Merge lp:~canonical-isd-hackers/canonical-identity-provider/key-registration into lp:canonical-identity-provider/release

[Michael Foord]

[Natalia Bidart (nataliabidart)]

Rejecting since this is pretty old.

=== modified file 'identityprovider/forms.py'
--- identityprovider/forms.py	2010-09-21 22:04:10 +0000
+++ identityprovider/forms.py	2011-05-11 08:50:23 +0000
@@ -9,7 +9,12 @@
 from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext as _
 
-from identityprovider.models import Account, EmailAddress, verify_token_string
+from identityprovider.models import (
+    Account,
+    EmailAddress,
+    YubiKey,
+    verify_token_string,
+)
 from identityprovider.models.const import EmailStatus
 from identityprovider.utils import (
     get_person_and_account_by_email, CannotResetPasswordException,
@@ -182,6 +187,7 @@
             'class': 'disableAutoComplete textType',
             'size': '20'
         }))
+    require_key = fields.BooleanField(required=False)
 
     def __init__(self, data=None, **kwargs):
         # These keyword arguments are required to render the form successfully
@@ -189,7 +195,8 @@
         self.account = kwargs.pop('account')
 
         if data is None:
-            kwargs['initial'] = {'displayname': self.account.displayname}
+            kwargs['initial'] = {'displayname': self.account.displayname,
+                                 'require_key':self.account.require_key}
 
         super(EditAccountForm, self).__init__(data, **kwargs)
 
@@ -200,12 +207,13 @@
 
         # Override the field to set initial value (current preferred email)
         self.fields['preferred_email'] = PreferredEmailField(
-            queryset=EmailAddress.objects.filter(account=self.account).\
+            queryset=EmailAddress.objects.filter(account=self.account).
                 exclude(status=EmailStatus.NEW).order_by('-status', 'email'),
             initial=preferredemail_id,
             widget=ROAwareSelect,
             error_messages=email_errors,
-            empty_label=None)
+            empty_label=None
+        )
 
     def clean_displayname(self):
         name = self.cleaned_data['displayname'].strip()
@@ -261,6 +269,7 @@
         if self.is_valid():
             self.account.displayname = self.cleaned_data['displayname']
             self.account.preferredemail = self.cleaned_data['preferred_email']
+            self.account.require_key = self.cleaned_data['require_key']
             self.account.save()
             password = self.cleaned_data['password']
             if password:
@@ -286,6 +295,26 @@
         return data
 
 
+class NewKeyForm(forms.ModelForm):
+    newkey = fields.CharField()
+
+    def clean_newkey(self):
+        data = self.cleaned_data['newkey']
+        # Verify, if fail, then:
+        #raise forms.ValidationError(_("Invalid Yubi key."))
+        # 'cccccccitnicnibiidnjbrctldunhkiedndechgkjiku'[:12] = 'cccccccitnic'
+        return data
+
+    def clean(self):
+        if self.cleaned_data.has_key('newkey'):
+            self.cleaned_data['public_id'] = self.cleaned_data['newkey'][:12]
+        return self.cleaned_data
+
+    class Meta:
+        model = YubiKey
+        #exclude = ('public_id',)
+
+
 class PreAuthorizeForm(forms.Form):
     trust_root = forms.CharField(error_messages=default_errors)
     callback = forms.CharField(error_messages=default_errors)
 
=== modified file 'identityprovider/models/__init__.py'
--- identityprovider/models/__init__.py	2010-12-22 15:19:08 +0000
+++ identityprovider/models/__init__.py	2011-05-11 08:50:23 +0000
@@ -5,6 +5,7 @@
 from metamodels import *
 from person import *
 from emailaddress import *
+from yubi_key import *
 from authtoken import *
 from openidmodels import *
 from team import *
 
=== modified file 'identityprovider/models/account.py'
--- identityprovider/models/account.py	2011-02-23 15:45:28 +0000
+++ identityprovider/models/account.py	2011-05-11 08:50:23 +0000
@@ -75,9 +75,9 @@
 class Account(models.Model):
     date_created = models.DateTimeField(default=datetime.utcnow,
                                         editable=False)
-    creation_rationale = \
-            models.IntegerField(
-                choices=AccountCreationRationale._get_choices())
+    creation_rationale = models.IntegerField(
+                choices=AccountCreationRationale._get_choices()
+    )
 
     status = models.IntegerField(choices=AccountStatus._get_choices())
     date_status_set = models.DateTimeField(default=datetime.utcnow)
@@ -86,6 +86,7 @@
     status_comment = models.TextField(blank=True, null=True)
     preferredlanguage = models.TextField(blank=True, null=True)
     old_openid_identifier = models.TextField(blank=True, null=True)
+    require_key = models.BooleanField(default=False)
 
     objects = AccountManager()
 
