django-restit 4.2.15__tar.gz → 4.2.17__tar.gz

{django_restit-4.2.15 → django_restit-4.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.15
+Version: 4.2.17
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes
@@ -16,6 +16,7 @@ Requires-Dist: boto3 (>=1.26.160,<2.0.0)
 Requires-Dist: django
 Requires-Dist: django-redis-cache (>=3.0.1,<4.0.0)
 Requires-Dist: django-redis-sessions (>=0.6.2,<0.7.0)
+Requires-Dist: fido2
 Requires-Dist: gevent (>=23.7.0,<24.0.0)
 Requires-Dist: hashids (>=1.3.1,<2.0.0)
 Requires-Dist: inlinestyler

{django_restit-4.2.15 → django_restit-4.2.17}/account/models/member.py

@@ -88,6 +88,7 @@ class Member(User, RestModel, MetaDataModel):
             ("perms", "properties|permissions.")]
         QUERY_FIELDS_SPECIAL = {
             "ip": "auth_sessions__ip",
+            "login_country": "auth_sessions__location__country"
         }
         UNIQUE_LOOKUP = ["username", "email"]
         METADATA_FIELD_PROPERTIES = settings.USER_METADATA_PROPERTIES
@@ -474,6 +475,7 @@ class Member(User, RestModel, MetaDataModel):
 
     def disable(self, by="system", reason="", notify=True):
         self.is_active = False
+        self.security_token = None
         self.save()
         self.memberships.update(state=-25)
 

{django_restit-4.2.15 → django_restit-4.2.17}/account/passkeys/core.py

@@ -6,6 +6,8 @@ try:
     import fido2
     from fido2.server import Fido2Server
     from fido2.utils import websafe_decode, websafe_encode
+    from fido2 import cbor
+    fido2.features.webauthn_json_mapping.enabled = True
 except Exception:
     pass
 
@@ -21,7 +23,6 @@ FIDO_KEY_ATTACHMENT = settings.get("FIDO_KEY_ATTACHMENT", "cross-platform")
 
 FIDO_SERVER_ID = settings.get("FIDO_SERVER_ID", settings.SERVER_NAME)
 FIDO_SERVER_NAME = settings.get("FIDO_SERVER_NAME", settings.SITE_LABEL)
-fido2.features.webauthn_json_mapping.enabled = True
 
 
 def verify_origin(id):
@@ -52,6 +53,9 @@ def registerBegin(member, request, attachment=FIDO_KEY_ATTACHMENT):
         authenticator_attachment=attachment,
         resident_key_requirement=webauthn.ResidentKeyRequirement.PREFERRED)
     rp = objict(server.rp)
+    data = objict.fromdict(dict(data))
+    data.excludeCredentials = getUserCredentials(member, websafe=True)
+    rh.debug("data", data)
     # rh.debug("registerBegin", rp, server.rp.id_hash)
     return data, state, rp
 
@@ -80,10 +84,15 @@ def registerComplete(request, fido2_state, rp_id):
     return user_key
 
 
-def getUserCredentials(member):
+def getUserCredentials(member, websafe=False):
     if member is None:
         return []
-    return [webauthn.AttestedCredentialData(websafe_decode(uk.token)) for uk in member.passkeys.all()]
+    creds = [webauthn.AttestedCredentialData(websafe_decode(uk.token)) for uk in member.passkeys.all()]
+    if websafe:
+        return [dict(
+            type="public-key",
+            id=rh.toBase64(acd.credential_id)) for acd in creds]
+    return creds
 
 
 def authBegin(request):
@@ -97,7 +106,7 @@ def authComplete(request, fido2_state, rp_id):
     credential = request.DATA.get("credential")
     upk = UserPassKey.objects.filter(uuid=credential.id, is_enabled=1).last()
     if upk is None:
-        raise Exception(f"could not find UserPassKey {credential.id}")
+        raise Exception("PassKey not found on host.")
     stored_credentials = [webauthn.AttestedCredentialData(websafe_decode(upk.token))]
     server = getServer(request, rp_id)
     cred = server.authenticate_complete(

