django-pfx 1.4.dev18__tar.gz → 1.4.dev24__tar.gz

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev18
+Version: 1.4.dev24
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-pfx
-Version: 1.4.dev18
+Version: 1.4.dev24
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/django_pfx.egg-info/SOURCES.txt

@@ -61,7 +61,9 @@ pfx/pfxcore/middleware/authentication.py
 pfx/pfxcore/middleware/locale.py
 pfx/pfxcore/middleware/profiling.py
 pfx/pfxcore/models/__init__.py
+pfx/pfxcore/models/abstract_pfx_base_user.py
 pfx/pfxcore/models/cache_mixins.py
+pfx/pfxcore/models/login_ban.py
 pfx/pfxcore/models/not_null_fields.py
 pfx/pfxcore/models/otp_user_mixin.py
 pfx/pfxcore/models/pfx_models.py
@@ -70,6 +72,8 @@ pfx/pfxcore/serializers/__init__.py
 pfx/pfxcore/serializers/json.py
 pfx/pfxcore/storage/__init__.py
 pfx/pfxcore/storage/s3_storage.py
+pfx/pfxcore/templates/registration/otp_code_email.txt
+pfx/pfxcore/templates/registration/otp_code_subject.txt
 pfx/pfxcore/templates/registration/password_reset_email.txt
 pfx/pfxcore/templates/registration/password_reset_subject.txt
 pfx/pfxcore/templates/registration/welcome_email.txt

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/default_settings.py

@@ -1,11 +1,16 @@
 PFX_TOKEN_SHORT_VALIDITY = {'hours': 12}
 PFX_TOKEN_LONG_VALIDITY = {'days': 30}
 PFX_TOKEN_OTP_VALIDITY = {'minutes': 15}
+PFX_HOTP_CODE_VALIDITY = 15
 
 PFX_COOKIE_DOMAIN = None
 PFX_COOKIE_SECURE = True
 PFX_COOKIE_SAMESITE = 'None'
 
+PFX_LOGIN_BAN_FAILED_NUMBER = 5
+PFX_LOGIN_BAN_SECONDS_START = 60
+PFX_LOGIN_BAN_SECONDS_STEP = 60
+
 PFX_OPENAPI_PATH = "doc/api/"
 PFX_OPENAPI_FILENAME = "openapi"
 PFX_OPENAPI_TEMPLATE = {}

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/locale/fr/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-03-28 11:03+0100\n"
+"POT-Creation-Date: 2024-04-08 13:51+0200\n"
 "PO-Revision-Date: 2021-06-22 23:31+0200\n"
 "Last-Translator: \n"
 "Language-Team: \n"
@@ -59,14 +59,42 @@ msgstr ""
 "Format non valide, il peut s’agir d’un nombre en heures, « 1:05 », « :05 », "
 "« 1h 5m », « 1.5h » ou « 30m »."
 
-#: models/otp_user_mixin.py:8
+#: models/login_ban.py:45
+msgid "Username"
+msgstr "Nom d’utilisateur"
+
+#: models/login_ban.py:46
+msgid "Failed counter"
+msgstr "Compteur d’échec"
+
+#: models/login_ban.py:47
+msgid "Last failed"
+msgstr "Dernier échec"
+
+#: models/login_ban.py:52
+msgid "Login ban"
+msgstr "Login banni"
+
+#: models/login_ban.py:53
+msgid "Login bans"
+msgstr "Login bannis"
+
+#: models/otp_user_mixin.py:10
 msgid "OTP secret token"
 msgstr "Jeton secret OTP"
 
-#: models/otp_user_mixin.py:11
+#: models/otp_user_mixin.py:13
 msgid "Temporary OTP secret token"
 msgstr "Jeton secret OTP temporaire"
 
+#: models/otp_user_mixin.py:14
+msgid "HOTP count"
+msgstr "Compte HOTP"
+
+#: models/otp_user_mixin.py:15
+msgid "HOTP expiry"
+msgstr "Expiration HOTP"
+
 #: models/pfx_models.py:14
 #, python-format
 msgid "%(model_name)s with this %(field_labels)s already exists."
@@ -92,6 +120,41 @@ msgstr "{key} doit être une date."
 msgid "{key} must be “true”, “false”, “1”, “0” or empty."
 msgstr "{key} doit être « true », « false », « 1 », « 0 » ou vide"
 
