U
    ‡äVcy  ã                   @   s>   d Z ddlmZ ddlmZ dZe e¡ZG dd„ deƒZ	dS )aÝ  
Implementation of a domain controller that uses realm/user_name/password mappings
from the configuration file and uses the share path as realm name.

user_mapping is defined a follows::

    simple_dc: {
        user_mapping = {
            "realm1": {
                "John Smith": {
                    "password": "YouNeverGuessMe",
                },
                "Dan Brown": {
                    "password": "DontGuessMeEither",
                    "roles": ["editor"]
                }
            },
            "realm2": {
                ...
            }
        },
    }

The "*" pseudo-share is used to pass a default definition::

    user_mapping = {
        "*": {  // every share except for 'realm2'
            "Dan Brown": {
                "password": "DontGuessMeEither",
                "roles": ["editor"]
            }
        },
        "realm2": {
            ...
        }
    },

A share (even the "*" pseudo-share) can be set to True to allow anonymous access::

    user_mapping = {
        "*": {
            "Dan Brown": {
                "password": "DontGuessMeEither",
                "roles": ["editor"]
            },
        },
        "realm2": True
    },

The SimpleDomainController fulfills the requirements of a DomainController as
used for authentication with http_authenticator.HTTPAuthenticator for the
WsgiDAV application.

Domain Controllers must provide the methods as described in
DomainControllerBase_

.. _DomainControllerBase : dc/base_dc.py

é    )Úutil)ÚBaseDomainControllerÚreStructuredTextc                       sV   e Zd Z‡ fdd„Zdd„ Zddd„Zdd	„ Zd
d„ Zdd„ Zdd„ Z	dd„ Z
‡  ZS )ÚSimpleDomainControllerc                    sv   t t| ƒ ||¡ | di ¡}| d¡| _| jd kr<tdƒ‚| j ¡ D ]*\}}t|ƒtt	fksb|sFtd 
|¡ƒ‚qFd S )NÚ	simple_dcÚuser_mappingz&Missing option: simple_dc.user_mappingzMInvalid option: simple_dc.user_mapping['{}']: must be True or non-empty dict.)Úsuperr   Ú__init__ÚgetÚuser_mapÚRuntimeErrorÚitemsÚtypeÚboolÚdictÚformat)ÚselfÚwsgidav_appÚconfigZdc_confÚshareÚdata©Ú	__class__© ú$/opt/wsgidav/wsgidav/dc/simple_dc.pyr	   K   s    
ÿÿzSimpleDomainController.__init__c                 C   s   d  | jj¡S )Nz{}())r   r   Ú__name__©r   r   r   r   Ú__str__\   s    zSimpleDomainController.__str__Nc                 C   s>   | j  |¡}|dkr | j  d¡}|dks0|dkr4|S | |¡S )zHReturn the matching user_map entry (falling back to default '*' if any).NÚ*)r   r
   )r   ÚrealmÚ	user_nameÚrealm_entryr   r   r   Ú_get_realm_entry_   s    z'SimpleDomainController._get_realm_entryc                 C   s   |   ||¡}|S )z5Resolve a relative url to the appropriate realm name.)Z_calc_realm_from_path_provider)r   Ú	path_infoÚenvironr   r   r   r   Úget_domain_realmh   s    z'SimpleDomainController.get_domain_realmc                 C   s*   |   |¡}|dkr"t d |¡¡ |dk	S )zUReturn True if this realm requires authentication (grant anonymous access otherwise).NzUMissing configuration simple_dc.user_mapping["{}"] (or "*"): realm is not accessible!T)r"   Ú_loggerÚerrorr   )r   r   r$   r!   r   r   r   Úrequire_authenticationm   s    
ÿÿz-SimpleDomainController.require_authenticationc                 C   s:   |   ||¡}|dk	r6|| d¡kr6| dg ¡|d< dS dS )z|Returns True if this user_name/password pair is valid for the realm,
        False otherwise. Used for basic authentication.NÚpasswordÚrolesúwsgidav.auth.rolesTF)r"   r
   )r   r   r    r)   r$   Úuserr   r   r   Úbasic_auth_userw   s
    z&SimpleDomainController.basic_auth_userc                 C   s   dS )NTr   r   r   r   r   Úsupports_http_digest_auth   s    z0SimpleDomainController.supports_http_digest_authc                 C   s@   |   ||¡}|dkrdS | d¡}| dg ¡|d< |  |||¡S )zComputes digest hash A1 part.NFr)   r*   r+   )r"   r
   Z_compute_http_digest_a1)r   r   r    r$   r,   r)   r   r   r   Údigest_auth_user…   s    
z'SimpleDomainController.digest_auth_user)N)r   Ú
__module__Ú__qualname__r	   r   r"   r%   r(   r-   r.   r/   Ú__classcell__r   r   r   r   r   J   s   
	

r   N)
Ú__doc__Úwsgidavr   Zwsgidav.dc.base_dcr   Ú__docformat__Úget_module_loggerr   r&   r   r   r   r   r   Ú<module>   s
   ;
