Mass cleaning of kfet' authentication machinery

AccountBackend
- Should now work if used in AUTHENTICATION_BACKENDS settings.
- It does not retieve itself the password, as it should not be used
this way.

GenericBackend
- Delete useless 'username' arg of its 'authenticate()' method.
- Now delete the token in DB.

TemporaryAuthMiddleware
- New name of the middleware is more meaningful.
- Is now responsible to retrieve the password from the request, instead
of the AccountBackend.

GenericTeamToken model
- Add a manager' method to create token, avoiding possible error due to
unicity constraint.

GenericLoginView (authentication with the kfet generic user)
- Replace obscure system with a 100% HTTP handling.
- See comments for more information.

Misc
- More docstrings!
- More tests!
- Add some i18n.
- Add kfet/confirm_form.html template:
    Ask user to confirm sth via a form (which will send a POST request).
    Context variables:
        * title: the page title
        * confirm_url: action attribute for <form>
        * text: displayed confirmation text
- kfet.js : Add functions allowing to emit POST request from <a> tag.
- Non-link nav items from kfet navbar also get a 'title'.
- A utility has been found for the 'sunglasses' glyphicon!

kfet/auth/views.py

@@ -3,38 +3,105 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.contrib.auth import authenticate, login
 from django.contrib.auth.decorators import permission_required
 from django.contrib.auth.models import Group, User
-from django.core.urlresolvers import reverse_lazy
+from django.contrib.auth.views import redirect_to_login
+from django.core.urlresolvers import reverse, reverse_lazy
 from django.db.models import Prefetch
-from django.shortcuts import render
-from django.utils.crypto import get_random_string
+from django.http import QueryDict
+from django.shortcuts import redirect, render
+from django.utils.decorators import method_decorator
+from django.utils.translation import ugettext_lazy as _
+from django.views.generic import View
+from django.views.decorators.http import require_http_methods
 from django.views.generic.edit import CreateView, UpdateView
 
-from django_cas_ng.views import logout as cas_logout_view
-
-from kfet.decorators import teamkfet_required
-
 from .forms import GroupForm
 from .models import GenericTeamToken
 
 
-@teamkfet_required
-def login_genericteam(request):
-    # Check si besoin de déconnecter l'utilisateur de CAS
-    cas_logout = None
-    if request.user.profile.login_clipper:
-        # Récupèration de la vue de déconnexion de CAS
-        # Ici, car request sera modifié après
-        next_page = request.META.get('HTTP_REFERER', None)
-        cas_logout = cas_logout_view(request, next_page=next_page)
+class GenericLoginView(View):
+    """
+    View to authenticate as kfet generic user.
 
-    # Authentification du compte générique
-    token = GenericTeamToken.objects.create(token=get_random_string(50))
-    user = authenticate(username="kfet_genericteam", token=token.token)
-    login(request, user)
+    It is a 2-step view. First, issue a token if user is a team member and send
+    him to the logout view (for proper disconnect) with callback url to here.
+    Then authenticate the token to log in as the kfet generic user.
 
-    messages.success(request, "Connecté en utilisateur partagé")
+    Token is stored in COOKIES to avoid share it with the authentication
+    provider, which can be external. Session is unusable as it will be cleared
+    on logout.
+    """
+    TOKEN_COOKIE_NAME = 'kfettoken'
 
-    return cas_logout or render(request, "kfet/login_genericteam.html")
+    @method_decorator(require_http_methods(['GET', 'POST']))
+    def dispatch(self, request, *args, **kwargs):
+        token = request.get_signed_cookie(self.TOKEN_COOKIE_NAME, None)
+        if not token:
+            if not request.user.has_perm('kfet.is_team'):
+                return redirect_to_login(request.get_full_path())
+
+            if request.method == 'POST':
+                # Step 1: set token and logout user.
+                return self.prepare_auth()
+            else:
+                # GET request should not change server/client states. Send a
+                # confirmation template to emit a POST request.
+                return render(request, 'kfet/confirm_form.html', {
+                    'title': _("Ouvrir une session partagée"),
+                    'text': _(
+                        "Êtes-vous sûr·e de vouloir ouvrir une session "
+                        "partagée ?"
+                    ),
+                })
+        else:
+            # Step 2: validate token.
+            return self.validate_auth(token)
+
+    def prepare_auth(self):
+        # Issue token.
+        token = GenericTeamToken.objects.create_token()
+
+        # Prepare callback of logout.
+        here_url = reverse(login_generic)
+        if 'next' in self.request.GET:
+            # Keep given next page.
+            here_qd = QueryDict(mutable=True)
+            here_qd['next'] = self.request.GET['next']
+            here_url += '?{}'.format(here_qd.urlencode())
+
+        logout_url = reverse('cof-logout')
+        logout_qd = QueryDict(mutable=True)
+        logout_qd['next'] = here_url
+        logout_url += '?{}'.format(logout_qd.urlencode(safe='/'))
+
+        resp = redirect(logout_url)
+        resp.set_signed_cookie(
+            self.TOKEN_COOKIE_NAME, token.token, httponly=True)
+        return resp
+
+    def validate_auth(self, token):
+        # Authenticate with GenericBackend.
+        user = authenticate(request=self.request, kfet_token=token)
+
+        if user:
+            # Log in generic user.
+            login(self.request, user)
+            messages.success(self.request, _(
+                "K-Fêt — Ouverture d'une session partagée."
+            ))
+            resp = redirect(self.get_next_url())
+        else:
+            # Try again.
+            resp = redirect(self.request.get_full_path())
+
+        # Prevents blocking due to an invalid COOKIE.
+        resp.delete_cookie(self.TOKEN_COOKIE_NAME)
+        return resp
+
+    def get_next_url(self):
+        return self.request.GET.get('next', reverse('kfet.kpsul'))
+
+
+login_generic = GenericLoginView.as_view()
 
 
 @permission_required('kfet.manage_perms')