î _ÝVVã@s¸ddlmZddlmZddlmZddlmZddlm Z dd„Z Gdd „d e ƒZ Gd d „d e ƒZ Gd d „d e ƒZGdd„deƒZdS)é)Úauth)Ú load_backend)ÚRemoteUserBackend)ÚImproperlyConfigured)ÚSimpleLazyObjectcCs+t|dƒs$tj|ƒ|_n|jS)NÚ _cached_user)ÚhasattrrÚget_userr)Úrequest©r ú@/tmp/pip-build-ghmbqnp_/Django/django/contrib/auth/middleware.pyr sr c@seZdZdd„ZdS)ÚAuthenticationMiddlewarecs:tˆdƒstdƒ‚t‡fdd†ƒˆ_dS)NÚsessionzùThe Django authentication middleware requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware' before 'django.contrib.auth.middleware.AuthenticationMiddleware'.cs tˆƒS)N)r r )r r r Úsz:AuthenticationMiddleware.process_request..)rÚAssertionErrorrÚuser)Úselfr r )r r Úprocess_requests z(AuthenticationMiddleware.process_requestN)Ú__name__Ú __module__Ú __qualname__rr r r r r s r c@s"eZdZdZdd„ZdS)ÚSessionAuthenticationMiddlewareaa Formerly, a middleware for invalidating a user's sessions that don't correspond to the user's current session authentication hash. However, it caused the "Vary: Cookie" header on all responses. Now a backwards compatibility shim that enables session verification in auth.get_user() if this middleware is in MIDDLEWARE_CLASSES. cCsdS)Nr )rr r r r r"sz/SessionAuthenticationMiddleware.process_requestN)rrrÚ__doc__rr r r r rs rc@sFeZdZdZdZdZdd„Zdd„Zdd „Zd S) ÚRemoteUserMiddlewareaý Middleware for utilizing Web-server-provided authentication. If request.user is not authenticated, then this middleware attempts to authenticate the username passed in the ``REMOTE_USER`` request header. If authentication is successful, the user is automatically logged in to persist the user in the session. The header used is configurable and defaults to ``REMOTE_USER``. Subclass this class and change the ``header`` attribute if you need to use a different header. Z REMOTE_USERTc Csït|dƒstdƒ‚ny|j|j}Wn>tk rr|jrj|jjƒrj|j|ƒndSYnX|jjƒr·|jj ƒ|j ||ƒkr§dS|j|ƒnt j d|ƒ}|rë||_t j ||ƒndS)NrzïThe Django remote user auth middleware requires the authentication middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.auth.middleware.AuthenticationMiddleware' before the RemoteUserMiddleware class.Z remote_user)rrZMETAÚheaderÚKeyErrorÚforce_logout_if_no_headerrZis_authenticatedÚ_remove_invalid_userZ get_usernameÚclean_usernamerZ authenticateÚlogin)rr Úusernamerr r r r:s"   ! z$RemoteUserMiddleware.process_requestc CsK|jtj}tj|ƒ}y|j|ƒ}Wntk rFYnX|S)zs Allows the backend to clean the username, if the backend defines a clean_username method. )rrÚBACKEND_SESSION_KEYrrÚAttributeError)rr r Z backend_strÚbackendr r r r`s z#RemoteUserMiddleware.clean_usernamec Csgy"t|jjtjdƒƒ}Wntk rCtj|ƒYn Xt|tƒrctj|ƒndS)z¡ Removes the current authenticated user in the request which is invalid but only if the user is authenticated via the RemoteUserBackend. ÚN) rrÚgetrr!Ú ImportErrorZlogoutÚ isinstancer)rr Zstored_backendr r r rms " z)RemoteUserMiddleware._remove_invalid_userN) rrrrrrrrrr r r r r&s  & rc@seZdZdZdZdS)ÚPersistentRemoteUserMiddlewarea£ Middleware for Web-server provided authentication on logon pages. Like RemoteUserMiddleware but keeps the user authenticated even if the header (``REMOTE_USER``) is not found in the request. Useful for setups when the external authentication via ``REMOTE_USER`` is only expected to happen on some "logon" URL and the rest of the application wants to use Django's authentication mechanism. FN)rrrrrr r r r r(|s r(N)Zdjango.contribrZdjango.contrib.authrZdjango.contrib.auth.backendsrZdjango.core.exceptionsrZdjango.utils.functionalrr Úobjectr rrr(r r r r Ús   V