1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
from datetime import datetime
from datetime import timedelta
from flask import current_app
from flask import render_template
from flask import request
from flask import session
import flask
import json
import logging
import uuid
from rz_mail import send_email_message
from rz_req_handling import make_json_response, make_response__ajax__html
log = logging.getLogger('rhizi')
class User_Signup_Request(dict):
def __init__(self, rz_username,
email_address,
last_name,
first_name):
self['rz_username'] = rz_username
self['email_address'] = email_address
self['last_name'] = last_name
self['first_name'] = first_name
self['submission_date'] = None
self['validation_key'] = None
def __str__(self):
return 'email_address: %s' % (self['email_address'])
def has_expired(self):
date_now = datetime.now()
dt_6h = timedelta(hours=6)
dt = self['submission_date'] - date_now
return dt > dt_6h
def filter_expired_requests(us_req_map):
for su_req_email, su_req in us_req_map.items():
if su_req.has_expired():
log.info('user sign-up request expired: %s' % (su_req))
del us_req_map[su_req_email]
def get_or_init_usreq_map():
"""
lazy user signup request map getter
"""
if not hasattr(current_app, 'usreq_email_to_req_map'):
setattr(current_app, 'usreq_email_to_req_map', {})
us_req_map = current_app.usreq_email_to_req_map
return us_req_map
def activate_user_account(us_req):
user_db = current_app.user_db
existing_account = None
try:
existing_account = user_db.lookup_user__by_email_address(us_req['email_address'])
except Exception as _:
pass # thrown if user was not found
if None != existing_account:
raise Exception('account activation code reused: existing-account: %s' % (existing_account))
user_db.user_add(first_name=us_req['first_name'],
last_name=us_req['last_name'],
rz_username=us_req['rz_username'],
email_address=us_req['email_address'])
# FIXME: process pw
log.info('user account activated: email: %s, rz_username: %s' % (us_req['email_address'], us_req['rz_username']))
def rest__user_signup():
"""
REST API user sign up endpoint
"""
def add_user_signup_req(us_req_map, us_req):
key = us_req['email_address']
us_req_map[key] = us_req # finally, add request
def rm_user_signup_req(us_req_map, us_req):
key = us_req['email_address']
del us_req_map[key]
def sanitize_input(req):
req_json = request.get_json()
first_name = req_json['first_name']
last_name = req_json['last_name']
rz_username = req_json['rhizi_username']
email_address = req_json['email_address']
ret = User_Signup_Request(rz_username=rz_username,
email_address=email_address,
last_name=last_name,
first_name=first_name)
# TODO: augment
for k, v in ret.items():
if k in ['submission_date', 'validation_key']:
continue
if len(v) > 32:
raise Exception('malformed signup request: len(%s) > 32' % (k))
if len(v) < 3:
raise Exception('malformed signup request: len(%s) < 4' % (k))
return ret
def generate_email_confirmation_key():
"""
generate a random UUID based string ID
"""
return str(uuid.uuid4()).replace('-', '')
html_ok__submitted = '<p>Your request has been successfully submitted.<br>Please check your email to activate your account.</p>'
html_ok__already_pending = '<p>Your request has already been submitted.<br>please check your email to activate your account.</p>'
html_err__tech_difficulty = '<p>We are experiencing technical difficulty processing your request,<br>please try again later.</p>'
html_err__activation_failure = '<p>Activation failure,<br>please try again later.</p>'
# use incoming request as house keeping trigger
us_req_map = get_or_init_usreq_map()
filter_expired_requests(us_req_map)
if request.method == 'POST':
# FIXME: add captcha
# if req_json['captcha_solution'] = ...
try:
us_req = sanitize_input(request)
except Exception as e:
log.exception(e)
return make_response__ajax__html(status=400, html_str=html_err__tech_difficulty)
# FIXME: implement form validation
existing_req = us_req_map.get(us_req['email_address'])
if None != existing_req:
# already pending
log.warning('user signup: request already pending: %s' % (existing_req))
return make_response__ajax__html(status=200, html_str=html_ok__already_pending)
us_req['submission_date'] = datetime.now()
us_req['validation_key'] = generate_email_confirmation_key()
# send activation email
try:
send_user_activation_link__email(us_req)
add_user_signup_req(us_req_map, us_req)
return make_response__ajax__html(html_str=html_ok__submitted)
except Exception as e:
log.exception('user sign-up: failed to send validation email', e)
return make_response__ajax__html(status=500, html_str=html_err__tech_difficulty)
if request.method == 'GET':
v_tok = request.args.get('v_tok')
if None != v_tok: # validation token passed
for _, us_req in us_req_map.items():
other_req_v_tok = us_req['validation_key']
if None == other_req_v_tok:
continue
if other_req_v_tok == v_tok:
if us_req.has_expired(): # check again whether request has expired
return render_template('user_signup.html', state='activation_failure', html_str__err=html_err__activation_failure)
try:
activate_user_account(us_req)
except Exception as e:
return render_template('user_signup.html', state='activation_failure', html_str__err=html_err__activation_failure)
# activation success
rm_user_signup_req(us_req_map, us_req)
return render_template('user_signup.html', state='activation_success')
# request expired & already removed OR bad token
log.warning('user sign-up: request not found or bad token: remote-address: %s' % (request.remote_addr))
return render_template('user_signup.html', state='activation_failure', html_str__err=html_err__activation_failure)
else: # no validation token: new user
return render_template('user_signup.html')
def send_user_activation_link__email(us_req):
"""
Send user feedback by email along with screen capture attachments
"""
# FIXME: use HTTPS
confirmation_link = 'http://%s/signup?v_tok=%s' % (current_app.rz_config.SERVER_NAME,
us_req['validation_key'])
msg_body = ['Hello %s %s,' % (us_req['first_name'],
us_req['last_name']),
'',
'Thank you for your joining the Rhizi community!',
'',
'Below is a sign up confirmation link - open it in your browser to activate your account:',
'',
confirmation_link,
'',
'Happy knowledge editing!',
'The Rhizi team.'
]
msg_body = '\n'.join(msg_body)
try:
send_email_message(recipients=[us_req['email_address']],
subject="Rhizi sign up request",
body=msg_body)
return json.dumps({}) # expects json encoded, contents discarded
except Exception:
log.exception('send_user_feedback__email: exception while sending email')
return make_json_response(status=500)
|
