o h@sddlZddlZddlmZddlmZddlmZddlm Z ddl m Z ddl m Z mZdd lmZmZmZGd d d eZGd d d ee ZdS)N HttpResponseconstant_time_compare)method_decorator) csrf_exempt)View)AnymailInsecureWebhookWarningAnymailWebhookValidationFailure)get_anymail_settingcollect_all_methodsget_request_basic_authcs0eZdZdZdZdZfddZddZZS)AnymailBasicAuthMixinzAImplements webhook basic auth as mixin to AnymailBaseWebhookView.TNc sbtdg|d|_t|jtjr|jg|_|jr$t|jdkr$tdt t t |j di|dS)Nwebhook_secret)defaultkwargszYour Anymail webhooks are insecure and open to anyone on the web. You should set WEBHOOK_SECRET in your ANYMAIL settings. See 'Securing webhooks' in the Anymail docs.) r basic_auth isinstancesix string_typeswarn_if_no_basic_authlenwarningswarnr superr__init__selfr __class__rG/var/www/html/env/lib/python3.10/site-packages/anymail/webhooks/base.pyrs zAnymailBasicAuthMixin.__init__cs@|jrt|tfdd|jD}|std|jdSdS)zHIf configured for webhook basic auth, validate request has correct auth.c3s|]}t|VqdSNr).0 allowed_auth request_authrr# 1sz9AnymailBasicAuthMixin.validate_request..z3Missing or invalid basic auth in Anymail %s webhookN)rranyr esp_name)r requestauth_okrr'r#validate_request*s z&AnymailBasicAuthMixin.validate_request) __name__ __module__ __qualname____doc__rrrr. __classcell__rrr!r#rs  rcsteZdZdZfddZdZddZddZgd Ze e fd d Z d d Z ddZ ddZeddZZS)AnymailBaseWebhookViewzBase view for processing ESP event webhooks ESP-specific implementations should subclass and implement parse_events. They may also want to implement validate_request if additional security is available. c s(tt|jdi|t|jd|_dS)Nr.r)rr4rr r" validatorsrr!rr#rDszAnymailBaseWebhookView.__init__NcCsdS)aCheck validity of webhook post, or raise AnymailWebhookValidationFailure. AnymailBaseWebhookView includes basic auth validation. Subclasses can implement (or provide via mixins) if the ESP supports additional validation (such as signature checking). *All* definitions of this method in the class chain (including mixins) will be called. There is no need to chain to the superclass. (See self.run_validators and collect_all_methods.) Security note: use django.utils.crypto.constant_time_compare for string comparisons, to avoid exposing your validation to a timing attack. Nrr r,rrr#r.Msz'AnymailBaseWebhookView.validate_requestcCst)zzReturn a list of normalized AnymailWebhookEvent extracted from ESP post data. Subclasses must implement. )NotImplementedErrorr6rrr# parse_events`sz#AnymailBaseWebhookView.parse_events)postheadoptionscstt|j|g|Ri|Sr$)rr4dispatchr r,argsrr!rr#r<kszAnymailBaseWebhookView.dispatchcOstSr$rr=rrr#r:oszAnymailBaseWebhookView.headcOs>||||}|j}|D] }|jj|j||dqtS)N)sendereventr+)run_validatorsr8r+signalsendr"r)r r,r>reventsr+r@rrr#r9ss  zAnymailBaseWebhookView.postcCs|jD]}|||qdSr$)r5)r r, validatorrrr#rAs  z%AnymailBaseWebhookView.run_validatorscCstd|jj|jjf)z Read-only name of the ESP for this webhook view. Subclasses must override with class attr. E.g.: esp_name = "Postmark" esp_name = "SendGrid" # (use ESP's preferred capitalization) z&%s.%s must declare esp_name class attr)r7r"r0r/)r rrr#r+s zAnymailBaseWebhookView.esp_name)r/r0r1r2rrBr.r8http_method_namesrrr<r:r9rApropertyr+r3rrr!r#r4;s  r4)rr django.httprdjango.utils.cryptordjango.utils.decoratorsrdjango.views.decorators.csrfrdjango.views.genericr exceptionsr r utilsr r robjectrr4rrrr#s     -