feat(oauth): add branded oath consent page template

cl/assets/templates/oauth2_provider/authorize.html

@@ -0,0 +1,81 @@
+{% extends "base.html" %}
+
+{% block title %}{% if error %}Authorization error{% else %}Authorize {{ application.name }}{% endif %} – CourtListener.com{% endblock %}
+
+{% block privacy %}
+  <meta name="robots" content="noindex, noodp, noarchive, noimageindex"/>
+{% endblock %}
+
+{% block footer-scripts %}{% endblock %}
+{% block sidebar %}{% endblock %}
+
+{% block content %}
+  <div class="col-xs-1 col-sm-2 col-md-3"></div>
+  <div class="col-xs-10 col-sm-8 col-md-6 well">
+    {% if not error %}
+      <h2>Authorize <em>{{ application.name }}</em>?</h2>
+      <p class="gray">
+        Signed in as <strong>{{ request.user.username }}</strong>.
+      </p>
+
+      <p class="lead v-offset-above-2">
+        The application <strong>{{ application.name }}</strong> is
+        requesting access to your CourtListener account. If you
+        approve, it will be able to:
+      </p>
+
+      <ul>
+        {% for scope in scopes_descriptions %}
+          <li>{{ scope }}</li>
+        {% endfor %}
+      </ul>
+
+      {% if form.redirect_uri.value %}
+        <p>
+          After you decide, you will be redirected to:
+          <br>
+          <code>{{ form.redirect_uri.value }}</code>
+        </p>
+      {% endif %}
+
+      <div class="alert alert-warning v-offset-above-2" role="alert">
+        <i class="fa fa-exclamation-triangle"></i>
+        Only authorize applications you trust. They will be able to
+        act on your behalf within the permissions listed above until
+        you <a href="{% url "view_oauth_authorizations" %}">revoke access</a>.
+      </div>
+
+      {% if form.errors %}
+        <div class="alert alert-danger">
+          {{ form.errors }}
+          {{ form.non_field_errors }}
+        </div>
+      {% endif %}
+
+      <form method="post" id="authorizationForm">{% csrf_token %}
+        {% for field in form %}
+          {% if field.is_hidden %}{{ field }}{% endif %}
+        {% endfor %}
+        <div class="text-right v-offset-above-2">
+          <button type="submit" class="btn btn-default btn-lg">Cancel</button>
+          <button type="submit" name="allow" value="Authorize" class="btn btn-primary btn-lg">Allow access</button>
+        </div>
+      </form>
+    {% else %}
+      <h2>Something went wrong</h2>
+      <p class="lead">We couldn’t complete this authorization request.</p>
+      <p>
+        <strong>Error:</strong> {{ error.error }}
+        {% if error.description %}
+          <br><strong>Details:</strong> {{ error.description }}
+        {% endif %}
+      </p>
+      <p>
+        Try returning to the application that sent you here and
+        starting over. If the problem continues, please
+        <a href="{% url "contact" %}">contact us</a>.
+      </p>
+    {% endif %}
+  </div>
+  <div class="col-xs-1 col-sm-2 col-md-3"></div>
+{% endblock %}

cl/users/templates/includes/developer-tabs.html

@@ -17,5 +17,9 @@
       <a href="{% url "view_webhooks" %}">
         <i class="fa fa-plug"></i>&nbsp;Webhooks</a>
     </li>
+    <li class="{% if page == "api_oauth" %} active {% endif %} medium">
+      <a href="{% url "view_oauth_authorizations" %}">
+        <i class="fa fa-shield"></i>&nbsp;Authorized Apps</a>
+    </li>
   </ul>
 </div>

