tracim.lib.utils.auth

Complexity

Total Complexity

12

Size/Duplication

Total Lines	116
Duplicated Lines	0 %

Importance

Changes

0

3 Functions

Rating	Name	Duplication	Size	Complexity
A	get_workspace()	0	18	4
A	get_user()	0	15	2
B	check_credentials()	0	37	6

# -*- coding: utf-8 -*-

This module should have a docstring.

import typing

from json.decoder import JSONDecodeError

The name JSONDecodeError does not seem to exist in module json.decoder.

from sqlalchemy.orm.exc import NoResultFound

from pyramid.request import Request
from pyramid.security import ALL_PERMISSIONS

Unused ALL_PERMISSIONS imported from pyramid.security

from pyramid.security import Allow

Unused Allow imported from pyramid.security

from pyramid.security import unauthenticated_userid

from tracim.models.auth import Group

Unused Group imported from tracim.models.auth

from tracim.models.auth import User
from tracim.models.data import Workspace
from tracim.models.data import UserRoleInWorkspace

Unused UserRoleInWorkspace imported from tracim.models.data

from tracim.lib.core.user import UserApi
from tracim.lib.core.workspace import WorkspaceApi
from tracim.lib.core.userworkspace import RoleApi

# INFO - G.M - 06-04-2018 - Auth for pyramid
# based on this tutorial : https://docs.pylonsproject.org/projects/pyramid-cookbook/en/latest/auth/basic.html  # nopep8

This line is too long as per the coding-style (119/100).

BASIC_AUTH_WEBUI_REALM = "tracim"

# Global Permissions
ADMIN_PERM = 'admin'
MANAGE_GLOBAL_PERM = 'manage_global'
USER_PERM = 'user'
# Workspace-specific permission
READ_PERM = 'read'
CONTRIBUTE_PERM = 'contribute'
MANAGE_CONTENT_PERM = 'manage_content'
MANAGE_WORKSPACE_PERM = 'manage_workspace'


def get_user(request: Request) -> typing.Optional[User]:
    """
    Get current pyramid user from request
    :param request: pyramid request
    :return:
    """
    app_config = request.registry.settings['CFG']
    uapi = UserApi(None, session=request.dbsession, config=app_config)
    user = None
    try:
        login = unauthenticated_userid(request)
        user = uapi.get_one_by_email(login)
    except NoResultFound:
        pass
    return user


def get_workspace(request: Request) -> typing.Optional[Workspace]:
    """
    Get current workspace from request
    :param request: pyramid request
    :return:
    """
    workspace = None
    try:
        if 'workspace_id' not in request.json_body:
            return None
        workspace_id = request.json_body['workspace_id']
        wapi = WorkspaceApi(current_user=None, session=request.dbsession)
        workspace = wapi.get_one(workspace_id)
    except JSONDecodeError:
        pass
    except NoResultFound:
        pass
    return workspace


def check_credentials(
        login: str,
        cleartext_password: str,
        request: Request
) -> typing.Optional[list]:
    """
    Check credential for pyramid basic_auth, checks also for
    global and Workspace related permissions.
    :param login: login of user
    :param cleartext_password: user password in cleartext
    :param request: Pyramid request
    :return: None if auth failed, list of permissions if auth succeed
    """
    user = get_user(request)

    # Do not accept invalid user
    if not user \
            or user.email != login \
            or not user.validate_password(cleartext_password):
        return None
    permissions = []

    # Global groups
    for group in user.groups:
        permissions.append(group.group_id)

    # Current workspace related group
    workspace = get_workspace(request)
    if workspace:
        roleapi = RoleApi(current_user=user, session=request.dbsession)
        role = roleapi.get_one(
            user_id=user.user_id,
            workspace_id=workspace.workspace_id,
        )
        permissions.append(role)

    return permissions


class Root(object):
    """
    Root of all Pyramid requests, used to store global acl
    """
    __acl__ = ()