Flask-Exts 0.2.3__tar.gz → 0.2.4__tar.gz

{flask_exts-0.2.3 → flask_exts-0.2.4}/CHANGES.rst

@@ -1,3 +1,14 @@
+v0.2.4
+------
+
+Unreleased
+
+- user change password
+- user forgot password
+- user 2FA with TOTP
+- user recovery codes
+- user recovery
+
 v0.2.3
 ------
 
@@ -7,7 +18,6 @@ Released 2025-08-28
 - add folder email
 - add security.email_verification
 
-
 v0.2.2
 ------
 

{flask_exts-0.2.3 → flask_exts-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Flask-Exts
-Version: 0.2.3
+Version: 0.2.4
 Summary: Flask extensions with admin, SQLAlchemy, babel, forms, fields, widgets, and so on.
 Project-URL: Documentation, https://flask-exts.readthedocs.io
 Project-URL: Source, https://github.com/ojso/flask-exts
@@ -46,7 +46,10 @@ Requires-Dist: flask-babel>=4.0
 Requires-Dist: flask-login>=0.6
 Requires-Dist: flask-sqlalchemy>=3.0
 Requires-Dist: flask>=3.0
+Requires-Dist: pillow>=11.0
 Requires-Dist: pyjwt>=2.0
+Requires-Dist: pyotp>=2.0
+Requires-Dist: qrcode>=8.0
 Requires-Dist: tablib>=3.0
 Requires-Dist: webauthn>=2.0
 Requires-Dist: wtforms>=3.0

{flask_exts-0.2.3 → flask_exts-0.2.4}/docs/configure.rst

@@ -18,7 +18,7 @@ Configuration
                            Default is ``csrf_token``.
 ``CSRF_TIME_LIMIT``        Max age in seconds for CSRF tokens. 
                            Default is ``1800``. 
-``VERIFY_EMAIL_SENDER``    Email address used to send verification emails.
+``NOREPLY_EMAIL_SENDER``   Email address used to send emails.
                            It is a dict for smtp with keys: host,port,user,password.
                            Default is None.
 ========================== =====================================================================

{flask_exts-0.2.3 → flask_exts-0.2.4}/docs/index.rst

@@ -42,6 +42,7 @@ More examples, please click :doc:`examples`.
 
    configure
    develop
+   user
    examples
    changes
 

flask_exts-0.2.4/docs/user.rst

@@ -0,0 +1,11 @@
+=======
+User
+=======
+
+views
+=======
+
+.. automodule:: flask_exts.views.user_view
+   :members:
+   :undoc-members:
+   :show-inheritance:

{flask_exts-0.2.3 → flask_exts-0.2.4}/examples/demo/build_sample.py

@@ -1,6 +1,6 @@
 import random
 import datetime
-from flask_exts.proxies import _usercenter
+from flask_exts.proxies import _userstore
 from .models import db
 from .models.author import Author
 from .models.author import AVAILABLE_USER_TYPES
@@ -13,11 +13,11 @@ from .models.location_image import ImageType
 
 
 def build_user_admin():
-    u, _ = _usercenter.create_user(
+    u, _ = _userstore.create_user(
         username="admin", password="admin", email="admin@example.com"
     )
-    r, _ = _usercenter.create_role(name="admin")
-    _usercenter.user_add_role(u, r)
+    r, _ = _userstore.create_role(name="admin")
+    _userstore.user_add_role(u, r)
 
 
 def build_sample_image_type():

flask_exts-0.2.4/examples/demo/templates/my/index.html

@@ -0,0 +1,7 @@
+{% extends 'admin/master.html' %}
+{% block main %}
+<div>
+    Demo:my:index
+</div>
+<div> x= {{ x }}, x'type is {{ template.funcs.type_name(x) }}.</div>
+{% endblock %}

