pyramid-fullauth 0.3.0__py2.7.egg

pyramid_fullauth/views/basic/profile/password.py

@@ -0,0 +1,128 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Profile related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User, AuthenticationProvider
+
+from pyramid_fullauth.events import BeforeReset
+from pyramid_fullauth.events import AfterResetRequest
+from pyramid_fullauth.events import AfterReset
+from pyramid_fullauth.exceptions import ValidateError
+from pyramid_fullauth.tools import validate_passsword
+
+
+@view_defaults(route_name='password:reset', permission=NO_PERMISSION_REQUIRED,
+               renderer='pyramid_fullauth:resources/templates/reset.mako')
+class PasswordResetView(BaseView):
+
+    """Profile related views."""
+
+    @view_config()
+    def get(self):
+        """Password reset request view."""
+        csrf_token = self.request.session.get_csrf_token()
+
+        return {'status': True, 'csrf_token': csrf_token}
+
+    @view_config(request_method='POST', check_csrf=True)
+    def post(self):
+        """View processing requests to reset password."""
+        csrf_token = self.request.session.get_csrf_token()
+
+        try:
+            user = pyramid_basemodel.Session.query(User).filter(
+                User.email == self.request.POST.get('email', '')).one()
+        except NoResultFound:
+            return {'status': False,
+                    'msg': self.request._('user-not-exists',
+                                          default='User does not exists',
+                                          domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+
+        user.set_reset()
+        try:
+            self.request.registry.notify(AfterResetRequest(self.request, user))
+        except HTTPFound as redirect:
+            return redirect
+
+        return HTTPFound(location='/')
+
+
+@view_defaults(route_name='password:reset:continue', permission=NO_PERMISSION_REQUIRED,
+               renderer='pyramid_fullauth:resources/templates/reset.proceed.mako')
+class PasswordResetContinueView(BaseView):
+
+    """
+    Password reset views.
+
+    These views display actual reset password views.
+    """
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display actual password reset form."""
+        self.request.logout()
+        return {
+            'status': True,
+            'csrf_token': self.request.session.get_csrf_token()
+        }
+
+    @view_config(request_method='POST', check_csrf=True)
+    def post(self):
+        """Validate and possibly accept new email."""
+        user = self.request.matchdict.get('user')
+
+        password = self.request.POST.get('password', None)
+        password_confirm = self.request.POST.get('confirm_password', None)
+        if password == password_confirm:
+
+            try:
+                self.request.registry.notify(BeforeReset(self.request, user))
+                validate_passsword(self.request, password, user)
+
+                user.reset_key = None
+                try:
+                    pyramid_basemodel.Session.query(AuthenticationProvider).filter(
+                        AuthenticationProvider.user_id == user.id,
+                        AuthenticationProvider.provider == u'email'
+                    ).one()
+                except NoResultFound:
+                    user.providers.append(
+                        AuthenticationProvider(
+                            provider=u'email',
+                            provider_id=user.id
+                        )
+                    )
+
+                pyramid_basemodel.Session.flush()
+            except (ValidateError, AttributeError) as e:
+                return {
+                    'status': False,
+                    'msg': str(e),
+                    'csrf_token': self.request.session.get_csrf_token()
+                }
+
+            try:
+                self.request.registry.notify(AfterReset(self.request, user))
+            except HTTPFound as redirect:
+                return redirect
+        else:
+            return {
+                'status': False,
+                'msg': self.request._('password-mismatch',
+                                      default='Password doesn\'t match',
+                                      domain='pyramid_fullauth'),
+                'csrf_token': self.request.session.get_csrf_token()
+            }
+
+        return self.get()

