flask-appbuilder 3.2.1rc1__py3-none-any.whl → 5.0.2rc1__py3-none-any.whl

flask_appbuilder/security/api.py

@@ -1,28 +1,24 @@
-from flask import request
-from flask_jwt_extended import (
-    create_access_token,
-    create_refresh_token,
-    get_jwt_identity,
-    jwt_refresh_token_required,
-)
-
-from ..api import BaseApi, safe
-from ..const import (
+from flask import request, Response
+from flask_appbuilder.api import BaseApi, safe
+from flask_appbuilder.const import (
     API_SECURITY_ACCESS_TOKEN_KEY,
-    API_SECURITY_PASSWORD_KEY,
     API_SECURITY_PROVIDER_DB,
-    API_SECURITY_PROVIDER_KEY,
     API_SECURITY_PROVIDER_LDAP,
-    API_SECURITY_REFRESH_KEY,
     API_SECURITY_REFRESH_TOKEN_KEY,
-    API_SECURITY_USERNAME_KEY,
     API_SECURITY_VERSION,
 )
-from ..views import expose
+from flask_appbuilder.security.schemas import login_post
+from flask_appbuilder.views import expose
+from flask_jwt_extended import (
+    create_access_token,
+    create_refresh_token,
+    get_jwt_identity,
+    jwt_required,
+)
+from marshmallow import ValidationError
 
 
 class SecurityApi(BaseApi):
-
     resource_name = "security"
     version = API_SECURITY_VERSION
     openapi_spec_tag = "Security"
@@ -35,7 +31,7 @@ class SecurityApi(BaseApi):
 
     @expose("/login", methods=["POST"])
     @safe
-    def login(self):
+    def login(self) -> Response:
         """Login endpoint for the API returns a JWT and optionally a refresh token
         ---
         post:
@@ -88,20 +84,20 @@ class SecurityApi(BaseApi):
         """
         if not request.is_json:
             return self.response_400(message="Request payload is not JSON")
-        username = request.json.get(API_SECURITY_USERNAME_KEY, None)
-        password = request.json.get(API_SECURITY_PASSWORD_KEY, None)
-        provider = request.json.get(API_SECURITY_PROVIDER_KEY, None)
-        refresh = request.json.get(API_SECURITY_REFRESH_KEY, False)
-        if not username or not password or not provider:
-            return self.response_400(message="Missing required parameter")
+        try:
+            login_payload = login_post.load(request.json)
+        except ValidationError as error:
+            return self.response_400(message=error.messages)
+
         # AUTH
-        if provider == API_SECURITY_PROVIDER_DB:
-            user = self.appbuilder.sm.auth_user_db(username, password)
-        elif provider == API_SECURITY_PROVIDER_LDAP:
-            user = self.appbuilder.sm.auth_user_ldap(username, password)
-        else:
-            return self.response_400(
-                message="Provider {} not supported".format(provider)
+        user = None
+        if login_payload["provider"] == API_SECURITY_PROVIDER_DB:
+            user = self.appbuilder.sm.auth_user_db(
+                login_payload["username"], login_payload["password"]
+            )
+        elif login_payload["provider"] == API_SECURITY_PROVIDER_LDAP:
+            user = self.appbuilder.sm.auth_user_ldap(
+                login_payload["username"], login_payload["password"]
             )
         if not user:
             return self.response_401()
@@ -109,18 +105,18 @@ class SecurityApi(BaseApi):
         # Identity can be any data that is json serializable
         resp = dict()
         resp[API_SECURITY_ACCESS_TOKEN_KEY] = create_access_token(
-            identity=user.id, fresh=True
+            identity=str(user.id), fresh=True
         )
-        if refresh:
+        if "refresh" in login_payload and login_payload["refresh"]:
             resp[API_SECURITY_REFRESH_TOKEN_KEY] = create_refresh_token(
-                identity=user.id
+                identity=str(user.id)
             )
         return self.response(200, **resp)
 
