dbca-utils 2.1.0__tar.gz → 2.1.2__tar.gz

{dbca_utils-2.1.0/src/dbca_utils.egg-info → dbca_utils-2.1.2}/PKG-INFO

@@ -1,12 +1,9 @@
 Metadata-Version: 2.4
 Name: dbca-utils
-Version: 2.1.0
+Version: 2.1.2
 Summary: Utilities for DBCA Django apps
-Author-email: Rocky Chen <rocky.chen@dbca.wa.gov.au>, Ashley Felton <ashley.felton@dbca.wa.gov.au>
-Project-URL: Homepage, https://github.com/dbca-wa/dbca-utils
-Project-URL: Repository, https://github.com/dbca-wa/dbca-utils.git
-Project-URL: Changelog, https://github.com/dbca-wa/dbca-utils/blob/master/CHANGELOG.md
-Project-URL: GitHub, https://github.com/dbca-wa/dbca-utils
+Author-Email: Rocky Chen <rocky.chen@dbca.wa.gov.au>, Ashley Felton <ashley.felton@dbca.wa.gov.au>
+License-Expression: Apache-2.0
 Classifier: Framework :: Django
 Classifier: Framework :: Django :: 4.0
 Classifier: Framework :: Django :: 4.2
@@ -15,7 +12,6 @@ Classifier: Framework :: Django :: 5.2
 Classifier: Environment :: Web Environment
 Classifier: Intended Audience :: Developers
 Classifier: Development Status :: 5 - Production/Stable
-Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.10
@@ -24,11 +20,14 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Project-URL: Homepage, https://github.com/dbca-wa/dbca-utils
+Project-URL: Repository, https://github.com/dbca-wa/dbca-utils.git
+Project-URL: Changelog, https://github.com/dbca-wa/dbca-utils/blob/master/CHANGELOG.md
+Project-URL: GitHub, https://github.com/dbca-wa/dbca-utils
 Requires-Python: <4.0,>=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
 Requires-Dist: django<6,>=4
-Dynamic: license-file
+Requires-Dist: markupsafe==3.0.2
+Description-Content-Type: text/markdown
 
 # Overview
 

dbca_utils-2.1.2/pyproject.toml

@@ -0,0 +1,72 @@
+[project]
+name = "dbca-utils"
+version = "2.1.2"
+description = "Utilities for DBCA Django apps"
+authors = [
+    { name = "Rocky Chen", email = "rocky.chen@dbca.wa.gov.au" },
+    { name = "Ashley Felton", email = "ashley.felton@dbca.wa.gov.au" },
+]
+readme = "README.md"
+license = "Apache-2.0"
+classifiers = [
+    "Framework :: Django",
+    "Framework :: Django :: 4.0",
+    "Framework :: Django :: 4.2",
+    "Framework :: Django :: 5.0",
+    "Framework :: Django :: 5.2",
+    "Environment :: Web Environment",
+    "Intended Audience :: Developers",
+    "Development Status :: 5 - Production/Stable",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+requires-python = ">=3.10,<4.0"
+dependencies = [
+    "django>=4,<6",
+    "markupsafe==3.0.2",
+]
+
+[project.urls]
+Homepage = "https://github.com/dbca-wa/dbca-utils"
+Repository = "https://github.com/dbca-wa/dbca-utils.git"
+Changelog = "https://github.com/dbca-wa/dbca-utils/blob/master/CHANGELOG.md"
+GitHub = "https://github.com/dbca-wa/dbca-utils"
+
+[dependency-groups]
+dev = [
+    "pytest-django>=4.11.0",
+    "pytest-sugar>=1.0.0",
+    "tox>=4.25.0",
+    "tox-uv>=1.25.0",
+]
+
+[build-system]
+requires = [
+    "pdm-backend",
+]
+build-backend = "pdm.backend"
+
+[tool.uv]
+package = true
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ". src"
+python_files = "tests.py test_*.py"
+
+[tool.ruff]
+line-length = 140
+indent-width = 4
+
+[tool.ruff.lint]
+ignore = [
+    "E265",
+    "E501",
+    "E722",
+]

