32 lines
1 KiB
Python
32 lines
1 KiB
Python
from django.shortcuts import redirect
|
|
from django.utils.deprecation import MiddlewareMixin
|
|
|
|
from ..models import TwoFactorConfig
|
|
|
|
|
|
class TwoFactorMiddleware(MiddlewareMixin):
|
|
"""Enforces 2FA verification for users who have it configured."""
|
|
|
|
EXEMPT_PATHS = [
|
|
"/api/auth/login/",
|
|
"/api/auth/logout/",
|
|
"/api/auth/2fa/verify/",
|
|
"/api/auth/2fa/recovery/",
|
|
"/api/auth/check/",
|
|
]
|
|
|
|
def process_request(self, request):
|
|
if not hasattr(request, "user") or not request.user.is_authenticated:
|
|
return None
|
|
if request.path in self.EXEMPT_PATHS:
|
|
return None
|
|
if request.path.startswith("/admin/"):
|
|
return None
|
|
try:
|
|
tfa = TwoFactorConfig.objects.get(user=request.user)
|
|
if tfa.is_enabled and tfa.is_configured:
|
|
if not getattr(request, "_2fa_verified", False):
|
|
return redirect("2fa-verify")
|
|
except TwoFactorConfig.DoesNotExist:
|
|
pass
|
|
return None
|