pyramid_fullauth/views/basic/register.py

@@ -0,0 +1,110 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Registration related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User, AuthenticationProvider
+from pyramid_fullauth.events import BeforeRegister, AfterRegister
+from pyramid_fullauth import tools
+from pyramid_fullauth.exceptions import ValidateError
+
+
+@view_defaults(route_name='register', permission=NO_PERMISSION_REQUIRED,
+               renderer="pyramid_fullauth:resources/templates/register.mako")
+class RegisterView(BaseView):
+
+    """Registration views."""
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display registration form."""
+        csrf_token = self.request.session.get_csrf_token()
+        return {'status': True, 'msg': None, 'csrf_token': csrf_token, 'errors': {}}
+
+    @view_config(request_method='POST', check_csrf=True)
+    @view_config(request_method='POST', check_csrf=True, xhr=True, renderer="json")
+    def post(self):
+        """Process registration request."""
+        response = {
+            'status': False,
+            'msg': self.request._('You have an error in your registration form',
+                                  domain='pyramid_fullauth'),
+            'csrf_token': self.request.session.get_csrf_token(),
+            'errors': {},
+        }
+
+        user = User()
+        user.address_ip = self.request.remote_addr
+
+        response = self._fillin_user(response, user)
+
+        if not response['errors']:
+            response['status'] = True
+            response['msg'] = self.request._(
+                'You have successfully registered', domain='pyramid_fullauth')
+
+        try:
+            self.request.registry.notify(AfterRegister(self.request, user, response))
+        except HTTPFound as redirect:
+            return redirect
+
+        return response
+
+    def _fillin_user(self, response, user):
+        """
+        Fill new user object in, with sent data.
+
+        :param dict response: response to return from register view
+        :param pyramid_fullauth.models.User user: new user object
+
+        :returns: response
+        :rtype: dict
+        """
+        email = self.request.POST.get('email', u'')
+        # here if e-mail is already in database
+
+        if pyramid_basemodel.Session.query(User).filter(User.email == email).count() != 0:
+            response['errors']['email'] = self.request._(
+                'User with given e-mail already exists!',
+                domain='pyramid_fullauth')
+        try:
+            try:
+                user.email = email
+            except ValidateError as e:
+                # do not overwrite existing error
+                if 'email' not in response['errors']:
+                    response['errors']['email'] = str(e)
+
+            if self.config.register.password.require:
+                try:
+                    tools.validate_passsword(self.request,
+                                             self.request.POST.get('password', u''),
+                                             user)
+                except ValidateError as e:
+                    response['errors']['password'] = e.message
+            else:
+                user.password = tools.password_generator(
+                    self.config.register.password.length_min)
+
+            self.request.registry.notify(BeforeRegister(self.request, user, response['errors']))
+            if not response['errors']:
+                pyramid_basemodel.Session.add(user)
+                pyramid_basemodel.Session.flush()
+
+                # lets add AuthenticationProvider as email!
+                user.providers.append(
+                    AuthenticationProvider(provider=u'email', provider_id=user.id))
+            else:
+                return response
+        except AttributeError as e:
+            response['errors']['msg'] = str(e)
+
+        return response

