django-restit 4.2.174__tar.gz → 4.2.176__tar.gz

{django_restit-4.2.174 → django_restit-4.2.176}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: django-restit
-Version: 4.2.174
+Version: 4.2.176
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

django_restit-4.2.176/account/migrations/0023_authsession_method.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.18 on 2025-03-23 19:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0022_alter_memberdevice_modified'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='authsession',
+            name='method',
+            field=models.CharField(blank=True, db_index=True, default=None, max_length=127, null=True),
+        ),
+    ]

{django_restit-4.2.174 → django_restit-4.2.176}/account/models/member.py

@@ -149,7 +149,7 @@ class Member(User, RestModel, MetaDataModel):
     display_name = models.CharField(max_length=64, blank=True, null=True, default=None)
     picture = models.ForeignKey("medialib.MediaItem", blank=True, null=True, help_text="Profile picture", related_name='+', on_delete=models.CASCADE)
 
-    # we use this token to allow us to invalidate JWT tokens 
+    # we use this token to allow us to invalidate JWT tokens
     security_token = models.CharField(max_length=64, blank=True, null=True, default=None, db_index=True)
     auth_code = models.CharField(max_length=64, blank=True, null=True, default=None, db_index=True)
     auth_code_expires = models.DateTimeField(blank=True, null=True, default=None)
@@ -263,6 +263,24 @@ class Member(User, RestModel, MetaDataModel):
             return self.has_usable_password()
         return False
 
+    def getFailedLoginCount(self):
+        c = RemoteEvents.hget("users:failed:username", self.username)
+        if c is not None:
+            return int(c)
+        return c
+
+    @classmethod
+    def GetFailedLoginsForIP(cls, ip):
+        c = RemoteEvents.hget("users:failed:ip", ip)
+        if c is not None:
+            return int(c)
+        return c
+
+    @classmethod
+    def GetIPsWithFailedLoginAttempts(cls, threshold):
+        failed_ips = RemoteEvents.hgetall("users:failed:ip")
+        return {ip: int(count) for ip, count in failed_ips.items() if int(count) > threshold}
+
     def recordFailedLogin(self, request):
         c = RemoteEvents.hincrby("users:failed:username", self.username, 1)
         if c >= settings.LOCK_PASSWORD_ATTEMPTS:
@@ -273,13 +291,15 @@ class Member(User, RestModel, MetaDataModel):
                 "account", f"incorrect password for {self.username}", level=8,
                 error_code=498,
                 request=request)
-        c = RemoteEvents.hincrby("users:failed:ip", request.ip, 1)
+        ic = RemoteEvents.hincrby("users:failed:ip", request.ip, 1)
+        return c
 
     def recordSuccessLogin(self, request):
         self.last_login = datetime.now()
         self.save()
         RemoteEvents.hdel("users:failed:username", self.username)
-        RemoteEvents.hdel("users:failed:ip", request.ip)
+        if request:
+            RemoteEvents.hdel("users:failed:ip", request.ip)
 
     def hasPasswordExpired(self):
         now = datetime.now()
@@ -288,38 +308,33 @@ class Member(User, RestModel, MetaDataModel):
             self.save()
         return now - self.password_changed > timedelta(days=settings.PASSWORD_EXPIRES_DAYS)
 
-    def login(self, password=None, request=None, use_jwt=False):
-        if not self.is_active or self.is_blocked:
-            return False
-        # can force login
+    def login(self, password=None, request=None):
         if not request:
             request = rh.getActiveRequest()
+        if not self.is_active or self.is_blocked:
+            return False
         if not self.checkPassword(password):
-            # invalid password
             self.recordFailedLogin(request)
             return False
-        else:
-            self.recordSuccessLogin(request)
-        if use_jwt:
-            self.recordSuccessLogin(request)
-            self.locateByIP(request.ip)
-            return True
-        self.user_ptr.backend = 'django.contrib.auth.backends.ModelBackend'
-        auth_login(request, self.user_ptr)
-        self.locateByIP(request.ip)
+        self.authLogin(request)
         return True
 
     def loginNoPassword(self, request=None):
         if not self.is_active or self.is_blocked:
             return False
-        # can force login
         if not request:
             request = rh.getActiveRequest()
-        self.user_ptr.backend = 'django.contrib.auth.backends.ModelBackend'
-        auth_login(request, self.user_ptr)
-        self.locateByIP(request.ip)
+        self.authLogin(request)
         return True
 
