
    Y~h.                         d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d d	lT d
dlmZ ddlmZ ddlmZ d
dlmZ  G d dej                  ZdS )    N)pbkdf2_hmac)AES)SHA256)RSA)get_random_bytes)
PKCS1_v1_5)pad)*   )
send_email   )auth)LdapStatusCode)
Supervisorc                       e Zd ZdZdZe                    e                    ej	        
                    ej        ddd          g                    Zed             Zed             Zd	 Zed
             Zd?dZed             Zd@dZd ZdAdZedefd            ZdAdefdZed             Zed             Zed             Z ed             Z!ed             Z"d Z#d Z$d Z%d Z&ed              Z'ed!             Z(ed"             Z)d# Z*dBd$Z+dBd%Z,ed&             Z-ed'             Z.dCd)Z/	 	 dDd*e0d+e1d,e1d-e1d.ef
d/Z2ed0             Z3edBd1            Z4 fd2Z5d3 Z6ed4             Z7ed5e8fd6            Z9ed7             Z:ed8             Z;ed9             Z<edBd:            Z=e e>dd;dd<=          d>                         Z? xZ@S )ECmfAuth    
   modulesr   	templates)loaderc                 f    t          j        | j                            d          d                   S )N$base64	b64decode	pass_hashsplitselfs    ./modules/auth/models/auth.pykeyzCmfAuth.key#   (     4 4S 9 9" =>>>    c                 f    t          j        | j                            d          d                   S )Nr   r   r    s    r"   saltzCmfAuth.salt'   r$   r%   c                     t          j        | j                  }|t          t	          t          j                                        z  }|| j                                        z  }|S N)secrets	token_hextoken_lengthstrinttimer(   hex)r!   server_challenges     r"   gen_server_challengezCmfAuth.gen_server_challenge+   sR    ",T->??CDIKK 0 0111DIMMOO+r%   c                    d| j         dz  }}|||         }||dz   }}|||         }|t          |          }}t                              |||                   }t	          j        d|                                |d          }	t          j        | j                   }
t          t          t          j                                        }||
z   |z   |z   }t          t          j                  }t          j        |	t          j        |          }|                    t%          |                                t          j                            }||z                                   S )Nr   r   r   sha256順 )r-   lenbytesfromhexhashlibr   encoder+   r,   r.   r/   r0   r   r   
block_sizenewMODE_CBCencryptr	   r1   )clsloginpasswordr2   startendserver_randomserver_timestampserver_salttest_keyclient_randomsecretivcipherencrypted_secrets                  r"   test_gen_server_challenge_respz&CmfAuth.test_gen_server_challenge_resp1   s7   (1,s(s3#(s+E#I6#.//smm$4U3Y$?@@&hoo''g
 
