
    Ii+                        d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZmZ d dlmZ d dlmZmZmZ d d	lmZmZmZmZmZmZmZmZ d d
lmZm Z m!Z!m"Z" e jF                  jI                  d      Z%e jF                  jI                  d      Z&de jF                  jI                  d       Z'dZ(g dZ) e*de%        e*de&rdnd        e*de'        e*de(        e*de)        ede+      Z,d+dZ-e,j]                  dddg       ej^                  d      ed                      Z0e,j]                  d       eed!                      Z1e,j]                  d"dg       e!d#$      ed%                      Z2e,j]                  d&      d'        Z3e,j]                  e(      d(        Z4e,j]                  d)      d*        Z5y),    N)db)limiter)User)validate_user_login_data)audit_routeaudit_auth_attempt)send_discord_audit_log)
login_userlogout_userlogin_required)	Blueprintrender_templaterequestredirecturl_forflashjsonifysession)create_access_tokencreate_refresh_tokenjwt_requiredget_jwt_identitySHAREPOINT_CLIENT_IDSHAREPOINT_CLIENT_SECRETz"https://login.microsoftonline.com/SHAREPOINT_TENANT_IDz
/getAToken)z	User.Readz
Files.ReadzSites.Read.Allz
CLIENT_ID:zCLIENT_SECRET:SETzNOT SETz
AUTHORITY:zREDIRECT_PATH:zSCOPE:authc                 L    t        j                  t        t        t        |       S )N)	authorityclient_credentialtoken_cache)msalConfidentialClientApplication	CLIENT_ID	AUTHORITYCLIENT_SECRET)caches    ./srv/www/ollama/chat-ollama/src/routes/auth.py_build_msal_appr)      s    --Y'U< <    z/loginGETPOST)methodsz5 per minutec                     t         j                  dk(  r0	 t        t         j                        } t	        | t
              st        |       } | j                  dd      j                         j                         }| j                  dd      }t        j                  j                  |      j                         }|rddlm} d| } |j                  |d      }|j                  |      rd||<   nW|d	z   ||<   ||   d
k\  rGt!        d|j"                  d|j"                  d| dt         j$                   t         j$                         |r|j                  |      rt'        |dd      }|r[|t         j$                  k7  rHt!        d|j"                  d|j"                  dt         j$                   d| dt         j$                         t         j$                  |_        t*        j                  j-                          t/        d|j"                   d|        t1        |       t/        d|j2                          t5        |d       ddlm} t/        d|j"                   d|         |d|j:                  |j"                  d|        t/        d|j"                   d|        t         j<                  r>t?        |j"                        }	tA        |j"                        }
tC        d ||	|
d!d"      S tE        tG        d#            S t5        |d$       t         j<                  rtC        d%d&d'      d(fS tI        d&       tO        d+      S tO        d+      S # tJ        $ r}t5        t         j                  j                  dd      d$       t         j<                  rtC        d)tM        |      d'      d*fcY d}~S tI        tM        |             Y d}~tO        d+      S d}~ww xY w),u	  
    Endpoint de login.
