authentik.stages.prompt.models

  1"""prompt models"""
  2
  3from typing import Any, Type  # noqa: UP035
  4from urllib.parse import urlparse, urlunparse
  5from uuid import uuid4
  6
  7from django.db import models
  8from django.http import HttpRequest
  9from django.utils.translation import gettext_lazy as _
 10from django.views import View
 11from rest_framework.exceptions import ValidationError
 12from rest_framework.fields import (
 13    BooleanField,
 14    CharField,
 15    ChoiceField,
 16    DateField,
 17    DateTimeField,
 18    EmailField,
 19    HiddenField,
 20    IntegerField,
 21    ReadOnlyField,
 22)
 23from rest_framework.serializers import BaseSerializer
 24from structlog.stdlib import get_logger
 25
 26from authentik.core.expression.evaluator import PropertyMappingEvaluator
 27from authentik.core.expression.exceptions import PropertyMappingExpressionException
 28from authentik.core.models import User
 29from authentik.flows.models import Stage
 30from authentik.lib.models import SerializerModel
 31from authentik.policies.models import Policy
 32
 33CHOICES_CONTEXT_SUFFIX = "__choices"
 34
 35LOGGER = get_logger()
 36
 37
 38class FieldTypes(models.TextChoices):
 39    """Field types an Prompt can be"""
 40
 41    # update website/docs/add-secure-apps/flows-stages/stages/prompt/index.md
 42
 43    # Simple text field
 44    TEXT = "text", _("Text: Simple Text input")
 45    # Long text field
 46    TEXT_AREA = "text_area", _("Text area: Multiline Text Input.")
 47    # Simple text field
 48    TEXT_READ_ONLY = "text_read_only", _(
 49        "Text (read-only): Simple Text input, but cannot be edited."
 50    )
 51    # Long text field
 52    TEXT_AREA_READ_ONLY = "text_area_read_only", _(
 53        "Text area (read-only): Multiline Text input, but cannot be edited."
 54    )
 55
 56    # Same as text, but has autocomplete for password managers
 57    USERNAME = (
 58        "username",
 59        _("Username: Same as Text input, but checks for and prevents duplicate usernames."),
 60    )
 61    EMAIL = "email", _("Email: Text field with Email type.")
 62    PASSWORD = (
 63        "password",  # noqa # nosec
 64        _(
 65            "Password: Masked input, multiple inputs of this type on the same prompt "
 66            "need to be identical."
 67        ),
 68    )
 69    NUMBER = "number"
 70    CHECKBOX = "checkbox"
 71    RADIO_BUTTON_GROUP = "radio-button-group", _(
 72        "Fixed choice field rendered as a group of radio buttons."
 73    )
 74    DROPDOWN = "dropdown", _("Fixed choice field rendered as a dropdown.")
 75    DATE = "date"
 76    DATE_TIME = "date-time"
 77
 78    FILE = (
 79        "file",
 80        _(
 81            "File: File upload for arbitrary files. File content will be available in flow "
 82            "context as data-URI"
 83        ),
 84    )
 85
 86    SEPARATOR = "separator", _("Separator: Static Separator Line")
 87    HIDDEN = "hidden", _("Hidden: Hidden field, can be used to insert data into form.")
 88    STATIC = "static", _("Static: Static value, displayed as-is.")
 89
 90    AK_LOCALE = "ak-locale", _("authentik: Selection of locales authentik supports")
 91
 92
 93CHOICE_FIELDS = (FieldTypes.RADIO_BUTTON_GROUP, FieldTypes.DROPDOWN)
 94
 95
 96class InlineFileField(CharField):
 97    """Field for inline data-URI base64 encoded files"""
 98
 99    def to_internal_value(self, data: str):
100        uri = urlparse(data)
101        if uri.scheme != "data":
102            raise ValidationError("Invalid scheme")
103        header, _encoded = uri.path.split(",", 1)
104        _mime, _, enc = header.partition(";")
105        if enc != "base64":
106            raise ValidationError("Invalid encoding")
107        return super().to_internal_value(urlunparse(uri))
108
109
110class Prompt(SerializerModel):
111    """Single Prompt, part of a prompt stage."""