  )#*:;;s49;;//00.1AAEIcn--3<44!>>#fmmoos~*N*NOO%%**,,,r%   restore_passwordFc                 P   |                      d           t          | j                  }|dk    r
| j        |d<   |r5t	          d           d| d	t
          j                            |           S t	          d           d
| d	t
          j                            |           S )u   
        Сформируем ссылку на сброс и отправим её пользователю.
        Альтернативно переиспользуется для приглашения нового пользователя.
        F)reset)hrO   rA   T)absolutezservicedesk/auth/?zauth/)reset_pass_set_datadictreset_password_hashrA   auth_base_hrefurllibparse	urlencode)r!   endpointsdeskparamss       r"   reset_pass_linkzCmfAuth.reset_pass_linkN   s    
 	  u ---0111)))"jF7O 	f$d333qqhqqQWQ]QgQghnQoQoqqq$d333ee(eeV\E[E[\bEcEceeer%   c           	      T   t           j                            |g d          }|sht                                          5  t           j                            ddd |dddd	           d d d            n# 1 swxY w Y   t          d
          |j        r|j        t          j	                    k    r|j        dz
  t          j	                    dz
  k    rht                                          5  t           j                            ddd |dddd	           d d d            n# 1 swxY w Y   t          d          dt          j         } |j                    }| j                            d          }|                    |t                    }t           j                                        }|                    |j        j        ||           t                                          5  t           j                            ddd d|idd	           d d d            d S # 1 swxY w Y   d S )N)reset_password_expiresrA   emailrA   fieldsrestore_password_get_linkr   zLogin not foundrA   reasonfailT)operatecmf_model_nameparent
audit_dataresult_statuscurrent_transactionu,   Такого пользователя нетQ i,  zAlready sentu   Вам на почту уже отправлена ссылка для сброса пароля. Для повторной отправки повторите попытку позже.uC   Ссылка для восстановления доступа к zreset_password_email.html)restore_linkconfig)subjectrA   ok)modelsr   getcmfutildisable_aclCmfAuditaudit_eventCmfAuthErrorra   r0   CmfErrorrq   HOSTNAME_FQDNr_   
_jinja_envget_templaterenderCmfPluginMailBoxget_local_mailboxsend_messagerb   value)r@   rA   r   rr   linktemplatemessagemail_boxs           r"   send_pass_linkzCmfAuth.send_pass_link]   sB   ~!!6b6b6b!cc 	O$$&& \ \++4O`i37e_pDqDq:@VZ , \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ MNNN& 		w+dikk99+|<ty{{f?UUU$$&& \ \++4O`i37e_mDnDn:@VZ , \ \ \\ \ \ \ \ \ \ \ \ \ \ \ \ \ \  v w w wnX^Xlnn#t#%%>../JKK//tF/CC*<<>>dj.III  "" 	V 	VO''0K\e/3%@P6:PT ( V V V	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	V 	Vs5   )A44A8;A8,)D!!D%(D%((HH!$H!Tc                     |rdnt          j        d          | _        |rdn"t          t	          j                              dz   | _        |                                  dS )u  
        Выставляем (или сбрасываем) секретик для сброса пароля
        Не очень хорошо, наверное хранить его в чистом виде, если упрут базу account будет печально,
        т.к. по сути даст доступ ко всем, кто в течение часа до угона БД запросил восстановление пароля.
        По хорошему хэшировать чем-то, что хранится отдельно от БД и периодически менять.
        Но это TODO-преTODO, т.к. паранойя.
        12 байт рандома дают нам 2**(8*12)=79,2E+27 значений. Перебирать по 1 в сек по сети - 2,5E+21 лет.
        :param reset - если True, выставляем всё в None, если False - генерируем новые значения
        N   ro   )r+   token_urlsaferW   r/   r0   ra   save)r!   rQ   s     r"   rU   zCmfAuth.reset_pass_set_data~   sU     ,1#O44g6KB6O6O .3&XddTY[[9I9IL9X#		r%   c                 J    | j          pt          j                    | j         k    S )u_    Проверяем что ссылка для сброса пароля не протухла )ra   r0   r    s    r"   reset_pass_is_expiredzCmfAuth.reset_pass_is_expired   s!    ..[$)++@[2[[r%   Nc                    ddd}|>| j         j        t          t          j                    d|z  z             | j        j        d}t          j        t          j        |          	                                          
                                }t          j        t          j        |          	                                          
                                }| d| S )NRS256JWT)algtypro   )rA   expscope.)rA   r   r/   r0   r   r   	b64encodejsondumpsr;   decode)r!   dayspayloadheaders       r"   
create_jwtzCmfAuth.create_jwt   s     //?)49;;)<<==) G
 !$*V"4"4";";"="=>>EEGG"4:g#6#6#=#=#?#?@@GGII$$7$$$r%   jwtc                 P   t          j        t          j        | d                                                                                             }t          j        t          j        | d                                                                                             }| d| S )Nr   r   r   )r   r   r   r   r;   r   )r   r   r   s      r"   
jwt_to_strzCmfAuth.jwt_to_str   s    !$*S]";";"B"B"D"DEELLNN"4:c)n#=#=#D#D#F#FGGNNPP$$7$$$r%   c                 h   ||                      |          }t          j        t          j                  }t          j                    }|                    |                                           |                    |          }t          j
        |                                          }| d| }|S )Nr   )r   r   r=   APPrsa_private_keyr   updater;   signr   r   r   )r!   r   r   signerdigestr   ress          r"   rsa_sign_pack_jwtzCmfAuth.rsa_sign_pack_jwt   s    ;//$''C 344cjjll###{{6""%%,,..ootoo
r%   c                    |                      d          \  }}}t          j                    }| d| }|                    |                                           t          j        |          }t          j        t          j	                  }|
