pyramid-fullauth 0.3.0__py2.7.egg

pyramid_fullauth/resources/templates/reset.mako

@@ -0,0 +1,34 @@
+## -*- coding: utf-8 -*-
+<%doc>
+Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+
+This module is part of pyramid_fullauth and is released under
+the MIT License (MIT): http://opensource.org/licenses/MIT
+</%doc>
+<%inherit file="pyramid_fullauth:resources/templates/layout.mako" />
+
+<h1>${_('Recover your password', domain='pyramid_fullauth')}</h1>
+<div class="row-fluid">
+    <div class="span2"></div>
+    <div class="span8">
+        % if not status:
+            <div class="alert alert-error">${_('Error!', domain='pyramid_fullauth')} ${msg}</div>
+        % endif
+        <form class="form-horizontal" name="reset_password" method="POST" action="${request.current_route_path()}">
+            <fieldset>
+                <div class="control-group">
+                    <label class="control-label" for="reset[email]">${_('Your e-mail address', domain='pyramid_fullauth')}:</label>
+                    <div class="controls">
+                        <input type="email" placeholder="username@hostname.com" name="email" id="reset[email]"/>
+                        <input type="hidden" name="csrf_token" value="${csrf_token}" />
+                    </div>
+                </div>
+                <div class="form-actions">
+                    <button type="submit" class="btn btn-large">${_('Reset Password', domain='pyramid_fullauth')}</button>
+                </div>
+            </fieldset>
+        </form>
+    </div>
+    <div class="span2"></div>
+</div>
+

pyramid_fullauth/resources/templates/reset.proceed.mako

@@ -0,0 +1,41 @@
+## -*- coding: utf-8 -*-
+<%doc>
+Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+
+This module is part of pyramid_fullauth and is released under
+the MIT License (MIT): http://opensource.org/licenses/MIT
+</%doc>
+<%inherit file="pyramid_fullauth:resources/templates/layout.mako" />
+
+<h1>${_('Recover your password - choose new password', domain='pyramid_fullauth')}</h1>
+<div class="row-fluid">
+    <div class="span8">
+        % if not status:
+            <div class="alert alert-error">${_('Error!', domain='pyramid_fullauth')} ${msg}</div>
+        % endif
+        <form class="form-horizontal" id="reset_password" name="reset_password" method="POST" action="${request.current_route_path()}">
+            <input type="hidden" name="csrf_token" value="${csrf_token}" />
+            <fieldset>
+                <div class="control-group">
+                    <label class="control-label" for="password">${_('Password', domain='pyramid_fullauth')}:</label>
+                    <div class="controls">
+                        <input type="password" id="password" name="password" placeholder="minimum 6 characters"/>
+                        <span class="help-inline" id="password_status"></span>
+                    </div>
+                </div>
+                <div class="control-group">
+                    <label class="control-label" for="confirm_password">${_('Confirm password', domain='pyramid_fullauth')}:</label>
+                    <div class="controls">
+                        <input type="password" name="confirm_password" id="confirm_password"/>
+                        <span class="help-inline" id="confirm_password_status"></span>
+                    </div>
+                </div>
+                <div class="form-actions">
+                    <button type="submit" class="btn btn-large">${_('Reset Password', domain='pyramid_fullauth')}</button>
+                </div>
+            </fieldset>
+        </form>
+    </div>
+    <div class="span2"></div>
+</div>
+

pyramid_fullauth/routing/__init__.py

@@ -0,0 +1,5 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Routing module."""

