|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
|
# Copyright 2010 - 2017 RhodeCode GmbH and the AppEnlight project authors
|
|
|
#
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
# You may obtain a copy of the License at
|
|
|
#
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
#
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
# See the License for the specific language governing permissions and
|
|
|
# limitations under the License.
|
|
|
|
|
|
import colander
|
|
|
import datetime
|
|
|
import json
|
|
|
import logging
|
|
|
import uuid
|
|
|
import pyramid.security as security
|
|
|
import appenlight.lib.helpers as h
|
|
|
|
|
|
from authomatic.adapters import WebObAdapter
|
|
|
from pyramid.view import view_config
|
|
|
from pyramid.httpexceptions import HTTPFound, HTTPUnprocessableEntity
|
|
|
from pyramid.httpexceptions import HTTPNotFound, HTTPBadRequest
|
|
|
from pyramid.security import NO_PERMISSION_REQUIRED
|
|
|
from ziggurat_foundations.models.services.external_identity import (
|
|
|
ExternalIdentityService,
|
|
|
)
|
|
|
from ziggurat_foundations.models.services.user import UserService
|
|
|
|
|
|
from appenlight.lib import generate_random_string
|
|
|
from appenlight.lib.social import handle_social_data
|
|
|
from appenlight.lib.utils import (
|
|
|
channelstream_request,
|
|
|
add_cors_headers,
|
|
|
permission_tuple_to_dict,
|
|
|
)
|
|
|
from appenlight.models import DBSession
|
|
|
from appenlight.models.alert_channels.email import EmailAlertChannel
|
|
|
from appenlight.models.alert_channel_action import AlertChannelAction
|
|
|
from appenlight.models.services.alert_channel import AlertChannelService
|
|
|
from appenlight.models.services.alert_channel_action import AlertChannelActionService
|
|
|
from appenlight.models.auth_token import AuthToken
|
|
|
from appenlight.models.report import REPORT_TYPE_MATRIX
|
|
|
from appenlight.models.user import User
|
|
|
from appenlight.models.services.user import UserService
|
|
|
from appenlight.subscribers import _
|
|
|
from appenlight.validators import build_rule_schema
|
|
|
from appenlight import forms
|
|
|
from webob.multidict import MultiDict
|
|
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_no_id",
|
|
|
renderer="json",
|
|
|
request_method="GET",
|
|
|
permission="root_administration",
|
|
|
)
|
|
|
def users_list(request):
|
|
|
"""
|
|
|
Returns users list
|
|
|
"""
|
|
|
props = [
|
|
|
"user_name",
|
|
|
"id",
|
|
|
"first_name",
|
|
|
"last_name",
|
|
|
"email",
|
|
|
"last_login_date",
|
|
|
"status",
|
|
|
]
|
|
|
users = UserService.all()
|
|
|
users_dicts = []
|
|
|
for user in users:
|
|
|
u_dict = user.get_dict(include_keys=props)
|
|
|
u_dict["gravatar_url"] = UserService.gravatar_url(user, s=20)
|
|
|
users_dicts.append(u_dict)
|
|
|
return users_dicts
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_no_id",
|
|
|
renderer="json",
|
|
|
request_method="POST",
|
|
|
permission="root_administration",
|
|
|
)
|
|
|
def users_create(request):
|
|
|
"""
|
|
|
Returns users list
|
|
|
"""
|
|
|
form = forms.UserCreateForm(
|
|
|
MultiDict(request.safe_json_body or {}), csrf_context=request
|
|
|
)
|
|
|
if form.validate():
|
|
|
log.info("registering user")
|
|
|
# probably not needed in the future since this requires root anyways
|
|
|
# lets keep this here in case we lower view permission in the future
|
|
|
# if request.registry.settings['appenlight.disable_registration']:
|
|
|
# return HTTPUnprocessableEntity(body={'error': 'Registration is currently disabled.'})
|
|