 
=== added file 'identityprovider/models/yubi_key.py'
--- identityprovider/models/yubi_key.py	1970-01-01 00:00:00 +0000
+++ identityprovider/models/yubi_key.py	2011-05-11 08:50:23 +0000
@@ -0,0 +1,20 @@
+# Copyright 2011 Canonical Ltd.  This software is licensed under the
+# GNU Affero General Public License version 3 (see the file LICENSE).
+
+from django.db import models
+
+from identityprovider.models import Account
+from django.utils.translation import ugettext_lazy as _
+
+
+__all__ = ['YubiKey']
+
+
+class YubiKey(models.Model):
+    public_id = models.CharField(primary_key=True, max_length=20, blank=True)
+    name = models.CharField(max_length=30)
+    account = models.ForeignKey(Account)
+
+    class Meta:
+        app_label = 'identityprovider'
+        db_table = u'yubi_key'
 
=== added file 'identityprovider/templates/account/delete_key.html'
--- identityprovider/templates/account/delete_key.html	1970-01-01 00:00:00 +0000
+++ identityprovider/templates/account/delete_key.html	2011-05-11 08:50:23 +0000
@@ -0,0 +1,34 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% comment %}
+Copyright 2010 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% block title %}
+  {% trans "Remove USB key" %}
+{% endblock %}
+
+{% block text_title %}
+  <h2 class="main">{% blocktrans %}Remove USB key?{% endblocktrans %}</h2>
+{% endblock %}
+
+{% block content_id %}auth{% endblock %}
+
+{% block content %}
+  <div class="info">
+    <p>{% blocktrans %}Are you sure you want to remove this USB key?{% endblocktrans %}</p>
+  </div>
+
+  <div class="actions">
+    <form action="" method="POST">
+      <p>
+        <button type="submit" class="btn" name="delete"><span><span>{% trans "Yes, remove" %}</span></span></button>
+        {% trans "or" %}
+        <a href="/keys">{% trans "cancel" %}</a>
+      </p>
+    </form>
+  </div>
+  <br style="clear: both" />
+{% endblock %}
 
=== modified file 'identityprovider/templates/account/edit.html'
--- identityprovider/templates/account/edit.html	2010-11-10 00:10:51 +0000
+++ identityprovider/templates/account/edit.html	2011-05-11 08:50:23 +0000
@@ -90,7 +90,11 @@
             {{ form.preferred_email }}
         </p>
         {% if not embedded %}
+        <p><label class="formLabel" for="id_require_key">
+            {% trans "Require key authentication" %}{{ form.require_key }}
+        </p>
         <p><a href="/+emails">{% trans "Manage email addresses" %}</a></p>
+        <p><a href="/keys">{% trans "Manage USB keys" %}</a></p>
         {% endif %}
     </div>
     {% if not readonly %}
 
=== added file 'identityprovider/templates/account/keys.html'
--- identityprovider/templates/account/keys.html	1970-01-01 00:00:00 +0000
+++ identityprovider/templates/account/keys.html	2011-05-11 08:50:23 +0000
@@ -0,0 +1,82 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% comment %}
+Copyright 2010 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% block title %}
+  {% blocktrans %}{{ account_displayname }}'s USB keys{% endblocktrans %}
+{% endblock %}
+
+{% block extra_header_top %}
+<link rel="stylesheet" type="text/css" href="/assets/identityprovider/lazr-js/cssreset/reset-min.css"></link>
+<link rel="stylesheet" type="text/css" href="/assets/identityprovider/lazr-js/cssfonts/fonts-min.css"></link>
+<link rel="stylesheet" type="text/css" href="/assets/identityprovider/lazr-js/cssbase/base-min.css"></link>
+<style type="text/css">
+td.actions {
+    text-align: right;
+}
+</style>
+{% endblock %}
+
+{% block text_title %}
+  <h1 class="main">{% trans "Your email addresses" %}</h1>
+{% endblock %}
+
+{% block content %}
+
+{% if not yubi_keys %}
+  <p>{% blocktrans %}You have no USB keys associated with your account.{% endblocktrans %}</p>
+{% endif %}
+
+{% if yubi_keys %}
+
+  <h2>{% trans "USB keys" %}</h2>
+
+  <table class="listing hover">
+    {% for key in yubi_keys %}
+      <tr>
+        <td>{{ key.name }}</td>
+        <td>{{ key.public_id }}</td>
+        {% if not readonly %}
+          <td class="actions">
+            <a href="/remove-key/{{ key.public_id }}"><img src="/assets/identityprovider/trash-icon.gif" width="14" height="14"> {% trans "Remove" %}</a>
+          </td>
+        {% endif %}
+      </tr>
+    {% endfor %}
+  </table>
+
+{% endif %}
+
+{% if not readonly %}
+
+  <h2>{% trans "Add USB key" %}</h2>
+
+  <form action="new-key" method="post">
+    <p class="input-row">
+      <label for="id_name">{% trans "Name" %}</label><br>
+      {{ form.name }}
+      {% if form.name.errors %}
+        <span class="error">{{ form.name.errors|first }}</span>
+      {% endif %}
+    </p>
+    <p class="input-row">
+      <label for="id_newkey">{% trans "Key" %}</label><br>
+      {{ form.newkey }}
+      {% if form.newkey.errors %}
+        <span class="error">{{ form.newkey.errors|first }}</span>
+      {% endif %}
+    </p>
+    <p class="actions">
+      <button type="submit" class="btn" name="continue">
+        <span><span>{% trans "Add key" %}</span></span>
+      </button>
+    </p>
+  </form>
+
+{% endif %}
+
+{% endblock %}
 
