wbcore 2.2.1__py2.py3-none-any.whl

wbcore/contrib/authentication/authentication.py

@@ -0,0 +1,162 @@
+import functools
+from datetime import timedelta
+from typing import TYPE_CHECKING
+
+from django.conf import settings
+from django.utils import timezone
+from jwt import decode as jwt_decode
+from rest_framework.authentication import BaseAuthentication
+from rest_framework.authentication import TokenAuthentication as DRFTokenAuthentication
+from rest_framework.exceptions import AuthenticationFailed
+from rest_framework.request import Request
+from rest_framework.reverse import reverse
+from rest_framework_simplejwt.exceptions import InvalidToken, TokenError
+from rest_framework_simplejwt.tokens import UntypedToken
+
+from .models import Token
+
+if TYPE_CHECKING:
+    from wbcore.contrib.authentication.models import User
+else:
+    from django.contrib.auth import get_user_model
+
+    User = get_user_model()
+
+
+class TokenAuthentication(DRFTokenAuthentication):
+    """
+    Short lived Token token based authentication.
+
+    Clients should authenticate by passing the token key in the "Authorization"
+    HTTP header, prepended with the string "Token ".  For example:
+
+        Authorization: Token 401f7ac837da42b97f613d789819ff93537bee6a
+    """
+
+    model = Token
+
+    # TODO: Find a way to improve typing in the next two methods, somehow pyright is not picking up self.model
+    def authenticate_credentials(self, key) -> tuple[User, Token]:
+        return super().authenticate_credentials(key)  # type: ignore
+
+    def authenticate(self, request) -> tuple[User, Token] | None:
+        authentication_res = super().authenticate(request)
+        if authentication_res:
+            authentication_res[1].check_validity_for_endpoint(request.resolver_match.view_name, timezone.now())  # type: ignore
+        return authentication_res  # type: ignore
+
+
+class QueryTokenAuthentication(TokenAuthentication):
+    """
+    Short lived Token token based authentication through query parameters.
+
+    Clients should authenticate by passing the token key "token" as query parameters. For example:
+        ?token=401f7ac837da42b97f613d789819ff93537bee6a
+    Note, this is unsafe to use this authentication backend on unsecured connection
+    """
+
+    query_param_name = "token"
+
+    # TODO: Find a way to improve typing in the next method, somehow pyright is not picking up self.model
+    def authenticate(self, request) -> tuple[User, Token] | None:
+        token = request.query_params.get(self.query_param_name)
+        if not token:
+            return None
+        user, token = self.authenticate_credentials(token)
+        token.check_validity_for_endpoint(request.resolver_match.view_name, timezone.now())
+        return user, token  # type: ignore
+
+
+class JWTCookieAuthentication(BaseAuthentication):
+    def authenticate(self, request: "Request") -> tuple[User, UntypedToken] | None:
+        jwt_access_token = None
+        if cookie_token := request.COOKIES.get("JWT-access", None):
+            jwt_access_token = cookie_token
+        elif (header_token := request._request.headers.get("Authorization", None)) and (
+            len(header_token.split(" ")) == 2
+        ):
+            jwt_access_token = header_token.split(" ")[1]
+        if not jwt_access_token:
+            return None
+        try:
+            token = UntypedToken(jwt_access_token)  # type: ignore -- the 3rd party dependency has a wrong type hint
+            decoded_data = jwt_decode(jwt_access_token, settings.SECRET_KEY, algorithms=["HS256"])
+            user = User.objects.get(id=decoded_data["user_id"])
+            return (user, token)
+        except (
+            InvalidToken,
+            TokenError,
+            KeyError,
+            User.DoesNotExist,
+            UnboundLocalError,
+        ):
+            raise AuthenticationFailed("Invalid token")
+
+
+def inject_short_lived_token(view_name: str | None = None):
+    """
+    Decorator to wrap around additional resource function which return key value pair of resources and endpoint.
+    The decorator will create for the user a short lived token only valid for the requested endpoint and inject it as query parameters
+
+    The decorator expects a view_name (namespace:view_name) to be given otherwise, it will guess it from the resource endpoint (through the resolver)
+    Args:
+        view_name: Optional, view name to use instead of resolved the endpoint view name
+    """
+
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(serializer, instance, request, user, **kwargs):
+            res = {}
+            if view_name is None:
+                return res
+            for key, endpoint in func(serializer, instance, request, user, **kwargs).items():
+                res[key] = Token.generate_shareable_link(endpoint, user, protected_view_name=view_name)
+            return res
+
+        return wrapper
+
+    return decorator
+
+
+def unauthenticated(request: "Request") -> dict[str, None]:
+    return {"type": None}
+
+
+def get_user_name(user: User) -> str:
+    if method := getattr(user, "get_full_name", None):
+        return method()
+    return f"{user.first_name} {user.last_name}"
+
+
+def get_dev_user_from_settings(username_field_key: str) -> list[dict[str, str]]:
+    if dev_user := getattr(settings, "DEV_USERS", []):
+        users = list()
+        for user in dev_user:
+            username, password = user.split(":")
+            users.append({username_field_key: username, "password": password})
+        return users
+    return []
+
+
+def jwt_auth(request: Request) -> dict:
+    username_field_key = User.USERNAME_FIELD
+    username_field_label = User._meta.get_field(username_field_key).verbose_name
+
+    access = settings.SIMPLE_JWT.get("ACCESS_TOKEN_LIFETIME", timedelta(minutes=5))
+    refresh = settings.SIMPLE_JWT.get("REFRESH_TOKEN_LIFETIME", timedelta(days=1))
+
+    config = {
+        "type": "JWT",
+        "config": {
+            "token": reverse("token_obtain_pair", request=request),
+            "refresh": reverse("token_refresh", request=request),
+            "verify": reverse("token_verify", request=request),
+            "token_lifetime": {"access": access, "refresh": refresh},
+            "username_field_key": username_field_key,
+            "username_field_label": username_field_label,
+        },
+    }
+
+    if users := get_dev_user_from_settings(username_field_key):
+        config["dev_users"] = users
+    return config