|
user = User()
|
|
|
# insert new user here
|
|
|
DBSession.add(user)
|
|
|
form.populate_obj(user)
|
|
|
UserService.regenerate_security_code(user)
|
|
|
UserService.set_password(user, user.user_password)
|
|
|
user.status = 1 if form.status.data else 0
|
|
|
request.session.flash(_("User created"))
|
|
|
DBSession.flush()
|
|
|
return user.get_dict(
|
|
|
exclude_keys=[
|
|
|
"security_code_date",
|
|
|
"notes",
|
|
|
"security_code",
|
|
|
"user_password",
|
|
|
]
|
|
|
)
|
|
|
else:
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users",
|
|
|
renderer="json",
|
|
|
request_method="GET",
|
|
|
permission="root_administration",
|
|
|
)
|
|
|
@view_config(
|
|
|
route_name="users",
|
|
|
renderer="json",
|
|
|
request_method="PATCH",
|
|
|
permission="root_administration",
|
|
|
)
|
|
|
def users_update(request):
|
|
|
"""
|
|
|
Updates user object
|
|
|
"""
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if not user:
|
|
|
return HTTPNotFound()
|
|
|
post_data = request.safe_json_body or {}
|
|
|
if request.method == "PATCH":
|
|
|
form = forms.UserUpdateForm(MultiDict(post_data), csrf_context=request)
|
|
|
if form.validate():
|
|
|
form.populate_obj(user, ignore_none=True)
|
|
|
if form.user_password.data:
|
|
|
UserService.set_password(user, user.user_password)
|
|
|
if form.status.data:
|
|
|
user.status = 1
|
|
|
else:
|
|
|
user.status = 0
|
|
|
else:
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
return user.get_dict(
|
|
|
exclude_keys=["security_code_date", "notes", "security_code", "user_password"]
|
|
|
)
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_property",
|
|
|
match_param="key=resource_permissions",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_resource_permissions_list(request):
|
|
|
"""
|
|
|
Get list of permissions assigned to specific resources
|
|
|
"""
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if not user:
|
|
|
return HTTPNotFound()
|
|
|
return [
|
|
|
permission_tuple_to_dict(perm)
|
|
|
for perm in UserService.resources_with_possible_perms(user)
|
|
|
]
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users",
|
|
|
renderer="json",
|
|
|
request_method="DELETE",
|
|
|
permission="root_administration",
|
|
|
)
|
|
|
def users_DELETE(request):
|
|
|
"""
|
|
|
Removes a user permanently from db - makes a check to see if after the
|
|
|
operation there will be at least one admin left
|
|
|
"""
|
|
|
msg = _("There needs to be at least one administrator in the system")
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if user:
|
|
|
users = UserService.users_for_perms(["root_administration"]).all()
|
|
|
if len(users) < 2 and user.id == users[0].id:
|
|
|
request.session.flash(msg, "warning")
|
|
|
else:
|
|
|
DBSession.delete(user)
|
|
|
request.session.flash(_("User removed"))
|
|
|
return True
|
|
|
request.response.status = 422
|
|
|
return False
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self",
|
|
|
renderer="json",
|
|
|
request_method="GET",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
@view_config(
|
|
|
route_name="users_self",
|
|
|
renderer="json",
|
|
|
request_method="PATCH",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_self(request):
|
|
|
"""
|
|
|
Updates user personal information
|
|
|
"""
|
|
|
|
|
|
if request.method == "PATCH":
|
|
|
form = forms.gen_user_profile_form()(
|
|
|
MultiDict(request.unsafe_json_body), csrf_context=request
|
|
|
)
|
|
|
if form.validate():
|
|
|
form.populate_obj(request.user)
|
|
|
request.session.flash(_("Your profile got updated."))
