wbcore 2.2.1__py2.py3-none-any.whl

wbcore/contrib/authentication/migrations/0004_token.py

@@ -0,0 +1,51 @@
+# Generated by Django 4.1.8 on 2023-04-20 13:09
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentication", "0003_alter_user_profile"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="Token",
+            fields=[
+                ("key", models.CharField(max_length=40, primary_key=True, serialize=False, verbose_name="Key")),
+                ("created", models.DateTimeField(auto_now_add=True, verbose_name="Created")),
+                ("valid_until", models.DateTimeField(blank=True, null=True, verbose_name="Valid Until")),
+                (
+                    "protected_view_name",
+                    models.CharField(
+                        blank=True,
+                        help_text="If specified, only view that revert to this viewname will accept this token",
+                        max_length=256,
+                        null=True,
+                        verbose_name="Protected View-Name",
+                    ),
+                ),
+                (
+                    "number_usage_left",
+                    models.PositiveIntegerField(blank=True, null=True, verbose_name="Number of allowed usage"),
+                ),
+                ("is_valid", models.BooleanField(default=True, verbose_name="Is Valid")),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="auth_tokens",
+                        to=settings.AUTH_USER_MODEL,
+                        verbose_name="User",
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Token",
+                "verbose_name_plural": "Tokens",
+                "unique_together": {("user", "protected_view_name")},
+            },
+        ),
+    ]

wbcore/contrib/authentication/migrations/0005_user_external_calendar_settings.py

@@ -0,0 +1,17 @@
+# Generated by Django 4.1 on 2022-10-04 06:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authentication", "0004_token"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="user",
+            name="metadata",
+            field=models.JSONField(blank=True, default=dict),
+        ),
+    ]

wbcore/contrib/authentication/migrations/0006_auto_20231206_1422.py

@@ -0,0 +1,13 @@
+# Generated by Django 4.2.7 on 2023-12-06 13:22
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ("authentication", "0005_user_external_calendar_settings"),
+    ]
+
+    operations = []

wbcore/contrib/authentication/models/__init__.py

@@ -0,0 +1,3 @@
+from .tokens import Token
+from .users import Group, Permission, User, UserManager
+from .users_activities import UserActivity

