django-restit 4.1.75__py3-none-any.whl → 4.1.77__py3-none-any.whl

account/migrations/0017_rename_requires_topt_member_requires_totp.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.1.4 on 2023-11-28 23:26
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0016_authsession_buid'),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name='member',
+            old_name='requires_topt',
+            new_name='requires_totp',
+        ),
+    ]

account/models/member.py

@@ -68,7 +68,7 @@ class User(AbstractUser, RestModel):
 class Member(User, RestModel, MetaDataModel):
     class RestMeta:
         NO_SHOW_FIELDS = ["password", "auth_code", "security_token"]
-        SEARCH_FIELDS = ["username", "email", "first_name", "last_name", "display_name"]
+        SEARCH_FIELDS = ["username", "email", "first_name", "last_name", "display_name", "phone_number"]
         VIEW_PERMS = ["view_members", "manage_members", "manage_users", "owner"]
         SAVE_PERMS = ["invite_members", "manage_members", "manage_users", "owner"]
         LIST_DEFAULT_FILTERS = {
@@ -125,13 +125,13 @@ class Member(User, RestModel, MetaDataModel):
                     'is_blocked',
                     'is_staff',
                     'is_superuser',
-                    'requires_topt',
+                    'requires_totp',
                     'last_login',
                     'last_activity',
                     ('date_joined', 'created'),
                     ("hasLoggedIn", "has_logged_in"),
                     'avatar',
-                    'has_topt',
+                    'has_totp',
                     'auth_token'
                 ],
                 "extra": ["metadata", "password_expires_in"],
@@ -152,7 +152,7 @@ class Member(User, RestModel, MetaDataModel):
 
     password_changed = models.DateTimeField(blank=True, null=True, default=None)
     last_activity = models.DateTimeField(blank=True, null=True, default=None)
-    requires_topt = models.BooleanField(blank=True, null=True, default=False)
+    requires_totp = models.BooleanField(blank=True, null=True, default=False)
 
     def __str__(self):
         return self.username
@@ -214,9 +214,10 @@ class Member(User, RestModel, MetaDataModel):
         return None
 
     @property
-    def has_topt(self):
-        token = self.getSecretProperty("totp_token", default=None)
-        return token is not None
+    def has_totp(self):
+        token = self.getProperty("totp_token", category="secrets", default=None)
+        verified = self.getProperty("totp_verified", default=False)
+        return token is not None and verified
 
     @property
     def password_expires_in(self):
@@ -667,7 +668,7 @@ class Member(User, RestModel, MetaDataModel):
 
     # time based one time passwords / GOOGLE Authenticator
     def totp_getSecret(self, reset=False):
-        token = self.getProperty("totp_token", category="secrets", default=None)
+        token = self.getSecretProperty("totp_token", default=None)
         if token is None or reset:
             token = pyotp.random_base32()
             self.setProperty("totp_token", token, category="secrets")

account/periodic.py

@@ -8,9 +8,9 @@ from sessionlog.models import SessionLog
 def run_cleanup_tokens(force=False, verbose=False, now=None):
     # we want to nuke invite tokens every 15 minutes
     # we do not want to do this if using invite
-    stale = datetime.now() - timedelta(hours=24)
-    qset = Member.objects.filter(auth_token__isnull=False).filter(modified__lte=stale)
-    qset.update(auth_token=None)
+    stale = datetime.now() - timedelta(hours=48)
+    qset = Member.objects.filter(auth_code__isnull=False).filter(modified__lte=stale)
+    qset.update(auth_code=None)
 
     # lets prune old non active sessions
     SessionLog.Clean(limit=10000)

account/rpc/auth.py

@@ -38,13 +38,24 @@ def jwt_login(request):
         return restStatus(request, False, error="Password and/or Username is incorrect", error_code=422)
     password = request.DATA.get('password', None)
     member.canLogin(request)  # throws exception if cannot login
+    if member.requires_totp:
+        resp = checkForTOTP(request, member)
+        if resp is not None:
+            return resp
     if not member.login(request=request, password=password, use_jwt=True):
         member.log("login_failed", "incorrect password", request, method="login", level=31)
-        return restStatus(request, False, error="Password or Username is incorrect", error_code=401)
+        return restStatus(request, False, error="Invalid Credentials", error_code=401)
+    return on_complete_jwt(request, member)
+
+
+def on_complete_jwt(request, member):
     if member.security_token is None or member.security_token == JWT_KEY:
         member.refreshSecurityToken()
-    member.log("jwt_login", "jwt login succesful", request, method="login", level=7)
-    
+
+    member.log(
+        "jwt_login", "jwt login succesful", 
+        request, method="login", level=7)
+
     device_id = request.DATA.get(["device_id", "deviceID"])
     token = JWToken(user_id=member.pk, key=member.security_token, device_id=device_id)
 