|
|
|
else:
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
return request.user.get_dict(
|
|
|
exclude_keys=["security_code_date", "notes", "security_code", "user_password"],
|
|
|
extended_info=True,
|
|
|
)
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=external_identities",
|
|
|
renderer="json",
|
|
|
request_method="GET",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_external_identies(request):
|
|
|
user = request.user
|
|
|
identities = [
|
|
|
{"provider": ident.provider_name, "id": ident.external_user_name}
|
|
|
for ident in user.external_identities.all()
|
|
|
]
|
|
|
return identities
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=external_identities",
|
|
|
renderer="json",
|
|
|
request_method="DELETE",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_external_identies_DELETE(request):
|
|
|
"""
|
|
|
Unbinds external identities(google,twitter etc.) from user account
|
|
|
"""
|
|
|
user = request.user
|
|
|
for identity in user.external_identities.all():
|
|
|
log.info("found identity %s" % identity)
|
|
|
if identity.provider_name == request.params.get(
|
|
|
"provider"
|
|
|
) and identity.external_user_name == request.params.get("id"):
|
|
|
log.info("remove identity %s" % identity)
|
|
|
DBSession.delete(identity)
|
|
|
return True
|
|
|
return False
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=password",
|
|
|
renderer="json",
|
|
|
request_method="PATCH",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_password(request):
|
|
|
"""
|
|
|
Sets new password for user account
|
|
|
"""
|
|
|
user = request.user
|
|
|
form = forms.ChangePasswordForm(
|
|
|
MultiDict(request.unsafe_json_body), csrf_context=request
|
|
|
)
|
|
|
form.old_password.user = user
|
|
|
if form.validate():
|
|
|
UserService.regenerate_security_code(user)
|
|
|
UserService.set_password(user, form.new_password.data)
|
|
|
msg = (
|
|
|
"Your password got updated. " "Next time log in with your new credentials."
|
|
|
)
|
|
|
request.session.flash(_(msg))
|
|
|
return True
|
|
|
else:
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
return False
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=websocket",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def users_websocket(request):
|
|
|
"""
|
|
|
Handle authorization of users trying to connect
|
|
|
"""
|
|
|
# handle preflight request
|
|
|
user = request.user
|
|
|
if request.method == "OPTIONS":
|
|
|
res = request.response.body("OK")
|
|
|
add_cors_headers(res)
|
|
|
return res
|
|
|
applications = UserService.resources_with_perms(
|
|
|
user, ["view"], resource_types=["application"]
|
|
|
)
|
|
|
channels = ["app_%s" % app.resource_id for app in applications]
|
|
|
payload = {
|
|
|
"username": user.user_name,
|
|
|
"conn_id": str(uuid.uuid4()),
|
|
|
"channels": channels,
|
|
|
}
|
|
|
settings = request.registry.settings
|
|
|
response = channelstream_request(
|
|
|
settings["cometd.secret"],
|
|
|
"/connect",
|
|
|
payload,
|
|
|
servers=[request.registry.settings["cometd_servers"]],
|
|
|
throw_exceptions=True,
|
|
|
)
|
|
|
return payload
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
request_method="GET",
|
|
|
match_param="key=alert_channels",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_channels(request):
|
|
|
"""
|
|
|
Lists all available alert channels
|
|
|
"""
|
|
|
user = request.user
|
|
|
return [c.get_dict(extended_info=True) for c in user.alert_channels]
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=alert_actions",
|
|
|
request_method="GET",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_actions(request):
|
|
|
"""
|
|
|
Lists all available alert channels
|
|
|
"""
|
|
|
user = request.user
|
|
|
return [r.get_dict(extended_info=True) for r in user.alert_actions]
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
renderer="json",
|
|
|
match_param="key=alert_channels_rules",
|
|
|
request_method="POST",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_channels_rule_POST(request):