wbcore/contrib/authentication/models/tokens.py

@@ -0,0 +1,140 @@
+import urllib
+from datetime import datetime, timedelta
+
+from django.conf import settings
+from django.db import models
+from django.urls import resolve
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+from dynamic_preferences.models import global_preferences_registry
+from rest_framework import exceptions
+from rest_framework.authtoken.models import Token as DRFToken
+
+from .users import User
+
+
+class Token(DRFToken):
+    """
+    Short-Lived and short-usage Token to be used as DRF token
+    """
+
+    valid_until = models.DateTimeField(blank=True, null=True, verbose_name=_("Valid Until"))
+    protected_view_name = models.CharField(
+        blank=True,
+        null=True,
+        max_length=256,
+        verbose_name="Protected View-Name",
+        help_text="If specified, only view that revert to this viewname will accept this token",
+    )
+    number_usage_left = models.PositiveIntegerField(blank=True, null=True, verbose_name=_("Number of allowed usage"))
+    is_valid = models.BooleanField(default=True, verbose_name=_("Is Valid"))
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL, related_name="auth_tokens", on_delete=models.CASCADE, verbose_name=_("User")
+    )
+
+    def __str__(self):
+        if self.key:
+            return self.key
+        return ""
+
+    def check_validity_for_endpoint(self, view_name: str, current_time: datetime) -> True:
+        """
+        Handle the logic for token validity. Expect this method to be called from a request access
+        Args:
+            view_name: view name to check authentication against
+            current_time: The time to check authentication validity
+
+        Returns:
+            True if the token is valid and authentication can be granted
+        """
+        if not current_time:
+            current_time = timezone.now()
+        if not self.is_valid:
+            raise exceptions.AuthenticationFailed("Token is not valid anymore")
+        if self.valid_until is not None and self.valid_until < current_time:
+            raise exceptions.AuthenticationFailed("Token has expired")
+
+        if self.protected_view_name and not view_name == self.protected_view_name:
+            raise exceptions.AuthenticationFailed("Token has limited scope that doesn't match the requested endpoint")
+        if self.number_usage_left is not None:
+            if self.number_usage_left <= 0:
+                raise exceptions.AuthenticationFailed("Token usage exhausted")
+            self.number_usage_left -= 1
+            self.save()
+        return True
+
+    @classmethod
+    def generate_shareable_link(
+        cls,
+        endpoint: str,
+        user: "User",
+        creation_time: datetime | None = None,
+        protected_view_name: str = None,
+        token: str | None = None,
+    ) -> str:
+        """
+        Given an endpoint and a user, generate a shorted live token valid from now to the default validity time and appends it to the base endpoint query parameters
+        Args:
+            endpoint: endpoint to append the token to
+            user: token's owner
+        Returns:
+            an valid endpoint with the token as query parameter
+        """
+        if not creation_time:
+            creation_time = timezone.now()
+        global_preferences = global_preferences_registry.manager()
+        valid_until = creation_time + timedelta(
+            hours=global_preferences["authentication__default_token_validity_in_hours"]
+        )
+
+        parse_url = urllib.parse.urlsplit(urllib.parse.unquote(endpoint))
+        endpoint = parse_url.path
+        base_params = dict(urllib.parse.parse_qsl(parse_url.query))
+        if not token:
+            token = Token.generate_token_for_user(
+                user,
+                valid_until=valid_until,
+                protected_view_name=resolve(endpoint).view_name if not protected_view_name else protected_view_name,
+            ).key
+        base_params["token"] = token
+
+        if parse_url.scheme and parse_url.netloc:
+            endpoint = parse_url.scheme + "://" + parse_url.netloc + endpoint
+        params_repr = "&".join([f"{k}={v}" for k, v in base_params.items()])
+        return endpoint + f"?{params_repr}"
+
+    @classmethod
+    def generate_token_for_user(
+        cls,
+        user: "User",
+        valid_until: datetime | None = None,
+        number_of_usages: int | None = None,
+        protected_view_name: str | None = None,
+    ):
+        """
+        Generate a token for a user. We assume uniqueness between user and protected_view_name to avoid crowding our table.
+        Args:
+            user: Token's owner
+            valid_until: Token maximum datetime validity
+            number_of_usages: Token maximum token usages
+            protected_view_name: Token restricted view
+        Returns:
+            A valid Token
+        """
+
+        token, created = Token.objects.get_or_create(
+            user=user,
+            protected_view_name=protected_view_name,
+            defaults={"valid_until": valid_until, "number_usage_left": number_of_usages},
+        )
+        if not created:
+            token.number_usage_left = number_of_usages
+            token.valid_until = valid_until
+            token.is_valid = True
+            token.save()
+        return token
+
+    class Meta:
+        verbose_name = _("Token")
+        verbose_name_plural = _("Tokens")
+        unique_together = [("user", "protected_view_name")]

