udata 9.1.2.dev30355__py2.py3-none-any.whl → 9.1.2.dev30454__py2.py3-none-any.whl

udata/core/user/models.py

@@ -1,34 +1,33 @@
+import json
 from copy import copy
 from datetime import datetime
 from itertools import chain
-import json
 from time import time
 
 from authlib.jose import JsonWebSignature
 from blinker import Signal
 from flask import current_app
-from flask_security import UserMixin, RoleMixin, MongoEngineUserDatastore
-from mongoengine.signals import pre_save, post_save
-
+from flask_security import MongoEngineUserDatastore, RoleMixin, UserMixin
+from mongoengine.signals import post_save, pre_save
 from werkzeug.utils import cached_property
 
 from udata import mail
 from udata.core import storages
-from udata.uris import endpoint_for
-from udata.frontend.markdown import mdstrip
-from udata.i18n import lazy_gettext as _
-from udata.models import db, WithMetrics, Follow
 from udata.core.discussions.models import Discussion
 from udata.core.storages import avatars, default_image_basename
-from .constants import AVATAR_SIZES
+from udata.frontend.markdown import mdstrip
+from udata.i18n import lazy_gettext as _
+from udata.models import Follow, WithMetrics, db
+from udata.uris import endpoint_for
 
-__all__ = ('User', 'Role', 'datastore')
+from .constants import AVATAR_SIZES
 
+__all__ = ("User", "Role", "datastore")
 
 
 # TODO: use simple text for role
 class Role(db.Document, RoleMixin):
-    ADMIN = 'admin'
+    ADMIN = "admin"
     name = db.StringField(max_length=80, unique=True)
     description = db.StringField(max_length=255)
     permissions = db.ListField()
@@ -42,8 +41,7 @@ class UserSettings(db.EmbeddedDocument):
 
 
 class User(WithMetrics, UserMixin, db.Document):
-    slug = db.SlugField(
-        max_length=255, required=True, populate_from='fullname')
+    slug = db.SlugField(max_length=255, required=True, populate_from="fullname")
     email = db.StringField(max_length=255, required=True, unique=True)
     password = db.StringField()
     active = db.BooleanField()
@@ -54,8 +52,7 @@ class User(WithMetrics, UserMixin, db.Document):
     last_name = db.StringField(max_length=255, required=True)
 
     avatar_url = db.URLField()
-    avatar = db.ImageField(
-        fs=avatars, basename=default_image_basename, thumbnails=AVATAR_SIZES)
+    avatar = db.ImageField(fs=avatars, basename=default_image_basename, thumbnails=AVATAR_SIZES)
     website = db.URLField()
     about = db.StringField()
 
@@ -93,16 +90,16 @@ class User(WithMetrics, UserMixin, db.Document):
     on_delete = Signal()
 
     meta = {
-        'indexes': ['$slug', '-created_at', 'slug', 'apikey'],
-        'ordering': ['-created_at'],
-        'auto_create_index_on_save': True
+        "indexes": ["$slug", "-created_at", "slug", "apikey"],
+        "ordering": ["-created_at"],
+        "auto_create_index_on_save": True,
     }
 
     __metrics_keys__ = [
-        'datasets',
-        'reuses',
-        'following',
-        'followers',
+        "datasets",
+        "reuses",
+        "following",
+        "followers",
     ]
 
     def __str__(self):
@@ -110,19 +107,20 @@ class User(WithMetrics, UserMixin, db.Document):
 
     @property
     def fullname(self):
-        return ' '.join((self.first_name or '', self.last_name or '')).strip()
+        return " ".join((self.first_name or "", self.last_name or "")).strip()
 
     @cached_property
     def organizations(self):
         from udata.core.organization.models import Organization
+
         return Organization.objects(members__user=self, deleted__exists=False)
 