    ---
    tags:
      - auth
    summary: Autentica um usuário
    description: Permite que um usuário faça login no sistema
    parameters:
      - name: email
        in: formData
        type: string
        required: true
        description: E-mail do usuário
      - name: password
        in: formData
        type: string
        required: true
        description: Senha do usuário
    responses:
      200:
        description: Login bem-sucedido
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Success'
      401:
        description: Credenciais inválidas
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Error'
    r,   email passwordr/   r   )r   fail_count_      zLogin suspeitou   Usuáriou    Múltiplas falhas de login para z do IP )actionuser_idobject_type	object_iddetails
ip_addresslast_login_ipNzLogin de IP incomum: u    (último: )z.[DEBUG] login_user will be called for user_id=, email=z1[DEBUG] login_user called, user is_authenticated=T	log_auditz4[DEBUG] log_audit will be called for login: user_id=LoginzLogin bem-sucedido para r6   r8   r9   r:   z,[DEBUG] log_audit called for login: user_id=identityzLogin successful)r/   access_tokenrefresh_token)messagedatachat.chat_redirectFzInvalid credentialsu   E-mail ou senha inválidos)errorrG   i  zValidation errori  zauth/login.html)(r   methodr   form
isinstancedictgetstriplowerr   query	filter_byfirstflaskr   check_passwordr	   idremote_addrgetattrr<   r   commitprintr
   is_authenticatedr   src.security.auditr@   usernameis_jsonr   r   r   r   r   r   	Exceptionstrr   )rH   r/   r1   userr   fail_key
fail_countlast_ipr@   rE   rF   es               r(   loginrg   #   sa   H ~~F	+GLL9DdD)DzHHWb)//1779Exx
B/H::''e'4::<D)(0(W[[15
&&x0()GH%(2QGH%x(A-.#3$(GG(2&*gg&FugWU\UhUhTi$j'.':': ++H5!$>w'*=*==*/ $$."&''"78K8K7LKX_W``a b#*#6#6 &-%8%8"

!!#FtwwixX]W^_`4 I$J_J_I`ab"5$/8LTWWIU]^c]def" $"gg6ug>	 DTWWIXV[U\]^??#6#HL$8$''$JM"#5%*,8-:!$    (< =>>ue,)>Kghiknnn./ ,--?,--  	w||//<eD);AOPRUUU#a&MM,--	s7   KM /M +M /M 	OAO+O1OOz/logoutc                  x    t                t        j                  rt        ddi      S t	        t        d            S )uq  
    Endpoint de logout.
    ---
    tags:
      - auth
    summary: Faz logout do usuário
    description: Encerra a sessão do usuário atual
    security:
      - bearerAuth: []
    responses:
      200:
        description: Logout bem-sucedido
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Success'
    rG   zLogout successful
auth.login)r   r   r_   r   r   r    r*   r(   logoutrk      s1    * M	#6788GL)**r*   z/refreshT)refreshc                  H    t               } t        |       }t        d|i      S )a  
    Endpoint de refresh token.
    ---
    tags:
      - auth
    summary: Atualiza o token de acesso
    description: Gera um novo token de acesso usando o refresh token
    security:
      - bearerAuth: []
    responses:
      200:
        description: Token atualizado com sucesso
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Success'
    rC   rE   )r   r   r   )current_user_idrE   s     r(   rl   rl      s&    * '(O&@LNL122r*   z/login-microsoftc            	      x   	 t        t        j                               t        d<   t        j
                  j                  d      sct        j
                  j                  d      sDt        j                  j                  d      dk(  s"t        j                  j                  d      dk(  rd} nd	} t               j                  t        t        d   t        d
d|       d      }t        d|       t        |      S # t         $ r8}t#        j$                  d       t'        dt        |      d      dfcY d }~S d }~ww xY w)Nstate	localhost	127.0.0.1	FLASK_ENVdevelopmentFLASK_DEBUG1httphttpsauth.authorized_microsoftT	_external_schemeselect_account)rp   redirect_uripromptzMSAL Auth URL:z Erro ao iniciar login Microsoft:Erro interno do servidorrJ   r:     )ra   uuiduuid4r   r   host
