+
−import datetime
+
−import logging
+
−import warnings
+
−
+
−from pyramid.authorization import ACLAuthorizationPolicy
+
−from pyramid_cubicweb.core import get_principals
+
−
+
−from pyramid.authentication import AuthTktAuthenticationPolicy
+
−
+
−log = logging.getLogger(__name__)
+
−
+
−
+
−class CubicWebAuthTktAuthenticationPolicy(AuthTktAuthenticationPolicy):
+
−    """An authentication policy that update the user last_login_time.
+
−
+
−    The update is done in the 'remember' method, which is called on login,
+
−    and each time the authentication ticket is reissued.
+
−
+
−    Meaning, the last_login_time is updated reissue_time seconds (maximum)
+
−    before the last request by the user.
+
−
+
−    Usually used via :func:`includeme`.
+
−    """
+
−
+
−    def remember(self, request, principal, **kw):
+
−        headers = super(CubicWebAuthTktAuthenticationPolicy, self).remember(
+
−            request, principal, **kw)
+
−        try:
+
−            repo = request.registry['cubicweb.repository']
+
−            with repo.internal_cnx() as cnx:
+
−                cnx.execute(
+
−                    "SET U last_login_time %(now)s WHERE U eid %(user)s", {
+
−                        'now': datetime.datetime.now(),
+
−                        'user': principal})
+
−                cnx.commit()
+
−        except:
+
−            log.exception("Failed to update last_login_time")
+
−        return headers
+
−
+
−
+
−def includeme(config):
+
−    """ Activate the CubicWeb AuthTkt authentication policy.
+
−
+
−    Usually called via ``config.include('pyramid_cubicweb.auth')``.
+
−
+
−    See also :ref:`defaults_module`
+
−    """
+
−    secret = config.registry['cubicweb.config']['pyramid-auth-secret']
+
−
+
−    if not secret:
+
−        secret = 'notsosecret'
+
−        warnings.warn('''
+
−
+
−            !! WARNING !! !! WARNING !!
+
−
+
−            The authentication cookies are signed with a static secret key.
+
−            To put your own secret key, edit your all-in-one.conf file
+
−            and set the 'pyramid-auth-secret' key.
+
−
+
−            YOU SHOULD STOP THIS INSTANCE unless your really know what you
+
−            are doing !!
+
−
+
−        ''')
+
−
+
−    config.set_authentication_policy(
+
−        CubicWebAuthTktAuthenticationPolicy(
+
−            secret, callback=get_principals, hashalg='sha512',
+
−            reissue_time=3600))
+
−    config.set_authorization_policy(ACLAuthorizationPolicy())