
    Z)i-                     z   S SK r S SKrS SKrS SKrS SKJr  S SKJr  S SKJ	r	  S SK
Jr  S SKJrJr  S SKJr  S SKJrJrJr  S S	KJrJrJrJrJrJrJrJr  S S
KJrJ r J!r!J"r"  \ RF                  RI                  S5      r%\ RF                  RI                  S5      r&S\ RF                  RI                  S5       3r'Sr(/ SQr)\*" S\%5        \*" S\&(       a  SOS5        \*" S\'5        \*" S\(5        \*" S\)5        \" S\+5      r,S+S jr-\,R]                  SSS/S9\R^                  " S5      \S 5       5       5       r0\,R]                  S 5      \\S! 5       5       5       r1\,R]                  S"S/S9\!" S#S$9\S% 5       5       5       r2\,R]                  S&5      S' 5       r3\,R]                  \(5      S( 5       r4\,R]                  S)5      S* 5       r5g),    N)db)limiter)User)validate_user_login_data)audit_routeaudit_auth_attempt)send_discord_audit_log)
login_userlogout_userlogin_required)	Blueprintrender_templaterequestredirecturl_forflashjsonifysession)create_access_tokencreate_refresh_tokenjwt_requiredget_jwt_identitySHAREPOINT_CLIENT_IDSHAREPOINT_CLIENT_SECRETz"https://login.microsoftonline.com/SHAREPOINT_TENANT_IDz
/getAToken)z	User.Readz
Files.ReadzSites.Read.Allz
CLIENT_ID:zCLIENT_SECRET:SETzNOT SETz
AUTHORITY:zREDIRECT_PATH:zSCOPE:authc                 H    [         R                  " [        [        [        U S9$ )N)	authorityclient_credentialtoken_cache)msalConfidentialClientApplication	CLIENT_ID	AUTHORITYCLIENT_SECRET)caches    PC:\Users\fernando.barreto\Documents\GitLab\ollama\chat-ollama\src\routes\auth.py_build_msal_appr)      s    --Y'U< <    z/loginGETPOST)methodsz5 per minutec                     [         R                  S:X  Ga:   [        [         R                  5      n [	        U [
        5      (       d  [        U 5      n U R                  SS5      R                  5       R                  5       nU R                  SS5      n[        R                  R                  US9R                  5       nU(       a  SSKJn  SU 3nUR                  " US5      nUR                  U5      (       a  SXE'   OSUS	-   XE'   XE   S
:  aD  [!        SUR"                  SUR"                  SU S[         R$                   3[         R$                  S9  U(       Ga  UR                  U5      (       Ga  ['        USS5      nU(       aY  U[         R$                  :w  aE  [!        SUR"                  SUR"                  S[         R$                   SU S3[         R$                  S9  [         R$                  Ul        [*        R                  R-                  5         [/        SUR"                   SU 35        [1        U5        [/        SUR2                   35        [5        US5        SSKJn  [/        SUR"                   SU 35        U" SUR:                  UR"                  SU 3S9  [/        SUR"                   SU 35        [         R<                  (       a8  [?        UR"                  S9n	[A        UR"                  S9n
[C        S UU	U
S!.S".5      $ [E        [G        S#5      5      $ [5        US$5        [         R<                  (       a  [C        S%S&S'.5      S(4$ [I        S&5        [O        S+5      $ ! [J         a{  n[5        [         R                  R                  SS5      S$5        [         R<                  (       a  [C        S)[M        U5      S'.5      S*4s SnA$ [I        [M        U5      5         SnANSnAff = f),u  
Endpoint de login.