|
|
|
"""
|
|
|
Creates new notification rule for specific alert channel
|
|
|
"""
|
|
|
user = request.user
|
|
|
alert_action = AlertChannelAction(owner_id=request.user.id, type="report")
|
|
|
DBSession.add(alert_action)
|
|
|
DBSession.flush()
|
|
|
return alert_action.get_dict()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
permission="authenticated",
|
|
|
match_param="key=alert_channels_rules",
|
|
|
renderer="json",
|
|
|
request_method="DELETE",
|
|
|
)
|
|
|
def alert_channels_rule_DELETE(request):
|
|
|
"""
|
|
|
Removes specific alert channel rule
|
|
|
"""
|
|
|
user = request.user
|
|
|
rule_action = AlertChannelActionService.by_owner_id_and_pkey(
|
|
|
user.id, request.GET.get("pkey")
|
|
|
)
|
|
|
if rule_action:
|
|
|
DBSession.delete(rule_action)
|
|
|
return True
|
|
|
return HTTPNotFound()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
permission="authenticated",
|
|
|
match_param="key=alert_channels_rules",
|
|
|
renderer="json",
|
|
|
request_method="PATCH",
|
|
|
)
|
|
|
def alert_channels_rule_PATCH(request):
|
|
|
"""
|
|
|
Removes specific alert channel rule
|
|
|
"""
|
|
|
user = request.user
|
|
|
json_body = request.unsafe_json_body
|
|
|
|
|
|
schema = build_rule_schema(json_body["rule"], REPORT_TYPE_MATRIX)
|
|
|
try:
|
|
|
schema.deserialize(json_body["rule"])
|
|
|
except colander.Invalid as exc:
|
|
|
return HTTPUnprocessableEntity(body=json.dumps(exc.asdict()))
|
|
|
|
|
|
rule_action = AlertChannelActionService.by_owner_id_and_pkey(
|
|
|
user.id, request.GET.get("pkey")
|
|
|
)
|
|
|
|
|
|
if rule_action:
|
|
|
rule_action.rule = json_body["rule"]
|
|
|
rule_action.resource_id = json_body["resource_id"]
|
|
|
rule_action.action = json_body["action"]
|
|
|
return rule_action.get_dict()
|
|
|
return HTTPNotFound()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
permission="authenticated",
|
|
|
match_param="key=alert_channels",
|
|
|
renderer="json",
|
|
|
request_method="PATCH",
|
|
|
)
|
|
|
def alert_channels_PATCH(request):
|
|
|
user = request.user
|
|
|
channel_name = request.GET.get("channel_name")
|
|
|
channel_value = request.GET.get("channel_value")
|
|
|
# iterate over channels
|
|
|
channel = None
|
|
|
for channel in user.alert_channels:
|
|
|
if (
|
|
|
channel.channel_name == channel_name
|
|
|
and channel.channel_value == channel_value
|
|
|
):
|
|
|
break
|
|
|
if not channel:
|
|
|
return HTTPNotFound()
|
|
|
|
|
|
allowed_keys = ["daily_digest", "send_alerts"]
|
|
|
for k, v in request.unsafe_json_body.items():
|
|
|
if k in allowed_keys:
|
|
|
setattr(channel, k, v)
|
|
|
else:
|
|
|
return HTTPBadRequest()
|
|
|
return channel.get_dict()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
permission="authenticated",
|
|
|
match_param="key=alert_channels",
|
|
|
request_method="POST",
|
|
|
renderer="json",
|
|
|
)
|
|
|
def alert_channels_POST(request):
|
|
|
"""
|
|
|
Creates a new email alert channel for user, sends a validation email
|
|
|
"""
|
|
|
user = request.user
|
|
|
form = forms.EmailChannelCreateForm(
|
|
|
MultiDict(request.unsafe_json_body), csrf_context=request
|
|
|
)
|
|
|
if not form.validate():
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
|
|
|
email = form.email.data.strip()
|
|
|
channel = EmailAlertChannel()
|
|
|
channel.channel_name = "email"
|
|
|
channel.channel_value = email
|
|
|
security_code = generate_random_string(10)
|
|
|
channel.channel_json_conf = {"security_code": security_code}
|
|
|
user.alert_channels.append(channel)
|
|
|
|
|
|
email_vars = {
|
|
|
"user": user,
|
|
|
"email": email,
|
|
|
"request": request,
|
|
|
"security_code": security_code,
|
|
|
"email_title": "AppEnlight :: " "Please authorize your email",
|
|
|
}
|
|
|
|
|
|
UserService.send_email(
|
|
|
request,
|
|
|
recipients=[email],
|
|
|
variables=email_vars,
|
|
|
template="/email_templates/authorize_email.jinja2",
|
|
|
)
|
|
|
request.session.flash(_("Your alert channel was " "added to the system."))
