50 lines
2.5 KiB
Python
50 lines
2.5 KiB
Python
from datetime import datetime, timezone as datetime_timezone
|
|
|
|
from django.utils import timezone
|
|
from django.db import transaction
|
|
from rest_framework.exceptions import AuthenticationFailed
|
|
from rest_framework_simplejwt.tokens import RefreshToken
|
|
|
|
from apps.jwt_auth.models import JwtToken
|
|
|
|
|
|
def validate_role_access(role):
|
|
if not (role.cuser and role.cuser.is_active and role.is_active and role.mobile_verify):
|
|
raise AuthenticationFailed('حساب کاربری یا نقش شما غیرفعال است. دوباره وارد شوید.', code='session_invalid')
|
|
workspace = role.sys_ws
|
|
if not workspace or not workspace.is_active or (workspace.expire and workspace.expire <= timezone.now()):
|
|
raise AuthenticationFailed('دسترسی فضای کاری غیرفعال یا منقضی شده است.', code='session_invalid')
|
|
if role.role_type.role_name_en == 'workspace_customer' and role.customer_panel is not True:
|
|
raise AuthenticationFailed('دسترسی شما به پنل مشتریان فعال نیست.', code='session_invalid')
|
|
|
|
|
|
@transaction.atomic
|
|
def issue_tokens(role, session=None):
|
|
validate_role_access(role)
|
|
if session is None:
|
|
session = JwtToken.objects.create(cuser=role.cuser, cuser_role=role, refresh='')
|
|
refresh = RefreshToken.for_user(role.cuser)
|
|
refresh['workspace_uuid'] = str(role.sys_ws.uuid)
|
|
refresh['cuser_role_uuid'] = str(role.uuid)
|
|
refresh['user_uuid'] = str(role.cuser.uuid)
|
|
refresh['session_id'] = session.pk
|
|
data = {'refresh': str(refresh), 'access': str(refresh.access_token)}
|
|
session.refresh = data['refresh']
|
|
session.access = data['access']
|
|
session.expire = datetime.fromtimestamp(refresh['exp'], tz=datetime_timezone.utc)
|
|
session.save()
|
|
return data
|
|
|
|
|
|
def validate_session_claims(session, token):
|
|
if session.expire and session.expire <= timezone.now():
|
|
raise AuthenticationFailed('نشست شما منقضی شده است. دوباره وارد شوید.', code='session_invalid')
|
|
role = session.cuser_role
|
|
validate_role_access(role)
|
|
expected = {'user_id': session.cuser_id, 'user_uuid': str(role.cuser.uuid),
|
|
'cuser_role_uuid': str(role.uuid), 'workspace_uuid': str(role.sys_ws.uuid)}
|
|
if token.get('session_id') is not None:
|
|
expected['session_id'] = session.pk
|
|
if role.cuser_id != session.cuser_id or any(token.get(key) != value for key, value in expected.items()):
|
|
raise AuthenticationFailed('نشست شما معتبر نیست. دوباره وارد شوید.', code='session_invalid')
|