1

# encoding: utf-8

     2

     3

import datetime

     4

import urlparse

     5

import werkzeug

     6

import werkzeug.urls

     7

     8

import pvl.login.auth

     9

import pvl.web

    10

import pvl.web.response

    11

    12

from pvl.login import pubtkt

    13

from pvl.web import urls

    14

from pvl.web import html5 as html

    15

    16

import logging; log = logging.getLogger('pvl.login.server')

    17

    18

class Handler (pvl.web.Handler) :

    19

    # Bootstrap

    20

    DOCTYPE = 'html'

    21

    HTML_XMLNS = None

    22

    HTML_LANG = 'en'

    23

    CSS = (

    24

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/css/bootstrap.min.css',

    25

    )

    26

    JS = (

    27

            '//code.jquery.com/jquery.js',

    28

            '//netdna.bootstrapcdn.com/bootstrap/3.0.3/js/bootstrap.min.js',

    29

    )

    30

    31

    STYLE = """

    32

body {

    33

    padding-top: 2em;

    34

    text-align: center;

    35

}

    36

    37

.container {

    38

    padding: 2em 1em;

    39

    text-align: left;

    40

}

    41

    """

    42

    43

    def redirect (self, *url, **params) :

    44

        return pvl.web.response.redirect(self.url(*url, **params))

    45

    46

    pubtkt = None

    47

    48

    def init (self) :

    49

        self.alerts = []

    50

    51

    def alert (self, type, alert, icon=None) :

    52

        log.info(u"%s: %s", type, alert)

    53

    54

        self.alerts.append((type, icon, unicode(alert)))

    55

    56

    def process_cookie (self) :

    57

        """

    58

            Reverse the urlencoding used for the cookie...

    59

        """

    60

    61

        log.debug("cookies: %s", self.request.cookies)

    62

    63

        cookie = self.request.cookies.get(self.app.cookie_name)

    64

    65

        if not cookie :

    66

            return

    67

    68

        log.debug("cookie %s=%s", self.app.cookie_name, cookie)

    69

    70

        cookie = werkzeug.urls.url_unquote(cookie)

    71

    72

        log.debug("cookie decoded: %s", cookie)

    73

    74

        if not cookie :

    75

            return

    76

    77

        try :

    78

            self.pubtkt = self.app.load(cookie)

    79

    80

        except pubtkt.ParseError as ex :

    81

            self.alert('danger', ex, icon='compare')

    82

    83

        except pubtkt.ExpiredError as ex :

    84

            self.pubtkt = ex.pubtkt

    85

            self.alert('warning', ex, icon='clock')

    86

    87

        except pubtkt.VerifyError as ex :

    88

            self.pubtkt = ex.pubtkt

    89

            self.alert('danger', ex, icon='warning-sign')

    90

    91

    def process_back (self) :

    92

        self.server = None

    93

        self.back = urlparse.urlunparse((self.app.login_scheme, self.app.login_server, '/', '', '', ''))

    94

    95

        back = self.request.args.get('back')

    96

    97

        if back :

    98

            url = urlparse.urlparse(back, self.app.login_scheme)

    99

   100

            if not self.app.login_scheme :

   101

                scheme = url.scheme

   102

   103

            elif url.scheme == self.app.login_scheme :

   104

                scheme = url.scheme

   105

   106

            else :

   107

                self.alert('info', "Using SSL for application URL", icon='lock')

   108

                scheme = self.app.login_scheme

   109

   110

            self.server = self.app.check_server(url.hostname)

   111

            self.back = urlparse.urlunparse((scheme, self.server, url.path, url.params, url.query, url.fragment))

   112

   113

    def render_alerts (self) :

   114

        for type, icon, alert in self.alerts :

   115

            yield html.div(class_='alert alert-{type}'.format(type=type))(

   116

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   117

                    alert

   118

            )

   119

   120

   121

   122

class Index (Handler) :

   123

    TITLE = u"Päivölä Network Login"

   124

   125

    STYLE = Handler.STYLE + """

   126

.pubtkt {

   127

    width: 30em;

   128

    margin: 1em auto;

   129

}

   130

   131

.pubtkt form {

   132

    display: inline;