|
|
|
request.session.flash(
|
|
|
_(
|
|
|
"You need to authorize your email channel, a message was "
|
|
|
"sent containing necessary information."
|
|
|
),
|
|
|
"warning",
|
|
|
)
|
|
|
DBSession.flush()
|
|
|
channel.get_dict()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="section_view",
|
|
|
match_param=["section=user_section", "view=alert_channels_authorize"],
|
|
|
renderer="string",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_channels_authorize(request):
|
|
|
"""
|
|
|
Performs alert channel authorization based on auth code sent in email
|
|
|
"""
|
|
|
user = request.user
|
|
|
for channel in user.alert_channels:
|
|
|
security_code = request.params.get("security_code", "")
|
|
|
if channel.channel_json_conf["security_code"] == security_code:
|
|
|
channel.channel_validated = True
|
|
|
request.session.flash(_("Your email was authorized."))
|
|
|
return HTTPFound(location=request.route_url("/"))
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
request_method="DELETE",
|
|
|
match_param="key=alert_channels",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_channel_DELETE(request):
|
|
|
"""
|
|
|
Removes alert channel from users channel
|
|
|
"""
|
|
|
user = request.user
|
|
|
channel = None
|
|
|
for chan in user.alert_channels:
|
|
|
if chan.channel_name == request.params.get(
|
|
|
"channel_name"
|
|
|
) and chan.channel_value == request.params.get("channel_value"):
|
|
|
channel = chan
|
|
|
break
|
|
|
if channel:
|
|
|
user.alert_channels.remove(channel)
|
|
|
request.session.flash(_("Your channel was removed."))
|
|
|
return True
|
|
|
return False
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
permission="authenticated",
|
|
|
match_param="key=alert_channels_actions_binds",
|
|
|
renderer="json",
|
|
|
request_method="POST",
|
|
|
)
|
|
|
def alert_channels_actions_binds_POST(request):
|
|
|
"""
|
|
|
Adds alert action to users channels
|
|
|
"""
|
|
|
user = request.user
|
|
|
json_body = request.unsafe_json_body
|
|
|
channel = AlertChannelService.by_owner_id_and_pkey(
|
|
|
user.id, json_body.get("channel_pkey")
|
|
|
)
|
|
|
|
|
|
rule_action = AlertChannelActionService.by_owner_id_and_pkey(
|
|
|
user.id, json_body.get("action_pkey")
|
|
|
)
|
|
|
|
|
|
if channel and rule_action:
|
|
|
if channel.pkey not in [c.pkey for c in rule_action.channels]:
|
|
|
rule_action.channels.append(channel)
|
|
|
return rule_action.get_dict(extended_info=True)
|
|
|
return HTTPUnprocessableEntity()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
request_method="DELETE",
|
|
|
match_param="key=alert_channels_actions_binds",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def alert_channels_actions_binds_DELETE(request):
|
|
|
"""
|
|
|
Removes alert action from users channels
|
|
|
"""
|
|
|
user = request.user
|
|
|
channel = AlertChannelService.by_owner_id_and_pkey(
|
|
|
user.id, request.GET.get("channel_pkey")
|
|
|
)
|
|
|
|
|
|
rule_action = AlertChannelActionService.by_owner_id_and_pkey(
|
|
|
user.id, request.GET.get("action_pkey")
|
|
|
)
|
|
|
|
|
|
if channel and rule_action:
|
|
|
if channel.pkey in [c.pkey for c in rule_action.channels]:
|
|
|
rule_action.channels.remove(channel)
|
|
|
return rule_action.get_dict(extended_info=True)
|
|
|
return HTTPUnprocessableEntity()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="social_auth_abort", renderer="string", permission=NO_PERMISSION_REQUIRED
|
|
|
)
|
|
|
def oauth_abort(request):
|
|
|
"""
|
|
|
Handles problems with authorization via velruse
|
|
|
"""
|
|
|
|
|
|
|
|
|
@view_config(route_name="social_auth", permission=NO_PERMISSION_REQUIRED)
|
|
|
def social_auth(request):
