django-hidp 2.0.0__tar.gz → 2.0.0.dev0__tar.gz

{django_hidp-2.0.0 → django_hidp-2.0.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-hidp
-Version: 2.0.0
+Version: 2.0.0.dev0
 Summary: Full-featured authentication system for Django projects
 Author: Jaap Roes, Dennis Bunskoek, Ramon de Jezus, Thomas Kalverda, Wouter de Vries
 Author-email: Jaap Roes <jroes@leukeleu.nl>, Dennis Bunskoek <dbunskoek@leukeleu.nl>, Ramon de Jezus <rdejezus@leukeleu.nl>, Thomas Kalverda <tkalverda@leukeleu.nl>, Wouter de Vries <wdevries@leukeleu.nl>
@@ -11,13 +11,15 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Framework :: Django
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3
-Requires-Dist: django>=4.2
+Requires-Dist: django>=5.2
 Requires-Dist: django-ratelimit>=4.1.0,<5
 Requires-Dist: jwcrypto>=1.5,<2
 Requires-Dist: requests>=2.32,<3
-Requires-Dist: django-hidp[oidc-provider,otp] ; extra == 'all'
-Requires-Dist: django-oauth-toolkit>=3.0.1 ; extra == 'oidc-provider'
-Requires-Dist: djangorestframework>=3.15.2 ; extra == 'oidc-provider'
+Requires-Dist: django-hidp[api,oidc-provider,otp] ; extra == 'all'
+Requires-Dist: djangorestframework>=3.15.2 ; extra == 'api'
+Requires-Dist: drf-spectacular>=0.28.0 ; extra == 'api'
+Requires-Dist: django-hidp[api] ; extra == 'oidc-provider'
+Requires-Dist: django-oauth-toolkit>=3.4.1 ; extra == 'oidc-provider'
 Requires-Dist: django-otp>=1.5.0 ; extra == 'otp'
 Requires-Dist: segno>=1.3.0 ; extra == 'otp'
 Requires-Dist: django-hidp[otp] ; extra == 'recommended'
@@ -27,6 +29,7 @@ Project-URL: Repository, https://github.com/leukeleu/django-hidp/
 Project-URL: Issues, https://github.com/leukeleu/django-hidp/issues
 Project-URL: Releasenotes, https://github.com/leukeleu/django-hidp/releases
 Provides-Extra: all
+Provides-Extra: api
 Provides-Extra: oidc-provider
 Provides-Extra: otp
 Provides-Extra: recommended

{django_hidp-2.0.0 → django_hidp-2.0.0.dev0}/hidp/accounts/email_change.py

@@ -42,3 +42,37 @@ def remove_complete_and_stale_email_change_requests(*, days=7, dry_run=False):
         complete_and_stale_email_change_requests.delete()
 
     return complete_and_stale_email_change_requests_count
+
+
+def get_pending_email_change_request(user, *, token_generator):
+    """Return the unexpired email change request of `user` that is not yet complete."""
+    return (
+        EmailChangeRequest.objects.filter(
+            user=user,
+            created_at__gte=(
+                timezone.now() - timedelta(seconds=token_generator.token_timeout)
+            ),
+        )
+        .exclude(confirmed_by_current_email=True, confirmed_by_proposed_email=True)
+        .first()
+    )
+
+
+def get_email_change_request_from_token_data(user, token_data):
+    """
+    Return the email change request of `user` that `token_data` confirms.
+
+    Returns `None` when the token is malformed, or the request is already confirmed
+    for the recipient of the token.
+    """
+    if (
+        not isinstance(token_data, dict)
+        or set(token_data) != {"recipient", "uuid"}
+        or token_data["recipient"] not in set(Recipient)
+    ):
+        return None
+    return (
+        EmailChangeRequest.objects.filter(id=token_data["uuid"], user=user)
+        .exclude(**{f"confirmed_by_{token_data['recipient']}": True})
+        .first()
+    )

