U
    BdR'                     @   s6   d dl mZ d dlT ddlmZ G dd dejZdS )    )fields)*   )cmf_auth_openid_pluginc                       s   e Zd Zejjd ZdZedd Zdd Z	 fddZ
 fd	d
ZedddZeedddZedddZdd Zedd ZdddZ  ZS )CmfAuthOpenIdPlugin)loggerNc                 C   sB   | j s<ddlm} tj}tjr$tj}|j|  dd|d| _ | j S )Nr   )
log_config
   i@KL )ZbackupCountZmaxByteslevel)	_CmfAuthOpenIdPlugin__loggerZcmf.modules.logsr   ZloggingINFOconfigDEBUGZ
get_loggerZget_files_dir)selfr   r
    r   ../modules/sso/models/cmf_auth_openid_plugin.pyr      s    zCmfAuthOpenIdPlugin.loggerc                 C   s0   | j js| jjjsd S tjdtj	dd| _ d S )Nzhttps://Zssozopenid-connect)
callback_urlis_nullpluginext_url
is_changedospathjoinr   Z
ORG_DOMAINr   r   r   r   _check_callback_url   s    z'CmfAuthOpenIdPlugin._check_callback_urlc                    s   t   ddg S )Nr   zplugin.ext_url)supersave_preload_fieldsr   	__class__r   r   r      s    z'CmfAuthOpenIdPlugin.save_preload_fieldsc                    s,   |    | jjrtjdd| _t j||S )Nr   )type)r   r   r   modelsZ	CmfPluginr   save)r   argskwargsr   r   r   r"      s    zCmfAuthOpenIdPlugin.savecodec           	   	   C   sb  dd l }| ddg | jdkrN| jj|dg| jjd}| j|d |d< n|jt	j
| jjjd	| jjjd
 }t|d}| jjj|d< | jj|d< t  | jj |d< W 5 Q R X d|d< ddi}|j|d ||| jjjd}|  | }d|krd| dd|d  i}|j|d || jjjd}|  | |d< | jd|  |S )Nr   app_typeplugin.*keycloakZauthorization_code)r&   
grant_typeredirect_uriaccess_tokenuserinfo_data .well-known/openid-configurationverifyr%   	client_idr+   client_secretr*   content-type!application/x-www-form-urlencodedtoken_endpointdataheadersr0   erroru>   Сервер авторизации вернул ошибку ZAuthorizationzBearer Zuserinfo_endpoint)r8   r0   u   Получили токен )requestsload_fieldsr'   client_keycloaktokenr   valueZuserinfogetr   r   r   r   r   
verify_ssljsondictext_client_idcmfutildisable_acl
ext_secretdecryptpostraise_for_statusr   info)	r   r&   r:   r=   openid_confparamsr8   resZuserinfo_responser   r   r   	get_token$   s8    





zCmfAuthOpenIdPlugin.get_token)r,   c                 C   s6   dd l }dd l}|| dd d }||}|S )Nr   .   ==)base64rA   Z	b64decodesplitloads)r,   rR   rA   Zdecoded_tokenZ
token_infor   r   r   unpack_tokenB   s
    