|
|
|
# Get the internal provider name URL variable.
|
|
|
provider_name = request.matchdict.get("provider")
|
|
|
|
|
|
# Start the login procedure.
|
|
|
adapter = WebObAdapter(request, request.response)
|
|
|
result = request.authomatic.login(adapter, provider_name)
|
|
|
if result:
|
|
|
if result.error:
|
|
|
return handle_auth_error(request, result)
|
|
|
elif result.user:
|
|
|
return handle_auth_success(request, result)
|
|
|
return request.response
|
|
|
|
|
|
|
|
|
def handle_auth_error(request, result):
|
|
|
# Login procedure finished with an error.
|
|
|
request.session.pop("zigg.social_auth", None)
|
|
|
request.session.flash(
|
|
|
_(
|
|
|
"Something went wrong when we tried to "
|
|
|
"authorize you via external provider. "
|
|
|
"Please try again."
|
|
|
),
|
|
|
"warning",
|
|
|
)
|
|
|
|
|
|
return HTTPFound(location=request.route_url("/"))
|
|
|
|
|
|
|
|
|
def handle_auth_success(request, result):
|
|
|
# Hooray, we have the user!
|
|
|
# OAuth 2.0 and OAuth 1.0a provide only limited user data on login,
|
|
|
# We need to update the user to get more info.
|
|
|
if result.user:
|
|
|
result.user.update()
|
|
|
|
|
|
social_data = {
|
|
|
"user": {"data": result.user.data},
|
|
|
"credentials": result.user.credentials,
|
|
|
}
|
|
|
# normalize data
|
|
|
social_data["user"]["id"] = result.user.id
|
|
|
user_name = result.user.username or ""
|
|
|
# use email name as username for google
|
|
|
if social_data["credentials"].provider_name == "google" and result.user.email:
|
|
|
user_name = result.user.email
|
|
|
social_data["user"]["user_name"] = user_name
|
|
|
social_data["user"]["email"] = result.user.email or ""
|
|
|
|
|
|
request.session["zigg.social_auth"] = social_data
|
|
|
# user is logged so bind his external identity with account
|
|
|
if request.user:
|
|
|
handle_social_data(request, request.user, social_data)
|
|
|
request.session.pop("zigg.social_auth", None)
|
|
|
return HTTPFound(location=request.route_url("/"))
|
|
|
else:
|
|
|
user = ExternalIdentityService.user_by_external_id_and_provider(
|
|
|
social_data["user"]["id"], social_data["credentials"].provider_name
|
|
|
)
|
|
|
# fix legacy accounts with wrong google ID
|
|
|
if not user and social_data["credentials"].provider_name == "google":
|
|
|
user = ExternalIdentityService.user_by_external_id_and_provider(
|
|
|
social_data["user"]["email"], social_data["credentials"].provider_name
|
|
|
)
|
|
|
|
|
|
# user tokens are already found in our db
|
|
|
if user:
|
|
|
handle_social_data(request, user, social_data)
|
|
|
headers = security.remember(request, user.id)
|
|
|
request.session.pop("zigg.social_auth", None)
|
|
|
return HTTPFound(location=request.route_url("/"), headers=headers)
|
|
|
else:
|
|
|
msg = (
|
|
|
"You need to finish registration "
|
|
|
"process to bind your external identity to your account "
|
|
|
"or sign in to existing account"
|
|
|
)
|
|
|
request.session.flash(msg)
|
|
|
return HTTPFound(location=request.route_url("register"))
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="section_view",
|
|
|
permission="authenticated",
|
|
|
match_param=["section=users_section", "view=search_users"],
|
|
|
renderer="json",
|
|
|
)
|
|
|
def search_users(request):
|
|
|
"""
|
|
|
Returns a list of users for autocomplete