pyramid_fullauth/routing/predicates.py

@@ -0,0 +1,86 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Routing predicate definitions."""
+
+from sqlalchemy.orm.exc import NoResultFound
+from pyramid.config.predicates import CheckCSRFTokenPredicate
+from pyramid.httpexceptions import HTTPUnauthorized
+import pyramid_basemodel
+
+from pyramid_fullauth.models import User
+
+
+def reset_hash(info, request):
+    """
+    Check whether reset hash is correct.
+
+    :param dict info: pyramid info dict with path fragments and info
+    :param pyramid.request.Request request: request object
+
+    :returns: whether reset hash exists or not
+    :rtype: bool
+
+    """
+    reset_hash = info['match'].get('hash', None)
+    if reset_hash:
+        try:
+            info['match']['user'] = pyramid_basemodel.Session.query(User).filter(User.reset_key == reset_hash).one()
+            return True
+        except NoResultFound:
+            pass
+    return False
+
+
+def change_email_hash(info, request):
+    """
+    Check whether change email hash is correct.
+
+    :param dict info: pyramid info dict with path fragments and info
+    :param pyramid.request.Request request: request object
+
+    :returns: whether change email hash exists or not
+    :rtype: bool
+
+    """
+    change_email_hash = info['match'].get('hash', None)
+    if change_email_hash:
+        try:
+            info['match']['user'] = pyramid_basemodel.Session.query(User).filter(User.email_change_key == change_email_hash).one()
+            return True
+        except NoResultFound:
+            pass
+    return False
+
+
+class CSRFCheckPredicate(CheckCSRFTokenPredicate):
+
+    """
+    Run csrf check dependant on configuration.
+
+    .. note::
+
+        Raises HTTPUnauthorized exception if check fails.
+
+    :raises: pyramid.httpexceptions.HTTPUnauthorized
+
+    :returns: True if check succeeds or turned off.
+    :rtype: bool
+
+    """
+
+    def __call__(self, context, request):
+        """
+        Run predicate check.
+
+        :param context:
+        :param pyramid.request.Request request:
+
+        """
+        if request.registry['config'].fullauth.check_csrf:
+            result = CheckCSRFTokenPredicate.__call__(self, context, request)
+            if not result:
+                raise HTTPUnauthorized
+
+        return True

pyramid_fullauth/tools.py

@@ -0,0 +1,66 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Additional tools used in pyramid_fullauth."""
+
+import string
+from random import choice
+from pyramid_fullauth.exceptions import (
+    EmptyError, ShortPasswordError, PasswordConfirmMismatchError
+)
+
+
+def password_generator(length, chars=(string.letters + string.digits + string.punctuation)):
+    """
+    Generate random password.
+
+    .. warning::
+
+        TODO: tests!
+
+    :param int length: length of a password to Generates
+    :param list chars: list of characters from which to choose
+    :returns: password
+    :rtype: str
+    """
+    return u''.join([choice(chars) for i in range(length)])
+
+
+def validate_passsword(request, password, user=None):
+    """
+    Validate password properly.
+
+    .. note::
+
+        If no user provided, password is just validated
+
+    :param pyramid.request.Request request: request object
+    :param str password: password to be set
+    :param pyramid_fullauth.models.User user: user object
+
+    :raises: pyramid_fullauth.exceptions.ValidateError
+    """
+    password_config = request.registry['config'].fullauth.register.password
+    if not password:
+        raise EmptyError(
+            request._('Please enter your password',
+                      domain='pyramid_fullauth'))
+
+    if password_config['length_min'] and\
+            len(password) < password_config['length_min']:
+        raise ShortPasswordError(
+            request._('Password is too short',
+                      domain='pyramid_fullauth'))
+
+    # here if password doesn't match
+    if password_config['confirm']:
+        confirm_password = request.POST.get('confirm_password', u'')
+        if password != confirm_password:
+            raise PasswordConfirmMismatchError(
+                request._('password-mismatch',
+                          default='Passwords don\'t match',
+                          domain='pyramid_fullauth'))
+
+    if user:
+        user.password = password

pyramid_fullauth/views/__init__.py

@@ -0,0 +1,15 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Views submodule."""
+
+
+class BaseView(object):
+
+    """basic view class."""
+
+    def __init__(self, request):
+        """Common init for views."""
+        self.request = request
+        self.config = request.registry['config'].fullauth

pyramid_fullauth/views/basic/__init__.py

@@ -0,0 +1,5 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Basic views."""

pyramid_fullauth/views/basic/activate.py

@@ -0,0 +1,44 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Registration related views."""
+
+from pyramid.view import view_config
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+from pyramid_fullauth.events import AfterActivate
+
+
+@view_config(route_name='register:activate', permission=NO_PERMISSION_REQUIRED,
+             renderer="pyramid_fullauth:resources/templates/activate.mako")
+class ActivateView(BaseView):
+
+    """Activate account views."""
+
+    def __call__(self):
+        """Process account activation."""
+        activate_hash = self.request.matchdict.get('hash')
+        user = None
+        response = {}
+        response['status'] = True
+        if activate_hash:
+            try:
+                user = pyramid_basemodel.Session.query(User).filter(User.activate_key == activate_hash).one()
+                if not user.is_active:
+                    user.is_active = True
+            except NoResultFound:
+                response['status'] = False
+        try:
+            self.request.registry.notify(AfterActivate(self.request, user))
+        except HTTPFound as e:
+            # it's a redirect, let's follow it!
+            return e
+
+        return response