+    def authLogin(self, request, use_session=True):
+        if use_session:
+            self.user_ptr.backend = 'django.contrib.auth.backends.ModelBackend'
+            auth_login(request, self.user_ptr)
+        if request:
+            self.locateByIP(request.ip)
+        self.recordSuccessLogin(request)
+
     def canLogin(self, request=None, throw_exception=True, using_password=True):
         if not self.is_active:
             self.log("login_blocked", F"account is not active {self.username}", request, method="login", level=31)
@@ -577,7 +592,7 @@ class Member(User, RestModel, MetaDataModel):
         SMS.send(phone, msg)
         return True
 
-    def sendEmail(self, subject, body, attachments=[], do_async=True, template=None, 
+    def sendEmail(self, subject, body, attachments=[], do_async=True, template=None,
                   context=None):
         default_domain = self.getProperty("default_domain", settings.EMAIL_DEFAULT_DOMAIN)
         from_email = rh.getFromEmailForHost(default_domain)
@@ -675,7 +690,7 @@ class Member(User, RestModel, MetaDataModel):
             allow_email = not self.email_disabled and valid_email and (force or via in ["all", "email"])
         else:
             allow_email = valid_email
-        
+
         if not allow_email and not allow_sms:
             return False
 
@@ -796,7 +811,7 @@ class Member(User, RestModel, MetaDataModel):
     def block(self, reason, request=None):
         if not request:
             request = self.getActiveRequest()
-        PersistentLog.log("account blocked, {}".format(reason), 5, request, "account.Member", self.pk, "blocked")
+        self.auditLog(f"account blocked, {reason}", "blocked", level=5)
         RemoteEvents.hset("users:blocked:username", self.username, time.time())
         self.reportIncident(
             "account", f"account '{self.username}' blocked: {reason}", level=2,
@@ -832,7 +847,7 @@ class Member(User, RestModel, MetaDataModel):
 
     # BEGIN REST CALLBACKS
     def on_permission_change(self, key, value, old_value, category):
-        # called when a metadata.permissions field changes.. see django settings USER_METADATA_PROPERTIES 
+        # called when a metadata.permissions field changes.. see django settings USER_METADATA_PROPERTIES
         # we want to log both the person changing permissions
         # and those being changed
         request = RestModel.getActiveRequest()
@@ -865,7 +880,7 @@ class Member(User, RestModel, MetaDataModel):
         request = self.getActiveRequest()
         if not request.member.is_superuser:
             raise PermissionDeniedException("Permission Denied: attempting to super user")
-        self.is_superuser = int(value)     
+        self.is_superuser = int(value)
 
     def set_disable(self, value):
         if value is not None and value in [1, '1', True, 'true']:
@@ -1219,7 +1234,7 @@ class Member(User, RestModel, MetaDataModel):
     def authWS4RedisConnection(cls, auth_data):
         """
         This method is used by the async/websocket service to authenticate.
-        If the model can authenticate the connection it should return dict 
+        If the model can authenticate the connection it should return dict
         with kind and pk of the model that is authenticaed
         """
         from rest import UberDict
@@ -1338,5 +1353,3 @@ class AuthToken(models.Model, RestModel):
 
     def __str__(self):
         return "{o.member}: {o.secure_token}".format(o=self)
-
-

{django_restit-4.2.174 → django_restit-4.2.176}/account/models/session.py

@@ -42,6 +42,7 @@ class AuthSession(models.Model, RestModel):
     signature = models.CharField(max_length=127, db_index=True)
     ip = models.CharField(max_length=127, null=True, blank=True, db_index=True)
     buid = models.CharField(max_length=127, null=True, blank=True, default=None)
+    method = models.CharField(max_length=127, null=True, blank=True, db_index=True, default=None)
 
     member = models.ForeignKey("account.Member", null=True, blank=True, related_name="auth_sessions", on_delete=models.CASCADE)
     location = models.ForeignKey("location.GeoIP", related_name="auth_sessions", blank=True, null=True, default=None, on_delete=models.CASCADE)
@@ -72,8 +73,9 @@ class AuthSession(models.Model, RestModel):
         return f"{self.member.username} - {self.ip} - {self.os} - {self.browser}"
 
     @classmethod
-    def NewSession(cls, request):
+    def NewSession(cls, request, method="jwt"):
         obj = cls(ip=request.ip, member=request.member, signature=request.signature)
+        obj.method = method
         obj.user_agent = request.META.get('HTTP_USER_AGENT', None)
         obj.last_activity = datetime.now()
         obj.buid = request.POST.get("__buid__", request.GET.get("__buid__", None))
@@ -92,4 +94,3 @@ class AuthSession(models.Model, RestModel):
                 session.touch()
             return session
         return None
-