{dbca_utils-2.1.0 → dbca_utils-2.1.2}/src/dbca_utils/middleware.py

@@ -5,6 +5,7 @@ from django.contrib.auth.middleware import AuthenticationMiddleware, get_user
 from django.utils import timezone
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.functional import SimpleLazyObject
+from markupsafe import escape
 
 from dbca_utils.utils import env
 
@@ -13,18 +14,16 @@ LOCAL_USERGROUPS = env("LOCAL_USERGROUPS", default=[])
 User = get_user_model()
 
 
-def sync_usergroups(user, groups):
+def sync_usergroups(user, groups=None):
     from django.contrib.auth.models import Group
 
-    usergroups = (
-        [Group.objects.get_or_create(name=name)[0] for name in groups.split(",")]
-        if groups
-        else []
-    )
+    if groups:
+        usergroups = [Group.objects.get_or_create(name=name)[0] for name in groups.split(",")]
+    else:
+        usergroups = []
+
     usergroups.sort(key=lambda o: o.id)
-    existing_usergroups = list(
-        user.groups.exclude(name__in=LOCAL_USERGROUPS).order_by("id")
-    )
+    existing_usergroups = list(user.groups.exclude(name__in=LOCAL_USERGROUPS).order_by("id"))
     index1 = 0
     index2 = 0
     len1 = len(usergroups)
@@ -76,9 +75,7 @@ if ENABLE_AUTH2_GROUPS:
             existing_groups = request.session.get("usergroups")
             if groups != existing_groups:
                 # User group is changed.
-                request.user = SimpleLazyUser(
-                    lambda: get_user(request), request, groups
-                )
+                request.user = SimpleLazyUser(lambda: get_user(request), request, groups)
                 return
         original_process_request(self, request)
 
@@ -102,11 +99,7 @@ class SSOLoginMiddleware(MiddlewareMixin):
     def process_request(self, request):
         # Logout headers included with request.
         if (
-            (
-                request.path.startswith("/logout")
-                or request.path.startswith("/admin/logout")
-                or request.path.startswith("/ledger/logout")
-            )
+            (request.path.startswith("/logout") or request.path.startswith("/admin/logout") or request.path.startswith("/ledger/logout"))
             and "HTTP_X_LOGOUT_URL" in request.META
             and request.META["HTTP_X_LOGOUT_URL"]
         ):
@@ -114,18 +107,20 @@ class SSOLoginMiddleware(MiddlewareMixin):
             return http.HttpResponseRedirect(request.META["HTTP_X_LOGOUT_URL"])
 
         # Auth2 is not enabled, skip further processing.
-        if (
-            "HTTP_REMOTE_USER" not in request.META
-            or not request.META["HTTP_REMOTE_USER"]
-        ):
+        if "HTTP_REMOTE_USER" not in request.META or not request.META["HTTP_REMOTE_USER"]:
             # auth2 not enabled
             return
 
-        user_authenticated = request.user.is_authenticated
-
         # Auth2 is enabled.
-        # Request user is not authenticated.
-        if not user_authenticated:
+        # Security check: if the logged-in request user's email does not match the email
+        # returned from Auth2, invalidate the current request session and force a new session
+        # using the returned SSO values.
+        if request.user.is_authenticated and request.user.email != request.META["HTTP_X_EMAIL"]:
+            logout(request)
+
+        # Request user is not authenticated locally: obtain user attributes from the request.META dict
+        # returned by SSO.
+        if not request.user.is_authenticated:
             attributemap = {
                 "username": "HTTP_REMOTE_USER",
                 "last_name": "HTTP_X_LAST_NAME",
@@ -137,31 +132,28 @@ class SSOLoginMiddleware(MiddlewareMixin):
                 if value in request.META:
                     attributemap[key] = request.META[value]
 
