tegwick
8be281025b
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
42 lines
1.7 KiB
Python
42 lines
1.7 KiB
Python
import time
|
|
|
|
from django.conf import settings
|
|
from django.contrib.auth import logout
|
|
from django.contrib.auth.middleware import LoginRequiredMiddleware
|
|
from django.contrib.auth.views import redirect_to_login
|
|
from django.http import HttpResponse
|
|
from django.urls import reverse
|
|
from django.utils.cache import add_never_cache_headers
|
|
|
|
|
|
class PilotLoginRequiredMiddleware(LoginRequiredMiddleware):
|
|
"""Use Django's default-deny gate, including full-page HTMX reauthentication."""
|
|
|
|
def process_request(self, request):
|
|
expiry = request.session.get("oidc_expires")
|
|
if expiry is not None and (
|
|
expiry <= time.time()
|
|
or request.user.is_staff
|
|
or request.user.is_superuser
|
|
or not settings.NETKINGDOM_ENABLED
|
|
or request.session.get("oidc_binding")
|
|
!= [
|
|
settings.NETKINGDOM_ISSUER,
|
|
settings.NETKINGDOM_TENANT,
|
|
settings.NETKINGDOM_CLIENT_ID,
|
|
]
|
|
):
|
|
logout(request)
|
|
|
|
def handle_no_permission(self, request, view_func):
|
|
if request.headers.get("HX-Request") == "true":
|
|
# The original URL may render only a fragment or accept only POST.
|
|
login = redirect_to_login(reverse("home"), self.get_login_url(view_func))
|
|
return HttpResponse(status=401, headers={"HX-Redirect": login.url})
|
|
return super().handle_no_permission(request, view_func)
|
|
|
|
def process_response(self, request, response):
|
|
# Company records and account pages must not survive in shared caches.
|
|
if request.path_info != "/health/":
|
|
add_never_cache_headers(response)
|
|
return response
|