_token:
                 oauth_token.revoke()
-                oauth_token.delete()
         except AttributeError:
             pass
 

konova/views/map_proxy.py

@@ -11,7 +11,6 @@ from json import JSONDecodeError
 import requests
 import urllib3.util
 from django.contrib.auth.decorators import login_required
-from django.contrib.gis import geos
 from django.http import JsonResponse, HttpRequest, HttpResponse
 from django.utils.decorators import method_decorator
 from django.utils.http import urlencode
@@ -19,7 +18,7 @@ from django.views import View
 
 from requests.auth import HTTPDigestAuth
 
-from konova.sub_settings.lanis_settings import MAP_PROXY_HOST_WHITELIST, DEFAULT_SRID_RLP
+from konova.sub_settings.lanis_settings import MAP_PROXY_HOST_WHITELIST
 from konova.sub_settings.proxy_settings import PROXIES, GEOPORTAL_RLP_USER, GEOPORTAL_RLP_PASSWORD
 
 
@@ -77,83 +76,7 @@ class ClientProxyParcelSearch(BaseClientProxyView):
             raise PermissionError(f"Proxied url '{url}' is not allowed!")
 
         content, response_code = self.perform_url_call(url)
-        content = json.loads(content)
-        try:
-            content = self.__process_response_into_old_client_format(content, url)
-        except KeyError:
-            pass
-        return JsonResponse(content)
-
-    def __process_response_into_old_client_format(self, content: dict, url: str) -> dict:
-        """ Returns the response in a structure which is compatible with the old netgis mapclient.
-
-        THIS METHOD IS TEMPORARILY USED AND WILL NOT BE NEEDED ANYMORE, ONCE THE MAPCLIENT IS CAPABLE OF PROCESSING
-        THE NEW API'S STRUCTURE!
-
-        Args:
-            content (dict): The api response body
-            url (str): The called api url
-
-        Returns:
-            backwards_compatible_content (dict): The restructured content
-        """
-
-        def process_parcel_response_into_old_client_format(content: dict):
-            """ Processes parcel responses in a way that the old client can interpret them
-
-            Args:
-                content (dict): The new API response content
-
-            Returns:
-                backward_compatible_content (dict): The old client input content
-            """
-            backward_compatible_content = {
-                "count": content["count"],
-                "data": [
-                    {
-                        "fln": elem["flur"],
-                        "fsn_zae": elem["zaehler"],
-                        "fsn_nen": elem["nenner"],
-                        "fsk": elem["kennzeichen"],
-                        "flaeche": elem["flaeche"],
-                        "geometry": geos.fromstr(json.dumps(elem["geometry"])).transform(DEFAULT_SRID_RLP,
-                                                                                         clone=True).wkt,
-                    }
-                    for elem in content["results"]
-                ]
-            }
-            return backward_compatible_content
-
-        def process_gemarkung_response_into_old_client_format(content: dict):
-            """ Processes gemarkung responses in a way that the old client can interpret them
-
-            Args:
-                content (dict): The new API response content
-
-            Returns:
-                backward_compatible_content (dict): The old client input content
-            """
-            content = content["results"]
-            backward_compatible_content = {
-                "data": [{"gmk_name": element["name"], "gmk_gmn": element["id"]} for element in content]
-            }
-            return backward_compatible_content
-
-
-        backwards_compatible_handling = {
-            "flurstueck_search.php": process_parcel_response_into_old_client_format,
-            "gemarkung_search.php": process_gemarkung_response_into_old_client_format,
-        }
-
-        backwards_compatible_handling_method = None
-        for key, method in backwards_compatible_handling.items():
-            if key in url:
-                backwards_compatible_handling_method = method
-                break
-        if backwards_compatible_handling_method is not None:
-            content = backwards_compatible_handling_method(content)
-        return content
-
+        return HttpResponse(content)
 
 
 class ClientProxyParcelWFS(BaseClientProxyView):

konova/views/oauth.py

@@ -7,52 +7,33 @@ Created on: 26.04.24
 """
 import base64
 import hashlib
+from urllib.parse import urlencode
 
-from authlib.common.security import generate_token
-from authlib.integrations.base_client import OAuthError
-from authlib.integrations.django_client import OAuth
-
+import requests
 from django.contrib.auth import login
-from django.http import HttpRequest, HttpResponse
+from django.http import HttpRequest
 from django.shortcuts import redirect
 from django.urls import reverse
+from django.utils.timezone import now
 from django.views import View
 
 from api.models import OAuthToken
 from konova.sub_settings.django_settings import BASE_URL
-from konova.sub_settings.sso_settings import SSO_SERVER_BASE, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET
+from konova.sub_settings.sso_settings import SSO_SERVER_BASE, OAUTH_CODE_VERIFIER, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET
 
