pyramid-fullauth 0.4.0__py3.4.egg

pyramid_fullauth/views/basic/profile/__init__.py

@@ -0,0 +1,5 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Groups profile views."""

pyramid_fullauth/views/basic/profile/email.py

@@ -0,0 +1,108 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Email related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPRedirection, HTTPSeeOther
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+from pyramid.compat import text_type
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+
+from pyramid_fullauth.events import BeforeEmailChange
+from pyramid_fullauth.events import AfterEmailChange
+from pyramid_fullauth.events import AfterEmailChangeActivation
+from pyramid_fullauth.exceptions import EmptyError, EmailValidationError
+
+
+@view_defaults(route_name='email:change', permission='email_change',
+               renderer='pyramid_fullauth:resources/templates/email_change.mako')
+class EmailChangeViews(BaseView):
+
+    """Email change related views."""
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display email change request form."""
+        return {'status': True, 'csrf_token': self.request.session.get_csrf_token()}
+
+    @view_config(request_method='POST', check_csrf='csrf_token')
+    @view_config(request_method='POST', check_csrf='csrf_token', xhr=True, renderer="json")
+    def post(self):
+        """Process email change request."""
+        csrf_token = self.request.session.get_csrf_token()
+        try:
+            pyramid_basemodel.Session.query(User).filter(
+                User.email == self.request.POST.get('email', '')
+            ).one()
+            return {'status': False,
+                    'msg': self.request._('User with this email exists',
+                                          domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+        except NoResultFound:
+            pass
+
+        user = self.request.user
+        try:
+            self.request.registry.notify(BeforeEmailChange(self.request, user))
+        except AttributeError as e:
+            return {'status': False, 'msg': text_type(e), 'csrf_token': csrf_token}
+
+        try:
+            user.set_new_email(self.request.POST.get('email', ''))
+        except EmptyError:
+            return {'status': False,
+                    'msg': self.request._(
+                        'E-mail is empty',
+                        domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+        except EmailValidationError:
+            return {'status': False,
+                    'msg': self.request._(
+                        'Incorrect e-mail format',
+                        domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+
+        response_values = {
+            'status': True,
+            'msg': self.request._('We sent you email to activate your new email address',
+                                  domain='pyramid_fullauth')
+        }
+
+        try:
+            self.request.registry.notify(AfterEmailChange(self.request, user))
+        except HTTPRedirection as redirect:
+            if self.request.is_xhr:
+                response_values['url'] = redirect.location
+                return response_values
+            else:
+                return redirect
+        else:
+            if self.request.is_xhr:
+                return response_values
+            else:
+                return HTTPSeeOther(location='/')
+
+
+@view_config(route_name='email:change:continue', permission=NO_PERMISSION_REQUIRED,
+             renderer='pyramid_fullauth:resources/templates/email_change.mako')
+class EmailChangeAccept(BaseView):
+
+    """Display email change success."""
+
+    def __call__(self):
+        """View that changes user email."""
+        user = self.request.matchdict.get('user')
+        user.change_email()
+
+        try:
+            self.request.registry.notify(AfterEmailChangeActivation(self.request, user))
+        except HTTPRedirection as redirect:
+            return redirect
+        return HTTPSeeOther(location='/')

