<s> import json <EOL> import hmac <EOL> import hashlib <EOL> from django . http import HttpResponse <EOL> import django . contrib . auth as djangoAuth <EOL> from django . core . context_processors import csrf <EOL> from django . shortcuts import render_to_response <EOL> from django . views . decorators . csrf import ( <EOL> csrf_exempt , csrf_protect , ensure_csrf_cookie <EOL> ) <EOL> import sys <EOL> sys . path . append ( "<STR_LIT>" ) <EOL> import crudAPI <EOL> import httpStatusCodes <EOL> import auth . models as authModels <EOL> import auth . authConstants as authConstants <EOL> hashAlgoMemoizer = { } <EOL> def __getHashDigest ( obj , hashAlgoName = '<STR_LIT>' ) : <EOL> if not obj : <EOL> return httpStatusCodes . BAD_REQUEST , None <EOL> hashAlgo = hashAlgoMemoizer . get ( hashAlgoName , None ) <EOL> if not hashAlgo : <EOL> hashAlgo = getattr ( hashlib , hashAlgoName , None ) <EOL> if not hashAlgo : <EOL> return httpStatusCodes . METHOD_NOT_ALLOWED , None <EOL> hashAlgoMemoizer [ hashAlgoName ] = hashAlgo <EOL> if not isinstance ( obj , bytes ) : <EOL> if not hasattr ( obj , '<STR_LIT>' ) : <EOL> return httpStatusCodes . METHOD_NOT_ALLOWED , None <EOL> obj = crudAPI . byteFy ( str ( obj ) ) <EOL> return httpStatusCodes . OK , hashAlgo ( obj ) . hexdigest ( ) <EOL> def _requiredHttpMethodCheck ( request , methodName ) : <EOL> method = request . method <EOL> if method != methodName : <EOL> resp = HttpResponse ( ) <EOL> resp . status_code = httpStatusCodes . METHOD_NOT_ALLOWED <EOL> resp . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' % ( methodName ) } ) ) <EOL> return resp <EOL> def credentialFieldCheck ( <EOL> credentials , expectedFields = [ '<STR_LIT>' , '<STR_LIT:username>' , '<STR_LIT:password>' ] <EOL> ) : <EOL> for keyword in expectedFields : <EOL> retr = credentials . get ( keyword , None ) <EOL> if not retr : <EOL> response = HttpResponse ( ) <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' % ( keyword ) } ) ) <EOL> response . status_code = httpStatusCodes . BAD_REQUEST <EOL> return response <EOL> @ csrf_protect <EOL> @ ensure_csrf_cookie <EOL> def newUser ( request ) : <EOL> notMethodCheckResponse = _requiredHttpMethodCheck ( request , '<STR_LIT:POST>' ) <EOL> if notMethodCheckResponse : <EOL> return notMethodCheckResponse <EOL> status , reqBody = crudAPI . _altParseRequestBody ( request , '<STR_LIT:POST>' , True ) <EOL> if status != httpStatusCodes . OK : <EOL> resp = HttpResponse ( ) <EOL> resp . status_code = httpStatusCodes . BAD_REQUEST <EOL> resp . write ( json . dumps ( { <EOL> '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return resp <EOL> missingCredsResponse = credentialFieldCheck ( <EOL> reqBody , [ '<STR_LIT>' , '<STR_LIT:username>' ] ) <EOL> if missingCredsResponse : <EOL> return missingCredsResponse <EOL> appAccessId = reqBody [ '<STR_LIT>' ] <EOL> appLookUp = authModels . App . objects . filter ( _accessId = appAccessId ) <EOL> if not appLookUp : <EOL> response . status_code = httpStatusCodes . NOT_FOUND <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> djangoUser = djangoAuth . models . User . objects . filter ( username = reqBody [ '<STR_LIT:username>' ] ) <EOL> resp = HttpResponse ( ) <EOL> if not djangoUser : <EOL> status , user = createDjangoUser ( reqBody ) <EOL> if status != httpStatusCodes . OK : <EOL> resp . status_code = status <EOL> return resp <EOL> else : <EOL> user = djangoUser [ <NUM_LIT:0> ] <EOL> authUserQuery = authModels . AuthUser . objects . filter ( <EOL> djangoUser_id = user . id , app_id = appLookUp [ <NUM_LIT:0> ] . id ) <EOL> response = HttpResponse ( ) <EOL> if authUserQuery : <EOL> response . status_code = httpStatusCodes . CONFLICT <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> else : <EOL> try : <EOL> newAuthEntry = authModels . AuthUser ( <EOL> djangoUser_id = user . id , app_id = appLookUp [ <NUM_LIT:0> ] . id , meta = reqBody . