U
    7gd{&                     @   s6   d dl mZ d dlT ddlmZ G dd dejZdS )    )fields)*   )cmf_auth_openid_pluginc                       s   e Zd Zejjd ZdZedd Zdd Z	 fddZ
 fd	d
ZedddZeedddZedddZdd Zedd Zdd Z  ZS )CmfAuthOpenIdPlugin)loggerNc                 C   sB   | j s<ddlm} tj}tjr$tj}|j|  dd|d| _ | j S )Nr   )
log_config
   i@KL )ZbackupCountZmaxByteslevel)	_CmfAuthOpenIdPlugin__loggerZcmf.modules.logsr   ZloggingINFOconfigDEBUGZ
get_loggerZget_files_dir)selfr   r
    r   ../modules/sso/models/cmf_auth_openid_plugin.pyr      s    zCmfAuthOpenIdPlugin.loggerc                 C   s0   | j js| jjjsd S tjdtj	dd| _ d S )Nzhttps://Zssozopenid-connect)
callback_urlis_nullpluginext_url
is_changedospathjoinr   Z
ORG_DOMAINr   r   r   r   _check_callback_url   s    z'CmfAuthOpenIdPlugin._check_callback_urlc                    s   t   ddg S )Nr   zplugin.ext_url)supersave_preload_fieldsr   	__class__r   r   r      s    z'CmfAuthOpenIdPlugin.save_preload_fieldsc                    s,   |    | jjrtjdd| _t j||S )Nr   )type)r   r   r   modelsZ	CmfPluginr   save)r   argskwargsr   r   r   r"      s    zCmfAuthOpenIdPlugin.savecodec           	      C   sL  dd l }| ddg | jdkrN| jj|dg| jjd}| j|d |d< n|jt	j
| jjjd	| jjjd
 }t|d}| jjj|d< | jj|d< | jj |d< d|d< ddi}|j|d ||| jjjd}|  | }d|krd| dd|d  i}|j|d || jjjd}|  | |d< | jd|  |S )Nr   app_typeplugin.*keycloakZauthorization_code)r&   
grant_typeredirect_uriaccess_tokenuserinfo_data .well-known/openid-configurationverifyr%   	client_idr+   client_secretr*   content-type!application/x-www-form-urlencodedtoken_endpointdataheadersr0   erroru>   Сервер авторизации вернул ошибку ZAuthorizationzBearer Zuserinfo_endpoint)r8   r0   u   Получили токен )requestsload_fieldsr'   client_keycloaktokenr   valueZuserinfogetr   r   r   r   r   
verify_ssljsondictext_client_id
ext_secretdecryptpostraise_for_statusr   info)	r   r&   r:   r=   openid_confparamsr8   resZuserinfo_responser   r   r   	get_token$   s6    



zCmfAuthOpenIdPlugin.get_token)r,   c                 C   s6   dd l }dd l}|| dd d }||}|S )Nr   .   ==)base64rA   Z	b64decodesplitloads)r,   rP   rA   Zdecoded_tokenZ
token_infor   r   r   unpack_tokenA   s
    
z CmfAuthOpenIdPlugin.unpack_token)jwtc                 C   s(  |  |d }| jd|  |d | jj}dddddg}tjj||d	}|d d}|d d}|d d
}|d d}	|d d}
|s|rtjjdd|g|d}|sF| jr>d}t	
||r|}n| d| j }tj||||||	d}tj g|_|  |
rFt|
}|jdkrF||j ntd||_| jr||_||_||_|	|_|
rt|
}|jdkr||j |jr|  tj|| d}|j  |j  |j |_!||_"|j#|_$|d|_%|d|_&|d |_'|d |_(tj)rtj)d |_*|  |S )Nr,   u.   Создаем сессию по access_token r-   	ext_loginname
first_name	last_nameemail)rU   r   Z
given_nameZfamily_nameZpictureloginrO   )filterr   z0^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$@)rU   rZ   rY   rV   rW   rX      u1   Пользователя нет в системе)rT   r   refresh_tokenrefresh_expires_inscope
expires_inr   )+rS   r   rH   r?   Zusername_claimr>   r!   Z	CmfPersonZcreate_new_userrematchdomainZCmfPersonGroupZ
user_groupZrg_member_ofr"   requestZstatus_codeZ
set_avatarZcontent	ExceptionrU   Zupdate_userrV   rY   rW   rX   r   Z
CmfSessionZ	auth_dateset_nowreauth_daterZ   Z
user_loginZ
user_emailidZuser_idr^   lifetimer`   access_token_expires_inZaccess_routeZ	client_ip)r   rT   ZpayloadrU   _fieldsZpersonrY   rV   rW   rX   Zpicture_urlpatternZ	cmf_loginrK   sessionr   r   r   get_sessionM   sp    
  





zCmfAuthOpenIdPlugin.get_sessionc                 C   sJ  dd l }z| jd|jj  | ddg | jr:t| jdkrV| j	
|j
j}n~|jtj| jjjd| jjjd }t|j
jd| jjj| jj d	}d
di}|j|d ||| jjjd}|  | }|r|j  |d |_|d |_
|d |_|  |W S W n2   | jd|jj  d|_|  Y d S X d S )Nr   u    Обновляем сессию disabledr(   r)   r.   r/   r^   )r^   r*   r1   r2   r3   r4   r5   r6   r_   ra   uA   Ошибка обновления сессии по токену T) r:   r   rH   ri   r>   r;   rp   AssertionErrorr'   r<   r^   r?   r   r   r   r   r   r@   rA   rB   rC   rD   rE   rF   rG   rh   rg   rj   rk   r"   	exceptionZexpired)r   rn   r:   rT   rI   rJ   r8   rK   r   r   r   r^      sB    








z!CmfAuthOpenIdPlugin.refresh_tokenc                 C   sJ   ddl m} | dg || jjj| jjj| jjj| jj	 | jj
jdS )Nr   )KeycloakOpenIDr(   )Z
server_urlr1   Z
realm_nameZclient_secret_keyr0   )r)   rs   r;   r   r   r>   rC   Zext_realm_namerD   rE   r@   )r   rs   r   r   r   r<      s    

z#CmfAuthOpenIdPlugin.client_keycloakc                 C   s  ddl m} dd l}| dg ztdtji}| jdkrX| j	j
| jj| jj|d}n|jtj| jjjd| jjjd }t }| jjj|d	< | jj|d
< d|d< | jj|d< tdtji|d< ||}|d  d| }| jd|  t|W S    | jd Y nX d S )Nr   )	urlencoder(   Znext_urlr)   )r+   r`   stater.   r/   r1   r+   r&   Zresponse_typer`   ru   Zauthorization_endpoint?u\   Редиректим пользователя на страницу авторизации: u#   Ошибка SSO редиректа)Zurllib.parsert   r:   r;   rA   dumpsre   Zurlr'   r<   Zauth_urlr   r>   r`   r?   r   r   r   r   r   r@   rB   rC   r   rH   Zredirectrr   )r   rt   r:   Zstate_paramsZ	login_urlrI   rJ   Zqsr   r   r   login_redirect   s2    
 

z"CmfAuthOpenIdPlugin.login_redirect)__name__
__module____qualname__r   r   Zui_meta_skipr   propertyr   r   r   r"   strrL   staticmethodrS   rB   ro   r^   r<   rx   __classcell__r   r   r   r   r      s   
	<!
	r   N)Zcmfr   Zcmf.includer   r   r   r   r   r   <module>   s   