authentik.core.sessions

  1"""authentik sessions engine"""
  2
  3import pickle  # nosec
  4
  5from django.contrib.auth import BACKEND_SESSION_KEY, HASH_SESSION_KEY, SESSION_KEY
  6from django.contrib.sessions.backends.db import SessionStore as SessionBase
  7from django.core.exceptions import SuspiciousOperation
  8from django.utils import timezone
  9from django.utils.functional import cached_property
 10from structlog.stdlib import get_logger
 11
 12from authentik.root.middleware import ClientIPMiddleware
 13
 14LOGGER = get_logger()
 15
 16
 17class SessionStore(SessionBase):
 18    def __init__(self, session_key=None, last_ip=None, last_user_agent=""):
 19        super().__init__(session_key)
 20        self._create_kwargs = {
 21            "last_ip": last_ip or ClientIPMiddleware.default_ip,
 22            "last_user_agent": last_user_agent,
 23        }
 24
 25    @classmethod
 26    def get_model_class(cls):
 27        from authentik.core.models import Session
 28
 29        return Session
 30
 31    @cached_property
 32    def model_fields(self):
 33        return [k.value for k in self.model.Keys]
 34
 35    def _get_session_from_db(self):
 36        try:
 37            return self.model.objects.select_related(
 38                "authenticatedsession",
 39                "authenticatedsession__user",
 40            ).get(
 41                session_key=self.session_key,
 42                expires__gt=timezone.now(),
 43            )
 44        except (self.model.DoesNotExist, SuspiciousOperation) as exc:
 45            if isinstance(exc, SuspiciousOperation):
 46                LOGGER.warning(str(exc))
 47            self._session_key = None
 48
 49    async def _aget_session_from_db(self):
 50        try:
 51            return await self.model.objects.select_related(
 52                "authenticatedsession",
 53                "authenticatedsession__user",
 54            ).aget(
 55                session_key=self.session_key,
 56                expires__gt=timezone.now(),
 57            )
 58        except (self.model.DoesNotExist, SuspiciousOperation) as exc:
 59            if isinstance(exc, SuspiciousOperation):
 60                LOGGER.warning(str(exc))
 61            self._session_key = None
 62
 63    def encode(self, session_dict):
 64        return pickle.dumps(session_dict, protocol=pickle.HIGHEST_PROTOCOL)
 65
 66    def decode(self, session_data):
 67        try:
 68            return pickle.loads(session_data)  # nosec
 69        except pickle.PickleError, AttributeError, TypeError:
 70            # PickleError, ValueError - unpickling exceptions
 71            # AttributeError - can happen when Django model fields (e.g., FileField) are unpickled
 72            #                  and their descriptors fail to initialize (e.g., missing storage)
 73            # TypeError - can happen with incompatible pickled objects
 74            # If any of these happen, just return an empty dictionary (an empty session)
 75            pass
 76        return {}
 77
 78    def load(self):
 79        s = self._get_session_from_db()
 80        if s:
 81            return {
 82                "authenticatedsession": getattr(s, "authenticatedsession", None),
 83                **{k: getattr(s, k) for k in self.model_fields},
 84                **self.decode(s.session_data),
 85            }
 86        else:
 87            return {}
 88
 89    async def aload(self):
 90        s = await self._aget_session_from_db()
 91        if s:
 92            return {
 93                "authenticatedsession": getattr(s, "authenticatedsession", None),
 94                **{k: getattr(s, k) for k in self.model_fields},
 95                **self.decode(s.session_data),
 96            }
 97        else:
 98            return {}
 99
100    def create_model_instance(self, data):
101        args = {
102            "session_key": self._get_or_create_session_key(),
103            "expires": self.get_expiry_date(),
104            "session_data": {},
105            **self._create_kwargs,
106        }
107        for k, v in data.items():
108            # Don't save:
109            # - unused auth data
110            # - related models
111            if k in [SESSION_KEY, BACKEND_SESSION_KEY, HASH_SESSION_KEY, "authenticatedsession"]:
112                pass
113            elif k in self.model_fields:
114                args[k] = v
115            else:
116                args["session_data"][k] = v
117        args["session_data"] = self.encode(args["session_data"])
118        return self.model(**args)
119
120    async def acreate_model_instance(self, data):
121        args = {
122            "session_key": await self._aget_or_create_session_key(),
123            "expires": await self.aget_expiry_date(),
124            "session_data": {},
125            **self._create_kwargs,
126        }
127        for k, v in data.items():
128            # Don't save:
129            # - unused auth data
130            # - related models
131            if k in [SESSION_KEY, BACKEND_SESSION_KEY, HASH_SESSION_KEY, "authenticatedsession"]:
132                pass
133            elif k in self.model_fields:
134                args[k] = v
135            else:
136                args["session_data"][k] = v
137        args["session_data"] = self.encode(args["session_data"])
138        return self.model(**args)
139
140    @classmethod
141    def clear_expired(cls):
142        cls.get_model_class().objects.filter(expires__lt=timezone.now()).delete()
143
144    @classmethod
145    async def aclear_expired(cls):
146        await cls.get_model_class().objects.filter(expires__lt=timezone.now()).adelete()
147
148    def cycle_key(self):
149        data = self._session
150        key = self.session_key
151        self.create()
152        self._session_cache = data
153        if key:
154            self.delete(key)
155        if (authenticated_session := data.get("authenticatedsession")) is not None:
156            authenticated_session.session_id = self.session_key
157            authenticated_session.save(force_insert=True)