c2cgeoportal-geoportal 2.3.5.80__py3-none-any.whl → 2.9rc45__py3-none-any.whl

c2cgeoportal_geoportal/lib/oidc.py

@@ -0,0 +1,304 @@
+# Copyright (c) 2024, Camptocamp SA
+# All rights reserved.
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+
+# 1. Redistributions of source code must retain the above copyright notice, this
+#    list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright notice,
+#    this list of conditions and the following disclaimer in the documentation
+#    and/or other materials provided with the distribution.
+
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# The views and conclusions contained in the software and documentation are those
+# of the authors and should not be interpreted as representing official policies,
+# either expressed or implied, of the FreeBSD Project.
+
+import datetime
+import json
+import logging
+from typing import TYPE_CHECKING, Any, NamedTuple, Optional, TypedDict, Union
+
+import pyramid.request
+import pyramid.response
+import simple_openid_connect.client
+import simple_openid_connect.data
+from pyramid.httpexceptions import HTTPBadRequest, HTTPInternalServerError, HTTPUnauthorized
+from pyramid.security import remember
+
+from c2cgeoportal_geoportal.lib.caching import get_region
+
+if TYPE_CHECKING:
+    from c2cgeoportal_commons.models import main, static
+
+_LOG = logging.getLogger(__name__)
+_CACHE_REGION_OBJ = get_region("obj")
+
+
+# User create on demand
+class DynamicUser(NamedTuple):
+    """
+    User created dynamically.
+    """
+
+    id: int
+    username: str
+    display_name: str
+    email: str
+    settings_role: Optional["main.Role"]
+    roles: list["main.Role"]
+
+
+@_CACHE_REGION_OBJ.cache_on_arguments()
+def get_oidc_client(request: pyramid.request.Request, host: str) -> simple_openid_connect.client.OpenidClient:
+    """
+    Get the OpenID Connect client from the request settings.
+    """
+
+    del host  # used for cache key
+
+    authentication_settings = request.registry.settings.get("authentication", {})
+    openid_connect = authentication_settings.get("openid_connect", {})
+    if openid_connect.get("enabled", False) is not True:
+        raise HTTPBadRequest("OpenID Connect not enabled")
+
+    return simple_openid_connect.client.OpenidClient.from_issuer_url(
+        url=openid_connect["url"],
+        authentication_redirect_uri=request.route_url("oidc_callback"),
+        client_id=openid_connect["client_id"],
+        client_secret=openid_connect.get("client-secret"),
+        scope=" ".join(openid_connect.get("scopes", ["openid", "profile", "email"])),
+    )
+
+
+class OidcRememberObject(TypedDict):
+    """
+    The JSON object that is stored in a cookie to remember the user.
+    """
+
+    access_token: str
+    access_token_expires: str
+    refresh_token: str | None
+    refresh_token_expires: str | None
+    username: str | None
+    display_name: str | None
+    email: str | None
+    settings_role: str | None
+    roles: list[str]
+
+
+def get_remember_from_user_info(
+    request: pyramid.request.Request, user_info: dict[str, Any], remember_object: OidcRememberObject
+) -> None:
+    """
+    Fill the remember object from the user info.
+
+    The remember object will be stored in a cookie to remember the user.
+
+    :param user_info: The user info from the ID token or from the user info view according to the `query_user_info` configuration.
+    :param remember_object: The object to fill, by default with the `username`, `email`, `settings_role` and `roles`,
+        the corresponding field from `user_info` can be configured in `user_info_fields`.
+    :param settings: The OpenID Connect configuration.
+    """
+    settings_fields = (
+        request.registry.settings.get("authentication", {})
+        .get("openid_connect", {})
+        .get("user_info_fields", {})
+    )
+
+    for field_, default_field in (
+        ("username", "sub"),
+        ("display_name", "name"),
+        ("email", "email"),
+        ("settings_role", None),
+        ("roles", None),
+    ):
+        user_info_field = settings_fields.get(field_, default_field)
+        if user_info_field is not None:
+            if user_info_field not in user_info:
+                _LOG.error(
+                    "Field '%s' not found in user info, available: %s.",
+                    user_info_field,
+                    ", ".join(user_info.keys()),
+                )
+                raise HTTPInternalServerError(f"Field '{user_info_field}' not found in user info.")