@@ -58,7 +69,12 @@ def jwt_login(request):
         am.MemberDevice.register(request, member, device_id)
     
     request.jwt_token = token.access_token  # this tells the middleware to store in cookie
-    return restGet(request, dict(access=token.access_token, refresh=token.refresh_token, id=member.pk))
+    return restGet(
+        request, 
+        dict(
+            access=token.access_token,
+            refresh=token.refresh_token,
+            id=member.pk))
 
 
 @rd.urlPOST(r'^jwt/logout$')
@@ -107,19 +123,38 @@ def getMemberByUsername(username):
     return member
 
 
+def checkForTOTP(request, member):
+    if not member.has_totp and not member.phone_number:
+        member.reportIncident(
+            "account", f"{member.username} TOTP not set", level=8,
+            error_code=455,
+            request=request)
+        return None
+    if not member.has_totp:
+        # we have a phone number so tell them to login with code
+        # they will need to request a code
+        return restStatus(
+            request, False, error=member.phone_number[-4:],
+            error_code=454)
+    totp_code = request.DATA.get("totp_code", None)
+    if totp_code is None:
+        # member.log("login_blocked", "requires MFA (TOTP)", request, method="login", level=31)
+        return restStatus(request, False, error="Requires MFA (TOTP)", error_code=455)
+    if not member.totp_verify(totp_code):
+        member.log("login_blocked", "Invalid MFA code", request, method="login", level=31)
+        return restStatus(request, False, error="Invalid Credentials", error_code=456)
+    return None
+
+
 def member_login_uname_pword(request, username, password):
     member = getMemberByUsername(username)
     if not member:
         return restStatus(request, False, error="Password or Username is not correct", error_code=422)
     member.canLogin(request)  # throws exception if cannot login
     if member.requires_topt:
-        totp_code = request.DATA.get("totp_code", None)
-        if totp_code is None:
-            member.log("login_blocked", "requires MFA (TOTP)", request, method="login", level=31)
-            return restStatus(request, False, error="requires MFA (TOTP)", error_code=455)
-        if not member.totp_verify(totp_code):
-            member.log("login_blocked", "invalid MFA code", request, method="login", level=31)
-            return restStatus(request, False, error="invalid MFA code", error_code=456)
+        resp = checkForTOTP(request, member)
+        if resp is not None:
+            return resp
     if not member.login(request=request, password=password, use_jwt=False):
         member.log("login_failed", "incorrect password", request, method="login", level=31)
         return restStatus(request, False, error="Password or Username is incorrect", error_code=401)
@@ -157,11 +192,7 @@ def member_login_uname_code(request, username, auth_code):
     if request.DATA.get("auth_method") == "basic":
         return restGet(request, dict(id=member.pk, session_key=request.session.session_key))
 
-    # we still force the user to use JWT after code login
-    if member.security_token is None:
-        member.refreshSecurityToken()
-    token = JWToken(user_id=member.pk, key=member.security_token)
-    return restGet(request, dict(access=token.access_token, refresh=token.refresh_token, id=member.pk))
+    return on_complete_jwt(request, member)
 
 
 @rd.url(r'^logout$')
@@ -196,22 +227,24 @@ def is_member_logged_in(request):
     return restStatus(request, False)
 
 
-@rd.urlPOST (r'^forgot$')
-@rd.urlPOST (r'^forget/$')
+@rd.urlPOST('mfa/request_code')
 @rd.never_cache
-def member_forgot_password(request):
-    """
-    | param: username = use the username as the lookup
-    | param: email = use the email as the lookup
+def member_request_code(request):
+    member = member_from_request(request)
+    resp = member_check_can_login(request, member)
+    if resp is not None:
+        return resp
+    return member_forgot_password_code(request, member)
 