{flask_exts-0.2.3 → flask_exts-0.2.4}/pyproject.toml

@@ -33,8 +33,11 @@ dependencies = [
     "Flask-Login>=0.6",
     "tablib>=3.0",
     "casbin>=1.0",
-    "PyJWT>=2.0", 
+    "PyJWT>=2.0",
+    "pyotp>=2.0",
     "webauthn>=2.0",
+    "qrcode>=8.0",
+    "pillow>=11.0",
 ]
 
 [project.optional-dependencies]

flask_exts-0.2.4/src/flask_exts/__about__.py

@@ -0,0 +1 @@
+__version__ = "0.2.4"

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/admin/base_admin.py

@@ -1,5 +1,6 @@
 from flask import render_template
 from flask import url_for
+from flask import make_response
 from .menu import Menu
 
 
@@ -122,4 +123,12 @@ class BaseAdmin:
         # Add URL generation method to kwargs
         kwargs["get_url"] = self.get_url
 
-        return render_template(template, **kwargs)
+        # If _headers is provided in kwargs, use make_response to set headers
+        if "_headers" in kwargs:
+            headers = kwargs.pop("_headers")
+            response = make_response(render_template(template, **kwargs))
+            for key, value in headers.items():
+                response.headers[key] = value
+            return response
+        else:
+            return render_template(template, **kwargs)

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/commands.py

@@ -1,6 +1,6 @@
 import click
 from flask.cli import AppGroup
-from .proxies import _usercenter
+from .proxies import _userstore
 from .datastore.sqla import db
 
 
@@ -20,15 +20,15 @@ security_cli = AppGroup("security", short_help="security for the app.")
 @click.argument("name")
 def create_user(name):
     print(f"security create_user {name}")
-    result = _usercenter.create_user(username=name)
+    result = _userstore.create_user(username=name)
     click.echo(result)
 
 
 @security_cli.command("create_admin", help="create user:admin with admin:role")
 @click.argument("password", default="admin")
 def create_admin(password):
-    u, _ = _usercenter.create_user(username="admin", password=password)
-    r, _ = _usercenter.create_role(name="admin")
-    _usercenter.user_add_role(u, r)
+    u, _ = _userstore.create_user(username="admin", password=password)
+    r, _ = _userstore.create_role(name="admin")
+    _userstore.user_add_role(u, r)
 
     print(f"security create admin {u.username} with role {r.name} ")

flask_exts-0.2.4/src/flask_exts/constants.py

@@ -0,0 +1,6 @@
+# no-cache header
+NO_CACHE_HEADER = {
+    "Cache-Control": "no-cache, no-store, must-revalidate, max-age=0",
+    "Pragma": "no-cache",
+    "Expires": "0",
+}

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/datastore/sqla/models/user.py

@@ -10,6 +10,8 @@ from ..orm import relationship
 from ..orm import ForeignKey
 from ..orm import Table
 from ..orm import Column
+from ..orm import MutableList
+from ..orm import JSON
 from .role import Role
 from .user_profile import UserProfile
 
@@ -28,31 +30,34 @@ class User(db.Model, BaseUser):
     uuid: Mapped[str] = mapped_column(unique=True, default=lambda: str(uuid.uuid4()))
     username: Mapped[Optional[str]] = mapped_column(unique=True)
     password: Mapped[Optional[str]]
-    display_name: Mapped[Optional[str]]
-    avatar: Mapped[Optional[str]]
+    actived: Mapped[bool] = mapped_column(default=False)
     status: Mapped[int] = mapped_column(default=0)
     expired_at: Mapped[Optional[datetime]]
-    actived: Mapped[bool] = mapped_column(default=False)
     email: Mapped[Optional[str]] = mapped_column(unique=True)
     email_verified: Mapped[bool] = mapped_column(default=False)
     email_verified_at: Mapped[Optional[datetime]]
     phone_number: Mapped[Optional[str]] = mapped_column(unique=True)
     phone_verified: Mapped[bool] = mapped_column(default=False)
     phone_verified_at: Mapped[Optional[datetime]]
+    tfa_enabled: Mapped[bool] = mapped_column(default=False)
+    tfa_method: Mapped[Optional[str]]
+    totp_secret: Mapped[Optional[str]]
+    recovery_codes: Mapped[Optional[list[str]]] = mapped_column(
+        type_=MutableList.as_mutable(JSON)
+    )
     created_at: Mapped[datetime] = mapped_column(default=datetime.now)
     updated_at: Mapped[datetime] = mapped_column(
         default=datetime.now, onupdate=datetime.now
     )
 
