B
    f%7                 @   s   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl	T d dl
mZ d dlmZ d dlmZ G dd	 d	ejjeZdS )
    N)abort)rollback_all_ds)*)normalize_email_address)ResponseMixin)urlparsec               @   s   e Zd ZdZdZdd Zdd Zejj	dd Z
d	d
 Zdd Zejj	dd Zejj	dd Zejj	dd Zejj	dd Zejj	dd ZdS )
SigninViewz/signin   c             C   s4   t jd}|s0t jr0tt j}|r0|d}|S )Naccess_token)requestcookiesgetdataujsonloads)selfr
   Zjson_res r   ./modules/auth/views/signin.py_get_access_token   s    

zSigninView._get_access_tokenc             C   s   |   }|rtj|S d S )N)r   modelsCmfAuthZrsa_verify_unpack_jwt)r   r
   r   r   r   _jwt_from_request   s    zSigninView._jwt_from_requestc             C   s  |   }|rZy0|d d }|d d }t|d d }d}W n6 ttttfk
rt   td d }d }d}d}Y nX d }|sd}|rtj	j
|dgd	}|sd}|r|j|krd}|rTtj tj| j}|dk rd
tjkrTtd| d| dtjd
   nLd|  kr"tjk rTn n.ttd
tjkr@tjd
 nd}| ||S t  d }tj
d}	|	rtj|	\}}
|rttd
tjkrtjd
 nd}| ||S tj }g }x<tjjdddgddgdD ]}| t!|j"|# d qW t$|}| %dS )NZpayloadloginscopeexpTzjwt value errorr   F)r   fieldsZnext_urlz !!! Maybe Cycle Redirect: login=z, scope=z
 next_url=/session_tokenZdisabledz==r   zplugin.*)filterr   )nameZ	login_urlzsignin.html)&r   int
ValueError	TypeErrorAttributeErrorKeyErrorloggingZ	exceptionr   r   r   r   datetimenowZfromtimestampdaysr   valuesprintr   prolong_daysmake_responseredirect_okr   r   Z
CmfSessionZ
from_tokenconfigIS_BOX_VERSIONZCmfAuthOpenIdPluginlistappenddictr   Zget_redirect_urllenZrender)r   Zjwtr   r   r   Zjwt_okauthZexpired_daysresponser   Z_sessionZshow_register_buttonZsso_buttonsZpluginZsso_buttons_countr   r   r   r   "   s`    



    zSigninView.getc          
   C   s   t js
d S tjd| s d S ttjd| }t j}t jrT|dkrTt jd }tjjj	d| |d d}|j
dd t| y|  W n" tk
r } zW d d }~X Y nX d S )	Nzauth:user_login_failed:   <   zauth:user_login_failed_lock:   )timeoutT)Zblocking)r/   AUTH_FREEZE_AFTER_LOGIN_FAILAPPREDIS_DBexistsr    r   Z!AUTH_FREEZE_AFTER_MANY_LOGIN_FAILZredislockacquiretimeZsleeprelease	Exception)r   r   cntr:   r?   er   r   r   _auth_freezee   s     

zSigninView._auth_freezec             C   s   t js
d S tjd| s d S tjdd }d| }tj|}dt	j
tjdd}tj|| |stjjddd |d	d
ddd||d	 td | }|r||krtjjddd |dd
ddd||d	 td d S )Nzauth:user_login_failed:captchazauth:user_login_captcha:    )kZauth_failedr   zRequire captcha)r   reasonZfailT   )	operatecmf_model_nameparent
audit_dataresult_statuscurrent_transactionsecurity_levelparent_nameparent_codei  zBad captcha)r/   AUTH_CHECK_CAPTCHAr<   r=   r>   r   r)   r   joinrandomchoicesstringdigitssetr   CmfAuditaudit_eventr   decode)r   r   rG   Zdb_keyZ
db_captchaZnew_captchar   r   r   _auth_check_captchay   s,    