wbcore/contrib/authentication/configs.py

@@ -0,0 +1,9 @@
+from django.conf import settings
+from django.utils.module_loading import import_string
+from rest_framework.request import Request
+from wbcore.configs.decorators import register_config
+
+
+@register_config
+def authentication_config(request: Request) -> tuple[str, dict]:
+    return "authentication", import_string(settings.WBCORE_DEFAULT_AUTH_CONFIG)(request)

wbcore/contrib/authentication/configurations.py

@@ -0,0 +1,53 @@
+import os
+from typing import Dict
+
+from configurations import values
+from rest_framework.request import Request
+from rest_framework.reverse import reverse
+
+
+class AuthenticationConfigurationMixin:
+    WBCORE_DEFAULT_USER_NAME = "wbcore.contrib.authentication.configurations.get_user_name"
+    WBCORE_DEFAULT_AUTH_CONFIG = "wbcore.contrib.authentication.configurations.auth_method"
+    AUTH_USER_MODEL = "authentication.User"
+    DEFAULT_FROM_EMAIL = values.Value("no-reply@stainly-bench.com", environ_prefix=None)
+
+
+def resolve_profile(request: Request) -> Dict:
+    """Returns two endpoints, one for the profile image and one for the profile widget"""
+
+    return {
+        "image": "https://image.freepik.com/free-vector/businessman-profile-cartoon_18591-58479.jpg",
+        "endpoint": reverse("wbcore:authentication:userprofile-detail", args=[request.user.id], request=request),
+    }
+
+
+def auth_method(request):
+    from wbcore.contrib.authentication.authentication import get_dev_user_from_settings
+
+    config = {
+        "type": "JWT",
+        "config": {
+            "token": reverse("wbcore:authentication:token_obtain_pair", request=request),
+            "refresh": reverse("wbcore:authentication:token_refresh", request=request),
+            "verify": reverse("wbcore:authentication:token_verify", request=request),
+            "username_field_key": "email",
+            "username_field_label": "E-Mail",
+        },
+    }
+    if users := get_dev_user_from_settings("email"):
+        config["dev_users"] = users
+
+    if "WB_SHOW_RESET_PASSWORD" in os.environ:
+        config["config"]["reset_password"] = {
+            "endpoint": reverse("wbcore:authentication:reset_password_email", request=request),
+            "method": "post",
+            "key": "email",
+            "success_message": "An e-mail has been sent to your address with instructions to reset your password.",
+        }
+
+    return config
+
+
+def get_user_name(user):
+    return f"{user.profile.first_name} {user.profile.last_name}"