wbcore/contrib/authentication/models/users.py

@@ -0,0 +1,225 @@
+# -*- encoding: utf-8 -*-
+import unicodedata
+import uuid
+
+from django.contrib.auth.models import AbstractBaseUser, BaseUserManager
+from django.contrib.auth.models import Group as DjangoBaseGroup
+from django.contrib.auth.models import Permission as DjangoBasePermission
+from django.contrib.auth.models import PermissionsMixin
+from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.db import models
+from django.utils import timezone
+from django.utils.encoding import force_str
+from django.utils.translation import gettext
+from django.utils.translation import gettext_lazy as _
+
+
+class UserManager(BaseUserManager):
+    use_in_migrations = True
+
+    @classmethod
+    def normalize_username(cls, username):
+        return unicodedata.normalize("NFKC", force_str(username))
+
+    def _create_user(self, username, email, password, **extra_fields):
+        if not email:
+            raise ValueError(gettext("No E-Mail provided"))
+        email = self.normalize_email(email)
+        if not username:
+            raise ValueError(gettext("No Username provided"))
+        username = UserManager.normalize_username(username)
+        user = self.model(email=email, username=username, **extra_fields)
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
+    def create_user(self, username, email, password=None, **extra_fields):
+        extra_fields.setdefault("is_staff", False)
+        extra_fields.setdefault("is_superuser", False)
+        extra_fields.setdefault("is_active", True)
+        extra_fields.setdefault("is_register", True)
+        return self._create_user(username, email.lower(), password, **extra_fields)
+
+    def create_superuser(self, username, email, password, **extra_fields):
+        extra_fields.setdefault("is_staff", True)
+        extra_fields.setdefault("is_superuser", True)
+        extra_fields.setdefault("is_active", True)
+        extra_fields.setdefault("is_register", True)
+        if extra_fields.get("is_staff") is not True:
+            raise ValueError("Superuser must have is_staff=True.")
+        if extra_fields.get("is_superuser") is not True:
+            raise ValueError("Superuser must have is_superuser=True.")
+
+        return self._create_user(username, email, password, **extra_fields)
+
+
+class User(AbstractBaseUser, PermissionsMixin):
+    uuid = models.UUIDField(default=uuid.uuid4, editable=False, unique=True)
+    email = models.EmailField(_("E-Mail"), unique=True)
+    username = models.CharField(_("username"), max_length=255, unique=True)
+    profile = models.OneToOneField("directory.Person", on_delete=models.PROTECT, related_name="user_account")
+    is_staff = models.BooleanField(
+        _("staff status"),
+        default=False,
+        help_text=_("Specifies whether the user can log into this admin site."),
+    )
+    is_active = models.BooleanField(
+        _("active"),
+        default=False,
+        help_text=_(
+            "Specifies whether this user should be treated as active. Unselect this instead of deleting accounts."
+        ),
+    )
+    is_register = models.BooleanField(
+        _("register"), default=True, help_text=_("Specifies whether this user has registered its email. ")
+    )
+    date_joined = models.DateTimeField(_("date joined"), default=timezone.now)
+    metadata = models.JSONField(default=dict, blank=True)
+
+    objects = UserManager()
+
+    USERNAME_FIELD = "email"
+    REQUIRED_FIELDS = ["username"]
+
+    class Meta:
+        verbose_name = _("user")
+        verbose_name_plural = _("users")
+        swappable = "AUTH_USER_MODEL"
+        permissions = [("administrate_user", "Administrate Users"), ("is_internal_user", "Internal User")]
+
+    @property
+    def is_internal(self):
+        from wbcore.permissions.registry import user_registry
+
+        return self in user_registry.internal_users
+
+    def get_full_name(self):
+        full_name = "%s %s" % (self.profile.first_name, self.profile.last_name)
