factors/email(minor): start rebuilding email integration as factor

passbook/providers/app_gw/middleware.py

@@ -1,55 +0,0 @@
-import time
-
-from django.conf import settings
-from django.contrib.sessions.middleware import SessionMiddleware
-from django.utils.cache import patch_vary_headers
-from django.utils.http import cookie_date
-from structlog import get_logger
-
-from passbook.factors.view import AuthenticationView
-
-LOGGER = get_logger()
-
-class SessionHostDomainMiddleware(SessionMiddleware):
-
-    def process_request(self, request):
-        session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
-        request.session = self.SessionStore(session_key)
-
-    def process_response(self, request, response):
-        """
-        If request.session was modified, or if the configuration is to save the
-        session every time, save the changes and set a session cookie.
-        """
-        try:
-            accessed = request.session.accessed
-            modified = request.session.modified
-        except AttributeError:
-            pass
-        else:
-            if accessed:
-                patch_vary_headers(response, ('Cookie',))
-            if modified or settings.SESSION_SAVE_EVERY_REQUEST:
-                if request.session.get_expire_at_browser_close():
-                    max_age = None
-                    expires = None
-                else:
-                    max_age = request.session.get_expiry_age()
-                    expires_time = time.time() + max_age
-                    expires = cookie_date(expires_time)
-                # Save the session data and refresh the client cookie.
-                # Skip session save for 500 responses, refs #3881.
-                if response.status_code != 500:
-                    request.session.save()
-                    hosts = [request.get_host().split(':')[0]]
-                    if AuthenticationView.SESSION_FORCE_COOKIE_HOSTNAME in request.session:
-                        hosts.append(request.session[AuthenticationView.SESSION_FORCE_COOKIE_HOSTNAME])
-                    LOGGER.debug("Setting hosts for session", hosts=hosts)
-                    for host in hosts:
-                        response.set_cookie(settings.SESSION_COOKIE_NAME,
-                                            request.session.session_key, max_age=max_age,
-                                            expires=expires, domain=host,
-                                            path=settings.SESSION_COOKIE_PATH,
-                                            secure=settings.SESSION_COOKIE_SECURE or None,
-                                            httponly=settings.SESSION_COOKIE_HTTPONLY or None)
-        return response

passbook/providers/app_gw/views.py

@@ -1,7 +1,8 @@
 """passbook app_gw views"""
-from pprint import pprint
 from urllib.parse import urlparse
 
+from django.conf import settings
+from django.core.cache import cache
 from django.http import HttpRequest, HttpResponse
 from django.views import View
 from structlog import get_logger
@@ -12,15 +13,26 @@ from passbook.providers.app_gw.models import ApplicationGatewayProvider
 ORIGINAL_URL = 'HTTP_X_ORIGINAL_URL'
 LOGGER = get_logger()
 
+def cache_key(session_cookie: str, request: HttpRequest) -> str:
+    """Cache Key for request fingerprinting"""
+    fprint = '_'.join([
+        session_cookie,
+        request.META.get('HTTP_HOST'),
+        request.META.get('PATH_INFO'),
+    ])
+    return f"app_gw_{fprint}"
 
 class NginxCheckView(AccessMixin, View):
+    """View used by nginx's auth_request module"""
 
     def dispatch(self, request: HttpRequest) -> HttpResponse:
-        pprint(request.META)
+        session_cookie = request.COOKIES.get(settings.SESSION_COOKIE_NAME, '')
+        _cache_key = cache_key(session_cookie, request)
+        if cache.get(_cache_key):
+            return HttpResponse(status=202)
         parsed_url = urlparse(request.META.get(ORIGINAL_URL))
         # request.session[AuthenticationView.SESSION_ALLOW_ABSOLUTE_NEXT] = True
         # request.session[AuthenticationView.SESSION_FORCE_COOKIE_HOSTNAME] = parsed_url.hostname
-        print(request.user)
         if not request.user.is_authenticated:
             return HttpResponse(status=401)
         matching = ApplicationGatewayProvider.objects.filter(
@@ -31,6 +43,7 @@ class NginxCheckView(AccessMixin, View):
         application = self.provider_to_application(matching.first())
         has_access, _ = self.user_has_access(application, request.user)
         if has_access:
+            cache.set(_cache_key, True)
             return HttpResponse(status=202)
         LOGGER.debug("User not passing", user=request.user)
         return HttpResponse(status=401)