pyramid_fullauth/views/social.py

@@ -0,0 +1,218 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Social login/registration view."""
+import logging
+
+from pyramid.view import view_config
+from pyramid.httpexceptions import HTTPFound
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+from sqlalchemy.exc import IntegrityError
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+from pyramid_fullauth.models import AuthenticationProvider
+from pyramid_fullauth.events import BeforeSocialRegister
+from pyramid_fullauth.events import AfterSocialRegister
+from pyramid_fullauth.events import AfterSocialLogIn
+from pyramid_fullauth.events import SocialAccountAlreadyConnected
+from pyramid_fullauth import tools
+
+logger = logging.getLogger(__name__)
+
+
+@view_config(context='velruse.AuthenticationComplete',
+             permission=NO_PERMISSION_REQUIRED,
+             renderer="pyramid_fullauth:resources/templates/register.mako")
+class SocialLoginViews(BaseView):
+
+    """Social login views definition."""
+
+    def set_provider(self, user, provider_name, user_provider_id):
+        """
+        Set authentication provider on user.
+
+        This method will connect given provider with given user,
+        unless provider_id has already been used on another user.
+
+        :param pyramid_fullauth.user.User user: user object
+        :param str provider_name: provider name
+        :param str user_provider_id: user id delivered by given provider
+
+        :returns: whether user got/was connected or the connection was made with another user.
+        :rtype: bool
+        """
+        if user.id:
+            try:
+                provider_auth = pyramid_basemodel.Session.query(
+                    AuthenticationProvider
+                ).filter(
+                    AuthenticationProvider.user_id == user.id,
+                    AuthenticationProvider.provider == provider_name
+                ).one()
+                if provider_auth.provider_id != user_provider_id:
+                    return False
+                return True
+            except NoResultFound:
+                pass
+
+        provider_auth = AuthenticationProvider(
+            provider=provider_name,
+            provider_id=user_provider_id
+        )
+        user.providers.append(provider_auth)
+        pyramid_basemodel.Session.flush()
+        return True
+
+    def __call__(self):
+        """
+        Action provides social authorization functionality.
+
+        When authorization with facebook or twitter is done successfully
+        action tries to find existing user in database,
+        if it exists - login this user, otherwise creates new user.
+        """
+        context = self.request.context
+        response_values = {
+            'status': False,
+            'csrf_token': self.request.session.get_csrf_token()
+        }
+        user = self.request.user
+
+        if user:
+            # Lets try to connect our user
+            return self._connect_user(response_values)
+
+        else:
+            try:
+                user = pyramid_basemodel.Session.query(
+                    User
+                ).join(AuthenticationProvider).filter(
+                    AuthenticationProvider.provider == context.provider_name,
+                    AuthenticationProvider.provider_id == context.profile['accounts'][0]['userid']
+                ).one()
+            except NoResultFound:
+                user = None
+
+            # If the user for the provider was not found then check
+            # if in the DB exists user with the same email
+            if not user:
+                user = self._register_user()
+                try:
+                    self.request.registry.notify(
+                        AfterSocialRegister(
+                            self.request, user, context.profile, response_values))
+                except HTTPFound as redirect:
+                    # it's a redirect, let's follow it!
+                    return redirect
+
+        # if we're here, user exists,
+        try:
+            self.request.registry.notify(AfterSocialLogIn(self.request, user, context.profile))
+        except HTTPFound as redirect:
+            # it's a redirect, let's follow it!
+            return self.request.login_perform(user, location=redirect.location)
+        else:
+            return self.request.login_perform(user)
+
+    def _connect_user(self, response_values):
+        """