+            remember_object[field_] = user_info[user_info_field]  # type: ignore[literal-required]
+
+
+def get_user_from_remember(
+    request: pyramid.request.Request, remember_object: OidcRememberObject, update_create_user: bool = False
+) -> Union["static.User", DynamicUser] | None:
+    """
+    Create a user from the remember object filled from `get_remember_from_user_info`.
+
+    :param remember_object: The object to fill, by default with the `username`, `email`, `settings_role` and `roles`.
+    :param settings: The OpenID Connect configuration.
+    :param update_create_user: If the user should be updated or created if it does not exist.
+    """
+
+    # Those imports are here to avoid initializing the models module before the database schema are
+    # correctly initialized.
+    from c2cgeoportal_commons import models  # pylint: disable=import-outside-toplevel
+    from c2cgeoportal_commons.models import main, static  # pylint: disable=import-outside-toplevel
+
+    assert models.DBSession is not None
+
+    user: static.User | DynamicUser | None
+    username = remember_object["username"]
+    assert username is not None
+    email = remember_object["email"]
+    assert email is not None
+    display_name = remember_object["display_name"] or email
+
+    openid_connect_configuration = request.registry.settings.get("authentication", {}).get(
+        "openid_connect", {}
+    )
+    provide_roles = openid_connect_configuration.get("provide_roles", False)
+    if provide_roles is False:
+        user_query = models.DBSession.query(static.User)
+        match_field = openid_connect_configuration.get("match_field", "username")
+        if match_field == "username":
+            user_query = user_query.filter_by(username=username)
+        elif match_field == "email":
+            user_query = user_query.filter_by(email=email)
+        else:
+            raise HTTPInternalServerError(
+                f"Unknown match_field: '{match_field}', allowed values are 'username' and 'email'"
+            )
+        user = user_query.one_or_none()
+        if update_create_user is True:
+            if user is not None:
+                for field in openid_connect_configuration.get("update_fields", []):
+                    if field == "username":
+                        user.username = username
+                    elif field == "display_name":
+                        user.display_name = display_name
+                    elif field == "email":
+                        user.email = email
+                    else:
+                        raise HTTPInternalServerError(
+                            f"Unknown update_field: '{field}', allowed values are 'username', 'display_name' and 'email'"
+                        )
+            elif openid_connect_configuration.get("create_user", False) is True:
+                user = static.User(username=username, email=email, display_name=display_name)
+                models.DBSession.add(user)
+    else:
+        user = DynamicUser(
+            id=-1,
+            username=username,
+            display_name=display_name,
+            email=email,
+            settings_role=(
+                models.DBSession.query(main.Role).filter_by(name=remember_object["settings_role"]).first()
+                if remember_object.get("settings_role") is not None
+                else None
+            ),
+            roles=[
+                models.DBSession.query(main.Role).filter_by(name=role).one()
+                for role in remember_object.get("roles", [])
+            ],
+        )
+    return user
+
+
+class OidcRemember:
+    """
+    Build the abject that we want to remember in the cookie.
+    """
+
+    def __init__(self, request: pyramid.request.Request):
+        self.request = request
+        self.authentication_settings = request.registry.settings.get("authentication", {})
+
+    @_CACHE_REGION_OBJ.cache_on_arguments()
+    def remember(
+        self,
+        token_response: (
+            simple_openid_connect.data.TokenSuccessResponse | simple_openid_connect.data.TokenErrorResponse
+        ),
+        host: str,
+    ) -> OidcRememberObject:
+        """
+        Remember the user in the cookie.
