pirates-auth 0.8.0__tar.gz

pirates_auth-0.8.0/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2020, Jan Bednařík
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

pirates_auth-0.8.0/PKG-INFO

@@ -0,0 +1,140 @@
+Metadata-Version: 2.4
+Name: pirates-auth
+Version: 0.8.0
+Summary: Passwordless SSO (OpenID Connect) authentication backend and abstract user, team and group models for Django. Used in the Czech Pirate Party.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: django,openid,sso
+Author: Jan Bednařík
+Author-email: jan.bednarik@gmail.com
+Requires-Python: >=3.11
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Topic :: Utilities
+Requires-Dist: Django (>=5.2,<7.0)
+Requires-Dist: mozilla-django-oidc (>=3.0,<5.0)
+Project-URL: Homepage, https://gitlab.pirati.cz/to/pirates
+Project-URL: Repository, https://gitlab.pirati.cz/to/pirates
+Description-Content-Type: text/markdown
+
+# Pirates
+
+Django app na uživatele, týmy a skupiny, s napojením na SSO.
+
+[![code style: Black](https://img.shields.io/badge/code%20style-Black-000000)](https://github.com/psf/black)
+[![license MIT](https://img.shields.io/badge/license-MIT-brightgreen)](LICENSE)
+![Python Version](https://img.shields.io/pypi/pyversions/pirates-auth)
+![Django Version](https://img.shields.io/pypi/djversions/pirates-auth?color=0C4B33)
+
+Bezheslová SSO autentizace (OpenID Connect) a abstraktní modely uživatele, týmu
+a skupiny pro Django.
+
+## Požadavky
+
+* Python 3.11+
+* Django 5.2–6.x
+
+## Instalace
+
+```
+pip install pirates-auth
+```
+
+Na PyPI se balíček jmenuje **`pirates-auth`**, ale importuje se jako `pirates` –
+pod tímto názvem se také přidává do `INSTALLED_APPS`.
+
+## Použití
+
+### Settings
+
+Přidat `pirates` do `INSTALLED_APPS`.
+
+### Modely
+
+Jsou k dipozici abstraktní modely pro uživatele, tým a organizační skupinu. Ty
+lze doplnit o další fieldy specifické pro aplikaci. Příklad:
+
+```python
+from django.db import models
+from pirates.models import AbstractUser
+
+class CustomUser(AbstractUser):
+    is_friendly = models.BooleanField(default=True)
+```
+
+A nezapomenout model pro uživatele nastavit v settings:
+
+```python
+AUTH_USER_MODEL = "myapp.CustomUser"
+```
+
+Uživatel je bezheslový – autentizuje se přes SSO (OpenID Connect), takže
+`AbstractUser` nedědí z `AbstractBaseUser` a nemá pole `password` ani
+`last_login`. `get_session_auth_hash()` je proto odvozen z `sso_id`, aby
+`django.contrib.auth.login()` fungoval i na Djangu 6+.
+
+### URLs
+
+URL patterns (v současné době pouze pro OpenID Connect) jsou definovány v
+`pirates.urls`. Stačí je připojit k URL patterns projektu:
+
+```python
+from pirates.urls import urlpatterns as pirates_urlpatterns 
+
+urlpatterns = [
+    # URL patterns projektu
+    # ...
+] + pirates_urlpatterns
+
+```
+
+### SSO přes OpenID Connect
+
+Implementaci OpenID zajišťuje knihovna
+[mozilla-django-oidc](https://github.com/mozilla/mozilla-django-oidc).
+
+V settings projektu je třeba nastavit několik konfiguračních konstant a
+autentifikační backend. Příklad settings (s využitím
+[django-environ](https://github.com/joke2k/django-environ)):
+
+```python
+from os.path import join
+import environ
+
+env = environ.Env()
+
+AUTHENTICATION_BACKENDS = ["pirates.auth.PiratesOIDCAuthenticationBackend"]
+
+OIDC_RP_CLIENT_ID = env.str("OIDC_RP_CLIENT_ID")
+OIDC_RP_CLIENT_SECRET = env.str("OIDC_RP_CLIENT_SECRET")
+OIDC_RP_REALM_URL = env.str("OIDC_RP_REALM_URL")
+OIDC_RP_SIGN_ALGO = "RS256"
+OIDC_OP_JWKS_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/certs")
+OIDC_OP_AUTHORIZATION_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/auth")
+OIDC_OP_TOKEN_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/token")
+OIDC_OP_USER_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/userinfo")
+```
+
+URL patterns pro OpenID Connect už jsou součástí `pirates.urls` (viz výše).
+
+#### Signál po přihlášení
+
+Po přihlášení uživatele je poslán signál `pirates.signals.post_login` s
+parametry:
+
+* `sender` - `PiratesOIDCAuthenticationBackend`
+* `user` - přihlášený uživatel (instance `AUTH_USER_MODEL`)
+* `created` - `True`/`False` zda-li byl vytvořen nový uživatel
+* `request` - instance `HttpRequest`
+