-    | Return: status + error
 
-    | Send fgroupet password reset instructions
-    """
+def member_from_request(request):
     username = request.DATA.get('username', None)
     if not username:
-        return restStatus(request, False, error="Username is required")
-    member = getMemberByUsername(username)
+        raise restPermissionDenied("Username is required")
+    return getMemberByUsername(username)
+
+
+def member_check_can_login(request, member):
     if not member:
         return restStatus(request, False, error="Password or Username is incorrect", error_code=422)
     if not member.is_active:
@@ -220,6 +253,24 @@ def member_forgot_password(request):
     if member.is_blocked:
         member.log("login_blocked", "account is locked out", request, method="login", level=31)
         return restStatus(request, False, error="Account locked out", error_code=411)
+    return None  
+
+
+@rd.urlPOST('forgot')
+@rd.never_cache
+def member_forgot_password(request):
+    """
+    | param: username = use the username as the lookup
+    | param: email = use the email as the lookup
+
+    | Return: status + error
+
+    | Send fgroupet password reset instructions
+    """
+    member = member_from_request(request)
+    resp = member_check_can_login(request, member)
+    if resp is not None:
+        return resp
 
     if request.DATA.get("use_code", False):
         return member_forgot_password_code(request, member)
@@ -264,7 +315,7 @@ def member_forgot_password_code(request, member):
 
 
 # time based one time passwords
-@rd.urlGET(r'^totp/qrcode$')
+@rd.urlGET('totp/qrcode')
 @rd.login_required
 def totp_qrcode(request):
     token = request.member.getProperty("totp_token", category="secrets", default=None)
@@ -301,6 +352,7 @@ def totp_verify(request):
         return restPermissionDenied(request, "invalid code format")
     if not request.member.totp_verify(code):
         return restPermissionDenied(request, "invalid code")
+    request.member.setProperty("totp_verified", 1)
     return restStatus(request, True)
 
 

account/rpc/group.py

@@ -46,9 +46,9 @@ def rest_on_group_invite(request, group_id=None):
         if not data or not data.email:
             return rv.restPermissionDenied(request, "missing fields")
         if data.email:
-            member = Member.GetMember(data.email.lower())
+            member = Member.GetMember(data.email.lower().strip())
         elif data.username:
-            member = Member.GetMember(data.username)
+            member = Member.GetMember(data.username.lower().strip())
         elif data.phone_number:
             member = Member.GetMemberByPhone(data.phone_number)
         if member is None:

{django_restit-4.1.75.dist-info → django_restit-4.1.77.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.1.75
+Version: 4.1.77
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.1.75.dist-info → django_restit-4.1.77.dist-info}/RECORD