                    ||          }|sd S t          j        |                                          }t          j        |                                          }t          j        |          }t          j        |          }t          t          j                              t          |d                   k    r5t                               dt          j                    |d                    d S ||dS )Nr   r   u9   Время жизни токена закончилосьr   r   )r   r   r=   r   r;   r   r   r   r   rsa_public_keyverifyr   r   loadsr/   r0   gdebug)rjwtr   r   	signaturer   r   verifierverifieds           r"   rsa_verify_unpack_jwtzCmfAuth.rsa_verify_unpack_jwt   sH   %)ZZ__"##'##cjjll###$Y//	>#"455??6955 	4!&))0022"7++2244F##*W%%ty{{c'%.1111GGOQUQZQ\Q\^efk^lmmm4 W555r%   c                 &   |                      d          \  }}}t          j        |                                          }t          j        |                                          }t	          j        |          }t	          j        |          }||dS )Nr   r   )r   r   r   r   r   r   )r   r   r   r   s       r"   rsa_unpack_jwtzCmfAuth.rsa_unpack_jwt   s|    %)ZZ__"!&))0022"7++2244F##*W%% W555r%   c                    |                      d          \  }}}t          j                    }| d| }|                    |                                           t          j        |          }d}	 t          j        |          }t          j        |          }	|	
                    ||          }nA# t          $ r4}
d|
 }t                              |           t          |          |
d }
~
ww xY w|S )Nr   Fu,   Не удалось разобрать JWT: )r   r   r=   r   r;   r   r   r   
import_keyr   r   
ValueErrorloggingerror)r   rsa_public_key_bytesr   r   r   r   r   r   r   r   er   s               r"   rsa_verify_jwtzCmfAuth.rsa_verify_jwt   s    %)ZZ__"##'##cjjll###$Y//		+ ^,@AAN!~n55H//&)44CC 	+ 	+ 	+F1FFEMM%   U##*	+ 
s   2>B1 1
C/;/C**C/c                 j   t                               d           |st                               d           d S 	 |                     |          }n8# t          $ r+}t          j                            d           d }Y d }~nd }~ww xY w|st                               d           d S  | d          }|d         d         |_        |d         d         |_        |d         d	         |_	        d |_
        d |_        d }t          j                            t          d
z             rUt!          t          d
z             5 }|                                                                }d d d            n# 1 swxY w Y   | |_        |j	        pd                    d          D ]e}|r|                    | d          rd|_        |dk    r<t           j        j        r+t                               d|            d|_
        d|_        ft                               d|j         d|j	         d|j                    |S )Nzfrom_jwt: startzfrom_jwt: warn not jwtzfail unpack jwtz2from_jwt: warn not cls.rsa_verify_unpack_jwt(rjwt)T)emptyr   rA   r   z/custom/org_name  :r
   uC   from_jwt: Доступ по билету тех поддержки zfrom_jwt: jwt is ok, z, z, is_local=)r   r   r   	Exceptionr   logger	exceptionrA   rb   r   jwt_is_supportjwt_is_match_orgospathexistsPROJECT_DIRopenreadstripr   
startswithglobal_settingssupport_mode)r@   r   r   r   objorg_namefperms           r"   from_jwtzCmfAuth.from_jwt   sr   	!""" 	GG,---4	++D11CC 	 	 	J  !2333CCCCCC	  	GGHIII4cooo	N7+		N7+		N7+	!#7>>+(::;; 	,k$6677 ,16688>>++, , , , , , , , , , , , , , , $,|Y_"++C00 	, 	,D ,t(~~~>> ,'+$s{{q0={c^accddd%)"'+$	a	aaSYaa3K_aabbb
s)   A 
B!B  B9'E,,E03E0c                 
   |                      dd|gdg          }|s|                      dd|gdg          }|s|                      dd|gdg          }|sgt          j        j                                        5  t
          j                            ddd d|id	d
d||	  	         d d d            n# 1 swxY w Y   d S |j        rt          
                    d|j         d           t          j        j                                        5  t
          j                            ddd |j        ddd	d
d|j        |j        	  	         d d d            n# 1 swxY w Y   t          dt          j        j         d           d S |j        j                             d          r|j                            d          \  }}t
          j                            |          rt
          j                            |dg          D ]0}	 |                    |j        j        |          }|t.          j        k    r n|t.          j        k    r|                                r d S |                                 t          j        j                                        5  t
          j                            ddd |j        j        dddd
d|j        j        |j        j        	  	         d d d            n# 1 swxY w Y   |c S # t8          $ r+}t          
                    d| d|            Y d }~*d }~ww xY wt          j        j                                        5  t
          j                            ddd |j        j        ddd	d
d|j        j        |j        j        	  	         d d d            n# 1 swxY w Y   |j        r8|j        j                             d          r|                     ||j        j                  r|                                rd S |                                 t          j        j                                        5  t
          j                            ddd |d ddd
d||	  	         d d d            n# 1 swxY w Y   |S t          j        j                                        5  t
          j                            ddd |d dd	d
d||	  	         d d d            n# 1 swxY w Y   |                                 d S )!N	ext_loginILIKEz***)filterrd   rA   rb   ident_failedr   rh   Tr   	ri   rj   rk   rl   rm   rn   security_levelparent_nameparent_codeus   Превышено количество попыток ввода пароля для учетной записи "u$   ", вход заблокированauth_failedzToo many failed login attemptsrf   un   Превышено количество попыток ввода пароля, повторите через u    минут
allow_ldap@)domainplugin.*)r   rd   auth_successedldap)rA   typers   u/   Ошибка авторизации через z: 
allow_basebase) ru   cmfutilrv   rw   rt   rx   ry   fail_block_end_dater   r   rA   	cmf_alertr   auth_fail_timeoutauth_optionsr   r   CmfAuthLdapPlugincountlistsigninr   r   INVALID_CREDENTIALSSUCCESS_is_permanent_blockauth_success_hookr   r   check_secretauth_fail_hook)	r@   rA   challenge_respr   _r   auth_pluginldap_status_coder   s	            r"   get_by_challenge_respzCmfAuth.get_by_challenge_resp  s   ggk7E:E7gKK 	L'''7E!:E7'KKC 	L'''7E!:E7'KKC 	!--// R R++NS\37WeDT:@VZkl8=5 , R R RR R R R R R R R R R R R R R R
 4" 	GG  z  KN  KT  z  z  z  {  {  {!--//  ++)#,),>^__"((,#$ #	 #	 , 
 