+        return full_name.strip()
+
+    def get_short_name(self):
+        return self.profile.first_name
+
+    def save(self, *args, **kwargs):
+        from wbcore.contrib.directory.models.entries import Person
+
+        self.username = self.username.lower()  # make sure username is lower case
+        self.profile = Person.get_or_create_with_user(self)
+        super().save(*args, **kwargs)
+
+    def reset_password(self, request=None):
+        """
+        Create the Reset Password email including the new password to be used for the next login
+        """
+        from django.contrib.auth.forms import PasswordResetForm
+
+        reset_password_form = PasswordResetForm(data={"email": self.email})
+        if reset_password_form.is_valid():
+            reset_password_form.save(
+                request=request,
+                email_template_name="password_reset_email.html",
+                html_email_template_name="password_reset_email_html.html",
+            )
+
+    def generate_temporary_token(self):
+        return PasswordResetTokenGenerator().make_token(self)
+
+    def verify_temporary_token(self, token):
+        return PasswordResetTokenGenerator().check_token(self, token)
+
+    @classmethod
+    def generate_username(cls, *names) -> str:
+        username = "-".join(map(lambda x: x.lower(), names))
+        similar = User.objects.filter(username__iregex=f"^({username}(-[0-9]*)*)$").count()
+        return username if similar == 0 else f"{username}-{similar + 1}"
+
+    @classmethod
+    def create_with_attributes(cls, email, password, username=None, first_name=None, last_name=None):
+        if not username and first_name and last_name:
+            username = cls.generate_username(first_name, last_name)
+        if not username:
+            raise ValueError(gettext("You need to specify a username or a pair of first and last name"))
+        return cls.objects.create_user(
+            username, email, password, is_staff=False, is_superuser=False, is_active=False, is_register=False
+        )
+
+    @property
+    def generic_auth_token_key(self) -> str | None:
+        """
+        Return generic valid useable token
+        """
+        token = self.auth_tokens.get_or_create(
+            valid_until__isnull=True,
+            protected_view_name__isnull=True,
+            number_usage_left__isnull=True,
+            defaults={
+                "is_valid": True,
+            },
+        )[0]
+        return token.key
+
+    @property
+    def first_name(self):
+        return self.profile.first_name
+
+    @property
+    def last_name(self):
+        return self.profile.last_name
+
+    @classmethod
+    def get_endpoint_basename(self):
+        return "wbcore:authentication:user"
+
+    @classmethod
+    def get_representation_endpoint(cls):
+        return "wbcore:authentication:userrepresentation-list"
+
+    @classmethod
+    def get_representation_value_key(cls):
+        return "id"
+
+    @classmethod
+    def get_representation_label_key(cls):
+        return "{{computed_str}}"
+
+
+class Group(DjangoBaseGroup):
+    class Meta:
+        proxy = True
+
+    @classmethod
+    def get_endpoint_basename(self):
+        return "wbcore:authentication:group"
+
+    @classmethod
+    def get_representation_endpoint(cls):
+        return "wbcore:authentication:grouprepresentation-list"
+
+    @classmethod
+    def get_representation_value_key(cls):
+        return "id"
+
+    @classmethod
+    def get_representation_label_key(cls):
+        return "{{name}}"
+
+
+class Permission(DjangoBasePermission):
+    class Meta:
+        proxy = True
+
+    @classmethod
+    def get_endpoint_basename(self):
+        return "wbcore:authentication:permission"
+
+    @classmethod
+    def get_representation_endpoint(cls):
+        return "wbcore:authentication:permissionrepresentation-list"
+
+    @classmethod
+    def get_representation_value_key(cls):
+        return "id"
+
+    @classmethod
+    def get_representation_label_key(cls):
+        return "{{name}}"

