284 lines
9.7 KiB
Python
284 lines
9.7 KiB
Python
from __future__ import annotations
|
||
|
||
from django.contrib.auth import get_user_model
|
||
from django.contrib.auth.password_validation import validate_password
|
||
from rest_framework import serializers
|
||
from rest_framework.exceptions import AuthenticationFailed
|
||
from rest_framework_simplejwt.serializers import (
|
||
TokenObtainPairSerializer,
|
||
TokenRefreshSerializer,
|
||
)
|
||
|
||
from .models import UserAuthSession
|
||
from .services import (
|
||
SESSION_ID_CLAIM,
|
||
create_token_pair_for_session,
|
||
validate_refresh_session,
|
||
)
|
||
|
||
User = get_user_model()
|
||
|
||
|
||
class TokenPairResponseSerializer(serializers.Serializer):
|
||
refresh = serializers.CharField(read_only=True)
|
||
access = serializers.CharField(read_only=True)
|
||
|
||
|
||
class QrLoginCreateResponseSerializer(serializers.Serializer):
|
||
token = serializers.CharField(read_only=True)
|
||
expires_at = serializers.DateTimeField(read_only=True)
|
||
|
||
|
||
class QrLoginExchangeRequestSerializer(serializers.Serializer):
|
||
token = serializers.CharField(write_only=True, trim_whitespace=True)
|
||
|
||
|
||
class QrLoginRequestCreateResponseSerializer(serializers.Serializer):
|
||
scan_token = serializers.CharField(read_only=True)
|
||
client_secret = serializers.CharField(read_only=True)
|
||
expires_at = serializers.DateTimeField(read_only=True)
|
||
device_name = serializers.CharField(read_only=True)
|
||
ip_address = serializers.IPAddressField(read_only=True, allow_null=True)
|
||
|
||
|
||
class QrLoginRequestStatusRequestSerializer(serializers.Serializer):
|
||
client_secret = serializers.CharField(write_only=True, trim_whitespace=True)
|
||
|
||
|
||
class QrLoginRequestStatusResponseSerializer(serializers.Serializer):
|
||
status = serializers.CharField(read_only=True)
|
||
refresh = serializers.CharField(read_only=True, required=False)
|
||
access = serializers.CharField(read_only=True, required=False)
|
||
|
||
|
||
class QrLoginRequestDetailResponseSerializer(serializers.Serializer):
|
||
status = serializers.CharField(read_only=True)
|
||
device_name = serializers.CharField(read_only=True)
|
||
ip_address = serializers.IPAddressField(read_only=True, allow_null=True)
|
||
created_at = serializers.DateTimeField(read_only=True)
|
||
expires_at = serializers.DateTimeField(read_only=True)
|
||
|
||
|
||
class QrLoginRequestActionResponseSerializer(serializers.Serializer):
|
||
status = serializers.CharField(read_only=True)
|
||
|
||
|
||
class TokenRefreshRequestSerializer(serializers.Serializer):
|
||
refresh = serializers.CharField(
|
||
help_text="Refresh token, полученный при логине."
|
||
)
|
||
|
||
|
||
class TokenRefreshResponseSerializer(serializers.Serializer):
|
||
access = serializers.CharField(read_only=True)
|
||
|
||
|
||
class SessionSerializer(serializers.ModelSerializer):
|
||
session_id = serializers.UUIDField(read_only=True)
|
||
is_current = serializers.SerializerMethodField()
|
||
|
||
class Meta:
|
||
model = UserAuthSession
|
||
fields = (
|
||
"session_id",
|
||
"is_current",
|
||
"device_name",
|
||
"ip_address",
|
||
"created_at",
|
||
"last_seen_at",
|
||
"revoked_at",
|
||
)
|
||
|
||
def get_is_current(self, obj: UserAuthSession) -> bool:
|
||
current_session_id = self.context.get("current_session_id")
|
||
return str(obj.session_id) == str(current_session_id)
|
||
|
||
|
||
class SessionBulkActionResponseSerializer(serializers.Serializer):
|
||
revoked = serializers.IntegerField(read_only=True)
|
||
|
||
|
||
class BrowserSessionRequestSerializer(serializers.Serializer):
|
||
next = serializers.CharField(
|
||
required=False,
|
||
allow_blank=True,
|
||
trim_whitespace=True,
|
||
max_length=4096,
|
||
)
|
||
|
||
|
||
class BrowserSessionResponseSerializer(serializers.Serializer):
|
||
redirect_url = serializers.CharField(read_only=True)
|
||
|
||
|
||
class ChangePasswordRequestSerializer(serializers.Serializer):
|
||
current_password = serializers.CharField(
|
||
write_only=True,
|
||
trim_whitespace=False,
|
||
style={"input_type": "password"},
|
||
)
|
||
new_password = serializers.CharField(
|
||
write_only=True,
|
||
min_length=8,
|
||
trim_whitespace=False,
|
||
style={"input_type": "password"},
|
||
)
|
||
new_password_confirm = serializers.CharField(
|
||
write_only=True,
|
||
trim_whitespace=False,
|
||
style={"input_type": "password"},
|
||
)
|
||
|
||
def validate(self, attrs):
|
||
if attrs["new_password"] != attrs["new_password_confirm"]:
|
||
raise serializers.ValidationError(
|
||
{"new_password_confirm": "Подтверждение пароля не совпадает."}
|
||
)
|
||
