<s> """<STR_LIT>""" <EOL> from collections import namedtuple <EOL> from functools import wraps <EOL> from flask import ( abort , current_app , Response , request , <EOL> url_for , redirect , _request_ctx_stack ) <EOL> from flask_login import current_user , login_required <EOL> from flask_principal import RoleNeed , Permission , Identity , identity_changed <EOL> from werkzeug . local import LocalProxy <EOL> from werkzeug . routing import BuildError <EOL> from . import utils <EOL> _security = LocalProxy ( lambda : current_app . extensions [ '<STR_LIT>' ] ) <EOL> _default_unauthorized_html = """<STR_LIT>""" <EOL> BasicAuth = namedtuple ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> def _get_unauthorized_response ( text = None , headers = None ) : <EOL> text = text or _default_unauthorized_html <EOL> headers = headers or { } <EOL> return Response ( text , <NUM_LIT> , headers ) <EOL> def _get_unauthorized_view ( ) : <EOL> view = utils . get_url ( utils . config_value ( '<STR_LIT>' ) ) <EOL> if view : <EOL> if callable ( view ) : <EOL> view = view ( ) <EOL> else : <EOL> try : <EOL> view = url_for ( view ) <EOL> except BuildError : <EOL> view = None <EOL> utils . do_flash ( * utils . get_message ( '<STR_LIT>' ) ) <EOL> return redirect ( view or request . referrer or '<STR_LIT:/>' ) <EOL> abort ( <NUM_LIT> ) <EOL> def _check_token ( ) : <EOL> header_key = _security . token_authentication_header <EOL> args_key = _security . token_authentication_key <EOL> header_token = request . headers . get ( header_key , None ) <EOL> token = request . args . get ( args_key , header_token ) <EOL> if request . get_json ( silent = True ) : <EOL> if not isinstance ( request . json , list ) : <EOL> token = request . json . get ( args_key , token ) <EOL> user = _security . login_manager . token_callback ( token ) <EOL> if user and user . is_authenticated : <EOL> app = current_app . _get_current_object ( ) <EOL> _request_ctx_stack . top . user = user <EOL> identity_changed . send ( app , identity = Identity ( user . id ) ) <EOL> return True <EOL> return False <EOL> def _check_http_auth ( ) : <EOL> auth = request . authorization or BasicAuth ( username = None , password = None ) <EOL> user = _security . datastore . find_user ( email = auth . username ) <EOL> if user and utils . verify_and_update_password ( auth . password , user ) : <EOL> _security . datastore . commit ( ) <EOL> app = current_app . _get_current_object ( ) <EOL> _request_ctx_stack . top . user = user <EOL> identity_changed . send ( app , identity = Identity ( user . id ) ) <EOL> return True <EOL> return False <EOL> def http_auth_required ( realm ) : <EOL> """<STR_LIT>""" <EOL> def decorator ( fn ) : <EOL> @ wraps ( fn ) <EOL> def wrapper ( * args , ** kwargs ) : <EOL> if _check_http_auth ( ) : <EOL> return fn ( * args , ** kwargs ) <EOL> if _security . _unauthorized_callback : <EOL> return _security . _unauthorized_callback ( ) <EOL> else : <EOL> r = _security . default_http_auth_realm if callable ( realm ) else realm <EOL> h = { '<STR_LIT>' : '<STR_LIT>' % r } <EOL> return _get_unauthorized_response ( headers = h ) <EOL> return wrapper <EOL> if callable ( realm ) : <EOL> return decorator ( realm ) <EOL> return decorator <EOL> def auth_token_required ( fn ) : <EOL> """<STR_LIT>""" <EOL> @ wraps ( fn ) <EOL> def decorated ( * args , ** kwargs ) : <EOL> if _check_token ( ) : <EOL> return fn ( * args , ** kwargs ) <EOL> if _security . _unauthorized_callback : <EOL> return _security . _unauthorized_callback ( ) <EOL> else : <EOL> return _get_unauthorized_response ( ) <EOL> return decorated <EOL> def auth_required ( * auth_methods ) : <EOL> """<STR_LIT>""" <EOL> login_mechanisms = { <EOL> '<STR_LIT>' : lambda : _check_token ( ) , <EOL> '<STR_LIT>' : lambda : _check_http_auth ( ) , <EOL> '<STR_LIT>' : lambda : current_user . is_authenticated <EOL> } <EOL> def wrapper ( fn ) : <EOL> @ wraps ( fn ) <EOL> def decorated_view ( * args , ** kwargs ) : <EOL> h = { } <EOL> mechanisms = [ ( method , login_mechanisms . get ( method ) ) for method in auth_methods ] <EOL> for method , mechanism in mechanisms : <EOL> if mechanism and mechanism ( ) : <EOL> return fn ( * args , ** kwargs ) <EOL> elif method == '<STR_LIT>' : <EOL> r = _security . default_http_auth_realm <EOL> h [ '<STR_LIT>' ] = '<STR_LIT>' % r <EOL> if _security . _unauthorized_callback : <EOL> return _security . _unauthorized_callback ( ) <EOL> else : <EOL> return _get_unauthorized_response ( headers = h ) <EOL> return decorated_view <EOL> return wrapper <EOL> def roles_required ( * roles ) : <EOL> """<STR_LIT>""" <EOL> def wrapper ( fn ) : <EOL> @ wraps ( fn ) <EOL> def decorated_view ( * args , ** kwargs ) : <EOL> perms = [ Permission ( RoleNeed ( role ) ) for role in roles ] <EOL> for perm in perms : <EOL> if not perm . can ( ) : <EOL> if _security . _unauthorized_callback : <EOL> return _security . _unauthorized_callback ( ) <EOL> else : <EOL> return _get_unauthorized_view ( ) <EOL> return fn ( * args , ** kwargs ) <EOL> return decorated_view <EOL> return wrapper <EOL> def roles_accepted ( * roles ) : <EOL> """<STR_LIT>""" <EOL> def wrapper ( fn ) : <EOL> @ wraps ( fn ) <EOL> def decorated_view ( * args , ** kwargs ) : <EOL> perm = Permission ( * [ RoleNeed ( role ) for role in roles ] ) <EOL> if perm . can ( ) : <EOL> return fn ( * args , ** kwargs ) <EOL> if _security . _unauthorized_callback : <EOL> return _security . _unauthorized_callback ( ) <EOL> else : <EOL> return _get_unauthorized_view ( ) <EOL> return decorated_view <EOL> return wrapper <EOL> def anonymous_user_required ( f ) : <EOL> @ wraps ( f ) <EOL> def wrapper ( * args , ** kwargs ) : <EOL> if current_user . is_authenticated : <EOL> return redirect ( utils . get_url ( _security . post_login_view ) ) <EOL> return f ( * args , ** kwargs ) <EOL> return wrapper </s>
