wbcore 1.59.9__py2.py3-none-any.whl

wbcore/contrib/ai/llm/utils.py

@@ -0,0 +1,69 @@
+from contextlib import suppress
+from typing import Any
+
+from langchain_core.language_models import BaseChatModel
+from langchain_core.messages import SystemMessage
+from langchain_core.messages.base import BaseMessage
+from langchain_core.output_parsers import PydanticOutputParser, StrOutputParser
+from langchain_core.prompts import ChatPromptTemplate
+from langchain_openai import ChatOpenAI
+from pydantic import BaseModel, ValidationError
+
+type Prompt = str | list[BaseMessage] | BaseMessage
+
+
+def _convert_prompt_to_chat_prompt_template(prompt: Prompt, format_instructions=None) -> ChatPromptTemplate:
+    if isinstance(prompt, BaseMessage):
+        prompt = [prompt]
+    if isinstance(prompt, str):
+        prompt = SystemMessage(content=prompt)
+    messages = []
+    for index, msg in enumerate(prompt):
+        content = msg.content
+        if index == 0 and format_instructions:
+            if "{format_instructions}" not in content:
+                content += "\n{format_instructions}"
+        messages.append((msg.type, content))
+    return ChatPromptTemplate.from_messages(messages).partial(format_instructions=format_instructions)
+
+
+def run_llm(
+    prompt: Prompt,
+    output_model: "type[BaseModel] | None" = None,
+    chat_model: type[BaseChatModel] = ChatOpenAI,
+    chat_model_name: str = "gpt-4o-mini",
+    max_tokens: int = 16000,
+    extra_tools: list[dict[str, str]] | None = None,
+    query: dict[str, Any] | None = None,
+    **llm_kwargs,
+) -> tuple[BaseModel | None, BaseMessage]:
+    llm = chat_model(model=chat_model_name, max_tokens=max_tokens, **llm_kwargs)  # type: ignore
+    tools = []
+    if not query:
+        query = {}
+
+    if extra_tools:
+        tools.extend(extra_tools)
+    if output_model:
+        tools.append(output_model)
+    if tools:
+        llm = llm.bind_tools(tools)
+
+    # Set up a parser
+    if output_model:
+        parser = PydanticOutputParser(pydantic_object=output_model)
+    else:
+        parser = StrOutputParser()
+    try:
+        format_instructions = parser.get_format_instructions()
+    except NotImplementedError:
+        format_instructions = None
+    chat_prompt_template = _convert_prompt_to_chat_prompt_template(prompt, format_instructions=format_instructions)
+
+    chain = chat_prompt_template | llm
+
+    response = chain.invoke(query)  # type: ignore
+    if output_model:
+        with suppress(ValidationError, IndexError):
+            return output_model.model_validate(response.tool_calls[0]["args"]), response
+    return None, response

wbcore/contrib/authentication/__init__.py

@@ -0,0 +1,9 @@
+from rest_framework.reverse import reverse
+
+
+def resolve_profile(request):
+    user = request.user
+    return {
+        "image": user.profile.profile_image.url if user.profile.profile_image else None,
+        "endpoint": reverse("wbcore:authentication:userprofile-detail", args=[user.id], request=request),
+    }

