django-restit 4.1.75__tar.gz → 4.1.77__tar.gz

{django_restit-4.1.75 → django_restit-4.1.77}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.1.75
+Version: 4.1.77
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

django_restit-4.1.77/account/migrations/0017_rename_requires_topt_member_requires_totp.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.1.4 on 2023-11-28 23:26
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0016_authsession_buid'),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name='member',
+            old_name='requires_topt',
+            new_name='requires_totp',
+        ),
+    ]

{django_restit-4.1.75 → django_restit-4.1.77}/account/models/member.py

@@ -68,7 +68,7 @@ class User(AbstractUser, RestModel):
 class Member(User, RestModel, MetaDataModel):
     class RestMeta:
         NO_SHOW_FIELDS = ["password", "auth_code", "security_token"]
-        SEARCH_FIELDS = ["username", "email", "first_name", "last_name", "display_name"]
+        SEARCH_FIELDS = ["username", "email", "first_name", "last_name", "display_name", "phone_number"]
         VIEW_PERMS = ["view_members", "manage_members", "manage_users", "owner"]
         SAVE_PERMS = ["invite_members", "manage_members", "manage_users", "owner"]
         LIST_DEFAULT_FILTERS = {
@@ -125,13 +125,13 @@ class Member(User, RestModel, MetaDataModel):
                     'is_blocked',
                     'is_staff',
                     'is_superuser',
-                    'requires_topt',
+                    'requires_totp',
                     'last_login',
                     'last_activity',
                     ('date_joined', 'created'),
                     ("hasLoggedIn", "has_logged_in"),
                     'avatar',
-                    'has_topt',
+                    'has_totp',
                     'auth_token'
                 ],
                 "extra": ["metadata", "password_expires_in"],
@@ -152,7 +152,7 @@ class Member(User, RestModel, MetaDataModel):
 
     password_changed = models.DateTimeField(blank=True, null=True, default=None)
     last_activity = models.DateTimeField(blank=True, null=True, default=None)
-    requires_topt = models.BooleanField(blank=True, null=True, default=False)
+    requires_totp = models.BooleanField(blank=True, null=True, default=False)
 
     def __str__(self):
         return self.username
@@ -214,9 +214,10 @@ class Member(User, RestModel, MetaDataModel):
         return None
 
     @property
-    def has_topt(self):
-        token = self.getSecretProperty("totp_token", default=None)
-        return token is not None
+    def has_totp(self):
+        token = self.getProperty("totp_token", category="secrets", default=None)
+        verified = self.getProperty("totp_verified", default=False)
+        return token is not None and verified
 
     @property
     def password_expires_in(self):
@@ -667,7 +668,7 @@ class Member(User, RestModel, MetaDataModel):
 
     # time based one time passwords / GOOGLE Authenticator
     def totp_getSecret(self, reset=False):
-        token = self.getProperty("totp_token", category="secrets", default=None)
+        token = self.getSecretProperty("totp_token", default=None)
         if token is None or reset:
             token = pyotp.random_base32()
             self.setProperty("totp_token", token, category="secrets")

{django_restit-4.1.75 → django_restit-4.1.77}/account/periodic.py

@@ -8,9 +8,9 @@ from sessionlog.models import SessionLog
 def run_cleanup_tokens(force=False, verbose=False, now=None):
     # we want to nuke invite tokens every 15 minutes
     # we do not want to do this if using invite
-    stale = datetime.now() - timedelta(hours=24)
-    qset = Member.objects.filter(auth_token__isnull=False).filter(modified__lte=stale)
-    qset.update(auth_token=None)
+    stale = datetime.now() - timedelta(hours=48)
+    qset = Member.objects.filter(auth_code__isnull=False).filter(modified__lte=stale)
+    qset.update(auth_code=None)
 
     # lets prune old non active sessions
     SessionLog.Clean(limit=10000)

{django_restit-4.1.75 → django_restit-4.1.77}/account/rpc/auth.py

@@ -38,13 +38,24 @@ def jwt_login(request):
         return restStatus(request, False, error="Password and/or Username is incorrect", error_code=422)
     password = request.DATA.get('password', None)
     member.canLogin(request)  # throws exception if cannot login
+    if member.requires_totp:
+        resp = checkForTOTP(request, member)
+        if resp is not None:
+            return resp
     if not member.login(request=request, password=password, use_jwt=True):
         member.log("login_failed", "incorrect password", request, method="login", level=31)
-        return restStatus(request, False, error="Password or Username is incorrect", error_code=401)
+        return restStatus(request, False, error="Invalid Credentials", error_code=401)
+    return on_complete_jwt(request, member)
+
+
+def on_complete_jwt(request, member):
     if member.security_token is None or member.security_token == JWT_KEY:
         member.refreshSecurityToken()
-    member.log("jwt_login", "jwt login succesful", request, method="login", level=7)
-    
+
+    member.log(
+        "jwt_login", "jwt login succesful", 
+        request, method="login", level=7)
+
     device_id = request.DATA.get(["device_id", "deviceID"])
     token = JWToken(user_id=member.pk, key=member.security_token, device_id=device_id)
 
