1

# encoding: utf-8

     2

     3

import datetime

     4

import werkzeug

     5

import werkzeug.urls

     6

     7

import pvl.web

     8

import pvl.web.response

     9

    10

from pvl.login import pubtkt

    11

from pvl.web import urls, html

    12

    13

import logging; log = logging.getLogger('pvl.login.server')

    14

    15

class Handler (pvl.web.Handler) :

    16

    # Bootstrap

    17

    DOCTYPE = 'html'

    18

    HTML_XMLNS = None

    19

    HTML_LANG = 'en'

    20

    CSS = (

    21

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    22

    )

    23

    JS = (

    24

            '//code.jquery.com/jquery.js',

    25

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    26

    )

    27

    31

    def process_cookie (self) :

    32

        """

    33

            Reverse the urlencoding used for the cookie...

    34

        """

    35

    36

        log.debug("cookies: %s", self.request.cookies)

    37

    38

        cookie = self.request.cookies.get(self.app.cookie_name)

    39

    40

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    41

    42

        if cookie :

    43

            cookie = werkzeug.urls.url_unquote(cookie)

    44

    45

        log.debug("cookie decoded: %s", cookie)

    46

    47

        if cookie :

    48

            return self.app.load(cookie)

    49

    50

class Index (Handler) :

    51

    TITLE = u"Päivölä Network Login"

    52

    53

    pubtkt = None

    54

    cookie_error = None

    55

    56

    def process (self) :

    57

        try :

    58

            self.pubtkt = self.process_cookie()

    59

        except pubtkt.Error as ex :

    60

            self.cookie_error = ex

    64

    65

    def render_valid (self, valid) :

    66

        seconds = valid.seconds + valid.days * (24 * 60 * 60)

    67

    68

        minutes, seconds = divmod(seconds, 60)

    69

        hours, minutes = divmod(minutes, 60)

    70

    71

        return "%2d:%02d:%02d" % (hours, minutes, seconds)

    72

    73

    def render_pubtkt_fields (self, pubtkt) :

    74

        """

    75

            Yield (glyphicon, text) to render as fields for ticket.

    76

        """

    77

    78

        yield 'user', "User account", pubtkt.uid

    79

    80

        valid = self.render_valid(pubtkt.valid())

    81

    82

        if pubtkt.graceperiod :

    83

            valid = "{valid} ({grace})".format(valid=valid, grace=self.render_valid(pubtkt.grace()))

    84

    85

        yield 'time', "Remaining validity", valid

    86

    87

        if pubtkt.cip :

    88

            yield 'cloud', "Network address", pubtkt.cip

    89

    90

        if pubtkt.udata :

    91

            yield 'comment', "Associated data", pubtkt.udata

    92

    93

        for token in pubtkt.tokens :

    94

            yield 'flag', "Access token", token

    95

    96

        if pubtkt.bauth :

    97

            yield 'keys', "Authentication token", pubtkt.bauth

    98

    99

    def render_pubtkt (self, pubtkt) :

   100

        return html.div(class_='panel panel-info')(

   101

            html.div(class_='panel-heading')("Login: {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   102

            html.div(class_='panel-body')(

   103

                "This is a valid login ticket.",

   104

            ),

   105

            html.ul(class_='list-group')(

   106

                html.li(class_='list-group-item', title=title)(

   107

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   108

                    info,

   109

                ) for icon, title, info in self.render_pubtkt_fields(pubtkt)

   110

            ),

   116

        )

   117

   118

    def render_info (self) :

   119

        if self.cookie_error :

   120

            return (

   121

                    html.h2("Invalid cookie"),

   122

                    html.p(self.cookie_error),

   123

            )

   124

   126

   127

    def render (self) :

   128

   129

        return html.div(class_='container')(

   130

                self.render_info(),

   131

        )

   132

   133

class Login (Handler) :

   134

    TITLE = "Login"

   135

   136

    STYLE = """

   137

form#login {

   138

    max-width:  50%;

   139

    padding:    1em;

   140

    margin:     0 auto;

   141

}

   142

   143

    """

   144

   145

   146

    auth_error = None

   147

   148

    def process (self) :

   149

        if self.request.method == 'POST' :

   150

            back = self.app.login_server

   151

            username = self.request.form.get('username')

   152

            password = self.request.form.get('username')

   153

   154

            if username and password :

   155

                # preprocess

   156

                username = username.strip().lower()

   157

   158

                try :

   159

                    pt = self.app.auth(username, password)

   160

   161

                except pubtkt.Error as ex :

   162

                    self.auth_errors = ex

   163

   164

                else :

   165

                    # browsers seem to be very particular about quoting ;'s in cookie values...

   166

                    # this follows PHP's setcookie() encoding...

   167

                    cookie = werkzeug.urls.url_quote(self.app.sign(pt))

   168

   169

                    # redirect with cookie

   170

                    response = pvl.web.response.redirect(back)

   171

   172

                    response.set_cookie(self.app.cookie_name, cookie,

   173

                        domain      = self.app.cookie_domain,

   174

                        secure      = self.app.cookie_secure,

   175

                        httponly    = self.app.cookie_httponly,

   176

                    )

   177

   178

                    return response

   179

   180

    def render (self) :

   181

        domain = self.app.login_domain

   182

   183

        return html.div(class_='container')(

   185

                html.fieldset(

   186

                    html.legend("Log in"),

   187

   188

                    html.div(class_='form-group')(

   189

                        html.div(class_='input-group')(

   190

                            html.label(for_='username', class_='sr-only')("Username"),

   191

                            html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=True),

   192

                            html.span(class_='input-group-addon')("@{domain}".format(domain=domain)),

   193

                        ),

   194

   195

                        html.label(for_='password', class_='sr-only')("Password"),

   196

                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=True),

   197

                    ),

   198

   199

                    html.button(type='submit', class_='btn btn-primary')("Login"),

   200

                )

   201

            )

   202

        )

   203

   242

class LoginApplication (pvl.web.Application) :

   243

    URLS = urls.Map((

   244

        urls.rule('/',              Index),

   245

        urls.rule('/login',         Login),

   247

    ))

   248

   249

    PUBLIC_KEY = 'etc/login/public.pem'

   250

    PRIVATE_KEY = 'etc/login/private.pem'

   251

   252

    login_domain = 'test.paivola.fi'

   253

    login_server = 'https://login.test.paivola.fi/'

   254

    login_expire = datetime.timedelta(hours=1)

   255

   256

    cookie_name = 'auth_pubtkt'

   257

    cookie_domain = 'test.paivola.fi'

   258

    cookie_secure = True

   259

    cookie_httponly = True

   260

   261

    def __init__ (self, public_key=PUBLIC_KEY, private_key=PRIVATE_KEY, **opts) :

   262

        super(LoginApplication, self).__init__(**opts)

   263

   264

        self.server_keys = pubtkt.ServerKeys.config(

   265

                public_key  = public_key,

   266

                private_key = private_key,

   267

        )

   268

   269

    def load (self, cookie) :

   270

        """

   271

            Load a pubtkt from a cookie, and verify it.

   272

        """

   273

   274

        return pubtkt.PubTkt.load(cookie, self.server_keys.public)

   275

   276

    def auth (self, username, password) :

   277

        """

   278

            Perform authentication, returning a PubTkt, signed

   279

        """

   280

   281

        return pubtkt.PubTkt.new(username,

   282

                expiry  = self.login_expire,

   283

        )

   284

   285

    def sign (self, pubtkt) :

   286

        """

   287

            Create a cookie by signing the given pubtkt.

   288

        """

   289

   290

        return pubtkt.sign(self.server_keys.private)

   291