@@ -16,24 +16,25 @@ account/migrations/0013_memberdevice_ip.py,sha256=5Dxm5uNy7D1RnZeTYRYhU_7WlDQCme
 account/migrations/0014_alter_notificationmemberrecord_member.py,sha256=q3CHimwbhTk8rHkqaaOOcNrsHE7hSkVL7JDH6KmxWZs,541
 account/migrations/0015_memberdevice_buid.py,sha256=O3M3mS_O1zn4gQahC3ebRu8tMySo3cUbfO3X1-vLFMk,460
 account/migrations/0016_authsession_buid.py,sha256=wZdiH_87Ik3jAXYUgtafeAo9IbJq35xDVOlQ_UiTC8k,424
+account/migrations/0017_rename_requires_topt_member_requires_totp.py,sha256=GksGiF7OQDV2RihyC2OTBzSmDwzCzenThkNs6FKni4M,375
 account/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 account/models/__init__.py,sha256=OxQbDkVcZogwgNj3bQWljOxAkkt15KgBYVrsumzek8Q,341
 account/models/device.py,sha256=XipNpByreGubB5-d4ZBOoIV5Xw14b2Btcgn6fXz8HAc,4105
 account/models/feeds.py,sha256=4n4Mv8HjcXpUmMPWafHlsGbVQ1fDKdtblL1hp30sDrg,1437
 account/models/group.py,sha256=X_ij8moxmtH9qwH3w2EL8siuy-prsyxQVv1JIhBp3hI,19399
 account/models/legacy.py,sha256=zYdtv4LC0ooxPVqWM-uToPwV-lYWQLorSE6p6yn1xDw,2720
-account/models/member.py,sha256=kyPnmRRG-LF9q9bOfmaGkuPHnePu8bR7wKfhlqy6Xoo,48477
+account/models/member.py,sha256=7z6RAW9vVl7FX1q6KfW02I6VvAzsxkJy_i2ULYfBNHo,48574
 account/models/membership.py,sha256=l7suW6kRCfa3KqdbqjOIO2jVhxjkPbEENdJIlj2WomY,7378
 account/models/notify.py,sha256=YnZujSHJHY7B09e6FIyZIEJRWLPYk1Sk1e92tFzB1IA,12078
 account/models/session.py,sha256=swhxcx_lWzOpGCmfifXoACgWYqmKmS7eZsD9s9jSToc,3509
 account/models/settings.py,sha256=gOyRWBVd3BQpjfj_hJPtqX3H46ztyRAFxBrPbv11lQg,2137
 account/oauth/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 account/oauth/google.py,sha256=q5M6Qhpfp9QslKRVYFZBvtG6kgXV6vYMrR5fp6Xdb9I,2078
-account/periodic.py,sha256=imh9C-oQVhfw7GX3RRHYuC6DIreGbXrQM35A8C4UjOE,876
+account/periodic.py,sha256=-u0n-7QTJgDOkasGhBAPwHAwjpqWGA-MZLEFkVTqCGU,874
 account/rpc/__init__.py,sha256=L_AqHC0WbgUgLoqvNz6pY0E34eqh7sRaX77I6TxhRZ4,152
-account/rpc/auth.py,sha256=8CgXsbNZLeBcd5MHpdL29z9E8PYUcKX_zYpTPX_Pa-0,12516
+account/rpc/auth.py,sha256=TL74o-LH8ETqF0EzLb6Bis_lsLx9VEirA-ZvivBUPaE,13652
 account/rpc/device.py,sha256=fbbZFp3cUdhVXvD7gVFOqFWj4hKS3bjZKD_aF5fQxd8,2852
-account/rpc/group.py,sha256=dUIZGArPgnKafL7F44f7Qum5EAskWcjj64Haqlkbdb8,3448
+account/rpc/group.py,sha256=Y_Ii-vlDx09neMd95AmC7xBwDf3wdFgXjB-kIG2jMdE,3472
 account/rpc/member.py,sha256=oKdXSGhQ7AOPTwisZ5RvHhQ1SdZoXWlBQY0lIlDXJY0,1150
 account/rpc/notify.py,sha256=Q2YWejP36egeF060Hih5uX4Psv_B8NWlLLPi7iDYlIw,3344
 account/rpc/oauth.py,sha256=-BW38HjYwSQhOs31ubnBxO0yCKVpczEMoHq54NC9uOU,2610
@@ -94,7 +95,7 @@ incident/migrations/0011_ticket.py,sha256=Ml5E_Qi4Z0MD89fetoOFOL3rPlVQdjaaDCcFBf
 incident/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 incident/models/__init__.py,sha256=NMphuhb0RTMf7Ov4QkNv7iv6_I8Wtr3xQ54yjX_a31M,209
 incident/models/event.py,sha256=AXFV92OtnVi3opSZcRX1o3qZ8uBvqGFL549AXH2gjY8,6792
-incident/models/incident.py,sha256=qBwXC4lhQ8YZ7EatDjOced93cXq1jJqYgElgmKfl9nw,14409
+incident/models/incident.py,sha256=zaq81_ZdGAeUDKpmP2c9Du8TPTMt2EW5e-Oyt8q2Lwo,14390
 incident/models/ossec.py,sha256=pWMqcuTRxPFTEF-OZQSMn7YpNEE9mfsI4GMhWWjJs5I,2187
 incident/models/rules.py,sha256=Ua-hC78_D6YikJjP3DXfA8ghi6zu__Qud8H1bk7MRG0,5342
 incident/models/ticket.py,sha256=S3kqGQpYLE6Y4M9IKu_60sgW-f592xNr8uufqHnvDoU,2302
@@ -350,7 +351,7 @@ pushit/utils.py,sha256=IeTCGa-164nmB1jIsK1lu1O1QzUhS3BKfuXHGjCW-ck,2121
 rest/.gitignore,sha256=TbEvWRMnAiajCTOdhiNrd9eeCAaIjRp9PRjE_VkMM5g,118