wbcore/contrib/authentication/models/users_activities.py

@@ -0,0 +1,112 @@
+from datetime import timedelta
+
+from celery import shared_task
+from django.conf import settings
+from django.contrib.auth import user_logged_in
+from django.db import models
+from django.db.models import DateTimeField, OuterRef, Subquery
+from django.dispatch import receiver
+from django.utils import timezone
+from django.utils.translation import gettext_lazy as _
+
+from .users import User
+
+ACCESS_TOKEN_LIFETIME = settings.SIMPLE_JWT["ACCESS_TOKEN_LIFETIME"].seconds
+
+
+class UserActivity(models.Model):
+    SUCCESS = _("Success")
+    FAILED = _("Failed")
+
+    ACTIVITY_STATUS = ((SUCCESS, _("Success")), (FAILED, _("Failed")))
+
+    class Type(models.TextChoices):
+        LOGIN = "LOGIN", _("Login")
+
+    IP = models.GenericIPAddressField(null=True, blank=True)
+    date = models.DateTimeField(auto_now_add=True)
+    user = models.ForeignKey(
+        "authentication.User", related_name="login_activities", null=True, on_delete=models.SET_NULL
+    )
+    status = models.CharField(max_length=8, default=SUCCESS, choices=ACTIVITY_STATUS, null=True, blank=True)
+    jti = models.CharField(max_length=32, default="", blank=True)
+    type = models.CharField(max_length=16, default=Type.LOGIN, choices=Type.choices, null=True, blank=True)
+    user_agent_info = models.CharField(max_length=255)
+    latest_refresh = models.DateTimeField(null=True, blank=True)
+
+    def __str__(self) -> str:
+        return _("Activity of {user} at {date}").format(user=str(self.user), date=self.date)
+
+    class Meta:
+        verbose_name = _("User Login Activity")
+        verbose_name_plural = _("User Login Activities")
+
+    @classmethod
+    def get_latest_login_datetime_subquery(cls, profile_name="pk", use_user=False):
+        """
+        Create a subquery to retrieve the latest login datetime information
+
+        Arguments:
+            profile_name {str} -- The OuterRef field for user__profile
+        Returns:
+            Subquery -- Subquery for latest login detail
+        """
+
+        if use_user:
+            qs = UserActivity.objects.filter(user__id=OuterRef("id"))
+        else:
+            qs = UserActivity.objects.filter(user__profile__id=OuterRef(profile_name))
+        return Subquery(qs.order_by("-latest_refresh").values("latest_refresh")[:1], output_field=DateTimeField())
+
+    @classmethod
+    def get_endpoint_basename(self):
+        return "wbcore:authentication:useractivity"
+
+    @classmethod
+    def get_representation_value_key(cls):
+        return "id"
+
+    @classmethod
+    def get_representation_label_key(cls):
+        return "{{user}}: {{date}}-{{latest_refresh}}"
+
+
+@receiver(user_logged_in)
+def log_user_logged_in_success(sender, user, request, **kwargs):
+    """
+    Signal triggerd whenever a user log into a new session. Create a new UserActivity for that user
+    """
+    user_agent_info = (request.META.get("HTTP_USER_AGENT", "<unknown>")[:255],)
+    x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
+    if x_forwarded_for:
+        ip = x_forwarded_for.split(",")[0]
+    else:
+        ip = request.META.get("REMOTE_ADDR")
+
+    access_token_lifespan = settings.SIMPLE_JWT["ACCESS_TOKEN_LIFETIME"].seconds
+    state = UserActivity.SUCCESS if kwargs.get("authentication_status", True) else UserActivity.FAILED
+    if jti := kwargs.get("jti", None):
+        # TODO: What if request is None?
+        UserActivity.objects.create(
+            IP=ip,
+            user=user,
+            user_agent_info=user_agent_info,
+            status=state,
+            jti=jti,
+            latest_refresh=timezone.now() + timedelta(seconds=access_token_lifespan),
+        )
+
+
+@shared_task()
+def refresh_user_activity(user_id, refresh_time, jti):
+    """
+    Signal triggerd whenever a refresh token is submit from the frontend. Update latest_refresh to the associated UserActivity.
+    """
+    user = User.objects.get(id=user_id)
+    user_activity, created = UserActivity.objects.get_or_create(user=user, jti=jti)
+    if created:
+        elapse = (refresh_time - user_activity.latest_refresh).seconds
+        access_token_lifespan = settings.SIMPLE_JWT["ACCESS_TOKEN_LIFETIME"].seconds
+        if elapse > access_token_lifespan:
+            user_activity.latest_refresh = refresh_time
+            user_activity.save()

wbcore/contrib/authentication/release_notes/1_0_0.md

@@ -0,0 +1,13 @@
+Date: 2023-04-26
+Module: Authentication
+Summary: Initial Release Note
+Version: 1.0.0
+
+## New Features
+- Bootstrap module versioning
+
+## Enhancements
+./.
+
+## Bugfixes
+./.

wbcore/contrib/authentication/serializers/__init__.py

@@ -0,0 +1,14 @@
+from .users import (
+    ChangePasswordSerializer,
+    GroupModelSerializer,
+    GroupRepresentationSerializer,
+    MyTokenObtainPairSerializer,
+    MyTokenRefreshSerializer,
+    PermissionModelSerializer,
+    PermissionRepresentationField,
+    PermissionRepresentationSerializer,
+    UserModelSerializer,
+    UserProfileModelSerializer,
+    UserRepresentationSerializer,
+)
+from .users_activites import UserActivitySerializer, UserActivityTableSerializer