user_login.py

"""
Perubahan Mendasar dari fungsi login adalah:
1. Penambahan parameter external-uim
2. Apabila parameter external-uim != None maka akan load module sesuai dengan
   isi dari external-uim
3. Dengan adanya parameter ini saat terjadi login maka yang pertama kali di cek
    - Jika user tidak ada dalam lokal maka akan diforward login ke
      (external_uim).login
    - Jika user ada
        - Jika user terdapat dan ExternalIdentity maka user lofin akan diforward
          ke module External Identity
    - Jika tidak memenuhi syarat diatas maka akan login seperti normal login

4. Module external-uim harus terdapat function
    def login(user_id, password, user=None):
        ............
        ............
        return user

    result object dari fungsi tersebut harus berupa class User()
"""
import os
from importlib import import_module

import colander
import requests
from deform import widget, Form, ValidationFailure, Button
from pyramid.httpexceptions import HTTPFound, HTTPNotFound
from pyramid.renderers import render_to_response
from pyramid.security import remember, forget
from pyramid.view import view_config
from ziggurat_foundations.models.services.external_identity import \
    ExternalIdentityService
from ziggurat_foundations.models.services.user import UserService

from opensipkd.base import DBSession, get_params
from opensipkd.base.models import User, ExternalIdentity
from opensipkd.tools import create_now, set_user_log, get_settings
from opensipkd.base.views import _, one_hour, two_minutes, BaseView
from pyramid_mailer.message import Message

log = __import__("logging").getLogger(__name__)


class Login(colander.Schema):
    username = colander.SchemaNode(colander.String())
    password = colander.SchemaNode(
        colander.String(), widget=widget.PasswordWidget())


# http://deformdemo.repoze.org/interfield/
def login_validator(form, value):
    pass


def get_login_headers(request, user):
    headers = remember(request, user.id)
    user.last_login_date = create_now()
    DBSession.add(user)
    DBSession.flush()
    return headers


class Views(BaseView):
    @view_config(route_name='login', renderer='templates/login.pt')
    def view_login(self):
        request = self.req
        request.session["login"] = True
        next_url = request.params.get('next', request.referrer)
        login_tpl = get_params('login_tpl', 'templates/login.pt')
        if not next_url:
            next_url = request.route_url('home')

        if request.authenticated_userid:  # (request):
            request.session.flash('Anda sudah login', 'error')
            return HTTPFound(location=f"{request.route_url('home')}")

        schema = Login(validator=login_validator)
        form = Form(schema, buttons=('login',))
        message = ""
        if 'login' in request.POST:
            identity = request.POST.get('username')
            user = schema.user = User.get_by_identity(identity)
            controls = request.POST.items()
            try:
                c = form.validate(controls)
            except ValidationFailure as e:
                msg = 'Login gagal'
                set_user_log(msg, request, log, identity)
                request.session.flash(msg, 'error')
                return HTTPFound(location=request.route_url('login'))

            values = dict(c)
            # start cek external module
            pckgs = get_params('external-uim')
            if user:
                external_user = DBSession.query(ExternalIdentity) \
                    .filter_by(local_user_id=user.id,
                               external_user_name=identity).first()
                pckgs = external_user and pckgs or None

            if pckgs:
                # user_name = user and user.user_name or ""
                m = import_module(pckgs)
                try:
                    user = m.login(identity, values['password'], user)
                except Exception as e:
                    log.warn(str(e))
                    request.session.flash(str(e), "error")
                    return HTTPFound(location=request.route_url('login'))

            else:
                if not user or not UserService.check_password(user, values[
                    'password']):
                    msg = "Login Gagal"
                    set_user_log(msg, request, log, identity)
                    request.session.flash(msg, "error")
                    next_url = f"{request.route_url('login')}?next={next_url}"
                    return HTTPFound(location=next_url)

            return redirect_login(request, user)

        elif 'register' in request.POST:
            register_form = get_params("register_form", 'register')
            return HTTPFound(location=request.route_url(register_form))

        elif 'login failed' in request.session:
            r = dict(form=request.session['login failed'])
            del request.session['login failed']
            return r

        elif "provider_name" in request.params and request.params[
            "provider_name"]:
            provider_name = request.params["provider_name"]
            if provider_name == "google":
                from .base_google import googlesignin
                try:
                    id_info = googlesignin(request)
                except Exception as e:
                    login = ""
                    request.session.flash(str(e), "error")
                    return render_to_response(login_tpl,
                                              dict(form=form.render(),
                                                   message=message,
                                                   url=request.route_url(
                                                       'login'),
                                                   next_url=next_url,
                                                   login=login, ),
                                              request=request)