{django_restit-4.2.174 → django_restit-4.2.176}/account/rpc/auth.py

@@ -37,6 +37,7 @@ def member_login(request):
 @rd.never_cache
 def jwt_login(request):
     # poor mans JWT, carried over
+    auth_method = "basic"
     username = request.DATA.get('username', None)
     if not username:
         return rv.restPermissionDenied(request, "Password and/or Username is incorrect", error_code=422)
@@ -45,29 +46,31 @@ def jwt_login(request):
         return rv.restPermissionDenied(request, error=f"Password and/or Username is incorrect for {username}", error_code=422)
     auth_code = request.DATA.get(["auth_code", "code", "invite_token"], None)
     if username and auth_code:
+        # this is typically used for OAUTH (final)
         return member_login_uname_code(request, username, auth_code)
     password = request.DATA.get('password', None)
     member.canLogin(request)  # throws exception if cannot login
     if member.requires_totp or member.has_totp:
+        auth_method = "basic+totp"
         resp = checkForTOTP(request, member)
         if resp is not None:
             return resp
-    if not member.login(request=request, password=password, use_jwt=True):
+    if not member.login(request=request, password=password):
         # we do not want permission denied catcher invoked as it is already handled in login method
         return rv.restStatus(request, False, error=f"Invalid Credentials {username}", error_code=401)
-    return on_complete_jwt(request, member)
+    return on_complete_jwt(request, member, auth_method)
 
 
-def on_complete_jwt(request, member):
+def on_complete_jwt(request, member, method="basic"):
     if member.security_token is None or member.security_token == JWT_KEY or member.force_single_session:
         member.refreshSecurityToken()
 
     member.log(
-        "jwt_login", "jwt login succesful", 
+        "jwt_login", "jwt login succesful",
         request, method="login", level=7)
 
     device_id = request.DATA.get(["device_id", "deviceID"])
-    
+
     token = JWToken(
         user_id=member.pk,
         key=member.security_token,
@@ -80,13 +83,13 @@ def on_complete_jwt(request, member):
     request.signature = token.session_id
     request.device_id = device_id
     request.buid = request.DATA.get("__buid__", None)
-    request.auth_session = am.AuthSession.NewSession(request)
+    request.auth_session = am.AuthSession.NewSession(request, method)
     if bool(device_id):
         am.MemberDevice.register(request, member, device_id)
-    
+
     request.jwt_token = token.access_token  # this tells the middleware to store in cookie
     return rv.restGet(
-        request, 
+        request,
         dict(
             access=token.access_token,
             refresh=token.refresh_token,
@@ -218,12 +221,13 @@ def member_login_uname_code(request, username, auth_code):
         member.setPassword(password)
     member.auth_code = None
     member.auth_code_expires = None
-    member.login(request=request)
+    member.canLogin(request, using_password=False)  # throws exception if cannot login
+    member.loginNoPassword(request)
     member.save()
     member.log("code_login", "code login", request, method="login", level=8)
-    if request.DATA.get("auth_method") == "basic":
+    if request.DATA.get("auth_method") == "basic" and ALLOW_BASIC_LOGIN:
         return rv.restGet(request, dict(id=member.pk, session_key=request.session.session_key))
-    return on_complete_jwt(request, member)
+    return on_complete_jwt(request, member, "auth_code")
 
 
 @rd.url(r'^logout$')
@@ -296,7 +300,7 @@ def get_member_from_request(request):
         request.member = member
         member.log("login_blocked", "account is locked out", request, method="login", level=31)
         return member, rv.restPermissionDenied(request, error=f"{member.username} Account locked out", error_code=411)
-    return member, None  
+    return member, None
 
 
 @rd.urlPOST('forgot')
@@ -410,3 +414,10 @@ def totp_verify(request):
     return rv.restStatus(request, True)
 
 
+# time based one time passwords
+@rd.urlPOST('security/ip/failed_logins')
+@rd.login_required
+def failed_logins_by_ip(request):
+    ips = am.Member.GetIPsWithFailedLoginAttempts(request.DATA.get("threshold", 10))
+    lst = [dict(ip=k, count=v) for k, v in ips.items()]
+    return rv.restList(request, lst)