   133

}

   134

   135

.pubtkt .panel-heading {

   136

    line-height: 20px;

   137

}

   138

   139

.pubtkt .panel-body .glyphicon {

   140

    width: 1em;

   141

    float: left;

   142

    line-height: 20px;

   143

}

   144

   145

.pubtkt .panel-body .progress {

   146

    margin-bottom: 0;

   147

    margin-left: 2em;

   148

}

   149

    """

   150

   151

    JS = Handler.JS + (

   152

        '/static/pubtkt-expire.js',

   153

    )

   154

   155

    def process (self) :

   156

        self.process_cookie()

   157

   158

        if not self.pubtkt :

   159

            return self.redirect(Login)

   160

   161

    def render_valid (self, valid) :

   162

        seconds = valid.seconds + valid.days * (24 * 60 * 60)

   163

   164

        minutes, seconds = divmod(seconds, 60)

   165

        hours, minutes = divmod(minutes, 60)

   166

   167

        return "%2d:%02d:%02d" % (hours, minutes, seconds)

   168

   169

    def render_status (self, pubtkt) :

   170

        valid = pubtkt.valid()

   171

        grace = pubtkt.grace()

   172

   173

        if grace :

   174

            return 'warning'

   175

        elif valid :

   176

            return 'success'

   177

        else :

   178

            return 'danger'

   179

   180

    def render_pubtkt_valid (self, pubtkt) :

   181

        """

   182

            Yield HTML for ticket validity.

   183

        """

   184

   185

   186

        lifetime = self.app.login_valid

   187

        valid = pubtkt.valid()

   188

        grace = pubtkt.grace()

   189

        grace_period = pubtkt.grace_period()

   190

        remaining = pubtkt.remaining()

   191

   192

        if valid :

   193

            progress = float(valid.seconds) / float(lifetime.seconds)

   194

        else :

   195

            progress = None

   196

   197

        if grace :

   198

            title = "Remaining renewal period"

   199

            label = "{grace} (Renew)".format(grace=self.render_valid(grace))

   200

            status = 'warning'

   201

        elif valid :

   202

            title = "Remaining validity period"

   203

            label = "{valid}".format(valid=self.render_valid(valid))

   204

            status = 'success'

   205

        else :

   206

            title = "Expired"

   207

            label = "Expired"

   208

            status = 'danger'

   209

   210

        if progress :

   211

            return html.div(class_='panel-body', title=title)(

   212

                html.span(class_='glyphicon glyphicon-time'),

   213

                html.div(class_='progress pubtkt-progress',

   214

                    data_start=valid.seconds,

   215

                    data_refresh=grace_period.seconds if remaining else None,

   216

                    data_end=lifetime.seconds,

   217

                )(

   218

                    html.div(class_='progress-bar progress-bar-{status}'.format(status=status),

   219

                        role='progressbar',

   220

                        style='width: {pp:.0f}%'.format(pp=progress*100),

   221

                    )(

   222

                        html.span(class_='pubtkt-progress-label')(label)

   223

                    )

   224

                )

   225

            )

   226

        else :

   227

            return None # html.p(label)

   228

   229

    def render_pubtkt_fields (self, pubtkt) :

   230

        """

   231

            Yield (glyphicon, text) to render as fields for ticket.

   232

        """

   233

   234

        if pubtkt.cip :

   235

            yield 'cloud', None, "Network address", pubtkt.cip

   236

   237

        if pubtkt.udata :

   238

            yield 'comment', None, "Associated data", pubtkt.udata

   239

   240

        for token in pubtkt.tokens :

   241

            yield 'flag', None, "Access token", token

   242

   243

        if pubtkt.bauth :

   244

            yield 'keys', None, "Authentication token", pubtkt.bauth

   245

   246

    def render_pubtkt (self, pubtkt) :

   247

        status = self.render_status(pubtkt)

   248

        domain = self.app.login_domain

   249

   250

        return html.div(class_='pubtkt panel panel-{status}'.format(status=status))(

   251

            html.div(class_='panel-heading')(

   252

                html.span(class_='glyphicon glyphicon-user'),

   253

                html.strong(pubtkt.uid),

   254

                html.span("@", domain),

   255

            ),

   256

            self.render_pubtkt_valid(pubtkt),

   257

            html.ul(class_='list-group')(

   258

                html.li(class_='list-group-item {status}'.format(status=('alert-'+status if status else '')), title=title)(

