pyramid-fullauth 0.2.3__py27-none-any.whl

pyramid_fullauth/__init__.py

@@ -0,0 +1,91 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2013 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+
+import logging
+
+from tzf.pyramid_yml import config_defaults
+from pyramid.authorization import ACLAuthorizationPolicy
+from pyramid.authentication import AuthTktAuthenticationPolicy
+from pyramid.session import UnencryptedCookieSessionFactoryConfig
+
+
+from pyramid_fullauth.auth import groupfinder
+from pyramid_fullauth.routing import predicates
+from pyramid_fullauth.request import login_perform
+from pyramid_fullauth.request import user
+
+__version__ = '0.2.3'
+
+
+logger = logging.getLogger(__name__)
+
+
+def includeme(configurator):
+    '''
+    pyramid_fullauth includeme method
+
+    :param pyramid.configurator.Configurator configurator: pyramid's configurator object
+    '''
+
+    config_defaults(configurator, 'pyramid_fullauth:config')
+    configurator.include('pyramid_localize')
+    configurator.include('pyramid_mako')
+    fullauth_config = configurator.registry['config'].fullauth
+
+    configurator.set_authorization_policy(ACLAuthorizationPolicy())
+    configurator.set_authentication_policy(
+        AuthTktAuthenticationPolicy(callback=groupfinder,
+                                    **fullauth_config.AuthTkt))
+
+    # loading and setting session factory
+    # first, divide provided path for module, and factory name
+    module, factory = fullauth_config.session.factory.rsplit('.', 1)
+    # import session module first
+    session_module = __import__(module, fromlist=[module])
+    # get the  factory class
+    session_factory = getattr(session_module, factory)
+
+    # set the new session factory
+    configurator.set_session_factory(
+        session_factory(**fullauth_config.session.settings))
+
+    configurator.add_view_predicate('check_csrf', predicates.CSRFCheckPredicate)
+
+    # add routes
+    configurator.add_route(name='login', pattern='/login')
+    configurator.add_route(name='logout', pattern='/logout')
+    configurator.add_route(name='register', pattern='/register')
+    configurator.add_route(name='register:activate', pattern='/register/activate/{hash}')
+    configurator.add_route(name='password:reset', pattern='/password/reset')
+    configurator.add_route(name='password:reset:continue', pattern='/password/reset/{hash}',
+                           custom_predicates=(predicates.reset_hash,))
+    configurator.add_route(name='email:change', pattern='/email/change')
+    configurator.add_route(name='email:change:continue', pattern='/email/change/{hash}',
+                           custom_predicates=(predicates.change_email_hash,))
+    # scan base views
+    configurator.scan('pyramid_fullauth.views.basic')
+
+    # check for the social. If social is not available, we will not turn it on!
+    if 'social' in fullauth_config:
+        # Velruse init (for social auth)
+
+        # scan social views
+        configurator.scan('pyramid_fullauth.views.social')
+        providers = fullauth_config.social
+        configurator.registry['config']['login_providers'] = providers
+        for provider in providers:
+            # Ugly hack for using google oauth2, not OpenID + Oauth2 from google
+            provider_settings = fullauth_config['social'][provider]
+            if provider == 'google':  # pragma: no cover
+                provider = 'google_oauth2'
+
+            configurator.include('velruse.providers.' + provider)
+            getattr(configurator, 'add_{0}_login'.format(provider))(**provider_settings)
+
+    # we'll add some request methods:
+    configurator.add_request_method(login_perform, name='login_perform')
+    configurator.add_request_method(user, name='user', reify=True)