     @property
     def sysadmin(self):
-        return self.has_role('admin')
+        return self.has_role("admin")
 
     def url_for(self, *args, **kwargs):
-        return endpoint_for('users.show', 'api.user', user=self, *args, **kwargs)
+        return endpoint_for("users.show", "api.user", user=self, *args, **kwargs)
 
     display_url = property(url_for)
 
@@ -132,23 +130,19 @@ class User(WithMetrics, UserMixin, db.Document):
 
     @property
     def visible(self):
-        count = self.metrics.get('datasets', 0) + self.metrics.get('reuses', 0)
+        count = self.metrics.get("datasets", 0) + self.metrics.get("reuses", 0)
         return count > 0 and self.active
 
     @cached_property
     def resources_availability(self):
         """Return the percentage of availability for resources."""
         # Flatten the list.
-        availabilities = list(
-            chain(
-                *[org.check_availability() for org in self.organizations]
-            )
-        )
+        availabilities = list(chain(*[org.check_availability() for org in self.organizations]))
         # Filter out the unknown
         availabilities = [a for a in availabilities if type(a) is bool]
         if availabilities:
             # Trick will work because it's a sum() of booleans.
-            return round(100. * sum(availabilities) / len(availabilities), 2)
+            return round(100.0 * sum(availabilities) / len(availabilities), 2)
         # if nothing is unavailable, everything is considered OK
         return 100
 
@@ -156,35 +150,38 @@ class User(WithMetrics, UserMixin, db.Document):
     def datasets_org_count(self):
         """Return the number of datasets of user's organizations."""
         from udata.models import Dataset  # Circular imports.
-        return sum(Dataset.objects(organization=org).visible().count()
-                   for org in self.organizations)
+
+        return sum(
+            Dataset.objects(organization=org).visible().count() for org in self.organizations
+        )
 
     @cached_property
     def followers_org_count(self):
         """Return the number of followers of user's organizations."""
         from udata.models import Follow  # Circular imports.
-        return sum(Follow.objects(following=org).count()
-                   for org in self.organizations)
+
+        return sum(Follow.objects(following=org).count() for org in self.organizations)
 
     @property
     def datasets_count(self):
         """Return the number of datasets of the user."""
-        return self.metrics.get('datasets', 0)
+        return self.metrics.get("datasets", 0)
 
     @property
     def followers_count(self):
         """Return the number of followers of the user."""
-        return self.metrics.get('followers', 0)
+        return self.metrics.get("followers", 0)
 
     def generate_api_key(self):
         payload = {
-            'user': str(self.id),
-            'time': time(),
+            "user": str(self.id),
+            "time": time(),
         }
-        s = JsonWebSignature(algorithms=['HS512']).serialize_compact(
-            {'alg': 'HS512'},
-            json.dumps(payload, separators=(',', ':')),
-            current_app.config['SECRET_KEY'])
+        s = JsonWebSignature(algorithms=["HS512"]).serialize_compact(
+            {"alg": "HS512"},
+            json.dumps(payload, separators=(",", ":")),
+            current_app.config["SECRET_KEY"],
+        )
         self.apikey = s.decode()
 
     def clear_api_key(self):
@@ -202,28 +199,27 @@ class User(WithMetrics, UserMixin, db.Document):
     @classmethod
     def post_save(cls, sender, document, **kwargs):
         cls.after_save.send(document)
-        if kwargs.get('created'):
+        if kwargs.get("created"):
             cls.on_create.send(document)
         else:
             cls.on_update.send(document)
 