pyramid_fullauth/views/basic/profile/password.py

@@ -0,0 +1,129 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Profile related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPRedirection, HTTPSeeOther
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+from pyramid.compat import text_type
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User, AuthenticationProvider
+
+from pyramid_fullauth.events import BeforeReset
+from pyramid_fullauth.events import AfterResetRequest
+from pyramid_fullauth.events import AfterReset
+from pyramid_fullauth.exceptions import ValidateError
+from pyramid_fullauth.tools import validate_passsword
+
+
+@view_defaults(route_name='password:reset', permission=NO_PERMISSION_REQUIRED,
+               renderer='pyramid_fullauth:resources/templates/reset.mako')
+class PasswordResetView(BaseView):
+
+    """Profile related views."""
+
+    @view_config()
+    def get(self):
+        """Password reset request view."""
+        csrf_token = self.request.session.get_csrf_token()
+
+        return {'status': True, 'csrf_token': csrf_token}
+
+    @view_config(request_method='POST', check_csrf=True)
+    def post(self):
+        """View processing requests to reset password."""
+        csrf_token = self.request.session.get_csrf_token()
+
+        try:
+            user = pyramid_basemodel.Session.query(User).filter(
+                User.email == self.request.POST.get('email', '')).one()
+        except NoResultFound:
+            return {'status': False,
+                    'msg': self.request._('user-not-exists',
+                                          default='User does not exists',
+                                          domain='pyramid_fullauth'),
+                    'csrf_token': csrf_token}
+
+        user.set_reset()
+        try:
+            self.request.registry.notify(AfterResetRequest(self.request, user))
+        except HTTPRedirection as redirect:
+            return redirect
+
+        return HTTPSeeOther(location='/')
+
+
+@view_defaults(route_name='password:reset:continue', permission=NO_PERMISSION_REQUIRED,
+               renderer='pyramid_fullauth:resources/templates/reset.proceed.mako')
+class PasswordResetContinueView(BaseView):
+
+    """
+    Password reset views.
+
+    These views display actual reset password views.
+    """
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display actual password reset form."""
+        self.request.logout()
+        return {
+            'status': True,
+            'csrf_token': self.request.session.get_csrf_token()
+        }
+
+    @view_config(request_method='POST', check_csrf=True)
+    def post(self):
+        """Validate and possibly accept new email."""
+        user = self.request.matchdict.get('user')
+
+        password = self.request.POST.get('password', None)
+        password_confirm = self.request.POST.get('confirm_password', None)
+        if password == password_confirm:
+
+            try:
+                self.request.registry.notify(BeforeReset(self.request, user))
+                validate_passsword(self.request, password, user)
+
+                user.reset_key = None
+                try:
+                    pyramid_basemodel.Session.query(AuthenticationProvider).filter(
+                        AuthenticationProvider.user_id == user.id,
+                        AuthenticationProvider.provider == text_type('email')
+                    ).one()
+                except NoResultFound:
+                    user.providers.append(
+                        AuthenticationProvider(
+                            provider=text_type('email'),
+                            provider_id=user.id
+                        )
+                    )
+
+                pyramid_basemodel.Session.flush()
+            except (ValidateError, AttributeError) as e:
+                return {
+                    'status': False,
+                    'msg': text_type(e),
+                    'csrf_token': self.request.session.get_csrf_token()
+                }
+
+            try:
+                self.request.registry.notify(AfterReset(self.request, user))
+            except HTTPRedirection as redirect:
+                return redirect
+        else:
+            return {
+                'status': False,
+                'msg': self.request._('password-mismatch',
+                                      default='Password doesn\'t match',
+                                      domain='pyramid_fullauth'),
+                'csrf_token': self.request.session.get_csrf_token()
+            }
+
+        return self.get()

pyramid_fullauth/views/basic/register.py

@@ -0,0 +1,111 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Registration related views."""
+
+from pyramid.view import view_config, view_defaults
+from pyramid.httpexceptions import HTTPRedirection
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from pyramid.compat import text_type
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User, AuthenticationProvider
+from pyramid_fullauth.events import BeforeRegister, AfterRegister
+from pyramid_fullauth import tools
+from pyramid_fullauth.exceptions import ValidateError
+
+
+@view_defaults(route_name='register', permission=NO_PERMISSION_REQUIRED,
+               renderer="pyramid_fullauth:resources/templates/register.mako")
+class RegisterView(BaseView):
+
+    """Registration views."""
+
+    @view_config(request_method='GET')
+    def get(self):
+        """Display registration form."""
+        csrf_token = self.request.session.get_csrf_token()
+        return {'status': True, 'msg': None, 'csrf_token': csrf_token, 'errors': {}}
+
+    @view_config(request_method='POST', check_csrf=True)
+    @view_config(request_method='POST', check_csrf=True, xhr=True, renderer="json")
+    def post(self):
+        """Process registration request."""
+        response = {
+            'status': False,
+            'msg': self.request._('You have an error in your registration form',
+                                  domain='pyramid_fullauth'),
+            'csrf_token': self.request.session.get_csrf_token(),
+            'errors': {},
+        }
+
+        user = User()
+        user.address_ip = self.request.remote_addr
+
+        response = self._fillin_user(response, user)
+
+        if not response['errors']:
+            response['status'] = True
+            response['msg'] = self.request._(
+                'You have successfully registered', domain='pyramid_fullauth')
+
+        try:
+            self.request.registry.notify(AfterRegister(self.request, user, response))
+        except HTTPRedirection as redirect:
+            return redirect
+
+        return response
+
+    def _fillin_user(self, response, user):
+        """
+        Fill new user object in, with sent data.
+
+        :param dict response: response to return from register view
+        :param pyramid_fullauth.models.User user: new user object
+
+        :returns: response
+        :rtype: dict
+        """
+        email = self.request.POST.get('email', text_type(''))
+        # here if e-mail is already in database
+
+        if pyramid_basemodel.Session.query(User).filter(User.email == email).count() != 0:
+            response['errors']['email'] = self.request._(
+                'User with given e-mail already exists!',
+                domain='pyramid_fullauth')
+        try:
+            try:
+                user.email = email
+            except ValidateError as e:
+                # do not overwrite existing error
+                if 'email' not in response['errors']:
+                    response['errors']['email'] = text_type(e)
+
+            if self.config.register.password.require:
+                try:
+                    tools.validate_passsword(self.request,
+                                             self.request.POST.get('password', text_type('')),
+                                             user)
+                except ValidateError as e:
+                    response['errors']['password'] = text_type(e)
+            else:
+                user.password = tools.password_generator(
+                    self.config.register.password.length_min)
+
+            self.request.registry.notify(BeforeRegister(self.request, user, response['errors']))
+            if not response['errors']:
+                pyramid_basemodel.Session.add(user)
+                pyramid_basemodel.Session.flush()
+
+                # lets add AuthenticationProvider as email!
+                user.providers.append(
+                    AuthenticationProvider(provider=text_type('email'), provider_id=user.id))
+            else:
+                return response
+        except AttributeError as e:
+            response['errors']['msg'] = text_type(e)
+
+        return response

