U
    (Kf                     @   s>   d dl T ddlmZ d dlmZmZmZ G dd dejZdS )    )*   )cmf_session)datetime	timedeltatimezonec                       s   e Zd Zi Zeeje	j
ddgZeed< ejf eZedddZeedddZdedddZdd ZededddZ fddZ  ZS )
CmfSessionZcmfZ	templatesloader)returnc                 C   s   | j jdd }t|S )N:   )idvaluesplitcmfutilZcrypt)selfmessage r   ./cmf/models/cmf_session.py	get_token   s    zCmfSession.get_tokenc                 C   s   zt |}W n   td Y dS X tjjd| dddgd}|rtt	j
}||jt|jjd kr|d	g |j|}|rtjd
d}|jj|_|jj|_|jj|_d|_d
|_td|j d|j d|j  ||fS dS )NuD   Не удалось расшифровать токен сессии)NNzCmfSession:Fr   plugin)r   Zexpiredfields)Zsecondszplugin.plugin.*T)emptyzfrom_session_token: jwt is ok, z, z, is_local=)r   decryptgdebugmodelsr   getr   nowr   ZutcZreauth_dater   Zaccess_token_expires_inr   load_fieldsr   Zrefresh_tokenCmfAuth
user_loginZloginZ
user_emailemailZ
user_scopeZscopeZjwt_is_supportZjwt_is_match_org)clsZsession_tokenZdecrypted_tokensessionr   objr   r   r   
from_token   s*    



"zCmfSession.from_tokenNany)two_factor_optc                    s.   fdd} fdd}dd l dddg tjjjd	d
dgdjsjtd d d S |sv }|r*j	rj	
 j	  dk rtddj	
 j	     d S dfddtdD _j	    |dkr|  |  n"|dkr|  n|dkr*|  d S )Nc                     sX    dks dkrTj js0td ddd d S tj } | j jjj d d S )Nr'   phone   У абонента u.    не указан номер телефонаTabortu&    ваш проверочный код.)	
two_factorr)   	cmf_alertr   ZCmfPluginSMSGateZget_local_smsgatesend_messageZnumbersms_code)Zsms_gatemethodpersonr   r   r   send_sms,   s    
z*CmfSession.tfa_send_code.<locals>.send_smsc                     sp    dks dkrlj js0td ddd d S jd} | jjd}tj	 }|j
j jj|d	d
 d S )Nr'   r"   r*   u    не указан emailTr+   ztfa_mail.html)Ztfa_coder3   uJ   Код безопасности для учетной записи EvaTeam)Zsubject)r-   r"   r.   
_jinja_envZget_templateZrenderr0   r   ZCmfPluginMailBoxZget_local_mailboxr/   r   )templateZ
email_bodyZmail_boxr1   r   r   
send_email4   s    
  z,CmfSession.tfa_send_code.<locals>.send_emailr   sms_send_timer0   user_idtwo_factor.*two_factor.two_factor_optr   r   r   u   У пользователя u    не настроена 2FA   uK   Следующая отправка будет доступна через  c                 3   s   | ]}t  d dV  qdS )r   	   N)strZrandint).0_)randomr   r   	<genexpr>N   s     z+CmfSession.tfa_send_code.<locals>.<genexpr>   r'   Zsmsr"   )rC   r   r   	CmfPersonr   r9   r-   r.   get_two_factor_optr8   r   Ztotal_secondsjoinranger0   set_nowsave)r   r(   r2   r4   r7   r   )r2   r3   rC   r   r   tfa_send_code+   s4    



zCmfSession.tfa_send_codec                 C   s   ddl m} | jrd S | jtjjjkr.tj}ntj	j
| jdddgd}| r|jr`tjjs`d S dtji}||}ttj d| }tj
d	d
|jd< d|jd< d|jd< |S d S )Nr   )	urlencodeis_adminZ
is_supportr;   r<   Znext_urlz/auth/two-factor?ZOriginr   zAccess-Control-Allow-Origintruez Access-Control-Allow-CredentialszContent-Type, x-ijtzAccess-Control-Allow-Headers)Zurllib.parserM   checkedr9   r   Zcurrent_userr   r   r   rF   r   rG   rN   Zglobal_settingsZtwo_factor_adminZrequestZurlZredirectconfigZAUTH_SERVER_URLZheaders)r   rM   r3   paramsZqsrr   r   r   tfa_check_two_factorY   s&     


zCmfSession.tfa_check_two_factorr)   )codec              	   C   s  dd l }tjjtjjddgd}d}|d krTdD ]"}t|j|r0|	dd } qTq0|sft
d| tj jd	7  _tjj  tjj| k }rd
tj_nD|jjrt  ||jj }W 5 Q R X ||  }rd
tj_|rt|j| dd
 |j  tj  |S )Nr   r:   r   r<   F)Zapplication_verifiedZemail_verifiedZphone_verifiedrB   u   Необходимо указать метод авторизации по которому происходит проверка method=r   TZ	_verified)pyotpr   rF   r   r   r$   r9   getattrr-   r   AssertionErrorZsms_try_countZsms_try_timerJ   r0   rP   Ztopt_secretr   Zdisable_aclZTOTPr   ZverifysetattrrK   )rU   r2   rV   r3   resultmZtotpr   r   r   tfa_check_codem   s.    



zCmfSession.tfa_check_codec                    s<   t jjddt| jt| jddd| j| jd	 t j||S )NZlogin_successedr    okTr   )	ZoperateZcmf_model_nameZ
cmf_authorparentZresult_statusZcurrent_transactionZsecurity_levelparent_nameZparent_code)r   ZCmfAuditZaudit_eventr@   r9   r!   superrK   )r   argskwargs	__class__r   r   rK      s          zCmfSession.save)Nr'   )r)   )__name__
__module____qualname__Z_optionsZjinja2ZFileSystemLoaderospathrH   rQ   ZPROJECT_DIRZ_loaderZEnvironmentr5   r@   r   classmethodr&   rL   rT   staticmethodr\   rK   __classcell__r   r   rc   r   r      s   .r   N)Zcmf.includer   r   r   r   r   r   r   r   r   r   <module>   s   