+        """
+
+        del host  # Used for cache key
+
+        if isinstance(token_response, simple_openid_connect.data.TokenErrorResponse):
+            _LOG.warning(
+                "OpenID connect connection error: %s [%s]",
+                token_response.error_description,
+                token_response.error_uri,
+            )
+            raise HTTPUnauthorized("See server logs for details")
+
+        if not isinstance(token_response, simple_openid_connect.data.TokenSuccessResponse):
+            _LOG.warning("OpenID connect connection error: %s", token_response)
+            raise HTTPUnauthorized("See server logs for details")
+
+        openid_connect = self.authentication_settings.get("openid_connect", {})
+        remember_object: OidcRememberObject = {
+            "access_token": token_response.access_token,
+            "access_token_expires": (
+                datetime.datetime.now() + datetime.timedelta(seconds=token_response.expires_in)
+            ).isoformat(),
+            "refresh_token": token_response.refresh_token,
+            "refresh_token_expires": (
+                None
+                if token_response.refresh_expires_in is None
+                else (
+                    datetime.datetime.now() + datetime.timedelta(seconds=token_response.refresh_expires_in)
+                ).isoformat()
+            ),
+            "username": None,
+            "display_name": None,
+            "email": None,
+            "settings_role": None,
+            "roles": [],
+        }
+        client = get_oidc_client(self.request, self.request.host)
+
+        if openid_connect.get("query_user_info", False) is True:
+            user_info = client.fetch_userinfo(token_response.access_token)
+        else:
+            un_validated_user_info = simple_openid_connect.data.IdToken.parse_jwt(
+                token_response.id_token, client.provider_keys
+            )
+            _LOG.info(
+                "Receive audiences: %s",
+                (
+                    un_validated_user_info.aud
+                    if isinstance(un_validated_user_info.aud, str)
+                    else ", ".join(un_validated_user_info.aud)
+                ),
+            )
+            user_info = client.decode_id_token(
+                token_response.id_token,
+                extra_trusted_audiences=openid_connect.get(
+                    "trusted_audiences", [openid_connect.get("client_id")]
+                ),
+            )
+
+        self.request.get_remember_from_user_info(user_info.dict(), remember_object)
+        self.request.response.headers.extend(remember(self.request, json.dumps(remember_object)))
+
+        return remember_object
+
+
+def includeme(config: pyramid.config.Configurator) -> None:
+    """
+    Pyramid includeme function.
+    """
+    config.add_request_method(get_remember_from_user_info, name="get_remember_from_user_info")
+    config.add_request_method(get_user_from_remember, name="get_user_from_remember")

c2cgeoportal_geoportal/lib/wmstparsing.py

@@ -0,0 +1,353 @@
+# Copyright (c) 2013-2024, Camptocamp SA
+# All rights reserved.
+
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+
+# 1. Redistributions of source code must retain the above copyright notice, this
+#    list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright notice,
+#    this list of conditions and the following disclaimer in the documentation
+#    and/or other materials provided with the distribution.
+
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# The views and conclusions contained in the software and documentation are those
+# of the authors and should not be interpreted as representing official policies,
+# either expressed or implied, of the FreeBSD Project.
+
+
+import datetime
+from typing import Any, Union
+
+import isodate
+
+TimeExtent = Union["TimeExtentValue", "TimeExtentInterval"]
+
+
+def min_none(a: datetime.datetime | None, b: datetime.datetime | None) -> datetime.datetime | None:
+    """Return the min value, support non in input."""
+    if a is None:
+        return b
+    if b is None:
+        return a
+    return min(a, b)
+
+
+def max_none(a: datetime.datetime | None, b: datetime.datetime | None) -> datetime.datetime | None:
+    """Return the max value, support non in input."""
+    if a is None:
+        return b
+    if b is None:
+        return a
+    return max(a, b)
+
+
+class TimeInformation:
+    """
+    Collect the WMS time information.
+
+    Arguments:
+
+        extent: A time extent instance (``TimeExtentValue`` or ``TimeExtentInterval``)
+        mode: The layer mode ("single", "range" or "disabled")
+        widget: The layer mode ("slider" (default) or "datepicker")
+    """
+
+    def __init__(self) -> None:
+        self.extent: TimeExtent | None = None
+        self.mode: str | None = None
+        self.widget: str | None = None
+        self.layer: dict[str, Any] | None = None
+
+    def merge(self, layer: dict[str, Any], extent: TimeExtent, mode: str, widget: str) -> None:
+        layer_apply = self.layer == layer or (not self.has_time() and extent is not None)
+
+        self.merge_extent(extent)
+        self.merge_mode(mode)
+        self.merge_widget(widget)
+
+        if layer_apply:
+            layer["time"] = self.to_dict()
+            self.layer = layer
+        elif self.layer is not None:
+            del self.layer["time"]
+            self.layer = None
+
+    def merge_extent(self, extent: TimeExtent) -> None:
+        if self.extent is not None:
+            self.extent.merge(extent)
+        else:
+            self.extent = extent
+
+    def merge_mode(self, mode: str) -> None:
+        if mode != "disabled":
+            if self.mode is not None:
+                if self.mode != mode:
+                    raise ValueError(f"Could not mix time mode '{mode!s}' and '{self.mode!s}'")
+            else:
+                self.mode = mode
+
+    def merge_widget(self, widget: str | None) -> None:
+        widget = "slider" if not widget else widget
+        assert widget is not None
+
+        if self.widget is not None:
+            if self.widget != widget:
+                raise ValueError(f"Could not mix time widget '{widget!s}' and '{self.widget!s}'")
+        else:
+            self.widget = widget
+
+    def has_time(self) -> bool:
+        return self.extent is not None
+
+    def to_dict(self) -> dict[str, Any] | None:
+        if self.has_time():
+            assert self.extent is not None
+            time = self.extent.to_dict()
+            time["mode"] = self.mode
+            time["widget"] = self.widget
+            return time
+        return None
+
+
+class TimeExtentValue:
+    """Represents time as a list of values."""
