U
    d&3                     @   s   d dl Z d dlZd dlZd dlZd dlmZ d dlZd dlZd dl	Zd dl
mZ d dlmZ ddlmZ G dd deejjZG d	d
 d
eZG dd deejjZG dd deejjZG dd deejjZdS )    N)	urlencode)options)instantiate   )BaseHandlerc                   @   s0   e Zd ZdZejjdd Zejjdd ZdS )GoogleAuth2LoginHandleroauthc                 c   sn   | j | j d }| ddr@| j|| ddV }| |V  n*| j|| j | j d ddgddd	id
V  d S )Nredirect_uricodeFr	   r
   keyZprofileemailapproval_prompt r	   	client_idZscopeZresponse_typeZextra_paramssettings_OAUTH_SETTINGS_KEYget_argumentget_authenticated_user_on_authauthorize_redirectselfr	   user r   5/tmp/pip-unpacked-wheel-3pokl8eb/flower/views/auth.pyget   s    zGoogleAuth2LoginHandler.getc              
   c   s  |st jdd|d }z |  jddd| idV }W n4 tk
rn } zt jdd| W 5 d }~X Y nX t|j	d	d
 }t
| jjj|sdj|d}t jd|| dt| | d| jjjpd}| jjjr|d dkrd| }| | d S )N  zGoogle auth failedaccess_tokenz)https://www.googleapis.com/userinfo/v2/meAuthorizationz	Bearer %sheaderszGoogle auth failed: %sutf-8r   zlAccess denied to '{email}'. Please use another account or ask your admin to add your email to flower --auth.)r   r   next/r   )tornadoweb	HTTPErrorget_auth_http_clientfetch	Exceptionjsonloadsbodydecoderematchapplicationr   authformatset_secure_cookiestrr   
url_prefixredirect)r   r   r    responseer   messagenext_r   r   r   r   &   s,    
$z GoogleAuth2LoginHandler._on_authN)	__name__
__module____qualname__r   r'   gen	coroutiner   r   r   r   r   r   r      s
   
r   c                   @   s   e Zd Zdd ZdS )LoginHandlerc                 O   s   t tjf||S )N)r   r   Zauth_provider)clsargskwargsr   r   r   __new__E   s    zLoginHandler.__new__N)r>   r?   r@   rG   r   r   r   r   rC   D   s   rC   c                   @   sL   e Zd ZdZdZdZdZejj	dd Z
ejj	dd Zejj	d	d
 ZdS )GithubLoginHandlerz(https://github.com/login/oauth/authorizez+https://github.com/login/oauth/access_tokenFr   c                 c   s   t ||| j| j d | j| j d dd}|  j| jdddd|d	V }|jrftj	d
t
| tjt|jdd S Nr   secretauthorization_coder	   r
   r   Zclient_secretZ
grant_typePOST!application/x-www-form-urlencodedapplication/jsonzContent-TypeAcceptmethodr#   r/   OAuth authenticator error: %sr$   r   r   r   r*   r+   _OAUTH_ACCESS_TOKEN_URLerrorr'   r4   	AuthErrorr7   rA   Returnr-   r.   r/   r0   r   r	   r
   r/   r:   r   r   r   r   P   s(    
z)GithubLoginHandler.get_authenticated_userc                 c   sl   | j | j d }| ddr@| j|| ddV }| |V  n(| j|| j | j d dgdddid	V  d S )
Nr	   r
   Fr   r   z
user:emailr   r   r   r   r   r   r   r   r   f   s    zGithubLoginHandler.getc                 #   s   |st jdd|d }  jdd| dddV } fd	d
t|jdD }|snd}t jd| 	dt
|   d jjjpd} jjjr|d dkrd| } | d S )N  OAuth authentication failedr    z"https://api.github.com/user/emailsztoken Tornado authr!   z
User-agentr"   c                    s6   g | ].}|d  rt  jjj|d r|d  qS )Zverifiedr   )r1   r2   r3   r   r4   lower).0r   r   r   r   
<listcomp>   s     z/GithubLoginHandler._on_auth.<locals>.<listcomp>r$   _Access denied. Please use another account or ask your admin to add your email to flower --auth.r   r   r%   r&   r   )r'   r(   r)   r*   r+   r-   r.   r/   r0   r6   r7   popr   r3   r   r8   r9   )r   r   r    r:   Zemailsr<   r=   r   ra   r   r   x   s&     zGithubLoginHandler._on_authN)r>   r?   r@   _OAUTH_AUTHORIZE_URLrV   _OAUTH_NO_CALLBACKSr   r'   rA   rB   r   r   r   r   r   r   r   rH   I   s   