     @cached_property
     def json_ld(self):
-
         result = {
-            '@type': 'Person',
-            '@context': 'http://schema.org',
-            'name': self.fullname,
+            "@type": "Person",
+            "@context": "http://schema.org",
+            "name": self.fullname,
         }
 
         if self.about:
-            result['description'] = mdstrip(self.about)
+            result["description"] = mdstrip(self.about)
 
         if self.avatar_url:
-            result['image'] = self.avatar_url
+            result["image"] = self.avatar_url
 
         if self.website:
-            result['url'] = self.website
+            result["url"] = self.website
 
         return result
 
@@ -231,8 +227,8 @@ class User(WithMetrics, UserMixin, db.Document):
         return db.Document.delete(self, *args, **kwargs)
 
     def delete(self, *args, **kwargs):
-        raise NotImplementedError('''This method should not be using directly.
-        Use `mark_as_deleted` (or `_delete` if you know what you're doing)''')
+        raise NotImplementedError("""This method should not be using directly.
+        Use `mark_as_deleted` (or `_delete` if you know what you're doing)""")
 
     def mark_as_deleted(self, notify: bool = True):
         if self.avatar.filename is not None:
@@ -242,14 +238,13 @@ class User(WithMetrics, UserMixin, db.Document):
             for key, value in self.avatar.thumbnails.items():
                 storage.delete(value)
 
-
         copied_user = copy(self)
-        self.email = '{}@deleted'.format(self.id)
-        self.slug = 'deleted'
+        self.email = "{}@deleted".format(self.id)
+        self.slug = "deleted"
         self.password = None
         self.active = False
-        self.first_name = 'DELETED'
-        self.last_name = 'DELETED'
+        self.first_name = "DELETED"
+        self.last_name = "DELETED"
         self.avatar = None
         self.avatar_url = None
         self.website = None
@@ -259,9 +254,9 @@ class User(WithMetrics, UserMixin, db.Document):
         self.deleted = datetime.utcnow()
         self.save()
         for organization in self.organizations:
-            organization.members = [member
-                                    for member in organization.members
-                                    if member.user != self]
+            organization.members = [
+                member for member in organization.members if member.user != self
+            ]
             organization.save()
         for discussion in Discussion.objects(discussion__posted_by=self):
             # Remove all discussions with current user as only participant
@@ -271,36 +266,40 @@ class User(WithMetrics, UserMixin, db.Document):
 
             for message in discussion.discussion:
                 if message.posted_by == self:
-                    message.content = 'DELETED'
+                    message.content = "DELETED"
             discussion.save()
         Follow.objects(follower=self).delete()
         Follow.objects(following=self).delete()
 
         from udata.models import ContactPoint
-        ContactPoint.objects(owner=self).delete()
 
+        ContactPoint.objects(owner=self).delete()
 
         if notify:
-            mail.send(_('Account deletion'), copied_user, 'account_deleted')
+            mail.send(_("Account deletion"), copied_user, "account_deleted")
 
     def count_datasets(self):
         from udata.models import Dataset
-        self.metrics['datasets'] = Dataset.objects(owner=self).visible().count()
+
+        self.metrics["datasets"] = Dataset.objects(owner=self).visible().count()
         self.save()
 
     def count_reuses(self):
         from udata.models import Reuse
-        self.metrics['reuses'] = Reuse.objects(owner=self).visible().count()
+
+        self.metrics["reuses"] = Reuse.objects(owner=self).visible().count()
         self.save()
 
     def count_followers(self):
         from udata.models import Follow
-        self.metrics['followers'] = Follow.objects(until=None).followers(self).count()
+
+        self.metrics["followers"] = Follow.objects(until=None).followers(self).count()
         self.save()
 
     def count_following(self):
         from udata.models import Follow
-        self.metrics['following'] = Follow.objects.following(self).count()
+
+        self.metrics["following"] = Follow.objects.following(self).count()
         self.save()
 
 

udata/core/user/permissions.py

@@ -1,14 +1,13 @@
 from udata.auth import Permission, RoleNeed, UserNeed
 from udata.i18n import lazy_gettext as _
 
-
 ROLES = {
-    'admin': _('System administrator'),
-    'editor': _('Site editorialist'),
-    'moderator': _('Site moderator'),
+    "admin": _("System administrator"),
+    "editor": _("Site editorialist"),
+    "moderator": _("Site moderator"),
 }
 