     roles: Mapped[List["Role"]] = relationship(secondary=user_role_table)
-
     profile: Mapped["UserProfile"] = relationship(
         "UserProfile", back_populates="user", uselist=False
     )
 
     def get_roles(self):
         return [r.name for r in self.roles]
-    
+
     @property
     def is_active(self):
         return self.actived

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/datastore/sqla/models/user_profile.py

@@ -14,12 +14,10 @@ class UserProfile(db.Model):
     user_id: Mapped[int] = mapped_column(ForeignKey("user.id"), unique=True)
     name: Mapped[Optional[str]]
     identity: Mapped[Optional[str]] = mapped_column(unique=True)
+    display_name: Mapped[Optional[str]]
+    avatar: Mapped[Optional[str]]
     locale: Mapped[Optional[str]]
-    timezone: Mapped[Optional[str]]
-    # 2FA
-    tf_method: Mapped[Optional[str]]
-    tf_totp_secret: Mapped[Optional[str]]
-    recovery_codes: Mapped[Optional[str]]
+    timezone: Mapped[Optional[str]]    
     # timestamps
     created_at: Mapped[datetime] = mapped_column(default=datetime.now)
     updated_at: Mapped[datetime] = mapped_column(

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/datastore/sqla/models/webauthn.py

@@ -8,6 +8,7 @@ from ..orm import LargeBinary
 from ..orm import ForeignKey
 from ..orm import relationship
 from ..orm import JSON
+from ..orm import MutableList
 
 
 class WebAuthnMixin(db.Model):
@@ -19,7 +20,9 @@ class WebAuthnMixin(db.Model):
     )
     public_key: Mapped[bytes] = mapped_column(LargeBinary)
     sign_count: Mapped[Optional[int]] = mapped_column(default=0)
-    transports: Mapped[Optional[list[str]]] = mapped_column(type_=JSON)
+    transports: Mapped[Optional[list[str]]] = mapped_column(
+        type_=MutableList.as_mutable(JSON)
+    )
     backup_state: Mapped[bool] = mapped_column()
     device_type: Mapped[str] = mapped_column()
     extensions: Mapped[Optional[str]] = mapped_column()

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/datastore/sqla/orm.py

@@ -7,6 +7,5 @@ from sqlalchemy.orm import mapped_column
 from sqlalchemy.orm import declared_attr
 from sqlalchemy.types import LargeBinary
 from sqlalchemy.types import JSON
-
-
-
+from sqlalchemy.ext.mutable import MutableDict
+from sqlalchemy.ext.mutable import MutableList

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/email/base.py

@@ -1,5 +1,7 @@
 from ..signals import to_send_email
 from .verify_email_sender import VerifyEmailSender
+from .reset_password_sender import ResetPasswordSender
+
 
 class Email:
     def __init__(self, app=None):
@@ -11,6 +13,15 @@ class Email:
     def init_app(self, app):
         self.app = app
         self.subscribe_signal(app)
+        self.register_senders()
+        if "verify_email" not in self.senders:
+            app.logger.warning(
+                "Please configure the NOREPLY_EMAIL_SENDER in your app config."
+            )
+        if "reset_password" not in self.senders:
+            app.logger.warning(
+                "Please configure the NOREPLY_EMAIL_SENDER in your app config."
+            )
 
     def subscribe_signal(self, app):
         to_send_email.connect(self.send, app)
@@ -21,23 +32,35 @@ class Email:
             return
         self.send_email(data["type"], data)
 