+            # Sanitise first_name and last_name values, because end-users have control over these
+            # values and could conceivably inject malicious values into them (e.g. a XSS attack).
+            if "first_name" in attributemap:
+                attributemap["first_name"] = str(escape(attributemap["first_name"]))
+            if "last_name" in attributemap:
+                attributemap["last_name"] = str(escape(attributemap["last_name"]))
+
             # Optional setting: projects may define accepted user email domains either as
             # a list of strings, or a single string.
-            if (
-                hasattr(settings, "ALLOWED_EMAIL_SUFFIXES")
-                and settings.ALLOWED_EMAIL_SUFFIXES
-            ):
-                allowed = settings.ALLOWED_EMAIL_SUFFIXES
+            if hasattr(settings, "ALLOWED_EMAIL_SUFFIXES") and settings.ALLOWED_EMAIL_SUFFIXES:
                 if isinstance(settings.ALLOWED_EMAIL_SUFFIXES, str):
-                    allowed = [settings.ALLOWED_EMAIL_SUFFIXES]
-                if not any(
-                    [attributemap["email"].lower().endswith(x) for x in allowed]
-                ):
+                    allowed_email_suffixes = list(settings.ALLOWED_EMAIL_SUFFIXES)
+                else:
+                    allowed_email_suffixes = settings.ALLOWED_EMAIL_SUFFIXES
+                # If the user email suffix is not in the allowed list, return a 404 response.
+                if not any([attributemap["email"].lower().endswith(suffix) for suffix in allowed_email_suffixes]):
                     return http.HttpResponseForbidden()
 
-            if (
-                attributemap["email"]
-                and User.objects.filter(email__iexact=attributemap["email"]).exists()
-            ):
+            # Check for an existing User instance.
+            if attributemap["email"] and User.objects.filter(email__iexact=attributemap["email"]).exists():
                 user = User.objects.filter(email__iexact=attributemap["email"])[0]
-            elif (
-                User.__name__ != "EmailUser"
-                and User.objects.filter(
-                    username__iexact=attributemap["username"]
-                ).exists()
-            ):
+            elif User.__name__ != "EmailUser" and User.objects.filter(username__iexact=attributemap["username"]).exists():
                 user = User.objects.filter(username__iexact=attributemap["username"])[0]
             else:
                 user = User(last_login=timezone.localtime())
@@ -174,7 +166,7 @@ class SSOLoginMiddleware(MiddlewareMixin):
             # Log the user in.
             login(request, user)
 
-            # Synchronize the user groups
+            # Synchronize the user groups.
             if ENABLE_AUTH2_GROUPS and "HTTP_X_GROUPS" in request.META:
                 groups = request.META["HTTP_X_GROUPS"] or None
                 sync_usergroups(user, groups)

dbca_utils-2.1.2/tests/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class TestsConfig(AppConfig):
+    default_auto_field = "django.db.models.AutoField"
+    name = "tests"

dbca_utils-2.1.2/tests/migrations/0001_initial.py

@@ -0,0 +1,63 @@
+import django.db.models.deletion
+import django.utils.timezone
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="TestModel",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("effective_to", models.DateTimeField(blank=True, null=True)),
+                (
+                    "created",
+                    models.DateTimeField(
+                        default=django.utils.timezone.now, editable=False
+                    ),
+                ),
+                ("modified", models.DateTimeField(auto_now=True)),
+                ("name", models.CharField(max_length=64)),
+                (
+                    "creator",
+                    models.ForeignKey(
+                        blank=True,
+                        editable=False,
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="%(app_label)s_%(class)s_created",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "modifier",
+                    models.ForeignKey(
+                        blank=True,
+                        editable=False,
+                        null=True,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        related_name="%(app_label)s_%(class)s_modified",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+    ]

dbca_utils-2.1.2/tests/models.py

@@ -0,0 +1,11 @@
+from django.db import models
+
+from dbca_utils.models import ActiveMixin, ActiveMixinManager, AuditMixin
+
+
+class TestModel(ActiveMixin, AuditMixin):
+    name = models.CharField(max_length=64)
+    objects = ActiveMixinManager()
+
+    def __str__(self):
+        return self.name

dbca_utils-2.1.2/tests/settings.py

@@ -0,0 +1,46 @@
+SECRET_KEY = "secretkey"
+
+INSTALLED_APPS = [
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "tests",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "dbca_utils.middleware.SSOLoginMiddleware",
+]
+
+ROOT_URLCONF = "tests.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.debug",
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ]
+        },
+    }
+]
+
+DATABASES = {"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}}
+
+STATIC_URL = "/static/"
+
+DEFAULT_AUTO_FIELD = "django.db.models.AutoField"
+
+USE_TZ = True