+
+    def __init__(
+        self,
+        values: set[datetime.datetime],
+        resolution: str,
+        min_def_value: datetime.datetime | None,
+        max_def_value: datetime.datetime | None,
+    ):
+        """
+        Initialize.
+
+        Arguments:
+
+            values: A set() of datetime
+            resolution: The resolution from the mapfile time definition
+            min_def_value: the minimum default value as a datetime
+            max_def_value: the maximum default value as a datetime
+        """
+        self.values = values
+        self.resolution = resolution
+        self.min_def_value = min_def_value
+        self.max_def_value = max_def_value
+
+    def merge(self, extent: TimeExtent) -> None:
+        if not isinstance(extent, TimeExtentValue):
+            raise ValueError("Could not mix time defined as a list of values with other type of definition")
+        self.values.update(extent.values)
+        self.min_def_value = min_none(self.min_def_value, extent.min_def_value)
+        self.max_def_value = max_none(self.max_def_value, extent.max_def_value)
+
+    def to_dict(self) -> dict[str, Any]:
+        values = sorted(self.values)
+        min_def_value = _format_date(self.min_def_value) if self.min_def_value else None
+        max_def_value = _format_date(self.max_def_value) if self.max_def_value else None
+
+        return {
+            "minValue": _format_date(values[0]),
+            "maxValue": _format_date(values[-1]),
+            "values": list(map(_format_date, values)),
+            "resolution": self.resolution,
+            "minDefValue": min_def_value,
+            "maxDefValue": max_def_value,
+        }
+
+
+class TimeExtentInterval:
+    """Represents time with the help of a start, an end and an interval."""
+
+    def __init__(
+        self,
+        start: datetime.datetime,
+        end: datetime.datetime,
+        interval: tuple[int, int, int, int],
+        resolution: str,
+        min_def_value: datetime.datetime | None,
+        max_def_value: datetime.datetime | None,
+    ):
+        """
+        Initialize.
+
+        Arguments:
+
+            start: The start value as a datetime
+            end: The end value as a datetime
+            interval: The interval as a tuple (years, months, days, seconds)
+            resolution: The resolution from the mapfile time definition
+            min_def_value: the minimum default value as a datetime
+            max_def_value: the maximum default value as a datetime
+        """
+        self.start = start
+        self.end = end
+        self.interval = interval
+        self.resolution = resolution
+        self.min_def_value = min_def_value
+        self.max_def_value = max_def_value
+
+    def merge(self, extent: TimeExtent) -> None:
+        if not isinstance(extent, TimeExtentInterval):
+            raise ValueError("Could not merge time defined as with an interval with other type of definition")
+        if self.interval != extent.interval:
+            raise ValueError("Could not merge times defined with a different interval")
+        start = min_none(self.start, extent.start)
+        assert start is not None
+        self.start = start
+        end = max_none(self.end, extent.end)
+        assert end is not None
+        self.end = end
+        self.min_def_value = (
+            self.min_def_value
+            if extent.min_def_value is None
+            else (
+                extent.min_def_value
+                if self.min_def_value is None
+                else min_none(self.min_def_value, extent.min_def_value)
+            )
+        )
+        self.max_def_value = (
+            self.max_def_value
+            if extent.max_def_value is None
+            else (
+                extent.max_def_value
+                if self.max_def_value is None
+                else max_none(self.max_def_value, extent.max_def_value)
+            )
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        min_def_value = _format_date(self.min_def_value) if self.min_def_value is not None else None
+        max_def_value = _format_date(self.max_def_value) if self.max_def_value is not None else None
+
+        return {
+            "minValue": _format_date(self.start),
+            "maxValue": _format_date(self.end),
+            "interval": self.interval,
+            "resolution": self.resolution,
+            "minDefValue": min_def_value,
+            "maxDefValue": max_def_value,
+        }
+
+
+def parse_extent(extent: list[str], default_values: str) -> TimeExtent:
+    """
+    Parse a time extend from OWSLib to a `̀ TimeExtentValue`` or a ``TimeExtentInterval``.