+        Connect user to social account.
+
+        :param dict response_values:
+
+        :returns: response values with any message,
+            or HTTPFound if raised in SocialAccountAlreadyConnected
+        :rtype: dict
+        """
+        context = self.request.context
+        user = self.request.user
+        try:
+            if not self.set_provider(
+                user, context.provider_name, context.profile['accounts'][0]['userid']
+            ):
+                response_values['msg'] = self.request._(
+                    'Your account is already connected to other ${provider} account.',
+                    domain='pyramid_fullauth',
+                    mapping={'provider': context.provider_name}
+                )
+            else:
+                response_values['status'] = True
+                response_values['msg'] = self.request._(
+                    'Your account has been connected to ${provider} account.',
+                    domain='pyramid_fullauth',
+                    mapping={'provider': context.provider_name}
+                )
+        except IntegrityError:
+            response_values['msg'] = self.request._(
+                'This ${provider} account is already connected with other account.',
+                domain='pyramid_fullauth',
+                mapping={'provider': context.provider_name}
+            )
+            try:
+                self.request.registry.notify(
+                    SocialAccountAlreadyConnected(
+                        self.request, user, context.profile, response_values))
+            except HTTPFound as redirect:
+                # it's a redirect, let's follow it!
+                return redirect
+        return response_values
+
+    def _register_user(self):
+        """Actually register new user in the system based on context values."""
+        context = self.request.context
+        email = self._email_from_context(context)
+
+        try:
+            user = pyramid_basemodel.Session.query(User).filter(User.email == email).one()
+            # If we are here that means that in the DB exists user with the same email but without the provider
+            # then we connect social account to this user
+            if not self.set_provider(
+                user, context.provider_name, context.profile['accounts'][0]['userid']
+            ):
+                # authenticating user with different social account than assigned,
+                # recogniced by same email address used
+                logger.debug('''Authenticated {user.id} connected to
+                             {context.provider_name} id {connected_id},
+                             with {userid}'''.format(
+                    user=user,
+                    context=context,
+                    connected_id=user.provider_id(context.provider_name),
+                    userid=context.profile['accounts'][0]['userid']))
+            pyramid_basemodel.Session.flush()
+        except NoResultFound:
+            length_min = self.config.register.password.length_min
+            user = User(
+                email=email,
+                password=tools.password_generator(length_min),
+                address_ip=self.request.remote_addr
+            )
+            self.request.registry.notify(BeforeSocialRegister(self.request, user, context.profile))
+            self.set_provider(user, context.provider_name, context.profile['accounts'][0]['userid'])
+            pyramid_basemodel.Session.add(user)
+            pyramid_basemodel.Session.flush()
+            user.is_active = True
+        return user
+
+    def _email_from_context(self, context):
+        """
+        Extract or generate email from context values.
+
+        :param velruse.AuthenticationComplete context: velruse context
+        """
+        # getting verified email from provider
+        if 'verifiedEmail' in context.profile:
+            return context.profile['verifiedEmail']
+        # getting first of the emails provided by social login provider
+        elif 'emails' in context.profile and context.profile['emails'] and 'value' in context.profile['emails'][0]:
+            return context.profile['emails'][0]['value']
+        # generating some random email address based on social userid and provider domain
+        else:
+            return u'{0}@{1}'.format(
+                context.profile['accounts'][0]['userid'],
+                context.profile['accounts'][0]['domain']
+            )