-sysadmin = Permission(RoleNeed('admin'))
+sysadmin = Permission(RoleNeed("admin"))
 
 
 class UserEditPermission(Permission):

udata/core/user/rdf.py

@@ -1,22 +1,21 @@
-'''
+"""
 This module centralize user helpers for RDF/DCAT serialization and parsing
-'''
+"""
 
-from rdflib import Graph, URIRef, Literal, BNode
-from rdflib.namespace import RDF, RDFS, FOAF
+from rdflib import BNode, Graph, Literal, URIRef
+from rdflib.namespace import FOAF, RDF, RDFS
 
 from udata.rdf import namespace_manager
 from udata.uris import endpoint_for
 
 
 def user_to_rdf(user, graph=None):
-    '''
+    """
     Map a Resource domain model to a DCAT/RDF graph
-    '''
+    """
     graph = graph or Graph(namespace_manager=namespace_manager)
     if user.id:
-        user_url = endpoint_for('users.show_redirect', 'api.user', 
-                                user=user.id, _external=True)
+        user_url = endpoint_for("users.show_redirect", "api.user", user=user.id, _external=True)
         id = URIRef(user_url)
     else:
         id = BNode()

udata/core/user/tasks.py

@@ -9,7 +9,7 @@ from .models import datastore
 log = logging.getLogger(__name__)
 
 
-@task(route='high.mail')
+@task(route="high.mail")
 def send_test_mail(email):
     user = datastore.find_user(email=email)
-    mail.send(_('Test mail'), user, 'test')
+    mail.send(_("Test mail"), user, "test")

udata/core/user/tests/test_user_model.py

@@ -1,15 +1,13 @@
 import pytest
 
-from udata.core.discussions.factories import (
-    MessageDiscussionFactory, DiscussionFactory
-)
+from udata.core.discussions.factories import DiscussionFactory, MessageDiscussionFactory
+from udata.core.discussions.models import Discussion
 from udata.core.followers.models import Follow
+from udata.core.organization.factories import OrganizationFactory
 from udata.core.user.factories import UserFactory
 from udata.core.user.models import User
-from udata.core.discussions.models import Discussion
-from udata.core.organization.factories import OrganizationFactory
 
-pytestmark = pytest.mark.usefixtures('clean_db')
+pytestmark = pytest.mark.usefixtures("clean_db")
 
 
 @pytest.mark.frontend
@@ -20,12 +18,22 @@ class UserModelTest:
         user = UserFactory()
         other_user = UserFactory()
         org = OrganizationFactory(editors=[user])
-        discussion_only_user = DiscussionFactory(user=user, subject=org, discussion=[
-            MessageDiscussionFactory(posted_by=user), MessageDiscussionFactory(posted_by=user)
-        ])
-        discussion_with_other = DiscussionFactory(user=other_user, subject=org, discussion=[
-            MessageDiscussionFactory(posted_by=other_user), MessageDiscussionFactory(posted_by=user)
-        ])
+        discussion_only_user = DiscussionFactory(
+            user=user,
+            subject=org,
+            discussion=[
+                MessageDiscussionFactory(posted_by=user),
+                MessageDiscussionFactory(posted_by=user),
+            ],
+        )
+        discussion_with_other = DiscussionFactory(
+            user=other_user,
+            subject=org,
+            discussion=[
+                MessageDiscussionFactory(posted_by=other_user),
+                MessageDiscussionFactory(posted_by=user),
+            ],
+        )
         user_follow_org = Follow.objects.create(follower=user, following=org)
         user_followed = Follow.objects.create(follower=other_user, following=user)
 
@@ -36,12 +44,12 @@ class UserModelTest:
 
         assert Discussion.objects(id=discussion_only_user.id).first() is None
         discussion_with_other.reload()
-        assert discussion_with_other.discussion[1].content == 'DELETED'
+        assert discussion_with_other.discussion[1].content == "DELETED"
 
         assert Follow.objects(id=user_follow_org.id).first() is None
         assert Follow.objects(id=user_followed.id).first() is None
 
