93 lines
2.2 KiB
Python
93 lines
2.2 KiB
Python
from flask import (
|
|
g,
|
|
redirect,
|
|
url_for,
|
|
session,
|
|
request,
|
|
current_app as app,
|
|
_request_ctx_stack as request_ctx_stack,
|
|
)
|
|
from werkzeug.datastructures import ImmutableTypeConversionDict
|
|
|
|
from atat.domain.users import Users
|
|
|
|
|
|
UNPROTECTED_ROUTES = [
|
|
"atat.root",
|
|
"dev.login_dev",
|
|
"dev.dev_new_user",
|
|
"atat.login_redirect",
|
|
"atat.logout",
|
|
"atat.unauthorized",
|
|
"static",
|
|
"atat.about",
|
|
]
|
|
|
|
|
|
def apply_authentication(app):
|
|
@app.before_request
|
|
# pylint: disable=unused-variable
|
|
def enforce_login():
|
|
user = get_current_user()
|
|
if user:
|
|
g.current_user = user
|
|
g.last_login = get_last_login()
|
|
|
|
if should_redirect_to_user_profile(request, user):
|
|
return redirect(url_for("users.user", next=request.path))
|
|
elif not _unprotected_route(request):
|
|
return redirect(url_for("atat.root", next=request.path))
|
|
|
|
|
|
def should_redirect_to_user_profile(request, user):
|
|
has_complete_profile = user.profile_complete
|
|
is_unprotected_route = _unprotected_route(request)
|
|
is_requesting_user_endpoint = request.endpoint in [
|
|
"users.user",
|
|
"users.update_user",
|
|
]
|
|
|
|
if has_complete_profile or is_unprotected_route or is_requesting_user_endpoint:
|
|
return False
|
|
|
|
return True
|
|
|
|
|
|
def get_current_user():
|
|
user_id = session.get("user_id")
|
|
if user_id:
|
|
return Users.get(user_id)
|
|
else:
|
|
return False
|
|
|
|
|
|
def get_last_login():
|
|
return session.get("user_id") and session.get("last_login")
|
|
|
|
|
|
def _nullify_session(session):
|
|
session_key = f"{app.config.get('SESSION_KEY_PREFIX')}{session.sid}"
|
|
app.redis.delete(session_key)
|
|
request.cookies = ImmutableTypeConversionDict()
|
|
request_ctx_stack.top.session = app.session_interface.open_session(app, request)
|
|
|
|
|
|
def _current_dod_id():
|
|
return g.current_user.dod_id if session.get("user_id") else None
|
|
|
|
|
|
def logout():
|
|
dod_id = _current_dod_id()
|
|
|
|
_nullify_session(session)
|
|
|
|
if dod_id:
|
|
app.logger.info(f"user with EDIPI {dod_id} has logged out")
|
|
else:
|
|
app.logger.info("unauthenticated user has logged out")
|
|
|
|
|
|
def _unprotected_route(request):
|
|
if request.endpoint in UNPROTECTED_ROUTES:
|
|
return True
|