pirates_auth-0.8.0/README.md

@@ -0,0 +1,109 @@
+# Pirates
+
+Django app na uživatele, týmy a skupiny, s napojením na SSO.
+
+[![code style: Black](https://img.shields.io/badge/code%20style-Black-000000)](https://github.com/psf/black)
+[![license MIT](https://img.shields.io/badge/license-MIT-brightgreen)](LICENSE)
+![Python Version](https://img.shields.io/pypi/pyversions/pirates-auth)
+![Django Version](https://img.shields.io/pypi/djversions/pirates-auth?color=0C4B33)
+
+Bezheslová SSO autentizace (OpenID Connect) a abstraktní modely uživatele, týmu
+a skupiny pro Django.
+
+## Požadavky
+
+* Python 3.11+
+* Django 5.2–6.x
+
+## Instalace
+
+```
+pip install pirates-auth
+```
+
+Na PyPI se balíček jmenuje **`pirates-auth`**, ale importuje se jako `pirates` –
+pod tímto názvem se také přidává do `INSTALLED_APPS`.
+
+## Použití
+
+### Settings
+
+Přidat `pirates` do `INSTALLED_APPS`.
+
+### Modely
+
+Jsou k dipozici abstraktní modely pro uživatele, tým a organizační skupinu. Ty
+lze doplnit o další fieldy specifické pro aplikaci. Příklad:
+
+```python
+from django.db import models
+from pirates.models import AbstractUser
+
+class CustomUser(AbstractUser):
+    is_friendly = models.BooleanField(default=True)
+```
+
+A nezapomenout model pro uživatele nastavit v settings:
+
+```python
+AUTH_USER_MODEL = "myapp.CustomUser"
+```
+
+Uživatel je bezheslový – autentizuje se přes SSO (OpenID Connect), takže
+`AbstractUser` nedědí z `AbstractBaseUser` a nemá pole `password` ani
+`last_login`. `get_session_auth_hash()` je proto odvozen z `sso_id`, aby
+`django.contrib.auth.login()` fungoval i na Djangu 6+.
+
+### URLs
+
+URL patterns (v současné době pouze pro OpenID Connect) jsou definovány v
+`pirates.urls`. Stačí je připojit k URL patterns projektu:
+
+```python
+from pirates.urls import urlpatterns as pirates_urlpatterns 
+
+urlpatterns = [
+    # URL patterns projektu
+    # ...
+] + pirates_urlpatterns
+
+```
+
+### SSO přes OpenID Connect
+
+Implementaci OpenID zajišťuje knihovna
+[mozilla-django-oidc](https://github.com/mozilla/mozilla-django-oidc).
+
+V settings projektu je třeba nastavit několik konfiguračních konstant a
+autentifikační backend. Příklad settings (s využitím
+[django-environ](https://github.com/joke2k/django-environ)):
+
+```python
+from os.path import join
+import environ
+
+env = environ.Env()
+
+AUTHENTICATION_BACKENDS = ["pirates.auth.PiratesOIDCAuthenticationBackend"]
+
+OIDC_RP_CLIENT_ID = env.str("OIDC_RP_CLIENT_ID")
+OIDC_RP_CLIENT_SECRET = env.str("OIDC_RP_CLIENT_SECRET")
+OIDC_RP_REALM_URL = env.str("OIDC_RP_REALM_URL")
+OIDC_RP_SIGN_ALGO = "RS256"
+OIDC_OP_JWKS_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/certs")
+OIDC_OP_AUTHORIZATION_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/auth")
+OIDC_OP_TOKEN_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/token")
+OIDC_OP_USER_ENDPOINT = join(OIDC_RP_REALM_URL, "protocol/openid-connect/userinfo")
+```
+
+URL patterns pro OpenID Connect už jsou součástí `pirates.urls` (viz výše).
+
+#### Signál po přihlášení
+
+Po přihlášení uživatele je poslán signál `pirates.signals.post_login` s
+parametry:
+
+* `sender` - `PiratesOIDCAuthenticationBackend`
+* `user` - přihlášený uživatel (instance `AUTH_USER_MODEL`)
+* `created` - `True`/`False` zda-li byl vytvořen nový uživatel
+* `request` - instance `HttpRequest`