z CmfAuthOpenIdPlugin.unpack_token)jwtc                 C   s(  |  |d }| jd|  |d | jj}dddddg}tjj||d	}|d d}|d d}|d d
}|d d}	|d d}
|s|rtjjdd|g|d}|sF| jr>d}t	
||r|}n| d| j }tj||||||	d}tj g|_|  |
rFt|
}|jdkrF||j ntd||_| jr||_||_||_|	|_|
rt|
}|jdkr||j |jr|  tj|| d}|j  |j  |j |_!||_"|j#|_$|d|_%|d|_&|d |_'|d |_(tj)rtj)d |_*|  |S )Nr,   u.   Создаем сессию по access_token r-   	ext_loginname
first_name	last_nameemail)rW   r   Z
given_nameZfamily_nameZpictureloginrQ   )filterr   z0^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$@)rW   r\   r[   rX   rY   rZ      u1   Пользователя нет в системе)rV   r   refresh_tokenrefresh_expires_inscope
expires_inr   )+rU   r   rJ   r?   Zusername_claimr>   r!   Z	CmfPersonZcreate_new_userrematchdomainZCmfPersonGroupZ
user_groupZrg_member_ofr"   requestZstatus_codeZ
set_avatarZcontent	ExceptionrW   Zupdate_userrX   r[   rY   rZ   r   Z
CmfSessionZ	auth_dateset_nowreauth_dater\   Z
user_loginZ
user_emailidZuser_idr`   lifetimerb   access_token_expires_inZaccess_routeZ	client_ip)r   rV   ZpayloadrW   _fieldsZpersonr[   rX   rY   rZ   Zpicture_urlpatternZ	cmf_loginrM   sessionr   r   r   get_sessionN   sp    
  





zCmfAuthOpenIdPlugin.get_sessionc              	   C   s^  dd l }z| jd|jj  | ddg | jr:t| jdkrV| j	
|j
j}n|jtj| jjjd| jjjd }t ( t|j
jd| jjj| jj d	}W 5 Q R X d
di}|j|d ||| jjjd}|  | }|r$|j  |d |_|d |_
|d |_|  |W S W n2   | j d|jj  d|_!|  Y d S X d S )Nr   u    Обновляем сессию disabledr(   r)   r.   r/   r`   )r`   r*   r1   r2   r3   r4   r5   r6   ra   rc   uA   Ошибка обновления сессии по токену T)"r:   r   rJ   rk   r>   r;   rr   AssertionErrorr'   r<   r`   r?   r   r   r   r   r   r@   rA   rD   rE   rB   rC   rF   rG   rH   rI   rj   ri   rl   rm   r"   	exceptionZexpired)r   rp   r:   rV   rK   rL   r8   rM   r   r   r   r`      sD    









z!CmfAuthOpenIdPlugin.refresh_tokenc              
   C   sj   ddl m} | dg t @ || jjj| jjj| jj	j| jj
 | jjjdW  5 Q R  S Q R X d S )Nr   )KeycloakOpenIDr(   )Z
server_urlr1   Z
realm_nameZclient_secret_keyr0   )r)   ru   r;   rD   rE   r   r   r>   rC   Zext_realm_namerF   rG   r@   )r   ru   r   r   r   r<      s    


z#CmfAuthOpenIdPlugin.client_keycloakc           	      C   s   ddl m} dd l}|stj}| dg ztd|i}| jdkr`| j	j
| jj| jj|d}n|jtj| jjjd| jjjd }t }| jjj|d	< | jj|d
< d|d< | jj|d< td|i|d< ||}|d  d| }| jd|  t|W S    | jd Y nX d S )Nr   )	urlencoder(   next_urlr)   )r+   rb   stater.   r/   r1   r+   r&   Zresponse_typerb   rx   Zauthorization_endpoint?u\   Редиректим пользователя на страницу авторизации: u#   Ошибка SSO редиректа)Zurllib.parserv   r:   rg   Zurlr;   rA   dumpsr'   r<   Zauth_urlr   r>   rb   r?   r   r   r   r   r   r@   rB   rC   r   rJ   Zredirectrt   )	r   rw   rv   r:   Zstate_paramsZ	login_urlrK   rL   Zqsr   r   r   login_redirect   s6    
 

z"CmfAuthOpenIdPlugin.login_redirect)N)__name__
__module____qualname__r   r   Zui_meta_skipr   propertyr   r   r   r"   strrN   staticmethodrU   rB   rq   r`   r<   r{   __classcell__r   r   r   r   r      s   
	<"

r   N)Zcmfr   Zcmf.includer   r   r   r   r   r   <module>   s   