+#: templates/registration/otp_code_email.txt:2
+#, python-format
+msgid ""
+"You're receiving this email because you requested an authentication code at "
+"%(site_name)s."
+msgstr ""
+"Vous recevez cet e-mail parce que vous avez demandé un code d’authentication "
+"sur %(site_name)s."
+
+#: templates/registration/otp_code_email.txt:4
+msgid "Authentication code:"
+msgstr "Code d’authentication :"
+
+#: templates/registration/otp_code_email.txt:6
+#, python-format
+msgid "This code is valid for %(otp_validity)s minutes."
+msgstr "Ce code est valable durant %(otp_validity)s minutes."
+
+#: templates/registration/otp_code_email.txt:8
+#: templates/registration/password_reset_email.txt:10
+#: templates/registration/welcome_email.txt:10
+msgid "Thanks for using our site!"
+msgstr "Merci d'utiliser notre site !"
+
+#: templates/registration/otp_code_email.txt:10
+#: templates/registration/password_reset_email.txt:12
+#: templates/registration/welcome_email.txt:12
+#, python-format
+msgid "The %(site_name)s team"
+msgstr "L'équipe de %(site_name)s"
+
+#: templates/registration/otp_code_subject.txt:2
+msgid "New authentication code for %(site_name)s"
+msgstr "Nouveau code d’authentication pour %(site_name)s"
+
 #: templates/registration/password_reset_email.txt:2
 #, python-format
 msgid ""
@@ -113,17 +176,6 @@ msgstr ""
 msgid "Your username, in case you've forgotten:"
 msgstr "Votre nom d'utilisateur, au cas où vous l'auriez oublié :"
 
-#: templates/registration/password_reset_email.txt:10
-#: templates/registration/welcome_email.txt:10
-msgid "Thanks for using our site!"
-msgstr "Merci d'utiliser notre site !"
-
-#: templates/registration/password_reset_email.txt:12
-#: templates/registration/welcome_email.txt:12
-#, python-format
-msgid "The %(site_name)s team"
-msgstr "L'équipe de %(site_name)s"
-
 #: templates/registration/password_reset_subject.txt:2
 #, python-format
 msgid "Password reset on %(site_name)s"
@@ -139,43 +191,52 @@ msgstr "Bienvenue sur %(site_name)s."
 msgid "Welcome on %(site_name)s"
 msgstr "Bienvenue sur %(site_name)s"
 
-#: views/authentication_views.py:221 views/authentication_views.py:378
+#: views/authentication_views.py:82
+#, python-brace-format
+msgid ""
+"Your connection is temporarily disabled after several unsuccessful attempts, "
+"please retry in {seconds} seconds."
+msgstr ""
+"Votre connexion est temporairement désactivée après plusieurs tentatives "
+"infructueuses, veuillez réessayer dans {seconds} secondes."
+
+#: views/authentication_views.py:244 views/authentication_views.py:407
 msgid "password updated successfully"
 msgstr "le mot de passe a été mis à jour avec succès"
 
-#: views/authentication_views.py:226
+#: views/authentication_views.py:249
 msgid "Incorrect password"
 msgstr "Mot de passe incorrect"
 
-#: views/authentication_views.py:229 views/authentication_views.py:387
+#: views/authentication_views.py:252 views/authentication_views.py:416
 msgid "Empty password is not allowed"
 msgstr "Un mot de passe vide n’est pas autorisé"
 
-#: views/authentication_views.py:313
+#: views/authentication_views.py:341
 msgid "User and token are valid"
 msgstr "L'utilisateur et le token sont valides"
 
-#: views/authentication_views.py:315
+#: views/authentication_views.py:343
 msgid "User or token is invalid"
 msgstr "L'utilisateur ou le token est invalide"
 
-#: views/authentication_views.py:420
+#: views/authentication_views.py:449
 msgid "OTP is already activated"
 msgstr "L'OTP est déjà activé"
 
-#: views/authentication_views.py:458
+#: views/authentication_views.py:487
 msgid "OTP is activated"
 msgstr "L'OTP est activé"
 
-#: views/authentication_views.py:459 views/authentication_views.py:493
+#: views/authentication_views.py:488 views/authentication_views.py:522
 msgid "Invalid OTP code"
 msgstr "Code OTP invalide"
 
-#: views/authentication_views.py:492
+#: views/authentication_views.py:521
 msgid "OTP is disabled"
 msgstr "L'OTP est désactivé"
 
-#: views/authentication_views.py:740
+#: views/authentication_views.py:777
 msgid ""
 "If the email address you entered is correct, you will receive an email from "
 "us with instructions to reset your password."
@@ -184,6 +245,10 @@ msgstr ""
 "un courrier électronique de notre part contenant des instructions pour "
 "réinitialiser votre mot de passe."
 