tests/__init__.py

@@ -0,0 +1 @@
+"""Tests."""

tests/conftest.py

@@ -0,0 +1,190 @@
+"""Most of the fixtures needed."""
+from mock import Mock
+import pytest
+
+import transaction
+from sqlalchemy import create_engine
+from sqlalchemy.orm import scoped_session, sessionmaker
+from sqlalchemy.pool import NullPool
+from zope.sqlalchemy import ZopeTransactionExtension
+
+from pyramid.compat import text_type
+from pytest_pyramid import factories
+import pyramid_basemodel
+
+
+@pytest.fixture
+def web_request():
+    """Mocked web request for views testing."""
+    request = Mock()
+    config = Mock()
+    config.configure_mock(
+        **{'fullauth.register.password':
+            {'length_min': 8, 'confirm': True},
+            'POST': {'confirm_password': '987654321'}
+           }
+    )
+
+    def _(message, *args, **kwargs):
+        return message
+    request._ = Mock(side_effect=_)
+    request.configure_mock(
+        **{'registry': {'config': config}}
+    )
+
+    return request
+
+
+@pytest.fixture(scope='function', params=['sqlite', 'mysql', 'postgresql'])
+def db_session(request):
+    """SQLAlchemy session."""
+    from pyramid_fullauth.models import Base
+
+    if request.param == 'sqlite':
+        connection = 'sqlite:///fullauth.sqlite'
+    elif request.param == 'mysql':
+        request.getfuncargvalue('mysqldb')  # takes care of creating database
+        connection = 'mysql+mysqldb://root:@127.0.0.1:3307/tests?charset=utf8'
+    elif request.param == 'postgresql':
+        request.getfuncargvalue('postgresql')  # takes care of creating database
+        connection = 'postgresql+psycopg2://postgres:@127.0.0.1:5433/tests'
+
+    engine = create_engine(connection, echo=False, poolclass=NullPool)
+    pyramid_basemodel.Session = scoped_session(sessionmaker(extension=ZopeTransactionExtension()))
+    pyramid_basemodel.bind_engine(engine, pyramid_basemodel.Session, should_drop=True)
+
+    def destroy():
+        transaction.commit()
+        Base.metadata.drop_all(engine)
+
+    request.addfinalizer(destroy)
+
+    return pyramid_basemodel.Session
+
+
+@pytest.fixture
+def user(db_session):
+    """Default user."""
+    from pyramid_fullauth.models import User
+    from tests.tools import DEFAULT_USER
+    user = User(**DEFAULT_USER)
+    db_session.add(user)
+    transaction.commit()
+    return user
+
+
+@pytest.fixture
+def active_user(user, db_session):
+    """Active user."""
+    user = db_session.merge(user)
+    user.is_active = True
+    transaction.commit()
+    return user
+
+
+@pytest.fixture(params=[
+    # (an @ character must separate the local and domain parts)
+    text_type('Abc.example.com'),
+    # (character dot(.) is last in local part)
+    text_type('Abc.@example.com'),
+    # (character dot(.) is double)
+    text_type('Abc..123@example.com'),
+    # (only one @ is allowed outside quotation marks)
+    text_type('A@b@c@example.com'),
+    # (none of the special characters in this local part is allowed outside quotation marks)
+    text_type('a"b(c)d,e:f;g<h>i[j\k]l@example.com'),
+    # (quoted strings must be dot separated, or the only element making up the local-part)
+    text_type('just"not"right@example.com'),
+    # (spaces, quotes, and backslashes may only exist when within quoted strings and preceded by a backslash)
+    text_type('this is"not\allowed@example.com'),
+    # (even if escaped (preceded by a backslash), spaces, quotes, and backslashes must still be contained by quotes)
+    text_type('this\ still\"not\\allowed@example.com'),
+    text_type('bad-mail'),
+])
+def invalid_email(request):
+    """Parametrized fixture with all the incorrect emails."""
+    return request.param
+
+
+default_config = factories.pyramid_config({
+    'pyramid.includes': [
+        'pyramid_tm',
+        'pyramid_fullauth'
+    ]
+})
+
+
+extended_config = factories.pyramid_config({
+    'pyramid.includes': [
+        'pyramid_tm',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+short_config = factories.pyramid_config({
+    'yml.location': 'tests:config/short_memory.yaml',
+    'pyramid.includes': [
+        'pyramid_tm',
+        'tzf.pyramid_yml',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+social_config = factories.pyramid_config({
+    'yml.location': 'tests:config/social.yaml',
+    'pyramid.includes': [
+        'pyramid_tm',
+        'tzf.pyramid_yml',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+authable_config = factories.pyramid_config({
+    'yml.location': 'tests:config',
+    'env': 'login',
+    'pyramid.includes': [
+        'pyramid_tm',
+        'tzf.pyramid_yml',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+nopassconfirm_config = factories.pyramid_config({
+    'yml.location': 'tests:config/no_password_confirm.yaml',
+    'env': 'login',
+    'pyramid.includes': [
+        'pyramid_tm',
+        'tzf.pyramid_yml',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+nopassregister_config = factories.pyramid_config({
+    'yml.location': 'tests:config/no_password_register.yaml',
+    'env': 'login',
+    'pyramid.includes': [
+        'pyramid_tm',
+        'tzf.pyramid_yml',
+        'pyramid_fullauth',
+        'tests.tools.include_views'
+    ]
+})
+
+
+default_app = factories.pyramid_app('default_config')
+extended_app = factories.pyramid_app('extended_config')
+short_app = factories.pyramid_app('short_config')
+social_app = factories.pyramid_app('social_config')
+authable_app = factories.pyramid_app('authable_config')
+nopassconfirm_app = factories.pyramid_app('nopassconfirm_config')
+nopassregister_app = factories.pyramid_app('nopassregister_config')