datastore: get user by numeric identity attribute

.travis.yml

@@ -61,7 +61,7 @@ deploy:
     secure: xzhkM+54+dmI7aFxWdMxTkHcMfOzuAxcGOpBanY367MyETtmNZUQx1VAQh5381UHiQ0+mg433srWrR4V1h0tsSB31KZAPazeh44zxpJRCv9b5Fx+46PmYW6ZpY8+vqUpFrKCcaLX5ZmEf62xXY3cvMbp0ubAURiV6N+hHyuH90w+3xucrSnFOuVHVuI3Eqp5Bz6zxEKscrIaZiT9CPh0F2jBpGZT8qXCYT1N8xeyH0SCszvKsIIoaPitpQDnoSkBfy6VHiNU6Tznseer6uLzrW80ynKu5mZwjT4mGT0j/rBUcbIpAYHajnsHXL27Gu32mli7beOkgd2vEpb14x5JygkPoYoUnSJlwhRUgAkNZVR5teNOcP87wU6ZAdv1jhfuQA/NUUpZucVpzASojAxf2996krT4hjYz7KJ2z5lSOww016EZ5mxyktGF23KXH9zrCWUv24r1K9JOUH+6OuQHFF40q1YiL2ro63raUdLm/Y3DLgeO6oDXZPMI2DFdRFCSpY2sGI6ZBrU89MuCJhju5Y838hOWQS330UcA71MpcsnmSZDsJ9o+Rrty6wowOdMqx4bmrm0G8ILNK4MosO7KwXZUMj/iV4SLUQjhBLhOTS+vLO8sa7PCZssK7z8C+378Y4Q+hrfsctCCGVBgRhuIr5KSLtKeD3bObQ/4VfIdK9E=
   distributions: "compile_catalog sdist bdist_wheel"
   on:
-    repo: inveniosoftware/flask-security-fork
+    repo: mattupstate/flask-security
     tags: true
     python: "2.7"
     condition: $REQUIREMENTS = release

CHANGES

@@ -1,24 +1,18 @@
-Flask-Security-Fork Changelog
-=============================
+Flask-Security Changelog
+========================
 
-Here you can see the full list of changes between each Flask-Security-Fork release.
+Here you can see the full list of changes between each Flask-Security release.
 
-Version 2.0.1
+Version 3.0.0
 -------------
 
-Released January 18th 2017
+Released TBD
 
 - Added options `SECURITY_EMAIL_PLAINTEXT` and `SECURITY_EMAIL_HTML`
   for sending respecively plaintext and HTML version of email.
 - Fixed validation when missing login information.
 - Fixed condition for token extraction from JSON body.
 - Better support for universal bdist wheel.
-
-Version 2.0.0
--------------
-
-Released January 11th 2017
-
 - Added port of CLI using Click configurable using options
   `SECURITY_CLI_USERS_NAME` and `SECURITY_CLI_ROLES_NAME`.
 - Added new configuration option `SECURITY_DATETIME_FACTORY` which can
@@ -27,30 +21,12 @@ Released January 11th 2017
 - Better IP tracking if using Flask 0.12.
 - Renamed deprecated Flask-WFT base form class.
 - Added tests for custom forms configured using app config.
-
-Version 1.8.2
--------------
-
-Released December 20th 2016
-
 - Added validation and tests for next argument in logout endpoint. (see #499)
 - Bumped minimal required versions of several packages.
 - Extended test matric on Travis CI for minimal and released package versions.
 - Added of .editorconfig and forced tests for code style.
-
-Version 1.8.1
--------------
-
-Released November 15th 2016
-
 - Fixed a security bug when validating a confirmation token, also checks
   if the email that the token was created with matches the user's current email.
-
-Version 1.8.0
--------------
-
-Released October 28th 2016
-
 - Replaced token loader with request loader.
 - Changed trackable behavior of `login_user` when IP can not be detected from a request from 'untrackable' to `None` value.
 - Use ProxyFix instead of inspecting X-Forwarded-For header.
@@ -70,11 +46,6 @@ Released October 28th 2016
 - Removed a duplicate line ('retype_password': 'Retype Password') in forms.py.
 - Various documentation improvement.
 