-    def register_sender(self, name, sender):
-        """Register a sender with a name."""
-        if name in self.senders:
-            raise ValueError(f"Sender with name {name} already exists.")
-        self.senders[name] = sender
-
     def send_email(self, name, data):
         """Send an email using a registered sender."""
         if name not in self.senders:
-            self.app.logger.warning(f"Email can not send data: {data}, because it can not find the sender: {name}")
+            self.app.logger.warning(
+                f"Email can not send data: {data}, because it can not find the sender: {name}"
+            )
             # raise ValueError(f"Email can not find the sender: {name}")
             return
         sender = self.senders.get(name)
         return sender.send(data)
-    
+
     def register_senders(self):
         """Register multiple senders."""
-        if "VERIFY_EMAIL_SENDER" in self.app.config:
-            verify_email_sender = VerifyEmailSender(**self.app.config["VERIFY_EMAIL_SENDER"])
+        # Register VerifyEmailSender
+        if "NOREPLY_EMAIL_SENDER" in self.app.config:
+            verify_email_sender = VerifyEmailSender(
+                **self.app.config["NOREPLY_EMAIL_SENDER"]
+            )
             self.register_sender("verify_email", verify_email_sender)
+
+        # Register ResetPasswordSender
+        if "NOREPLY_EMAIL_SENDER" in self.app.config:
+            reset_password_sender = ResetPasswordSender(
+                **self.app.config["NOREPLY_EMAIL_SENDER"]
+            )
+            self.register_sender("reset_password", reset_password_sender)
+
+    def register_sender(self, name, sender):
+        """Register a sender with a name."""
+        if name in self.senders:
+            raise ValueError(f"Sender with name {name} already exists.")
+        self.senders[name] = sender

flask_exts-0.2.4/src/flask_exts/email/reset_password_sender.py

@@ -0,0 +1,12 @@
+from .smtp import SmtpSSL
+
+
+class ResetPasswordSender(SmtpSSL):
+    def create_emsg(self, data):
+        if "subject" not in data:
+            data["subject"] = "Please reset your password"
+        if "content" not in data:
+            data["content"] = data.get("reset_password_link", "")
+        if "to" not in data:
+            data["to"] = data.get("email")
+        return super().create_emsg(data)

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/manager.py

@@ -1,10 +1,8 @@
-from flask_login import LoginManager
 from .datastore.sqla import db
 from .babel import babel_init_app
 from .template.base import Template
 from .email.base import Email
-from .usercenter.sqla_usercenter import SqlaUserCenter
-from .utils.request_user import load_user_from_request
+from .usercenter.core import UserCenter
 from .security.core import Security
 
 
@@ -22,8 +20,10 @@ class Manager:
     def get_email(self):
         return Email()
 
-    def get_usercenter(self):
-        return SqlaUserCenter()
+    def get_admin_class(self):
+        from .admin.base_admin import BaseAdmin
+
+        return BaseAdmin
 
     def init_app(self, app):
         self.app = app
@@ -54,21 +54,11 @@ class Manager:
         # init email
         self.email = self.get_email()
         self.email.init_app(app)
-        self.email.register_senders()
 
-        # init usercenter
-        self.usercenter = self.get_usercenter()
+        # init usercenter and initial login manager in usercenter
+        self.usercenter = UserCenter()
         self.usercenter.init_app(app)
 
-        # login
-        if not hasattr(app, "login_manager"):
-            login_manager = LoginManager()
-            login_manager.init_app(app)
-            login_manager.login_view = "user.login"
-            # login_manager.login_message = "Please login in"
-            login_manager.user_loader(self.usercenter.user_loader)
-            login_manager.request_loader(load_user_from_request)
-
         # init security
         self.security = Security()
         self.security.init_app(app)
@@ -76,8 +66,3 @@ class Manager:
         # init admin
         self.admin = self.get_admin_class()()
         self.admin.init_app(app)
-
-    def get_admin_class(self):
-        from .admin.base_admin import BaseAdmin
-
-        return BaseAdmin