     @expose("/refresh", methods=["POST"])
-    @jwt_refresh_token_required
+    @jwt_required(refresh=True)
     @safe
-    def refresh(self):
+    def refresh(self) -> Response:
         """
             Security endpoint for the refresh token, so we can obtain a new
             token without forcing the user to login again

flask_appbuilder/security/decorators.py

@@ -1,42 +1,80 @@
 import functools
 import logging
-
-from flask import current_app, flash, jsonify, make_response, redirect, request, url_for
-from flask_jwt_extended import verify_jwt_in_request
-from flask_login import current_user
-
-from .._compat import as_unicode
-from ..const import (
+from typing import Callable, List, Optional, TypeVar, Union
+
+from flask import (
+    current_app,
+    flash,
+    jsonify,
+    make_response,
+    redirect,
+    request,
+    Response,
+    url_for,
+)
+from flask_appbuilder._compat import as_unicode
+from flask_appbuilder.const import (
     FLAMSG_ERR_SEC_ACCESS_DENIED,
     LOGMSG_ERR_SEC_ACCESS_DENIED,
     PERMISSION_PREFIX,
 )
+from flask_appbuilder.utils.limit import Limit
+from flask_jwt_extended import verify_jwt_in_request
+from flask_limiter import RequestLimit
+from flask_login import current_user
+from typing_extensions import ParamSpec
 
 log = logging.getLogger(__name__)
 
+R = TypeVar("R")
+P = ParamSpec("P")
+
+
+def no_cache(view: Callable[..., Response]) -> Callable[..., Response]:
+    @functools.wraps(view)
+    def wrapped_view(*args, **kwargs) -> Response:
+        response = make_response(view(*args, **kwargs))
+        response.headers[
+            "Cache-Control"
+        ] = "no-store, no-cache, must-revalidate, max-age=0"
+        response.headers["Pragma"] = "no-cache"
+        response.headers["Expires"] = "0"
+        return response
+
+    return wrapped_view
+
+
+def response_unauthorized_mvc(status_code: int) -> Response:
+    response = make_response(
+        jsonify({"message": str(FLAMSG_ERR_SEC_ACCESS_DENIED), "severity": "danger"}),
+        status_code,
+    )
+    response.headers["Content-Type"] = "application/json"
+    return response
+
 
 def protect(allow_browser_login=False):
     """
-        Use this decorator to enable granular security permissions
-        to your API methods (BaseApi and child classes).
-        Permissions will be associated to a role, and roles are associated to users.
-
-        allow_browser_login will accept signed cookies obtained from the normal MVC app::
-
-            class MyApi(BaseApi):
-                @expose('/dosonmething', methods=['GET'])
-                @protect(allow_browser_login=True)
-                @safe
-                def do_something(self):
-                    ....
-
-                @expose('/dosonmethingelse', methods=['GET'])
-                @protect()
-                @safe
-                def do_something_else(self):
-                    ....
-
-        By default the permission's name is the methods name.
+    Use this decorator to enable granular security permissions
+    to your API methods (BaseApi and child classes).
+    Permissions will be associated to a role, and roles are associated to users.
+
+    allow_browser_login will accept signed cookies obtained from the normal MVC app::
+
+        class MyApi(BaseApi):
+            @expose('/dosonmething', methods=['GET'])
+            @protect(allow_browser_login=True)
+            @safe
+            def do_something(self):
+                ....
+
+            @expose('/dosonmethingelse', methods=['GET'])
+            @protect()
+            @safe
+            def do_something_else(self):
+                ....
+
+    By default the permission's name is the methods name.
     """
 
     def _protect(f):
@@ -47,25 +85,31 @@ def protect(allow_browser_login=False):
 
