authentik.stages.prompt.models

  1"""prompt models"""
  2
  3from typing import Any, Type  # noqa: UP035
  4from urllib.parse import urlparse, urlunparse
  5from uuid import uuid4
  6
  7from django.db import models
  8from django.http import HttpRequest
  9from django.utils.translation import gettext_lazy as _
 10from django.views import View
 11from rest_framework.exceptions import ValidationError
 12from rest_framework.fields import (
 13    BooleanField,
 14    CharField,
 15    ChoiceField,
 16    DateField,
 17    DateTimeField,
 18    EmailField,
 19    HiddenField,
 20    IntegerField,
 21    ReadOnlyField,
 22)
 23from rest_framework.serializers import BaseSerializer
 24from structlog.stdlib import get_logger
 25
 26from authentik.core.expression.evaluator import PropertyMappingEvaluator
 27from authentik.core.expression.exceptions import PropertyMappingExpressionException
 28from authentik.core.models import User
 29from authentik.flows.models import Stage
 30from authentik.lib.models import SerializerModel
 31from authentik.policies.models import Policy
 32
 33CHOICES_CONTEXT_SUFFIX = "__choices"
 34
 35LOGGER = get_logger()
 36
 37
 38class FieldTypes(models.TextChoices):
 39    """Field types an Prompt can be"""
 40
 41    # update website/docs/add-secure-apps/flows-stages/stages/prompt/index.md
 42
 43    # Simple text field
 44    TEXT = "text", _("Text: Simple Text input")
 45    # Long text field
 46    TEXT_AREA = "text_area", _("Text area: Multiline Text Input.")
 47    # Simple text field
 48    TEXT_READ_ONLY = "text_read_only", _(
 49        "Text (read-only): Simple Text input, but cannot be edited."
 50    )
 51    # Long text field
 52    TEXT_AREA_READ_ONLY = "text_area_read_only", _(
 53        "Text area (read-only): Multiline Text input, but cannot be edited."
 54    )
 55
 56    # Same as text, but has autocomplete for password managers
 57    USERNAME = (
 58        "username",
 59        _("Username: Same as Text input, but checks for and prevents duplicate usernames."),
 60    )
 61    EMAIL = "email", _("Email: Text field with Email type.")
 62    PASSWORD = (
 63        "password",  # noqa # nosec
 64        _(
 65            "Password: Masked input, multiple inputs of this type on the same prompt "
 66            "need to be identical."
 67        ),
 68    )
 69    NUMBER = "number"
 70    CHECKBOX = "checkbox"
 71    RADIO_BUTTON_GROUP = "radio-button-group", _(
 72        "Fixed choice field rendered as a group of radio buttons."
 73    )
 74    DROPDOWN = "dropdown", _("Fixed choice field rendered as a dropdown.")
 75    DATE = "date"
 76    DATE_TIME = "date-time"
 77
 78    FILE = (
 79        "file",
 80        _(
 81            "File: File upload for arbitrary files. File content will be available in flow "
 82            "context as data-URI"
 83        ),
 84    )
 85
 86    SEPARATOR = "separator", _("Separator: Static Separator Line")
 87    HIDDEN = "hidden", _("Hidden: Hidden field, can be used to insert data into form.")
 88    STATIC = "static", _("Static: Static value, displayed as-is.")
 89
 90    # Alert box types for displaying styled messages
 91    ALERT_INFO = "alert_info", _("Alert (Info): Static alert box with info styling")
 92    ALERT_WARNING = "alert_warning", _("Alert (Warning): Static alert box with warning styling")
 93    ALERT_DANGER = "alert_danger", _("Alert (Danger): Static alert box with danger styling")
 94
 95    AK_LOCALE = "ak-locale", _("authentik: Selection of locales authentik supports")
 96
 97
 98CHOICE_FIELDS = (FieldTypes.RADIO_BUTTON_GROUP, FieldTypes.DROPDOWN)
 99
100
101class InlineFileField(CharField):
102    """Field for inline data-URI base64 encoded files"""
103
104    def to_internal_value(self, data: str):
105        uri = urlparse(data)
106        if uri.scheme != "data":
107            raise ValidationError("Invalid scheme")
108        header, _encoded = uri.path.split(",", 1)
109        _mime, _, enc = header.partition(";")
110        if enc != "base64":
111            raise ValidationError("Invalid encoding")
112        return super().to_internal_value(urlunparse(uri))
113
114
115class Prompt(SerializerModel):
116    """Single Prompt, part of a prompt stage."""