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/proxies.py

@@ -6,7 +6,7 @@ from werkzeug.local import LocalProxy
 if t.TYPE_CHECKING:
     from .manager import Manager
     from .template.base import Template
-    from .usercenter.base_usercenter import BaseUserCenter
+    from .usercenter.base_user_store import BaseUserStore
     from .security.core import Security
     from .security.authorizer.base import Authorizer
 
@@ -15,7 +15,7 @@ _manager: "Manager" = LocalProxy(lambda: current_app.extensions["manager"])
 
 _template: "Template" = LocalProxy(lambda: _manager.template)
 
-_usercenter: "BaseUserCenter" = LocalProxy(lambda: _manager.usercenter)
+_userstore: "BaseUserStore" = LocalProxy(lambda: _manager.usercenter.userstore)
 
 _security: "Security" = LocalProxy(lambda: _manager.security)
 

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/security/core.py

@@ -2,6 +2,8 @@ from .hasher import Blake2bHasher
 from .serializer import TimedUrlSerializer
 from .authorizer.casbin_authorizer import CasbinAuthorizer
 from .email_verification import EmailVerification
+from .reset_password import ResetPassword
+from .two_factor_authentication import TwoFactorAuthentication
 
 
 class Security:
@@ -19,8 +21,12 @@ class Security:
         self.serializer = TimedUrlSerializer(secret_key)
         # email verification
         self.email_verification = EmailVerification(app)
+        # reset password
+        self.reset_password = ResetPassword(app)
         # authorizer
         self.authorizer = CasbinAuthorizer(app)
+        # 2FA
+        self.tfa = TwoFactorAuthentication(app)
 
     def get_within(self, serializer_name):
         """Get the max age for a serializer."""

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/security/email_verification.py

@@ -2,7 +2,7 @@ from datetime import datetime
 from flask import url_for
 from flask import current_app
 from ..proxies import _security
-from ..proxies import _usercenter
+from ..proxies import _userstore
 from ..signals import to_send_email
 
 
@@ -30,7 +30,8 @@ class EmailVerification:
 
         :param user: The user to send the instructions to
         """
-
+        if user is None or user.email is None:
+            return
         token = self.generate_verify_email_token(user)
         link = url_for("user.verify_email", token=token, _external=True)
 
@@ -44,7 +45,7 @@ class EmailVerification:
 
         to_send_email.send(current_app._get_current_object(), data=data)
 
-    def verify_email_token(self, token, within=None):
+    def verify_email_with_token(self, token, within=None):
         """
         View function which handles an email verification request.
         This is always a GET from an email - so for 'spa' must always redirect.
@@ -63,7 +64,7 @@ class EmailVerification:
             return ("invalid_token", None)
 
         token_user_identity, token_email_hash = token_data
-        user = _usercenter.get_user_by_identity(token_user_identity)
+        user = _userstore.get_user_by_identity(token_user_identity)
 
         if not user:
             return ("no_user", None)
@@ -78,6 +79,6 @@ class EmailVerification:
         user.email_verified_at = datetime.now()
         user.actived = True
 
-        _usercenter.save_user(user)
+        _userstore.save_user(user)
 
         return ("verified", user)