{django_restit-4.2.15 → django_restit-4.2.17}/account/rpc/passkeys.py

@@ -21,7 +21,7 @@ def rest_on_passkeys_reg_begin(request):
     # or in redis with expires in 5m?
     request.session["fido2_state"] = state
     request.session["fido2_rp_id"] = rp.id
-    return rv.restResult(request, dict(data))
+    return rv.restResult(request, data)
 
 
 @rd.url('passkeys/register/end')

{django_restit-4.2.15 → django_restit-4.2.17}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.15"
+version = "4.2.17"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"
@@ -42,6 +42,7 @@ pypng = "*"
 pygments = "*"
 mistune = "*"
 inlinestyler = "*"
+fido2 = "*"
 python-dateutil = "^2.8.2"
 hashids = "^1.3.1"
 boto3 = "^1.26.160"

{django_restit-4.2.15 → django_restit-4.2.17}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.15"
+__version__ = "4.2.17"

{django_restit-4.2.15 → django_restit-4.2.17}/rest/helpers.py

@@ -863,6 +863,13 @@ def getBlockedHosts():
     return blocked
 
 
+def toInteger(value):
+    if isinstance(value, str):
+        if "." in value:
+            return int(float(value))
+    return int(value)
+
+
 def toString(value):
     if isinstance(value, bytes):
         value = value.decode()
@@ -897,7 +904,9 @@ def hexToByteArray(value):
 def hexToString(value):
     return bytes.fromhex(value).decode('utf-8')
 
-def toBase64(value):
+def toBase64(value, as_str=True):
+    if as_str:
+        return toString(base64.b64encode(toBytes(value)))
     return base64.b64encode(toBytes(value))
 
 def fromBase64(value):

{django_restit-4.2.15 → django_restit-4.2.17}/rest/jwtoken.py

@@ -6,14 +6,16 @@ from rest import settings
 
 
 JWT_EXP_1_DAY = 86400
+JWT_EXP_2_DAY = 172800
 JWT_EXP_7_DAY = 604800
 JWT_EXP_30_MIN = 1800
 JWT_KEY = settings.SECRET_KEY
-JWT_EXP_DEFAULT = settings.get("JWT_EXP_DEFAULT", JWT_EXP_30_MIN)
+JWT_EXPIRES = settings.get("JWT_EXPIRES", JWT_EXP_30_MIN)
+JWT_REFRESH_EXPIRES = settings.get("JWT_REFRESH_EXPIRES", JWT_EXP_2_DAY)
 
 
 class JWToken():
-    def __init__(self, token=None, user_id=None, key=JWT_KEY, device_id=None, alg="HS256", access_expires_in=JWT_EXP_DEFAULT, refresh_expires_in=JWT_EXP_7_DAY):
+    def __init__(self, token=None, user_id=None, key=JWT_KEY, device_id=None, alg="HS256", access_expires_in=JWT_EXPIRES, refresh_expires_in=JWT_REFRESH_EXPIRES):
         # takes full JWT token header.payload.signature
         self.token = token
         self.key = key

{django_restit-4.2.15 → django_restit-4.2.17}/rest/models/base.py

@@ -1573,6 +1573,8 @@ class RestModel(object):
             ft = cls.get_field_type(fn)
             if ft == "DateTimeField":
                 value = rh.parseDateTime(value)
+            elif ft == "IntegerField":
+                value = rh.toInteger(value)
             q[key] = value
         if bool(q):
             # rh.debug("queryFromRequest", q, "default_filters:", request.default_rest_filters)

{django_restit-4.2.15 → django_restit-4.2.17}/rest/rpc.py

@@ -42,6 +42,14 @@ def on_get_version(request):
     return views.restStatus(request, True, {"data": versions})
 
 
+@url('test/session')
+def on_get_my_session(request):
+    echo = request.DATA.get("echo", None)
+    if echo:
+        request.session["echo"] = echo
+    return views.restReturn(request, dict(echo=request.session.get("echo", "not set")))
+
+
 @url(r'^joke$')
 def on_get_joke(request):
     return views.restGet(request, {"joke": joke.getRandomJoke()})