wbcore/contrib/authentication/admin.py

@@ -0,0 +1,247 @@
+# -*- encoding: utf-8 -*-
+
+from django.conf import settings
+from django.contrib import admin, messages
+from django.contrib.admin.options import IS_POPUP_VAR
+from django.contrib.admin.utils import unquote
+from django.contrib.auth import update_session_auth_hash
+from django.contrib.auth.forms import (
+    AdminPasswordChangeForm,
+    UserChangeForm,
+    UserCreationForm,
+)
+from django.contrib.auth.models import Permission
+from django.core.exceptions import PermissionDenied
+from django.db import transaction
+from django.http import Http404, HttpResponseRedirect
+from django.template.response import TemplateResponse
+from django.urls import re_path, reverse
+from django.utils.decorators import method_decorator
+from django.utils.encoding import force_str
+from django.utils.html import escape
+from django.utils.translation import gettext_lazy as _
+from django.views.decorators.csrf import csrf_protect
+from django.views.decorators.debug import sensitive_post_parameters
+
+from .models import Token, User, UserActivity
+
+csrf_protect_m = method_decorator(csrf_protect)
+sensitive_post_parameters_m = method_decorator(sensitive_post_parameters())
+
+
+@admin.register(Permission)
+class PermissionAdmin(admin.ModelAdmin):
+    list_display = ("name", "content_type", "codename")
+    search_fields = ("name", "codename")
+
+
+class TokenInline(admin.TabularInline):
+    model = Token
+    fields = (
+        "key",
+        "valid_until",
+        "protected_view_name",
+        "number_usage_left",
+        "is_valid",
+    )
+    readonly_fields = ("key", "user")
+    extra = 0
+    raw_id_fields = ["user"]
+    show_change_link = True
+
+
+admin.site.register(UserActivity)
+
+
+@admin.register(Token)
+class TokenAdmin(admin.ModelAdmin):
+    search_fields = ("key", "user__username", "user__email")
+
+    list_display = (
+        "user",
+        "key",
+        "valid_until",
+        "protected_view_name",
+        "number_usage_left",
+        "is_valid",
+    )
+
+
+@admin.register(User)
+class UserAdmin(admin.ModelAdmin):
+    # add_form_template = 'admin/auth/user/add_form.html'
+    change_user_password_template = None
+    fieldsets = (
+        (_("Main information"), {"fields": ("email", "username", "password", "profile")}),
+        (_("Synchronization"), {"fields": ("metadata",)}),
+        (
+            _("Permissions"),
+            {"fields": ("is_active", "is_register", "is_staff", "is_superuser", "groups", "user_permissions")},
+        ),
+    )
+    raw_id_fields = ("profile",)
+    add_fieldsets = (
+        (
+            None,
+            {
+                "classes": ("wide",),
+                "fields": ("email", "username", "password1", "password2"),
+            },
+        ),
+    )
+    form = UserChangeForm
+    add_form = UserCreationForm
+    change_password_form = AdminPasswordChangeForm
+
+    list_display = ("email", "username", "uuid", "is_staff", "is_active", "is_register")
+    list_filter = ("is_staff", "is_superuser", "is_active", "groups")
+    search_fields = ("email", "username")
+    ordering = ("email",)
+    filter_horizontal = (
+        "groups",
+        "user_permissions",
+    )
+
+    def get_fieldsets(self, request, obj=None):
+        if not obj:
+            return self.add_fieldsets
+        return super(UserAdmin, self).get_fieldsets(request, obj)
+
+    def get_form(self, request, obj=None, **kwargs):
+        """
+        Use special form during user creation
+        """
+        defaults = {}
+        if obj is None:
+            defaults["form"] = self.add_form
+        defaults.update(kwargs)
+        return super(UserAdmin, self).get_form(request, obj, **defaults)
+
+    def get_urls(self):
+        return [
+            re_path(
+                r"^(.+)/password/$",
+                self.admin_site.admin_view(self.user_change_password),
+                name="auth_user_password_change",
+            ),
+        ] + super(UserAdmin, self).get_urls()
+
+    def lookup_allowed(self, lookup, value):
+        # See #20078: we don't want to allow any lookups involving passwords.
+        if lookup.startswith("password"):
+            return False
+        return super(UserAdmin, self).lookup_allowed(lookup, value)
+
+    @sensitive_post_parameters_m
+    @csrf_protect_m
+    @transaction.atomic
+    def add_view(self, request, form_url="", extra_context=None):
+        # It's an error for a user to have add permission but NOT change
+        # permission for users. If we allowed such users to add users, they
+        # could create superusers, which would mean they would essentially have