{django_hidp-2.0.0 → django_hidp-2.0.0.dev0}/hidp/accounts/email_verification.py

@@ -2,6 +2,7 @@ from datetime import timedelta
 from urllib.parse import urlencode
 
 from django.contrib.auth import get_user_model
+from django.db.models.functions import MD5
 from django.urls import reverse
 from django.utils import timezone
 
@@ -22,11 +23,11 @@ def get_email_verification_required_url(user, *, next_url=""):
     return url
 
 
-def get_verify_email_url(user, *, next_url=""):
+def get_verify_email_url(token, *, next_url=""):
     url = reverse(
         "hidp_accounts:verify_email",
         kwargs={
-            "token": tokens.email_verification_token_generator.make_token(user),
+            "token": token,
         },
     )
     if next_url:
@@ -34,6 +35,24 @@ def get_verify_email_url(user, *, next_url=""):
     return url
 
 
+def get_unverified_user_from_token(token, *, token_generator):
+    """
+    Return the active, unverified user identified by an email verification token.
+
+    Returns `None` if the token is invalid or expired, or if no such user exists.
+    """
+    email_hash = token_generator.check_token(token) if token else None
+    if email_hash is None:
+        return None
+    return (
+        UserModel.objects.email_unverified()
+        .filter(is_active=True)
+        .annotate(email_hash=MD5("email"))
+        .filter(email_hash=email_hash)
+        .first()
+    )
+
+
 def remove_stale_unverified_accounts(*, days=90, dry_run=False):
     """
     Remove accounts that are not verified within a given number of days after creation.

django_hidp-2.0.0.dev0/hidp/accounts/flows.py

@@ -0,0 +1,129 @@
+"""Account side effects shared by the HTML views and the API."""
+
+import logging
+
+from datetime import timedelta
+
+from django.contrib.auth import get_user_model, update_session_auth_hash
+from django.db import IntegrityError, transaction
+from django.utils import timezone
+
+from . import auth as hidp_auth
+from .email_change import Recipient
+
+logger = logging.getLogger(__name__)
+UserModel = get_user_model()
+
+REAUTHENTICATION_DELTA = timedelta(minutes=5)
+
+
+def register(form):
+    """
+    Save the user of a valid `UserCreationForm`.
+
+    Returns the existing user when the email address is taken, so the caller can
+    respond the same way whether or not an account exists.
+    """
+    try:
+        with transaction.atomic():
+            return form.save()
+    except IntegrityError:
+        return UserModel.objects.get(email__iexact=form.cleaned_data["email"])
+
+
+def send_registration_email(user, *, verification_mailer, account_exists_mailer):
+    """Send the verification email, or tell an existing user they have an account."""
+    try:
+        if not user.email_verified:
+            verification_mailer(user).send()
+        elif user.is_active:
+            account_exists_mailer(user).send()
+    except Exception:
+        # Do not leak the existence of the user.
+        logger.exception("Failed to send verification email.")
+
+
+def send_verification_email(user, *, verification_mailer):
+    """
+    Send the email verification email, logging a failure instead of raising it.
+
+    A failed send must not fail the request of a user who is waiting for the
+    email, such as a login with valid credentials.
+    """
+    try:
+        verification_mailer(user).send()
+    except Exception:
+        logger.exception("Failed to send verification email.")
+
+
+def login(request, user):
+    """Log in a user with a verified email address, and return whether it did."""
+    if user.email_verified:
+        hidp_auth.login(request, user)
+        return True
+    return False
+
+
+def send_password_reset_email(user, *, password_reset_mailer, set_password_mailer):
+    """Send a password reset link, or a set password link to a user without one."""
+    mailer = (
+        password_reset_mailer if user.has_usable_password() else set_password_mailer
+    )
+    try:
+        mailer(user).send()
+    except Exception:
+        # Do not leak the existence of the user.
+        logger.exception("Failed to send password (re)set email.")
+
+
+def change_password(request, form):
+    """Save the new password of a valid password form, keeping the session valid."""
+    user = form.save()
+    update_session_auth_hash(request, user)
+    return user
+
+
+def requires_reauthentication(user, *, delta=REAUTHENTICATION_DELTA):
+    """Whether `user` must log in again before setting a password."""
+    return user.last_login is None or user.last_login < timezone.now() - delta
+
+
+def send_email_change_emails(
+    user,
+    email_change_request,
+    *,
+    email_change_request_mailer,
+    proposed_email_exists_mailer,
+):
+    """
+    Ask the current and proposed email addresses to confirm the change.
+
+    An existing account at the proposed address is told so, unless it is inactive.
+    """
+    email_change_request_mailer(
+        user,
+        email_change_request=email_change_request,
+        recipient=Recipient.CURRENT_EMAIL,
+    ).send()
+
+    existing_user = UserModel.objects.filter(
+        email__iexact=email_change_request.proposed_email
+    ).first()
+    if existing_user and not existing_user.is_active:
+        return
+    mailer = (
+        proposed_email_exists_mailer if existing_user else email_change_request_mailer
+    )
+    mailer(
+        user,
+        email_change_request=email_change_request,
+        recipient=Recipient.PROPOSED_EMAIL,
+    ).send()
+
+
+def confirm_email_change(form):
+    """Save a valid `EmailChangeConfirmForm`, or return `None` if the email is taken."""
+    try:
+        return form.save()
+    except IntegrityError:
+        return None