+#: views/authentication_views.py:845
+msgid "A new authentication code has been sent by email."
+msgstr "Un nouveau code d'authentification a été envoyé par e-mail."
+
 #: views/filters_views.py:79
 #, python-brace-format
 msgid "Invalid value for {filter} filter"

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/middleware/authentication.py

@@ -32,25 +32,29 @@ class JWTTokenDecodeMixin:
     @classmethod
     def decode_jwt(cls, token, otp_login=False):
         try:
+            headers = jwt.get_unverified_header(token)
+            if 'pfx_user_pk' not in headers:
+                raise jwt.InvalidTokenError(
+                    "Missing pfx_user_pk in token headers")
+            user = cls.get_cached_user(headers['pfx_user_pk'])
             decoded = jwt.decode(
-                token, settings.PFX_SECRET_KEY,
+                token,
+                user.get_user_jwt_signature_key() + settings.PFX_SECRET_KEY,
                 options=dict(require=["exp"]),
                 algorithms="HS256")
-            user = cls.get_cached_user(decoded['pfx_user_pk'])
             if 'otp_login' in decoded:
                 if otp_login:
                     return user, *decoded['otp_login']
                 raise jwt.InvalidTokenError(
                     "This token is reserved for OTP login")
             return user
-        except get_user_model().DoesNotExist:
-            raise
-        except DecodeError as e:
-            logger.exception(e)
-            raise
-        except jwt.ExpiredSignatureError:
+        except (get_user_model().DoesNotExist, jwt.ExpiredSignatureError,
+                jwt.InvalidTokenError, jwt.InvalidSignatureError) as e:
+            # Log these exceptions only in debug mode
+            logger.debug(e, exc_info=True)
             raise
-        except Exception as e:  # pragma: no cover
+        except (DecodeError, Exception) as e:
+            # Always logs unexpected exceptions
             logger.exception(e)
             raise
 

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/models/__init__.py

@@ -1,4 +1,6 @@
+from .abstract_pfx_base_user import AbstractPFXBaseUser
 from .cache_mixins import CacheableMixin, CacheDependsMixin
+from .login_ban import LoginBan
 from .not_null_fields import (
     NotNullCharField,
     NotNullTextField,

django-pfx-1.4.dev24/pfx/pfxcore/models/abstract_pfx_base_user.py

@@ -0,0 +1,15 @@
+from django.contrib.auth.models import AbstractBaseUser
+
+
+class AbstractPFXBaseUser(AbstractBaseUser):
+    class Meta:
+        abstract = True
+
+    def get_user_jwt_signature_key(self):
+        """
+        Return a user secret to sign JWT token.
+
+        If not empty, the JWT token validity depends on all values
+        user to build the return string.
+        """
+        return self.password

django-pfx-1.4.dev24/pfx/pfxcore/models/login_ban.py

@@ -0,0 +1,60 @@
+from datetime import timedelta
+
+from django.db import models
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from pfx.pfxcore.settings import PFXSettings
+
+settings = PFXSettings()
+
+
+class LoginBanQuerySet(models.QuerySet):
+    def is_ban(self, username):
+        if not username or settings.PFX_LOGIN_BAN_FAILED_NUMBER == 0:
+            return False
+        try:
+            ban = self.get(username=username)
+        except LoginBan.DoesNotExist:
+            return False
+        if ban.failed_counter % settings.PFX_LOGIN_BAN_FAILED_NUMBER == 0:
+            seconds = settings.PFX_LOGIN_BAN_SECONDS_START + (
+                settings.PFX_LOGIN_BAN_SECONDS_STEP * (ban.failed_counter - 1))
+            ban_time = ban.last_failed + timedelta(seconds=seconds)
+            now = timezone.now()
+            if now < ban_time:
+                return ban_time - now
+        return False
+
+    def ban(self, username):
+        if not username:
+            return
+        try:
+            ban = self.get(username=username)
+            ban.save()
+        except LoginBan.DoesNotExist:
+            LoginBan.objects.create(username=username)
+
+    def unban(self, username):
+        if not username:
+            return
+        self.filter(username=username).delete()
+
+
+class LoginBan(models.Model):
+    username = models.CharField(_("Username"), max_length=150, unique=True)
+    failed_counter = models.IntegerField(_("Failed counter"))
+    last_failed = models.DateTimeField(_("Last failed"), auto_now=True)
+
+    objects = LoginBanQuerySet.as_manager()
+
+    class Meta:
+        verbose_name = _("Login ban")
+        verbose_name_plural = _("Login bans")
+
+    def __str__(self):
+        return self.username
+
+    def save(self, *args, **kwargs):
+        self.failed_counter = (self.failed_counter or 0) + 1
+        return super().save(*args, **kwargs)

