o
    ȕh4                     @   s   d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlZd dl	Zd dl
mZ d dlmZ ddlmZ ddlmZ dd	 Zd
d ZG dd deejjZG dd deZG dd deejjZG dd deejjZG dd deejjZdS )    N)	urlencode)instantiate)options   )BaseHandler)NotFoundErrorHandlerc                 C   sD   d| v r||  dv S d| v rt| dd} t| |S | |kS )N|*z\.\*z![A-Za-z0-9!#$%&'*+/=?^_`{|}~.\-]*)splitreescapereplace	fullmatch)patternemail r   N/var/www/Befach/backend/venv/lib/python3.10/site-packages/flower/views/auth.pyauthenticate   s   r   c                 C   sB   |  ddkr	dS d| v rd| v rdS d| ddd v rdS dS )Nr	      Fr   @T)countrsplit)r   r   r   r   validate_auth_option   s   r   c                   @   s    e Zd ZdZdd Zdd ZdS )GoogleAuth2LoginHandleroauthc                    sx   | j | j d }| ddr&| j|| ddI d H }| |I d H  d S | j|| j | j d ddgddd	id
 d S )Nredirect_uricodeFr   r   keyprofiler   approval_prompt r   	client_idscoperesponse_typeextra_paramssettings_OAUTH_SETTINGS_KEYget_argumentget_authenticated_user_on_authauthorize_redirectselfr   userr   r   r   get)   s   
zGoogleAuth2LoginHandler.getc              
      s  |s
t jdd|d }z|  jddd| idI d H }W n ty7 } z
t jdd| d }~ww t|j	d	d
 }t
| jjj|sXd| d}t jd|| dt| | d| jjjpid}| jjjrz|d dkrzd| }| | d S )N  zGoogle auth failedaccess_tokenz)https://www.googleapis.com/userinfo/v2/meAuthorizationBearer headerszGoogle auth failed: utf-8r   zAccess denied to 'zS'. Please use another account or ask your admin to add your email to flower --auth.r1   next/r   )tornadoweb	HTTPErrorget_auth_http_clientfetch	Exceptionjsonloadsbodydecoder   applicationr   authset_secure_cookiestrr+   
url_prefixredirect)r0   r1   r4   responseer   messagenext_r   r   r   r-   :   s,   z GoogleAuth2LoginHandler._on_authN)__name__
__module____qualname__r*   r2   r-   r   r   r   r   r   &   s    r   c                   @   s   e Zd Zdd ZdS )LoginHandlerc                 O   s   t tjptg|R i |S )N)r   r   auth_providerr   )clsargskwargsr   r   r   __new__U   s   zLoginHandler.__new__N)rP   rQ   rR   rX   r   r   r   r   rS   T   s    rS   c                   @   sP   e Zd ZeddZde dZde dZdZdZ	dd	 Z
d
d Zdd ZdS )GithubLoginHandlerFLOWER_GITHUB_OAUTH_DOMAINz
github.comhttps://z/login/oauth/authorizez/login/oauth/access_tokenFr   c                    |   t ||| j| j d | j| j d dd}|  j| jdddd|d	I d H }|jr5tj	d
| t
|jdS Nr   secretauthorization_coder   r   r$   client_secret
grant_typePOST!application/x-www-form-urlencodedapplication/jsonzContent-TypeAcceptmethodr8   rD   OAuth authenticator error: r9   r   r)   r*   r?   r@   _OAUTH_ACCESS_TOKEN_URLerrorr<   rG   	AuthErrorrB   rC   rD   rE   r0   r   r   rD   rL   r   r   r   r,   b   &   z)GithubLoginHandler.get_authenticated_userc                    sv   | j | j d }| ddr&| j|| ddI d H }| |I d H  d S | j|| j | j d dgdddid	 d S )
Nr   r   Fr   r   z
user:emailr!   r"   r#   r(   r/   r   r   r   r2   v   s   
zGithubLoginHandler.getc                    s   |s
t jdd|d }  jd j dd| ddd	I d H } fd
dt|j	dD }|s?d}t jd| 
dt|   d jjjpRd} jjjrc|d dkrcd| } | d S )N  OAuth authentication failedr4   zhttps://api.z/user/emailsztoken Tornado authr5   z
User-agentr7   c                    s4   g | ]}|d  rt  jjj|d r|d  qS )verifiedr   )r   rF   r   rG   lower).0r   r0   r   r   
<listcomp>   s
    z/GithubLoginHandler._on_auth.<locals>.<listcomp>r9   _Access denied. Please use another account or ask your admin to add your email to flower --auth.r3   r1   r:   r;   r   )r<   r=   r>   r?   r@   _OAUTH_DOMAINrB   rC   rD   rE   rH   rI   popr+   rF   r   rJ   rK   )r0   r1   r4   rL   emailsrN   rO   r   rx   r   r-      s(    zGithubLoginHandler._on_authN)rP   rQ   rR   osgetenvr{   _OAUTH_AUTHORIZE_URLrl   _OAUTH_NO_CALLBACKSr*   r,   r2   r-   r   r   r   r   rY   Y   s    rY   c                   @   sL   e Zd ZeddZde dZde dZdZdd Z	d	d