{django_hidp-2.0.0 → django_hidp-2.0.0.dev0}/hidp/accounts/mailers.py

@@ -7,6 +7,7 @@ from django.urls import reverse
 from django.utils.encoding import force_bytes
 from django.utils.http import urlsafe_base64_encode
 
+from ..utils import add_query_params
 from . import email_verification, tokens
 from .email_change import Recipient
 
@@ -93,16 +94,27 @@ class EmailVerificationMailer(BaseMailer):
     email_template_name = "hidp/accounts/verification/email/verification_body.txt"
     html_email_template_name = "hidp/accounts/verification/email/verification_body.html"
 
-    def __init__(self, user, *, base_url, post_verification_redirect=None):
+    def __init__(
+        self, user, *, base_url, post_verification_redirect=None, verification_url=None
+    ):
         super().__init__(base_url=base_url)
         self.user = user
         self.post_verification_redirect = post_verification_redirect
+        self.verification_url = verification_url
 
     def get_verification_url(self):
+        token = tokens.email_verification_token_generator.make_token(self.user)
+
+        if self.verification_url:
+            return add_query_params(
+                self.verification_url.format(token=token),
+                next=self.post_verification_redirect or None,
+            )
+
         return urljoin(
             self.base_url,
             email_verification.get_verify_email_url(
-                self.user,
+                token=token,
                 next_url=self.post_verification_redirect,
             ),
         )
@@ -129,12 +141,15 @@ class AccountExistsMailer(BaseMailer):
         "hidp/accounts/verification/email/account_exists_body.html"
     )
 
-    def __init__(self, user, *, base_url):
+    def __init__(self, user, *, base_url, password_reset_url=None):
         super().__init__(base_url=base_url)
         self.user = user
+        self.password_reset_url = password_reset_url
 
     def get_password_reset_url(self):
-        return urljoin(self.base_url, reverse("hidp_accounts:password_reset_request"))
+        return self.password_reset_url or urljoin(
+            self.base_url, reverse("hidp_accounts:password_reset_request")
+        )
 
     def get_context(self, extra_context=None):
         return super().get_context(
@@ -155,9 +170,10 @@ class PasswordResetRequestMailer(BaseMailer):
     html_email_template_name = "hidp/accounts/recovery/email/password_reset_body.html"
     token_generator = default_token_generator
 