 
                 x  HI  HY  Hk  x  x  x  y  y  y4!%%l33 	r	,,IAv'--V-<< r#)#;#@#@WaVb#@#c#c ' 'K'+6+=+=cm>QSa+b+b( ,~/QQQ!E-1GGG"6688 ,'+tt11333!$!1!=!=!?!? ~ ~ & ; ;DTenCG^a^k^q  |B  UC  UCJNdhyzHKH[ilivi| !< !~ !~ !~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ $'JJJ H % f f f dR] d dab d deeeeeeeef& X%1133 r rO//V_7;RUR_ReouHvHv>DZ^op<?M<O]`]j]p 0 r r rr r r r r r r r r r r r r r r = 	VS-377EE 	V0CDD V**,,  4%%'''X%1133 C CO//8HYb7;RWagHhHh>BX\mn  }B<A 0 C C CC C C C C C C C C C C C C C C 
 X%1133 V VO//V_7;RWagHhHh>DZ^op<Au 0 V V VV V V V V V V V V V V V V V V 	ts   ;+B22B69B6;EEE K<A
K,,K0	3K0	<
L1 L,,L1A
N--N14N1,RR	R	5,S--S14S1c                    t           j        j        r| j        rt                               d| j         d           t          j        j        	                                5  t          j                            ddd | j        ddddd	| j        | j        
	  	         d d d            n# 1 swxY w Y   t          d           dS dS )Nu   Учетная запись "u3   " перманентно заблокированаr   r   zPermanent blockrf   rh   Tr   r   ul   Учетная запись заблокирована, обратитесь к администраторуF)r   r   auth_fail_permanent_blockfail_permanent_blockr   rA   r   r   rv   rw   rt   rx   ry   r   r    s    r"   r   zCmfAuth._is_permanent_blockh  s   6 	4;T 	GGsDJsssttt!--//  ++)#,)-?PQQ"((,#$ $
 $
 , 
 