flask_exts-0.2.4/src/flask_exts/security/reset_password.py

@@ -0,0 +1,78 @@
+from datetime import datetime
+from flask import url_for
+from flask import current_app
+from ..proxies import _security
+from ..proxies import _userstore
+from ..signals import to_send_email
+
+
+class ResetPassword:
+    """
+    Class to handle reset password functionality.
+    This class provides methods to generate reset token and reset password with the token.
+    """
+
+    def __init__(self, app=None):
+        self.app = app
+        self.serializer_name = "reset_password"
+
+    def generate_reset_password_token(self, user):
+        """Generates a reset password token for the specified user.
+        :param user: The user to work with
+        """
+        data = (str(user.id), _security.hasher.hash(user.email))
+        token = _security.serializer.dumps(self.serializer_name, data)
+        return token
+
+    def send_reset_password_token(self, user):
+        """Sends the reset password token.
+        :param user: The user to send the reset password token to.
+        """
+        if user is None or user.email is None:
+            return
+        token = self.generate_reset_password_token(user)
+        link = url_for("user.reset_password", token=token, _external=True)
+
+        data = {
+            "type": "reset_password",
+            "email": user.email,
+            "reset_password_link": link,
+            "reset_password_token": token,
+            "user": user,
+        }
+
+        to_send_email.send(current_app._get_current_object(), data=data)
+
+    def reset_password_with_token(self, token, password, within=None):
+        """
+        Resets the password for a user with the given token.
+        """
+        if within is None:
+            within = _security.get_within(self.serializer_name)
+
+        expired, invalid, token_data = _security.serializer.loads(
+            self.serializer_name, token, within
+        )
+
+        if expired:
+            return ("expired", None)
+
+        if invalid or not token_data:
+            return ("invalid_token", None)
+
+        token_user_identity, token_email_hash = token_data
+        user = _userstore.get_user_by_identity(token_user_identity)
+
+        if not user:
+            return ("no_user", None)
+
+        if not _security.hasher.verify(user.email, token_email_hash):
+            return ("invalid_token", None)
+
+        if not user.email_verified:
+            return ("email_not_verified", None)
+
+        _userstore.user_set(user, password=user.hash_password(password))
+        _userstore.save_user(user)
+
+        return ("ok", None)

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/security/serializer.py

@@ -22,7 +22,7 @@ class TimedUrlSerializer:
         return token
 
     def loads(
-        self, serializer_name: str, token: str, max_age: int | None = None
+        self, serializer_name: str, token: str, max_age: int | None = 259200  # 3 days
     ) -> tuple[bool, bool, t.Any]:
         """Get the status of a token and return data.
 
@@ -42,7 +42,7 @@ class TimedUrlSerializer:
         try:
             data = s.loads(token, max_age=max_age)
         except SignatureExpired:
-            _, data = s.loads_unsafe(token)
+            # _, data = s.loads_unsafe(token)
             expired = True
         except (BadSignature, TypeError, ValueError):
             invalid = True

flask_exts-0.2.4/src/flask_exts/security/two_factor_authentication.py

@@ -0,0 +1,38 @@
+import secrets
+import string
+import pyotp
+
+
+class TwoFactorAuthentication:
+    def __init__(self, app=None):
+        self.app = app
+
+    def generate_totp_secret(self):
+        return pyotp.random_base32()
+
+    def generate_recovery_codes(self, count=10, length=16):
+        alphabet = string.ascii_letters + string.digits
+        codes = set()
+        while len(codes) < count:
+            code = "".join(secrets.choice(alphabet) for _ in range(length))
+            codes.add(code)
+        return list(codes)
+
+    def get_totp_code(self, otp_secret):
+        if otp_secret is None:
+            return None
+        otp = pyotp.TOTP(otp_secret)
+        return otp.now()
+
+    def get_totp_uri(self, otp_secret, username):
+        otp = pyotp.TOTP(otp_secret)
+        if self.app and self.app.config.get("APP_NAME"):
+            app_name = self.app.config.get("APP_NAME")
+        else:
+            app_name = "UnknownApp"
+        uri = otp.provisioning_uri(name=username, issuer_name=app_name)
+        return uri
+
+    def verify_totp(self, otp_secret, token):
+        otp = pyotp.TOTP(otp_secret)
+        return otp.verify(token)

{flask_exts-0.2.3 → flask_exts-0.2.4}/src/flask_exts/static/js/modal.js

@@ -3,6 +3,6 @@ $('#fa_modal_window').on('show.bs.modal', function (event) {
     let modal = $(this)
     modal.find('.modal-content').load(relatedTarget.attr('href'), function () {
         // window.faForm.applyGlobalStyles(document.getElementsByClassName('modal-content'));
-        window.faForm.applyGlobalStyles(modal.find('.modal-content'), true);
+        // window.faForm.applyGlobalStyles(modal.find('.modal-content'), true);
     })
 })