                request.session["id_info"] = id_info
            else:
                id_info = None

            user = id_info and ExternalIdentityService. \
                user_by_external_id_and_provider(id_info['sub'], id_info['iss'])

            if id_info and not user:
                request.session.flash('Silahkan Melakukan Registrasi')
                register_form = get_params("register_form", 'register')
                return HTTPFound(location=request.route_url(register_form))

            if user and user.status == 1:
                return redirect_login(request, user)
            else:
                message = "User anda masih menunggu verifikasi atau lagi di blokir"
                request.session.flash(message, "error")
        login = ""
        return render_to_response(
            renderer_name=login_tpl,
            request=request,
            value=dict(form=form.render(),
                       message=message,
                       url=request.route_url('login'),
                       next_url=next_url,
                       login=login, ),
        )


def redirect_login(request, user):
    set_user_log("Login Sukses", request, log, user.user_name)
    headers = get_login_headers(request, user)
    request.session.flash("Sukses Login")
    next_url = request.params.get('next')
    if not next_url and request.matched_route.name == 'login':
        url = get_params('modules_default', 'home')
        return HTTPFound(location=request.route_url(url),
                         headers=headers)
    return HTTPFound(location=next_url, headers=headers)


@view_config(route_name='logout', renderer="templates/logout.pt")
def view_logout(request):
    if 'batal' in request.POST:
        log.info(request.route_url('home'))
        return HTTPFound(location=f"{request.route_url('home')}", )
    elif request.POST:
        set_user_log("Logout", request, log)
        headers = forget(request)
        request.session.delete()
        if "g_state" in request.cookies:
            del request.cookies["g_state"]
            # if "g_state" in request.cookies:
            # requests.post("https://accounts.google.com/o/oauth2/revoke?token=" + ACCESS_TOKEN);
            # headers = forget(request)
            # request.session.delete()
            # request.session["start"]="login"
        return HTTPFound(location=request.route_url('home'),
                         headers=headers)
    return dict()


class ChangePassword(colander.Schema):
    new_password = colander.SchemaNode(
        colander.String(), widget=widget.PasswordWidget())
    retype_password = colander.SchemaNode(
        colander.String(), widget=widget.PasswordWidget())
    password = colander.SchemaNode(colander.String(),
                                   title=_("Old Password"))


def change_password_validator(form, value):
    exc = colander.Invalid(form, '')
    user = form.request.user
    if not UserService.check_password(user, value["password"]):
        exc["password"] = 'Login Failed'
        raise exc

    if value['new_password'] != value['retype_password']:
        exc["new_password"] = 'Retype mismatch.'
        exc["retype_password"] = 'Retype mismatch.'
        raise exc


@view_config(route_name='change-password',
             renderer='templates/change-password.pt')
def view_change_password(request):
    if request.authenticated_userid:
        request.session.flash('Anda sudah login', 'error')
        return HTTPFound(location=f"{request.route_url('home')}")
    schema = ChangePassword(validator=change_password_validator)
    btn_save = Button('save', _('Simpan'))
    btn_cancel = Button('cancel', _('Batalkan'))
    buttons = (btn_save, btn_cancel)
    form = Form(schema, buttons=buttons)
    if not request.POST:
        return dict(form=form.render())
    if 'save' not in request.POST:
        return HTTPFound(location=request.route_url('login'))
    items = request.POST.items()
    try:
        c = form.validate(items)
    except ValidationFailure as e:
        return dict(form=e.render())
    code = request.matchdict['code']
    q = DBSession.query(User).filter_by(security_code=code)
    user = q.first()
    if not user or \
            create_now() - user.security_code_date > one_hour:
        request.session.flash('Security code expired', 'error')
        return HTTPFound(location=request.route_url('login'))
    user.security_code = None
    UserService.set_password(user, c['new_password'])
    DBSession.add(user)
    headers = get_login_headers(request, user)
    request.session.flash('Password baru Anda sudah disimpan.')
    set_user_log("Change Password", request, log)
    return HTTPFound(location=f"{request.route_url('home')}", headers=headers)


######################
# Buat ulang API Key #
######################
class APIKey(colander.Schema):
    api_key = colander.SchemaNode(
        colander.String(), widget=widget.TextInputWidget(readonly=True))


def generate_api_key():
    return UserService.generate_random_string(64)