 
-
-_OAUTH = OAuth()
-_OAUTH.register(
-    name="sso",
-    client_id=OAUTH_CLIENT_ID,
-    client_secret=OAUTH_CLIENT_SECRET,
-    authorize_url=f"{SSO_SERVER_BASE}o/authorize/",
-    access_token_url=f"{SSO_SERVER_BASE}o/token/",
-    code_challenge_method="S256",
-    client_kwargs={},
-)
-
 class OAuthLoginView(View):
-    """ View for OAuth2 login step
+    """
+    Starts OAuth Login procedure
+        -> AnonymousUser is redirected to SSO component using specific parameters
+        -> After successful login (in SSO component), user will be redirected to a specific callback url (OAuthCallbackView)
+        -> Callback view uses retrieved authorization token to get a proper access token from SSO component
+        -> SSO component answers with access token
+        -> OAuthCallbackView uses token in Authorization header to access user data of logged-in user in SSO component
+        -> OAuthCallbackView creates/updates user
+        -> OAuthCallbackView logs in user and redirects to default home view
 
     """
-    def get(self, request: HttpRequest, *args, **kwargs):
-        redirect_uri = f'{BASE_URL}{reverse("oauth-callback")}'
-
-        # create new PKCE-Verifier
-        code_verifier, code_challenge = self.__create_code_challenge()
-
-        # keep verifier in session, so it can be read out for callback
-        request.session["oauth_code_verifier"] = code_verifier
-
-        return _OAUTH.sso.authorize_redirect(
-            request,
-            redirect_uri,
-            code_verifier=code_verifier,
-        )
 
     def __create_code_challenge(self):
         """
@@ -63,49 +44,82 @@ class OAuthLoginView(View):
         Returns:
 
         """
-        code_verifier = generate_token(128)
+        code_verifier = OAUTH_CODE_VERIFIER
 
         code_challenge = hashlib.sha256(code_verifier.encode('utf-8')).digest()
         code_challenge = base64.urlsafe_b64encode(code_challenge).decode('utf-8').replace('=', '')
         return code_verifier, code_challenge
 
+    def get(self, request: HttpRequest, *args, **kwargs):
+        """
+        Redirects user to OAuth SSO webservice for credential based login there
+
+        Args:
+            request ():
+            *args ():
+            **kwargs ():
+
+        Returns:
+
+        """
+        oauth_authentication_code_url = f"{SSO_SERVER_BASE}o/authorize/"
+        redirect_uri = f'{BASE_URL}{reverse("oauth-callback")}'
+
+        code_verifier, code_challenge = self.__create_code_challenge()
+
+        urlencode_params = urlencode(
+            {
+                "response_type": "code",
+                "code_challenge": code_challenge,
+                "code_challenge_method": "S256",
+                "client_id": OAUTH_CLIENT_ID,
+                "redirect_uri": redirect_uri,
+            }
+        )
+        url = f"{oauth_authentication_code_url}?{urlencode_params}"
+        return redirect(url)
+
+
 class OAuthCallbackView(View):
-    """ View for OAuth2 callback step
+    """
+    Callback view for OAuth2.0 authentication token.
+    Authentication tokens will be exchanged for access token.
+    Access Token will be used for fetching user data from SSO component.
+    User data will be used for creating/updating user data inside this app.
+    User will be logged-in and redirected to default home view.
 
     """
+
     def get(self, request: HttpRequest, *args, **kwargs):
-        # Get code verifier (created on oatuh-login step) from session
-        code_verifier = request.session.pop(
-            "oauth_code_verifier",
-            None,
+        authentication_code = request.GET.get("code")
+        oauth_acces_token_url = f"{SSO_SERVER_BASE}o/token/"
+
+        callback_url = f'{BASE_URL}{reverse("oauth-callback")}'
+
+        params = {
+            "grant_type": "authorization_code",
+            "code": authentication_code,
+            "redirect_uri": callback_url,
+            "code_verifier": OAUTH_CODE_VERIFIER,
+            "client_id": OAUTH_CLIENT_ID,
+            "client_secret": OAUTH_CLIENT_SECRET
+        }
+        access_code_response = requests.post(
+            oauth_acces_token_url,
+            data=params
         )
-        if not code_verifier:
-            return HttpResponse(
-                "PKCE code_verifier missing or is invalid.",
-                status=400,
-            )
+        received_on = now()
 
