Refresh

apps/core/views.py

@@ -1,12 +1,21 @@
 from __future__ import annotations
 
+import logging
+
 from django.conf import settings
 from django.contrib import messages
+from django.contrib.auth import get_user_model, login
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.views import LoginView
 from django.http import JsonResponse
+from django.shortcuts import redirect
+from django.urls import reverse
+from django.utils.http import url_has_allowed_host_and_scheme
+from django.views.decorators.http import require_POST
 from django.views.generic import TemplateView
 
+from apps.core import entra as entra_sso
+from apps.core.forms import EmailAuthenticationForm
 from apps.core.rate_limit import clear_rate_limit, is_rate_limited, register_rate_limit_failure
 from apps.jobs.services.cockpit import build_dashboard_cockpit
 from apps.profiles.models import SearchProfile
@@ -15,9 +24,32 @@ from apps.sources.services.health import collect_source_health
 from .health import readiness
 from .services.automation import build_automation_cockpit
 
+logger = logging.getLogger(__name__)
+
+SSO_BACKEND = "apps.core.auth_backends.EmailOrUsernameModelBackend"
+SESSION_ENTRA_FLOW = "entra_auth_flow"
+SESSION_ENTRA_NEXT = "entra_next"
+
+
+def _safe_next(request, candidate: str | None) -> str | None:
+    if candidate and url_has_allowed_host_and_scheme(
+        candidate,
+        allowed_hosts={request.get_host()},
+        require_https=request.is_secure(),
+    ):
+        return candidate
+    return None
+
 
 class SecurityAwareLoginView(LoginView):
     template_name = "registration/login.html"
+    authentication_form = EmailAuthenticationForm
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context["entra_enabled"] = entra_sso.entra_enabled()
+        context["demo_enabled"] = bool(getattr(settings, "DEMO_MODE_ENABLED", False))
+        return context
 
     @staticmethod
     def _remaining_minutes(seconds: int) -> str:
@@ -68,6 +100,142 @@ class SecurityAwareLoginView(LoginView):
         return super().form_valid(form)
 
 
+def _split_name(full_name: str) -> tuple[str, str]:
+    parts = full_name.split()
+    if not parts:
+        return "", ""
+    if len(parts) == 1:
+        return parts[0][:150], ""
+    return parts[0][:150], " ".join(parts[1:])[:150]
+
+
+def _unique_username(base: str) -> str:
+    user_model = get_user_model()
+    base = (base or "gebruiker")[:140].strip() or "gebruiker"
+    candidate = base
+    suffix = 1
+    while user_model.objects.filter(username__iexact=candidate).exists():
+        suffix += 1
+        candidate = f"{base}-{suffix}"
+    return candidate
+
+
+def _get_or_create_sso_user(email: str, full_name: str):
+    user_model = get_user_model()
+    user = user_model.objects.filter(email__iexact=email).order_by("id").first()
+    first, last = _split_name(full_name)
+    if user is None:
+        user = user_model(
+            username=_unique_username(email.split("@", 1)[0]),
+            email=email,
+            first_name=first,
+            last_name=last,
+        )
+        user.set_unusable_password()
+        user.save()
+    elif full_name and not (user.first_name or user.last_name):
+        user.first_name, user.last_name = first, last
+        user.save(update_fields=["first_name", "last_name"])
+    return user
+
+
+@require_POST
+def entra_login(request):
+    """Start de Entra ID authorization-code flow."""
+    if not entra_sso.entra_enabled():
+        messages.error(request, "Inloggen via Entra ID is niet ingeschakeld.")
+        return redirect("login")
+    try:
+        config = entra_sso.load_config()
+        redirect_uri = config.redirect_uri or request.build_absolute_uri(
+            reverse("entra-callback")
+        )
+        flow = entra_sso.build_auth_flow(config, redirect_uri)
+    except entra_sso.EntraConfigError as exc:
+        logger.warning("Entra ID niet beschikbaar: %s", exc)
+        messages.error(request, "Inloggen via Entra ID is nu niet beschikbaar.")
+        return redirect("login")
+
+    request.session[SESSION_ENTRA_FLOW] = flow
+    next_url = _safe_next(request, request.POST.get("next"))
+    if next_url:
+        request.session[SESSION_ENTRA_NEXT] = next_url
+    return redirect(flow["auth_uri"])
+
+
+def entra_callback(request):
+    """Verwerk de terugkeer van Microsoft na de SSO-flow."""
+    if not entra_sso.entra_enabled():
+        return redirect("login")
+
+    flow = request.session.pop(SESSION_ENTRA_FLOW, None)
+    next_url = request.session.pop(SESSION_ENTRA_NEXT, None)
+    if not flow:
+        messages.error(request, "De Entra ID-sessie is verlopen. Probeer opnieuw.")
+        return redirect("login")
+
+    try:
+        config = entra_sso.load_config()
+        result = entra_sso.redeem_auth_code(config, flow, request.GET.dict())
+    except entra_sso.EntraConfigError as exc:
+        logger.warning("Entra ID niet beschikbaar: %s", exc)
+        messages.error(request, "Inloggen via Entra ID is nu niet beschikbaar.")
+        return redirect("login")
+
+    if "error" in result:
+        logger.warning(
+            "Entra ID-fout: %s", result.get("error_description") or result.get("error")
+        )
+        messages.error(request, "Inloggen via Entra ID is mislukt.")
+        return redirect("login")
+
+    email, name = entra_sso.extract_identity(result)
+    if not email:
+        messages.error(request, "Entra ID gaf geen e-mailadres terug.")
+        return redirect("login")
+    if not entra_sso.domain_allowed(config, email):
+        messages.error(request, "Dit Entra ID-account mag hier niet inloggen.")
+        return redirect("login")
+
+    user = _get_or_create_sso_user(email, name)
+    login(request, user, backend=SSO_BACKEND)
+    clear_rate_limit(request, namespace="login")
+    return redirect(next_url or settings.LOGIN_REDIRECT_URL)
+
+
+@require_POST
+def demo_login(request):
+    """Log in als afgeschermd demo-account."""
+    if not getattr(settings, "DEMO_MODE_ENABLED", False):
+        messages.error(request, "De demomodus is niet ingeschakeld.")
+        return redirect("login")
+
+    user_model = get_user_model()
+    user, created = user_model.objects.get_or_create(
+        username=settings.DEMO_USERNAME,
+        defaults={
+            "email": settings.DEMO_EMAIL,
+            "first_name": "Demo",
+            "last_name": "Gebruiker",
+        },
+    )
+    if created:
+        user.set_unusable_password()
+        user.save()
+
+    try:
+        from apps.jobs.services.demo_seed import seed_demo_environment
+
+        seed_demo_environment(user)
+    except Exception:
+        # De demo mag nooit de login blokkeren.
+        logger.exception("Kon de demo-omgeving niet seeden")
+
+    login(request, user, backend=SSO_BACKEND)
+    next_url = _safe_next(request, request.POST.get("next"))
+    return redirect(next_url or settings.LOGIN_REDIRECT_URL)
+
+
 def health_live(request):
     return JsonResponse({"ok": True, "service": "vacatureradar"})