dbca_utils-2.1.2/tests/templates/tests/test_model_list.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <title>{{ TITLE }}</title>
+    </head>
+    <body>
+        <ul>
+            {% for object in object_list %}<li>{{ object.name }}, {{ object.created|date:"r" }}</li>{% endfor %}
+        </ul>
+    </body>
+</html>

dbca_utils-2.1.2/tests/urls.py

@@ -0,0 +1,7 @@
+from django.urls import path
+
+from .views import TestModelListView
+
+urlpatterns = [
+    path("test-models/", TestModelListView.as_view(), name="test_model_list"),
+]

dbca_utils-2.1.2/tests/views.py

@@ -0,0 +1,16 @@
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.views.generic.list import ListView
+
+from dbca_utils.utils import env
+
+from .models import TestModel
+
+
+class TestModelListView(LoginRequiredMixin, ListView):
+    model = TestModel
+    template_name = "tests/test_model_list.html"
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context["TITLE"] = env("TEST_ENVIRONMENT_VAR")
+        return context

dbca_utils-2.1.0/PKG-INFO

@@ -1,111 +0,0 @@
-Metadata-Version: 2.4
-Name: dbca-utils
-Version: 2.1.0
-Summary: Utilities for DBCA Django apps
-Author-email: Rocky Chen <rocky.chen@dbca.wa.gov.au>, Ashley Felton <ashley.felton@dbca.wa.gov.au>
-Project-URL: Homepage, https://github.com/dbca-wa/dbca-utils
-Project-URL: Repository, https://github.com/dbca-wa/dbca-utils.git
-Project-URL: Changelog, https://github.com/dbca-wa/dbca-utils/blob/master/CHANGELOG.md
-Project-URL: GitHub, https://github.com/dbca-wa/dbca-utils
-Classifier: Framework :: Django
-Classifier: Framework :: Django :: 4.0
-Classifier: Framework :: Django :: 4.2
-Classifier: Framework :: Django :: 5.0
-Classifier: Framework :: Django :: 5.2
-Classifier: Environment :: Web Environment
-Classifier: Intended Audience :: Developers
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: License :: OSI Approved :: Apache Software License
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Software Development :: Libraries
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: <4.0,>=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: django<6,>=4
-Dynamic: license-file
-
-# Overview
-
-DBCA Django utility classes and functions.
-
-## Development
-
-The recommended way to set up this project for development is using
-[uv](https://docs.astral.sh/uv/)
-to install and manage a Python virtual environment.
-With uv installed, install the required Python version (see `pyproject.toml`). Example:
-
-    uv python install 3.12
-
-Change into the project directory and run:
-
-    uv python pin 3.12
-    uv sync
-
-Activate the virtualenv like so:
-
-    source .venv/bin/activate
-
-Run unit tests using `pytest` (or `tox`, to test against multiple Python versions):
-
-    pytest -sv
-    tox -v
-
-## Releases
-
-Tagged releases are built and pushed to PyPI automatically using a GitHub
-workflow in the project. Update the project version in `pyproject.toml` and
-tag the required commit with the same value to trigger a release. Packages
-can also be built and uploaded manually, if desired.
-
-Build the project locally using uv, [publish to the PyPI registry](https://docs.astral.sh/uv/guides/publish/#publishing-your-package)
-using the same tool if you require:
-
-    uv build
-    uv publish
-
-## Installation
-
-1. Install via pip/etc.: `pip install dbca-utils`
-
-## SSO Login Middleware
-
-This will automatically login and create users using headers from an upstream proxy (REMOTE_USER and some others).
-The logout view will redirect to a separate logout page which clears the SSO session.
-
-### Usage
-
-Add `dbca_utils.middleware.SSOLoginMiddleware` to `settings.MIDDLEWARE` (after both of
-`django.contrib.sessions.middleware.SessionMiddleware` and
-`django.contrib.auth.middleware.AuthenticationMiddleware`.
-Ensure that `AUTHENTICATION_BACKENDS` contains `django.contrib.auth.backends.ModelBackend`,
-as this middleware depends on it for retrieving the logged in user for a session.
-Note that the middleware will still work without it, but will reauthenticate the session
-on every request, and `request.user.is_authenticated` won't work properly/will be false.
-
-Example:
-
-```python
-MIDDLEWARE = [
-    ...,
-    'django.contrib.sessions.middleware.SessionMiddleware',
-    'django.contrib.auth.middleware.AuthenticationMiddleware',
-    'dbca_utils.middleware.SSOLoginMiddleware'
-    ...,
-]
-```
-
-## Audit model mixin
-
-`AuditMixin` is an extension of `Django.db.model.Model` that adds a number of additional fields:
-
-- `creator` - FK to `AUTH_USER_MODEL`, used to record the object creator
-- `modifier` - FK to `AUTH_USER_MODEL`, used to record who the object was last modified by
-- `created` - a timestamp that is set on initial object save
-- `modified` - an auto-updating timestamp (on each object save)