 rest/README.md,sha256=V3ETc-cJu8PZIbKr9xSe_pA4JEUpC8Dhw4bQeVCDJPw,5460
 rest/RemoteEvents.py,sha256=nL46U7AuxIrlw2JunphR1tsXyqi-ep_gD9CYGpYbNgE,72
-rest/__init__.py,sha256=EBklYrW3BC8Q1_xwHhntKj0NjkG0lEqi8Nw56aKm-K0,121
+rest/__init__.py,sha256=42ez8LEkgPOOkm7pc1ftpMfoo52l5H5XggNBtlOWYYs,121
 rest/arc4.py,sha256=y644IbF1ec--e4cUJ3KEYsewTCITK0gmlwa5mJruFC0,1967
 rest/cache.py,sha256=1Qg0rkaCJCaVP0-l5hZg2CIblTdeBSlj_0fP6vlKUpU,83
 rest/crypto/__init__.py,sha256=Tl0U11rgj1eBYqd6OXJ2_XSdNLumW_JkBZnaJqI6Ldw,72
@@ -377,12 +378,12 @@ rest/management/commands/rpc.py,sha256=bQRisv4z34LyRR5xiS63glY5tgZC4SkYr7UWoCtHl
 rest/middleware/__init__.py,sha256=u4Z8Fl9uOuX2yHT_uISCLjLDofdGWrpaDNYrc6T1xE4,33
 rest/middleware/cors.py,sha256=sNAgZ3chnXI5WKYdcbTc8eXqxZLdM1tHns7lIoI5BPE,3513
 rest/middleware/db_router.py,sha256=jd0ywJK0PX6hz3Jy3DGRWfGr6v53tV-BtRIPm_32f0w,2345
-rest/middleware/jwt.py,sha256=jZ5_9hbSbegf7UYAdMYthEHaPCQw0WPf3kMymvQAd1E,5522
+rest/middleware/jwt.py,sha256=dR8rWnb1BrJmlvCVz2I9d0GD2CfnbxutGlqItbZWs1E,6017
 rest/middleware/request.py,sha256=JchRNy5L-bGd-7h-KFYekGRvREe2eCkZXKOYqIkP2hI,4189
 rest/middleware/session.py,sha256=zHSoQpIzRLmpqr_JvW406wzpvU3W3gDbm5JhtzLAMlE,10240
 rest/middleware/session_store.py,sha256=X_i06TnZLW1srV0vkjjLhZ7fl1G56PswXxRpVzdFasw,1874
 rest/models/__init__.py,sha256=M8pvFDq-WCF-QcM58X7pMufYYe0aaQ3U0PwGe9TKbbY,130
-rest/models/base.py,sha256=Fo17FhaeZHIVfNP8M6eIoVVikxkOBAGGzsgNg8Fl7B8,65724
+rest/models/base.py,sha256=pjilLSXpkNVdyOVm8ipExYpjW-P--w4yKW36j3-EOdY,65787
 rest/models/cacher.py,sha256=eKz8TINVhWEqKhJGMsRkKZTtBUIv5rN3NHbZwOC56Uk,578
 rest/models/metadata.py,sha256=VM5t3I1DYgvwLAOjaYcMdVZ2JWrrcJUMU3o3gATkPYk,12626
 rest/net.py,sha256=LTF4ip-ur8C2G7NETVOg7ioACegBGo4sDJA18PfF5kQ,1691
@@ -447,7 +448,7 @@ telephony/decorators.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 telephony/migrations/0001_initial.py,sha256=YRiNtpeqj-4uvq19sfI64Q-KRnQ_T53kNzyt-CZUl14,3030
 telephony/migrations/0002_alter_sms_sid.py,sha256=QAnMG-UZ5emssZwdJ8XwfaRh3872zUUR55maDMD4RkE,424
 telephony/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-telephony/models.py,sha256=S6k7rbG1GxO9nhffOOzbM-jgpm1PJEfO20mdj6IIpDI,8116
+telephony/models.py,sha256=68BWPyTZ_bNptuCqhFEv3iraMp6bcWKXfJ7jnj_pUpo,8142
 telephony/phone_util.py,sha256=15IWkTSqkjDWT9edPAYogAxHc1OdjOziPSxsJ8vfpfE,2426
 telephony/rpc.py,sha256=GVPWH5XSPNar-ICu5oq-yF6FBmJbju3XJr6gSXA6ZVU,3535
 wiki/__init__.py,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1
@@ -482,7 +483,7 @@ ws4redis/servers/uwsgi.py,sha256=VyhoCI1DnVFqBiJYHoxqn5Idlf6uJPHvfBKgkjs34mo,172
 ws4redis/settings.py,sha256=K0yBiLUuY81iDM4Yr-k8hbvjn5VVHu5zQhmMK8Dtz0s,1536
 ws4redis/utf8validator.py,sha256=S0OlfjeGRP75aO6CzZsF4oTjRQAgR17OWE9rgZdMBZA,5122
 ws4redis/websocket.py,sha256=R0TUyPsoVRD7Y_oU7w2I6NL4fPwiz5Vl94-fUkZgLHA,14848
-django_restit-4.1.75.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
-django_restit-4.1.75.dist-info/METADATA,sha256=hjRHe-VVVIQu1Sqhc6pz00FdyeLdszibBJ-5coivs7I,7573
-django_restit-4.1.75.dist-info/WHEEL,sha256=Zb28QaM1gQi8f4VCBhsUklF61CTlNYfs9YAZn-TOGFk,88
-django_restit-4.1.75.dist-info/RECORD,,
+django_restit-4.1.77.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
+django_restit-4.1.77.dist-info/METADATA,sha256=AM9Kck1ngBJZB2d2puHI-_yNU9dFtFfjbbpr5onZm60,7573
+django_restit-4.1.77.dist-info/WHEEL,sha256=Zb28QaM1gQi8f4VCBhsUklF61CTlNYfs9YAZn-TOGFk,88
+django_restit-4.1.77.dist-info/RECORD,,

