Or, log in using a social provider.
- {% if config['STORMPATH_ENABLE_FACEBOOK'] %} + {% if config['stormpath']['web']['social']['facebook']['enabled'] %} {% include "flask_stormpath/facebook_login_form.html" %} {% endif %} - {% if config['STORMPATH_ENABLE_GOOGLE'] %} + {% if config['stormpath']['web']['social']['google']['enabled'] %} {% include "flask_stormpath/google_login_form.html" %} {% endif %} {% endif %} diff --git a/docs/upgrading.rst b/docs/upgrading.rst index d1650f9..0049022 100644 --- a/docs/upgrading.rst +++ b/docs/upgrading.rst @@ -8,6 +8,12 @@ This page contains specific upgrading instructions to help you migrate between Flask-Stormpath releases. +Version 0.4.8 -> Version 0.5.0 +------------------------------ + +**No changes needed!** + + Version 0.4.7 -> Version 0.4.8 ------------------------------ diff --git a/flask_stormpath/__init__.py b/flask_stormpath/__init__.py index bd7798f..470dd78 100644 --- a/flask_stormpath/__init__.py +++ b/flask_stormpath/__init__.py @@ -1,4 +1,52 @@ # -*- coding: utf-8 -*- + + +import os +from datetime import timedelta +from flask import Blueprint, __version__ as flask_version, current_app + +from flask_login import ( + LoginManager, + current_user, + login_required, + login_user, + logout_user +) + +from flask_login.utils import _get_user +from stormpath.client import Client +from stormpath.error import Error as StormpathError +from stormpath_config.loader import ConfigLoader +from stormpath_config.strategies import ( + LoadEnvConfigStrategy, + LoadFileConfigStrategy, + LoadAPIKeyConfigStrategy, + LoadAPIKeyFromConfigStrategy, + ValidateClientConfigStrategy, + EnrichClientFromRemoteConfigStrategy, + EnrichIntegrationFromRemoteConfigStrategy, + MoveAPIKeyToClientAPIKeyStrategy, + ExtendConfigStrategy, + MoveSettingsToConfigStrategy) + +from werkzeug.local import LocalProxy +from .context_processors import user_context_processor +from .request_processors import request_wants_json +from .models import User +from .settings import StormpathSettings +from .views import ( + RegisterView, + LoginView, + ForgotPasswordView, + ChangePasswordView, + VerifyEmailView, + LogoutView, + MeView, + GoogleLoginView, + FacebookLoginView +) + + """ flask-stormpath --------------- @@ -15,52 +63,13 @@ """ -__version__ = '0.4.8' +__version__ = '0.5.0' __version_info__ = __version__.split('.') __author__ = 'Stormpath, Inc.' __license__ = 'Apache' __copyright__ = '(c) 2012 - 2015 Stormpath, Inc.' -from flask import ( - Blueprint, - __version__ as flask_version, - _app_ctx_stack as stack, - current_app, -) - -from flask_login import ( - LoginManager, - current_user, - login_required, - login_user, - logout_user, -) -try: - from flask_login.utils import _get_user -except ImportError: - from flask_login import _get_user - -from stormpath.client import Client -from stormpath.error import Error as StormpathError - -from werkzeug.local import LocalProxy - -from .context_processors import user_context_processor -from .decorators import groups_required -from .models import User -from .settings import check_settings, init_settings -from .views import ( - google_login, - facebook_login, - forgot, - forgot_change, - login, - logout, - register, -) - - # A proxy for the current user. user = LocalProxy(lambda: _get_user()) @@ -72,19 +81,26 @@ class StormpathManager(object): specific apps, so you can create one in the main body of your code and then bind it to your app in a factory function. """ - def __init__(self, app=None): + def __init__(self, app=None, csrf=None): """ Initialize this extension. :param obj app: (optional) The Flask app. + :param obj csrf: (optional) CSRFProtect object. """ self.app = app + self.csrf = csrf # If the user specifies an app, let's configure go ahead and handle all # configuration stuff for the user's app. if app is not None: self.init_app(app) + @app.before_request + def check_csrf(): + if self.csrf and not request_wants_json(): + csrf.protect() + def init_app(self, app): """ Initialize this application. @@ -100,11 +116,7 @@ def init_app(self, app): """ # Initialize all of the Flask-Stormpath configuration variables and # settings. - init_settings(app.config) - - # Check our user defined settings to ensure Flask-Stormpath is properly - # configured. - check_settings(app.config) + self.init_settings(app.config) # Initialize the Flask-Login extension. self.init_login(app) @@ -113,7 +125,8 @@ def init_app(self, app): self.init_routes(app) # Initialize our blueprint. This lets us do cool template stuff. - blueprint = Blueprint('flask_stormpath', 'flask_stormpath', template_folder='templates') + blueprint = Blueprint( + 'flask_stormpath', 'flask_stormpath', template_folder='templates') app.register_blueprint(blueprint) # Ensure the `user` context is available in templates. This makes it @@ -125,6 +138,64 @@ def init_app(self, app): # necessary! self.app = app + def init_settings(self, config): + """ + Initialize the Flask-Stormpath settings. + + This function sets all default configuration values. + + :param dict config: The Flask app config. + """ + # Basic Stormpath credentials and configuration. + web_config_file = config.get('STORMPATH_CONFIG_PATH') + + # Set default settings needed to init stormpath-flask. + self.set_default_settings(config) + + config_loader = ConfigLoader( + load_strategies=[ + LoadFileConfigStrategy(web_config_file), + LoadAPIKeyConfigStrategy("~/.stormpath/apiKey.properties"), + LoadFileConfigStrategy("~/.stormpath/stormpath.json"), + LoadFileConfigStrategy("~/.stormpath/stormpath.yaml"), + LoadAPIKeyConfigStrategy("./apiKey.properties"), + LoadFileConfigStrategy("./stormpath.yaml"), + LoadFileConfigStrategy("./stormpath.json"), + LoadEnvConfigStrategy(prefix='STORMPATH'), + ExtendConfigStrategy(extend_with={}), # FIXME: This is still unimplemented. + MoveSettingsToConfigStrategy(config=config) + ], + post_processing_strategies=[ + LoadAPIKeyFromConfigStrategy(), + MoveAPIKeyToClientAPIKeyStrategy() + ], + validation_strategies=[ValidateClientConfigStrategy()]) + config['stormpath'] = StormpathSettings(config_loader.load()) + + # Create