pyramid_fullauth/views/basic/forbidden.py

@@ -0,0 +1,47 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Forbidden views."""
+
+from pyramid.view import forbidden_view_config
+from pyramid.security import authenticated_userid
+from pyramid.httpexceptions import HTTPFound
+
+from pyramid_fullauth.views import BaseView
+
+
+class ForbiddenViews(BaseView):
+
+    """Forbidden related views."""
+
+    def __init__(self, request):
+        """Set all responses status to 403 by default."""
+        super(ForbiddenViews, self).__init__(request)
+        self.request.response.status_code = 403
+
+    @forbidden_view_config(renderer='pyramid_fullauth:resources/templates/403.mako')
+    def forbidden(self):
+        """Forbidden page view."""
+        # do not allow a user to login if they are already logged in
+        if authenticated_userid(self.request):
+            return {}
+
+        loc = self.request.route_path('login', _query=(('after', self.request.path),))
+        return HTTPFound(location=loc)
+
+    @forbidden_view_config(xhr=True, renderer='json')
+    def forbidden_json(self):
+        """Forbidden xhr response."""
+        # do not allow a user to login if they are already logged in
+        if authenticated_userid(self.request):
+            return {'status': False, 'msg':
+                    self.request._('forbidden-notallowed',
+                                   default='You are not allowed to use this function',
+                                   domain='pyramid_fullauth')}
+
+        return {'status': False,
+                'msg': self.request._('forbidden-login',
+                                      default='You have to be logged in to use this function',
+                                      domain='pyramid_fullauth'),
+                'login_url': self.request.route_path('login')}

pyramid_fullauth/views/basic/login.py

@@ -0,0 +1,128 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Authorisation related views."""
+
+from pyramid.view import view_config
+from pyramid.view import view_defaults
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import authenticated_userid
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+from pyramid_fullauth.events import BeforeLogIn
+from pyramid_fullauth.events import AfterLogIn
+from pyramid_fullauth.events import AlreadyLoggedIn
+
+
+@view_defaults(route_name='login', permission=NO_PERMISSION_REQUIRED,
+               renderer='pyramid_fullauth:resources/templates/login.mako')
+class BaseLoginView(BaseView):
+
+    """Basic logic for login views."""
+
+    def __init__(self, request):
+        """Prepare login views."""
+        super(BaseLoginView, self).__init__(request)
+
+        self.response = {
+            'status': False,
+            'msg': self.request._('Login error', domain='pyramid_fullauth'),
+            'after': self.request.params.get(
+                'after', self.request.referer or '/'),
+            'csrf_token': self.request.session.get_csrf_token()
+        }
+
+    def _redirect_authenticated_user(self):
+        """Redirect already logged in user away from login page."""
+        redirect = HTTPFound(location=self.response['after'])
+        try:
+            self.request.registry.notify(AlreadyLoggedIn(self.request))
+        except HTTPFound as redirect:
+            pass
+
+        if self.request.is_xhr:
+            self.response['status'] = True
+            self.response['msg'] = self.request._(
+                'Already logged in!',
+                domain='pyramid_fullauth')
+            self.response['after'] = redirect.location
+            return self.response
+        else:
+            return redirect
+
+
+@view_config(request_method='GET')
+class LoginView(BaseLoginView):
+
+    """Login view."""
+
+    def __call__(self):
+        """Display login page."""
+        if authenticated_userid(self.request):
+            return self._redirect_authenticated_user()
+
+        self.request.registry.notify(BeforeLogIn(self.request, None))
+
+        self.response['status'] = True
+        del self.response['msg']
+        return self.response
+
+
+@view_config(request_method='POST', check_csrf=True)
+@view_config(request_method='POST', check_csrf=True, xhr=True, renderer="json")
+class LoginViewPost(BaseLoginView):
+
+    """Login view POST method."""
+
+    def __call__(self):
+        """Login action."""
+        if authenticated_userid(self.request):
+            return self._redirect_authenticated_user()
+
+        email = self.request.POST.get('email', '')
+        password = self.request.POST.get('password', '')
+        try:
+            user = pyramid_basemodel.Session.query(User).filter(User.email == email).one()
+        except NoResultFound:
+            self.request.registry.notify(BeforeLogIn(self.request, None))
+
+            self.response['msg'] = self.request._('Wrong e-mail or password.',
+                                                  domain='pyramid_fullauth')
+            return self.response
+
+        try:
+            self.request.registry.notify(BeforeLogIn(self.request, user))
+        except AttributeError as e:
+            self.response['msg'] = str(e)
+            return self.response
+
+        if user.check_password(password):
+
+            login_kwargs = {'remember_me': self.request.POST.get('remember')}
+            try:
+                # if remember in POST set cookie timeout to one month
+                self.request.registry.notify(AfterLogIn(self.request, user))
+            except AttributeError as e:
+                self.response['msg'] = str(e)
+                return self.response
+            except HTTPFound as redirect:
+                login_kwargs['location'] = redirect.location
+
+            redirect = self.request.login_perform(user, **login_kwargs)
+            if self.request.is_xhr:
+                self.response['status'] = True
+                del self.response['msg']
+                self.response['after'] = redirect.location
+                return self.response
+            else:
+                return redirect
+        else:
+            self.response['msg'] = self.request._('Wrong e-mail or password.',
+                                                  domain='pyramid_fullauth')
+            return self.response