---
tags:
  - auth
summary: Autentica um usuário
description: Permite que um usuário faça login no sistema
parameters:
  - name: email
    in: formData
    type: string
    required: true
    description: E-mail do usuário
  - name: password
    in: formData
    type: string
    required: true
    description: Senha do usuário
responses:
  200:
    description: Login bem-sucedido
    content:
      application/json:
        schema:
          $ref: '#/components/schemas/Success'
  401:
    description: Credenciais inválidas
    content:
      application/json:
        schema:
          $ref: '#/components/schemas/Error'
r,   email passwordr/   r   )r   fail_count_      zLogin suspeitou   Usuáriou    Múltiplas falhas de login para z do IP )actionuser_idobject_type	object_iddetails
ip_addresslast_login_ipNzLogin de IP incomum: u    (último: )z.[DEBUG] login_user will be called for user_id=, email=z1[DEBUG] login_user called, user is_authenticated=T	log_auditz4[DEBUG] log_audit will be called for login: user_id=LoginzLogin bem-sucedido para r6   r8   r9   r:   z,[DEBUG] log_audit called for login: user_id=identityzLogin successful)r/   access_tokenrefresh_token)messagedatachat.chat_redirectFzInvalid credentialsu   E-mail ou senha inválidos)errorrG   i  zValidation errori  zauth/login.html)(r   methodr   form
isinstancedictgetstriplowerr   query	filter_byfirstflaskr   check_passwordr	   idremote_addrgetattrr<   r   commitprintr
   is_authenticatedr   src.security.auditr@   usernameis_jsonr   r   r   r   r   r   	Exceptionstrr   )rH   r/   r1   userr   fail_key
fail_countlast_ipr@   rE   rF   es               r(   loginrg   #   sK   H ~~F	+GLL9DdD))DzHHWb)//1779Exx
B/H::''e'4::<D)(0$[[15
&&x00()G%(2QG%(A-.#3$(GG(2&*gg&FugWU\UhUhTi$j'.':': ++H55!$>w'*=*==*/ $$."&''"78K8K7LKX_W``a b#*#6#6 &-%8%8"

!!#FtwwixX]W^_`4 I$J_J_I`ab"5$/8LTWWIU]^c]def" $"gg6ug>	 DTWWIXV[U\]^??#6#HL$8$''$JM"#5%*,8-:!$    (< =>>ue,)>Kghiknnn./ ,--  	w||//<eD);AOPRUUU#a&MM		s7   K(M  M 0M M 
O %AO<O OO z/logoutc                      [        5         [        R                  (       a  [        SS05      $ [	        [        S5      5      $ )u1  
Endpoint de logout.
---
tags:
  - auth
summary: Faz logout do usuário
description: Encerra a sessão do usuário atual
security:
  - bearerAuth: []
responses:
  200:
    description: Logout bem-sucedido
    content:
      application/json:
        schema:
          $ref: '#/components/schemas/Success'
rG   zLogout successful
auth.login)r   r   r_   r   r   r    r*   r(   logoutrk      s1    * M	#6788GL)**r*   z/refreshT)refreshc                  B    [        5       n [        U S9n[        SU05      $ )aU  
Endpoint de refresh token.
---
tags:
  - auth
summary: Atualiza o token de acesso
description: Gera um novo token de acesso usando o refresh token
security:
  - bearerAuth: []
responses:
  200:
    description: Token atualizado com sucesso
    content:
      application/json:
        schema:
          $ref: '#/components/schemas/Success'
rC   rE   )r   r   r   )current_user_idrE   s     r(   rl   rl      s&    * '(O&@LNL122r*   z/login-microsoftc            
          [        [        R                  " 5       5      [        S'   [        R
                  R                  S5      (       dj  [        R
                  R                  S5      (       dF  [        R                  R                  S5      S:X  d#  [        R                  R                  S5      S:X  a  Sn OS	n [        5       R                  [        [        S   [        S
SU S9SS9n[        SU5        [        U5      $ ! [          a9  n["        R$                  " S5        ['        S[        U5      S.5      S4s S nA$ S nAff = f)Nstate	localhost	127.0.0.1	FLASK_ENVdevelopmentFLASK_DEBUG1httphttpsauth.authorized_microsoftT	_external_schemeselect_account)rp   redirect_uripromptzMSAL Auth URL:z Erro ao iniciar login Microsoft:Erro interno do servidorrJ   r:     )ra   uuiduuid4r   r   host
startswithosenvironrO   r)   get_authorization_request_urlSCOPEr   r[   r   r`   logging	exceptionr   )schemeauth_urlrf   s      r(   login_microsoftr      s;   Vtzz|,<<"";//7<<3J3J;3W3W[][e[e[i[iju[v  {H  \H  LN  LV  LV  LZ  LZ  [h  Li  mp  LpFF"$BB'" !<V\]#	 C 
 	)!! V<=!;AOPRUUUVs   C<C? ?
