0
0
Fork 0
mirror of https://github.com/healthchecks/healthchecks.git synced 2025-03-16 21:23:36 +00:00
healthchecks_healthchecks/hc/accounts/views.py

546 lines
17 KiB
Python
Raw Normal View History

from datetime import timedelta as td
from urllib.parse import urlparse
2015-06-11 19:12:09 +00:00
import uuid
from django.db import transaction
from django.conf import settings
from django.contrib import messages
2015-11-02 21:55:33 +00:00
from django.contrib.auth import login as auth_login
from django.contrib.auth import logout as auth_logout
2015-06-18 15:39:03 +00:00
from django.contrib.auth import authenticate
from django.contrib.auth.decorators import login_required
2015-06-11 19:12:09 +00:00
from django.contrib.auth.models import User
from django.core import signing
2019-05-15 11:27:50 +00:00
from django.http import (
HttpResponseForbidden,
HttpResponseBadRequest,
HttpResponseNotFound,
)
from django.shortcuts import get_object_or_404, redirect, render
from django.utils.timezone import now
from django.urls import resolve, Resolver404
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_POST
from hc.accounts import forms
2019-01-12 14:40:21 +00:00
from hc.accounts.models import Profile, Project, Member
2019-04-25 18:28:40 +00:00
from hc.api.models import Channel, Check, TokenBucket
from hc.lib.date import choose_next_report_date
from hc.payments.models import Subscription
2015-06-11 19:12:09 +00:00
2019-05-15 11:27:50 +00:00
NEXT_WHITELIST = (
"hc-checks",
"hc-details",
"hc-log",
"hc-p-channels",
2019-05-15 11:27:50 +00:00
"hc-add-slack",
"hc-add-pushover",
"hc-add-telegram",
"hc-project-settings",
2019-05-15 11:27:50 +00:00
)
def _is_whitelisted(redirect_url):
if not redirect_url:
return False
parsed = urlparse(redirect_url)
try:
match = resolve(parsed.path)
except Resolver404:
return False
return match.url_name in NEXT_WHITELIST
2015-06-11 19:12:09 +00:00
def _make_user(email, with_project=True):
username = str(uuid.uuid4())[:30]
2015-06-18 15:39:03 +00:00
user = User(username=username, email=email)
user.set_unusable_password()
2015-06-18 15:39:03 +00:00
user.save()
2015-06-12 17:49:35 +00:00
project = None
if with_project:
project = Project(owner=user)
project.badge_key = user.username
project.save()
check = Check(project=project)
check.name = "My First Check"
check.save()
channel = Channel(project=project)
channel.kind = "email"
channel.value = email
channel.email_verified = True
channel.save()
channel.checks.add(check)
2019-01-12 14:40:21 +00:00
# Ensure a profile gets created
Profile.objects.for_user(user)
2016-05-09 12:35:13 +00:00
return user
2015-06-30 21:28:13 +00:00
def _redirect_after_login(request):
""" Redirect to the URL indicated in ?next= query parameter. """
redirect_url = request.GET.get("next")
if _is_whitelisted(redirect_url):
return redirect(redirect_url)
if request.user.project_set.count() == 1:
project = request.user.project_set.first()
return redirect("hc-checks", project.code)
2019-01-29 08:59:10 +00:00
return redirect("hc-index")
def login(request):
form = forms.PasswordLoginForm()
magic_form = forms.EmailLoginForm()
2019-05-15 11:27:50 +00:00
if request.method == "POST":
if request.POST.get("action") == "login":
form = forms.PasswordLoginForm(request.POST)
if form.is_valid():
auth_login(request, form.user)
return _redirect_after_login(request)
else:
magic_form = forms.EmailLoginForm(request.POST)
if magic_form.is_valid():
redirect_url = request.GET.get("next")
2019-04-25 18:28:40 +00:00
if not _is_whitelisted(redirect_url):
redirect_url = None
profile = Profile.objects.for_user(magic_form.user)
2019-04-25 18:28:40 +00:00
profile.send_instant_login_link(redirect_url=redirect_url)
response = redirect("hc-login-link-sent")