112
113    prompt_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
114    name = models.TextField(unique=True, blank=False)
115
116    field_key = models.TextField(
117        help_text=_("Name of the form field, also used to store the value")
118    )
119    label = models.TextField()
120    type = models.CharField(max_length=100, choices=FieldTypes.choices)
121    required = models.BooleanField(default=True)
122    placeholder = models.TextField(
123        blank=True,
124        help_text=_(
125            "Optionally provide a short hint that describes the expected input value. "
126            "When creating a fixed choice field, enable interpreting as "
127            "expression and return a list to return multiple choices."
128        ),
129    )
130    initial_value = models.TextField(
131        blank=True,
132        help_text=_(
133            "Optionally pre-fill the input with an initial value. "
134            "When creating a fixed choice field, enable interpreting as "
135            "expression and return a list to return multiple default choices."
136        ),
137    )
138    sub_text = models.TextField(blank=True, default="")
139
140    order = models.IntegerField(default=0)
141
142    placeholder_expression = models.BooleanField(default=False)
143    initial_value_expression = models.BooleanField(default=False)
144
145    @property
146    def serializer(self) -> Type[BaseSerializer]:  # noqa: UP006
147        from authentik.stages.prompt.api import PromptSerializer
148
149        return PromptSerializer
150
151    def get_choices(
152        self,
153        prompt_context: dict,
154        user: User,
155        request: HttpRequest,
156        dry_run: bool | None = False,
157    ) -> tuple[dict[str, Any]] | None:
158        """Get fully interpolated list of choices"""
159        if self.type not in CHOICE_FIELDS:
160            return None
161
162        raw_choices = self.placeholder
163
164        if self.field_key + CHOICES_CONTEXT_SUFFIX in prompt_context:
165            raw_choices = prompt_context[self.field_key + CHOICES_CONTEXT_SUFFIX]
166        elif self.placeholder_expression:
167            evaluator = PropertyMappingEvaluator(
168                self, user, request, prompt_context=prompt_context, dry_run=dry_run
169            )
170            try:
171                raw_choices = evaluator.evaluate(self.placeholder)
172            except Exception as exc:  # pylint:disable=broad-except
173                wrapped = PropertyMappingExpressionException(exc, None)
174                LOGGER.warning(
175                    "failed to evaluate prompt choices",
176                    exc=wrapped,
177                )
178                if dry_run:
179                    raise wrapped from exc
180
181        if isinstance(raw_choices, list | tuple | set):
182            choices = raw_choices
183        else:
184            choices = [raw_choices]
185
186        if len(choices) == 0:
187            LOGGER.warning("failed to get prompt choices", choices=choices, input=raw_choices)
188
189        return tuple(choices)
190
191    def get_placeholder(
192        self,
193        prompt_context: dict,
194        user: User,
195        request: HttpRequest,
196        dry_run: bool | None = False,
197    ) -> str:
198        """Get fully interpolated placeholder"""
199        if self.type in CHOICE_FIELDS:
200            # Choice fields use the placeholder to define all valid choices.
201            # Therefore their actual placeholder is always blank
202            return ""
203
204        if self.placeholder_expression:
205            evaluator = PropertyMappingEvaluator(
206                self, user, request, prompt_context=prompt_context, dry_run=dry_run
207            )
208            try:
209                return evaluator.evaluate(self.placeholder)
210            except Exception as exc:  # pylint:disable=broad-except
211                wrapped = PropertyMappingExpressionException(exc, None)
212                LOGGER.warning(
213                    "failed to evaluate prompt placeholder",
214                    exc=wrapped,
215                )
216                if dry_run:
217                    raise wrapped from exc
218        return self.placeholder
219
220    def get_initial_value(
221        self,
222        prompt_context: dict,
223        user: User,
224        request: HttpRequest,
225        dry_run: bool | None = False,
226    ) -> str:
227        """Get fully interpolated initial value"""
228
229        if self.field_key in prompt_context:
230            # We don't want to parse this as an expression since a user will
231            # be able to control the input
232            value = prompt_context[self.field_key]
233        elif self.initial_value_expression:
234            evaluator = PropertyMappingEvaluator(
235                self, user, request, prompt_context=prompt_context, dry_run=dry_run
236            )
237            try:
238                value = evaluator.evaluate(self.initial_value)
239            except Exception as exc:  # pylint:disable=broad-except
240                wrapped = PropertyMappingExpressionException(exc, None)
241                LOGGER.warning(
242                    "failed to evaluate prompt initial value",
243                    exc=wrapped,
244                )
245                if dry_run:
246                    raise wrapped from exc
247                value = self.initial_value
248        else:
249            value = self.initial_value
250
251        if self.type in CHOICE_FIELDS:
252            # Ensure returned value is a valid choice
253            choices = self.get_choices(prompt_context, user, request)
254            if not choices:
255                return ""
256            if not any(
257                choice.get("value") == value if isinstance(choice, dict) else choice == value
258                for choice in choices
259            ):
260                return choices[0]
261
262        return value
263
264    def field(  # noqa PLR0915
265        self, default: Any | None, choices: list[Any] | None = None
266    ) -> CharField:
267        """Get field type for Challenge and response. Choices are only valid for CHOICE_FIELDS."""
