U ~f5@s>ddlTddlmZddlmZmZmZGdddejZdS))*) cmf_session)datetime timedeltatimezonecseZdZiZeeje j ddgZ e ed<ej feZ dZddddgZed d d Zeed d d ZdedddZddZededddZfddZZS) CmfSessionZcmfZ templatesloaderTgetsgettfa_check_code tfa_send_code)returncCs|jjdd}t|S)N:)idvaluesplitcmfutilZcrypt)selfmessager./cmf/models/cmf_session.py get_tokenszCmfSession.get_tokenc CsVzt|}WntdYdSXtjjd|dddgd}|rtt j }||j t |j jdkr|d g|j|}|rRtjd d }|jj|_|jj|_|jj|_|jstjrtjj|jkrd }tjD]6}|d rtj|dgd}|dtjd|j7}q||_d|_ d |_!td|jd|jd|j!||fSdS)NuDНе удалось расшифровать токен сессии)NNz CmfSession:Frplugin)rZexpiredfields)Zsecondszplugin.plugin.*T)emptyzCmfPersonGroup:code)r rzfrom_session_token: jwt is ok, z, z , is_local=)"rdecryptgdebugmodelsrr rnowrZutcZ reauth_daterZaccess_token_expires_inr load_fieldsrZ refresh_tokenCmfAuth user_loginZloginZ user_emailemailZ user_scopescope current_userZcurrent_person__member_of startswithZ get_obj_by_idconfigZORG_NAMErZjwt_is_supportZjwt_is_match_org) clsZ session_tokenZdecrypted_tokensessionr$objr)Zgroup_idgrouprrr from_tokens8           "zCmfSession.from_tokenNany)two_factor_optcs.fdd}fdd}ddldddgtjjjd d d gd jsjtd ddS|sv}|r*j rj j  dkrtddj j  dSd fddt dD_j |dkr||n"|dkr|n|dkr*|dS)NcsXdksdkrTjjs0tdddddStj}|jjjjddS)Nr2phoneУ абонента u. не указан номер телефонаTabortu& ваш проверочный код.) two_factorr4 cmf_alertr#ZCmfPluginSMSGateZget_local_smsgate send_messageZnumbersms_code)Zsms_gatemethodpersonrrrsend_sms>s  z*CmfSession.tfa_send_code..send_smscspdksdkrljjs0tdddddSjd}|jjd}tj }|j jjj |d d dS) Nr2r(r5u не указан emailTr6z tfa_mail.html)Ztfa_coder>uJКод безопасности для учетной записи EvaTeam)Zsubject) r8r(r9 _jinja_envZ get_templateZrenderr;r#ZCmfPluginMailBoxZget_local_mailboxr:r)templateZ email_bodyZmail_boxr<rr send_emailFs  z,CmfSession.tfa_send_code..send_emailr sms_send_timer;user_id two_factor.*two_factor.two_factor_optrrruУ пользователя u не настроена 2FAuKСледующая отправка будет доступна через rc3s|]}tddVqdS)r N)strZrandint).0_)randomrr `sz+CmfSession.tfa_send_code..r2Zsmsr()rMr%r# CmfPersonr rDr8r9get_two_factor_optrCr$Z total_secondsjoinranger;set_nowsave)rr3r=r?rBr)r=r>rMrrr =s4     zCmfSession.tfa_send_codecCsddlm}|jrdS|jtjjjkr.tj}ntj j |jdddgd}| r|j r`tj js`dSdtji}||}ttd|}tj d d |jd <d |jd <d|jd<|SdS)Nr) urlencodeis_adminZ is_supportrFrGZnext_urlzauth/two-factor?ZOriginrzAccess-Control-Allow-Origintruez Access-Control-Allow-CredentialszContent-Type, x-ijtzAccess-Control-Allow-Headers)Z urllib.parserVcheckedrDr!r*rrr#rPr rQrWZglobal_settingsZtwo_factor_adminZrequestZurlZredirectZauth_base_hrefZheaders)rrVr>paramsZqsrrrrtfa_check_two_factorks&    zCmfSession.tfa_check_two_factorr4)rc Csddl}tjjtjjddgd}d}|dkrTdD]"}t|j|r0| dd}qTq0|sft d|tjj d 7_ tjj tjj|k}rd tj_nD|jjrt||jj}W5QRX||}rd tj_|rt|j|d d |jtj|S) NrrErrGF)Zapplication_verifiedZemail_verifiedZphone_verifiedrLuНеобходимо указать метод авторизации по которому происходит проверка method=rTZ _verified)pyotpr#rPr r!r.rDgetattrr8rAssertionErrorZ sms_try_countZ sms_try_timerTr;rYZ topt_secretrZ disable_aclZTOTPr ZverifysetattrrU)rr=r]r>resultmZtotprrrr s.      zCmfSession.tfa_check_codec s<tjjddt|jt|jddd|j|jd tj||S)NZlogin_successedr&okTr) ZoperateZcmf_model_nameZ cmf_authorparentZ result_statusZcurrent_transactionZsecurity_level parent_nameZ parent_code)r#ZCmfAuditZ audit_eventrJrDr'superrU)rargskwargs __class__rrrUszCmfSession.save)Nr2)r4)__name__ __module__ __qualname__Z_optionsZjinja2ZFileSystemLoaderospathrRr,Z PROJECT_DIRZ_loaderZ Environmentr@Z api_allowZ api_methodsrJr classmethodr1r r\ staticmethodr rU __classcell__rrrirrs$ $.rN)Z cmf.includerrrrrrrrrrs