=== modified file 'identityprovider/urls.py'
--- identityprovider/urls.py	2011-03-04 17:09:45 +0000
+++ identityprovider/urls.py	2011-05-11 08:50:23 +0000
@@ -65,12 +65,15 @@
 urlpatterns += patterns('identityprovider.views.account',
     (r'^%(optional_token)s\+edit$' % repls, 'index'),
     (r'^\+emails$', 'account_emails'),
+    (r'^keys$', 'account_keys'),
     (r'^$', 'index'),
     (r'^\+cookie$', 'cookie'),
     (r'^%(optional_token)s\+index$' % repls, 'index'),
     (r'^%(optional_token)s\+new-email$' % repls, 'new_email'),
+    (r'^new-key$' % repls, 'new_key'),
     (r'^%(optional_token)s\+verify-email$' % repls, 'verify_email'),
     (r'^%(optional_token)s\+remove-email$' % repls, 'delete_email'),
+    (r'^remove-key/(?P<public_id>.+)$' % repls, 'delete_key'),
 )
 
 if settings.BRAND.lower() == 'ubuntu':
 
=== modified file 'identityprovider/views/account.py'
--- identityprovider/views/account.py	2011-01-10 15:02:53 +0000
+++ identityprovider/views/account.py	2011-05-11 08:50:23 +0000
@@ -12,9 +12,17 @@
 from django.utils.translation import ugettext as _
 
 from identityprovider.decorators import check_readonly
-from identityprovider.forms import EditAccountForm, LoginForm, NewEmailForm
-from identityprovider.models import (send_validation_email_request,
-    EmailAddress)
+from identityprovider.forms import (
+    EditAccountForm,
+    LoginForm,
+    NewEmailForm,
+    NewKeyForm,
+)
+from identityprovider.models import (
+    EmailAddress,
+    send_validation_email_request,
+    YubiKey,
+)
 from oauth_backend.models import Consumer, Token
 from identityprovider.models.const import EmailStatus
 from identityprovider.views.utils import (redirection_url_for_token,
@@ -55,7 +63,7 @@
     if request.method == 'POST' and not settings.READ_ONLY_MODE:
         form = EditAccountForm(request.POST, account=account)
         if form.save_account():
-            request.session['message'] = _("Your account details have been "\
+            request.session['message'] = _("Your account details have been "
                                            "successfully updated")
             return HttpResponseRedirect('.')
     else:
@@ -93,6 +101,22 @@
 
 
 @login_required
+def account_keys(request):
+    account = request.user
+    form = NewKeyForm()
+    context = RequestContext(request, {
+        'current_section': 'emails',
+        'account': account,
+        'account_displayname': account.displayname,
+        'yubi_keys': account.yubikey_set.all(),
+        'form': form,
+        'message': request.session.pop('message', None),
+        'message_style': 'informational'
+    })
+    return render_to_response('account/keys.html', context)
+
+
+@login_required
 def account_deactivate(request, token=None):
     request.token = token
     import django.contrib.auth as auth
@@ -117,7 +141,7 @@
     # TODO: This makes use of `tokenid` if it's passed in, but the
     # call to `send_validation_email_request` always generates a new
     # token.  Is this right?
-    
+
     # If there are any unverified emails that match they should be deleted.
     EmailAddress.objects.filter(email__iexact=email,
         status=EmailStatus.NEW).delete()
@@ -163,6 +187,31 @@
     return render_to_response('account/new_email.html', context)
 
 
+
+@login_required
+@check_readonly
+def new_key(request, key=None):
+    #request.token = token
+
+    if request.method != 'POST' or settings.READ_ONLY_MODE:
+        return
+
+    data = request.POST.copy()
+    data['account'] = request.user.id
+    form = NewKeyForm(data)
+    if form.is_valid():
+        form.save()
+        # Send e-mail to notify user (so they can catch possible
+        # security breaches
+        return HttpResponseRedirect('/keys')
+
+    context = RequestContext(request, {
+        'account_displayname': request.user.displayname,
+        'form': form
+        })
+    return render_to_response('account/keys.html', context)
+
+
 @login_required
 def verify_email(request, token=None):
     request.token = token
@@ -195,6 +244,18 @@
 
 
 @login_required
+def delete_key(request, public_id):
+    key = get_object_or_404(request.user.yubikey_set, public_id=public_id)
+    if request.method == 'POST':
+        key.delete()
+        request.session['message'] = _("The USB key was removed successfully")
+        return HttpResponseRedirect('/keys')
+    else:
+        context = RequestContext(request)
+        return render_to_response('account/delete_key.html', context)
+
+
+@login_required
 @check_readonly
 def applications(request):
     if request.method == 'POST':
@@ -217,6 +278,3 @@
             'message_style': 'informational',
             })
         return render_to_response('account/applications.html', context)
-
-
-