forked from DGNum/gestioCOF
140 lines
5.2 KiB
Python
140 lines
5.2 KiB
Python
from django.conf import settings as django_settings
|
|
from django.contrib import messages
|
|
from django.contrib.auth import authenticate, login
|
|
from django.contrib.auth.decorators import permission_required
|
|
from django.contrib.auth.models import Group, User
|
|
from django.contrib.auth.views import redirect_to_login
|
|
from django.contrib.messages.views import SuccessMessageMixin
|
|
from django.db.models import Prefetch
|
|
from django.http import QueryDict
|
|
from django.shortcuts import redirect, render
|
|
from django.urls import reverse, reverse_lazy
|
|
from django.utils.decorators import method_decorator
|
|
from django.utils.translation import ugettext_lazy as _
|
|
from django.views.decorators.http import require_http_methods
|
|
from django.views.generic import View
|
|
from django.views.generic.edit import CreateView, UpdateView
|
|
|
|
from .forms import GroupForm
|
|
from .models import GenericTeamToken
|
|
|
|
|
|
class GenericLoginView(View):
|
|
"""
|
|
View to authenticate as kfet generic user.
|
|
|
|
It is a 2-step view. First, issue a token if user is a team member and send
|
|
him to the logout view (for proper disconnect) with callback url to here.
|
|
Then authenticate the token to log in as the kfet generic user.
|
|
|
|
Token is stored in COOKIES to avoid share it with the authentication
|
|
provider, which can be external. Session is unusable as it will be cleared
|
|
on logout.
|
|
"""
|
|
|
|
TOKEN_COOKIE_NAME = "kfettoken"
|
|
|
|
@method_decorator(require_http_methods(["GET", "POST"]))
|
|
def dispatch(self, request, *args, **kwargs):
|
|
token = request.get_signed_cookie(self.TOKEN_COOKIE_NAME, None)
|
|
if not token:
|
|
if not request.user.has_perm("kfet.is_team"):
|
|
return redirect_to_login(request.get_full_path())
|
|
|
|
if request.method == "POST":
|
|
# Step 1: set token and logout user.
|
|
return self.prepare_auth(request)
|
|
else:
|
|
# GET request should not change server/client states. Send a
|
|
# confirmation template to emit a POST request.
|
|
return render(
|
|
request,
|
|
"kfet/confirm_form.html",
|
|
{
|
|
"title": _("Ouvrir une session partagée"),
|
|
"text": _(
|
|
"Êtes-vous sûr·e de vouloir ouvrir une session "
|
|
"partagée ?"
|
|
),
|
|
},
|
|
)
|
|
else:
|
|
# Step 2: validate token.
|
|
return self.validate_auth(token)
|
|
|
|
def prepare_auth(self, request):
|
|
# Issue token.
|
|
token = GenericTeamToken.objects.create_token()
|
|
|
|
# When CAS logs the user out, the generic login has to be called back.
|
|
# The corresponding callback URL is provided as a GET parameter.
|
|
# The renaming of the CAS logout "url" parameter to "service" is being forced,
|
|
# which is why the CAS logout URL with callback is constructed ad hoc,
|
|
# without relying on Django redirection to Django CAS.
|
|
|
|
generic_login_url = request.build_absolute_uri() # preserves next parameter
|
|
generic_login_qd = QueryDict(mutable=True)
|
|
generic_login_qd["service"] = generic_login_url
|
|
|
|
cas_server_url = django_settings.CAS_SERVER_URL
|
|
cas_logout_url = cas_server_url + "logout"
|
|
cas_callback_url = cas_logout_url + "?{}".format(generic_login_qd.urlencode())
|
|
|
|
logout_url = cas_callback_url
|
|
|
|
resp = redirect(logout_url)
|
|
resp.set_signed_cookie(self.TOKEN_COOKIE_NAME, token.token, httponly=True)
|
|
return resp
|
|
|
|
def validate_auth(self, token):
|
|
# Authenticate with GenericBackend.
|
|
user = authenticate(request=self.request, kfet_token=token)
|
|
|
|
if user:
|
|
# Log in generic user.
|
|
login(self.request, user)
|
|
messages.success(
|
|
self.request, _("K-Fêt — Ouverture d'une session partagée.")
|
|
)
|
|
resp = redirect(self.get_next_url())
|
|
else:
|
|
# Try again.
|
|
resp = redirect(self.request.get_full_path())
|
|
|
|
# Prevents blocking due to an invalid COOKIE.
|
|
resp.delete_cookie(self.TOKEN_COOKIE_NAME)
|
|
return resp
|
|
|
|
def get_next_url(self):
|
|
return self.request.GET.get("next", reverse("kfet.kpsul"))
|
|
|
|
|
|
login_generic = GenericLoginView.as_view()
|
|
|
|
|
|
@permission_required("kfet.manage_perms")
|
|
def account_group(request):
|
|
user_pre = Prefetch(
|
|
"user_set", queryset=User.objects.select_related("profile__account_kfet")
|
|
)
|
|
groups = Group.objects.filter(name__icontains="K-Fêt").prefetch_related(
|
|
"permissions", user_pre
|
|
)
|
|
return render(request, "kfet/account_group.html", {"groups": groups})
|
|
|
|
|
|
class AccountGroupCreate(SuccessMessageMixin, CreateView):
|
|
model = Group
|
|
template_name = "kfet/account_group_form.html"
|
|
form_class = GroupForm
|
|
success_message = "Nouveau groupe : %(name)s"
|
|
success_url = reverse_lazy("kfet.account.group")
|
|
|
|
|
|
class AccountGroupUpdate(SuccessMessageMixin, UpdateView):
|
|
queryset = Group.objects.filter(name__icontains="K-Fêt")
|
|
template_name = "kfet/account_group_form.html"
|
|
form_class = GroupForm
|
|
success_message = "Groupe modifié : %(name)s"
|
|
success_url = reverse_lazy("kfet.account.group")
|