+
+    Two formats are supported:
+    * ['start/end/interval']
+    * ['date1', 'date2', ..., 'date N']
+
+    default_values must be a slash separated String from OWSLib's a
+    defaulttimeposition
+    """
+    if extent:
+        min_def_value, max_def_value = _parse_default_values(default_values)
+        if extent[0].count("/") > 0:
+            # case "start/end/interval"
+            if len(extent) > 1 or extent[0].count("/") != 2:
+                raise ValueError(f"Unsupported time definition '{extent!s}'")
+            s, e, i = extent[0].split("/")
+            start = _parse_date(s)
+            end = _parse_date(e)
+            interval = _parse_duration(i)
+
+            return TimeExtentInterval(start[1], end[1], interval, start[0], min_def_value, max_def_value)
+        # case "value1, value2, ..., valueN"
+        dates = [_parse_date(d) for d in extent]
+        resolution = dates[0][0]
+        values = {d[1] for d in dates}
+
+        return TimeExtentValue(values, resolution, min_def_value, max_def_value)
+    raise ValueError(f"Invalid time extent format '{extent}'")
+
+
+def _parse_default_values(default_values: str) -> tuple[datetime.datetime, datetime.datetime | None]:
+    """
+    Parse the 'default' value from OWSLib's defaulttimeposition and return a maximum of two dates.
+
+    default value must be a slash separated String. return None on the seconde value if it does not exist.
+    """
+    if default_values is None:
+        return None, None
+
+    def_value = default_values.split("/")
+
+    _, min_def_value = _parse_date(def_value[0])
+    max_def_value = None
+
+    if len(def_value) > 1:
+        _, max_def_value = _parse_date(def_value[1])
+
+    return min_def_value, max_def_value
+
+
+def _parse_date(date: str) -> tuple[str, datetime.datetime]:
+    """
+    Parse a date string.
+
+    Return a tuple containing:
+
+    * the resolution: "year", "month", "day" or "second"
+    * the date as a datetime
+
+    The returned datetime always has a timezone (default is UTC)
+    """
+    resolutions = {"year": "%Y", "month": "%Y-%m", "day": "%Y-%m-%d"}
+
+    for resolution, pattern in list(resolutions.items()):
+        try:
+            dt = datetime.datetime.strptime(date, pattern)
+            return resolution, dt.replace(tzinfo=isodate.UTC)
+        except Exception:  # pylint: disable=broad-exception-caught # nosec
+            pass
+
+    try:
+        dt = isodate.parse_datetime(date)
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=isodate.UTC)
+        return "second", dt
+    except Exception as e:
+        raise ValueError(f"Invalid date format '{date}'") from e
+
+
+def _format_date(date: datetime.datetime) -> str:
+    str_ = isodate.datetime_isoformat(date)
+    assert isinstance(str_, str)
+    if date.tzinfo is None:
+        str_ += "Z"
+    return str_
+
+
+def _parse_duration(duration: str) -> tuple[int, int, int, int]:
+    """
+    Parse an ISO 8601 duration (i.e. "P2DT5S").
+
+    Return a tuple containing:
+
+    * years
+    * months
+    * days
+    * seconds
+    """
+    parsed_duration = isodate.parse_duration(duration)
+
+    # casting years and months to int as isodate might return a float
+    return (
+        int(parsed_duration.years) if hasattr(parsed_duration, "years") else 0,
+        int(parsed_duration.months) if hasattr(parsed_duration, "months") else 0,
+        parsed_duration.days,
+        parsed_duration.seconds,
+    )