-        try:
-            token = _OAUTH.sso.authorize_access_token(
-                request
-            )
-        except OAuthError as e:
-            print(e)
-            return HttpResponse(
-                "OAuth-Login failed while authorizing with OAuth.",
-                status=400,
-            )
-        try:
-            oauth_token = OAuthToken.create_from_oauth2_token(token)
-        except AssertionError:
-            return HttpResponse(
-                "OAuth-Login failed due to unexpected token content.",
-                status=400,
-            )
+        access_code_response_body = access_code_response.content.decode("utf-8")
+        status_code_invalid = access_code_response.status_code != 200
+        if status_code_invalid:
+            raise RuntimeError(f"OAuth access token could not be fetched: {access_code_response.text}")
 
+        oauth_token = OAuthToken.from_access_token_response(access_code_response_body, received_on)
         oauth_token.save()
         user = oauth_token.update_and_get_user()
         user.oauth_replace_token(oauth_token)
 
         login(request, user)
         return redirect("home")
+

locale/de/LC_MESSAGES/django.po

@@ -45,7 +45,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PACKAGE VERSION\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2026-09-17 16:25+0200\n"
+"POT-Creation-Date: 2026-09-13 12:06+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -2012,11 +2012,7 @@ msgstr "In Zwischenablage kopiert"
 msgid "Search"
 msgstr "Suchen"
 
-#: konova/utils/geometry/geometry_validator.py:328
-msgid "This feature holds malicious parts and can not be processed!"
-msgstr "Teile der Geometrie sind ungültig und können nicht verarbeitet werden!"
-
-#: konova/utils/geometry/geometry_validator.py:332
+#: konova/utils/geometry/geometry_validator.py:311
 msgid ""
 "This feature does not hold valid EPSG:25832 coordinates:\n"
 " {}"
@@ -2024,7 +2020,7 @@ msgstr ""
 "Dieses Feature enthält keine validen EPSG:25832 Koordinaten:\n"
 " {}"
 
-#: konova/utils/geometry/geometry_validator.py:340
+#: konova/utils/geometry/geometry_validator.py:319
 msgid "Only surfaces allowed. Points or lines must be buffered."
 msgstr ""
 "Nur Flächen erlaubt. Punkte oder Linien müssen zu Flächen gepuffert werden."

nginx.conf

@@ -0,0 +1,25 @@
+server {
+    listen 80;
+    client_max_body_size 25M;
+
+    location / {
+        proxy_pass http://127.0.0.1:8000;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Host $host;
+        proxy_redirect off;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    location /static/ {
+        alias /konova/static/;
+        access_log /var/log/nginx/access.log;
+        autoindex off;
+        types {
+            text/css css;
+            application/javascript js;
+        }
+    }
+
+    error_log /var/log/nginx/error.log;
+}

requirements.txt

@@ -1,7 +1,6 @@
 amqp==5.3.1
 asgiref==3.12.1
 async-timeout==5.0.1
-Authlib==1.8.0
 beautifulsoup4==4.15.0
 billiard==4.2.4
 cached-property==2.0.1
@@ -31,7 +30,6 @@ gunicorn==26.2.0
 idna==3.19
 importlib_metadata==9.0.1
 itsdangerous==2.2.0
-joserfc==1.7.5
 jwcrypto==1.6.0
 kombu==5.6.2
 oauthlib==3.3.1

templates/map/client/config.json

@@ -62,33 +62,33 @@
 		{ "id": "dtk_farbe", "folder": "bg", "type": "WMS", "order": -1, "title": "DTK5 farbig", "attribution": "LVermGeo", "url": "https://geo4.service24.rlp.de/wms/dtk5_rp.fcgi?", "name": "rp_dtk5", "active": false },
 		{ "id": "dtk_grau", "folder": "bg", "type": "WMS", "order": -1, "title": "DTK5 grau", "attribution": "LVermGeo", "url": "https://geo4.service24.rlp.de/wms/dtk5_rp.fcgi?", "name": "rp_dtk5_grau", "active": false },
 