pyramid_fullauth/views/social.py

@@ -0,0 +1,221 @@
+# Copyright (c) 2013 - 2014 by pyramid_fullauth authors and contributors <see AUTHORS file>
+#
+# This module is part of pyramid_fullauth and is released under
+# the MIT License (MIT): http://opensource.org/licenses/MIT
+"""Social login/registration view."""
+import logging
+
+from pyramid.view import view_config
+from pyramid.httpexceptions import HTTPRedirection
+from pyramid.security import NO_PERMISSION_REQUIRED
+
+from sqlalchemy.orm.exc import NoResultFound
+from sqlalchemy.exc import IntegrityError
+from pyramid.compat import text_type
+import pyramid_basemodel
+
+from pyramid_fullauth.views import BaseView
+from pyramid_fullauth.models import User
+from pyramid_fullauth.models import AuthenticationProvider
+from pyramid_fullauth.events import BeforeSocialRegister
+from pyramid_fullauth.events import AfterSocialRegister
+from pyramid_fullauth.events import AfterSocialLogIn
+from pyramid_fullauth.events import SocialAccountAlreadyConnected
+from pyramid_fullauth import tools
+
+logger = logging.getLogger(__name__)
+
+
+@view_config(context='velruse.AuthenticationComplete',
+             permission=NO_PERMISSION_REQUIRED,
+             renderer="pyramid_fullauth:resources/templates/register.mako")
+class SocialLoginViews(BaseView):
+
+    """Social login views definition."""
+
+    def set_provider(self, user, provider_name, user_provider_id):
+        """
+        Set authentication provider on user.
+
+        This method will connect given provider with given user,
+        unless provider_id has already been used on another user.
+
+        :param pyramid_fullauth.user.User user: user object
+        :param str provider_name: provider name
+        :param str user_provider_id: user id delivered by given provider
+
+        :returns: whether user got/was connected or the connection was made with another user.
+        :rtype: bool
+        """
+        if user.id:
+            try:
+                provider_auth = pyramid_basemodel.Session.query(
+                    AuthenticationProvider
+                ).filter(
+                    AuthenticationProvider.user_id == user.id,
+                    AuthenticationProvider.provider == provider_name
+                ).one()
+                if provider_auth.provider_id != user_provider_id:
+                    return False
+                return True
+            except NoResultFound:
+                pass
+
+        provider_auth = AuthenticationProvider(
+            provider=provider_name,
+            provider_id=user_provider_id
+        )
+        user.providers.append(provider_auth)
+        pyramid_basemodel.Session.flush()
+        return True
+
+    def __call__(self):
+        """
+        Action provides social authorization functionality.
+
+        When authorization with facebook or twitter is done successfully
+        action tries to find existing user in database,
+        if it exists - login this user, otherwise creates new user.
+        """
+        context = self.request.context
+        response_values = {
+            'status': False,
+            'csrf_token': self.request.session.get_csrf_token()
+        }
+        user = self.request.user
+
+        if user:
+            # Lets try to connect our user
+            return self._connect_user(response_values)
+
+        else:
+            try:
+                user = pyramid_basemodel.Session.query(
+                    User
+                ).join(AuthenticationProvider).filter(
+                    AuthenticationProvider.provider == context.provider_name,
+                    AuthenticationProvider.provider_id == context.profile['accounts'][0]['userid']
+                ).one()
+            except NoResultFound:
+                user = None
+
+            # If the user for the provider was not found then check
+            # if in the DB exists user with the same email
+            if not user:
+                user = self._register_user()
+                try:
+                    self.request.registry.notify(
+                        AfterSocialRegister(
+                            self.request, user, context.profile, response_values))
+                except HTTPRedirection as redirect:
+                    # it's a redirect, let's follow it!
+                    return redirect
+
+        # if we're here, user exists,
+        try:
+            self.request.registry.notify(AfterSocialLogIn(self.request, user, context.profile))
+        except HTTPRedirection as redirect:
+            # it's a redirect, let's follow it!
+            return self.request.login_perform(user, location=redirect.location)
+        else:
+            return self.request.login_perform(user)
+
+    def _connect_user(self, response_values):
+        """
+        Connect user to social account.
+
+        :param dict response_values:
+
+        :returns: response values with any message,
+            or HTTPRedirection if raised in SocialAccountAlreadyConnected
+        :rtype: dict
+        """
+        context = self.request.context
+        user = self.request.user
+        try:
+            if not self.set_provider(
+                user, context.provider_name, context.profile['accounts'][0]['userid']
+            ):
+                response_values['msg'] = self.request._(
+                    'Your account is already connected to other ${provider} account.',
+                    domain='pyramid_fullauth',
+                    mapping={'provider': context.provider_name}
+                )
+            else:
+                response_values['status'] = True
+                response_values['msg'] = self.request._(
+                    'Your account has been connected to ${provider} account.',
+                    domain='pyramid_fullauth',
+                    mapping={'provider': context.provider_name}
+                )
+        except IntegrityError:
+            response_values['msg'] = self.request._(
+                'This ${provider} account is already connected with other account.',
+                domain='pyramid_fullauth',
+                mapping={'provider': context.provider_name}
+            )
+            try:
+                self.request.registry.notify(
+                    SocialAccountAlreadyConnected(
+                        self.request, user, context.profile, response_values))
+            except HTTPRedirection as redirect:
+                # it's a redirect, let's follow it!
+                return redirect
+        return response_values
+
+    def _register_user(self):
+        """Actually register new user in the system based on context values."""
+        context = self.request.context
+        email = self._email_from_context(context)
+
+        try:
+            user = pyramid_basemodel.Session.query(User).filter(User.email == email).one()
+            # If we are here that means that in the DB exists user with the same email but without the provider
+            # then we connect social account to this user
+            if not self.set_provider(
+                user, context.provider_name, context.profile['accounts'][0]['userid']
+            ):
+                # authenticating user with different social account than assigned,
+                # recogniced by same email address used
+                logger.debug('''Authenticated {user.id} connected to
+                             {context.provider_name} id {connected_id},
+                             with {userid}'''.format(
+                    user=user,
+                    context=context,
+                    connected_id=user.provider_id(context.provider_name),
+                    userid=context.profile['accounts'][0]['userid']))
+            pyramid_basemodel.Session.flush()
+        except NoResultFound:
+            length_min = self.config.register.password.length_min
+            user = User(
+                email=email,
+                password=tools.password_generator(length_min),
+                address_ip=self.request.remote_addr
+            )
+            self.request.registry.notify(BeforeSocialRegister(self.request, user, context.profile))
+            self.set_provider(user, context.provider_name, context.profile['accounts'][0]['userid'])
+            pyramid_basemodel.Session.add(user)
+            pyramid_basemodel.Session.flush()
+            user.is_active = True
+        return user
+
+    def _email_from_context(self, context):
+        """
+        Extract or generate email from context values.
+
+        :param velruse.AuthenticationComplete context: velruse context
+        """
+        # getting verified email from provider
+        if 'verifiedEmail' in context.profile:
+            return context.profile['verifiedEmail']
+        # getting first of the emails provided by social login provider
+        elif 'emails' in context.profile and context.profile['emails'] and 'value' in context.profile['emails'][0]:
+            return context.profile['emails'][0]['value']
+        # generating some random email address based on social userid and provider domain
+        else:
+            return text_type(
+                '{0}@{1}'.format(
+                    context.profile['accounts'][0]['userid'],
+                    context.profile['accounts'][0]['domain']
+                )
+            )

tests/__init__.py

@@ -0,0 +1 @@
+"""Tests."""