   259

                    html.span(class_='glyphicon glyphicon-{glyphicon}'.format(glyphicon=icon)) if icon else None,

   260

                    data,

   261

                ) for icon, status, title, data in self.render_pubtkt_fields(pubtkt)

   262

            ),

   263

            html.div(class_='panel-footer')(

   264

                #html.div(class_='btn-toolbar', role='toolbar')(

   265

                    (

   266

                        html.form(action=self.url(Login), method='post', class_='form-inline')(

   267

                            html.button(type='submit', class_='btn btn-success')(

   268

                                html.span(class_='glyphicon glyphicon-time'), "Renew"

   269

                            )

   270

                        )

   271

                    ) if pubtkt.valid() else (

   272

                        html.form(action=self.url(Login), method='get', class_='form-inline')(

   273

                            html.button(type='submit', class_='btn btn-info')(

   274

                                html.span(class_='glyphicon glyphicon-log-in'), "Login"

   275

                            )

   276

                        ),

   277

                    ),

   278

   279

                    html.form(action=self.url(Logout), method='post', class_='form-inline pull-right')(

   280

                        html.button(type='submit', class_='btn btn-warning')(

   281

                            html.span(class_='glyphicon glyphicon-log-out'), "Logout"

   282

                        )

   283

                    ),

   284

                #),

   285

            ),

   286

        )

   287

   288

    def render (self) :

   289

        return html.div(class_='container')(

   290

                self.render_alerts(),

   291

                self.render_pubtkt(self.pubtkt) if self.pubtkt else None,

   292

        )

   293

   294

class Login (Handler) :

   295

    TITLE = "Login"

   296

   297

    STYLE = Handler.STYLE + """

   298

form#login {

   299

    max-width:  50%;

   300

    padding:    1em;

   301

    margin:     0 auto;

   302

}

   303

   304

    """

   308

    def process (self) :

   309

        self.process_cookie()

   310

   311

        try :

   312

            self.process_back()

   313

        except pubtkt.Error as ex :

   314

            self.alert('danger', ex)

   315

   316

        if self.pubtkt :

   317

            self.username = self.pubtkt.uid

   318

        else :

   319

            self.username = None

   320

   321

        # update cookie?

   322

        set_pubtkt = None

   323

   324

        if self.request.method == 'POST' :

   325

            username = self.request.form.get('username')

   326

            password = self.request.form.get('password')

   327

   328

            if username :

   329

                # preprocess

   330

                username = username.strip().lower()

   331

   332

            if username and password :

   333

                self.username = username

   334

   335

                try :

   336

                    set_pubtkt = self.app.auth(username, password)

   337

   338

                except pvl.login.auth.AuthError as ex :

   339

                    self.alert('danger', "Internal authentication error, try again later?")

   340

   344

   345

            elif self.pubtkt and self.pubtkt.valid() :

   346

                # renew manually if valid

   347

                set_pubtkt = self.app.renew(self.pubtkt)

   352

   353

        elif 'renew' in self.request.args :

   354

            # renew automatically if in grace period

   355

            if self.pubtkt and self.pubtkt.grace() :

   356

                set_pubtkt = self.app.renew(self.pubtkt)

   357

   358

        if set_pubtkt :

   359

            # browsers seem to be very particular about quoting ;'s in cookie values...

   360

            # this follows PHP's setcookie() encoding...

   361

            cookie = werkzeug.urls.url_quote(self.app.sign(set_pubtkt))

   362

   363

            self.pubtkt = set_pubtkt

   364

   365

            # redirect with cookie

   366

            response = pvl.web.response.redirect(self.back)

   367

   368

            response.set_cookie(self.app.cookie_name, cookie,

   369

                domain      = self.app.cookie_domain,

   370

                secure      = self.app.cookie_secure,

   371

                httponly    = self.app.cookie_httponly,

   372

            )

   373

   374

            return response

   375

   381

   382

    def render (self) :

   383

        domain = self.app.login_domain

   384

   385

        if 'logout' in self.request.args :

