Index: AuthTokenGenerator.py
===================================================================
--- AuthTokenGenerator.py	(revision 9)
+++ AuthTokenGenerator.py	(revision 0)
@@ -2,11 +2,8 @@
 from Products.PageTemplates.PageTemplateFile import PageTemplateFile
 from OFS.PropertyManager import PropertyManager
-from AccessControl import getSecurityManager
-from zExceptions import Unauthorized
-from Acquisition import aq_chain
 
-import logging
 import datetime
-import jwt
+import hashlib
+import json
 
 
@@ -28,5 +25,5 @@
     
     meta_type = 'AuthTokenGenerator'
-    _properties = ({'id':'consumer_key', 'type': 'string', 'mode': 'w'},
+    _properties=({'id':'consumer_key', 'type': 'string', 'mode': 'w'},
                  {'id':'consumer_secret', 'type': 'string', 'mode': 'w'},
                 )
@@ -35,19 +32,17 @@
 
     # Only change this if you're sure you know what you're doing
-    tokenTtl = 86400
+    consumerTtl = 86400
 
     def __init__(self, id, consumerKey=None, consumerSecret=None):
         """init document viewer"""
-        self.id = id
+        self.id=id
         self.consumer_key = consumerKey
         self.consumer_secret = consumerSecret
 
-    def index_html(self, user='anonymous'):
-        """returns authentication token for user (Zope style)"""
-        zUser = self._allowed_user(user=user)
-        logging.debug("allowed user: %s"%repr(zUser))
-        if zUser:
-            token = self._generate_token(zUser)
-            # set CORS headers
+    def index_html(self, user='anonymous', password=None):
+        """returns authentication token for user"""
+        if self._token_allowed():
+            token = self._generate_token(user)
+            self.REQUEST.RESPONSE.setHeader("Content-Type", "application/json")
             origin = self.REQUEST.getHeader("Origin", None)
             if origin is not None:
@@ -57,82 +52,25 @@
 
             self.REQUEST.RESPONSE.setHeader("Access-Control-Allow-Credentials", "true")
-            logging.debug("token for user %s: %s"%(user, token))
-            self.REQUEST.RESPONSE.setHeader("Content-Type", "text/plain")
-            return token
+            json.dump(token, self.REQUEST.RESPONSE)
         else:
-            raise Unauthorized
+            self.REQUEST.RESPONSE.setStatus('Forbidden')
+            return "SORRY, NOT ALLOWED!" 
 
-    def getLoginToken(self, user='anonymous', password=None):
-        """returns authentication token or error code"""
-        # set CORS headers
-        origin = self.REQUEST.getHeader("Origin", None)
-        if origin is not None:
-            self.REQUEST.RESPONSE.setHeader("Access-Control-Allow-Origin", origin)
-        else:
-            self.REQUEST.RESPONSE.setHeader("Access-Control-Allow-Origin", "*")
+    def _token_allowed(self, user=None, password=None):
+        # here we should check the login
+        return True
 
-        self.REQUEST.RESPONSE.setHeader("Access-Control-Allow-Credentials", "true")
-        zUser = self._allowed_user(user=user, password=password)
-        logging.debug("allowed user: %s"%repr(zUser))
-        if zUser:
-            token = self._generate_token(zUser)
-            logging.debug("token for user %s: %s"%(user, token))
-            self.REQUEST.RESPONSE.setHeader("Content-Type", "text/plain")
-            return token
-        else:
-            self.REQUEST.RESPONSE.setStatus('Unauthorized')
-            return "Please Authenticate!"
-
-    def _allowed_user(self, user=None, password=None):
-        # check the login
-        if user == 'anonymous':
-            # everybody can be anonymous
-            return user
-        
-        # get logged in user from Zope
-        authuser = getSecurityManager().getUser()
-        authname = authuser.getUserName()
-        if authname == user:
-            # user is logged in
-            return authuser
-        
-        if password:
-            logging.debug("trying password for token for user %s"%user)
-            # try all user folders in aq_chain
-            authuser = None
-            userfolder = None
-            for ctx in aq_chain(self):
-                new_uf = getattr(ctx, 'acl_users', None)
-                if new_uf != userfolder:
-                    userfolder = new_uf
-                    authuser = userfolder.authenticate(user, password, None)
-                    if authuser is not None:
-                        return authuser
-            
-        return None
-
-    def _generate_token(self, user):
+    def _generate_token(self, user_id):
         #return JSON-token
-        issue_time = datetime.datetime.now(UTC).replace(microsecond=0)
-        if isinstance(user, basestring):
-            # not a real User object
-            user_id = user
-        else:
-            user_id = user.getUserName()
-            
-        payload = {
-            'consumerKey':self.consumer_key, 
-            'userId':user_id, 
-            'issuedAt':issue_time.isoformat(), 
-            'ttl':self.tokenTtl}
-        
-        if hasattr(user, '_getLDAPGroups'):
-            # add groups from LDAP
-            groups = user._getLDAPGroups()
-            payload['memberOf'] = groups
-            
-        logging.debug("token payload=%s"%repr(payload))
-        return jwt.encode(payload, self.consumer_secret)
-        
+        issue_time = datetime.datetime.now(UTC).isoformat()
+        token = hashlib.sha256(self.consumer_secret + user_id + issue_time).hexdigest()
+    
+        return dict(
+            consumerKey=self.consumer_key,
+            authToken=token,
+            authTokenIssueTime=issue_time,
+            authTokenTTL=self.consumerTtl,
+            userId=user_id
+        )
 
 def manage_addAuthTokenGeneratorForm(self):
