karrio-server-core 2025.5__py3-none-any.whl

karrio/server/conf.py

@@ -0,0 +1,54 @@
+from django.db import connection
+from django.conf import settings as base_settings
+
+FEATURE_FLAGS = {
+    k: getattr(base_settings, k, True) for k, _ in base_settings.FEATURE_FLAGS
+}
+DEFAULT_ALLOWED_CONFIG = [
+    "APP_NAME",
+    "APP_WEBSITE",
+    "SUPPORT_EMAIL",
+    "BASE_TEMPLATE",
+    "BASE_FOOTER_TEMPLATE",
+]
+FALLBACK_VALUES = {
+    "APP_NAME": "Karrio",
+    "APP_WEBSITE": "https://karrio.io",
+    "SUPPORT_EMAIL": "hello@karrio.io",
+    "BASE_TEMPLATE": "karrio/base_site.html",
+    "BASE_FOOTER_TEMPLATE": "karrio/base_footer.html",
+}
+
+
+class _Settings:
+    def __getattr__(self, item):
+        if item == "tenant":
+            return self._get_tenant()
+
+        if item == "schema":
+            return self._get_schema()
+
+        if item == "APP_NAME":
+            return getattr(self._get_tenant(), "name", FALLBACK_VALUES.get(item))
+
+        if item == "APP_WEBSITE":
+            return getattr(self._get_tenant(), "website", FALLBACK_VALUES.get(item))
+
+        if item in FEATURE_FLAGS and self._get_tenant() is not None:
+            feature_flags = getattr(self._get_tenant(), "feature_flags", {})
+
+            return feature_flags.get(item, getattr(base_settings, item, None))
+
+        return getattr(base_settings, item, FALLBACK_VALUES.get(item))
+
+    def _get_schema(self):
+        return connection.get_schema() if base_settings.MULTI_TENANTS else None
+
+    def _get_tenant(self):
+        return connection.get_tenant() if base_settings.MULTI_TENANTS else None
+
+    def get(self, item):
+        return getattr(self, item)
+
+
+settings = _Settings()

karrio/server/core/__init__.py

@@ -0,0 +1,3 @@
+__path__ = __import__('pkgutil').extend_path(__path__, __name__)  # type: ignore
+
+default_app_config = 'karrio.server.core.apps.CoreConfig'

karrio/server/core/admin.py

@@ -0,0 +1 @@
+from django.contrib import admin

karrio/server/core/apps.py

@@ -0,0 +1,10 @@
+from django.apps import AppConfig
+
+
+class CoreConfig(AppConfig):
+    name = "karrio.server.core"
+
+    def ready(self):
+        from karrio.server.core.signals import register_signals
+
+        register_signals()