 
                 E  F  F  F4us   ;B&&B*-B*c                    t           j        j        sd S | j        dk    rd S t          j                            dd           }d| }t          j                            |          }d	                    t          j        t          j        d                    }t          j                            ||           |s:t          j                            ddd |d	d
ddd||	  	         t%          d           |                                }|r||k    r<t          j                            ddd |dd
ddd||	  	         t%          d           d S d S )Nr   captchazauth:user_login_captcha:r      kr   r   zRequire captcharf   rh   Tr   r   i  zBad captcha)r   r   auth_check_captchafail_try_counterrequestvaluesru   r   REDIS_DBjoinrandomchoicesstringdigitssetrt   rx   ry   abortr   )r!   rA   r  db_key
db_captchanew_captchas         r"   _auth_check_captchazCmfAuth._auth_check_captcha  sr     3 	F A%%F.$$Y553E33\%%f--
ggfnV]a@@@AA--- 	O''i/3%[l@m@m6<RVgh49u ( N N N #JJJ&&((
 	'Z//O''i/3%[h@i@i6<RVgh49u ( N N N #JJJJJ 0/r%   c                 \   | xj         dz  c_         | j         t          j        j        k    rmt          j        j        rd| _        nMt          j                                        t          j        t          j        j	        j
                  z   | _        d| _         |                                  d S )Nr   T)minutesr   )r  r   r   auth_fail_try_countr  r  datetimenow	timedeltar   r   r   r   r    s    r"   r   zCmfAuth.auth_fail_hook  s    " A$5$III : ,0))+3+<+@+@+B+BXEW-?EF F F ,( %&D!		r%   c                 <    d| _         |                                  d S )Nr   )r  r   r    s    r"   r   zCmfAuth.auth_success_hook  s     !		r%   c                 b     |             }||_         ||_        |                    ||           |S r*   )rA   rb   set_pass_hash)r@   rA   hashr(   r   s        r"   new_from_login_hash_saltz CmfAuth.new_from_login_hash_salt  s6    cee		$%%%
r%   c           	      B   |                     d          }|d         }|dk    rk|dd          \  }}}t          j        |          }t          j        |          }	|	t          d|                                |t          |                    k    S t          d|           )Nr   r   pbkdf2_sha256r   r5   zNot Implemented for )r   r   r   r   r;   r/   NotImplementedError)
r@   rJ   secret_hash
hash_parts	hash_algon_itersalt_b64hash_b64salt_bhash_bs
             r"   r   zCmfAuth.check_secret  s     &&s++
qM	'')3ABB&FHh%h//F%h//F[6==??FCPVKKXXXX!"D"D"DEEEr%   c                    |                      |g d          }|r|                     ||j        j                  rgt          j        j                                        5  t          j	        
                    ddd|id ddd||		  	         d d d            n# 1 swxY w Y   |S t          j        j                                        5  t          j	        
                    d
dd|id ddd||		  	         d d d            n# 1 swxY w Y   d S )N)r   rA   r   rc   r   r   rA   rs   Tr   )	ri   rj   rl   rk   rm   rn   r   r   r   r   rh   )ru   r   r   r   r   r   rv   rw   rt   rx   ry   )r@   rA   rB   r   s       r"   from_login_passwordzCmfAuth.from_login_password  s   wwU+I+I+IwJJ 	$.*>?? X%1133 V VO//8HYb<CU;K7;4eiz{<Au 0 V V VV V V V V V V V V V V V V V V
 X))++ 	N 	NO''i4;U3C/36_ctu49u ( N N N	N 	N 	N 	N 	N 	N 	N 	N 	N 	N 	N 	N 	N 	N 	N
 ts$   +BBB+C==DDc                     t           j        j        sd S t          j                            | dgddgddg          D ]8}|j        r/|                     ||j                  rt          |j	                  9d S )Nz-cmf_created_atr      r   cmf_created_at)rk   order_byslicerd   )
r   r   password_check_historyrt   CmfAuthHistoryslistr   r   CmfAuthReusePasswordErrorr4  )r!   rB   historys      r"   check_historyzCmfAuth.check_history  s      7 	F,22'8&9!QQ\^nPo 3 q q 	L 	LG   L$$Xw/@AA L3G4JKKK	L 	Lr%   c                     t                               |          }t                               |          }|                     |||           d S )NrB   )r8   r9   set_pass_hash_bytes)r!   r#  r(   rB   
hash_bytes
salt_bytess         r"   r"  zCmfAuth.set_pass_hash  sE    ]]4((
]]4((
  Z( KKKKKr%   c                 :   ||                      |           t          j        |                                          }t          j        |                                          }d| d| | _        | j                                         t          j        	                    | j