         def wraps(self, *args, **kwargs):
             # Apply method permission name override if exists
-            permission_str = "{}{}".format(PERMISSION_PREFIX, f._permission_name)
+            permission_str = f"{PERMISSION_PREFIX}{f._permission_name}"
             if self.method_permission_name:
                 _permission_name = self.method_permission_name.get(f.__name__)
                 if _permission_name:
-                    permission_str = "{}{}".format(PERMISSION_PREFIX, _permission_name)
+                    permission_str = f"{PERMISSION_PREFIX}{_permission_name}"
             class_permission_name = self.class_permission_name
+            # Check if permission is allowed on the class
             if permission_str not in self.base_permissions:
-                return self.response_401()
+                return self.response_403()
+            # Check if the resource is public
             if current_app.appbuilder.sm.is_item_public(
                 permission_str, class_permission_name
             ):
                 return f(self, *args, **kwargs)
+            # if no browser login then verify JWT
             if not (self.allow_browser_login or allow_browser_login):
                 verify_jwt_in_request()
+            # Verify resource access
             if current_app.appbuilder.sm.has_access(
                 permission_str, class_permission_name
             ):
                 return f(self, *args, **kwargs)
+            # If browser login?
             elif self.allow_browser_login or allow_browser_login:
+                # no session cookie (but we allow it), then try JWT
                 if not current_user.is_authenticated:
                     verify_jwt_in_request()
                 if current_app.appbuilder.sm.has_access(
@@ -73,11 +117,9 @@ def protect(allow_browser_login=False):
                 ):
                     return f(self, *args, **kwargs)
             log.warning(
-                LOGMSG_ERR_SEC_ACCESS_DENIED.format(
-                    permission_str, class_permission_name
-                )
+                LOGMSG_ERR_SEC_ACCESS_DENIED, permission_str, class_permission_name
             )
-            return self.response_401()
+            return self.response_403()
 
         f._permission_name = permission_str
         return functools.update_wrapper(wraps, f)
@@ -87,10 +129,10 @@ def protect(allow_browser_login=False):
 
 def has_access(f):
     """
-        Use this decorator to enable granular security permissions to your methods.
-        Permissions will be associated to a role, and roles are associated to users.
+    Use this decorator to enable granular security permissions to your methods.
+    Permissions will be associated to a role, and roles are associated to users.
 
-        By default the permission's name is the methods name.
+    By default the permission's name is the methods name.
     """
     if hasattr(f, "_permission_name"):
         permission_str = f._permission_name
@@ -98,20 +140,18 @@ def has_access(f):
         permission_str = f.__name__
 
     def wraps(self, *args, **kwargs):
-        permission_str = "{}{}".format(PERMISSION_PREFIX, f._permission_name)
+        permission_str = f"{PERMISSION_PREFIX}{f._permission_name}"
         if self.method_permission_name:
             _permission_name = self.method_permission_name.get(f.__name__)
             if _permission_name:
-                permission_str = "{}{}".format(PERMISSION_PREFIX, _permission_name)
+                permission_str = f"{PERMISSION_PREFIX}{_permission_name}"
         if permission_str in self.base_permissions and self.appbuilder.sm.has_access(
             permission_str, self.class_permission_name
         ):
             return f(self, *args, **kwargs)
         else:
             log.warning(
-                LOGMSG_ERR_SEC_ACCESS_DENIED.format(
-                    permission_str, self.__class__.__name__
-                )
+                LOGMSG_ERR_SEC_ACCESS_DENIED, permission_str, self.__class__.__name__
             )
             flash(as_unicode(FLAMSG_ERR_SEC_ACCESS_DENIED), "danger")
         return redirect(
@@ -127,12 +167,12 @@ def has_access(f):
 
 def has_access_api(f):
     """
-        Use this decorator to enable granular security permissions to your API methods.
-        Permissions will be associated to a role, and roles are associated to users.
+    Use this decorator to enable granular security permissions to your API methods.
+    Permissions will be associated to a role, and roles are associated to users.
 
-        By default the permission's name is the methods name.
+    By default the permission's name is the methods name.
 
-        this will return a message and HTTP 401 is case of unauthorized access.
+    this will return a message and HTTP 403 is case of unauthorized access.
     """
     if hasattr(f, "_permission_name"):
         permission_str = f._permission_name
@@ -140,29 +180,22 @@ def has_access_api(f):
         permission_str = f.__name__
 