pyramid_fullauth/views/basic/logout.py

@@ -0,0 +1,28 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""De-authentication related view."""
+
+from pyramid.view import view_config
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from pyramid_fullauth.views import BaseView
+
+
+@view_config(route_name='logout', permission=NO_PERMISSION_REQUIRED)
+class LogoutView(BaseView):
+
+    """Logout view."""
+
+    def __call__(self):
+        """Logout action."""
+        location = '/'
+        if self.config.redirects.logout:
+            location = self.request.route_path(self.config.redirects.logout)
+        # forget headers
+        self.request.logout()
+
+        return HTTPFound(location=location,
+                         headers=self.request.response.headers)

pyramid_fullauth/views/basic/profile/__init__.py

@@ -0,0 +1,5 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Groups profile views."""

pyramid_fullauth/views/basic/profile/email.py

@@ -0,0 +1,107 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Email related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+
+from pyramid_fullauth.events import BeforeEmailChange
+from pyramid_fullauth.events import AfterEmailChange
+from pyramid_fullauth.events import AfterEmailChangeActivation
+from pyramid_fullauth.exceptions import EmptyError, EmailValidationError
+
+
+@view_defaults(route_name='email:change', permission='email_change',
+               renderer='pyramid_fullauth:resources/templates/email_change.mako')
+class EmailChangeViews(BaseView):
+
+    """Email change related views."""
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display email change request form."""
+        return {'status': True, 'csrf_token': self.request.session.get_csrf_token()}
+
+    @view_config(request_method='POST', check_csrf='csrf_token')
+    @view_config(request_method='POST', check_csrf='csrf_token', xhr=True, renderer="json")
+    def post(self):
+        """Process email change request."""
+        csrf_token = self.request.session.get_csrf_token()
+        try:
+            pyramid_basemodel.Session.query(User).filter(
+                User.email == self.request.POST.get('email', '')
+            ).one()
+            return {'status': False,
+                    'msg': self.request._('User with this email exists',
+                                          domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+        except NoResultFound:
+            pass
+
+        user = self.request.user
+        try:
+            self.request.registry.notify(BeforeEmailChange(self.request, user))
+        except AttributeError as e:
+            return {'status': False, 'msg': e.message, 'csrf_token': csrf_token}
+
+        try:
+            user.set_new_email(self.request.POST.get('email', ''))
+        except EmptyError:
+            return {'status': False,
+                    'msg': self.request._(
+                        'E-mail is empty',
+                        domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+        except EmailValidationError:
+            return {'status': False,
+                    'msg': self.request._(
+                        'Incorrect e-mail format',
+                        domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+
+        response_values = {
+            'status': True,
+            'msg': self.request._('We sent you email to activate your new email address',
+                                  domain='pyramid_fullauth')
+        }
+
+        try:
+            self.request.registry.notify(AfterEmailChange(self.request, user))
+        except HTTPFound as redirect:
+            if self.request.is_xhr:
+                response_values['url'] = redirect.location
+                return response_values
+            else:
+                return redirect
+        else:
+            if self.request.is_xhr:
+                return response_values
+            else:
+                return HTTPFound(location='/')
+
+
+@view_config(route_name='email:change:continue', permission=NO_PERMISSION_REQUIRED,
+             renderer='pyramid_fullauth:resources/templates/email_change.mako')
+class EmailChangeAccept(BaseView):
+
+    """Display email change success."""
+
+    def __call__(self):
+        """View that changes user email."""
+        user = self.request.matchdict.get('user')
+        user.change_email()
+
+        try:
+            self.request.registry.notify(AfterEmailChangeActivation(self.request, user))
+        except HTTPFound as redirect:
+            return redirect
+        return HTTPFound(location='/')