   386

            self.alert('info', "You have been logged out.", icon='log-out')

   387

   388

        if self.pubtkt and self.pubtkt.valid() :

   389

            renew = True

   390

   391

            # within validity period...

   392

            self.alert('info', "Login or renew ticket.", icon='log-in')

   393

   394

        else :

   395

            renew = False

   396

   397

        return html.div(class_='container')(

   398

            html.form(action=self.url(back=self.back), method='POST', id='login')(

   399

                self.render_alerts(),

   400

   401

                html.fieldset(

   402

                    html.legend(

   403

                        (

   404

                            "Login @ ",

   405

                            html.a(href=self.back)(self.server),

   406

                        ) if self.server else (

   407

                            "Login"

   408

                        )

   409

                   ),

   410

   411

                    html.div(class_='form-group')(

   412

                        html.div(class_='input-group')(

   413

                            html.label(for_='username', class_='sr-only')("Username"),

   414

                            html.input(name='username', type='text', class_='form-control', placeholder="username", required=True, autofocus=(not self.username), value=self.username),

   415

                            html.span(class_='input-group-addon')("@{domain}".format(domain=domain)),

   416

                        ),

   417

   418

                        html.label(for_='password', class_='sr-only')("Password"),

   419

                        html.input(name='password', type='password', class_='form-control', placeholder="Password", required=(not renew), autofocus=bool(self.username)),

   420

                    ),

   421

   422

                    html.button(type='submit', class_='btn btn-primary')(

   423

                        html.span(class_='glyphicon glyphicon-log-in'), "Login"

   424

                    ),

   425

   426

                    html.button(type='submit', class_='btn btn-success')(

   427

                        html.span(class_='glyphicon glyphicon-time'), "Renew"

   428

                    ) if renew else None,

   429

                )

   430

            )

   431

        )

   432

   433

class Logout (Handler) :

   434

    TITLE = "Logout"

   435

   436

    def process (self) :

   437

        self.process_cookie()

   438

   439

        if not self.pubtkt :

   440

            return self.redirect(Login)

   441

   442

        if self.request.method == 'POST' :

   443

            response = pvl.web.response.redirect(self.url(Login, logout=1))

   444

   445

            response.set_cookie(self.app.cookie_name, '',

   446

                    expires = 0,

   447

                    domain      = self.app.cookie_domain,

   448

                    secure      = self.app.cookie_secure,

   449

                    httponly    = self.app.cookie_httponly,

   450

            )

   451

   452

            return response

   453

   454

    def render (self) :

   455

        return html.div(class_='container')(

   456

            html.form(action=self.url(), method='post')(

   457

                html.fieldset(

   458

                    html.legend("Logout {pubtkt.uid}".format(pubtkt=self.pubtkt)),

   459

   460

                    html.button(type='submit', class_='btn btn-warning')(

   461

                        html.span(class_='glyphicon glyphicon-log-out'), "Logout"

   462

                    ),

   463

                )

   464

            )

   465

        )

   466

   467

class LoginApplication (pvl.web.Application) :

   468

    URLS = urls.Map((

   469

        urls.rule('/',              Index),

   470

        urls.rule('/login',         Login),

   471

        urls.rule('/logout',        Logout),

   472

    ))

   473

   474

    PUBLIC_KEY = 'etc/login/public.pem'

   475

    PRIVATE_KEY = 'etc/login/private.pem'

   476

   477

    login_domain = 'test.paivola.fi'

   478

    login_server = 'login.test.paivola.fi'

   479

    login_valid = datetime.timedelta(seconds=60)

   480

    login_grace = datetime.timedelta(seconds=30)

   481

    login_scheme = 'https'

   482

   483

    cookie_name = 'auth_pubtkt'

   484

    cookie_domain = 'test.paivola.fi'

   485

    cookie_secure = True

   486

    cookie_httponly = True

   487

   488

    def __init__ (self, auth, public_key=PUBLIC_KEY, private_key=PRIVATE_KEY, **opts) :

   489

        super(LoginApplication, self).__init__(**opts)

   490

   491

        self._auth = auth

   492

        self.server_keys = pubtkt.ServerKeys.config(