     def wraps(self, *args, **kwargs):
-        permission_str = "{}{}".format(PERMISSION_PREFIX, f._permission_name)
+        permission_str = f"{PERMISSION_PREFIX}{f._permission_name}"
         if self.method_permission_name:
             _permission_name = self.method_permission_name.get(f.__name__)
             if _permission_name:
-                permission_str = "{}{}".format(PERMISSION_PREFIX, _permission_name)
+                permission_str = f"{PERMISSION_PREFIX}{_permission_name}"
         if permission_str in self.base_permissions and self.appbuilder.sm.has_access(
             permission_str, self.class_permission_name
         ):
             return f(self, *args, **kwargs)
         else:
             log.warning(
-                LOGMSG_ERR_SEC_ACCESS_DENIED.format(
-                    permission_str, self.__class__.__name__
-                )
-            )
-            response = make_response(
-                jsonify(
-                    {"message": str(FLAMSG_ERR_SEC_ACCESS_DENIED), "severity": "danger"}
-                ),
-                401,
+                LOGMSG_ERR_SEC_ACCESS_DENIED, permission_str, self.__class__.__name__
             )
-            response.headers["Content-Type"] = "application/json"
-            return response
+            if not current_user.is_authenticated:
+                return response_unauthorized_mvc(401)
+            return response_unauthorized_mvc(403)
 
     f._permission_name = permission_str
     return functools.update_wrapper(wraps, f)
@@ -170,38 +203,38 @@ def has_access_api(f):
 
 def permission_name(name):
     """
-        Use this decorator to override the name of the permission.
-        has_access will use the methods name has the permission name
-        if you want to override this add this decorator to your methods.
-        This is useful if you want to aggregate methods to permissions
+    Use this decorator to override the name of the permission.
+    has_access will use the methods name has the permission name
+    if you want to override this add this decorator to your methods.
+    This is useful if you want to aggregate methods to permissions
 
-        It will add '_permission_name' attribute to your method
-        that will be inspected by BaseView to collect your view's
-        permissions.
+    It will add '_permission_name' attribute to your method
+    that will be inspected by BaseView to collect your view's
+    permissions.
 
-        Note that you should use @has_access to execute after @permission_name
-        like on the following example.
+    Note that you should use @has_access to execute after @permission_name
+    like on the following example.
 
-        Use it like this to aggregate permissions for your methods::
+    Use it like this to aggregate permissions for your methods::
 
-            class MyModelView(ModelView):
-                datamodel = SQLAInterface(MyModel)
+        class MyModelView(ModelView):
+            datamodel = SQLAInterface(MyModel)
 
-                @has_access
-                @permission_name('GeneralXPTO_Permission')
-                @expose(url='/xpto')
-                def xpto(self):
-                    return "Your on xpto"
+            @has_access
+            @permission_name('GeneralXPTO_Permission')
+            @expose(url='/xpto')
+            def xpto(self):
+                return "Your on xpto"
 
-                @has_access
-                @permission_name('GeneralXPTO_Permission')
-                @expose(url='/xpto2')
-                def xpto2(self):
-                    return "Your on xpto2"
+            @has_access
+            @permission_name('GeneralXPTO_Permission')
+            @expose(url='/xpto2')
+            def xpto2(self):
+                return "Your on xpto2"
 
 
-        :param name:
-            The name of the permission to override
+    :param name:
+        The name of the permission to override
     """
 