-		{ "id": "kom", "folder": "kom", "type": "WMS", "title": "KOM", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=kom_recorded&", "name": "kom_recorded" },
-		{ "id": "kom_rec", "folder": "kom", "type": "WMS", "title": "KOM - In Bearbeitung", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=kom_unrecorded&", "name": "kom_unrecorded" },
-		{ "id": "kom_rec_unfinished", "folder": "kom", "type": "WMS", "title": "KOM - Unvollständige Altfälle", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=kom_unrecorded_old_entries&", "name": "kom_unrecorded_old_entries" },
+		{ "id": "kom", "folder": "kom", "type": "WMS", "title": "KOM", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=kom_recorded&", "name": "kom_recorded" },
+		{ "id": "kom_rec", "folder": "kom", "type": "WMS", "title": "KOM - In Bearbeitung", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=kom_unrecorded&", "name": "kom_unrecorded" },
+		{ "id": "kom_rec_unfinished", "folder": "kom", "type": "WMS", "title": "KOM - Unvollständige Altfälle", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=kom_unrecorded_old_entries&", "name": "kom_unrecorded_old_entries" },
 
-		{ "id": "eiv", "folder": "eiv", "type": "WMS", "title": "EIV", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=eiv_recorded&", "name": "eiv_recorded" },
-		{ "id": "eiv_rec", "folder": "eiv", "type": "WMS", "title": "EIV - In Bearbeitung", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=eiv_unrecorded&", "name": "eiv_unrecorded" },
-		{ "id": "eiv_rec_unfinished", "folder": "eiv", "type": "WMS", "title": "EIV - Unvollständige Altfälle", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=eiv_unrecorded_old_entries&", "name": "eiv_unrecorded_old_entries" },
+		{ "id": "eiv", "folder": "eiv", "type": "WMS", "title": "EIV", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=eiv_recorded&", "name": "eiv_recorded" },
+		{ "id": "eiv_rec", "folder": "eiv", "type": "WMS", "title": "EIV - In Bearbeitung", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=eiv_unrecorded&", "name": "eiv_unrecorded" },
+		{ "id": "eiv_rec_unfinished", "folder": "eiv", "type": "WMS", "title": "EIV - Unvollständige Altfälle", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=eiv_unrecorded_old_entries&", "name": "eiv_unrecorded_old_entries" },
 
-		{ "id": "oek", "folder": "oek", "type": "WMS", "title": "OEK", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=oek_recorded&", "name": "oek_recorded" },
-		{ "id": "oek_rec", "folder": "oek", "type": "WMS", "title": "OEK - In Bearbeitung", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=oek_unrecorded&", "name": "oek_unrecorded" },
+		{ "id": "oek", "folder": "oek", "type": "WMS", "title": "OEK", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=oek_recorded&", "name": "oek_recorded" },
+		{ "id": "oek_rec", "folder": "oek", "type": "WMS", "title": "OEK - In Bearbeitung", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=oek_unrecorded&", "name": "oek_unrecorded" },
 
-		{ "id": "ema", "folder": "ema", "type": "WMS", "title": "EMA", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=ema_recorded&", "name": "ema_recorded" },
-		{ "id": "ema_rec", "folder": "ema", "type": "WMS", "title": "EMA - In Bearbeitung", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=ema_unrecorded&", "name": "ema_unrecorded" },
+		{ "id": "ema", "folder": "ema", "type": "WMS", "title": "EMA", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=ema_recorded&", "name": "ema_recorded" },
+		{ "id": "ema_rec", "folder": "ema", "type": "WMS", "title": "EMA - In Bearbeitung", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=ema_unrecorded&", "name": "ema_unrecorded" },
 
-		{ "id": "mae", "folder": "mae", "type": "WMS", "title": "MAE", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=mae&", "name": "mae" },
+		{ "id": "mae", "folder": "mae", "type": "WMS", "title": "MAE", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=mae&", "name": "mae" },
 