karrio/server/core/authentication.py

@@ -0,0 +1,347 @@
+import yaml  # type: ignore
+import pydoc
+import functools
+from django.db.utils import ProgrammingError
+from django.conf import settings
+from django.contrib.auth import mixins, get_user_model
+from django.utils.translation import gettext_lazy as _
+from django.utils.functional import SimpleLazyObject
+from django.contrib.auth.middleware import (
+    AuthenticationMiddleware as BaseAuthenticationMiddleware,
+)
+from rest_framework import status
+from rest_framework import exceptions
+from rest_framework.authentication import (
+    TokenAuthentication as BaseTokenAuthentication,
+    BasicAuthentication as BaseBasicAuthentication,
+)
+from rest_framework_simplejwt.authentication import (
+    JWTAuthentication as BaseJWTAuthentication,
+)
+from oauth2_provider.contrib.rest_framework import (
+    OAuth2Authentication as BaseOAuth2Authentication,
+)
+from django_otp.middleware import OTPMiddleware
+from karrio.server.core.logging import logger
+
+UserModel = get_user_model()
+AUTHENTICATION_CLASSES = getattr(settings, "AUTHENTICATION_CLASSES", [])
+
+
+def catch_auth_exception(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        try:
+            return func(*args, **kwargs)
+        except exceptions.AuthenticationFailed:
+            from karrio.server.core.exceptions import APIException
+
+            raise APIException(
+                "Given token not valid for any token type",
+                code="invalid_token",
+                status_code=status.HTTP_401_UNAUTHORIZED,
+            )
+
+    return wrapper
+
+
+class TokenAuthentication(BaseTokenAuthentication):
+    def get_model(self):
+        if self.model is not None:
+            return self.model
+        from karrio.server.user.models import Token
+
+        return Token
+
+    @catch_auth_exception
+    def authenticate(self, request):
+        auth = super().authenticate(request)
+
+        if auth is not None:
+            user, token = auth
+            request.user = user or request.user
+            request.token = token
+            request.test_mode = token.test_mode
+            request.org = SimpleLazyObject(
+                functools.partial(
+                    get_request_org,
+                    request,
+                    user,
+                    default_org=token.organization,
+                )
+            )
+
+        return auth
+
+
+class TokenBasicAuthentication(BaseBasicAuthentication):
+    @catch_auth_exception
+    def authenticate(self, request):
+        auth = super(TokenBasicAuthentication, self).authenticate(request)
+
+        if auth is not None:
+            user, token = auth
+            request.user = user or request.user
+            request.token = token
+            request.test_mode = token.test_mode
+            request.org = SimpleLazyObject(
+                functools.partial(
+                    get_request_org,
+                    request,
+                    user,
+                    default_org=token.organization,
+                )
+            )
+
+        return auth
+
+    def authenticate_credentials(self, api_key, *args, **kwargs):
+        """
+        Authenticate the api token with optional request for context.
+        """
+        from karrio.server.user.models import Token
+
+        token = Token.objects.filter(key=api_key).first()
+        user = getattr(token, "user", None)
+
+        if user is None:
+            raise exceptions.AuthenticationFailed(_("Invalid username/password."))
+
+        if not user.is_active:
+            raise exceptions.AuthenticationFailed(_("User inactive or deleted."))
+
+        return (user, token)
+
+
+class JWTAuthentication(BaseJWTAuthentication):
+    @catch_auth_exception
+    def authenticate(self, request):
+        auth = super().authenticate(request)
+
+        if auth is not None:
+            user, token = auth
+
+            request.user = user
+            request.token = token
+            request.test_mode = get_request_test_mode(request)
+            request.otp_is_verified = token.get("is_verified") or False
+            request.org = SimpleLazyObject(
+                functools.partial(
+                    get_request_org,
+                    request,
+                    user,
+                    org_id=request.META.get("HTTP_X_ORG_ID"),
+                )
+            )
+
+            if not token.get("is_verified"):
+                raise exceptions.AuthenticationFailed(
+                    _("Authentication token not verified"), code="otp_not_verified"
+                )
+
+        return auth
+
+
+class OAuth2Authentication(BaseOAuth2Authentication):
+    @catch_auth_exception
+    def authenticate(self, request):
+        auth = super().authenticate(request)
+
+        if auth is not None:
+            user, token = auth
+
+            # Enhanced user context handling for different OAuth flows
+            if user is None:
+                # For client credentials flow, the user might be None from the base class
+                # but our custom validator should have set it on the request
+                if (
+                    hasattr(request, "user")
+                    and request.user
+                    and not request.user.is_anonymous
+                ):
+                    user = request.user
+                elif hasattr(request, "oauth_user"):
+                    user = request.oauth_user
+                # If we still don't have a user, try to get it from the OAuth application
+                elif hasattr(token, "application") and token.application:
+                    user = getattr(token.application, "user", None)
+
+            # Set request context
+            request.user = user or request.user
+            request.token = token
+            request.test_mode = get_request_test_mode(request)
+
+            # Enhanced organization context for OAuth apps
+            default_org = None
+            if hasattr(token, "application") and hasattr(
+                token.application, "oauth_app"
+            ):
+                # If this is an OAuth app token, use the app owner's organization
+                oauth_app = token.application.oauth_app
+                if hasattr(oauth_app, "created_by") and oauth_app.created_by:
+                    app_owner = oauth_app.created_by
+                    if hasattr(app_owner, "organizations"):
+                        default_org = app_owner.organizations.filter(
+                            is_active=True
+                        ).first()
+
+            request.org = SimpleLazyObject(
+                functools.partial(
+                    get_request_org,
+                    request,
+                    user,
+                    org_id=request.META.get("HTTP_X_ORG_ID"),
+                    default_org=default_org,
+                )
+            )
+
+        return auth
+
+
+class TwoFactorAuthenticationMiddleware(OTPMiddleware):
+    pass
+
+
+class AccessMixin(mixins.AccessMixin):
+    """Verify that the current user is authenticated."""
+
+    def dispatch(self, request, *args, **kwargs):
+        if (
+            not hasattr(request, "user")
+            or request.user is None
+            or not request.user.is_authenticated
+        ):
+            authenticate_user(request)
+
+        request.user = SimpleLazyObject(
+            functools.partial(get_request_user, request, request.user)
+        )
+
+        return super().dispatch(request, *args, **kwargs)
+
+
+class AuthenticationMiddleware(BaseAuthenticationMiddleware):
+    def process_response(self, request, response):
+        if getattr(request, "org", None) is not None:
+            response.set_cookie("org_id", getattr(request.org, "id", None))
+            response["X-org-id"] = getattr(request.org, "id", None)
+
+        if getattr(request, "test_mode", None) is not None:
+            response.set_cookie("test_mode", request.test_mode)
+            response["X-test-mode"] = request.test_mode
+
+        return response
+
+    def process_request(self, request):
+        super().process_request(request)
+
+        request = authenticate_user(request)
+
+        if hasattr(request, "user") and getattr(request, "org", None) is None:
+            request.org = get_request_org(
+                request,
+                request.user,
+                org_id=request.META.get("HTTP_X_ORG_ID"),
+            )
+
+        if not hasattr(request, "test_mode"):
+            request.test_mode = get_request_test_mode(request)
+
+
+def authenticate_user(request):
+    def authenticate(request, authenticator):
+        # Check if user exists and is not authenticated
+        if (
+            not hasattr(request, "user")
+            or request.user is None
+            or not getattr(request.user, "is_authenticated", False)
+        ):
+            logger.debug(f"Trying authenticator: {authenticator}")
+            try:
+                auth_instance = pydoc.locate(authenticator)()
+                auth = auth_instance.authenticate(request)
+
+                if auth is not None:
+                    user, token = auth
+                    request.user = user
+                    request.token = token
+            except AttributeError as e:
+                # Skip SessionAuthentication if it fails with _request attribute error
+                if "'WSGIRequest' object has no attribute '_request'" in str(e):
+                    logger.debug(
+                        f"Skipping {authenticator} - incompatible with middleware context"
+                    )
+                else:
+                    raise
+            except exceptions.AuthenticationFailed:
+                # Silently skip authentication failures - let the next authenticator try
+                logger.debug(f"Authentication failed with {authenticator}, trying next")
+                pass
+
+        return request
+
+    try:
+        logger.debug(f"Auth classes to try: {AUTHENTICATION_CLASSES}")
+        return functools.reduce(authenticate, AUTHENTICATION_CLASSES, request)
+    except Exception as e:
+        logger.debug(f"Authentication error: {e}")
+        return request
+
+
+def get_request_org(request, user, org_id: str = None, default_org=None):
+    """
+    Attempts to find and return an organization.
+    """
+    if settings.MULTI_ORGANIZATIONS:
+        try:
+            from karrio.server.orgs.models import Organization
+
+            if default_org is not None:
+                org = default_org
+            elif user and hasattr(user, "id") and user.id:
+                orgs = Organization.objects.filter(users__id=user.id)
+                org = None
+
+                if org_id is not None:
+                    org = orgs.filter(id=org_id).first()
+
+                if org is None:
+                    org = orgs.filter(is_active=True).first()
+            else:
+                org = None
+
+            if org is not None and not org.is_active:
+                raise exceptions.AuthenticationFailed(
+                    _("Organization is inactive"), code="inactive_organization"
+                )
+
+            if org is None and org_id is not None:
+                raise exceptions.AuthenticationFailed(
+                    _("No active organization found with the given credentials"),
+                    code="invalid_organization",
+                )
+
+            return org
+        except ProgrammingError:
+            pass
+
+        return None
+
+
+def get_request_user(request, user):
+    if not getattr(request, "otp_is_verified", True):
+        raise exceptions.AuthenticationFailed(
+            _("Authentication token not verified"), code="otp_not_verified"
+        )
+
+    if user is not None:
+        user.otp_device = None
+        user.is_verified = functools.partial(
+            lambda _: getattr(request, "otp_is_verified", True), user
+        )
+
+    return user
+
+
+def get_request_test_mode(request):
+    return yaml.safe_load(request.META.get("HTTP_X_TEST_MODE", "")) or False