                  }|rj|j                                         d|_        t                                          5  |                    d           d d d            d S # 1 swxY w Y   d S d S )Nzpbkdf2_sha256$100000$r   rA   FT)	only_data)r<  r   r   r   r   password_changed_dateset_nowrt   	CmfPersonru   rA   password_must_changerv   rw   r   )r!   r@  rA  rB   r-  r,  persons          r"   r?  zCmfAuth.set_pass_hash_bytes  sT   x(((#J//6688#J//6688FFFHFF"**,,,!%%DJ%77 	,(00222*/F'$$&& , ,d+++, , , , , , , , , , , , , , , , , ,	, 	,s   *DDDc                     t           j        S r*   )r   r   )r@   s    r"   current_authzCmfAuth.current_auth  s	    vr%   c                     g }t          d          D ]@}|                    t          j        t          j        t          j        z                        Ad                    |                              d          S )N   r   zutf-8)	rangeappendr  choicer  ascii_lettersr  r  r;   )r@   charsis      r"   gen_saltzCmfAuth.gen_salt  se    r 	N 	NALLv';fm'KLLMMMMwwu~~$$W---r%      c                    |                      dg           |st          t          j        j        j        |          }t          j        j        j        }t          j        j        j        }t          j        j        j        }| 	                    ||||          }t          |                                           }t          j        d|                                |d          }|                     |||o|           t           j        j                                        5  t(          j                            ddd| j        idd	d
| j        | j        d	  	         ddd           n# 1 swxY w Y   |S )uO   
        Генерирует новый пароль
        :return:
        rA   )lengthis_upper_symbol	is_numberis_special_symbolr5   r6   r>  reset_passwordr   Nrs   Tr   )	ri   rj   rl   rk   rm   rn   r   r   r   )load_fieldsmaxr   r   password_min_lengthr   password_min_upper_symbolpassword_min_numberspassword_min_special_symbol_generate_passwordr   rT  r:   r   r;   r?  r   r   rv   rw   rt   rx   ry   rA   )	r!   rW  rB   forcerX  rY  rZ  r(   r#  s	            r"   r[  zCmfAuth.reset_password  s    	'### 
	*>DfMMF/IOO)>DI ! 1 M S..#7H /  H
 Dzz""$$"8X__->->gNN  te6H IIIX))++ 	R 	RO''0@QZ4;TZ3H/34]aosoy48Jq ( R R R	R 	R 	R 	R 	R 	R 	R 	R 	R 	R 	R 	R 	R 	R 	R
 s   :E%%E),E)rW  rZ  rY  rX  returnc                 j   g }t           j        t           j        z   t           j        z   }|r@|t           j        z  }|                    t          j        t           j                             |r1|                    t          j        t           j                             |r1|                    t          j        t           j                             t          j        ||t          |          z
            }|
                    |           t          j        |           d                    |          S )Nr  r   )r  rQ  r  ascii_uppercasepunctuationrO  r  rP  r  r7   extendshuffler  )r!   rW  rZ  rY  rX  password_datalettersextra_symbolss           r"   rb  zCmfAuth._generate_password#  s     +-&69OO 	Dv))G  v/A!B!BCCC 	?  v}!=!=>>> 	H  v/E!F!FGGGw&3};M;M2MNNN]+++}%%%ww}%%%r%   c                    dt           j         }d|g}t          |||           t          j        j                                        5  t          j        	                    ddd d|idd||d		  	         d d d            d S # 1 swxY w Y   d S )
Nu&   Пароль для доступа к u   Пароль:send_passwordr   rb   rs   Tr   )	ri   rj   rk   rl   rm   rn   r   r   r   )
rq   r|   r   r   r   rv   rw   rt   rx   ry   )r@   rB   rb   rr   msg_contentss        r"   rn  zCmfAuth.send_password8  s    Q6;OQQ'2<%000X))++ 	: 	:O''PY/3%@P6:PTbguz78 ( : : :	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	: 	:s   +B  BBc                 `   ddl m} 	  |            }t                              ||          }|                                 |                    t          dd           d|dd          }|j        d	k    rt          d
          t          |j
                            d                    S )Nr   )session)rA   rg_member_ofT)rS   internalzauth/signup)rA   gen_pwd)data   u>   Не удалось создать учётную записьaccess_token)rw  )requestsrq  rt   rG  r   postrX   status_coder   rV   cookiesru   )r@   rA   rr  rq  srI  rs          r"   create_personzCmfAuth.create_personC  s    $$$$$$	
 GII!!L!II FFtd;;;HHH   
 