pirates_auth-0.8.0/pirates/apps.py

@@ -0,0 +1,13 @@
+from django.apps import AppConfig
+from django.utils.translation import gettext_lazy as _
+
+
+class PiratesConfig(AppConfig):
+    name = "pirates"
+    verbose_name = _("Pirates")
+
+    def ready(self):
+        try:
+            import pirates.signals
+        except ImportError:
+            pass

pirates_auth-0.8.0/pirates/auth.py

@@ -0,0 +1,49 @@
+from mozilla_django_oidc.auth import OIDCAuthenticationBackend
+
+from .signals import post_login
+
+
+class PiratesOIDCAuthenticationBackend(OIDCAuthenticationBackend):
+    """
+    Pirates OIDC Authentication Backend.
+
+    Instead of `email` uses claim `sub` (as `sso_id`) to identify users. Which
+    allows for email change.
+    """
+
+    def get_sso_id(self, claims):
+        return claims.get("sub")
+
+    def filter_users_by_claims(self, claims):
+        sso_id = self.get_sso_id(claims)
+        if not sso_id:
+            return self.UserModel.objects.none()
+        return self.UserModel.objects.filter(sso_id=sso_id)
+
+    def create_user(self, claims):
+        sso_id = self.get_sso_id(claims)
+        first_name = claims.get("given_name", "")
+        last_name = claims.get("family_name", "")
+        email = claims.get("email", "")
+        user = self.UserModel.objects.create(
+            sso_id=sso_id, first_name=first_name, last_name=last_name, email=email
+        )
+        self.send_post_login_signal(user, True, claims)
+        return user
+
+    def update_user(self, user, claims):
+        user.first_name = claims.get("given_name", "")
+        user.last_name = claims.get("family_name", "")
+        user.email = claims.get("email", "")
+        user.save()
+        self.send_post_login_signal(user, False, claims)
+        return user
+
+    def send_post_login_signal(self, user, created, claims):
+        post_login.send(
+            sender=self.__class__,
+            user=user,
+            created=created,
+            claims=claims,
+            request=self.request,
+        )