if attrs["current_password"] == attrs["new_password"]:
|
||
raise serializers.ValidationError(
|
||
{"new_password": "Новый пароль должен отличаться от текущего."}
|
||
)
|
||
return attrs
|
||
|
||
def validate_new_password(self, value: str) -> str:
|
||
request = self.context.get("request")
|
||
validate_password(value, user=getattr(request, "user", None))
|
||
return value
|
||
|
||
|
||
class ChangePasswordResponseSerializer(serializers.Serializer):
|
||
ok = serializers.BooleanField(read_only=True)
|
||
|
||
|
||
class PasswordResetRequestSerializer(serializers.Serializer):
|
||
login = serializers.CharField(
|
||
write_only=True,
|
||
allow_blank=False,
|
||
trim_whitespace=True,
|
||
help_text="Email или телефон пользователя.",
|
||
)
|
||
|
||
|
||
class PasswordResetRequestResponseSerializer(serializers.Serializer):
|
||
ok = serializers.BooleanField(read_only=True)
|
||
|
||
|
||
class PasswordResetConfirmRequestSerializer(serializers.Serializer):
|
||
uid = serializers.CharField(write_only=True)
|
||
token = serializers.CharField(write_only=True)
|
||
new_password = serializers.CharField(
|
||
write_only=True,
|
||
min_length=8,
|
||
trim_whitespace=False,
|
||
style={"input_type": "password"},
|
||
)
|
||
new_password_confirm = serializers.CharField(
|
||
write_only=True,
|
||
trim_whitespace=False,
|
||
style={"input_type": "password"},
|
||
)
|
||
|
||
def validate(self, attrs):
|
||
if attrs["new_password"] != attrs["new_password_confirm"]:
|
||
raise serializers.ValidationError(
|
||
{"new_password_confirm": "Подтверждение пароля не совпадает."}
|
||
)
|
||
return attrs
|
||
|
||
def validate_new_password(self, value: str) -> str:
|
||
validate_password(value)
|
||
return value
|
||
|
||
|
||
class PasswordResetConfirmResponseSerializer(serializers.Serializer):
|
||
ok = serializers.BooleanField(read_only=True)
|
||
|
||
|
||
class PhoneOrEmailTokenObtainPairSerializer(TokenObtainPairSerializer):
|
||
"""
|
||
Принимает единый login (LDAP username, email или телефон) + password.
|
||
Старые поля email/phone/phone_number остаются совместимыми.
|
||
"""
|
||
|
||
def __init__(self, *args, **kwargs):
|
||
super().__init__(*args, **kwargs)
|
||
# <- КЛЮЧЕВОЕ: email (username_field) не обязателен
|
||
self.fields[self.username_field].required = False
|
||
self.fields[self.username_field].help_text = (
|
||
"Email пользователя (поле сохранено для обратной совместимости)."
|
||
)
|
||
self.fields["login"] = serializers.CharField(
|
||
required=False,
|
||
allow_blank=True,
|
||
trim_whitespace=True,
|
||
help_text="LDAP-логин, email или номер телефона пользователя.",
|
||
)
|
||
self.fields["phone"] = serializers.CharField(
|
||
required=False,
|
||
allow_blank=True,
|
||
help_text="Номер телефона пользователя в произвольном формате.",
|
||
)
|
||
self.fields["phone_number"] = serializers.CharField(
|
||
required=False,
|
||
allow_blank=True,
|
||
help_text="Альтернативное имя поля для номера телефона.",
|
||
)
|
||
|
||
def validate(self, attrs):
|
||
identifier = (
|
||
attrs.get(self.username_field)
|
||
or self.initial_data.get("login")
|
||
or self.initial_data.get("phone")
|
||
or self.initial_data.get("phone_number")
|
||
)
|
||
identifier = str(identifier or "").strip()
|
||
if not identifier:
|
||
raise AuthenticationFailed(
|
||
"Login, email or phone number required",
|
||
code="no_credentials",
|
||
)
|
||
|
||
# SimpleJWT передаёт в django.authenticate() USERNAME_FIELD модели.
|
||
# LDAP3Backend интерпретирует это значение как uid/email/телефон, а
|
||
# локальный backend — как email/телефон.
|
||
attrs[self.username_field] = identifier
|
||
|
||
super().validate(attrs)
|
||
|
||
# не выдаём токены, если email не подтверждён/аккаунт не активен
|
||
if not self.user.email_verified or not self.user.is_active:
|
||
raise AuthenticationFailed(
|
||
"email_not_verified",
|
||
code="email_not_verified",
|
||
)
|
||
|
||
request = self.context.get("request")
|
||
if request is None:
|
||
raise AuthenticationFailed("request_context_missing")
|
||
|
||
refresh, access, _session = create_token_pair_for_session(
|
||
user=self.user,
|
||
request=request,
|
||
)
|
||
|
||
return {
|
||
"refresh": refresh,
|
||
"access": access,
|
||
}
|
||
|
||
|
||
class SessionTokenRefreshSerializer(TokenRefreshSerializer):
|
||
def validate(self, attrs):
|
||
raw_refresh = attrs["refresh"]
|
||
refresh = self.token_class(raw_refresh)
|
||
session = validate_refresh_session(
|
||
refresh,
|
||
raw_refresh=raw_refresh,
|
||
request=self.context.get("request"),
|
||
)
|
||
|
||
access = refresh.access_token
|
||
access[SESSION_ID_CLAIM] = str(session.session_id)
|
||
|
||
return {"access": str(access)}
|