wbcore/contrib/authentication/dynamic_preferences_registry.py

@@ -0,0 +1,26 @@
+from django.utils.translation import gettext_lazy as _
+from dynamic_preferences.preferences import Section
+from dynamic_preferences.registries import global_preferences_registry
+from dynamic_preferences.types import IntegerPreference
+
+authentication = Section("authentication")
+
+
+@global_preferences_registry.register
+class HoursBeforeDeletingUnregisteredAccountPreference(IntegerPreference):
+    section = authentication
+    name = "hours_before_deleting_unregistered_account"
+    default = 48
+
+    verbose_name = _("Immunity Period")
+    help_text = _("Set the maximum number of hours a user can remain without registration")
+
+
+@global_preferences_registry.register
+class DefaultTokenValidityInHoursPreference(IntegerPreference):
+    section = authentication
+    name = "default_token_validity_in_hours"
+    default = 24
+
+    verbose_name = _("Default Token Validity (in Hours)")
+    help_text = _("If not specified, a newly created token will be valid for that amount of hours")

wbcore/contrib/authentication/factories/__init__.py

@@ -0,0 +1,3 @@
+from .tokens import TokenFactory
+from .users import AuthenticatedPersonFactory, GroupFactory, SuperUserFactory, UserFactory, InternalUserFactory
+from .users_activities import UserActivityFactory

wbcore/contrib/authentication/factories/tokens.py

@@ -0,0 +1,15 @@
+import factory
+
+from ..models import Token
+
+
+class TokenFactory(factory.django.DjangoModelFactory):
+    valid_until = None
+    protected_view_name = "wbcore:authentication:user"
+    number_usage_left = None
+    is_valid = True
+    user = factory.SubFactory("wbcore.contrib.authentication.factories.UserFactory")
+
+    class Meta:
+        model = Token
+        django_get_or_create = ["user", "protected_view_name"]

wbcore/contrib/authentication/factories/users.py

@@ -0,0 +1,82 @@
+import factory
+from django.contrib.auth.models import Permission
+from dynamic_preferences.registries import global_preferences_registry
+from wbcore.contrib.directory.factories import CompanyFactory, PersonFactory
+from wbcore.contrib.directory.models import Company
+from wbcore.permissions.registry import user_registry
+
+from ..models import Group, User
+
+
+class UserFactory(factory.django.DjangoModelFactory):
+    class Meta:
+        model = User
+        django_get_or_create = ["email"]
+
+    email = factory.Sequence(lambda n: "email%d@admin.com" % n)
+    # username = factory.Faker('user_name')
+    username = factory.Sequence(lambda n: "user%d" % n)
+
+    profile = factory.SubFactory("wbcore.contrib.directory.factories.entries.PersonFactory")
+    is_active = True
+    is_register = True
+    is_superuser = False
+
+    plaintext_password = factory.PostGenerationMethodCall("set_password", "defaultpassword")
+
+    @factory.post_generation
+    def user_permissions(self, create, extracted, **kwargs):
+        if not create or not extracted:
+            return
+        for permission_key in extracted:
+            app_label, codename = permission_key.split(".")
+            permission = Permission.objects.get(codename=codename, content_type__app_label=app_label)
+            self.user_permissions.add(permission)
+
+    @factory.post_generation
+    def groups(self, create, extracted, **kwargs):
+        if not create or not extracted:
+            return
+        for group in extracted:
+            self.groups.add(group)
+
+
+class InternalUserFactory(UserFactory):
+    @factory.post_generation
+    def add_internal_profile(self, create, extracted, **kwargs):
+        main_company_id = global_preferences_registry.manager()["directory__main_company"]
+        if main_company_id and Company.objects.filter(id=main_company_id).exists():
+            self.profile.employers.add(Company.objects.get(id=main_company_id))
+        else:
+            # Create company
+            company = CompanyFactory()
+            # Set global config main_company=company.id
+            global_preferences_registry.manager()["directory__main_company"] = company.id
+            self.profile.employers.add(company)
+        self.user_permissions.add(
+            Permission.objects.get(content_type__app_label="authentication", codename="is_internal_user")
+        )
+        user_registry.reset_cache()
+
+
+class SuperUserFactory(UserFactory):
+    is_superuser = True
+    profile = None
+
+
+class AuthenticatedPersonFactory(PersonFactory):
+    user_account = factory.RelatedFactory(UserFactory, "profile")
+
+
+class GroupFactory(factory.django.DjangoModelFactory):
+    name = factory.Faker("text", max_nb_chars=150)
+
+    @factory.post_generation
+    def permissions(self, create, extracted, **kwargs):
+        if not create or not extracted:
+            return
+        for permission in extracted:
+            self.permissions.add(permission)
+
+    class Meta:
+        model = Group