+        # the permission to change users. To avoid the problem entirely, we
+        # disallow users from adding users if they don't have change
+        # permission.
+        if not self.has_change_permission(request):
+            if self.has_add_permission(request) and settings.DEBUG:
+                # Raise Http404 in debug mode so that the user gets a helpful
+                # error message.
+                raise Http404(
+                    _(
+                        'Your user does not have the "Change user" permission. In '
+                        "order to add users, Django requires that your user "
+                        'account have both the "Add user" and "Change user" '
+                        "permissions set."
+                    )
+                )
+            raise PermissionDenied
+        if extra_context is None:
+            extra_context = {}
+        username_field = self.model._meta.get_field(self.model.USERNAME_FIELD)
+        defaults = {
+            "auto_populated_fields": (),
+            "username_help_text": username_field.help_text,
+        }
+        extra_context.update(defaults)
+        return super(UserAdmin, self).add_view(request, form_url, extra_context)
+
+    @sensitive_post_parameters_m
+    def user_change_password(self, request, id, form_url=""):
+        if not self.has_change_permission(request):
+            raise PermissionDenied
+        user = self.get_object(request, unquote(id))
+        if user is None:
+            raise Http404(
+                _("%(name)s object with primary key %(key)r does not exist.")
+                % {
+                    "name": force_str(self.model._meta.verbose_name),
+                    "key": escape(id),
+                }
+            )
+        if request.method == "POST":
+            form = self.change_password_form(user, request.POST)
+            if form.is_valid():
+                form.save()
+                change_message = self.construct_change_message(request, form, None)
+                self.log_change(request, user, change_message)
+                msg = _("Password changed successfully.")
+                messages.success(request, msg)
+                update_session_auth_hash(request, form.user)
+                return HttpResponseRedirect(
+                    reverse(
+                        "%s:%s_%s_change"
+                        % (
+                            self.admin_site.name,
+                            user._meta.app_label,
+                            user._meta.model_name,
+                        ),
+                        args=(user.pk,),
+                    )
+                )
+        else:
+            form = self.change_password_form(user)
+
+        fieldsets = [(None, {"fields": list(form.base_fields)})]
+        admin_form = admin.helpers.AdminForm(form, fieldsets, {})
+
+        context = {
+            "title": _("Change password: %s") % escape(user.get_username()),
+            "adminForm": admin_form,
+            "form_url": form_url,
+            "form": form,
+            "is_popup": (IS_POPUP_VAR in request.POST or IS_POPUP_VAR in request.GET),
+            "add": True,
+            "change": False,
+            "has_delete_permission": False,
+            "has_change_permission": True,
+            "has_absolute_url": False,
+            "opts": self.model._meta,
+            "original": user,
+            "save_as": False,
+            "show_save": True,
+        }
+        context.update(self.admin_site.each_context(request))
+
+        request.current_app = self.admin_site.name
+
+        return TemplateResponse(
+            request,
+            self.change_user_password_template or "admin/auth/user/change_password.html",
+            context,
+        )
+
+    def response_add(self, request, obj, post_url_continue=None):
+        """
+        Determines the HttpResponse for the add_view stage. It mostly defers to
+        its superclass implementation but is customized because the User model
+        has a slightly different workflow.
+        """
+        # We should allow further modification of the user just added i.e. the
+        # 'Save' button should behave like the 'Save and continue editing'
+        # button except in two scenarios:
+        # * The user has pressed the 'Save and add another' button
+        # * We are adding a user in a popup
+        if "_addanother" not in request.POST and IS_POPUP_VAR not in request.POST:
+            request.POST = request.POST.copy()
+            request.POST["_continue"] = 1
+        return super(UserAdmin, self).response_add(request, obj, post_url_continue)