 =C\]]]~!>!>????r%   c                    | j         j        rfd| _        | j         j        sS| j         D ](}| j         |         D ]}| xj        d| d| z  c_        )| j        j                                        | _         t                      j        |i |}| j        j        rdt          
                                5  t                              | | j                                                   d d d            n# 1 swxY w Y   |S )Nr   r   r   )rk   r   )groups
is_changedr   is_nullr   r   superr   r   rv   rw   rt   r8  )r!   argskwargsr   grp_namer   	__class__s         r"   r   zCmfAuth.save[  s\   ;! 	6DJ;& 6 $ @ @H$(K$9 @ @

&?(&?&?X&?&??


@!Z-3355
egglD+F++>$ 	T$$&& T T%%TT^%LLQQSSST T T T T T T T T T T T T T T
s   24C22C69C6c                     | j         j        rg S t          d | j                             d          D                       S )Nc                 D    g | ]}|                     d           d         S )r   r   )r   ).0rS  s     r"   
<listcomp>z)CmfAuth.prepare_scope.<locals>.<listcomp>n  s&    CCCAGGCLLOCCCr%   r   )r   r  r  r   r    s    r"   prepare_scopezCmfAuth.prepare_scopej  sA    : 	ICCTZ-=-=c-B-BCCCDDDr%   c                    |                      |          }t          j        dk    r|S |d         d         }	 t          j        |          }n# t
          $ r d}t          |          w xY w|                     ||          }|s;d|d         d          d}t          	                    |           t          |          |S )NFalser   issuJ   Не удалось прочитать публичный ключ EvaTeamuE   Не удалось валидировать токен от EVA_APP r   !)
r   rq   EVA_ACCOUNT_USEr   read_crm_pub_keyRuntimeErrorr   r   r   r   )r@   eva_app_tokenr   r  crm_pub_keyr   r   s          r"   check_tokenzCmfAuth.check_tokenp  s      //!W,,J)nU#	#$5c::KK 	# 	# 	#`EE"""	# ##M;?? 	#y\_`i\jku\vyyyEMM%   E"""
s   A A(usersc          
         |                      |          }|d         d         }|D ]}	 t          |d                                                                                   }g d}	d}
|                    d          rp|                     t          |d                                                                                   |	          }
|
r||
_        n/|                     ||	          }
n|                     ||	          }
|
sLt                              |          }
t          	                    d	|            |

                                 |                    d
          pd}t          |                                                                          p||
_        |                    d          pd}t          |                                                                          pd|
_        |
j        j        ri |
_        |
j        sg |
_        ||
j        vr|
j                            |           g |
j        |<   |d         r{t          	                    d                    ||                     ||
j        vr|
j                            |           |
j        |= d|
j        _        |

                                 |d         D ]Q}t          	                    d| d| d|            |
j        |                             |           d|
j        _        R|d         |
_        t          	                    d|            t          	                    d|
j                    |

                                 t+                       t          	                    d|
j                    # t.          $ r t                              d|             w xY wddiS )u   
        Метод вызывается из eva_app при синхронизации
        создает и привязывает пользователей
        https://bcrm.carbonsoft.ru/project/Document/DOC-003025#spec-0-ldap
        r   r   rA   )r  r   r   reg_org_name_listrb   r   
is_supportis_adminN	old_loginrc   rC  u(   Создали пользователя rb   r   r   cmf_deletedu4   Пользователь {} удален из Eva {}Trr  u,   Добавляем пользователю u    права u    в Eva r   z
user_dict=zuser.groups=zuser.scope=u)   Не удалось обработать resultrs   )r  r.   lowerr   ru   rA   rt   r   r   r   r   rb   r   r  r  r  rO  formatremover  r   
cmf_commitr   r   r   )r@   r  r  r  r  r   r   	user_dictrA   _fieldsuserrb   r   grp_codes                 r"   rpc_account_sync_pushzCmfAuth.rpc_account_sync_push  s    oom,,y>*- 6	 6	I5Ig.//5577==??` ` `==-- @77Y{-C)D)D)J)J)L)L)R)R)T)T]d7eeD D%*

"wwU7wCC77w7??D  !>>>66D MM"TU"T"TUUUIIKKK!g..4" ZZ--//5577@5
%MM+66<"	!$Y!5!5!7!7!=!=!?!?!G4;& %"$DK- 0-/D*4#999*11(;;;(*H%]+ MM"X"_"_`ego"p"pqqqt'===.55h???H--1DK*IIKKK ). 9 2 2HMM  #AQV  #A  #Adl  #A  #Av~  #A  #A  B  B  BK)00:::-1DK**$-n$=!6966777:T[::;;;		8DJ889999   !!"Yi"Y"YZZZ $s   JN2C*N22)Oc                &   t           j        sd S d }t           j        sd S |                     |          }|d         d         }|D ]}t          j                            |d         d         dg          }	|	st                                          }	 ||	|d                    |d         d         |	_        |	                                 t          j                            |d         ddg          }
|
st                                          }
 ||
|           ||
_	        |d         |
_        |	|
_
        |
                                 t          j                            d	d
d |D             g          D ]}	|	                                 ddiS )Nc                     |D ]X}|dv s*|                     d          s|                    d          r1t          | |          rt          | |||                    Yd S )N)idcodeext_ipcmf__id)r   endswithhasattrsetattr)r   obj_dict
field_names      r"   copy_fz/CmfAuth.rpc_account_plugin_push.<locals>.copy_f  s    & C C
!999%0088 :<F<O<OPU<V<V :3
++ CCXj-ABBBC Cr%   r   r   pluginr  r
   )ext_idrd   r   r  zNOT INc                     g | ]
}|d          S )r   )r  r   s     r"   r  z3CmfAuth.rpc_account_plugin_push.<locals>.<listcomp>  s     PsPsPs_bQTUYQZPsPsPsr%   )r   r  rs   )rq   IS_BOX_VERSIONr  rt   	CmfPluginru   r  r   r   r   r  r   delete)r@   r  auth_pluginsr  r  r  r   r   r   r  auth_plugin_objs              r"   rpc_account_plugin_pushzCmfAuth.rpc_account_plugin_push  s   $ 	F	C 	C 	C $ 	Foom,,y>*-' 	# 	#K%))X1Ft1LVYUZ)[[F ,))++F6;x0111'1$7FMKKMMM$6::+dBS]`bl\m:nnO" ="(":":"<"<F?K000'/O$%0%6O"%+O"  """".33HhPsPsfrPsPsPs;t3uu 	 	FMMOOOO$r%   c           	      J   | j         t          j        | j        j                  z   t          j        t
          j                  z   }t          t
          dt          j	                  } |j
        d|                                 f||dddd| t          j        |||fi | d S )N)secondsr   AUTH_SESSION_COOKIE_DOMAINsession_tokenTLaxr   expiressecurehttponlysamesite)reauth_dater  r  access_token_expires_inr   rq   PROLONG_DAYSgetattrr  host
set_cookie	get_tokenr   set_nginx_token)rq  responsecookie_kwargsr  cookie_domains        r"   set_session_tokenzCmfAuth.set_session_token  s    #h&8A`Af&g&g&ggjrj|  CI  CV  kW  kW  kW  W(DglSS 	
	