@@ -58,7 +69,12 @@ def jwt_login(request):
         am.MemberDevice.register(request, member, device_id)
     
     request.jwt_token = token.access_token  # this tells the middleware to store in cookie
-    return restGet(request, dict(access=token.access_token, refresh=token.refresh_token, id=member.pk))
+    return restGet(
+        request, 
+        dict(
+            access=token.access_token,
+            refresh=token.refresh_token,
+            id=member.pk))
 
 
 @rd.urlPOST(r'^jwt/logout$')
@@ -107,19 +123,38 @@ def getMemberByUsername(username):
     return member
 
 
+def checkForTOTP(request, member):
+    if not member.has_totp and not member.phone_number:
+        member.reportIncident(
+            "account", f"{member.username} TOTP not set", level=8,
+            error_code=455,
+            request=request)
+        return None
+    if not member.has_totp:
+        # we have a phone number so tell them to login with code
+        # they will need to request a code
+        return restStatus(
+            request, False, error=member.phone_number[-4:],
+            error_code=454)
+    totp_code = request.DATA.get("totp_code", None)
+    if totp_code is None:
+        # member.log("login_blocked", "requires MFA (TOTP)", request, method="login", level=31)
+        return restStatus(request, False, error="Requires MFA (TOTP)", error_code=455)
+    if not member.totp_verify(totp_code):
+        member.log("login_blocked", "Invalid MFA code", request, method="login", level=31)
+        return restStatus(request, False, error="Invalid Credentials", error_code=456)
+    return None
+
+
 def member_login_uname_pword(request, username, password):
     member = getMemberByUsername(username)
     if not member:
         return restStatus(request, False, error="Password or Username is not correct", error_code=422)
     member.canLogin(request)  # throws exception if cannot login
     if member.requires_topt:
-        totp_code = request.DATA.get("totp_code", None)
-        if totp_code is None:
-            member.log("login_blocked", "requires MFA (TOTP)", request, method="login", level=31)
-            return restStatus(request, False, error="requires MFA (TOTP)", error_code=455)
-        if not member.totp_verify(totp_code):
-            member.log("login_blocked", "invalid MFA code", request, method="login", level=31)
-            return restStatus(request, False, error="invalid MFA code", error_code=456)
+        resp = checkForTOTP(request, member)
+        if resp is not None:
+            return resp
     if not member.login(request=request, password=password, use_jwt=False):
         member.log("login_failed", "incorrect password", request, method="login", level=31)
         return restStatus(request, False, error="Password or Username is incorrect", error_code=401)
@@ -157,11 +192,7 @@ def member_login_uname_code(request, username, auth_code):
     if request.DATA.get("auth_method") == "basic":
         return restGet(request, dict(id=member.pk, session_key=request.session.session_key))
 
-    # we still force the user to use JWT after code login
-    if member.security_token is None:
-        member.refreshSecurityToken()
-    token = JWToken(user_id=member.pk, key=member.security_token)
-    return restGet(request, dict(access=token.access_token, refresh=token.refresh_token, id=member.pk))
+    return on_complete_jwt(request, member)
 
 
 @rd.url(r'^logout$')
@@ -196,22 +227,24 @@ def is_member_logged_in(request):
     return restStatus(request, False)
 
 
-@rd.urlPOST (r'^forgot$')
-@rd.urlPOST (r'^forget/$')
+@rd.urlPOST('mfa/request_code')
 @rd.never_cache
-def member_forgot_password(request):
-    """
-    | param: username = use the username as the lookup
-    | param: email = use the email as the lookup
+def member_request_code(request):
+    member = member_from_request(request)
+    resp = member_check_can_login(request, member)
+    if resp is not None:
+        return resp
+    return member_forgot_password_code(request, member)
 
