OKiddlZddlZddlmZddlmZmZddlm Z ddl m Z m Z ddl mZddlmZddlmZdd lmZdd lmZdd lmZdd lmZmZmZmZej<eZ Gd deZ!y)N)Pattern)quote urlencode)BACKEND_SESSION_KEY)HttpResponseRedirect JsonResponse)reverse)get_random_string)MiddlewareMixin)cached_property) import_string)OIDCAuthenticationBackend) absolutify+add_state_and_verifier_and_nonce_to_sessiongenerate_code_challengeimport_from_settingsc^eZdZdZfdZedZedZedZ dZ dZ xZ S)SessionRefreshzRefreshes the session with the OIDC RP after expiry seconds For users authenticated with the OIDC RP, verify tokens are still valid and if not, force the user to re-authenticate silently. ctt| ||jdg|_|jd|_|jd|_|jdd|_|jdd|_|jdd |_ |jd d |_ |jd d|_ y) NOIDC_EXEMPT_URLSOIDC_OP_AUTHORIZATION_ENDPOINTOIDC_RP_CLIENT_IDOIDC_STATE_SIZE OIDC_AUTHENTICATION_CALLBACK_URLoidc_authentication_callbackOIDC_RP_SCOPESz openid emailOIDC_USE_NONCETOIDC_NONCE_SIZE) superr__init__ get_settingsrrrrrrrr)self get_response __class__s U/var/www/aura-ras/venv/lib/python3.12/site-packages/mozilla_django_oidc/middleware.pyr!zSessionRefresh.__init__!s nd,\: $ 1 12Db I.2.?.? ,/ +"&!2!23F!G#001BBG040A0A . *1 -#//0@.Q"//0@$G#001BBGct|g|SN)r)attrargss r&r"zSessionRefresh.get_settings1s#D0400r'cg}|jD]$}t|tr|j|&|j gdt |Dcgc] }|j dr|n t|"c}Scc}w)aNGenerate and return a set of url paths to exempt from SessionRefresh This takes the value of ``settings.OIDC_EXEMPT_URLS`` and appends three urls that mozilla-django-oidc uses. These values can be view names or absolute url paths. :returns: list of url paths (for example "/oidc/callback/") )oidc_authentication_initr oidc_logout/)r isinstance re_Patternappendextendset startswithr )r# exempt_urlsurls r&r6zSessionRefresh.exempt_urls5s (( (Cc:.""3' (   EP QcCNN3'SWS\ 9 Q  Qs%A>ct}|jD]$}t|ts|j |&|S)aFGenerate and return a set of url patterns to exempt from SessionRefresh This takes the value of ``settings.OIDC_EXEMPT_URLS`` and returns the values that are compiled regular expression patterns. :returns: list of url patterns (for example, ``re.compile(r"/user/[0-9]+/image")``) )r4rr0r1add)r#exempt_patterns url_patterns r&exempt_url_patternsz"SessionRefresh.exempt_url_patternsPs@%00 1K+z2##K0 1r'cLjjt}d}|rt|}t |t }j dk(xrUjjxr=|xr9j|jvxrtfd|jD S)zTakes a request and returns whether it triggers a refresh examination :arg HttpRequest request: :returns: boolean TGETc3TK|]}|jj!ywr))matchpath).0patrequests r& z4SessionRefresh.is_refreshable_url..tsTC ',,/Ts%() sessiongetrr issubclassrmethoduseris_authenticatedrAr6anyr<)r#rDbackend_sessionis_oidc_enabled auth_backends ` r&is_refreshable_urlz!SessionRefresh.is_refreshable_url`s"//--.AB (9L(7PQO NNe # U -- U U D$4$44 UT4;S;STTT  r'c|j|stjdy|jj dd}t j }||kDrtjd||ytjd|j }|j}t|j}d|t|t|j||jdd}|j|jd i|j r(t|j"}|jd |i|jd d rr|jd d} d| cxkrdkst%dt%dt| } |jdd} t'| | } |j| | dnd} t)|||| |j+|jd<t-|t.} dj1|| }|j2j ddk(rt5d|id}||d<|St7|S)Nzrequest is not refreshableoidc_id_token_expirationrz!id token is still valid (%s > %s)zid token has expiredcodenone) response_type client_id redirect_uristatescopepromptOIDC_AUTH_REQUEST_EXTRA_PARAMSnonce OIDC_USE_PKCEFOIDC_PKCE_CODE_VERIFIER_SIZE@+z/code_verifier_length must be between 43 and 128OIDC_PKCE_CODE_CHALLENGE_METHODS256)code_challengecode_challenge_methodoidc_login_next) quote_viaz {url}?{query})r7queryzx-requested-withXMLHttpRequest refresh_urli)status)rPLOGGERdebugrFrGtimerrr rrr rrupdater"rr ValueErrorrr get_full_pathrrformatheadersrr)r#rD expirationnowauth_urlrVrXparamsr\code_verifier_length code_verifierrerdrh redirect_urlresponses r&process_requestzSessionRefresh.process_requestwsH&&w/ LL5 6 __(()CQG iik   LLrsU $)3:1435>   8 $q2_q2r'