 Z
dd ZdS )GitLabLoginHandlerFLOWER_GITLAB_OAUTH_DOMAINz
gitlab.comr[   z/oauth/authorizez/oauth/tokenFc                    sx   t ||| jd d | jd d dd}|  j| jdddd	|d
I d H }|jr3tjd| t	
|jdS )Nr   r   r^   r_   r`   rc   rd   re   rf   rh   rj   r9   )r   r)   r?   r@   rl   rm   r<   rG   rn   rB   rC   rD   rE   ro   r   r   r   r,      s&   z)GitLabLoginHandler.get_authenticated_userc                    sr   | j d d }| ddr%| j|| ddI d H }| |I d H  d S | j|| j d d dgddd	id
 d S )Nr   r   r   Fr   r   read_apir!   r"   r#   )r)   r+   r,   r-   r.   r/   r   r   r   r2      s   
zGitLabLoginHandler.getc              
      s  |s
t jdd|d }tjdd dd  dD  z|  jd	| j	 d
d| dddI d H }W n t
yM } z
t jdd| d }~ww t|jdd }t| jjj|}g } rtjdd}|  jd	| j	 d| d| dddI d H } fddt|jdD }|r rt|dkrd}	t jd|	| dt| | d| jjjpd}
| jjjr|
d dkrd|
 }
| |
 d S )Nrq   rr   r4   !FLOWER_GITLAB_AUTH_ALLOWED_GROUPSr"   c                 S   s   g | ]}|r|  qS r   )striprw   groupr   r   r   ry      s    z/GitLabLoginHandler._on_auth.<locals>.<listcomp>,r[   z/api/v4/userr6   rs   rt   r7   r3   zGitLab auth failed: r9   r   FLOWER_GITLAB_MIN_ACCESS_LEVEL20z /api/v4/groups?min_access_level=c                    s    g | ]}|d   v r|d qS )	full_pathidr   r   allowed_groupsr   r   ry      s
    r   z@Access denied. Please use another account or contact your admin.r1   r:   r;   )r<   r=   r>   r~   environr2   r
   r?   r@   _OAUTH_GITLAB_DOMAINrA   rB   rC   rD   rE   r   rF   r   rG   lenrH   rI   r+   rJ   rK   )r0   r1   r4   rL   rM   
user_emailemail_allowedmatching_groupsmin_access_levelrN   rO   r   r   r   r-      sN   
zGitLabLoginHandler._on_authN)rP   rQ   rR   r~   r   r   r   rl   r   r,   r2   r-   r   r   r   r   r      s    r   c                   @   s\   e Zd ZdZdZedd Zedd Zedd Zed	d
 Z	dd Z
dd Zdd ZdS )OktaLoginHandlerFr   c                 C   s   t jdS )NFLOWER_OAUTH2_OKTA_BASE_URL)r~   r   r2   rx   r   r   r   base_url     zOktaLoginHandler.base_urlc                 C      | j  dS )Nz/v1/authorizer   rx   r   r   r   r     r   z%OktaLoginHandler._OAUTH_AUTHORIZE_URLc                 C   r   )Nz	/v1/tokenr   rx   r   r   r   rl     r   z(OktaLoginHandler._OAUTH_ACCESS_TOKEN_URLc                 C   r   )Nz/v1/userinfor   rx   r   r   r   _OAUTH_USER_INFO_URL  r   z%OktaLoginHandler._OAUTH_USER_INFO_URLc                    r\   r]   rk   ro   r   r   r   get_access_token  rp   z!OktaLoginHandler.get_access_tokenc                    s   | j | j d }| ddrC| dpdd}| d}|d u s&||kr,tjd| j|| dd	I d H }| 	|I d H  d S t
t }| d| | j|| j | j d
 dgdd|id d S )Nr   r   Foauth_state    r9   statez4OAuth authenticator error: State tokens do not matchr   r   zopenid emailr#   )r)   r*   r+   get_secure_cookierE   r<   rG   rn   r   r-   rI   uuiduuid4rH   r.   )r0   r   expected_statereturned_stateaccess_token_responser   r   r   r   r2   '  s.   

zOktaLoginHandler.getc           	         s   |s
t jdd|d }|  j| jd| dddI d H }t|j	d}|
d	p/d
 }|
do>t| jjj|}|sJd}t jd|| dt| | d | d| jjjp`d}| jjjrq|d dkrqd| }| | d S )Nrq   rr   r4   r6   rs   rt   r7   r9   r   r"   email_verifiedrz   r3   r1   r   r:   r;   r   )r<   r=   r>   r?   r@   r   rB   rC   rD   rE   r2   r   r   rF   r   rG   rH   rI   clear_cookier+   rJ   rK   )	r0   r   r4   rL   decoded_bodyr   r   rN   rO   r   r   r   r-   A  s2   

zOktaLoginHandler._on_authN)rP   rQ   rR   r   r*   propertyr   r   rl   r   r   r2   r-   r   r   r   r   r      s    



r   )rB   r~   r   r   urllib.parser   tornado.authr<   tornado.gentornado.webcelery.utils.importsr   tornado.optionsr   viewsr   views.errorr   r   r   rG   GoogleOAuth2Mixinr   rS   OAuth2MixinrY   r   r   r   r   r   r   <module>   s&    	
.J\