authentik.core.sessions

  1"""authentik sessions engine"""
  2
  3import pickle  # nosec
  4
  5from django.contrib.auth import BACKEND_SESSION_KEY, HASH_SESSION_KEY, SESSION_KEY
  6from django.contrib.sessions.backends.db import SessionStore as SessionBase
  7from django.core.exceptions import SuspiciousOperation
  8from django.utils import timezone
  9from django.utils.functional import cached_property
 10from structlog.stdlib import get_logger
 11
 12from authentik.root.middleware import ClientIPMiddleware
 13
 14LOGGER = get_logger()
 15
 16
 17class SessionStore(SessionBase):
 18    def __init__(self, session_key=None, last_ip=None, last_user_agent=""):
 19        super().__init__(session_key)
 20        self._create_kwargs = {
 21            "last_ip": last_ip or ClientIPMiddleware.default_ip,
 22            "last_user_agent": last_user_agent,
 23        }
 24
 25    @classmethod
 26    def get_model_class(cls):
 27        from authentik.core.models import Session
 28
 29        return Session
 30
 31    @cached_property
 32    def model_fields(self):
 33        return [k.value for k in self.model.Keys]
 34
 35    def _get_session_from_db(self):
 36        try:
 37            return self.model.objects.select_related(
 38                "authenticatedsession",
 39                "authenticatedsession__user",
 40            ).get(
 41                session_key=self.session_key,
 42                expires__gt=timezone.now(),
 43            )
 44        except (self.model.DoesNotExist, SuspiciousOperation) as exc:
 45            if isinstance(exc, SuspiciousOperation):
 46                LOGGER.warning(str(exc))
 47            self._session_key = None
 48
 49    async def _aget_session_from_db(self):
 50        try:
 51            return await self.model.objects.select_related(
 52                "authenticatedsession",
 53                "authenticatedsession__user",
 54            ).aget(
 55                session_key=self.session_key,
 56                expires__gt=timezone.now(),
 57            )
 58        except (self.model.DoesNotExist, SuspiciousOperation) as exc:
 59            if isinstance(exc, SuspiciousOperation):
 60                LOGGER.warning(str(exc))
 61            self._session_key = None
 62
 63    def encode(self, session_dict):
 64        return pickle.dumps(session_dict, protocol=pickle.HIGHEST_PROTOCOL)
 65
 66    def decode(self, session_data):
 67        try:
 68            return pickle.loads(session_data)  # nosec
 69        except pickle.PickleError, AttributeError, TypeError:
 70            # PickleError, ValueError - unpickling exceptions
 71            # AttributeError - can happen when Django model fields (e.g., FileField) are unpickled
 72            #                  and their descriptors fail to initialize (e.g., missing storage)
 73            # TypeError - can happen with incompatible pickled objects
 74            # If any of these happen, just return an empty dictionary (an empty session)
 75            LOGGER.warning("Failed to decode session data", exc_info=True)
 76            pass
 77        return {}
 78
 79    def load(self):
 80        s = self._get_session_from_db()
 81        if s:
 82            return {
 83                "authenticatedsession": getattr(s, "authenticatedsession", None),
 84                **{k: getattr(s, k) for k in self.model_fields},
 85                **self.decode(s.session_data),
 86            }
 87        else:
 88            return {}
 89
 90    async def aload(self):
 91        s = await self._aget_session_from_db()
 92        if s:
 93            return {
 94                "authenticatedsession": getattr(s, "authenticatedsession", None),
 95                **{k: getattr(s, k) for k in self.model_fields},
 96                **self.decode(s.session_data),
 97            }
 98        else:
 99            return {}
100
101    def create_model_instance(self, data):
102        args = {
103            "session_key": self._get_or_create_session_key(),
104            "expires": self.get_expiry_date(),
105            "session_data": {},
106            **self._create_kwargs,
107        }
108        for k, v in data.items():
109            # Don't save:
110            # - unused auth data
111            # - related models
112            if k in [SESSION_KEY, BACKEND_SESSION_KEY, HASH_SESSION_KEY, "authenticatedsession"]:
113                pass
114            elif k in self.model_fields:
115                args[k] = v
116            else:
117                args["session_data"][k] = v
118        args["session_data"] = self.encode(args["session_data"])
119        return self.model(**args)
120
121    async def acreate_model_instance(self, data):
122        args = {
123            "session_key": await self._aget_or_create_session_key(),
124            "expires": await self.aget_expiry_date(),
125            "session_data": {},
126            **self._create_kwargs,
127        }
128        for k, v in data.items():
129            # Don't save:
130            # - unused auth data
131            # - related models
132            if k in [SESSION_KEY, BACKEND_SESSION_KEY, HASH_SESSION_KEY, "authenticatedsession"]:
133                pass
134            elif k in self.model_fields:
135                args[k] = v
136            else:
137                args["session_data"][k] = v
138        args["session_data"] = self.encode(args["session_data"])
139        return self.model(**args)
140
141    @classmethod
142    def clear_expired(cls):
143        cls.get_model_class().objects.filter(expires__lt=timezone.now()).delete()
144
145    @classmethod
146    async def aclear_expired(cls):
147        await cls.get_model_class().objects.filter(expires__lt=timezone.now()).adelete()
148
149    def cycle_key(self):
150        data = self._session
151        key = self.session_key
152        self.create()
153        self._session_cache = data
154        if key:
155            self.delete(key)
156        if (authenticated_session := data.get("authenticatedsession")) is not None:
157            authenticated_session.session_id = self.session_key
158            authenticated_session.save(force_insert=True)