# check_token_submit looks for this cookie to decide if
# it needs to do the extra POST step.
response.set_cookie("auto-login", "1", max_age=300, httponly=True)
return response
2015-06-11 19:12:09 +00:00
bad_link = request.session.pop("bad_link", None)
ctx = {
"page": "login",
"form": form,
"magic_form": magic_form,
2019-05-15 11:27:50 +00:00
"bad_link": bad_link,
"registration_open": settings.REGISTRATION_OPEN,
}
2015-06-11 19:12:09 +00:00
return render(request, "accounts/login.html", ctx)
2015-06-18 15:39:03 +00:00
def logout(request):
auth_logout(request)
return redirect("hc-index")
2018-10-12 07:55:15 +00:00
@require_POST
@csrf_exempt
2018-10-12 07:55:15 +00:00
def signup(request):
if not settings.REGISTRATION_OPEN:
return HttpResponseForbidden()
ctx = {}
form = forms.AvailableEmailForm(request.POST)
2018-10-12 07:55:15 +00:00
if form.is_valid():
email = form.cleaned_data["identity"]
user = _make_user(email)
profile = Profile.objects.for_user(user)
profile.send_instant_login_link()
ctx["created"] = True
else:
ctx = {"form": form}
response = render(request, "accounts/signup_result.html", ctx)
if ctx.get("created"):
response.set_cookie("auto-login", "1", max_age=300, httponly=True)
return response
2018-10-12 07:55:15 +00:00
2015-06-11 19:12:09 +00:00
def login_link_sent(request):
return render(request, "accounts/login_link_sent.html")
def link_sent(request):
return render(request, "accounts/link_sent.html")
def check_token(request, username, token):
2016-08-29 14:54:53 +00:00
if request.user.is_authenticated and request.user.username == username:
2015-11-28 08:35:02 +00:00
# User is already logged in
return _redirect_after_login(request)
2015-11-28 08:35:02 +00:00
# Some email servers open links in emails to check for malicious content.
# To work around this, we sign user in if the method is POST
# *or* if the browser presents a cookie we had set when sending the login link.
#
# If the method is GET, we instead serve a HTML form and a piece
# of Javascript to automatically submit it.
2015-08-01 20:02:51 +00:00
if request.method == "POST" or "auto-login" in request.COOKIES:
user = authenticate(username=username, token=token)
if user is not None and user.is_active:
user.profile.token = ""
user.profile.save()
auth_login(request, user)
return _redirect_after_login(request)
request.session["bad_link"] = True
return redirect("hc-login")
return render(request, "accounts/check_token_submit.html")
@login_required
def profile(request):
2017-08-30 19:42:45 +00:00
profile = request.profile
2019-05-15 11:27:50 +00:00
ctx = {"page": "profile", "profile": profile, "my_projects_status": "default"}
if request.method == "POST":
if "change_email" in request.POST:
profile.send_change_email_link()
return redirect("hc-link-sent")
elif "set_password" in request.POST:
profile.send_set_password_link()
return redirect("hc-link-sent")
elif "leave_project" in request.POST:
code = request.POST["code"]
try:
2019-05-15 11:27:50 +00:00
project = Project.objects.get(code=code, member__user=request.user)
except Project.DoesNotExist:
return HttpResponseBadRequest()
Member.objects.filter(project=project, user=request.user).delete()
ctx["left_project"] = project
ctx["my_projects_status"] = "info"
# Retrieve projects right before rendering the template--
# The list of the projects might have *just* changed
ctx["projects"] = list(profile.projects())
return render(request, "accounts/profile.html", ctx)
@login_required
@require_POST
def add_project(request):
form = forms.ProjectNameForm(request.POST)
if not form.is_valid():
return HttpResponseBadRequest()
project = Project(owner=request.user)
project.code = project.badge_key = str(uuid.uuid4())
project.name = form.cleaned_data["name"]
project.save()
2019-01-29 08:59:10 +00:00
return redirect("hc-checks", project.code)
@login_required
def project(request, code):
if request.user.is_superuser:
q = Project.objects
else:
q = request.profile.projects()
try:
project = q.get(code=code)
except Project.DoesNotExist:
return HttpResponseNotFound()
is_owner = project.owner_id == request.user.id
ctx = {
"page": "project",
"project": project,
"is_owner": is_owner,
"show_api_keys": "show_api_keys" in request.GET,
}
if request.method == "POST":
if "create_api_keys" in request.POST:
project.set_api_keys()
project.save()
2019-01-12 14:40:21 +00:00
2018-10-29 19:44:34 +00:00
ctx["show_api_keys"] = True
ctx["api_keys_created"] = True
ctx["api_status"] = "success"
2018-10-29 19:44:34 +00:00
elif "revoke_api_keys" in request.POST:
project.api_key = ""
project.api_key_readonly = ""
project.save()
2019-01-12 14:40:21 +00:00
2018-10-29 19:44:34 +00:00
ctx["api_keys_revoked"] = True
ctx["api_status"] = "info"
2018-10-29 19:44:34 +00:00
elif "show_api_keys" in request.POST:
ctx["show_api_keys"] = True
2016-05-09 08:54:18 +00:00
elif "invite_team_member" in request.POST:
if not is_owner:
return HttpResponseForbidden()
form = forms.InviteTeamMemberForm(request.POST)
2016-05-09 08:54:18 +00:00
if form.is_valid():
email = form.cleaned_data["email"]
invite_suggestions = project.invite_suggestions()
if not invite_suggestions.filter(email=email).exists():