startswithosenvironrO   r)   get_authorization_request_urlSCOPEr   r[   r   r`   logging	exceptionr   )schemeauth_urlrf   s      r(   login_microsoftr      s5   Vtzz|,<<"";/7<<3J3J;3W[][e[e[i[iju[v  {H  \H  LN  LV  LV  LZ  LZ  [h  Li  mp  LpFF"$BB'" !<V\]#	 C 
 	)!! V<=!;AOPRUUUVs   C5C8 8	D9-D4.D94D9c            	         	 t         j                  j                  d      sct         j                  j                  d      sDt        j                  j                  d      dk(  s"t        j                  j                  d      dk(  rd} nd} t         j                  j                  d	      t        j
                  d	      k7  rt        t        d
            S dt         j                  v r6dt         j                  d    dt         j                  j                  d       S dt         j                  v rdt               j                  t         j                  d   t        t        dd|             }t        d|       d|v r|j                  di       }|j                  d      xs |j                  d      }|j                  d      xs |r|j                  dd      d   nd }|st        d       t        t        d            S t         j"                  j%                  |      j'                         }|sot!        ||       }dd l}|j+                  |j-                  d!             t.        j                  j1                  |       t.        j                  j3                          n6|j4                  |k7  r'|r%||_        t.        j                  j3                          t7        |       dd"lm} t        d#|j<                   d$|         |d%|j4                  |j<                  d&| '       t        d(|j<                   d$|        |t        d)<   |d   t        d<   t        d*       t        t        d+            S t        d,|       d-|j                  d       S y.# t>        $ r8}tA        jB                  d/       tE        d0tG        |      d1      d2fcY d }~S d }~ww xY w)3Nrq   rr   rs   rt   ru   rv   rw   rx   rp   indexrJ   zErro: z - error_descriptioncodery   Trz   )scopesr~   zMSAL Token Result:rE   id_token_claimspreferred_usernamer/   name@r4   r   u8   Não foi possível obter o e-mail do usuário Microsoft.ri   r2   )r^   r/      r?   z>[DEBUG] log_audit will be called for Microsoft login: user_id=r>   rA   z"Login Microsoft bem-sucedido para rB   z6[DEBUG] log_audit called for Microsoft login: user_id=rb   z&Login Microsoft realizado com sucesso!rI   zErro ao obter token:zErro ao obter token: u   Login cancelado ou inválidozErro no callback Microsoft:r   r   r   )$r   r   r   r   r   rO   argsr   r   r   r)   #acquire_token_by_authorization_coder   r[   splitr   r   rR   rS   rT   secretsset_passwordtoken_urlsafer   addrZ   r^   r
   r]   r@   rW   r`   r   r   r   ra   )	r   resultclaimsr/   r^   rb   r   r@   rf   s	            r(   authorized_microsoftr      s]   5V<<"";/7<<3J3J;3W[][e[e[i[iju[v  {H  \H  LN  LV  LV  LZ  LZ  [h  Li  mp  LpFF<<G$G(<<GG,--gll"GLL12#gll6F6FGZ6[5\]]W\\!$&JJV$$%@DZ`a K cF &/'$5r:

#78OFJJw<O!::f-\E%++c12Ea2HW[TU#GL$9::zz++%+8>>@?D"%%g&;&;B&?@JJNN4(JJ%%'}}0X(0

))+4 8VW[W^W^V__ghmgnop" $"gg@H	 NtwwiW_`e_fgh"(*0*@'>?(< =>>,f5.vzz:M/N.OPP- V78!;AOPRUUUVs9   CN AN C#N >E2N 1N 	O-OOOz/logout-microsoftc                  p    t        j                          t        t        dz   dt	        dd       z         S )Nz/oauth2/v2.0/logoutz?post_logout_redirect_uri=ri   T)r{   )r   clearr   r%   r   rj   r*   r(   logout_microsoftr     s9    MMO))
$W\T%J$KL	M r*   )N)6r   r"   r   r   src.extensionsr   src.securityr   src.models.userr   src.security.validatorsr   r]   r   r   src.discord.discord_webhookr	   flask_loginr
   r   r   rU   r   r   r   r   r   r   r   r   flask_jwt_extendedr   r   r   r   r   rO   r$   r&   r%   REDIRECT_PATHr   r[   __name__r   r)   routelimitrg   rk   rl   r   r   r   rj   r*   r(   <module>r      s   	         < > > ? ? a a a h hJJNN12	

9:0@V1W0XY	5 lI  I > lI   & h "<
 Hufo.~i.   /i.V I+   +. J)d3   *3, V  V& M6V 6Vp   !r*   