incident/models/incident.py

@@ -168,8 +168,8 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             action, perm = self.rule.action.split(":")
             members = Member.GetWithNotification(perm)
             # count = self.getProperty("event_count", default=1, field_type=int)
-            url = F"{settings.INCIDENT_PORTAL_URL}"
-            msg = f"Incident #{self.pk}\n{self.description}\n<a href='{url}?incident={self.pk}'>view</a>"
+            url = F"{settings.INCIDENT_PORTAL_URL}?incident={self.pk}"
+            msg = f"Incident #{self.pk}\n{self.description}\n{url}"
             for m in members:
                 m.sendSMS(msg)
         except Exception:

rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.1.75"
+__version__ = "4.1.77"

rest/middleware/jwt.py

@@ -112,6 +112,18 @@ class JWTokenMiddleware(object):
         if atoken is None:
             helpers.log_error("login failed with authtoken")
             return
+        if atoken.member.requires_totp:
+            reason = F"auth failed bacause requires_totp prevents auth_token login for {atoken.member.username}"
+            atoken.member.log(
+                "login_blocked", 
+                reason,
+                request, method="login", level=31)
+            atoken.member.reportIncident(
+                "account", reason, level=2,
+                error_code=444,
+                request=request,
+                details=reason)
+            return
         if not atoken.member.canLogin(request, False):
             helpers.log_error("user cannot login via authtoken", request.token)
             return 

rest/models/base.py

@@ -199,11 +199,13 @@ class RestModel(object):
 
     @classmethod
     def getGraph(cls, name):
-        graph_key = "_graph_{0}__".format(name)
-        if hasattr(cls, graph_key):
-            return getattr(cls, graph_key)
+        if name is None:
+            name = "default"
+        graph_key = f"_graph_{name}__"
+        if hasattr(cls._meta, graph_key):
+            return getattr(cls._meta, graph_key)
         graph = cls.buildGraph(name)
-        setattr(cls, graph_key, graph)
+        setattr(cls._meta, graph_key, graph)
         return graph
 
     def toGraph(self, request=None, graph="basic"):

telephony/models.py

@@ -10,6 +10,7 @@ from . import phone_util
 class SMS(models.Model, RestModel):
     class RestMeta:
         CAN_CREATE = False
+        CAN_DELETE = True
         DEFAULT_SORT = "-created"
         QUERY_FIELDS = ["endpoint", "srcpoint"]
         SEARCH_FIELDS = ["endpoint", "srcpoint"]