|
|
|
"""
|
|
|
user = request.user
|
|
|
items_returned = []
|
|
|
like_condition = request.params.get("user_name", "") + "%"
|
|
|
# first append used if email is passed
|
|
|
found_user = UserService.by_email(request.params.get("user_name", ""))
|
|
|
if found_user:
|
|
|
name = "{} {}".format(found_user.first_name, found_user.last_name)
|
|
|
items_returned.append({"user": found_user.user_name, "name": name})
|
|
|
for found_user in UserService.user_names_like(like_condition).limit(20):
|
|
|
name = "{} {}".format(found_user.first_name, found_user.last_name)
|
|
|
items_returned.append({"user": found_user.user_name, "name": name})
|
|
|
return items_returned
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="GET",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
@view_config(
|
|
|
route_name="users_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="GET",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def auth_tokens_list(request):
|
|
|
"""
|
|
|
Lists all available alert channels
|
|
|
"""
|
|
|
if request.matched_route.name == "users_self_property":
|
|
|
user = request.user
|
|
|
else:
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if not user:
|
|
|
return HTTPNotFound()
|
|
|
return [c.get_dict() for c in user.auth_tokens]
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="POST",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
@view_config(
|
|
|
route_name="users_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="POST",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def auth_tokens_POST(request):
|
|
|
"""
|
|
|
Lists all available alert channels
|
|
|
"""
|
|
|
if request.matched_route.name == "users_self_property":
|
|
|
user = request.user
|
|
|
else:
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if not user:
|
|
|
return HTTPNotFound()
|
|
|
|
|
|
req_data = request.safe_json_body or {}
|
|
|
if not req_data.get("expires"):
|
|
|
req_data.pop("expires", None)
|
|
|
form = forms.AuthTokenCreateForm(MultiDict(req_data), csrf_context=request)
|
|
|
if not form.validate():
|
|
|
return HTTPUnprocessableEntity(body=form.errors_json)
|
|
|
token = AuthToken()
|
|
|
form.populate_obj(token)
|
|
|
if token.expires:
|
|
|
interval = h.time_deltas.get(token.expires)["delta"]
|
|
|
token.expires = datetime.datetime.utcnow() + interval
|
|
|
user.auth_tokens.append(token)
|
|
|
DBSession.flush()
|
|
|
return token.get_dict()
|
|
|
|
|
|
|
|
|
@view_config(
|
|
|
route_name="users_self_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="DELETE",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
@view_config(
|
|
|
route_name="users_property",
|
|
|
match_param="key=auth_tokens",
|
|
|
request_method="DELETE",
|
|
|
renderer="json",
|
|
|
permission="authenticated",
|
|
|
)
|
|
|
def auth_tokens_DELETE(request):
|
|
|
"""
|
|
|
Lists all available alert channels
|
|
|
"""
|
|
|
if request.matched_route.name == "users_self_property":
|
|
|
user = request.user
|
|
|
else:
|
|
|
user = UserService.by_id(request.matchdict.get("user_id"))
|
|
|
if not user:
|
|
|
return HTTPNotFound()
|
|
|
|
|
|
for token in user.auth_tokens:
|
|
|
if token.token == request.params.get("token"):
|
|
|
user.auth_tokens.remove(token)
|
|
|
return True
|
|
|
return False
|
|
|
|