our custom user agent. This allows us to see which + # version of this SDK are out in the wild! + user_agent = 'stormpath-flask/%s flask/%s' % ( + __version__, flask_version) + + # Instantiate client with apiKey id and secret from config. + self.client = Client( + id=self.app.config['stormpath']['client']['apiKey']['id'], + secret=self.app.config['stormpath']['client']['apiKey']['secret'], + user_agent=user_agent, + cache_options=self.app.config['stormpath']['cache'], + ) + + # Enrich config from API service, and validate crucial settings. + ecfrcs = EnrichClientFromRemoteConfigStrategy( + client_factory=lambda client: self.client) + ecfrcs.process(self.app.config['stormpath'].store) + eifrcs = EnrichIntegrationFromRemoteConfigStrategy( + client_factory=lambda client: self.client) + eifrcs.process(self.app.config['stormpath'].store) + + self.application = self.client.applications.get( + self.app.config['stormpath']['application']['href']) + def init_login(self, app): """ Initialize the Flask-Login extension. @@ -134,18 +205,21 @@ def init_login(self, app): :param obj app: The Flask app. """ - app.config['REMEMBER_COOKIE_DURATION'] = app.config['STORMPATH_COOKIE_DURATION'] - app.config['REMEMBER_COOKIE_DOMAIN'] = app.config['STORMPATH_COOKIE_DOMAIN'] + app.config['REMEMBER_COOKIE_DURATION'] = app.config[ + 'stormpath']['cookie']['duration'] + app.config['REMEMBER_COOKIE_DOMAIN'] = app.config[ + 'stormpath']['cookie']['domain'] app.login_manager = LoginManager(app) app.login_manager.user_callback = self.load_user app.stormpath_manager = self - if app.config['STORMPATH_ENABLE_LOGIN']: + if app.config['stormpath']['web']['login']['enabled']: app.login_manager.login_view = 'stormpath.login' # Make this Flask session expire automatically. - app.config['PERMANENT_SESSION_LIFETIME'] = app.config['STORMPATH_COOKIE_DURATION'] + app.config['PERMANENT_SESSION_LIFETIME'] = app.config[ + 'stormpath']['cookie']['duration'] def init_routes(self, app): """ @@ -158,93 +232,99 @@ def init_routes(self, app): :param obj app: The Flask app. """ - if app.config['STORMPATH_ENABLE_REGISTRATION']: + if app.config['stormpath']['web']['basePath']: + base_path = app.config['stormpath']['web']['basePath'] + else: + base_path = '/' + + if app.config['stormpath']['web']['register']['enabled']: app.add_url_rule( - app.config['STORMPATH_REGISTRATION_URL'], + os.path.join( + base_path, + app.config['stormpath']['web']['register'][ + 'uri'].strip('/')), 'stormpath.register', - register, - methods = ['GET', 'POST'], + RegisterView.as_view('register'), + methods=['GET', 'POST'], ) - if app.config['STORMPATH_ENABLE_LOGIN']: + if app.config['stormpath']['web']['login']['enabled']: app.add_url_rule( - app.config['STORMPATH_LOGIN_URL'], + os.path.join( + base_path, app.config['stormpath']['web']['login'][ + 'uri'].strip('/')), 'stormpath.login', - login, - methods = ['GET', 'POST'], + LoginView.as_view('login'), + methods=['GET', 'POST'], ) - if app.config['STORMPATH_ENABLE_FORGOT_PASSWORD']: + if app.config['stormpath']['web']['forgotPassword']['enabled']: app.add_url_rule( - app.config['STORMPATH_FORGOT_PASSWORD_URL'], + os.path.join( + base_path, + app.config['stormpath']['web']['forgotPassword'][ + 'uri'].strip('/')), 'stormpath.forgot', - forgot, - methods = ['GET', 'POST'], + ForgotPasswordView.as_view('forgot'), + methods=['GET', 'POST'], ) app.add_url_rule( - app.config['STORMPATH_FORGOT_PASSWORD_CHANGE_URL'], + os.path.join( + base_path, + app.config['stormpath']['web']['changePassword'][ + 'uri'].strip('/')), 'stormpath.forgot_change', - forgot_change, - methods = ['GET', 'POST'], + ChangePasswordView.as_view('change'), + methods=['GET', 'POST'], ) - if app.config['STORMPATH_ENABLE_LOGOUT']: + if app.config['stormpath']['web']['verifyEmail']['enabled']: app.add_url_rule( - app.config['STORMPATH_LOGOUT_URL'], + app.config['stormpath']['web']['verifyEmail']['uri'], + 'stormpath.verify', + VerifyEmailView.as_view('verify'), + methods=['GET', 'POST'], + ) + + if app.config['stormpath']['web']['logout']['enabled']: + app.add_url_rule( + os.path.join( + base_path, + app.config['stormpath']['web']['logout'][ + 'uri'].strip('/')), 'stormpath.logout', - logout, + LogoutView.as_view('logout'), ) - if app.config['STORMPATH_ENABLE_GOOGLE']: + if app.config['stormpath']['web']['me']['enabled']: app.add_url_rule( - app.config['STORMPATH_GOOGLE_LOGIN_URL'], + os.path.join( + base_path, + app.config['stormpath']['web']['me']['uri'].strip('/')), + 'stormpath.me', + MeView.as_view('me'), + ) + + if app.config['stormpath']['web']['social']['google']['enabled']: + app.add_url_rule( + os.path.join( + base_path, + app.config[ + 'stormpath']['web']['social']['google']['login_url']), 'stormpath.google_login', - google_login, + GoogleLoginView.as_view('google'), ) - if app.config['STORMPATH_ENABLE_FACEBOOK']: + if app.config['stormpath']['web']['social']['facebook']['enabled']: app.add_url_rule( - app.config['STORMPATH_FACEBOOK_LOGIN_URL'], + os.path.join( + base_path, + app.config[ + 'stormpath']['web']['social']['facebook']['login_url']), 'stormpath.facebook_login', - facebook_login, + FacebookLoginView.as_view('facebook'), ) - @property - def client(self): - """ - Lazily load the Stormpath Client object we need to access the raw - Stormpath SDK. - """ - ctx = stack.top.app - if ctx is not None: - if not hasattr(ctx, 'stormpath_client'): - - # Create our custom user agent. This allows us to see which - # version of this SDK are out in the wild! - user_agent = 'stormpath-flask/%s flask/%s' % (__version__, flask_version) - - # If the user is specifying their credentials via a file path, - # we'll use this. - if self.app.config['STORMPATH_API_KEY_FILE']: - ctx.stormpath_client = Client( - api_key_file_location = self.app.config['STORMPATH_API_KEY_FILE'], - user_agent = user_agent, - cache_options = self.app.config['STORMPATH_CACHE'], - ) - - # If the user isn't specifying