wbcore/contrib/authentication/factories/users_activities.py

@@ -0,0 +1,19 @@
+import factory
+import pytz
+
+from ..models import UserActivity
+from .users import UserFactory
+
+
+class UserActivityFactory(factory.django.DjangoModelFactory):
+    class Meta:
+        model = UserActivity
+
+    IP = factory.Faker("ipv4")
+    date = factory.Faker("date_time", tzinfo=pytz.utc)
+    user = factory.SubFactory(UserFactory)
+    # status
+    # jti
+    # type
+    user_agent_info = factory.Faker("sentences")
+    latest_refresh = factory.Faker("date_time", tzinfo=pytz.utc)

wbcore/contrib/authentication/filters.py

@@ -0,0 +1,18 @@
+from wbcore import filters as wb_filters
+from wbcore.filters.defaults import current_month_date_range
+
+from .models import UserActivity
+
+
+class UserActivityChartFilter(wb_filters.FilterSet):
+    date = wb_filters.DateTimeRangeFilter(
+        method=wb_filters.DateRangeFilter.base_date_range_filter_method,
+        label="Date Range",
+        required=True,
+        clearable=False,
+        default=current_month_date_range,
+    )
+
+    class Meta:
+        model = UserActivity
+        fields = {}

wbcore/contrib/authentication/management/__init__.py

@@ -0,0 +1,14 @@
+from django_celery_beat.models import IntervalSchedule, PeriodicTask
+from django.db import DEFAULT_DB_ALIAS
+from django.apps import apps as global_apps
+
+
+def initialize_task(app_config, verbosity=2, interactive=True, using=DEFAULT_DB_ALIAS, apps=global_apps, **kwargs):
+    PeriodicTask.objects.update_or_create(
+        task="wbcore.contrib.authentication.tasks.delete_unregistered_user_account",
+        defaults={
+            "name": "Authentication: Delete ghost user accounts",
+            "interval": IntervalSchedule.objects.get_or_create(every=1, period=IntervalSchedule.DAYS)[0],
+            "crontab": None,
+        },
+    )