rH   c                   @   sH   e Zd ZdZdZdZejjdd Z	ejjdd Z
ejjdd	 Zd
S )GitLabLoginHandlerz"https://gitlab.com/oauth/authorizezhttps://gitlab.com/oauth/tokenFc                 c   s   t ||| jd d | jd d dd}|  j| jdddd	|d
V }|jrbtjdt	| tj
t|jdd S )Nr   r   rJ   rK   rL   rM   rN   rO   rP   rR   rT   r$   )r   r   r*   r+   rV   rW   r'   r4   rX   r7   rA   rY   r-   r.   r/   r0   rZ   r   r   r   r      s$    z)GitLabLoginHandler.get_authenticated_userc                 c   sh   | j d d }| ddr>| j|| ddV }| |V  n&| j|| j d d dgddd	id
V  d S )Nr   r	   r
   Fr   r   Zread_apir   r   r   )r   r   r   r   r   r   r   r   r   r      s    zGitLabLoginHandler.getc              
   #   s  |st jdd|d }tjdd dd  dD  z"|  jd	d
| dddV }W n4 t	k
r } zt jdd| W 5 d }~X Y nX t
|jdd }t| jjj|}g } rtjdd}|  jd|f d
| dddV } fddt
|jdD }|r2 rDt|dkrDd}	t jd|	| dt| | d| jjjphd}
| jjjr|
d dkrd|
 }
| |
 d S )Nr[   r\   r    Z!FLOWER_GITLAB_AUTH_ALLOWED_GROUPSr   c                 S   s   g | ]}|r|  qS r   )stripr`   groupr   r   r   rb      s      z/GitLabLoginHandler._on_auth.<locals>.<listcomp>,zhttps://gitlab.com/api/v4/userBearer r]   r^   r"   r   zGitLab auth failed: %sr$   r   ZFLOWER_GITLAB_MIN_ACCESS_LEVELZ20z4https://gitlab.com/api/v4/groups?min_access_level=%sc                    s    g | ]}|d   kr|d qS )	full_pathidr   ri   Zallowed_groupsr   r   rb      s   r   z@Access denied. Please use another account or contact your admin.r   r%   r&   )r'   r(   r)   osenvironr   splitr*   r+   r,   r-   r.   r/   r0   r1   r2   r3   r   r4   lenr6   r7   r   r8   r9   )r   r   r    r:   r;   Z
user_emailZemail_allowedZmatching_groupsZmin_access_levelr<   r=   r   ro   r   r      sH    $
zGitLabLoginHandler._on_authN)r>   r?   r@   re   rV   rf   r'   rA   rB   r   r   r   r   r   r   r   rg      s   

rg   c                   @   st   e Zd ZdZdZedd Zedd Zedd Zed	d
 Z	e
jjdd Ze
jjdd Ze
jjdd ZdS )OktaLoginHandlerFr   c                 C   s   t jdS )NZFLOWER_OAUTH2_OKTA_BASE_URL)rp   rq   r   ra   r   r   r   base_url   s    zOktaLoginHandler.base_urlc                 C   s   d | jS )Nz{}/v1/authorizer5   ru   ra   r   r   r   re      s    z%OktaLoginHandler._OAUTH_AUTHORIZE_URLc                 C   s   d | jS )Nz{}/v1/tokenrv   ra   r   r   r   rV      s    z(OktaLoginHandler._OAUTH_ACCESS_TOKEN_URLc                 C   s   d | jS )Nz{}/v1/userinforv   ra   r   r   r   _OAUTH_USER_INFO_URL  s    z%OktaLoginHandler._OAUTH_USER_INFO_URLc                 c   s   t ||| j| j d | j| j d dd}|  j| jdddd|d	V }|jrftj	d
t
| tjt|jdd S rI   rU   rZ   r   r   r   get_access_token  s(    
z!OktaLoginHandler.get_access_tokenc                 c   s   | j | j d }| ddrz| dp(dd}| d}|d ksJ||krVtjd| j|| dd	V }| 	|V  n@t
t }| d| | j|| j | j d
 dgdd|idV  d S )Nr	   r
   Foauth_state    r$   statez4OAuth authenticator error: State tokens do not matchr   r   zopenid emailr   )r   r   r   Zget_secure_cookier0   r'   r4   rX   rx   r   r7   uuidZuuid4r6   r   )r   r	   Zexpected_stateZreturned_stateaccess_token_responser{   r   r   r   r     s,    
zOktaLoginHandler.getc           	      c   s   |st jdd|d }|  j| jd| dddV }t|j	d}|
d	pXd
 }|
doxt| jjj|}|sd}t jd|| dt| | d | d| jjjpd}| jjjr|d dkrd| }| | d S )Nr[   r\   r    rl   r]   r^   r"   r$   r   r   email_verifiedrc   r   r   ry   r%   r&   r   )r'   r(   r)   r*   r+   rw   r-   r.   r/   r0   r   rh   r1   r2   r3   r   r4   r6   r7   Zclear_cookier   r8   r9   )	r   r}   r    r:   Zdecoded_bodyr   r~   r<   r=   r   r   r   r   7  s0    

zOktaLoginHandler._on_authN)r>   r?   r@   rf   r   propertyru   re   rV   rw   r'   rA   rB   rx   r   r   r   r   r   r   rt      s    





rt   )r-   r1   rp   r|   urllib.parser   Ztornado.genr'   Ztornado.webZtornado.authZtornado.optionsr   Zcelery.utils.importsr   Zviewsr   r4   ZGoogleOAuth2Mixinr   rC   ZOAuth2MixinrH   rg   rt   r   r   r   r   <module>   s   3L]