their credentials via a file - # path, it means they're using environment variables, so we'll - # try to grab those values. - else: - ctx.stormpath_client = Client( - id = self.app.config['STORMPATH_API_KEY_ID'], - secret = self.app.config['STORMPATH_API_KEY_SECRET'], - user_agent = user_agent, - cache_options = self.app.config['STORMPATH_CACHE'], - ) - - return ctx.stormpath_client - @property def login_view(self): """ @@ -260,25 +340,6 @@ def login_view(self, value): """ self.app.login_manager.login_view = value - @property - def application(self): - """ - Lazily load the Stormpath Application object we need to handle user - authentication, etc. - """ - ctx = stack.top.app - if ctx is not None: - if not hasattr(ctx, 'stormpath_application'): - applications = self.client.applications.search( - self.app.config['STORMPATH_APPLICATION'] - ) - if applications is None: - raise Exception('Failed to find ' + self.app.config['STORMPATH_APPLICATION'] + ' application. Please add it in the Stormpath console.') - - ctx.stormpath_application = applications[0] - - return ctx.stormpath_application - @staticmethod def load_user(account_href): """ @@ -296,3 +357,41 @@ def load_user(account_href): return user except StormpathError: return None + + def set_default_settings(self, config): + """ + Sets default settings for crucial settings needed to run + Flask-Stormpath. + """ + + # Set csrf default check to False, since our StormpathManager applies + # custom logic for applying csrf tokens. + config.setdefault('WTF_CSRF_CHECK_DEFAULT', False) + + # Which fields should be displayed when registering new users? + config.setdefault('STORMPATH_ENABLE_FACEBOOK', False) + config.setdefault('STORMPATH_ENABLE_GOOGLE', False) + + # Configure URL mappings. These URL mappings control which URLs will + # be used by Flask-Stormpath views. + config.setdefault('STORMPATH_GOOGLE_LOGIN_URL', '/google') + config.setdefault('STORMPATH_FACEBOOK_LOGIN_URL', '/facebook') + + # Cache configuration. + config.setdefault('STORMPATH_CACHE', None) + + # Configure templates. These template settings control which + # templates are used to render the Flask-Stormpath views. + config.setdefault( + 'STORMPATH_BASE_TEMPLATE', 'flask_stormpath/base.html') + + # Social login configuration. + config.setdefault('STORMPATH_SOCIAL', {}) + + # Cookie configuration. + config.setdefault('STORMPATH_COOKIE_DOMAIN', None) + config.setdefault('STORMPATH_COOKIE_DURATION', timedelta(days=365)) + + # Cookie name (this is not overridable by users, at least + # not explicitly). + config.setdefault('REMEMBER_COOKIE_NAME', 'stormpath_token') diff --git a/flask_stormpath/config/default-config.yml b/flask_stormpath/config/default-config.yml new file mode 100644 index 0000000..30e9661 --- /dev/null +++ b/flask_stormpath/config/default-config.yml @@ -0,0 +1,310 @@ +web: + + # The basePath is used as the default path for the cookies that are set by + # this library. If not defined, we will default to / + basePath: null + + domainName: null # Required if using subdomain-based multi-tenancy + + multiTenancy: + + # When enabled, the framework will require the user to authenticate against + # a specific Organization. The authenticated organization is persisted in + # the access token that is issued. + # + # At the moment we only support a sub-domain based strategy, wherby the + # user must arrive on the subdomain that correlates with their tenant in + # order to authenticate. If they visit the parent domain, they will be + # required to identify the organization they wish to use. + + enabled: false + strategy: "subdomain" + + oauth2: + enabled: true + uri: "/oauth/token" + client_credentials: + enabled: true + accessToken: + ttl: 3600 + password: + enabled: true + validationStrategy: "local" + + accessTokenCookie: + + # Controls the name of the cookie that we send to the browser. + name: "access_token" + + # httpOnly is true, to prevent XSS attacks from hijacking your cookies. We + # highly recommend that you do not change this. + httpOnly: true + + # The secure property controls the Secure flag on the cookie. The + # framework will auto-detect if the incoming request is over HTTPS, by + # looking at req.protocol === 'https' and turn on Secure if so. You can + # override auto-detection and force the Secure flag on by setting this + # property to true, or force off by setting this property to false. + secure: null + + # Controls the path flag of the cookie. Inherits from basePath, but can be + # overridden here. + path: null + + # Controls the domain flag on the cookie, will not be set unless specified. + domain: null + + # Refresh Token Cookie has same options as the Access Token Cookie (above). + refreshTokenCookie: + name: "refresh_token" + httpOnly: true + secure: null + path: null + domain: null + + # If the request does not specify an Accept header, or the preferred content + # type is */*, the Stormpath integration will respond with the first type in + # this list. + produces: + - application/json + - text/html + + # By default the Stormpath integration will respond to JSON and HTML + # requests. If a requested type is not in this list, the Stormpath + # integration should pass on the request, and allow the developer or base + # framework to handle the response. + invalidRequest: + uri: "/invalid_request" + + register: + enabled: true + uri: "/register" + nextUri: "/" + + # autoLogin is possible only if the email verification feature is disabled + # on the default account store of the defined Stormpath application. + autoLogin: false + view: "register" + form: + fields: + givenName: + enabled: true + label: "First Name" + placeholder: "First Name" + required: true + type: "text" + middleName: + enabled: false + label: "Middle Name" + placeholder: "Middle Name" + required: true + type: "text" + surname: + enabled: true + label: "Last Name" + placeholder: "Last Name" + required: true + type: "text" + username: + enabled: true + label: "Username" + placeholder: "Username" + required: true + type: "text" + email: + enabled: true + label: "Email" + placeholder: "Email" + required: true + type: "email" + password: + enabled: true + label: "Password" + placeholder: "Password" + required: true + type: "password" + confirmPassword: + enabled: false + label: "Confirm Password" + placeholder: "Confirm Password" + required: true + type: "password" + fieldOrder: + - "username" + - "givenName" + - "middleName" + - "surname" + - "email" + - "password" + - "confirmPassword" + + # Unless verifyEmail.enabled is specifically set to false, the email + # verification feature must be automatically enabled if the default account + # store for the defined Stormpath application has the email verification + # workflow enabled. + verifyEmail: + enabled: true + uri: "/verify" + nextUri: "/login?status=verified" + unverifiedUri: "/login?status=unverified" + view: "verify" + form: + fields: + email: + enabled: true + visible: true + label: "Email" + placeholder: "Email" + required: true + type: "email" + fieldOrder: + - "email" + + login: + enabled: true + uri: "/login" + nextUri: "/" + view: "login" + form: + fields: + login: + enabled: true + label: "Username or Email" + placeholder: "Username or Email" + required: true + type: "text" + password: + enabled: true + label: "Password" + placeholder: "Password" + required: true + type: "password" + fieldOrder: + - "login" + - "password" + + logout: + enabled: true + uri: "/logout" + nextUri: "/" + + organizationSelect: + view: "organization-select" + form: + fields: + organizationNameKey: + label: "Enter your organization name to continue" + placeholder: "e.g. my-company" + + # Unless forgotPassword.enabled is explicitly set to false, this feature + # will be automatically enabled if the default account store for the defined + # Stormpath application has the password reset workflow enabled. + forgotPassword: + enabled: true + uri: "/forgot" + nextUri: "/login?status=forgot" + view: "forgot-password" + form: + fields: + email: + enabled: true + visible: true + label: "Email" + placeholder: "Email" + required: true + type: "email" + fieldOrder: + - "email" + + # Unless changePassword.enabled is explicitly set to false, this feature + # will be automatically enabled if the default account store for the defined + # Stormpath application has the password reset workflow enabled. + changePassword: + enabled: true + uri: "/change" + nextUri: "/login?status=reset" + errorUri: "/forgot?status=invalid_sptoken" + autoLogin: false + view: "change-password" + form: + fields: + password: + enabled: true + label: "Password" + placeholder: "Password" + required: true + type: "password" + confirmPassword: + enabled: true + label: "Confirm Password" + placeholder: "Confirm Password" + required: true + type: "password" + fieldOrder: + - "password" + - "confirmPassword" + + # If idSite.enabled is true, the user should be redirected to ID site for + # login, registration, and password reset. They should also be redirected + # through ID Site on logout. + idSite: + enabled: false + uri: "/idSiteResult" + nextUri: "/" + loginUri: "" + forgotUri: "/#/forgot" + registerUri: "/#/register" + + # Social login configuration. This defines the callback URIs for OAuth + # flows, and the scope that is requested of each provider. Some providers + # want space-separated scopes, some want comma-separated. As such, these + # string values should be passed directly, as defined. + # + # These settings have no affect if the application does not have an account + # store for the given provider. + social: + facebook: + uri: "/callbacks/facebook" + scope: "email" + github: + uri: "/callbacks/github" + scope: "user:email" + google: + uri: "/callbacks/google" + scope: "email profile" + linkedin: + uri: "/callbacks/linkedin" + scope: "r_basicprofile, r_emailaddress" + + # The /me route is for front-end applications, it returns a JSON object with + # the current user object. The developer can opt-in to expanding account + # resources on this enpdoint. + me: + enabled: true + uri: "/me" + expand: + apiKeys: false + applications: false + customData: false + directory: false + groupMemberships: false + groups: false + providerData: false + tenant: false + + # If the developer wants our integration to serve their Single Page + # Application (SPA) in response to HTML requests for our default routes, + # such as /login, then they will need to enable this feature and tell us + # where the root of their SPA is. This is likely a file path on the + # filesystem. + # + # If the developer does not want our integration to handle their SPA, they + # will need to configure the framework themselves and remove 'text/html' + # from `stormpath.web.produces`, so that we don't serve our default + # HTML views. + spa: + enabled: false + view: null + + unauthorized: + view: "unauthorized" diff --git a/flask_stormpath/context_processors.py b/flask_stormpath/context_processors.py index 5ac3c4a..cae4796 100644 --- a/flask_stormpath/context_processors.py +++ b/flask_stormpath/context_processors.py @@ -1,11 +1,7 @@ """Custom context processors to make template development simpler.""" -from flask import current_app -try: - from flask_login.utils import _get_user -except ImportError: - from flask_login import _get_user +from flask_login.utils import _get_user def user_context_processor(): diff --git a/flask_stormpath/errors.py b/flask_stormpath/errors.py deleted file mode 100644 index 106f7ad..0000000 --- a/flask_stormpath/errors.py +++ /dev/null @@ -1,8 +0,0 @@ -"""Custom errors.""" - - -class ConfigurationError(Exception): - """ - This exception is raised if a user has misconfigured Flask-Stormpath. - """ - pass diff --git a/flask_stormpath/forms.py b/flask_stormpath/forms.py index d99728c..737ba5f 100644 --- a/flask_stormpath/forms.py +++ b/flask_stormpath/forms.py @@ -2,98 +2,97 @@ from flask_wtf import FlaskForm -from flask_wtf.form import _Auto +from wtforms.widgets import HiddenInput from wtforms.fields import PasswordField, StringField -from wtforms.validators import Email, EqualTo, InputRequired, ValidationError - - -class RegistrationForm(FlaskForm): - """ - Register a new user. - - This class is used to provide safe user registration. The only required - fields are `email` and `password` -- everything else is optional (and can - be configured by the developer to be used or not). - - .. note:: - This form only includes the fields that are available to register - users with Stormpath directly -- this doesn't include support for - Stormpath's social login stuff. - - Since social login stuff is handled separately (registration happens - through Javascript) we don't need to have a form for registering users - that way. - """ - username = StringField('Username') - given_name = StringField('First Name') - middle_name = StringField('Middle Name') - surname = StringField('Last Name') - email = StringField('Email', validators=[ - InputRequired('You must provide an email address.'), - Email('You must provide a valid email address.') - ]) - password = PasswordField('Password', validators=[InputRequired('You must supply a password.')]) - - def __init__(self, formdata=_Auto, config=None, **kwargs): - super(RegistrationForm, self).__init__(formdata=formdata, **kwargs) - - if config: - if config['STORMPATH_ENABLE_USERNAME'] and config['STORMPATH_REQUIRE_USERNAME']: - self.username.validators.append(InputRequired('Username is required.')) - - if config['STORMPATH_ENABLE_GIVEN_NAME'] and config['STORMPATH_REQUIRE_GIVEN_NAME']: - self.given_name.validators.append(InputRequired('First name is required.')) - - if config['STORMPATH_ENABLE_MIDDLE_NAME'] and config['STORMPATH_REQUIRE_MIDDLE_NAME']: - self.middle_name.validators.append(InputRequired('Middle name is required.')) - - if config['STORMPATH_ENABLE_SURNAME'] and config['STORMPATH_REQUIRE_SURNAME']: - self.surname.validators.append(InputRequired('Surname is required.')) - - -class LoginForm(FlaskForm): - """ - Log in an existing user. - - This class is used to provide safe user login. A user can log in using - a login identifier (either email or username) and password. Stormpath - handles the username / email abstractions itself, so we don't need any - special logic to handle those cases. - - .. note:: - This form only includes the fields that are available to log users in - with Stormpath directly -- this doesn't include support for Stormpath's - social login stuff. - - Since social login stuff is handled separately (login happens through - Javascript) we don't need to have a form for logging in users that way. - """ - login = StringField('Login', validators=[InputRequired('Login identifier required.')]) - password = PasswordField('Password', validators=[InputRequired('Password required.')]) - - -class ForgotPasswordForm(FlaskForm): - """ - Retrieve a user's email address for initializing the password reset - workflow. - - This class is used to retrieve a user's email address. - """ - email = StringField('Email', validators=[ - InputRequired('Email address required.'), - Email('You must provide a valid email address.') - ]) - - -class ChangePasswordForm(FlaskForm): - """ - Change a user's password. - - This class is used to retrieve a user's password twice to ensure it's valid - before making a change. - """ - password = PasswordField('Password', validators=[InputRequired('Password required.')]) - password_again = PasswordField('Password (again)', validators=[ - InputRequired('Please verify the password.'), - EqualTo('password', 'Passwords do not match.') - ]) +from wtforms.validators import InputRequired, EqualTo, Email +from stormpath.resources import Resource +import json + + +class StormpathForm(FlaskForm): + @classmethod + def specialize_form(basecls, config): + """ + Dynamic form. + + This class is used to set fields dynamically based on the form fields + settings from the config. + + .. note:: + This doesn't include support for Stormpath's social login stuff. + Since social login stuff is handled separately (through + Javascript), we don't need to have a form for registering/logging + in users that way. + """ + + class cls(basecls): + # Make sure that the original class is left unaltered. + pass + + field_list = config.get('fields', {}) + field_order = config.get('fieldOrder', []) + + setattr(cls, '_json', []) + + for field in field_order: + if field_list[field]['enabled']: + validators = [] + placeholder = field_list[field]['placeholder'] + + # Construct json fields + json_field = {'name': Resource.from_camel_case(field)} + json_field['placeholder'] = placeholder + + # Apply validators. + if field_list[field]['required']: + validators.append(InputRequired( + message='%s is required.' % placeholder)) + + if field_list[field]['type'] == 'email': + validators.append(Email( + message='Email must be in valid format.')) + + if field == 'confirmPassword': + validators.append(EqualTo( + 'password', message='Passwords do not match.')) + json_field['required'] = field_list[field]['required'] + + # Apply widgets. + if field_list[field].get('visible', True): + widget = None + json_field['visible'] = True + else: + widget = HiddenInput() + json_field['visible'] = False + + # Apply field classes. + if field_list[field]['type'] == 'password': + field_class = PasswordField + else: + field_class = StringField + json_field['type'] = field_list[field]['type'] + + # Apply labels. + if 'label' in field_list[field] and isinstance( + field_list[field]['label'], str): + label = field_list[field]['label'] + else: + label = '' + json_field['label'] = field_list[field]['label'] + + # Set json fields. + cls._json.append(json_field) + + # Finally, create our fields dynamically. + setattr( + cls, Resource.from_camel_case(field), + field_class( + label, validators=validators, + render_kw={"placeholder": placeholder}, + widget=widget)) + + return cls + + @property + def json(self): + return json.dumps(self._json) diff --git a/flask_stormpath/models.py b/flask_stormpath/models.py index 53a48e2..18fb893 100644 --- a/flask_stormpath/models.py +++ b/flask_stormpath/models.py @@ -1,13 +1,16 @@ """Custom data models.""" -from flask import current_app +from flask import current_app, request from six import text_type from blinker import Namespace from stormpath.resources.account import Account from stormpath.resources.provider import Provider +from . import StormpathError +from datetime import datetime +import json stormpath_signals = Namespace() @@ -60,9 +63,9 @@ def save(self): """ Send signal after user is updated. """ - return_value = super(User, self).save() + super(User, self).save() user_updated.send(self, user=dict(self)) - return return_value + return self def delete(self): """ @@ -73,8 +76,39 @@ def delete(self): user_deleted.send(None, user=user_dict) return return_value + def to_json(self): + def datetime_handler(obj): + if hasattr(obj, 'isoformat'): + return obj.isoformat() + else: + raise TypeError + + attrs = ( + 'href', + 'modified_at', + 'created_at', + 'status', + 'username', + 'email', + 'given_name', + 'middle_name', + 'surname', + 'full_name' + ) + json_data = { + 'account': {attr: getattr(self, attr, None) for attr in attrs}} + + # In case me view was called with expanded options enabled. + if hasattr(self._expand, 'items'): + json_data['account'].update(self._expand.items) + + return json.dumps(json_data, default=datetime_handler) + @classmethod - def create(cls, email, password, given_name, surname, username=None, middle_name=None, custom_data=None, status='ENABLED'): + def create( + self, email=None, password=None, given_name=None, surname=None, + username=None, middle_name=None, custom_data=None, + status='ENABLED'): """ Create a new User. @@ -113,12 +147,12 @@ def create(cls, email, password, given_name, surname, username=None, middle_name 'status': status, }) _user.__class__ = User - user_created.send(cls, user=dict(_user)) + user_created.send(self, user=dict(_user)) return _user @classmethod - def from_login(cls, login, password): + def from_login(self, login, password): """ Create a new User class given a login (`email` or `username`), and password. @@ -126,13 +160,86 @@ def from_login(cls, login, password): If something goes wrong, this will raise an exception -- most likely -- a `StormpathError` (flask_stormpath.StormpathError). """ - _user = current_app.stormpath_manager.application.authenticate_account(login, password).account + _user = current_app.stormpath_manager.application.authenticate_account( + login, password).account + _user.refresh() _user.__class__ = User return _user + @staticmethod + def from_social(social_name, access_token, provider): + """ + Helper method for our social methods. + """ + + kwargs = {'provider': provider.get('provider_id')} + if social_name == 'facebook': + kwargs['access_token'] = access_token + elif social_name == 'google': + kwargs['code'] = access_token + else: + raise ValueError('Social service is not supported.') + + try: + _user = ( + current_app.stormpath_manager. + application.get_provider_account(**kwargs)) + except StormpathError as err: + social_directory_exists = False + + # If we failed here, it usually means that this application doesn't + # have a social directory -- so we'll create one! + for asm in ( + current_app.stormpath_manager.application. + account_store_mappings): + + # If there is a social directory, we know this isn't the + # problem. + if ( + getattr(asm.account_store, 'provider') and + asm.account_store.provider.provider_id == provider.get( + 'provider_id') + ): + social_directory_exists = True + break + + # If there is a social directory already, we'll just pass on the + # exception we got. + if social_directory_exists: + raise err + + # Otherwise, we'll try to create a social directory on the user's + # behalf (magic!). + dir = current_app.stormpath_manager.client.directories.create({ + 'name': ( + current_app.stormpath_manager.application.name + + '-' + social_name), + 'provider': provider + }) + + # Now that we have a social directory, we'll map it to our + # application so it is active. + asm = ( + current_app.stormpath_manager.application. + account_store_mappings.create({ + 'application': current_app.stormpath_manager.application, + 'account_store': dir, + 'list_index': 99, + 'is_default_account_store': False, + 'is_default_group_store': False, + })) + + # Lastly, let's retry the social login one more time. + _user = ( + current_app.stormpath_manager. + application.get_provider_account(**kwargs)) + + _user.__class__ = User + return _user + @classmethod - def from_google(cls, code): + def from_google(self, code): """ Create a new User class given a Google access code. @@ -142,29 +249,33 @@ def from_google(cls, code): If something goes wrong, this will raise an exception -- most likely -- a `StormpathError` (flask_stormpath.StormpathError). """ - _user = current_app.stormpath_manager.application.get_provider_account( - code = code, - provider = Provider.GOOGLE, - ) - _user.__class__ = User - - return _user + provider = { + 'client_id': current_app.config[ + 'stormpath']['web']['social']['google']['clientId'], + 'client_secret': current_app.config[ + 'stormpath']['web']['social']['google']['clientSecret'], + 'redirect_uri': request.url_root[:-1] + current_app.config[ + 'stormpath']['web']['social']['google']['login_url'], + 'provider_id': Provider.GOOGLE, + } + return self.from_social('google', code, provider) @classmethod - def from_facebook(cls, access_token): + def from_facebook(self, access_token): """ Create a new User class given a Facebook user's access token. - Access tokens must be retrieved from Facebooks's OAuth service (Facebook - Login). + Access tokens must be retrieved from Facebooks's OAuth service + (Facebook Login). If something goes wrong, this will raise an exception -- most likely -- a `StormpathError` (flask_stormpath.StormpathError). """ - _user = current_app.stormpath_manager.application.get_provider_account( - access_token = access_token, - provider = Provider.FACEBOOK, - ) - _user.