E	.D=7E=Ec            
          [         R                  R                  S5      (       dj  [         R                  R                  S5      (       dF  [        R                  R                  S5      S:X  d#  [        R                  R                  S5      S:X  a  Sn OSn [         R                  R                  S	5      [        R
                  " S	5      :w  a  [        [        S
5      5      $ S[         R                  ;   a6  S[         R                  S    S[         R                  R                  S5       3$ S[         R                  ;   Gat  [        5       R                  [         R                  S   [        [        SSU S9S9n[        SU5        SU;   Ga
  UR                  S0 5      nUR                  S5      =(       d    UR                  S5      nUR                  S5      =(       d    U(       a  UR                  SS5      S   OS nU(       d  [        S5        [        [        S5      5      $ [         R"                  R%                  US9R'                  5       nU(       dk  [!        XCS 9nSS KnUR+                  UR-                  S!5      5        [.        R                  R1                  U5        [.        R                  R3                  5         O;UR4                  U:w  a+  U(       a$  XEl        [.        R                  R3                  5         [7        U5        SS"KJn  [        S#UR<                   S$U 35        U" S%UR4                  UR<                  S&U 3S'9  [        S(UR<                   S$U 35        U[        S)'   US   [        S'   [        S*5        [        [        S+5      5      $ [        S,U5        S-UR                  S5       3$ g.! [>         a9  n[@        RB                  " S/5        [E        S0[G        U5      S1.5      S24s S nA$ S nAff = f)3Nrq   rr   rs   rt   ru   rv   rw   rx   rp   indexrJ   zErro: z - error_descriptioncodery   Trz   )scopesr~   zMSAL Token Result:rE   id_token_claimspreferred_usernamer/   name@r4   r   u8   Não foi possível obter o e-mail do usuário Microsoft.ri   r2   )r^   r/      r?   z>[DEBUG] log_audit will be called for Microsoft login: user_id=r>   rA   z"Login Microsoft bem-sucedido para rB   z6[DEBUG] log_audit called for Microsoft login: user_id=rb   z&Login Microsoft realizado com sucesso!rI   zErro ao obter token:zErro ao obter token: u   Login cancelado ou inválidozErro no callback Microsoft:r   r   r   )$r   r   r   r   r   rO   argsr   r   r   r)   #acquire_token_by_authorization_coder   r[   splitr   r   rR   rS   rT   secretsset_passwordtoken_urlsafer   addrZ   r^   r
   r]   r@   rW   r`   r   r   r   ra   )	r   resultclaimsr/   r^   rb   r   r@   rf   s	            r(   authorized_microsoftr      s_   5V<<"";//7<<3J3J;3W3W[][e[e[i[iju[v  {H  \H  LN  LV  LV  LZ  LZ  [h  Li  mp  LpFF<<G$G(<<GG,--gll"GLL12#gll6F6FGZ6[5\]]W\\!$&JJV$$%@DZ`a K cF &/'$5r:

#78OFJJw<O!::f-\E%++c12Ea2HW[TU#GL$9::zz++%+8>>@?D"%%g&;&;B&?@JJNN4(JJ%%'}}0X(0

))+4 8VW[W^W^V__ghmgnop" $"gg@H	 NtwwiW_`e_fgh"(*0*@'>?(< =>>,f5.vzz:M/N.OPP- V78!;AOPRUUUVs9   CN4  A	N4 *C5N4  E2N4 N4 4
O7>.O2,O72O7z/logout-microsoftc            	      l    [         R                  " 5         [        [        S-   S[	        SSS9 3-   5      $ )Nz/oauth2/v2.0/logoutz?post_logout_redirect_uri=ri   T)r{   )r   clearr   r%   r   rj   r*   r(   logout_microsoftr     s9    MMO))
$W\T%J$KL	M r*   )N)6r   r"   r   r   src.extensionsr   src.securityr   src.models.userr   src.security.validatorsr   r]   r   r   src.discord.discord_webhookr	   flask_loginr
   r   r   rU   r   r   r   r   r   r   r   r   flask_jwt_extendedr   r   r   r   r   rO   r$   r&   r%   REDIRECT_PATHr   r[   __name__r   r)   routelimitrg   rk   rl   r   r   r   rj   r*   r(   <module>r      s   	         < > > ? ? a a a h hJJNN12	

9:0@V1W0XY	5 lI  I > lI   & h "<
 Hufo.~i.   /i.V I+   +. J)d3   *3, V  V& M6V 6Vp   !r*   