117
118    prompt_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
119    name = models.TextField(unique=True, blank=False)
120
121    field_key = models.TextField(
122        help_text=_("Name of the form field, also used to store the value")
123    )
124    label = models.TextField()
125    type = models.CharField(max_length=100, choices=FieldTypes.choices)
126    required = models.BooleanField(default=True)
127    placeholder = models.TextField(
128        blank=True,
129        help_text=_(
130            "Optionally provide a short hint that describes the expected input value. "
131            "When creating a fixed choice field, enable interpreting as "
132            "expression and return a list to return multiple choices."
133        ),
134    )
135    initial_value = models.TextField(
136        blank=True,
137        help_text=_(
138            "Optionally pre-fill the input with an initial value. "
139            "When creating a fixed choice field, enable interpreting as "
140            "expression and return a list to return multiple default choices."
141        ),
142    )
143    sub_text = models.TextField(blank=True, default="")
144
145    order = models.IntegerField(default=0)
146
147    placeholder_expression = models.BooleanField(default=False)
148    initial_value_expression = models.BooleanField(default=False)
149
150    @property
151    def serializer(self) -> Type[BaseSerializer]:  # noqa: UP006
152        from authentik.stages.prompt.api import PromptSerializer
153
154        return PromptSerializer
155
156    def get_choices(
157        self,
158        prompt_context: dict,
159        user: User,
160        request: HttpRequest,
161        dry_run: bool | None = False,
162    ) -> tuple[dict[str, Any]] | None:
163        """Get fully interpolated list of choices"""
164        if self.type not in CHOICE_FIELDS:
165            return None
166
167        raw_choices = self.placeholder
168
169        if self.field_key + CHOICES_CONTEXT_SUFFIX in prompt_context:
170            raw_choices = prompt_context[self.field_key + CHOICES_CONTEXT_SUFFIX]
171        elif self.placeholder_expression:
172            evaluator = PropertyMappingEvaluator(
173                self, user, request, prompt_context=prompt_context, dry_run=dry_run
174            )
175            try:
176                raw_choices = evaluator.evaluate(self.placeholder)
177            except Exception as exc:  # pylint:disable=broad-except
178                wrapped = PropertyMappingExpressionException(exc, None)
179                LOGGER.warning(
180                    "failed to evaluate prompt choices",
181                    exc=wrapped,
182                )
183                if dry_run:
184                    raise wrapped from exc
185
186        if isinstance(raw_choices, list | tuple | set):
187            choices = raw_choices
188        else:
189            choices = [raw_choices]
190
191        if len(choices) == 0:
192            LOGGER.warning("failed to get prompt choices", choices=choices, input=raw_choices)
193
194        return tuple(choices)
195
196    def get_placeholder(
197        self,
198        prompt_context: dict,
199        user: User,
200        request: HttpRequest,
201        dry_run: bool | None = False,
202    ) -> str:
203        """Get fully interpolated placeholder"""
204        if self.type in CHOICE_FIELDS:
205            # Choice fields use the placeholder to define all valid choices.
206            # Therefore their actual placeholder is always blank
207            return ""
208
209        if self.placeholder_expression:
210            evaluator = PropertyMappingEvaluator(
211                self, user, request, prompt_context=prompt_context, dry_run=dry_run
212            )
213            try:
214                return evaluator.evaluate(self.placeholder)
215            except Exception as exc:  # pylint:disable=broad-except
216                wrapped = PropertyMappingExpressionException(exc, None)
217                LOGGER.warning(
218                    "failed to evaluate prompt placeholder",
219                    exc=wrapped,
220                )
221                if dry_run:
222                    raise wrapped from exc
223        return self.placeholder
224
225    def get_initial_value(
226        self,
227        prompt_context: dict,
228        user: User,
229        request: HttpRequest,
230        dry_run: bool | None = False,
231    ) -> str:
232        """Get fully interpolated initial value"""
233
234        if self.field_key in prompt_context:
235            # We don't want to parse this as an expression since a user will
236            # be able to control the input
237            value = prompt_context[self.field_key]
238        elif self.initial_value_expression:
239            evaluator = PropertyMappingEvaluator(
240                self, user, request, prompt_context=prompt_context, dry_run=dry_run
241            )
242            try:
243                value = evaluator.evaluate(self.initial_value)
244            except Exception as exc:  # pylint:disable=broad-except
245                wrapped = PropertyMappingExpressionException(exc, None)
246                LOGGER.warning(
247                    "failed to evaluate prompt initial value",
248                    exc=wrapped,
249                )
250                if dry_run:
251                    raise wrapped from exc
252                value = self.initial_value
253        else:
254            value = self.initial_value
255
256        if self.type in CHOICE_FIELDS:
257            # Ensure returned value is a valid choice
258            choices = self.get_choices(prompt_context, user, request)
259            if not choices:
260                return ""
261            if not any(
262                choice.get("value") == value if isinstance(choice, dict) else choice == value
263                for choice in choices
264            ):
265                return choices[0]
266
267        return value
268
269    def field(  # noqa PLR0915
270        self, default: Any | None, choices: list[Any] | None = None
271    ) -> CharField:
272        """Get field type for Challenge and response. Choices are only valid for CHOICE_FIELDS."""