__class__ = User - - return _user + provider = { + 'client_id': current_app.config[ + 'stormpath']['web']['social']['facebook']['clientId'], + 'client_secret': current_app.config[ + 'stormpath']['web']['social']['facebook']['clientId'], + 'provider_id': Provider.FACEBOOK, + } + return self.from_social('facebook', access_token, provider) diff --git a/flask_stormpath/request_processors.py b/flask_stormpath/request_processors.py new file mode 100644 index 0000000..3def03f --- /dev/null +++ b/flask_stormpath/request_processors.py @@ -0,0 +1,30 @@ +"""Description here.""" + +from flask import request, current_app +from stormpath_config.errors import ConfigurationError + + +def get_accept_header(): + """ + Fetch the request content type and match it against our allowed types. + """ + if current_app and 'stormpath' in current_app.config: + allowed_types = current_app.config['stormpath']['web']['produces'] + request_accept_types = request.accept_mimetypes + + # If no accept types are specified, or the preferred accept type is + # */*, response type will be the first element of self.allowed_types. + if not request_accept_types or request_accept_types[0][0] == '*/*': + return allowed_types[0] + else: + return request_accept_types.best_match(allowed_types) + else: + raise ConfigurationError( + 'You must initialize flask app before calling this function.') + + +def request_wants_json(): + """ + Check if request wants json. + """ + return get_accept_header() == 'application/json' diff --git a/flask_stormpath/settings.py b/flask_stormpath/settings.py index 29c06c1..08528d6 100644 --- a/flask_stormpath/settings.py +++ b/flask_stormpath/settings.py @@ -1,142 +1,116 @@ """Helper functions for dealing with Flask-Stormpath settings.""" -from datetime import timedelta - -from .errors import ConfigurationError - - -def init_settings(config): - """ - Initialize the Flask-Stormpath settings. - - This function sets all default configuration values. - - :param dict config: The Flask app config. - """ - # Basic Stormpath credentials and configuration. - config.setdefault('STORMPATH_API_KEY_ID', None) - config.setdefault('STORMPATH_API_KEY_SECRET', None) - config.setdefault('STORMPATH_API_KEY_FILE', None) - config.setdefault('STORMPATH_APPLICATION', None) - - # Which fields should be displayed when registering new users? - config.setdefault('STORMPATH_ENABLE_FACEBOOK', False) - config.setdefault('STORMPATH_ENABLE_GOOGLE', False) - config.setdefault('STORMPATH_ENABLE_EMAIL', True) # If this is diabled, - # only social login can - # be used. - config.setdefault('STORMPATH_ENABLE_USERNAME', False) - config.setdefault('STORMPATH_ENABLE_EMAIL', True) # This MUST be True! - config.setdefault('STORMPATH_ENABLE_PASSWORD', True) # This MUST be True! - config.setdefault('STORMPATH_ENABLE_GIVEN_NAME', True) - config.setdefault('STORMPATH_ENABLE_MIDDLE_NAME', True) - config.setdefault('STORMPATH_ENABLE_SURNAME', True) - - # If the user attempts to create a non-social account, which fields should - # we require? (Email and password are always required, so those are not - # mentioned below.) - config.setdefault('STORMPATH_REQUIRE_USERNAME', True) - config.setdefault('STORMPATH_REQUIRE_EMAIL', True) # This MUST be True! - config.setdefault('STORMPATH_REQUIRE_PASSWORD', True) # This MUST be True! - config.setdefault('STORMPATH_REQUIRE_GIVEN_NAME', True) - config.setdefault('STORMPATH_REQUIRE_MIDDLE_NAME', False) - config.setdefault('STORMPATH_REQUIRE_SURNAME', True) - - # Will new users be required to verify new accounts via email before - # they're made active? - config.setdefault('STORMPATH_VERIFY_EMAIL', False) - - # Configure views. These views can be enabled or disabled. If they're - # enabled (default), then you automatically get URL routes, working views, - # and working templates for common operations: registration, login, logout, - # forgot password, and changing user settings. - config.setdefault('STORMPATH_ENABLE_REGISTRATION', True) - config.setdefault('STORMPATH_ENABLE_LOGIN', True) - config.setdefault('STORMPATH_ENABLE_LOGOUT', True) - config.setdefault('STORMPATH_ENABLE_FORGOT_PASSWORD', False) - config.setdefault('STORMPATH_ENABLE_SETTINGS', True) - - # Configure URL mappings. These URL mappings control which URLs will be - # used by Flask-Stormpath views. - config.setdefault('STORMPATH_REGISTRATION_URL', '/register') - config.setdefault('STORMPATH_LOGIN_URL', '/login') - config.setdefault('STORMPATH_LOGOUT_URL', '/logout') - config.setdefault('STORMPATH_FORGOT_PASSWORD_URL', '/forgot') - config.setdefault('STORMPATH_FORGOT_PASSWORD_CHANGE_URL', '/forgot/change') - config.setdefault('STORMPATH_SETTINGS_URL', '/settings') - config.setdefault('STORMPATH_GOOGLE_LOGIN_URL', '/google') - config.setdefault('STORMPATH_FACEBOOK_LOGIN_URL', '/facebook') - - # After a successful login, where should users be redirected? - config.setdefault('STORMPATH_REDIRECT_URL', '/') - - # Cache configuration. - config.setdefault('STORMPATH_CACHE', None) - - # Configure templates. These template settings control which templates are - # used to render the Flask-Stormpath views. - config.setdefault('STORMPATH_BASE_TEMPLATE', 'flask_stormpath/base.html') - config.setdefault('STORMPATH_REGISTRATION_TEMPLATE', 'flask_stormpath/register.html') - config.setdefault('STORMPATH_LOGIN_TEMPLATE', 'flask_stormpath/login.html') - config.setdefault('STORMPATH_FORGOT_PASSWORD_TEMPLATE', 'flask_stormpath/forgot.html') - config.setdefault('STORMPATH_FORGOT_PASSWORD_EMAIL_SENT_TEMPLATE', 'flask_stormpath/forgot_email_sent.html') - config.setdefault('STORMPATH_FORGOT_PASSWORD_CHANGE_TEMPLATE', 'flask_stormpath/forgot_change.html') - config.setdefault('STORMPATH_FORGOT_PASSWORD_COMPLETE_TEMPLATE', 'flask_stormpath/forgot_complete.html') - config.setdefault('STORMPATH_SETTINGS_TEMPLATE', 'flask_stormpath/settings.html') - - # Social login configuration. - config.setdefault('STORMPATH_SOCIAL', {}) - - # Cookie configuration. - config.setdefault('STORMPATH_COOKIE_DOMAIN', None) - config.setdefault('STORMPATH_COOKIE_DURATION', timedelta(days=365)) - - # Cookie