-		{ "id": "nsg", "folder": "schutzgebiet", "type": "WMS", "title": "Naturschutzgebiete", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=naturschutzgebiet&", "name": "naturschutzgebiet" },
-		{ "id": "npz", "folder": "schutzgebiet", "type": "WMS", "title": "Naturparkzonen", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=naturparkzone&", "name": "naturparkzone" },
-		{ "id": "lsg", "folder": "schutzgebiet", "type": "WMS", "title": "Landschaftsschutzgebiete", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=landschaftsschutzgebiet&", "name": "landschaftsschutzgebiet" },
-		{ "id": "vsg", "folder": "schutzgebiet", "type": "WMS", "title": "Vogelschutzgebiete", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=vogelschutzgebiet&", "name": "vogelschutzgebiet" },
-		{ "id": "ffh", "folder": "schutzgebiet", "type": "WMS", "title": "FFH Gebiete", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=ffhgebiet&", "name": "ffhgebiet" },
+		{ "id": "nsg", "folder": "schutzgebiet", "type": "WMS", "title": "Naturschutzgebiete", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=naturschutzgebiet&", "name": "naturschutzgebiet" },
+		{ "id": "npz", "folder": "schutzgebiet", "type": "WMS", "title": "Naturparkzonen", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=naturparkzonen&", "name": "naturparkzonen" },
+		{ "id": "lsg", "folder": "schutzgebiet", "type": "WMS", "title": "Landschaftsschutzgebiete", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=landschaftsschutzgebiet&", "name": "landschaftsschutzgebiet" },
+		{ "id": "vsg", "folder": "schutzgebiet", "type": "WMS", "title": "Vogelschutzgebiete", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=vogelschutzgebiet&", "name": "vogelschutzgebiet" },
+		{ "id": "ffh", "folder": "schutzgebiet", "type": "WMS", "title": "FFH Gebiete", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=ffh&", "name": "ffh" },
 
-		{"id": "ntpz", "folder": "nationalpark", "type": "WMS", "title": "Nationalpark Zonen", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=nationalparkzonen&", "name": "nationalparkzonen" },
-		{"id": "ntpg", "folder": "nationalpark", "type": "WMS", "title": "Nationalpark Grenzen", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/2d/mapserver/map.php?layers=nationalpark&", "name": "nationalpark" },
+		{"id": "ntpz", "folder": "nationalpark", "type": "WMS", "title": "Nationalpark Zonen", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=nationalpark_zonen&", "name": "nationalpark_zonen" },
+		{"id": "ntpg", "folder": "nationalpark", "type": "WMS", "title": "Nationalpark Grenzen", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=nationalpark_grenze&", "name": "nationalpark_grenze" },
 
-		{ "id": "natraum_g", "folder": "naturraum", "type": "WMS", "title": "Naturräume Grenzen", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/apps/service/wms_getmap.php?mapfile=natraum_lkompvo_grenzen&", "name": "natraum_lkompvo_grenzen" },
-		{ "id": "natraum_f", "folder": "naturraum", "type": "WMS", "title": "Naturräume Flächen", "url": "https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/apps/service/wms_getmap.php?mapfile=natraum_lkompvo&", "name": "natraum_lkompvo" },
+		{ "id": "natraum_g", "folder": "naturraum", "type": "WMS", "title": "Naturräume Grenzen", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=natraum_lkompvo_grenzen&", "name": "natraum_lkompvo_grenzen" },
+		{ "id": "natraum_f", "folder": "naturraum", "type": "WMS", "title": "Naturräume Flächen", "url": "https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_ogc/wms_getmap.php?mapfile=natraum_lkompvo&", "name": "natraum_lkompvo" },
 
 		{ "id": "lagebezeichnung", "folder": "alkis", "type": "WMS", "title": "Lagebezeichnungen", "url": "https://geo5.service24.rlp.de/wms/liegenschaften_rp.fcgi?", "name": "Lagebezeichnungen" },
 		{ "id": "flurstueck_wms", "folder": "alkis", "type": "WMS", "title": "Flurstücke (WMS)", "url": "https://geo5.service24.rlp.de/wms/liegenschaften_rp.fcgi?", "name": "Flurstueck", "active":  true},
@@ -129,8 +129,8 @@
 	"searchparcel":
 	{
 		"open": false,
-		"name_url": "/client/proxy?https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/module/flurstuecksuche/api/gemarkung_search.php?q={q}",
-		"parcel_url": "/client/proxy?https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/module/flurstuecksuche/api/flurstueck_search.php?gemarkung={district}&flur={field}&zaehler={parcelA}&nenner={parcelB}&export=json",
+		"name_url": "/client/proxy?https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_alkis/gem_search.php?placename={q}",
+		"parcel_url": "/client/proxy?https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_alkis/flur_search.php?gmk_gmn={district}&fln={field}&fsn_zae={parcelA}&fsn_nen={parcelB}&export=json",
 		"districts_service":
 		{
 			"type": "WFS",

