source: main/waeup.sirp/trunk/src/waeup/sirp/applicants/authentication.py @ 5903

##
## authentication.py
## Login : <uli@pu.smp.net>
## Started on  Tue Jul 27 14:26:35 2010 Uli Fouquet
## $Id$
## 
## Copyright (C) 2010 Uli Fouquet
## This program is free software; you can redistribute it and/or modify
## it under the terms of the GNU General Public License as published by
## the Free Software Foundation; either version 2 of the License, or
## (at your option) any later version.
## 
## This program is distributed in the hope that it will be useful,
## but WITHOUT ANY WARRANTY; without even the implied warranty of
## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
## GNU General Public License for more details.
## 
## You should have received a copy of the GNU General Public License
## along with this program; if not, write to the Free Software
## Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
##
"""Special authentication for applicants.

   XXX: This is work in progress, experimental code! Don't do that at home!
"""
import grok
from zope.event import notify
from zope.pluggableauth.factories import Principal
from zope.pluggableauth.interfaces import (
    ICredentialsPlugin, IAuthenticatorPlugin,
    IAuthenticatedPrincipalFactory, AuthenticatedPrincipalCreated)
from zope.pluggableauth.plugins.session import SessionCredentialsPlugin
from zope.publisher.interfaces import IRequest
from zope.publisher.interfaces.http import IHTTPRequest
from zope.session.interfaces import ISession
from waeup.sirp.accesscodes import get_access_code
from waeup.sirp.applicants.interfaces import (
    IApplicantPrincipalInfo, IApplicantPrincipal, IApplicantSessionCredentials,
    IJAMBApplicantSessionCredentials)
from waeup.sirp.applicants import get_applicant_data
from waeup.sirp.interfaces import IAuthPluginUtility


class PortalUser(grok.Role):
    """A role for applicants.
    """
    grok.name('waeup.Applicant')
    grok.permissions('waeup.Public')

class ApplicantPrincipalInfo(object):
    """Infos about an applicant principal.
    """
    grok.implements(IApplicantPrincipalInfo)

    def __init__(self, access_code):
        self.id = principal_id(access_code)
        self.title = u'Applicant'
        self.description = u'An Applicant'
        self.credentialsPlugin = None
        self.authenticatorPlugin = None
        self.access_code = access_code

class ApplicantPrincipal(Principal):
    """An applicant principal.

    Applicant principals provide an extra `access_code` and `reg_no`
    attribute extending ordinary principals.
    """

    grok.implements(IApplicantPrincipal)

    def __init__(self, access_code, prefix=None):
        self.id = principal_id(access_code)
        if prefix is not None:
            self.id = '%s.%s' % (prefix, self.id)
        self.title = u'Applicant'
        self.description = u'An applicant'
        self.groups = []
        self.access_code = access_code

    def __repr__(self):
        return 'ApplicantPrincipal(%r)' % self.id

class AuthenticatedApplicantPrincipalFactory(grok.MultiAdapter):
    """Creates 'authenticated' applicant principals.

    Adapts (principal info, request) to an ApplicantPrincipal instance.

    This adapter is used by the standard PAU to transform
    PrincipalInfos into Principal instances.
    """
    grok.adapts(IApplicantPrincipalInfo, IRequest)
    grok.implements(IAuthenticatedPrincipalFactory)

    def __init__(self, info, request):
        self.info = info
        self.request = request

    def __call__(self, authentication):
        principal = ApplicantPrincipal(
            self.info.access_code,
            authentication.prefix,
            )
        notify(
            AuthenticatedPrincipalCreated(
                authentication, principal, self.info, self.request))
        return principal


#
# Credentials plugins and related....
#

class ApplicantCredentials(object):
    """Credentials class for ordinary applicants.
    """
    grok.implements(IApplicantSessionCredentials)

    def __init__(self, access_code):
        self.access_code = access_code

    def getAccessCode(self):
        """Get the access code.
        """
        return self.access_code

    def getLogin(self):
        """Stay compatible with non-applicant authenticators.
        """
        return None

    def getPassword(self):
        """Stay compatible with non-applicant authenticators.
        """
        return None
    
class JAMBApplicantCredentials(ApplicantCredentials):
    """Credentials class for JAMB-screened applicants.
    """
    grok.implements(IJAMBApplicantSessionCredentials)