-    | Return: status + error
 
-    | Send fgroupet password reset instructions
-    """
+def member_from_request(request):
     username = request.DATA.get('username', None)
     if not username:
-        return restStatus(request, False, error="Username is required")
-    member = getMemberByUsername(username)
+        raise restPermissionDenied("Username is required")
+    return getMemberByUsername(username)
+
+
+def member_check_can_login(request, member):
     if not member:
         return restStatus(request, False, error="Password or Username is incorrect", error_code=422)
     if not member.is_active:
@@ -220,6 +253,24 @@ def member_forgot_password(request):
     if member.is_blocked:
         member.log("login_blocked", "account is locked out", request, method="login", level=31)
         return restStatus(request, False, error="Account locked out", error_code=411)
+    return None  
+
+
+@rd.urlPOST('forgot')
+@rd.never_cache
+def member_forgot_password(request):
+    """
+    | param: username = use the username as the lookup
+    | param: email = use the email as the lookup
+
+    | Return: status + error
+
+    | Send fgroupet password reset instructions
+    """
+    member = member_from_request(request)
+    resp = member_check_can_login(request, member)
+    if resp is not None:
+        return resp
 
     if request.DATA.get("use_code", False):
         return member_forgot_password_code(request, member)
@@ -264,7 +315,7 @@ def member_forgot_password_code(request, member):
 
 
 # time based one time passwords
-@rd.urlGET(r'^totp/qrcode$')
+@rd.urlGET('totp/qrcode')
 @rd.login_required
 def totp_qrcode(request):
     token = request.member.getProperty("totp_token", category="secrets", default=None)
@@ -301,6 +352,7 @@ def totp_verify(request):
         return restPermissionDenied(request, "invalid code format")
     if not request.member.totp_verify(code):
         return restPermissionDenied(request, "invalid code")
+    request.member.setProperty("totp_verified", 1)
     return restStatus(request, True)
 
 

{django_restit-4.1.75 → django_restit-4.1.77}/account/rpc/group.py

@@ -46,9 +46,9 @@ def rest_on_group_invite(request, group_id=None):
         if not data or not data.email:
             return rv.restPermissionDenied(request, "missing fields")
         if data.email:
-            member = Member.GetMember(data.email.lower())
+            member = Member.GetMember(data.email.lower().strip())
         elif data.username:
-            member = Member.GetMember(data.username)
+            member = Member.GetMember(data.username.lower().strip())
         elif data.phone_number:
             member = Member.GetMemberByPhone(data.phone_number)
         if member is None:

{django_restit-4.1.75 → django_restit-4.1.77}/incident/models/incident.py

@@ -168,8 +168,8 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             action, perm = self.rule.action.split(":")
             members = Member.GetWithNotification(perm)
             # count = self.getProperty("event_count", default=1, field_type=int)
-            url = F"{settings.INCIDENT_PORTAL_URL}"
-            msg = f"Incident #{self.pk}\n{self.description}\n<a href='{url}?incident={self.pk}'>view</a>"
+            url = F"{settings.INCIDENT_PORTAL_URL}?incident={self.pk}"
+            msg = f"Incident #{self.pk}\n{self.description}\n{url}"
             for m in members:
                 m.sendSMS(msg)
         except Exception:

{django_restit-4.1.75 → django_restit-4.1.77}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.1.75"
+version = "4.1.77"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.1.75 → django_restit-4.1.77}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.1.75"
+__version__ = "4.1.77"

{django_restit-4.1.75 → django_restit-4.1.77}/rest/middleware/jwt.py

@@ -112,6 +112,18 @@ class JWTokenMiddleware(object):
         if atoken is None:
             helpers.log_error("login failed with authtoken")
             return
+        if atoken.member.requires_totp:
+            reason = F"auth failed bacause requires_totp prevents auth_token login for {atoken.member.username}"
+            atoken.member.log(
+                "login_blocked", 
+                reason,
+                request, method="login", level=31)
+            atoken.member.reportIncident(
+                "account", reason, level=2,
+                error_code=444,
+                request=request,
+                details=reason)
+            return
         if not atoken.member.canLogin(request, False):
             helpers.log_error("user cannot login via authtoken", request.token)
             return 

{django_restit-4.1.75 → django_restit-4.1.77}/rest/models/base.py

@@ -199,11 +199,13 @@ class RestModel(object):
 
     @classmethod
     def getGraph(cls, name):
-        graph_key = "_graph_{0}__".format(name)
-        if hasattr(cls, graph_key):
-            return getattr(cls, graph_key)
+        if name is None:
+            name = "default"
+        graph_key = f"_graph_{name}__"
+        if hasattr(cls._meta, graph_key):
+            return getattr(cls._meta, graph_key)
         graph = cls.buildGraph(name)
-        setattr(cls, graph_key, graph)
+        setattr(cls._meta, graph_key, graph)
         return graph
 
     def toGraph(self, request=None, graph="basic"):

{django_restit-4.1.75 → django_restit-4.1.77}/telephony/models.py

@@ -10,6 +10,7 @@ from . import phone_util
 class SMS(models.Model, RestModel):
     class RestMeta:
         CAN_CREATE = False
+        CAN_DELETE = True
         DEFAULT_SORT = "-created"
         QUERY_FIELDS = ["endpoint", "srcpoint"]
         SEARCH_FIELDS = ["endpoint", "srcpoint"]