pyramid_fullauth/auth.py

@@ -0,0 +1,93 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2013 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+
+from pyramid.security import Allow
+from pyramid.security import Deny
+from pyramid.security import Everyone
+from pyramid.security import ALL_PERMISSIONS
+from pyramid.security import forget
+
+
+def groupfinder(userid, request):
+    '''
+        Reads all users groups,
+
+        .. note::
+
+            Adds **s:inactive** group to users who has not activated their account, and **s:user** group to those, who did.
+            If user has is_admin flag, he gets **s:superadmin** group set
+
+            Might be useful, when you want restrict access to some parts of your application, but still allow log in, and access to some other parts.
+
+        :param int userid: user identity
+        :param pyramid.request.Request request: request object
+        :returns: list of groups
+        :rtype: list
+    '''
+
+    user = request.user
+    groups = []
+    if user and user.id == userid:
+        groups = [group.name for group in user.groups]
+
+        # let's add inactive group for users that have not activated their account
+
+        if user.is_admin:
+            groups.append('s:superadmin')
+
+        if user.is_active:
+            groups.append('s:user')
+        else:
+            groups.append('s:inactive')
+
+    return groups
+
+
+class BaseACLRootFactoryMixin(object):
+
+    '''
+        ACL list factory Mixin,
+        __acl__ is the attribute which stores the list.
+
+        :return: tuple (Allow|Deny, Group name, Permission)
+        :rtype: list
+
+        .. note::
+
+            Can be converted later to database stored (sqlalchemy session is accessible through request.db)
+    '''
+
+    __acl__ = [(Allow, Everyone, 'view'),
+               (Allow, 's:superadmin', ALL_PERMISSIONS),
+               (Allow, 's:user', ('password_change', 'email_change'))
+               ]
+
+    def __init__(self, request):
+        self.request = request
+
+
+class force_logout(object):
+
+    '''
+        Logs out user.
+    '''
+
+    def __call__(self, wrapped_view):
+
+        def decorator(*args, **kwargs):
+            if not args:
+                return wrapped_view(*args, **kwargs)
+
+            for arg in args:
+                if 'request' in dir(arg):
+                    if arg.request.user:
+                        arg.request.response.headerlist.extend(forget(arg.request))
+                        arg.request.user = None
+            data = wrapped_view(*args, **kwargs)
+            return data
+
+        return decorator

pyramid_fullauth/config/config.yml

@@ -0,0 +1,26 @@
+# Copyright (c) 2013 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+
+# pyramid_fullauth's default configuration
+fullauth:
+    check_csrf: True    # Whether login processes should work with csrf token, or without
+    register:
+        password:
+            require: True   # set to false to not read password during register, and generate random one
+            length_min: 6   # will be used either to check password's length or generate this length random password
+            confirm: True   # by default there will be a field for password confirmation on the registration form
+    AuthTkt:
+        secret: fullauth_psst   # default secret used to hash auth_tk cookie
+        hashalg: sha512         # default authentication policy hash algorithm
+    login:
+        cookie_max_age: 2592000     # 30 days
+    redirects: # route name, to redirect to. If False, then redirects just to /
+        logout: False
+    session: # session factory settings
+        # factory key is responsible for providing full path to factory class (module.submodule.SessionFactory)
+        factory: pyramid.session.UnencryptedCookieSessionFactoryConfig
+        # settings are key: value pairs of all factory initialize attributes
+        settings:
+            secret: THATS_NOT_SECRET_ITS_A_SECRET