pirates_auth-0.8.0/pirates/models.py

@@ -0,0 +1,129 @@
+from django.conf import settings
+from django.contrib.auth.models import PermissionsMixin
+from django.db import models
+from django.utils import timezone
+from django.utils.crypto import salted_hmac
+from django.utils.translation import gettext_lazy as _
+
+
+class AbstractUser(PermissionsMixin):
+    """
+    An abstract base class implementing a fully featured User model with
+    admin-compliant permissions.
+    """
+
+    sso_id = models.CharField(
+        _("SSO ID"),
+        max_length=150,
+        unique=True,
+        error_messages={"unique": _("A user with that SSO ID already exists.")},
+    )
+    first_name = models.CharField(_("first name"), max_length=150, blank=True)
+    last_name = models.CharField(_("last name"), max_length=150, blank=True)
+    email = models.EmailField(_("email address"), blank=True)
+    is_staff = models.BooleanField(
+        _("staff status"),
+        default=False,
+        help_text=_("Designates whether the user can log into this admin site."),
+    )
+    is_active = models.BooleanField(
+        _("active"),
+        default=True,
+        help_text=_(
+            "Designates whether this user should be treated as active. "
+            "Unselect this instead of deleting accounts."
+        ),
+    )
+    date_joined = models.DateTimeField(_("date joined"), default=timezone.now)
+
+    USERNAME_FIELD = "sso_id"
+    REQUIRED_FIELDS = []
+
+    class Meta:
+        abstract = True
+        verbose_name = _("user")
+        verbose_name_plural = _("users")
+
+    def get_full_name(self):
+        """Return the first_name plus the last_name, with a space in between."""
+        full_name = f"{self.first_name} {self.last_name}"
+        return full_name.strip()
+
+    def get_short_name(self):
+        """Return the short name for the user."""
+        return self.first_name
+
+    def get_session_auth_hash(self):
+        """
+        Return an HMAC of the ``sso_id`` field.
+
+        This account is passwordless -- it authenticates through SSO and does
+        not inherit ``AbstractBaseUser``, so there is no ``password`` to hash
+        (the mechanism Django's own ``AbstractBaseUser`` uses). Django still
+        requires the method: since Django 6.0 ``django.contrib.auth.login()``
+        calls it unconditionally, so without it every login raises
+        ``AttributeError``. We derive the hash from the immutable ``sso_id``
+        instead. It must be non-empty and stable -- an empty value would make
+        Django flush the session on the next request and log the user out.
+        """
+        return self._get_session_auth_hash()
+
+    def get_session_auth_fallback_hash(self):
+        for fallback_secret in settings.SECRET_KEY_FALLBACKS:
+            yield self._get_session_auth_hash(secret=fallback_secret)
+
+    def _get_session_auth_hash(self, secret=None):
+        key_salt = "pirates.models.AbstractUser.get_session_auth_hash"
+        return salted_hmac(
+            key_salt,
+            self.sso_id,
+            secret=secret,
+            algorithm="sha256",
+        ).hexdigest()
+
+    def __str__(self):
+        return self.get_full_name() or self.email or self.sso_id
+
+    @property
+    def is_anonymous(self):
+        """
+        Always return False. This is a way of comparing User objects to
+        anonymous users.
+        """
+        return False
+
+    @property
+    def is_authenticated(self):
+        """
+        Always return True. This is a way to tell if the user has been
+        authenticated in templates.
+        """
+        return True
+
+
+class AbstractTeam(models.Model):
+    name = models.CharField(max_length=250, unique=True)
+    members = models.ManyToManyField(settings.AUTH_USER_MODEL)
+
+    class Meta:
+        abstract = True
+        ordering = ["name"]
+        verbose_name = _("team")
+        verbose_name_plural = _("teams")
+
+    def __str__(self):
+        return self.name
+
+
+class AbstractOrgGroup(models.Model):
+    name = models.CharField(max_length=250, unique=True)
+    members = models.ManyToManyField(settings.AUTH_USER_MODEL)
+
+    class Meta:
+        abstract = True
+        ordering = ["name"]
+        verbose_name = _("group")
+        verbose_name_plural = _("groups")
+
+    def __str__(self):
+        return self.name

pirates_auth-0.8.0/pirates/signals.py

@@ -0,0 +1,3 @@
+from django.dispatch import Signal
+
+post_login = Signal()

pirates_auth-0.8.0/pirates/urls.py

@@ -0,0 +1,5 @@
+from django.urls import include, path
+
+urlpatterns = [
+    path("oidc/", include("mozilla_django_oidc.urls")),
+]

pirates_auth-0.8.0/pyproject.toml

@@ -0,0 +1,63 @@
+[project]
+name = "pirates-auth"
+version = "0.8.0"
+description = "Passwordless SSO (OpenID Connect) authentication backend and abstract user, team and group models for Django. Used in the Czech Pirate Party."
+authors = [
+    { name = "Jan Bednařík", email = "jan.bednarik@gmail.com" },
+    { name = "Alexandra Ťapková", email = "git@ouppy.space" }
+]
+license = "MIT"
+readme = "README.md"
+requires-python = ">=3.11"
+keywords = ["django", "openid", "sso"]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Framework :: Django",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Topic :: Utilities",
+]
+dependencies = [
+    "Django>=5.2,<7.0",
+    "mozilla-django-oidc>=3.0,<5.0",
+]
+
+[project.urls]
+homepage = "https://gitlab.pirati.cz/to/pirates"
+repository = "https://gitlab.pirati.cz/to/pirates"
+
+[tool.poetry]
+packages = [{ include = "pirates" }]
+
+[tool.poetry.group.dev.dependencies]
+tox = ">=4.15"
+pytest = ">=8"
+pytest-cov = ">=5"
+pytest-factoryboy = ">=2.7"
+pytest-django = ">=4.8"
+pytest-mock = ">=3.14"
+
+[build-system]
+requires = ["poetry-core>=2.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.pytest.ini_options]
+python_files = "test_*.py"
+addopts = "--ds=tests.settings"
+
+[tool.isort]
+# config compatible with Black
+line_length = 88
+multi_line_output = 3
+default_section = "THIRDPARTY"
+include_trailing_comma = true
+known_third_party = ["django", "factory", "faker", "mozilla_django_oidc", "pytest", "pytest_factoryboy"]