dbca_utils-2.1.0/pyproject.toml

@@ -1,52 +0,0 @@
-[project]
-name = "dbca-utils"
-version = "2.1.0"
-description = "Utilities for DBCA Django apps"
-authors = [
-  { name = "Rocky Chen", email = "rocky.chen@dbca.wa.gov.au" },
-  { name = "Ashley Felton", email = "ashley.felton@dbca.wa.gov.au" },
-]
-readme = "README.md"
-classifiers = [
-  "Framework :: Django",
-  "Framework :: Django :: 4.0",
-  "Framework :: Django :: 4.2",
-  "Framework :: Django :: 5.0",
-  "Framework :: Django :: 5.2",
-  "Environment :: Web Environment",
-  "Intended Audience :: Developers",
-  "Development Status :: 5 - Production/Stable",
-  "License :: OSI Approved :: Apache Software License",
-  "Programming Language :: Python",
-  "Programming Language :: Python :: 3",
-  "Programming Language :: Python :: 3.10",
-  "Programming Language :: Python :: 3.11",
-  "Programming Language :: Python :: 3.12",
-  "Programming Language :: Python :: 3.13",
-  "Topic :: Software Development :: Libraries",
-  "Topic :: Software Development :: Libraries :: Python Modules",
-]
-requires-python = ">=3.10,<4.0"
-dependencies = ["django>=4,<6"]
-
-[project.urls]
-Homepage = "https://github.com/dbca-wa/dbca-utils"
-Repository = "https://github.com/dbca-wa/dbca-utils.git"
-Changelog = "https://github.com/dbca-wa/dbca-utils/blob/master/CHANGELOG.md"
-GitHub = "https://github.com/dbca-wa/dbca-utils"
-
-[dependency-groups]
-dev = [
-  "pytest-django>=4.11.0",
-  "pytest-sugar>=1.0.0",
-  "tox>=4.25.0",
-  "tox-uv>=1.25.0",
-]
-
-[tool.pytest.ini_options]
-# https://pytest-django.readthedocs.io/en/latest/configuring_django.html#pyproject-toml-settings
-DJANGO_SETTINGS_MODULE = "tests.settings"
-# https://pytest-django.readthedocs.io/en/latest/managing_python_path.html#using-pytest-s-pythonpath-option
-pythonpath = ". src"
-# https://pytest-django.readthedocs.io/en/latest/faq.html#my-tests-are-not-being-found-why
-python_files = "tests.py test_*.py"

dbca_utils-2.1.0/setup.cfg

@@ -1,4 +0,0 @@
-[egg_info]
-tag_build = 
-tag_date = 0
-

dbca_utils-2.1.0/src/dbca_utils.egg-info/SOURCES.txt

@@ -1,13 +0,0 @@
-LICENSE
-README.md
-pyproject.toml
-src/dbca_utils/__init__.py
-src/dbca_utils/middleware.py
-src/dbca_utils/models.py
-src/dbca_utils/utils.py
-src/dbca_utils.egg-info/PKG-INFO
-src/dbca_utils.egg-info/SOURCES.txt
-src/dbca_utils.egg-info/dependency_links.txt
-src/dbca_utils.egg-info/requires.txt
-src/dbca_utils.egg-info/top_level.txt
-tests/tests.py

dbca_utils-2.1.0/src/dbca_utils.egg-info/dependency_links.txt

@@ -1 +0,0 @@
-

dbca_utils-2.1.0/src/dbca_utils.egg-info/requires.txt

@@ -1 +0,0 @@
-django<6,>=4

dbca_utils-2.1.0/src/dbca_utils.egg-info/top_level.txt

@@ -1 +0,0 @@
-dbca_utils