name (this is not overridable by users, at least not explicitly). - config.setdefault('REMEMBER_COOKIE_NAME', 'stormpath_token') - - -def check_settings(config): - """ - Ensure the user-specified settings are valid. - - This will raise a ConfigurationError if anything mandatory is not - specified. - - :param dict config: The Flask app config. - """ - if not ( - all([ - config['STORMPATH_API_KEY_ID'], - config['STORMPATH_API_KEY_SECRET'], - ]) or config['STORMPATH_API_KEY_FILE'] - ): - raise ConfigurationError('You must define your Stormpath credentials.') - - if not config['STORMPATH_APPLICATION']: - raise ConfigurationError('You must define your Stormpath application.') - - if config['STORMPATH_ENABLE_GOOGLE']: - google_config = config['STORMPATH_SOCIAL'].get('GOOGLE') - - if not google_config or not all([ - google_config.get('client_id'), - google_config.get('client_secret'), - ]): - raise ConfigurationError('You must define your Google app settings.') - - if config['STORMPATH_ENABLE_FACEBOOK']: - facebook_config = config['STORMPATH_SOCIAL'].get('FACEBOOK') - - if not facebook_config or not all([ - facebook_config, - facebook_config.get('app_id'), - facebook_config.get('app_secret'), - ]): - raise ConfigurationError('You must define your Facebook app settings.') - - if config['STORMPATH_COOKIE_DOMAIN'] and not isinstance(config['STORMPATH_COOKIE_DOMAIN'], str): - raise ConfigurationError('STORMPATH_COOKIE_DOMAIN must be a string.') - - if config['STORMPATH_COOKIE_DURATION'] and not isinstance(config['STORMPATH_COOKIE_DURATION'], timedelta): - raise ConfigurationError('STORMPATH_COOKIE_DURATION must be a timedelta object.') +import collections + + +class StormpathSettings(collections.MutableMapping): + STORMPATH_PREFIX = 'STORMPATH' + DELIMITER = '_' + REGEX_SIGN = '*' + MAPPINGS = { # used for backwards compatibility + 'API_KEY_ID': 'client_apiKey_id', + 'API_KEY_SECRET': 'client_apiKey_secret', + 'APPLICATION': 'application_name', + + 'ENABLE_LOGIN': 'web_login_enabled', + 'ENABLE_REGISTRATION': 'web_register_enabled', + 'ENABLE_FORGOT_PASSWORD': 'web_forgotPassword_enabled', + + 'LOGIN_URL': 'web_login_uri', + 'REGISTRATION_URL': 'web_register_uri', + 'LOGOUT_URL': 'web_logout_uri', + + 'REDIRECT_URL': 'web_login_nextUri', + + 'REGISTRATION_TEMPLATE': 'web_register_template', + 'LOGIN_TEMPLATE': 'web_login_template', + + 'REGISTRATION_REDIRECT_URL': 'web_register_nextUri', + 'REQUIRE_*': 'web_register_form_fields_*_required', + 'ENABLE_*': 'web_register_form_fields_*_enabled', + + 'FORGOT_PASSWORD_TEMPLATE': 'web_forgotPassword_template', + 'FORGOT_PASSWORD_CHANGE_TEMPLATE': 'web_changePassword_template' + # 'FORGOT_PASSWORD_EMAIL_SENT_TEMPLATE' + # 'FORGOT_PASSWORD_COMPLETE_TEMPLATE' + # 'ENABLE_FACEBOOK' + # 'ENABLE_GOOGLE' + # 'SOCIAL' + # 'CACHE' + } + + def __init__(self, *args, **kwargs): + self.store = dict(*args, **kwargs) + + @staticmethod + def _from_camel(key): + cs = [] + for c in key: + cl = c.lower() + if c == cl: + cs.append(c) + else: + cs.append('_') + cs.append(c.lower()) + return ''.join(cs).upper() + + def __search__(self, root, key, root_string): + for node in root.keys(): + search_string = '%s%s%s' % ( + root_string, self.DELIMITER, + self._from_camel(node) + ) + if key == search_string: + return root, node + if key.startswith(search_string): + return self.__search__(root[node], key, search_string) + raise KeyError + + def __traverse__(self, parent, descendants): + child = descendants.pop(0) + if descendants: + if child not in parent: + parent[child] = {} + return self.__traverse__(parent[child], descendants) + return parent, child + + def __nodematch__(self, key): + if key.startswith(self.STORMPATH_PREFIX): + store_key = key.lstrip(self.STORMPATH_PREFIX).strip(self.DELIMITER) + if store_key in self.MAPPINGS: + members = self.MAPPINGS[store_key].split(self.DELIMITER) + store = self.__traverse__(self.store, members) + else: + store = self.__search__(self.store, key, self.STORMPATH_PREFIX) + else: + store = self.store, key + return store + + def __getitem__(self, key): + node, child = self.__nodematch__(key) + return node[child] + + def __setitem__(self, key, value): + node, child = self.__nodematch__(key) + node[child] = value + + def __delitem__(self, key): + node, child = self.__keytransform__(key) + del node[child] + + def __contains__(self, key): + try: + # FIXME: passwordPolicy breaks the code, in + # stormpath-python-config.stormpath_config:strategies._enrich_with_directory_policies + # self.__nodematch__(key) + self[key] + return True + except KeyError: + return False + + def __iter__(self): + return iter(self.store) + + def __len__(self): + return len(self.store) diff --git a/flask_stormpath/templates/flask_stormpath/base.html b/flask_stormpath/templates/flask_stormpath/base.html index 64ccdf6..767cd25 100644 --- a/flask_stormpath/templates/flask_stormpath/base.html +++ b/flask_stormpath/templates/flask_stormpath/base.html @@ -15,6 +15,7 @@ html, body { height: 100%; + margin: auto; } @media (max-width: 767px) { @@ -23,12 +24,12 @@ padding: 0 4px; } } - + body { margin-left: auto; margin-right: auto; } - + body, div, p, diff --git a/flask_stormpath/templates/flask_stormpath/forgot_change.html b/flask_stormpath/templates/flask_stormpath/change_password.html similarity index 91% rename from flask_stormpath/templates/flask_stormpath/forgot_change.html rename to flask_stormpath/templates/flask_stormpath/change_password.html index 4f437a9..adbddac 100644 --- a/flask_stormpath/templates/flask_stormpath/forgot_change.html +++ b/flask_stormpath/templates/flask_stormpath/change_password.html @@ -1,4 +1,4 @@ -{% extends config['STORMPATH_BASE_TEMPLATE'] %} +{% extends config['stormpath']['base_template'] %} {% block title %}Change Your Password{% endblock %} {% block description %}Change your password here.{% endblock %} @@ -38,7 +38,7 @@+ This verification link is no longer valid. + Please request a new link from the form below. +
+