templates/map/client/dist/netgis.min.js

@@ -400,7 +400,7 @@ netgis.Search.prototype.clearResults=function(){this.results.innerHTML="";this.m
 netgis.Search.prototype.showClearButton=function(a){!1===a?(this.button.classList.remove("netgis-hide"),this.closer.classList.add("netgis-hide")):(this.button.classList.add("netgis-hide"),this.closer.classList.remove("netgis-hide"))};netgis.Search.prototype.onInputKeyDown=function(a){if(13===a.keyCode)return a.preventDefault(),!1};
 netgis.Search.prototype.onInputKeyUp=function(a){switch(a.keyCode){case 13:if(this.autocomplete)a=this.results.getElementsByTagName("button"),0<a.length&&a[0].click();else this.onInputTimeout();break;case 27:this.clearAll();break;default:if(this.autocomplete)this.onInputChange()}};netgis.Search.prototype.onInputChange=function(a){this.timeout&&window.clearTimeout(this.timeout);this.timeout=window.setTimeout(this.onInputTimeout.bind(this),this.debounce)};
 netgis.Search.prototype.onInputTimeout=function(){var a=this.input.value;a=a.trim();0<a.length?this.requestSearch(a):this.clearAll()};netgis.Search.prototype.onButtonClick=function(a){this.input.focus()};netgis.Search.prototype.onCloserClick=function(a){this.clearAll();this.input.focus()};netgis.Search.prototype.onResultClick=function(a){a=a.currentTarget;var b=a.getAttribute("data-result");netgis.util.invoke(a,netgis.Events.SEARCH_SELECT,{item:a,data:b})};netgis=netgis||{};netgis.SearchParcel=function(a){this.config=a;this.districtsLayerID="searchparcel_districts";this.fieldsLayerID="searchparcel_fields";this.parcelsLayerID="searchparcel_parcels";this.selected={};this.initElements();this.initEvents();this.initConfig(a)};
-netgis.SearchParcel.Config={open:!1,name_url:"./proxy.php?https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/module/flurstuecksuche/api/gemarkung_search.php?q={q}",parcel_url:"./proxy.php?https://geoportal.naturschutz.rlp.de/kartendienst_naturschutz/module/flurstuecksuche/api/flurstueck_search.php?gemarkung={district}&flur={field}&zaehler={parcelA}&nenner={parcelB}&export=json",districts_service:{type:"WFS",url:"http://geo5.service24.rlp.de/wfs/verwaltungsgrenzen_rp.fcgi?",name:"vermkv:gemarkungen_rlp",format:"application/json; subtype=geojson",
+netgis.SearchParcel.Config={open:!1,name_url:"./proxy.php?https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_alkis/gem_search.php?placename={q}",parcel_url:"./proxy.php?https://geodaten.naturschutz.rlp.de/kartendienste_naturschutz/mod_alkis/flur_search.php?gmk_gmn={district}&fln={field}&fsn_zae={parcelA}&fsn_nen={parcelB}&export=json",districts_service:{type:"WFS",url:"http://geo5.service24.rlp.de/wfs/verwaltungsgrenzen_rp.fcgi?",name:"vermkv:gemarkungen_rlp",format:"application/json; subtype=geojson",
 min_zoom:12},fields_service:{url:"http://geo5.service24.rlp.de/wfs/verwaltungsgrenzen_rp.fcgi?",name:"vermkv:fluren_rlp",filter_property:"gmkgnr"}};
 netgis.SearchParcel.prototype.initElements=function(){this.panel=new netgis.Panel("Flurst\u00fccks-Suche");this.panel.container.style.minWidth="92mm";this.panel.container.addEventListener(netgis.Events.PANEL_TOGGLE,this.onPanelToggle.bind(this));this.container=document.createElement("section");this.container.className="netgis-search-parcel";this.panel.content.appendChild(this.container);this.popup=new netgis.Popup;this.popup.setHeader("Flurst\u00fcck");var a=document.createElement("section");this.top=
 a;this.container.appendChild(a);var b=this.createInput("Gemarkungsname:");b.style.position="relative";a.appendChild(b);this.nameInput=b.children[0];this.nameInput.setAttribute("title","ENTER: Ausw\u00e4hlen, ESCAPE: Zur\u00fccksetzen");this.nameInput.addEventListener("keyup",this.onInputNameKey.bind(this));this.nameLoader=document.createElement("div");this.nameLoader.className="netgis-loader netgis-text-primary netgis-hide";this.nameLoader.innerHTML="<i class='fas fa-spinner'></i>";b.appendChild(this.nameLoader);