wbcore/contrib/authentication/apps.py

@@ -0,0 +1,14 @@
+from django.apps import AppConfig
+from django.db.models.signals import post_migrate
+
+
+class AuthenticationConfig(AppConfig):
+    name = "wbcore.contrib.authentication"
+
+    def ready(self):
+        from wbcore.contrib.authentication.management import initialize_task
+
+        post_migrate.connect(
+            initialize_task,
+            dispatch_uid="wbcore.contrib.authentication.initialize_task",
+        )

wbcore/contrib/authentication/authentication.py

@@ -0,0 +1,111 @@
+import functools
+from typing import TYPE_CHECKING
+
+from django.conf import settings
+from django.utils import timezone
+from rest_framework import HTTP_HEADER_ENCODING
+from rest_framework.authentication import TokenAuthentication as DRFTokenAuthentication
+from rest_framework.request import Request
+from rest_framework_simplejwt.authentication import JWTAuthentication
+from rest_framework_simplejwt.settings import api_settings
+
+from .models import Token
+
+AUTH_HEADER_TYPES = api_settings.AUTH_HEADER_TYPES
+
+if TYPE_CHECKING:
+    from wbcore.contrib.authentication.models import User
+else:
+    from django.contrib.auth import get_user_model
+
+    User = get_user_model()
+
+
+class TokenAuthentication(DRFTokenAuthentication):
+    """
+    Short lived Token token based authentication.
+
+    Clients should authenticate by passing the token key in the "Authorization"
+    HTTP header, prepended with the string "Token ".  For example:
+
+        Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a
+    """
+
+    model = Token
+
+    # TODO: Find a way to improve typing in the next two methods, somehow pyright is not picking up self.model
+    def authenticate_credentials(self, key) -> tuple[User, Token]:
+        return super().authenticate_credentials(key)  # type: ignore
+
+    def authenticate(self, request) -> tuple[User, Token] | None:
+        authentication_res = super().authenticate(request)
+        if authentication_res:
+            authentication_res[1].check_validity_for_endpoint(request.resolver_match.view_name, timezone.now())  # type: ignore
+        return authentication_res  # type: ignore
+
+
+class QueryTokenAuthentication(TokenAuthentication):
+    """
+    Short lived Token token based authentication through query parameters.
+
+    Clients should authenticate by passing the token key "token" as query parameters. For example:
+        ?token=401f7ac837da42b97f613d789819ff93537bee6a
+    Note, this is unsafe to use this authentication backend on unsecured connection
+    """
+
+    query_param_name = "token"
+
+    # TODO: Find a way to improve typing in the next method, somehow pyright is not picking up self.model
+    def authenticate(self, request) -> tuple[User, Token] | None:
+        token = request.query_params.get(self.query_param_name)
+        if not token:
+            return None
+        user, token = self.authenticate_credentials(token)
+        token.check_validity_for_endpoint(request.resolver_match.view_name, timezone.now())
+        return user, token  # type: ignore
+
+
+class JWTCookieAuthentication(JWTAuthentication):
+    def get_header(self, request: Request) -> bytes:
+        if cookie_token := request.COOKIES.get(settings.JWT_COOKIE_KEY, None):
+            return f"{AUTH_HEADER_TYPES[0]} {cookie_token}".encode(HTTP_HEADER_ENCODING)
+        return super().get_header(request)
+
+
+def inject_short_lived_token(view_name: str | None = None):
+    """
+    Decorator to wrap around additional resource function which return key value pair of resources and endpoint.
+    The decorator will create for the user a short lived token only valid for the requested endpoint and inject it as query parameters
+
+    The decorator expects a view_name (namespace:view_name) to be given otherwise, it will guess it from the resource endpoint (through the resolver)
+    Args:
+        view_name: Optional, view name to use instead of resolved the endpoint view name
+    """
+
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(serializer, instance, request, user, **kwargs):
+            res = {}
+            if view_name is None:
+                return res
+            for key, endpoint in func(serializer, instance, request, user, **kwargs).items():
+                res[key] = Token.generate_shareable_link(endpoint, user, protected_view_name=view_name)
+            return res
+
+        return wrapper
+
+    return decorator
+
+
+def unauthenticated(request: "Request") -> dict[str, None]:
+    return {"type": None}
+
+
+def get_dev_user_from_settings(username_field_key: str) -> list[dict[str, str]]:
+    if dev_user := getattr(settings, "DEV_USERS", []):
+        users = list()
+        for user in dev_user:
+            username, password = user.split(":")
+            users.append({username_field_key: username, "password": password})
+        return users
+    return []

wbcore/contrib/authentication/configs.py

@@ -0,0 +1,10 @@
+from django.conf import settings
+from django.utils.module_loading import import_string
+from rest_framework.request import Request
+
+from wbcore.configs.decorators import register_config
+
+
+@register_config
+def authentication_config(request: Request) -> tuple[str, dict]:
+    return "authentication", import_string(settings.WBCORE_DEFAULT_AUTH_CONFIG)(request)