-    def __init__(self, user, *, base_url):
+    def __init__(self, user, *, base_url, password_reset_url=None):
         super().__init__(base_url=base_url)
         self.user = user
+        self.password_reset_url = password_reset_url
 
     def get_password_reset_url(self):
         """
@@ -166,13 +182,19 @@ class PasswordResetRequestMailer(BaseMailer):
         Returns:
             An absolute URL to the password reset page for the given user.
         """
+        uidb64 = urlsafe_base64_encode(force_bytes(self.user.pk))
+        token = self.token_generator.make_token(self.user)
+
+        if self.password_reset_url:
+            return self.password_reset_url.format(uidb64=uidb64, token=token)
+
         return urljoin(
             self.base_url,
             reverse(
                 "hidp_accounts:password_reset",
                 kwargs={
-                    "uidb64": urlsafe_base64_encode(force_bytes(self.user.pk)),
-                    "token": self.token_generator.make_token(self.user),
+                    "uidb64": uidb64,
+                    "token": token,
                 },
             ),
         )
@@ -198,12 +220,15 @@ class SetPasswordMailer(BaseMailer):
     email_template_name = "hidp/accounts/recovery/email/set_password_body.txt"
     html_email_template_name = "hidp/accounts/recovery/email/set_password_body.html"
 
-    def __init__(self, user, *, base_url):
+    def __init__(self, user, *, base_url, set_password_url=None):
         super().__init__(base_url=base_url)
         self.user = user
+        self.set_password_url = set_password_url
 
     def get_set_password_url(self):
-        return urljoin(self.base_url, reverse("hidp_account_management:set_password"))
+        return self.set_password_url or urljoin(
+            self.base_url, reverse("hidp_account_management:set_password")
+        )
 
     def get_context(self, extra_context=None):
         return super().get_context(
@@ -227,12 +252,15 @@ class PasswordChangedMailer(BaseMailer):
         "hidp/accounts/management/email/password_changed_body.html"
     )
 
-    def __init__(self, user, *, base_url):
+    def __init__(self, user, *, base_url, password_reset_url=None):
         super().__init__(base_url=base_url)
         self.user = user
+        self.password_reset_url = password_reset_url
 
     def get_password_reset_url(self):
-        return urljoin(self.base_url, reverse("hidp_accounts:password_reset_request"))
+        return self.password_reset_url or urljoin(
+            self.base_url, reverse("hidp_accounts:password_reset_request")
+        )
 
     def get_context(self, extra_context=None):
         return super().get_context(
@@ -252,28 +280,43 @@ class EmailChangeRequestMailer(BaseMailer):
     email_template_name = "hidp/accounts/management/email/email_change_body.txt"
     html_email_template_name = "hidp/accounts/management/email/email_change_body.html"
 
-    def __init__(self, user, *, base_url, email_change_request, recipient):
+    def __init__(
+        self,
+        user,
+        *,
+        base_url,
+        email_change_request,
+        recipient,
+        confirmation_url=None,
+        cancel_url=None,
+    ):
         super().__init__(base_url=base_url)
         self.user = user
         self.email_change_request = email_change_request
         self.recipient = recipient
+        self.confirmation_url = confirmation_url
+        self.cancel_url = cancel_url
 
     def get_confirmation_url(self):
+        token = tokens.email_change_token_generator.make_token(
+            str(self.email_change_request.pk), self.recipient
+        )
+
+        if self.confirmation_url:
+            return self.confirmation_url.format(token=token)
+
         return urljoin(
             self.base_url,
             reverse(
                 "hidp_account_management:email_change_confirm",
-                kwargs={
-                    "token": (
-                        tokens.email_change_token_generator.make_token(
-                            str(self.email_change_request.pk), self.recipient
-                        )
-                    )
-                },
+                kwargs={"token": token},
             ),
         )
 
     def get_cancel_url(self):
+        if self.cancel_url:
+            return self.cancel_url
+
         return urljoin(
             self.base_url,
             reverse("hidp_account_management:email_change_cancel"),