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> ) <EOL> newAuthEntry . save ( ) <EOL> except Exception , e : <EOL> print ( e ) <EOL> response . status_code = httpStatusCodes . BAD_REQUEST <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> else : <EOL> response . status_code = httpStatusCodes . OK <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> def createDjangoUser ( userCredentials ) : <EOL> allowedAttrs = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:email>' , '<STR_LIT:username>' ] <EOL> createdB = { } <EOL> for pickedKey in allowedAttrs : <EOL> createdB [ pickedKey ] = userCredentials . get ( pickedKey , '<STR_LIT>' ) <EOL> createdB [ '<STR_LIT:password>' ] = authModels . generateUUID ( ) . hex <EOL> try : <EOL> freshUser = djangoAuth . models . User . objects . create_user ( ** createdB ) <EOL> except Exception , e : <EOL> return httpStatusCodes . INTERNAL_SERVER_ERROR , e <EOL> else : <EOL> return httpStatusCodes . OK , freshUser <EOL> def checkHMACValidity ( userKey , msg , purportedResponse ) : <EOL> return hmac . HMAC ( <EOL> key = userKey , msg = msg , digestmod = hashlib . sha256 <EOL> ) . hexdigest ( ) == purportedResponse <EOL> @ csrf_protect <EOL> @ ensure_csrf_cookie <EOL> def loginByPassword ( request ) : <EOL> '''<STR_LIT>''' <EOL> notMethodCheckResponse = _requiredHttpMethodCheck ( request , '<STR_LIT:POST>' ) <EOL> if notMethodCheckResponse : <EOL> return notMethodCheckResponse <EOL> status , bodyParseResponse = crudAPI . _altParseRequestBody ( request , '<STR_LIT:POST>' ) <EOL> response = HttpResponse ( ) <EOL> if status != httpStatusCodes . OK : <EOL> response . status_code = httpStatusCodes . BAD_REQUEST <EOL> response . write ( json . dumps ( { <EOL> '<STR_LIT>' : '<STR_LIT>' <EOL> } ) ) <EOL> return response <EOL> credentials = bodyParseResponse <EOL> missingCredsResponse = credentialFieldCheck ( credentials , [ <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT:password>' , '<STR_LIT:username>' <EOL> ] ) <EOL> if missingCredsResponse : <EOL> return missingCredsResponse <EOL> appLookUp = authModels . App . objects . filter ( _accessId = credentials [ '<STR_LIT>' ] ) <EOL> if not appLookUp : <EOL> response . status_code = httpStatusCodes . NOT_FOUND <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> logout ( request ) <EOL> djangoUser = djangoAuth . authenticate ( <EOL> username = credentials [ '<STR_LIT:username>' ] , password = credentials [ '<STR_LIT:password>' ] <EOL> ) <EOL> if not djangoUser : <EOL> response . status_code = httpStatusCodes . FORBIDDEN <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> headApp = appLookUp [ <NUM_LIT:0> ] <EOL> appUser = authModels . AuthUser . objects . filter ( <EOL> app_id = headApp . id , djangoUser_id = djangoUser . id , _accessId = credentials [ '<STR_LIT>' ] <EOL> ) <EOL> if not appUser : <EOL> response . status_code = httpStatusCodes . FORBIDDEN <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> try : <EOL> djangoAuth . login ( request , djangoUser ) <EOL> except Exception , e : <EOL> print ( e ) <EOL> response . status_code = httpStatusCodes . BAD_REQUEST <EOL> else : <EOL> csrf ( request ) <EOL> response . status_code = httpStatusCodes . OK <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> @ csrf_protect <EOL> @ ensure_csrf_cookie <EOL> def loginBySignature ( request ) : <EOL> '''<STR_LIT>''' <EOL> notMethodCheckResponse = _requiredHttpMethodCheck ( request , '<STR_LIT:POST>' ) <EOL> if notMethodCheckResponse : <EOL> return notMethodCheckResponse <EOL> status , bodyParseResponse = crudAPI . _altParseRequestBody ( request , '<STR_LIT:POST>' ) <EOL> response = HttpResponse ( ) <EOL> if status != httpStatusCodes . OK : <EOL> response . status_code = httpStatusCodes . BAD_REQUEST <EOL> response . write ( json . dumps ( { <EOL> '<STR_LIT>' : '<STR_LIT>' <EOL> } ) ) <EOL> return response <EOL> credentials = bodyParseResponse <EOL> missingCredsResponse = credentialFieldCheck ( <EOL> credentials , [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> ) <EOL> if missingCredsResponse : <EOL> return missingCredsResponse <EOL> response = HttpResponse ( ) <EOL> appLookUp = authModels . App . objects . filter ( _accessId = credentials [ '<STR_LIT>' ] ) <EOL> if not appLookUp : <EOL> response . status_code = httpStatusCodes . NOT_FOUND <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> userAccessId = credentials [ '<STR_LIT>' ] <EOL> userLookUp = authModels . AuthUser . objects . filter ( <EOL> app_id = appLookUp [ <NUM_LIT:0> ] . id , _accessId = userAccessId ) <EOL> if not userLookUp : <EOL> response . status_code = httpStatusCodes . FORBIDDEN <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> retrUser = userLookUp [ <NUM_LIT:0> ] <EOL> djangoUserResults = djangoAuth . models . User . objects . filter ( id = retrUser . djangoUser_id ) <EOL> if not djangoUserResults : <EOL> response . status_code = httpStatusCodes . NOT_FOUND <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> isValidSignature = checkHMACValidity ( <EOL> crudAPI . byteFy ( retrUser . _secretKey + userAccessId ) , credentials . get ( '<STR_LIT:message>' , '<STR_LIT>' ) , credentials [ '<STR_LIT>' ] <EOL> ) <EOL> if not isValidSignature : <EOL> print ( '<STR_LIT>' ) <EOL> response . status_code = httpStatusCodes . UNAUTHORIZED <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> print ( '<STR_LIT>' ) <EOL> csrf ( request ) <EOL> response . status_code = httpStatusCodes . OK <EOL> response . write ( json . dumps ( { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return response <EOL> @ csrf_protect <EOL> def logout ( request ) : <EOL> '''<STR_LIT>''' <EOL> successfulLogout = False <EOL> if request . user . is_authenticated ( ) : <EOL> djangoAuth . logout ( request ) <EOL> successfulLogout = True <EOL> response = HttpResponse ( ) <EOL> response . write ( json . dumps ( { '<STR_LIT>' : successfulLogout } ) ) <EOL> return response <EOL> @ csrf_protect <EOL> @ ensure_csrf_cookie <EOL> def appHandler ( request ) : <EOL> return crudAPI . handleHTTPRequest ( <EOL> request , authConstants . APP_TABLE_KEY , authModels <EOL> ) <EOL> @ csrf_protect <EOL> @ ensure_csrf_cookie <EOL> def authUserHandler ( request ) : <EOL> if request . method == '<STR_LIT:POST>' : <EOL> return newUser ( request ) <EOL> return crudAPI . handleHTTPRequest ( <EOL> request , authConstants . AUTH_USER_KEY , authModels <EOL> ) </s>