{django_restit-4.2.174 → django_restit-4.2.176}/account/rpc/oauth.py

@@ -20,37 +20,43 @@ def oauth_google_login(request):
     state = request.DATA.get("state")
     app_url = settings.DEFAULT_LOGIN_URL
 
-    rh.log_print("google/login", request.DATA.toDict(), request.session.get("state"))
+    # rh.log_print("google/login", request.DATA.toDict(), request.session.get("state"))
 
     if state:
+        # this is where we should pull out the passed in state and get the proper URL
         state = objict.fromJSON(rh.hexToString(state))
         rh.log_print("state", state)
         app_url = state.url
 
     if not code:
         params = urlencode({'error': error})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
-    redirect_uri = f"{settings.BASE_URL_SECURE}{REST_PREFIX}account/oauth/google/login"
+    redirect_uri = f"{request.scheme}://{request.get_host()}/{REST_PREFIX}account/oauth/google/login"
     auth_data = google.getAccessToken(code, redirect_uri)
     if auth_data is None or auth_data.access_token is None:
         params = urlencode({'error': "failed to get access token from google"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     user_data = google.getUserInfo(auth_data.access_token)
     if user_data is None:
         params = urlencode({'error': "failed to get user data from google"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     if not user_data.email:
         params = urlencode({'error': "no email with account"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     # TODO allow new accounts?
     member = Member.objects.filter(email=user_data.email).last()
     if member is None:
         params = urlencode({'error': "user not found"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     member.setProperties(auth_data, category="google_auth")
     member.setProperties(user_data, category="google")
@@ -69,13 +75,8 @@ def oauth_google_login(request):
     member.save()
     member.auditLog("user succesfully authenticated with google", "google_oauth", level=17)
 
-    params = urlencode({'oauth_code': member.auth_code, "username":member.username})
+    params = urlencode({'oauth_code': member.auth_code, "username":member.username, "auth_method":"google_oauth"})
     rurl = None
-    if "?" in app_url:
-        if app_url[-1] == "?":
-            rurl = f"{app_url}{params}"
-        else:
-            rurl = f"{app_url}&{params}"
-    else:
-        rurl = f"{app_url}?{params}"
+    separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+    rurl = f"{app_url}{separator}{params}"
     return redirect(rurl)

{django_restit-4.2.174 → django_restit-4.2.176}/account/rpc/passkeys.py

@@ -51,4 +51,4 @@ def rest_on_passkeys_auth_complete(request):
         request.session.pop("fido2_state"),
         request.session.pop("fido2_rp_id"))
     # we now want to handle the JWT or basic login flow
-    return on_complete_jwt(request, uk.member)
+    return on_complete_jwt(request, uk.member, "passkey")

{django_restit-4.2.174 → django_restit-4.2.176}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.174"
+version = "4.2.176"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.174 → django_restit-4.2.176}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.174"
+__version__ = "4.2.176"

{django_restit-4.2.174 → django_restit-4.2.176}/rest/mail.py

@@ -37,11 +37,16 @@ SES_REGION = settings.SES_REGION
 EMAIL_METRICS = settings.get("EMAIL_METRICS", False)
 
 
-def send(to, subject, body=None, attachments=[], 
+def send(to, subject, body=None, attachments=[],
          from_email=settings.DEFAULT_FROM_EMAIL,
-         fail_silently=True, template=None, 
+         fail_silently=True, template=None,
          context=None, do_async=False, replyto=None):
     # make sure to is list
+    if isinstance(to, str):
+        if "," in to:
+            to = [t.strip() for t in to.split(',')]
+        elif ";" in to:
+            to = [t.strip() for t in to.split(';')]
     if not isinstance(to, (tuple, list)):
         to = [to]
     # if template lets render
@@ -254,5 +259,3 @@ def render_to_mail(name, context):
         body = html_content
 
     send(toaddrs, subject, body=body, from_email=fromaddr, do_async=True, replyto=replyto)
-
-

{django_restit-4.2.174 → django_restit-4.2.176}/rest/serializers/response.py

@@ -15,7 +15,7 @@ from . import csv
 from . import excel
 # from . import profiler
 STATUS_ON_PERM_DENIED = settings.get("STATUS_ON_PERM_DENIED", 403)
-REST_LIST_CACHE_COUNT = settings.get("REST_LIST_CACHE_COUNT", True)
+REST_LIST_CACHE_COUNT = settings.get("REST_LIST_CACHE_COUNT", False)
 
 
 def get_query_hash(queryset):