karrio/server/core/config.py

@@ -0,0 +1,31 @@
+"""Karrio server system configuration adapter."""
+
+import typing
+import karrio.lib as lib
+
+
+class ConstanceConfig(lib.AbstractSystemConfig):
+    """Django constance configuration adapter.
+
+    Provides access to runtime configuration values stored
+    in Django constance (database-backed settings).
+    """
+
+    def get(self, key: str, default: typing.Any = None) -> typing.Any:
+        from constance import config as constance_config
+
+        return getattr(constance_config, key, default)
+
+    def __getitem__(self, key: str) -> typing.Any:
+        from constance import config as constance_config
+
+        return getattr(constance_config, key)
+
+    def __contains__(self, key: str) -> bool:
+        from constance import config as constance_config
+
+        return hasattr(constance_config, key)
+
+
+# Singleton instance for use across the server
+config = ConstanceConfig()

karrio/server/core/context_processors.py

@@ -0,0 +1,12 @@
+from karrio.server.conf import settings, DEFAULT_ALLOWED_CONFIG
+
+
+TEMPLATE_SETTINGS_ACCESS_LIST = (
+    getattr(settings, "TEMPLATE_SETTINGS_ACCESS_LIST", None) or DEFAULT_ALLOWED_CONFIG
+)
+
+
+def get_settings(request):
+    return {
+        name: getattr(settings, name, None) for name in TEMPLATE_SETTINGS_ACCESS_LIST
+    }