# We're inviting a new user. Are we within team size limit?
if not project.can_invite_new_users():
return HttpResponseForbidden()
# And are we not hitting a rate limit?
if not TokenBucket.authorize_invite(request.user):
return render(request, "try_later.html")
2016-05-09 08:54:18 +00:00
try:
user = User.objects.get(email=email)
except User.DoesNotExist:
user = _make_user(email, with_project=False)
2016-05-09 08:54:18 +00:00
project.invite(user)
ctx["team_member_invited"] = email
ctx["team_status"] = "success"
2016-05-09 08:54:18 +00:00
elif "remove_team_member" in request.POST:
if not is_owner:
return HttpResponseForbidden()
form = forms.RemoveTeamMemberForm(request.POST)
2016-05-09 08:54:18 +00:00
if form.is_valid():
q = User.objects
q = q.filter(email=form.cleaned_data["email"])
q = q.filter(memberships__project=project)
farewell_user = q.first()
if farewell_user is None:
return HttpResponseBadRequest()
2016-05-09 08:54:18 +00:00
2019-05-15 11:27:50 +00:00
Member.objects.filter(project=project, user=farewell_user).delete()
2016-05-09 14:29:41 +00:00
ctx["team_member_removed"] = form.cleaned_data["email"]
ctx["team_status"] = "info"
elif "set_project_name" in request.POST:
form = forms.ProjectNameForm(request.POST)
2016-05-09 12:35:13 +00:00
if form.is_valid():
project.name = form.cleaned_data["name"]
project.save()
2019-01-12 14:40:21 +00:00
ctx["project_name_updated"] = True
ctx["project_name_status"] = "success"
elif "transfer_project" in request.POST:
if not is_owner:
return HttpResponseForbidden()
form = forms.TransferForm(request.POST)
if form.is_valid():
# Look up the proposed new owner
email = form.cleaned_data["email"]
try:
membership = project.member_set.filter(user__email=email).get()
except Member.DoesNotExist:
return HttpResponseBadRequest()
# Revoke any previous transfer requests
project.member_set.update(transfer_request_date=None)
# Initiate the new request
membership.transfer_request_date = now()
membership.save()
# Send an email notification
profile = Profile.objects.for_user(membership.user)
profile.send_transfer_request(project)
ctx["transfer_initiated"] = True
ctx["transfer_status"] = "success"
elif "cancel_transfer" in request.POST:
if not is_owner:
return HttpResponseForbidden()
project.member_set.update(transfer_request_date=None)
ctx["transfer_cancelled"] = True
ctx["transfer_status"] = "success"
elif "accept_transfer" in request.POST:
tr = project.transfer_request()
if not tr or tr.user != request.user:
return HttpResponseForbidden()
if not tr.can_accept():
return HttpResponseBadRequest()
with transaction.atomic():
# 1. Reuse the existing membership, and change its user
tr.user = project.owner
tr.transfer_request_date = None
tr.save()
# 2. Change project's owner
project.owner = request.user
project.save()
ctx["is_owner"] = True
messages.success(request, "You are now the owner of this project!")