pyramid_fullauth/events.py

@@ -0,0 +1,255 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2013 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+
+'''
+    pyramid_fullauth emits these events during whole cycle.
+'''
+
+
+class _BaseRegisterEvent(object):
+
+    '''
+        Base fullauth - most of the fullauth's event will provide both request and suer object with some additional data (these will be described then)
+    '''
+
+    def __init__(self, request, user):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+        '''
+        self.request = request
+        self.user = user
+
+
+class BeforeRegister(_BaseRegisterEvent):
+
+    '''
+        BeforeRegister event, fired, so developers can add custom validation
+        User object is not yet defined
+    '''
+
+    def __init__(self, request, user, errors):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+            :param dict errors: a dictionary with wrong/not submitted fields
+             with format - fields for which error occured: error message
+        '''
+
+        _BaseRegisterEvent.__init__(self, request, user)
+        self.errors = errors
+
+
+class AfterRegister(_BaseRegisterEvent):
+
+    '''
+        AfterRegister event, fired so developers can add some custom post-processing, like e-mail sending
+        User object is already in a session.
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+
+        .. warning::
+            If HTTPFound is risen from event listener, then response_values will not be used!
+
+    '''
+
+    def __init__(self, request, user, response_values):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+            :param dict response_values: a dictionary with response values
+        '''
+        _BaseRegisterEvent.__init__(self, request, user)
+        self.response_values = response_values
+
+
+class AfterActivate(_BaseRegisterEvent):
+
+    '''
+        Events gets emitted after account activation. To send a greeting email, or other actions that could be taken
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+    pass
+
+
+class AfterResetRequest(_BaseRegisterEvent):
+
+    '''
+        Event gets fired when the user requires password reset
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+    pass
+
+
+class BeforeReset(_BaseRegisterEvent):
+
+    '''
+        Event gets fired when user resets own password, fired so developer can add custom validation (like password length)
+    '''
+    pass
+
+
+class AfterReset(_BaseRegisterEvent):
+
+    '''
+        Event gets fired when user resets own password
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+    pass
+
+
+class AlreadyLoggedIn(object):
+
+    '''
+        Event gets fired when the logged in user enters login page
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+
+    def __init__(self, request):
+        '''
+            :param pyramid.request.Request request: request object
+        '''
+        self.request = request
+
+
+class BeforeLogIn(_BaseRegisterEvent):
+
+    '''
+        Event gets fired before the user logs in
+
+        .. note::
+            Action emitting this event, should catch all AttributeError that might be risen in event listener.
+            User param set to None when user is not found or request method is GET.
+    '''
+    pass
+
+
+class AfterLogIn(_BaseRegisterEvent):
+
+    '''
+        Event gets fired when the user logs in
+    '''
+    pass
+
+
+# Social events
+# TODO: extract to sub module
+
+
+class _BaseSocialRegister(_BaseRegisterEvent):
+
+    '''
+        Base for all social requests
+    '''
+
+    def __init__(self, request, user, profile):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+            :param dict profile: a dictionary with profile data
+        '''
+        _BaseRegisterEvent.__init__(self, request, user)
+        self.profile = profile
+
+
+class BeforeSocialRegister(_BaseSocialRegister):
+
+    '''
+        BeforeRegister event, fired, so developers can add custom validation
+    '''
+    pass
+
+
+class AfterSocialRegister(_BaseSocialRegister):
+
+    '''
+        AfterSocialRegister events is emitted after user registers through one of the social networks
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+
+    def __init__(self, request, user, profile, response_values):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+            :param dict profile: a dictionary with profile data
+            :param dict response_values: a dictionary with response values
+        '''
+        _BaseSocialRegister.__init__(self, request, user, profile)
+        self.response_values = response_values
+
+
+class AfterSocialLogIn(_BaseSocialRegister):
+
+    '''
+        Event gets fired when the user logs in through social network
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+    pass
+
+
+class SocialAccountAlreadyConnected(_BaseSocialRegister):
+
+    '''
+        Event gets fired when the user try to connect social network to account but this social account is already connected to another account
+
+        .. note::
+            Action emitting this event, should catch all HTTPFound that might be risen in event listener.
+    '''
+
+    def __init__(self, request, user, profile, response_values):
+        '''
+
+            :param pyramid.request.Request request: request object
+            :param pyramid_fullauth.models.User user: user object
+            :param dict profile: a dictionary with profile data
+            :param dict response_values: a dictionary with response values
+        '''
+        _BaseSocialRegister.__init__(self, request, user, profile)
+        self.response_values = response_values
+    pass
+
+
+class BeforeEmailChange(_BaseRegisterEvent):
+
+    '''
+        BeforeEmailChange event, fired so developers can add custom validation (like checking password)
+    '''
+    pass
+
+
+class AfterEmailChange(_BaseRegisterEvent):
+
+    '''
+        AfterEmailChange event, fired so developers can add some custom post-processing, like e-mail sending
+    '''
+    pass
+
+
+class AfterEmailChangeActivation(_BaseRegisterEvent):
+
+    '''
+        AfterEmailChangeActivation event, fired when user activate new email addres, so developers can add some custom post-processing
+    '''
+    pass

pyramid_fullauth/exceptions.py

@@ -0,0 +1,54 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2013 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+
+
+class DeleteException(Exception):
+
+    '''
+        Exception risen when the user can't be deleted
+    '''
+    pass
+
+
+class ValidateError(ValueError):
+
+    '''
+        Base of every validate error in pyramid_fullauth
+    '''
+    pass
+
+
+class EmptyError(ValidateError):
+
+    '''
+        Thrown whenever user is trying to set empty value
+    '''
+    pass
+
+
+class ShortPasswordError(ValidateError):
+
+    '''
+    Thrown when password doesn't meet the length requirement
+    '''
+    pass
+
+
+class PasswordConfirmMismatchError(ValidateError):
+
+    '''
+        Thrown when there's a mismatch with cpassword_confirm
+    '''
+    pass
+
+
+class EmailValidationError(ValidateError):
+
+    '''
+        Exception thrown, when there's incorrect email provided
+    '''
+    pass