B

a�N��@s.dZd
dl
mZ
Gdd�de�Zd	dd�
ZdS)
z-
Grant roles and logins based on IP address.
�)
�ip4c@s2eZ
dZd
Zddd�
Zdd�Zdd�Zd	d
�ZdS)
�GrantIPMiddlewarea
    On each request, ``ip_map`` is checked against ``REMOTE_ADDR``
    and logins and roles are assigned based on that.

    ``ip_map`` is a map of {ip_mask: (username, roles)}.  Either
    ``username`` or ``roles`` may be None.  Roles may also be prefixed
    with ``-``, like ``'-system'`` meaning that role should be
    revoked.  ``'__remove__'`` for a username will remove the username.

    If ``clobber_username`` is true (default) then any user
    specification will override the current value of ``REMOTE_USER``.
    ``'__remove__'`` will always clobber the username.

    ``ip_mask`` is something that `paste.util.ip4:IP4Range
    <class-paste.util.ip4.IP4Range.html>`_ can parse.  Simple IP
    addresses, IP/mask, ip<->ip ranges, and hostnames are allowed.
    Tc	CsR|
|_g|_
x:|��D].\}}|j
�t�|�
|�|d
|d�f�

qW||_dS)Nr
�
)�app�ip_map�items�appendrZIP4Range�_convert_user_role�clobber_username)�selfrrr
�key�value�r�C/opt/alt/python37/lib/python3.7/site-packages/paste/auth/grantip.py�__init__s





zGrantIPMiddleware.__init__cCs |rt|t
�r|�d
�
}|
|fS)N�
,)�
isinstance�
basestring�split)r�username�rolesrrrr	$s



z$GrantIPMiddleware._convert_user_rolec	Cs�t�
|
d
d�}d}g}xV|jD]L\}\}}||kr |rB|�|�

|dkrPd}q |r |
�d�
rd|jr ||
d<q W|r�d|
kr�|
d=|r�|�|
|�
|�|
|�S)NZREMOTE_ADDRFZ
__remove__TZREMOTE_USER)rZip2intr�extend�getr
�
_set_rolesr)	r�environZstart_response�addrZremove_userZ	add_roles�rangerrrrr�__call__)s$



















zGrantIPMiddleware.__call__cCs�|
�d
d��
d�
}td|�}g}x<|D]4}|�d�
rH|�|dd��

q&||kr&|�|�

q&Wx|D]}||krd|�|�

qdWd�|�
|
d
<dS)NZREMOTE_USER_TOKENS�r�
-r)rr�filter�
startswithr�remove�join)rrrZ	cur_rolesZremove_roles�rolerrrr=s













zGrantIPMiddleware._set_rolesN)
T)�__name__�
__module__�__qualname__�__doc__rr	rrrrrrrs

rFc
Ks|d
dlm
}
||�
}i}xV|��D]J\}}d|krD|�dd�\}}	n|}d}	|dkrXd}|	dkrdd}	|||<q"Wt|||�S)a�

    Grant roles or usernames based on IP addresses.

    Config looks like this::

      [filter:grant]
      use = egg:Paste#grantip
      clobber_username = true
      # Give localhost system role (no username):
      127.0.0.1 = -:system
      # Give everyone in 192.168.0.* editor role:
      192.168.0.0/24 = -:editor
      # Give one IP the username joe:
      192.168.0.7 = joe
      # And one IP is should not be logged in:
      192.168.0.10 = __remove__:-editor
      
    r
)
�asbool�
:rrr)Zpaste.deploy.convertersr)rrr)
rZglobal_confr
�kwr)rrr
rr$rrr�make_grantipNs











r,N)
F)r(Z
paste.utilr�objectrr,rrrr�<module>s
F