-Flask-Security Changelog
-========================
-
-Here you can see the full list of changes between each Flask-Security release.
-
 Version 1.7.5
 -------------
 

README.rst

@@ -1,30 +1,28 @@
-Flask-Security-Fork
+Flask-Security
 ===================
 
-.. image:: https://img.shields.io/travis/inveniosoftware/flask-security-fork.svg
-    :target: https://travis-ci.org/inveniosoftware/flask-security-fork
+.. image:: https://img.shields.io/travis/mattupstate/flask-security.svg
+    :target: https://travis-ci.org/mattupstate/flask-security
 
-.. image:: https://img.shields.io/coveralls/inveniosoftware/flask-security-fork.svg
-    :target: https://coveralls.io/r/inveniosoftware/flask-security-fork
+.. image:: https://img.shields.io/coveralls/mattupstate/flask-security.svg
+    :target: https://coveralls.io/r/mattupstate/flask-security
 
-.. image:: https://img.shields.io/github/tag/inveniosoftware/flask-security-fork.svg
-    :target: https://github.com/inveniosoftware/flask-security-fork/releases
+.. image:: https://img.shields.io/github/tag/mattupstate/flask-security.svg
+    :target: https://github.com/mattupstate/flask-security/releases
 
-.. image:: https://img.shields.io/pypi/dm/flask-security-fork.svg
-    :target: https://pypi.python.org/pypi/flask-security-fork
+.. image:: https://img.shields.io/pypi/dm/flask-security.svg
+    :target: https://pypi.python.org/pypi/flask-security
     :alt: Downloads
 
-.. image:: https://img.shields.io/github/license/inveniosoftware/flask-security-fork.svg
-    :target: https://github.com/inveniosoftware/flask-security-fork/blob/master/LICENSE
+.. image:: https://img.shields.io/github/license/mattupstate/flask-security.svg
+    :target: https://github.com/mattupstate/flask-security/blob/master/LICENSE
     :alt: License
 
-This is a fork of the official Flask-Security extension.
-
 It quickly adds security features to your Flask application.
 
 Resources
 ---------
 
-- `Documentation <https://flask-security-fork.readthedocs.io/>`_
+- `Documentation <https://flask-security.readthedocs.io/>`_
 - `Issue Tracker <https://github.com/mattupstate/flask-security/issues>`_
-- `Code <https://github.com/inveniosoftware/flask-security-fork/>`_
+- `Code <https://github.com/mattupstate/flask-security/>`_

docs/conf.py

@@ -100,7 +100,7 @@
 # further.  For a list of options available for each theme, see the
 # documentation.
 html_theme_options = {
-    # 'github_fork': 'mattupstate/flask-security',
+    'github_fork': 'mattupstate/flask-security',
     # 'index_logo': False
     'touch_icon': 'touch-icon.png',
     'index_logo': 'logo-full.png'

docs/features.rst

@@ -129,8 +129,8 @@ Run ``flask --help`` and look for users and roles.
 
 
 .. _Click: http://packages.python.org/Click/
-.. _Flask-Login: http://packages.python.org/Flask-Login/
-.. _alternative token: http://packages.python.org/Flask-Login/#alternative-tokens
+.. _Flask-Login: https://flask-login.readthedocs.org/en/latest/
+.. _alternative token: https://flask-login.readthedocs.io/en/latest/#alternative-tokens
 .. _Flask-Principal: http://packages.python.org/Flask-Principal/
 .. _documentation on this topic: http://packages.python.org/Flask-Principal/#granular-resource-protection
 .. _passlib: http://packages.python.org/passlib/

docs/index.rst

@@ -18,7 +18,7 @@ Flask application. They include:
 Many of these features are made possible by integrating various Flask extensions
 and libraries. They include:
 
-1. `Flask-Login <http://packages.python.org/Flask-Login/>`_
+1. `Flask-Login <https://flask-login.readthedocs.org/en/latest/>`_
 2. `Flask-Mail <http://packages.python.org/Flask-Mail/>`_
 3. `Flask-Principal <http://packages.python.org/Flask-Principal/>`_
 4. `Flask-WTF <http://packages.python.org/Flask-WTF/>`_

docs/quickstart.rst

@@ -17,7 +17,7 @@ SQLAlchemy Install requirements
 ::
 
      $ mkvirtualenv <your-app-name>
-     $ pip install flask-security-fork flask-sqlalchemy
+     $ pip install flask-security flask-sqlalchemy
 
 
 SQLAlchemy Application
@@ -90,7 +90,7 @@ SQLAlchemy Install requirements
 ::
 