zSigninView._auth_check_captchac             C   sx   t js
d S ttjd }tjd| s.d S ddlm	} ddl
m} tjd|  }| }||}||ddS )Nr   zauth:user_login_captcha:r   )Response)ImageCaptchaz	image/png)Zmimetype)r/   rV   r   r   r)   r<   r=   r>   flaskra   Zcaptcha.imagerb   r   r_   Zgenerate)r   r   ra   rb   rG   Zimager   r   r   r   captcha_img   s    
zSigninView.captcha_imgc             C   s  dd l }|jtjd }d|kr*t|}tjd }| | | | t	  t
j||}t
jj  |stjs~tjrd}tjd| rttjd| }|d7 }tjjd| |dd td	 d
}|jrt |jkrd}tjjr,|jr,|jtj tjjj!d }||j" k r,d}|rtjdd }tjdd }	|rZ|	st
j#j$ddd d|iddd||d	 td |%||	 |jrd |_t
j#j$ddd d|iddd||d	 |&  t'd}
| (|
|S Q R X d S )Nr   r   @challenge_respzauth:user_login_failed:rL   i  )exi  FT)r(   Znew_password_hashZnew_password_saltZpassword_expiredr   password_expires_must_change)	rM   rN   rO   rP   rQ   rR   rS   rT   rU   i  Zpassword_changedr9   zSigned in successfully))urllibparseZunquoter   r)   r   rF   r`   ZcmfutilZdisable_aclr   r   get_by_challenge_respZdpZcommitr/   r;   rV   r<   r=   r>   r    r   r\   r   rh   rA   gZglobal_settingsZpassword_max_daysZpassword_changed_dater&   Z	timedeltavaluer'   r]   r^   Zset_pass_hashZsaver,   r.   )r   ri   r   rf   r5   rD   Zneed_change_passwordZexpire_datehashZsaltr6   r   r   r   post   sX    




zSigninView.postc             C   s   dS )NrH   r   )r   r   r   r   get_server_challenge   s    zSigninView.get_server_challengec             C   s^  t jstd tdS t jjj}tjj	|ddgd}|sBtdS |j
jrftd | jtd|d	S td
d |j
j D }|std | jtd|d	S t|dkrtd x&t|D ]}td|r|| qW t|dkrBtd | }td| tj }tjr4tj|r4tdtj }| j||d	S td | jtd|d	S )uu    Определить по куке куда отправить пользователя автоматически. u7   1. Нет куки - форма авторизации.z/auth/signinr   r   )r   r   z"/auth/signout?next_url=auth/signinuO   2.1. У пользователя нет scope - форма создания VM.z/auth/assign)r5   c             S   s   g | ]}| d d qS ):r   )split).0r   r   r   r   
<listcomp>   s    z&SigninView.proceed.<locals>.<listcomp>uO   2.2. У пользователя нет scope - форма создания VM.r9   ur   3.2. У пользователя два scope, проверим, не системный ли один из нихz^acrm[0-9]{5,6}$rL   uo   3. У пользователя один единственный scope - на эту CRM и отправить.zhttps://uc   4. У пользователя несколько scope - отправить на список CRM.r   )rl   r5   r%   infor-   Zemailrm   r   r   r   r   Zis_nullr.   r\   rr   r4   rematchdiscardpopr/   ZAUTH_SESSION_COOKIE_DOMAINr0   
startswith)r   r   r5   Zscopesr   r6   r   r   r   proceed   s8    






zSigninView.proceedc             C   sh   t tjd }tjd }| | tj||}|s`tjs@tj	rXt
jjd| ddd td | S )u>   
            Ручка для авторизации
        r   passwordzauth:user_login_failed:rL   i  )rg   i  )r   r   r)   rF   r   r   rk   r/   r;   rV   r<   r=   r\   r   Zrsa_sign_pack_jwt)r   r   r|   r5   r   r   r   signin_with_login_password  s    

z%SigninView.signin_with_login_passwordN)__name__
__module____qualname__Z__url__r+   r   r   cmfviewsactionr   rF   r`   rd   ro   rp   r{   r}   r   r   r   r   r      s   C;&r   )r&   r   rX   rZ   rA   rc   r   Zcmf.data_providers.baser   Zcmf.includeZmodules.auth.models.emailr   Zmodules.auth.views.responser   Zurllib.parser   r   r   ZBaseViewr   r   r   r   r   <module>   s   