elif "reject_transfer" in request.POST:
tr = project.transfer_request()
if not tr or tr.user != request.user:
return HttpResponseForbidden()
tr.transfer_request_date = None
tr.save()
return render(request, "accounts/project.html", ctx)
@login_required
def notifications(request):
2017-08-30 19:42:45 +00:00
profile = request.profile
2019-05-15 11:27:50 +00:00
ctx = {"status": "default", "page": "profile", "profile": profile}
if request.method == "POST":
form = forms.ReportSettingsForm(request.POST)
if form.is_valid():
if profile.reports_allowed != form.cleaned_data["reports_allowed"]:
profile.reports_allowed = form.cleaned_data["reports_allowed"]
if profile.reports_allowed:
profile.next_report_date = choose_next_report_date()
else:
profile.next_report_date = None
if profile.nag_period != form.cleaned_data["nag_period"]:
# Set the new nag period
profile.nag_period = form.cleaned_data["nag_period"]
# and schedule next_nag_date:
if profile.nag_period:
profile.next_nag_date = now() + profile.nag_period
else:
profile.next_nag_date = None
profile.save()
ctx["status"] = "info"
return render(request, "accounts/notifications.html", ctx)
@login_required
def set_password(request, token):
2017-08-30 19:42:45 +00:00
if not request.profile.check_token(token, "set-password"):
return HttpResponseBadRequest()
if request.method == "POST":
form = forms.SetPasswordForm(request.POST)
if form.is_valid():
password = form.cleaned_data["password"]
request.user.set_password(password)
request.user.save()
2017-08-30 19:42:45 +00:00
request.profile.token = ""
request.profile.save()
# Setting a password logs the user out, so here we
# log them back in.
u = authenticate(username=request.user.email, password=password)
auth_login(request, u)
2016-07-07 21:05:05 +00:00
messages.success(request, "Your password has been set!")
return redirect("hc-profile")
2016-02-16 21:41:40 +00:00
return render(request, "accounts/set_password.html", {})
@login_required
def change_email(request, token):
2017-08-30 19:42:45 +00:00
if not request.profile.check_token(token, "change-email"):
return HttpResponseBadRequest()
if request.method == "POST":
form = forms.ChangeEmailForm(request.POST)
if form.is_valid():
request.user.email = form.cleaned_data["email"]
request.user.set_unusable_password()
request.user.save()
2017-08-30 19:42:45 +00:00
request.profile.token = ""
request.profile.save()
return redirect("hc-change-email-done")
else:
form = forms.ChangeEmailForm()
return render(request, "accounts/change_email.html", {"form": form})
def change_email_done(request):
return render(request, "accounts/change_email_done.html")
@csrf_exempt
def unsubscribe_reports(request, signed_username):
# Some email servers open links in emails to check for malicious content.
# To work around this, for GET requests we serve a confirmation form.
# If the signature is more than 5 minutes old, we also include JS code to
# auto-submit the form.
ctx = {}
signer = signing.TimestampSigner(salt="reports")
# First, check the signature without looking at the timestamp:
try:
username = signer.unsign(signed_username)
except signing.BadSignature:
return render(request, "bad_link.html")
# Check if timestamp is older than 5 minutes:
try:
username = signer.unsign(signed_username, max_age=300)
except signing.SignatureExpired:
ctx["autosubmit"] = True
if request.method != "POST":
return render(request, "accounts/unsubscribe_submit.html", ctx)
user = User.objects.get(username=username)
2017-08-30 19:42:45 +00:00
profile = Profile.objects.for_user(user)
profile.reports_allowed = False
profile.next_report_date = None
profile.nag_period = td()
profile.next_nag_date = None
2017-08-30 19:42:45 +00:00
profile.save()
return render(request, "accounts/unsubscribed.html")
2016-05-09 12:35:13 +00:00
@require_POST
@login_required
def close(request):
user = request.user
# Cancel their subscription:
sub = Subscription.objects.filter(user=user).first()
if sub:
sub.cancel()
user.delete()
# Deleting user also deletes its profile, checks, channels etc.
request.session.flush()
return redirect("hc-index")
@require_POST
@login_required
def remove_project(request, code):
project = get_object_or_404(Project, code=code, owner=request.user)
project.delete()
return redirect("hc-index")