     def wraps(f):
@@ -209,3 +242,68 @@ def permission_name(name):
         return f
 
     return wraps
+
+
+def limit(
+    limit_value: Union[str, Callable[[], str]],
+    key_func: Optional[Callable[[], str]] = None,
+    per_method: bool = False,
+    methods: Optional[List[str]] = None,
+    error_message: Optional[str] = None,
+    exempt_when: Optional[Callable[[], bool]] = None,
+    override_defaults: bool = True,
+    deduct_when: Optional[Callable[[Response], bool]] = None,
+    on_breach: Optional[Callable[[RequestLimit], Optional[Response]]] = None,
+    cost: Union[int, Callable[[], int]] = 1,
+):
+    """
+    Decorator to be used for rate limiting individual routes or blueprints.
+
+    :param limit_value: rate limit string or a callable that returns a
+     string. :ref:`ratelimit-string` for more details.
+    :param key_func: function/lambda to extract the unique
+     identifier for the rate limit. defaults to remote address of the
+     request.
+    :param per_method: whether the limit is sub categorized into the
+     http method of the request.
+    :param methods: if specified, only the methods in this list will
+     be rate limited (default: ``None``).
+    :param error_message: string (or callable that returns one) to override
+     the error message used in the response.
+    :param exempt_when: function/lambda used to decide if the rate
+     limit should skipped.
+    :param override_defaults:  whether the decorated limit overrides
+     the default limits (Default: ``True``).
+
+     .. note:: When used with a :class:`~BaseView` the meaning
+        of the parameter extends to any parents the blueprint instance is
+        registered under. For more details see :ref:`recipes:nested blueprints`
+
+    :param deduct_when: a function that receives the current
+     :class:`flask.Response` object and returns True/False to decide if a
+     deduction should be done from the rate limit
+    :param on_breach: a function that will be called when this limit
+     is breached. If the function returns an instance of :class:`flask.Response`
+     that will be the response embedded into the :exc:`RateLimitExceeded` exception
+     raised.
+    :param cost: The cost of a hit or a function that
+     takes no parameters and returns the cost as an integer (Default: ``1``).
+    """
+
+    def wraps(f: Callable[P, R]) -> Callable[P, R]:
+        _limit = Limit(
+            limit_value=limit_value,
+            key_func=key_func,
+            per_method=per_method,
+            methods=methods,
+            error_message=error_message,
+            exempt_when=exempt_when,
+            override_defaults=override_defaults,
+            deduct_when=deduct_when,
+            on_breach=on_breach,
+            cost=cost,
+        )
+        f._limit = _limit
+        return f
+
+    return wraps

flask_appbuilder/security/forms.py

@@ -1,16 +1,29 @@
 from flask_babel import lazy_gettext
 from flask_wtf.recaptcha import RecaptchaField
-from wtforms import BooleanField, PasswordField, StringField
-from wtforms.validators import DataRequired, Email, EqualTo
+from wtforms import PasswordField, StringField
+from wtforms.validators import DataRequired, Email, EqualTo, ValidationError
 
 from ..fieldwidgets import BS3PasswordFieldWidget, BS3TextFieldWidget
 from ..forms import DynamicForm
+from ..validators import PasswordComplexityValidator
 
 
-class LoginForm_oid(DynamicForm):
-    openid = StringField(lazy_gettext("OpenID"), validators=[DataRequired()])
-    username = StringField(lazy_gettext("User Name"))
-    remember_me = BooleanField(lazy_gettext("Remember me"), default=False)
+class SelectDataRequired(DataRequired):
+    """
+    Select required flag on the input field will not work well on Chrome
+    Console error:
+        An invalid form control with name='roles' is not focusable.
+
+    This makes a simple override to the DataRequired to be used specifically with
+    select fields
+    """
+
+    field_flags = {}
+
+
+def roles_or_groups_required(form, field):
+    if not form["roles"].data and not form["groups"].data:
+        raise ValidationError(lazy_gettext("Either select a role or a group"))
 
 
 class LoginForm_db(DynamicForm):
@@ -40,7 +53,7 @@ class ResetPasswordForm(DynamicForm):
             "Please use a good password policy,"
             " this application does not check this for you"
         ),
-        validators=[DataRequired()],
+        validators=[DataRequired(), PasswordComplexityValidator()],
         widget=BS3PasswordFieldWidget(),
     )
     conf_password = PasswordField(
@@ -88,27 +101,3 @@ class RegisterUserDBForm(DynamicForm):
         widget=BS3PasswordFieldWidget(),
     )
     recaptcha = RecaptchaField()
-
-
-class RegisterUserOIDForm(DynamicForm):
-    username = StringField(
-        lazy_gettext("User Name"),
-        validators=[DataRequired()],
-        widget=BS3TextFieldWidget(),
-    )
-    first_name = StringField(
-        lazy_gettext("First Name"),
-        validators=[DataRequired()],
-        widget=BS3TextFieldWidget(),
-    )
-    last_name = StringField(
-        lazy_gettext("Last Name"),
-        validators=[DataRequired()],
-        widget=BS3TextFieldWidget(),
-    )
-    email = StringField(
-        lazy_gettext("Email"),
-        validators=[DataRequired(), Email()],
-        widget=BS3TextFieldWidget(),
-    )
-    recaptcha = RecaptchaField()