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/models/otp_user_mixin.py

@@ -1,7 +1,13 @@
-from django.conf import settings
+from datetime import timedelta
+
 from django.db import models
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 
+from pfx.pfxcore.settings import PFXSettings
+
+settings = PFXSettings()
+
 
 class OtpUserMixin(models.Model):
     otp_secret_token = models.CharField(
@@ -9,6 +15,8 @@ class OtpUserMixin(models.Model):
         blank=True, unique=True)
     otp_secret_token_tmp = models.CharField(
         _("Temporary OTP secret token"), max_length=32, null=True, blank=True)
+    hotp_count = models.IntegerField(_("HOTP count"), default=0)
+    hotp_expiry = models.DateTimeField(_("HOTP expiry"), default=timezone.now)
 
     class Meta:
         abstract = True
@@ -41,4 +49,25 @@ class OtpUserMixin(models.Model):
     def is_otp_valid(self, otp_code, tmp=False):
         import pyotp
         totp = pyotp.parse_uri(self.get_otp_setup_uri(tmp=tmp))
-        return totp.verify(otp_code)
+        valid = totp.verify(otp_code)
+        if not valid and timezone.now() <= self.hotp_expiry:
+            hotp = pyotp.hotp.HOTP(
+                tmp and self.otp_secret_token_tmp or
+                self.otp_secret_token)
+            return hotp.verify(otp_code, self.hotp_count)
+        return valid
+
+    def get_user_jwt_signature_key(self):
+        return super().get_user_jwt_signature_key() + (
+            self.otp_secret_token or "")
+
+    def get_hotp_code(self):
+        import pyotp
+        if not self.otp_secret_token:
+            raise Exception("OTP disabled")
+        self.hotp_count += 1
+        self.hotp_expiry = timezone.now() + timedelta(
+            minutes=settings.PFX_HOTP_CODE_VALIDITY)
+        self.save(update_fields=[
+            'hotp_count', 'hotp_expiry'])
+        return pyotp.hotp.HOTP(self.otp_secret_token).at(self.hotp_count)

django-pfx-1.4.dev24/pfx/pfxcore/templates/registration/otp_code_email.txt

@@ -0,0 +1,12 @@
+{% load i18n %}{% autoescape off %}
+{% blocktrans %}You're receiving this email because you requested an authentication code at {{ site_name }}.{% endblocktrans %}
+
+{% trans "Authentication code:" %} {{ otp_code }}
+
+{% blocktrans %}This code is valid for {{ otp_validity }} minutes.{% endblocktrans %}
+
+{% trans "Thanks for using our site!" %}
+
+{% blocktrans %}The {{ site_name }} team{% endblocktrans %}
+
+{% endautoescape %}

django-pfx-1.4.dev24/pfx/pfxcore/templates/registration/otp_code_subject.txt

@@ -0,0 +1,3 @@
+{% load i18n %}{% autoescape off %}
+{% blocktrans %}New authentication code for {{ site_name }}{% endblocktrans %}
+{% endautoescape %}

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/urls.py

@@ -4,4 +4,5 @@ urlpatterns = register_views(
     views.LocaleRestView,
     views.AuthenticationView,
     views.SignupView,
-    views.ForgottenPasswordView)
+    views.ForgottenPasswordView,
+    views.OtpEmailView)

{django-pfx-1.4.dev18 → django-pfx-1.4.dev24}/pfx/pfxcore/views/__init__.py

@@ -1,6 +1,7 @@
 from .authentication_views import (
     AuthenticationView,
     ForgottenPasswordView,
+    OtpEmailView,
     SendMessageTokenMixin,
     SignupView,
 )