{% trans 'Enter the Verification Code from your Authenticator App.' %}
-{% endblock %} diff --git a/passbook/stages/otp/urls.py b/passbook/stages/otp/urls.py deleted file mode 100644 index 012ff2923b..0000000000 --- a/passbook/stages/otp/urls.py +++ /dev/null @@ -1,12 +0,0 @@ -"""passbook OTP Urls""" - -from django.urls import path - -from passbook.stages.otp import views - -urlpatterns = [ - path("", views.UserSettingsView.as_view(), name="otp-user-settings"), - path("qr/", views.QRView.as_view(), name="otp-qr"), - path("enable/", views.EnableView.as_view(), name="otp-enable"), - path("disable/", views.DisableView.as_view(), name="otp-disable"), -] diff --git a/passbook/stages/otp/utils.py b/passbook/stages/otp/utils.py deleted file mode 100644 index 978803747c..0000000000 --- a/passbook/stages/otp/utils.py +++ /dev/null @@ -1,17 +0,0 @@ -"""passbook OTP Utils""" - -from django.utils.http import urlencode - - -def otpauth_url(accountname, secret, issuer=None, digits=6): - """Create otpauth according to - https://github.com/google/google-authenticator/wiki/Key-Uri-Format""" - # Ensure that the secret parameter is the FIRST parameter of the URI, this - # allows Microsoft Authenticator to work. - query = [ - ("secret", secret), - ("digits", digits), - ("issuer", "passbook"), - ] - - return "otpauth://totp/%s:%s?%s" % (issuer, accountname, urlencode(query)) diff --git a/passbook/stages/otp/views.py b/passbook/stages/otp/views.py deleted file mode 100644 index 82ff8b3334..0000000000 --- a/passbook/stages/otp/views.py +++ /dev/null @@ -1,166 +0,0 @@ -"""passbook OTP Views""" -from base64 import b32encode -from binascii import unhexlify - -from django.contrib import messages -from django.contrib.auth.mixins import LoginRequiredMixin -from django.http import Http404, HttpRequest, HttpResponse -from django.shortcuts import get_object_or_404, redirect -from django.urls import reverse -from django.utils.decorators import method_decorator -from django.utils.translation import ugettext as _ -from django.views import View -from django.views.decorators.cache import never_cache -from django.views.generic import FormView, TemplateView -from django_otp.plugins.otp_static.models import StaticDevice, StaticToken -from django_otp.plugins.otp_totp.models import TOTPDevice -from qrcode import make -from qrcode.image.svg import SvgPathImage -from structlog import get_logger - -from passbook.audit.models import Event, EventAction -from passbook.lib.config import CONFIG -from passbook.stages.otp.forms import OTPSetupForm -from passbook.stages.otp.utils import otpauth_url - -OTP_SESSION_KEY = "passbook_stages_otp_key" -OTP_SETTING_UP_KEY = "passbook_stages_otp_setup" -LOGGER = get_logger() - - -class UserSettingsView(LoginRequiredMixin, TemplateView): - """View for user settings to control OTP""" - - template_name = "stages/otp/user_settings.html" - - # TODO: Check if OTP Stage exists and applies to user - def get_context_data(self, **kwargs): - kwargs = super().get_context_data(**kwargs) - static = StaticDevice.objects.filter(user=self.request.user, confirmed=True) - if static.exists(): - kwargs["static_tokens"] = StaticToken.objects.filter( - device=static.first() - ).order_by("token") - totp_devices = TOTPDevice.objects.filter(user=self.request.user, confirmed=True) - kwargs["state"] = totp_devices.exists() and static.exists() - return kwargs - - -class DisableView(LoginRequiredMixin, View): - """Disable TOTP for user""" - - def get(self, request: HttpRequest) -> HttpResponse: - """Delete all the devices for user""" - static = get_object_or_404(StaticDevice, user=request.user, confirmed=True) - static_tokens = StaticToken.objects.filter(device=static).order_by("token") - totp = TOTPDevice.objects.filter(user=request.user, confirmed=True) - static.delete() - totp.delete() - for token in static_tokens: - token.delete() - messages.success(request, "Successfully disabled OTP") - # Create event with email notification - Event.new(EventAction.CUSTOM, message="User disabled OTP.").from_http(request) - return redirect(reverse("passbook_stages_otp:otp-user-settings")) - - -class EnableView(LoginRequiredMixin, FormView): - """View to set up OTP""" - - title = _("Set up OTP") - form_class = OTPSetupForm - template_name = "login/form.html" - - totp_device = None - static_device = None - - # TODO: Check if OTP Stage exists and applies to user - def get_context_data(self, **kwargs): - kwargs["config"] = CONFIG.y("passbook") - kwargs["title"] = _("Configure OTP") - kwargs["primary_action"] = _("Setup") - return super().get_context_data(**kwargs) - - def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse: - # Check if user has TOTP setup already - finished_totp_devices = TOTPDevice.objects.filter( - user=request.user, confirmed=True - ) - finished_static_devices = StaticDevice.objects.filter( - user=request.user, confirmed=True - ) - if finished_totp_devices.exists() and finished_static_devices.exists(): - messages.error(request, _("You already have TOTP enabled!")) - del request.session[OTP_SETTING_UP_KEY] - return redirect("passbook_stages_otp:otp-user-settings") - request.session[OTP_SETTING_UP_KEY] = True - # Check if there's an unconfirmed device left to set up - totp_devices = TOTPDevice.objects.filter(user=request.user, confirmed=False) - if not totp_devices.exists(): - # Create new TOTPDevice and save it, but not confirm it - self.totp_device = TOTPDevice(user=request.user, confirmed=False) - self.totp_device.save() - else: - self.totp_device = totp_devices.first() - - # Check if we have a static device already - static_devices = StaticDevice.objects.filter(user=request.user, confirmed=False) - if not static_devices.exists(): - # Create new static device and some codes - self.static_device = StaticDevice(user=request.user, confirmed=False) - self.static_device.save() - # Create 9 tokens and save them - # TODO: Send static tokens via Email - for _counter in range(0, 9): - token = StaticToken( - device=self.static_device, token=StaticToken.random_token() - ) - token.save() - else: - self.static_device = static_devices.first() - - # Somehow convert the generated key to base32 for the QR code - rawkey = unhexlify(self.totp_device.key.encode("ascii")) - request.session[OTP_SESSION_KEY] = b32encode(rawkey).decode("utf-8") - return super().dispatch(request, *args, **kwargs) - - def get_form(self, form_class=None): - form = super().get_form(form_class=form_class) - form.device = self.totp_device - form.fields["qr_code"].initial = reverse("passbook_stages_otp:otp-qr") - tokens = [(x.token, x.token) for x in self.static_device.token_set.all()] - form.fields["tokens"].choices = tokens - return form - - def form_valid(self, form): - # Save device as confirmed - LOGGER.debug("Saved OTP Devices") - self.totp_device.confirmed = True - self.totp_device.save() - self.static_device.confirmed = True - self.static_device.save() - del self.request.session[OTP_SETTING_UP_KEY] - Event.new(EventAction.CUSTOM, message="User enabled OTP.").from_http( - self.request - ) - return redirect("passbook_stages_otp:otp-user-settings") - - -@method_decorator(never_cache, name="dispatch") -class QRView(View): - """View returns an SVG image with the OTP token information""" - - def get(self, request: HttpRequest) -> HttpResponse: - """View returns an SVG image with the OTP token information""" - # Get the data from the session - try: - key = request.session[OTP_SESSION_KEY] - except KeyError: - raise Http404 - - url = otpauth_url(accountname=request.user.username, secret=key) - # Make and return QR code - img = make(url, image_factory=SvgPathImage) - resp = HttpResponse(content_type="image/svg+xml; charset=utf-8") - img.save(resp) - return resp diff --git a/passbook/stages/otp/__init__.py b/passbook/stages/otp_time/__init__.py similarity index 100% rename from passbook/stages/otp/__init__.py rename to passbook/stages/otp_time/__init__.py diff --git a/passbook/stages/otp_time/api.py b/passbook/stages/otp_time/api.py new file mode 100644 index 0000000000..3ce955c01a --- /dev/null +++ b/passbook/stages/otp_time/api.py @@ -0,0 +1,21 @@ +"""OTPTimeStage API Views""" +from rest_framework.serializers import ModelSerializer +from rest_framework.viewsets import ModelViewSet + +from passbook.stages.otp_time.models import OTPTimeStage + + +class OTPTimeStageSerializer(ModelSerializer): + """OTPTimeStage Serializer""" + + class Meta: + + model = OTPTimeStage + fields = ["pk", "name", "digits"] + + +class OTPTimeStageViewSet(ModelViewSet): + """OTPTimeStage Viewset""" + + queryset = OTPTimeStage.objects.all() + serializer_class = OTPTimeStageSerializer diff --git a/passbook/stages/otp_time/apps.py b/passbook/stages/otp_time/apps.py new file mode 100644 index 0000000000..854be8ab88 --- /dev/null +++ b/passbook/stages/otp_time/apps.py @@ -0,0 +1,9 @@ +from django.apps import AppConfig + + +class PassbookStageOTPTimeConfig(AppConfig): + + name = "passbook.stages.otp_time" + label = "passbook_stages_otp_time" + verbose_name = "passbook OTP.Time" + mountpoint = "-/user/otp/time/" diff --git a/passbook/stages/otp/forms.py b/passbook/stages/otp_time/forms.py similarity index 52% rename from passbook/stages/otp/forms.py rename to passbook/stages/otp_time/forms.py index 0033667cf0..490ac569f8 100644 --- a/passbook/stages/otp/forms.py +++ b/passbook/stages/otp_time/forms.py @@ -1,16 +1,10 @@ -"""passbook OTP Forms""" - from django import forms -from django.core.validators import RegexValidator from django.utils.safestring import mark_safe from django.utils.translation import gettext_lazy as _ from django_otp.models import Device -from passbook.stages.otp.models import OTPStage - -OTP_CODE_VALIDATOR = RegexValidator( - r"^[0-9a-z]{6,8}$", _("Only alpha-numeric characters are allowed.") -) +from passbook.stages.otp_time.models import OTPTimeStage +from passbook.stages.otp_validate.forms import OTP_CODE_VALIDATOR class PictureWidget(forms.widgets.Widget): @@ -20,30 +14,11 @@ class PictureWidget(forms.widgets.Widget): return mark_safe(f'@@ -21,22 +21,11 @@
{% if not state %} - {% trans "Enable OTP" %} + {% trans "Enable Time-based OTP" %} {% else %} - {% trans "Disable OTP" %} + {% trans "Disable Time-based OTP" %} {% endif %}
{% for token in static_tokens %}{{ token.token }}
- {% empty %}{% trans 'N/A' %}{% endfor %}
-