cl/users/templates/profile/oauth_authorizations.html

@@ -0,0 +1,83 @@
+{% extends "profile/nav.html" %}
+{% load humanize %}
+
+{% block title %}{{ page_title }} – CourtListener.com{% endblock %}
+
+{% block nav-api %}active{% endblock %}
+
+{% block content %}
+  {# Navigation Tabs #}
+  {% include "includes/developer-tabs.html" %}
+
+  <div class="hidden-xs col-sm-1 col-md-2"></div>
+  <div class="col-xs-12 col-sm-10 col-md-8 text-center">
+    <h1>Authorized Apps</h1>
+    <p class="gray">
+      Apps you have granted access to your CourtListener account.
+    </p>
+
+    {% if messages %}
+      {% for message in messages %}
+        <p class="alert alert-success">{{ message|escape }}</p>
+      {% endfor %}
+    {% endif %}
+
+    {% if authorizations %}
+      <div class="table-responsive v-offset-above-2">
+        <table class="table settings-table">
+          <thead>
+            <tr class="active">
+              <th class="text-left">Application</th>
+              <th class="text-left">Permissions</th>
+              <th class="text-left">First&nbsp;granted</th>
+              <th class="text-left">Last&nbsp;used</th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            {% for auth in authorizations %}
+              <tr>
+                <td class="text-left">
+                  <strong>{{ auth.application.name }}</strong>
+                </td>
+                <td class="text-left">
+                  <ul class="list-unstyled bottom">
+                    {% for scope in auth.scopes %}
+                      <li>{{ scope }}</li>
+                    {% endfor %}
+                  </ul>
+                </td>
+                <td class="text-left">
+                  {{ auth.first_granted|naturaltime }}
+                </td>
+                <td class="text-left">
+                  {{ auth.last_used|naturaltime }}
+                </td>
+                <td>
+                  <form method="post" class="bottom">
+                    {% csrf_token %}
+                    <input type="hidden" name="application_id"
+                           value="{{ auth.application.id }}">
+                    <button type="submit" class="btn btn-danger btn-sm">
+                      <i class="fa fa-trash"></i>&nbsp;Revoke
+                    </button>
+                  </form>
+                </td>
+              </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+    {% else %}
+      <p class="v-offset-above-2">
+        You haven&rsquo;t authorized any apps yet.
+      </p>
+      <p class="gray">
+        When you grant a third-party application access to your account
+        through the OAuth flow, it will appear here so you can review
+        or revoke its access at any time.
+      </p>
+    {% endif %}
+  </div>
+  <div class="hidden-xs col-sm-1 col-md-2"></div>
+{% endblock %}

cl/users/urls.py

@@ -120,6 +120,11 @@
     path("profile/api-token/", views.view_api_token, name="view_api_token"),
     path("profile/api-usage/", views.view_api_usage, name="view_api_usage"),
     path("profile/webhooks/", views.view_webhooks, name="view_webhooks"),
+    path(
+        "profile/oauth-apps/",
+        views.view_oauth_authorizations,
+        name="view_oauth_authorizations",
+    ),
     path("profile/your-support/", view_donations, name="profile_your_support"),
     re_path(
         "profile/webhooks/(logs|test-logs)/",

cl/users/views.py

@@ -33,6 +33,10 @@
     sensitive_variables,
 )
 from django.views.decorators.http import require_http_methods
+from oauth2_provider.models import (
+    get_access_token_model,
+    get_refresh_token_model,
+)
 from rest_framework.renderers import JSONRenderer
 from waffle import switch_is_active
 
@@ -786,6 +790,73 @@ def view_webhooks(request: AuthenticatedHttpRequest) -> HttpResponse:
     )
 
 
+@login_required
+@never_cache
+@require_http_methods(["GET", "POST"])
+def view_oauth_authorizations(
+    request: AuthenticatedHttpRequest,
+) -> HttpResponse:
+    """List the OAuth applications the user has granted access to."""
+    AccessToken = get_access_token_model()
+    RefreshToken = get_refresh_token_model()
+
+    if request.method == "POST":
+        app_id = request.POST.get("application_id")
+        if app_id:
+            AccessToken.objects.filter(
+                user=request.user, application_id=app_id
+            ).delete()
+            RefreshToken.objects.filter(
+                user=request.user, application_id=app_id
+            ).delete()
+            messages.success(request, "Access revoked.")
+        return HttpResponseRedirect(reverse("view_oauth_authorizations"))
+
+    scopes_settings = settings.OAUTH2_PROVIDER.get("SCOPES", {})
+    tokens = (
+        AccessToken.objects.filter(
+            user=request.user, application__isnull=False
+        )
+        .select_related("application")
+        .order_by("-updated")
+    )
+    by_app: dict[int, dict] = {}
+    for tok in tokens:
+        entry = by_app.setdefault(
+            tok.application_id,
+            {
+                "application": tok.application,
+                "first_granted": tok.created,
+                "last_used": tok.updated,
+                "scope_names": set(),
+            },
+        )
+        entry["first_granted"] = min(entry["first_granted"], tok.created)
+        entry["last_used"] = max(entry["last_used"], tok.updated)
+        entry["scope_names"].update(tok.scope.split())
+
+    # One row per Application, aggregated across any access/refresh
+    # tokens the user holds for that application.
+    authorizations = []
+    for entry in by_app.values():
+        entry["scopes"] = [
+            scopes_settings.get(s, s) for s in sorted(entry["scope_names"])
+        ]
+        authorizations.append(entry)
+    authorizations.sort(key=lambda e: e["last_used"], reverse=True)
+
+    return TemplateResponse(
+        request,
+        "profile/oauth_authorizations.html",
+        {
+            "private": True,
+            "page": "api_oauth",
+            "page_title": "Authorized Apps",
+            "authorizations": authorizations,
+        },
+    )
+
+
 @login_required
 @never_cache
 def view_webhook_logs(