    def __init__(self, access_code):
        self.access_code = access_code

class WAeUPApplicantCredentialsPlugin(grok.GlobalUtility,
                                      SessionCredentialsPlugin):
    """A credentials plugin that scans requests for applicant credentials.
    """
    grok.provides(ICredentialsPlugin)
    grok.name('applicant_credentials')

    loginpagename = 'login'
    accesscode_prefix_field = 'form.prefix'
    accesscode_series_field = 'form.ac_series'
    accesscode_number_field = 'form.ac_number'

    def extractCredentials(self, request):
        """Extracts credentials from a session if they exist.
        """
        if not IHTTPRequest.providedBy(request):
            return None
        session = ISession(request)
        sessionData = session.get(
            'zope.pluggableauth.browserplugins')
        access_code_prefix = request.get(self.accesscode_prefix_field, None)
        access_code_series = request.get(self.accesscode_series_field, None)
        access_code_no = request.get(self.accesscode_number_field, None)
        access_code = '%s-%s-%s' % (
            access_code_prefix, access_code_series, access_code_no)
        if None in [access_code_prefix, access_code_series, access_code_no]:
            access_code = None
        credentials = None

        if access_code:
            credentials = ApplicantCredentials(access_code)
        elif not sessionData:
            return None
        sessionData = session[
            'zope.pluggableauth.browserplugins']
        if credentials:
            sessionData['credentials'] = credentials
        else:
            credentials = sessionData.get('credentials', None)
        if not credentials:
            return None
        if not IApplicantSessionCredentials.providedBy(credentials):
            # If credentials were stored in session from another
            # credentials plugin then we cannot make assumptions about
            # its structure.
            return None

        # Entered credentials are ordinary applicant credentials,
        # not JAMB-screened applicant credentials
        return {'accesscode': credentials.getAccessCode()}



class ApplicantsAuthenticatorPlugin(grok.GlobalUtility):
    """Authenticate applicants.

    XXX: This plugin currently accepts any input and authenticates the
    user as applicant.
    """
    grok.provides(IAuthenticatorPlugin)
    grok.name('applicants')

    def authenticateCredentials(self, credentials):
        if not isinstance(credentials, dict):
            return None
        accesscode = credentials.get('accesscode', None)
        if accesscode is None:
            return None
        applicant_data = get_applicant_data(accesscode)
        ac = get_access_code(accesscode) # Get the real access code object
        appl_ac = getattr(applicant_data, 'access_code', None)
        if ac is None:
            return None
        if ac.invalidation_date is not None and appl_ac != ac.representation:
            return None
        if appl_ac is not None and appl_ac != ac.representation:
            return None
        return ApplicantPrincipalInfo(accesscode)

    def principalInfo(self, id):
        """Returns an IPrincipalInfo object for the specified principal id.

        This method is used by the stadard PAU to lookup for instance
        groups. If a principal belongs to a group, the group is looked
        up by the id.  Currently we always return ``None``,
        indicating, that the principal could not be found. This also
        means, that is has no effect if applicant users belong to a
        certain group. They can not gain extra-permissions this way.
        """
        return None

class ApplicantsAuthUtility(grok.GlobalUtility):
    """A global utility that sets up any PAU passed.
    """
    grok.provides(IAuthPluginUtility)
    grok.name('applicants_auth_setup')

    def register(self, pau):
        """Register our local applicants specific PAU components.

        Applicants provider their own authentication system resulting
        in a specialized credentials plugin and a specialized
        authenticator plugin.

        Here we tell a given PAU that these plugins exist and should
        be consulted when trying to authenticate a user.

        We stack our local plugins on top of the list, so that other
        authentication mechanisms (the normal user authentication for
        instance) have precedence and to avoid "account-shadowing".
        """
        # The local credentials plugin is registered under the name
        # 'applicant_credentials' (see above).
        pau.credentialsPlugins.append('applicant_credentials')
        # The local authenticator plugin is registered under the name
        # 'applicants' (subject to change?)
        pau.authenticatorPlugins.append('applicants')
        return pau

    def unregister(self, pau):
        return pau
    
    
def principal_id(access_code):
    """Get a principal ID for applicants.

    We need unique principal ids for appliants. As access codes must
    be unique we simply return them.
    """
    return access_code