 !$
	
 
	
 
	
 
	
 
	
 	-RRMRRRRRr%   c           	           |j         d | j        t          j        dz
            f|t          j                                        t	          j        t          j        t          j        z             z   dddd| d S )Nrw  r   r  Tr  r  )r  r   rq   TOKEN_TTL_DAYSr  r  r  r  )r   r  r  r  s       r"   set_access_tokenzCmfAuth.set_access_token  s     #D"(=(ABBB		

 !%))++h.@*V-@@/B /B /B B$	
 	
 	
 	
 	
 	
 	
r%   c           	          |s>t           j                                         t          j        t          j                  z   } | j        	 	 d||dddd| d S )Nr  nginx_auth_tokenpassword123Tr  r  )r  r  )r  r  r  rq   r  r  )r  r  r  r  s       r"   r  zCmfAuth.set_nginx_token  s     	]%))++h.@fF[.\.\.\\G	
 !$	
 	
 	
 	
 	
 	
 	
r%   u_   Разблокировка учетных записей по истечению времениz	@minutely)	only_oncedescription
system_jobschedulec                     t           j        j        rd S t          j                                        } 	 t
          j                            dgdd| gddg          }|sd S |D ]}d |_         |j	                     t                       V)NTr   <r   d   )rd   r   r6  )r   r   r  r  r  rt   r   r   r   r   r  )r  blocked_usersr   s      r"   )cron_unblock_users_after_block_expirationz1CmfAuth.cron_unblock_users_after_block_expiration  s     6 	F##%%	"N//-.-sC8#h 0  M ! %  +/(	LLL	r%   )rO   F)T)r   Nr*   )rU  NN)FFF)A__name__
__module____qualname__r-   	ts_lengthjinja2EnvironmentFileSystemLoaderr   r   r  rq   r   r}   propertyr#   r(   r3   classmethodrN   r_   r   rU   r   r   staticmethodrV   r   r.   r   r   r   r   r   r  r   r  r   r   r$  r   r1  r<  r"  r?  rK  rT  r[  r/   boolrb  rn  r~  r   r  r  r   r  r  r  r  r  cmf_deferred_jobr  __classcell__)r  s   @r"   r   r      s       LI##&&V5GSY[f(g(g'hii $ k kJ ? ? X? ? ? X?      - - [-8f f f f V V [V@   \ \ \
% 
% 
% 
% % % % % \%

 
c 
 
 
 
 6 6 \60 6 6 \6   \$ % % [%N X X [Xt  .  >       [ 	F 	F [	F   [$
L 
L 
LL L L L
, , , ,    [ . . [.   < 6;9>& &&.2&&26& 
& & & &* : : [: @ @ @ [@.    E E E   [" @  @  @  @  [@ D     [ B S S \S" 
 
 \
 

 

 

 \

 u	     \    r%   r   ) r   r  r:   r   r  r+   r  r0   rY   r   Crypto.Cipherr   Crypto.Hashr   Crypto.PublicKeyr   Crypto.Randomr   Crypto.Signaturer   Crypto.Util.Paddingr	   cmf.includerb   r   rd   r   enumsr   
supervisorr   r   r  r%   r"   <module>r     sh                                          * * * * * * ' ' ' ' ' ' # # # # # #                 " " " " " " " " " " " "S S S S Sdl S S S S Sr%   