268        field_class = CharField
269        kwargs = {
270            "required": self.required,
271        }
272        match self.type:
273            case FieldTypes.TEXT | FieldTypes.TEXT_AREA:
274                kwargs["trim_whitespace"] = False
275                kwargs["allow_blank"] = not self.required
276            case FieldTypes.TEXT_READ_ONLY, FieldTypes.TEXT_AREA_READ_ONLY:
277                field_class = ReadOnlyField
278                # required can't be set for ReadOnlyField
279                kwargs["required"] = False
280                kwargs["allow_blank"] = True
281            case FieldTypes.EMAIL:
282                field_class = EmailField
283                kwargs["allow_blank"] = not self.required
284            case FieldTypes.NUMBER:
285                field_class = IntegerField
286            case FieldTypes.CHECKBOX:
287                field_class = BooleanField
288                kwargs["required"] = False
289            case FieldTypes.DATE:
290                field_class = DateField
291            case FieldTypes.DATE_TIME:
292                field_class = DateTimeField
293            case FieldTypes.FILE:
294                field_class = InlineFileField
295            case FieldTypes.SEPARATOR:
296                kwargs["required"] = False
297                kwargs["label"] = ""
298            case FieldTypes.HIDDEN:
299                field_class = HiddenField
300                kwargs["required"] = False
301                kwargs["default"] = self.placeholder
302            case FieldTypes.STATIC:
303                kwargs["default"] = self.placeholder
304                kwargs["required"] = False
305                kwargs["label"] = ""
306
307            case FieldTypes.AK_LOCALE:
308                kwargs["allow_blank"] = True
309
310        if self.type in CHOICE_FIELDS:
311            field_class = ChoiceField
312            kwargs["choices"] = []
313            if choices:
314                for choice in choices:
315                    label, value = choice, choice
316                    if isinstance(choice, dict):
317                        label = choice.get("label", "")
318                        value = choice.get("value", "")
319                    kwargs["choices"].append((value, label))
320
321        if default:
322            kwargs["default"] = default
323        # May not set both `required` and `default`
324        if "default" in kwargs:
325            kwargs.pop("required", None)
326        return field_class(**kwargs)
327
328    def save(self, *args, **kwargs):
329        if self.type not in FieldTypes:
330            raise ValueError
331        return super().save(*args, **kwargs)
332
333    def __str__(self):
334        return f"Prompt field '{self.field_key}' type {self.type}"
335
336    class Meta:
337        verbose_name = _("Prompt")
338        verbose_name_plural = _("Prompts")
339
340
341class PromptStage(Stage):
342    """Prompt the user to enter information."""
343
344    fields = models.ManyToManyField(Prompt)
345
346    validation_policies = models.ManyToManyField(Policy, blank=True)
347
348    @property
349    def serializer(self) -> type[BaseSerializer]:
350        from authentik.stages.prompt.api import PromptStageSerializer
351
352        return PromptStageSerializer
353
354    @property
355    def view(self) -> type[View]:
356        from authentik.stages.prompt.stage import PromptStageView
357
358        return PromptStageView
359
360    @property
361    def component(self) -> str:
362        return "ak-stage-prompt-form"
363
364    class Meta:
365        verbose_name = _("Prompt Stage")
366        verbose_name_plural = _("Prompt Stages")