-        assert user.slug == 'deleted'
+        assert user.slug == "deleted"
 
     def test_mark_as_deleted_slug_multiple(self):
         user = UserFactory()
@@ -50,8 +58,8 @@ class UserModelTest:
         user.mark_as_deleted()
         other_user.mark_as_deleted()
 
-        assert user.slug == 'deleted'
-        assert other_user.slug == 'deleted-1'
+        assert user.slug == "deleted"
+        assert other_user.slug == "deleted-1"
 
     def test_delete_safeguard(self):
         user = UserFactory()

udata/cors.py

@@ -0,0 +1,99 @@
+import logging
+
+from flask import request
+from werkzeug.datastructures import Headers
+
+log = logging.getLogger(__name__)
+
+
+def add_vary(headers: Headers, header: str):
+    values = headers.getlist("Vary")
+    if header not in values:
+        values.append(header)
+    headers.set("Vary", ", ".join(values))
+
+
+def add_actual_request_headers(headers: Headers) -> Headers:
+    origin = request.headers.get("Origin", None)
+    if origin:
+        headers.set("Access-Control-Allow-Origin", origin)
+        add_vary(headers, "Origin")
+
+        headers.set("Access-Control-Allow-Credentials", "true")
+
+    return headers
+
+
+def is_preflight_request() -> bool:
+    return (
+        request.method == "OPTIONS"
+        and request.headers.get("Access-Control-Request-Method", None) is not None
+    )
+
+
+def is_allowed_cors_route():
+    return (
+        request.path.endswith((".js", ".css", ".woff", ".woff2", ".png", ".jpg", ".jpeg", ".svg"))
+        or request.path.startswith("/api")
+        or request.path.startswith("/oauth")
+    )
+
+
+def add_preflight_request_headers(headers: Headers) -> Headers:
+    origin = request.headers.get("Origin", None)
+    if origin:
+        headers.set("Access-Control-Allow-Origin", origin)
+        add_vary(headers, "Origin")
+
+        headers.set("Access-Control-Allow-Credentials", "true")
+
+        # The API allows all methods, so just copy the browser requested methods from the request headers.
+        headers.set(
+            "Access-Control-Allow-Methods", request.headers.get("Access-Control-Request-Method", "")
+        )
+        add_vary(headers, "Access-Control-Request-Method")
+
+        headers.set(
+            "Access-Control-Allow-Headers",
+            request.headers.get("Access-Control-Request-Headers", ""),
+        )
+        add_vary(headers, "Access-Control-Request-Headers")
+
+    return headers
+
+
+def init_app(app):
+    """
+    The CORS should be enabled before routing to trigger before some redirects.
+
+        For OPTIONS requests, we do not call the backend API code at all.
+    We just return the access-control headers.
+
+    For other requests, we append the access-control headers to the original
+    response.
+
+    This module is inspired by:
+    - the CORS logic https://github.com/fruitcake/php-cors/blob/master/src/CorsService.php
+    - the middleware https://github.com/laravel/framework/blob/11.x/src/Illuminate/Http/Middleware/HandleCors.php
+    """
+
+    @app.before_request
+    def bypass_code_for_options_requests():
+        if not is_allowed_cors_route():
+            return
+
+        if is_preflight_request():
+            headers = add_preflight_request_headers(Headers())
+            return "", 204, headers
+
+    @app.after_request
+    def add_cors_headers(response):
+        if not is_allowed_cors_route():
+            return response
+
+        if request.method == "OPTIONS":
+            add_vary(response.headers, "Access-Control-Request-Method")
+
+        add_actual_request_headers(response.headers)
+
+        return response

udata/db/tasks.py

@@ -1,6 +1,7 @@
 from udata.commands.db import check_references
 from udata.tasks import job
 
-@job('check-integrity')
+
+@job("check-integrity")
 def check_integrity(self):
     check_references()