273        field_class = CharField
274        kwargs = {
275            "required": self.required,
276        }
277        match self.type:
278            case FieldTypes.TEXT | FieldTypes.TEXT_AREA:
279                kwargs["trim_whitespace"] = False
280                kwargs["allow_blank"] = not self.required
281            case FieldTypes.TEXT_READ_ONLY, FieldTypes.TEXT_AREA_READ_ONLY:
282                field_class = ReadOnlyField
283                # required can't be set for ReadOnlyField
284                kwargs["required"] = False
285                kwargs["allow_blank"] = True
286            case FieldTypes.EMAIL:
287                field_class = EmailField
288                kwargs["allow_blank"] = not self.required
289            case FieldTypes.NUMBER:
290                field_class = IntegerField
291            case FieldTypes.CHECKBOX:
292                field_class = BooleanField
293                kwargs["required"] = False
294            case FieldTypes.DATE:
295                field_class = DateField
296            case FieldTypes.DATE_TIME:
297                field_class = DateTimeField
298            case FieldTypes.FILE:
299                field_class = InlineFileField
300            case FieldTypes.SEPARATOR:
301                kwargs["required"] = False
302                kwargs["label"] = ""
303            case FieldTypes.HIDDEN:
304                field_class = HiddenField
305                kwargs["required"] = False
306                kwargs["default"] = self.placeholder
307            case (
308                FieldTypes.STATIC
309                | FieldTypes.ALERT_INFO
310                | FieldTypes.ALERT_WARNING
311                | FieldTypes.ALERT_DANGER
312            ):
313                kwargs["default"] = self.placeholder
314                kwargs["required"] = False
315                kwargs["label"] = ""
316
317            case FieldTypes.AK_LOCALE:
318                kwargs["allow_blank"] = True
319
320        if self.type in CHOICE_FIELDS:
321            field_class = ChoiceField
322            kwargs["choices"] = []
323            if choices:
324                for choice in choices:
325                    label, value = choice, choice
326                    if isinstance(choice, dict):
327                        label = choice.get("label", "")
328                        value = choice.get("value", "")
329                    kwargs["choices"].append((value, label))
330
331        if default:
332            kwargs["default"] = default
333        # May not set both `required` and `default`
334        if "default" in kwargs:
335            kwargs.pop("required", None)
336        return field_class(**kwargs)
337
338    def save(self, *args, **kwargs):
339        if self.type not in FieldTypes:
340            raise ValueError
341        return super().save(*args, **kwargs)
342
343    def __str__(self):
344        return f"Prompt field '{self.field_key}' type {self.type}"
345
346    class Meta:
347        verbose_name = _("Prompt")
348        verbose_name_plural = _("Prompts")
349
350
351class PromptStage(Stage):
352    """Prompt the user to enter information."""
353
354    fields = models.ManyToManyField(Prompt)
355
356    validation_policies = models.ManyToManyField(Policy, blank=True)
357
358    @property
359    def serializer(self) -> type[BaseSerializer]:
360        from authentik.stages.prompt.api import PromptStageSerializer
361
362        return PromptStageSerializer
363
364    @property
365    def view(self) -> type[View]:
366        from authentik.stages.prompt.stage import PromptStageView
367
368        return PromptStageView
369
370    @property
371    def component(self) -> str:
372        return "ak-stage-prompt-form"
373
374    class Meta:
375        verbose_name = _("Prompt Stage")
376        verbose_name_plural = _("Prompt Stages")