wbcore/contrib/authentication/configurations.py

@@ -0,0 +1,60 @@
+import os
+from datetime import timedelta
+from typing import Dict
+
+from configurations import values
+from django.conf import settings
+from rest_framework.request import Request
+from rest_framework.reverse import reverse
+
+
+class AuthenticationConfigurationMixin:
+    WBCORE_DEFAULT_USER_NAME = "wbcore.contrib.authentication.configurations.get_user_name"
+    WBCORE_DEFAULT_AUTH_CONFIG = "wbcore.contrib.authentication.configurations.auth_method"
+    AUTH_USER_MODEL = "authentication.User"
+    DEFAULT_FROM_EMAIL = values.Value("no-reply@stainly-bench.com", environ_prefix=None)
+
+
+def resolve_profile(request: Request) -> Dict:
+    """Returns two endpoints, one for the profile image and one for the profile widget"""
+
+    return {
+        "image": "https://image.freepik.com/free-vector/businessman-profile-cartoon_18591-58479.jpg",
+        "endpoint": reverse("wbcore:authentication:userprofile-detail", args=[request.user.id], request=request),
+    }
+
+
+def auth_method(request):
+    from wbcore.contrib.authentication.authentication import get_dev_user_from_settings
+
+    access = settings.SIMPLE_JWT.get("ACCESS_TOKEN_LIFETIME", timedelta(minutes=5))
+    refresh = settings.SIMPLE_JWT.get("REFRESH_TOKEN_LIFETIME", timedelta(days=1))
+
+    config = {
+        "type": "JWT",
+        "config": {
+            "token": reverse("wbcore:authentication:token_obtain_pair", request=request),
+            "refresh": reverse("wbcore:authentication:token_refresh", request=request),
+            "verify": reverse("wbcore:authentication:token_verify", request=request),
+            "token_lifetime": {"access": access, "refresh": refresh},
+            "username_field_key": "email",
+            "username_field_label": "E-Mail",
+            "cookie_key": settings.JWT_COOKIE_KEY,
+        },
+    }
+    if users := get_dev_user_from_settings("email"):
+        config["dev_users"] = users
+
+    if "WB_SHOW_RESET_PASSWORD" in os.environ:
+        config["config"]["reset_password"] = {
+            "endpoint": reverse("wbcore:authentication:reset_password_email", request=request),
+            "method": "post",
+            "key": "email",
+            "success_message": "An e-mail has been sent to your address with instructions to reset your password.",
+        }
+
+    return config
+
+
+def get_user_name(user):
+    return f"{user.profile.first_name} {user.profile.last_name}"

wbcore/contrib/authentication/dynamic_preferences_registry.py

@@ -0,0 +1,26 @@
+from django.utils.translation import gettext_lazy as _
+from dynamic_preferences.preferences import Section
+from dynamic_preferences.registries import global_preferences_registry
+from dynamic_preferences.types import IntegerPreference
+
+authentication = Section("authentication")
+
+
+@global_preferences_registry.register
+class HoursBeforeDeletingUnregisteredAccountPreference(IntegerPreference):
+    section = authentication
+    name = "hours_before_deleting_unregistered_account"
+    default = 48
+
+    verbose_name = _("Immunity Period")
+    help_text = _("Set the maximum number of hours a user can remain without registration")
+
+
+@global_preferences_registry.register
+class DefaultTokenValidityInHoursPreference(IntegerPreference):
+    section = authentication
+    name = "default_token_validity_in_hours"
+    default = 24
+
+    verbose_name = _("Default Token Validity (in Hours)")
+    help_text = _("If not specified, a newly created token will be valid for that amount of hours")

wbcore/contrib/authentication/factories/__init__.py

@@ -0,0 +1,10 @@
+from .tokens import TokenFactory
+from .users import (
+    AuthenticatedPersonFactory,
+    GroupFactory,
+    PermissionFactory,
+    SuperUserFactory,
+    UserFactory,
+    InternalUserFactory,
+)
+from .users_activities import UserActivityFactory

wbcore/contrib/authentication/factories/tokens.py

@@ -0,0 +1,15 @@
+import factory
+
+from ..models import Token
+
+
+class TokenFactory(factory.django.DjangoModelFactory):
+    valid_until = None
+    protected_view_name = "wbcore:authentication:user"
+    number_usage_left = None
+    is_valid = True
+    user = factory.SubFactory("wbcore.contrib.authentication.factories.UserFactory")
+
+    class Meta:
+        model = Token
+        django_get_or_create = ["user", "protected_view_name"]