U
    X(if3                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
 d dlT d dlmZ d dlmZ d dlmZ G dd	 d	ejjeZdS )
    N)abort)rollback_all_ds)*)normalize_email_address)ResponseMixin)copyc                   @   s   e Zd ZdZdZdd Zdd Zejj	dd Z
d	d
 Zejj	dd Zejj	dd Zejj	dd Zejj	dd Zejj	dd ZdS )
SigninViewz/signin   c                 C   s4   t jd}|s0t jr0tt j}|r0|d}|S )Naccess_token)requestcookiesgetdataujsonloads)selfr
   Zjson_res r   ./modules/auth/views/signin.py_get_access_token   s    

zSigninView._get_access_tokenc                 C   s   |   }|rtj|S d S )N)r   modelsCmfAuthZrsa_verify_unpack_jwt)r   r
   r   r   r   _jwt_from_request   s    zSigninView._jwt_from_requestc                 C   sT  dd l }ddlm} tjdd}tj|}t	
|s<d}|  }|rz0|d d }|d d }t|d d }d	}W n6 ttttfk
r   td
 d }d }d}d}Y nX d }	|sd}|rtjj|dgd}	|	sd}|r|	j|krd}|rztj tj| j}
|
dk rDdtjkrztd| d| dtjd   n6d|
  kr^tjk rzn ntt|}| ||	S t   d }	tj!d}|rtj"#|\}	}|dgd}|	r|stt|}| ||	S t$|D ]}|dkr|%| qt&j' }g }tj(j)dddgddgdD ] }|*t+|j,|-|d q t.|}| /dS )Nr   )get_flashed_messagesnext_url/ZpayloadloginscopeexpTzjwt value errorFr   fieldsz !!! Maybe Cycle Redirect: login=z, scope=z
 next_url=session_tokenZ
auth_error)Zcategory_filteru)   Требуется авторизацияZdisabledz==r   zplugin.*)filterr   )nameZ	login_urlzsignin.html)0htmlflaskr   r   valuesr   urllibparseunquotecmfutilis_safe_next_urlr   int
ValueError	TypeErrorAttributeErrorKeyErrorlogging	exceptionr   r   r   datetimeZnowZfromtimestampZdaysprintr   prolong_daysmake_responseredirect_okr   r   Z
CmfSessionZ
from_tokenr   removeconfigIS_BOX_VERSIONZCmfAuthOpenIdPluginlistappenddictr"   Zget_redirect_urllenZrender)r   r#   r   r   Zjwtr   r   r   Zjwt_okauthZexpired_daysresponser    Z_sessionmessagesmsgZshow_register_buttonZsso_buttonsZpluginZsso_buttons_countr   r   r   r   #   sr    





zSigninView.getc              
   C   s   t jjsd S d|  }ttj|p*d}|dkr:d S tj	dd }d|  }tj|}d
tjtjdd}tj|| |stjjd	d
d |dddd||d td | }|r||krtjjd	d
d |dddd||d td d S )Nzauth:user_last_login_fail:r      captchaauth:user_login_captcha:    )kZauth_failedr   zRequire captcha)r   reasonZfailZoperateZcmf_model_nameparentZ
audit_dataZresult_statusZsecurity_levelparent_nameZparent_codei  zBad captcha)gglobal_settingsauth_check_captchalowerr+   APPREDIS_DBr   r   r%   joinrandomchoicesstringdigitssetr   CmfAuditaudit_eventr   decode)r   r   Zdb_keyZlast_login_failrD   Z
db_captchaZnew_captchar   r   r   _auth_check_captchap   s@    
   
   zSigninView._auth_check_captchac                 C   s   t jjsd S dd l}|jtjd }d|kr6t|}t	j
d|  sPd S ddlm} ddlm} t	j
d|   }| }||}||ddS )	Nr   r   @rE   )Response)ImageCaptchaz	image/png)Zmimetype)rM   rN   rO   r&   r'   r(   r   r%   r   rQ   rR   existsrP   r$   r^   Zcaptcha.imager_   r   r[   Zgenerate)r   r&   r   r^   r_   rD   Zimager   r   r   r   captcha_img   s    
zSigninView.captcha_imgc                 C   s  dd l }ddlm} |jtjd }d|kr6t|}tjd }| | |	 0 t
j||}t
jj  |si }tjrtjd |d< td| | }|r2tjd	d }tjd
d }	|r|	st
jjddd d|idd||d td |||	 |jr
d |_t
jjddd d|idd||d |  tjdd}
|j|
}
||
s\d}
ttd|
i}| ||W  5 Q R  S Q R X d S )Nr   )r)   r   r]   challenge_respmessage  Znew_password_hashZnew_password_saltZpassword_expiredr   password_expires_must_changerC   rJ   i  Zpassword_changed   r   r   Zredirect_url)r&   Zcmf.utilr)   r'   r(   r   r%   r   r\   disable_aclr   r   get_by_challenge_respdpcommitrM   alertr   need_change_passwordr   rY   rZ   Zset_pass_hashrf   Zsaver*   r5   Zjsonifyr7   )r   r&   r)   r   rb   r?   abort_kwargsrm   hashZsaltr   r@   r   r   r   post   s^    



   
   zSigninView.postc                 C   s   dS )NrF   r   )r   r   r   r   get_server_challenge   s    zSigninView.get_server_challengec                 C   sZ  t jstd tdS t jjj}tjj	|ddgd}|sBtdS |j
jrftd | jtd|d	S td
d |j
j D }|std | jtd|d	S t|dkrtd t|D ]}td|r|| qt|dkr>td | }td| tj }tjr0tj|r0tdtj }| j||d	S td | jtd|d	S )uu    Определить по куке куда отправить пользователя автоматически. u7   1. Нет куки - форма авторизации.z/auth/signinr   r   r   z"/auth/signout?next_url=auth/signinuO   2.1. У пользователя нет scope - форма создания VM.z/auth/assign)r?   c                 S   s   g | ]}| d d qS ):r   )split).0r   r   r   r   
<listcomp>   s     z&SigninView.proceed.<locals>.<listcomp>uO   2.2. У пользователя нет scope - форма создания VM.rg   ur   3.2. У пользователя два scope, проверим, не системный ли один из нихz^acrm[0-9]{5,6}$rC   uo   3. У пользователя один единственный scope - на эту CRM и отправить.zhttps://uc   4. У пользователя несколько scope - отправить на список CRM.r   )rM   r?   r0   infor6   Zemailvaluer   r   r   r   Zis_nullr7   rX   rs   r>   rematchdiscardpopr9   ZAUTH_SESSION_COOKIE_DOMAINr:   
startswith)r   r   r?   Zscopesr   r@   r   r   r   proceed   s8    






zSigninView.proceedc              	   C   st   t tjd }tjd }t F tj||}tjj	  |sbi }t
jrXt
jd |d< td| W 5 Q R X | S )u>   
            Ручка для авторизации
        r   passwordrc   rd   re   )r   r   r%   r)   rh   r   r   ri   rj   rk   rM   rl   r   Zrsa_sign_pack_jwt)r   r   r~   r?   rn   r   r   r   signin_with_login_password  s    

z%SigninView.signin_with_login_passwordN)__name__
__module____qualname__Z__url__r4   r   r   cmfviewsactionr   r\   ra   rp   rq   r}   r   r   r   r   r   r      s"   
L!

5

%r   )r2   urllib.parser&   r   rT   rV   timer$   r   Zcmf.data_providers.baser   Zcmf.includeZmodules.auth.models.emailr   Zmodules.auth.views.responser   r   r   r   ZBaseViewr   r   r   r   r   <module>   s   