@view_config(
    route_name='recreate-api-key', renderer='templates/recreate-api-key.pt',
    permission='view')
def view_recreate_api_key(request):
    if not request.user.api_key:
        return HTTPNotFound()
    schema = APIKey()
    btn_submit = Button('recreate', _('Buat ulang'))
    btn_cancel = Button('cancel', _('Batalkan'))
    buttons = (btn_submit, btn_cancel)
    form = Form(schema, buttons=buttons)
    if not request.POST:
        d = dict(api_key=request.user.api_key)
        return dict(form=form.render(appstruct=d))
    if 'recreate' not in request.POST:
        return HTTPFound(location=f"{request.route_url('home')}")
    request.user.api_key = api_key = generate_api_key()
    DBSession.add(request.user)
    msg = 'API Key Anda yang baru {}'.format(api_key)
    request.session.flash(msg)
    return HTTPFound(location=f"{request.route_url('home')}")


##################
# Reset password #
##################
class ResetPassword(colander.Schema):
    email = colander.SchemaNode(
        colander.String(), title=_('Email'),
        description=_(
            'email-reset-password',
            default='Enter your email address and we will send you ' \
                    'a link to reset your password.')
    )


def reset_password_validator(form, value):
    user = form.user
    if not user or not user.status:
        raise colander.Invalid(form, _('Invalid email'))


def security_code_age(user):
    return create_now() - user.security_code_date


def send_email_security_code(
        request, user, time_remain, subject, body_msg_id, body_default_file):
    settings = get_settings()
    if 'mail.sender_name' not in settings \
            or 'mail.username' not in settings:
        return

    url = '{}password/{}'.format(
        request.route_url('home'), user.security_code)
    minutes = int(time_remain.seconds / 60)
    data = dict(url=url, minutes=minutes)
    here = os.path.abspath(os.path.dirname(__file__))
    body_file = os.path.join(here, body_default_file)
    with open(body_file) as f:
        body_tpl = f.read()
    body = _(body_msg_id, default=body_tpl, mapping=data)
    # body = request.localizer.translate(body)
    # sender = '{} <{}>'.format(
    #     settings['mail.sender_name'], settings['mail.username'])
    # subject = request.localizer.translate(_(subject))
    # message = Message(
    #     subject=subject, sender=sender, recipients=[user.email], body=body)
    # mailer = request.registry['mailer']
    # mailer.send(message)
    sending_mail(request, user, subject, body)


def sending_mail(request, user, subject, body):
    settings = get_settings()
    body = request.localizer.translate(body)
    sender = '{} <{}>'.format(
        settings['mail.sender_name'], settings['mail.username'])
    subject = request.localizer.translate(_(subject))
    message = Message(
        subject=subject, sender=sender, recipients=[user.email], body=body)
    mailer = request.registry['mailer']
    mailer.send(message)


def send_email_pending(
        request, user, subject, body_msg_id, body_default_file):
    settings = get_settings()
    if 'mail.sender_name' not in settings \
            or 'mail.username' not in settings:
        return

    here = os.path.abspath(os.path.dirname(__file__))
    body_file = os.path.join(here, body_default_file)
    with open(body_file) as f:
        body_tpl = f.read()
    body = _(body_msg_id, default=body_tpl)
    sending_mail(request, user, subject, body)


def regenerate_security_code(user):
    age = security_code_age(user)
    remain = one_hour - age
    if user.security_code and age < one_hour and remain > two_minutes:
        return remain
    UserService.regenerate_security_code(user)
    user.security_code_date = create_now()
    DBSession.add(user)
    return one_hour


@view_config(route_name='reset-password',
             renderer='templates/reset-password.pt')
def view_reset_password(request):
    if request.authenticated_userid:
        return HTTPFound(location=f"{request.route_url('home')}")

    resp = dict(title=_('Reset password'))
    schema = ResetPassword(validator=reset_password_validator)
    btn_submit = Button('submit', _('Send password reset email'))
    form = Form(schema, buttons=(btn_submit,))
    if 'submit' in request.POST:
        controls = request.POST.items()
        identity = request.POST.get('email')
        q = DBSession.query(User).filter_by(email=identity)
        schema.user = user = q.first()
        try:
            c = form.validate(controls)
        except ValidationFailure:
            resp['form'] = form.render()
            return resp
        remain = regenerate_security_code(user)
        set_user_log("Reset password to {}".format(user.email), request, log,
                     user.user_name)
        send_email_security_code(
            request, user, remain, 'Reset password', 'reset-password-body',
            'reset-password-body.tpl')
        return HTTPFound(location=request.route_url('reset-password-sent'))
    resp['form'] = form.render()
    return resp


@view_config(
    route_name='reset-password-sent',
    renderer='templates/reset-password-sent.pt')
def view_reset_password_sent(request):
    return dict(title=_('Reset password'))