2018-01-11 12:10:27 +00:00
|
|
|
# -*- coding: utf-8 -*-
|
|
|
|
#
|
2019-05-20 04:30:55 +00:00
|
|
|
import time
|
2022-07-04 03:29:39 +00:00
|
|
|
|
2018-11-23 02:25:35 +00:00
|
|
|
from django.conf import settings
|
2022-07-04 03:29:39 +00:00
|
|
|
from rest_framework import permissions
|
|
|
|
|
|
|
|
from authentication.const import ConfirmType
|
|
|
|
from common.exceptions import UserConfirmRequired
|
2022-07-15 06:56:51 +00:00
|
|
|
from orgs.utils import tmp_to_root_org
|
|
|
|
from authentication.models import ConnectionToken
|
|
|
|
from common.utils import get_object_or_none
|
2018-07-20 10:42:01 +00:00
|
|
|
|
2018-01-11 12:10:27 +00:00
|
|
|
|
|
|
|
class IsValidUser(permissions.IsAuthenticated, permissions.BasePermission):
|
|
|
|
"""Allows access to valid user, is active and not expired"""
|
|
|
|
|
|
|
|
def has_permission(self, request, view):
|
|
|
|
return super(IsValidUser, self).has_permission(request, view) \
|
2021-10-20 09:56:59 +00:00
|
|
|
and request.user.is_valid
|
2018-01-11 12:10:27 +00:00
|
|
|
|
|
|
|
|
2022-07-15 06:56:51 +00:00
|
|
|
class IsValidUserOrConnectionToken(IsValidUser):
|
|
|
|
|
|
|
|
def has_permission(self, request, view):
|
|
|
|
return super(IsValidUserOrConnectionToken, self).has_permission(request, view) \
|
|
|
|
or self.is_valid_connection_token(request)
|
|
|
|
|
|
|
|
@staticmethod
|
|
|
|
def is_valid_connection_token(request):
|
|
|
|
token_id = request.query_params.get('token')
|
|
|
|
if not token_id:
|
|
|
|
return False
|
|
|
|
with tmp_to_root_org():
|
|
|
|
token = get_object_or_none(ConnectionToken, id=token_id)
|
|
|
|
return token and token.is_valid
|
|
|
|
|
|
|
|
|
2022-02-17 12:13:31 +00:00
|
|
|
class OnlySuperUser(IsValidUser):
|
2018-07-25 03:21:12 +00:00
|
|
|
def has_permission(self, request, view):
|
2022-02-17 12:13:31 +00:00
|
|
|
return super().has_permission(request, view) \
|
2018-07-25 03:21:12 +00:00
|
|
|
and request.user.is_superuser
|
|
|
|
|
|
|
|
|
2018-11-23 02:25:35 +00:00
|
|
|
class WithBootstrapToken(permissions.BasePermission):
|
|
|
|
def has_permission(self, request, view):
|
|
|
|
authorization = request.META.get('HTTP_AUTHORIZATION', '')
|
|
|
|
if not authorization:
|
|
|
|
return False
|
|
|
|
request_bootstrap_token = authorization.split()[-1]
|
|
|
|
return settings.BOOTSTRAP_TOKEN == request_bootstrap_token
|
2019-06-19 02:47:26 +00:00
|
|
|
|
|
|
|
|
2022-07-04 03:29:39 +00:00
|
|
|
class UserConfirmation(permissions.BasePermission):
|
2022-07-07 09:07:57 +00:00
|
|
|
ttl = 60 * 5
|
2022-07-04 03:29:39 +00:00
|
|
|
min_level = 1
|
|
|
|
confirm_type = ConfirmType.ReLogin
|
2019-07-02 06:17:56 +00:00
|
|
|
|
2022-07-04 03:29:39 +00:00
|
|
|
def has_permission(self, request, view):
|
2022-07-19 08:22:49 +00:00
|
|
|
if not settings.SECURITY_VIEW_AUTH_NEED_MFA:
|
|
|
|
return True
|
|
|
|
|
2022-07-04 03:29:39 +00:00
|
|
|
confirm_level = request.session.get('CONFIRM_LEVEL')
|
|
|
|
confirm_time = request.session.get('CONFIRM_TIME')
|
|
|
|
|
|
|
|
if not confirm_level or not confirm_time or \
|
|
|
|
confirm_level < self.min_level or \
|
|
|
|
confirm_time < time.time() - self.ttl:
|
|
|
|
raise UserConfirmRequired(code=self.confirm_type)
|
|
|
|
return True
|
|
|
|
|
|
|
|
@classmethod
|
|
|
|
def require(cls, confirm_type=ConfirmType.ReLogin, ttl=300):
|
|
|
|
min_level = ConfirmType.values.index(confirm_type) + 1
|
|
|
|
name = 'UserConfirmationLevel{}TTL{}'.format(min_level, ttl)
|
|
|
|
return type(name, (cls,), {'min_level': min_level, 'ttl': ttl, 'confirm_type': confirm_type})
|