      $ mkvirtualenv <your-app-name>
-     $ pip install flask-security-fork sqlalchemy
+     $ pip install flask-security sqlalchemy
 
 Also, you can use the extension `Flask-SQLAlchemy-Session documentation
 <http://flask-sqlalchemy-session.readthedocs.io/en/v1.1/>`_.
@@ -206,7 +206,7 @@ MongoEngine Install requirements
 ::
 
     $ mkvirtualenv <your-app-name>
-    $ pip install flask-security-fork flask-mongoengine
+    $ pip install flask-security flask-mongoengine
 
 MongoEngine Application
 ~~~~~~~~~~~~~~~~~~~~~~~
@@ -273,7 +273,7 @@ Peewee Install requirements
 ::
 
     $ mkvirtualenv <your-app-name>
-    $ pip install flask-security-fork flask-peewee
+    $ pip install flask-security flask-peewee
 
 Peewee Application
 ~~~~~~~~~~~~~~~~~~

flask_security/core.py

@@ -250,7 +250,7 @@ def _on_identity_loaded(sender, identity):
     if hasattr(current_user, 'id'):
         identity.provides.add(UserNeed(current_user.id))
 
-    for role in current_user.roles:
+    for role in getattr(current_user, 'roles', []):
         identity.provides.add(RoleNeed(role.name))
 
     identity.user = current_user

flask_security/datastore.py

@@ -133,6 +133,13 @@ def _prepare_create_user_args(self, **kwargs):
         kwargs['roles'] = roles
         return kwargs
 
+    def _is_numeric(self, value):
+        try:
+            int(value)
+        except (TypeError, ValueError):
+            return False
+        return True
+
     def get_user(self, id_or_email):
         """Returns a user matching the specified ID or email address."""
         raise NotImplementedError
@@ -233,21 +240,15 @@ def __init__(self, db, user_model, role_model):
         UserDatastore.__init__(self, user_model, role_model)
 
     def get_user(self, identifier):
-        if self._is_numeric(identifier):
-            return self.user_model.query.get(identifier)
+        rv = self.user_model.query.get(identifier)
+        if rv is not None:
+            return rv
         for attr in get_identity_attributes():
             query = getattr(self.user_model, attr).ilike(identifier)
             rv = self.user_model.query.filter(query).first()
             if rv is not None:
                 return rv
 
-    def _is_numeric(self, value):
-        try:
-            int(value)
-        except (TypeError, ValueError):
-            return False
-        return True
-
     def find_user(self, **kwargs):
         return self.user_model.query.filter_by(**kwargs).first()
 
@@ -296,10 +297,13 @@ def get_user(self, identifier):
         from mongoengine import ValidationError
         try:
             return self.user_model.objects(id=identifier).first()
-        except ValidationError:
+        except (ValidationError, ValueError):
             pass
+
+        is_numeric = self._is_numeric(identifier)
+
         for attr in get_identity_attributes():
-            query_key = '%s__iexact' % attr
+            query_key = attr if is_numeric else '%s__iexact' % attr
             query = {query_key: identifier}
             rv = self.user_model.objects(**query).first()
             if rv is not None:
@@ -347,7 +351,7 @@ def __init__(self, db, user_model, role_model, role_link):
     def get_user(self, identifier):
         try:
             return self.user_model.get(self.user_model.id == identifier)
-        except ValueError:
+        except (self.user_model.DoesNotExist, ValueError):
             pass
 
         for attr in get_identity_attributes():
@@ -429,22 +433,21 @@ def __init__(self, db, user_model, role_model):
 
     @with_pony_session
     def get_user(self, identifier):
-        if self._is_numeric(identifier):
+        from pony.orm.core import ObjectNotFound
+        try:
             return self.user_model[identifier]
+        except (ObjectNotFound, ValueError):
+            pass
 
         for attr in get_identity_attributes():
             # this is a nightmare, tl;dr we need to get the thing that
             # corresponds to email (usually)
-            user = self.user_model.get(**{attr: identifier})
-            if user is not None:
-                return user
-
-    def _is_numeric(self, value):
-        try:
-            int(value)
-        except ValueError:
-            return False
-        return True
+            try:
+                user = self.user_model.get(**{attr: identifier})
+                if user is not None:
+                    return user
+            except TypeError:
+                pass
 
     @with_pony_session
     def find_user(self, **kwargs):