wbcore/contrib/authentication/migrations/0001_initial_squashed.py

@@ -0,0 +1,174 @@
+# Generated by Django 4.1.8 on 2023-04-13 10:33
+
+import uuid
+
+import django.contrib.auth.models
+import django.db.models.deletion
+import django.utils.timezone
+import wbcore.contrib.authentication.models
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        ("auth", "0012_alter_user_first_name_max_length"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="User",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID"),
+                ),
+                ("password", models.CharField(max_length=128, verbose_name="password")),
+                ("last_login", models.DateTimeField(blank=True, null=True, verbose_name="last login")),
+                (
+                    "is_superuser",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Designates that this user has all permissions without explicitly assigning them.",
+                        verbose_name="superuser status",
+                    ),
+                ),
+                ("uuid", models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ("email", models.EmailField(max_length=254, unique=True, verbose_name="E-Mail")),
+                ("username", models.CharField(max_length=255, unique=True, verbose_name="username")),
+                (
+                    "is_staff",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Specifies whether the user can log into this admin site.",
+                        verbose_name="staff status",
+                    ),
+                ),
+                (
+                    "is_active",
+                    models.BooleanField(
+                        default=False,
+                        help_text="Specifies whether this user should be treated as active. Unselect this instead of deleting accounts.",
+                        verbose_name="active",
+                    ),
+                ),
+                (
+                    "is_register",
+                    models.BooleanField(
+                        default=True,
+                        help_text="Specifies whether this user has registered its email. ",
+                        verbose_name="register",
+                    ),
+                ),
+                (
+                    "date_joined",
+                    models.DateTimeField(default=django.utils.timezone.now, verbose_name="date joined"),
+                ),
+                (
+                    "groups",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
+                        related_name="user_set",
+                        related_query_name="user",
+                        to="auth.group",
+                        verbose_name="groups",
+                    ),
+                ),
+                (
+                    "user_permissions",
+                    models.ManyToManyField(
+                        blank=True,
+                        help_text="Specific permissions for this user.",
+                        related_name="user_set",
+                        related_query_name="user",
+                        to="auth.permission",
+                        verbose_name="user permissions",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "user",
+                "verbose_name_plural": "users",
+                "permissions": [
+                    ("administrate_user", "Administrate Users"),
+                    ("is_internal_user", "Internal User"),
+                ],
+                "swappable": "AUTH_USER_MODEL",
+            },
+            managers=[
+                ("objects", wbcore.contrib.authentication.models.UserManager()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="Group",
+            fields=[],
+            options={
+                "proxy": True,
+                "indexes": [],
+                "constraints": [],
+            },
+            bases=("auth.group",),
+            managers=[
+                ("objects", django.contrib.auth.models.GroupManager()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="Permission",
+            fields=[],
+            options={
+                "proxy": True,
+                "indexes": [],
+                "constraints": [],
+            },
+            bases=("auth.permission",),
+            managers=[
+                ("objects", django.contrib.auth.models.PermissionManager()),
+            ],
+        ),
+        migrations.CreateModel(
+            name="UserActivity",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name="ID"),
+                ),
+                ("IP", models.GenericIPAddressField(blank=True, null=True)),
+                ("date", models.DateTimeField(auto_now_add=True)),
+                (
+                    "status",
+                    models.CharField(
+                        blank=True,
+                        choices=[("Success", "Success"), ("Failed", "Failed")],
+                        default="Success",
+                        max_length=8,
+                        null=True,
+                    ),
+                ),
+                ("jti", models.CharField(blank=True, default="", max_length=32)),
+                (
+                    "type",
+                    models.CharField(
+                        blank=True, choices=[("LOGIN", "Login")], default="LOGIN", max_length=16, null=True
+                    ),
+                ),
+                ("user_agent_info", models.CharField(max_length=255)),
+                ("latest_refresh", models.DateTimeField(blank=True, null=True)),
+                (
+                    "user",
+                    models.ForeignKey(
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="login_activities",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "User Login Activity",
+                "verbose_name_plural": "User Login Activities",
+            },
+        ),
+    ]

wbcore/contrib/authentication/migrations/0002_profile.py

@@ -0,0 +1,26 @@
+# Generated by Django 4.1.8 on 2023-04-13 10:33
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("directory", "0001_initial"),
+        ("authentication", "0001_initial_squashed"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="profile",
+            field=models.OneToOneField(
+                blank=True,
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                related_name="user_account",
+                to="directory.person",
+            ),
+        )
+    ]

wbcore/contrib/authentication/migrations/0003_alter_user_profile.py

@@ -0,0 +1,34 @@
+# Generated by Django 4.1.8 on 2023-04-17 07:22
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+def migrate_script(apps, schema_editor):
+    User = apps.get_model("authentication", "User")
+    from wbcore.contrib.directory.models import Person
+
+    for user in User.objects.filter(profile__isnull=True):
+        user.profile_id = Person.get_or_create_with_user(user).id
+        user.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("directory", "0002_auto_20230414_1553"),
+        ("authentication", "0002_profile"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="user",
+            name="profile",
+            field=models.OneToOneField(
+                default=None,
+                on_delete=django.db.models.deletion.PROTECT,
+                related_name="user_account",
+                to="directory.person",
+            ),
+            preserve_default=False,
+        ),
+    ]