Utils

hypha.apply.users.utils

get_user_by_email

get_user_by_email(email)

Source code in hypha/apply/users/utils.py

def get_user_by_email(email):
    UserModel = get_user_model()
    qs = UserModel.objects.filter(email__iexact=email)  # case insensitive matching

    # if multiple accounts then check with case sensitive search
    if len(qs) > 1:
        qs = qs.filter(email=email)  # case sensitive matching

    if len(qs) == 0:
        return

    user = qs[0]
    return user

is_user_already_registered

is_user_already_registered(email)

Checks if a specified user is already registered. Returns a tuple containing a boolean value that indicates if the user exists and in case he does whats the duplicated attribute

Source code in hypha/apply/users/utils.py

def is_user_already_registered(email: str) -> tuple[bool, str]:
    """
    Checks if a specified user is already registered.
    Returns a tuple containing a boolean value that indicates if the user exists
    and in case he does whats the duplicated attribute
    """

    user_model = get_user_model()
    if user_model.objects.filter(email__iexact=email):
        return (True, _("Email is already in use."))

    return (False, "")

can_use_oauth_check

can_use_oauth_check(user)

Checks that the user belongs to the whitelisted domains. Anonymous or non-whitelisted email domains cannot log in or associate OAuth accounts

Source code in hypha/apply/users/utils.py

def can_use_oauth_check(user):
    """
    Checks that the user belongs to the whitelisted domains.
    Anonymous or non-whitelisted email domains cannot log in
    or associate OAuth accounts
    """
    try:
        domain = user.email.split("@")[-1]
        whitelisted_domains = {
            *settings.SOCIAL_AUTH_GOOGLE_OAUTH2_WHITELISTED_DOMAINS,
            *settings.SOCIAL_AUTH_OKTA_OAUTH2_WHITELISTED_DOMAINS,
        }
        return domain in whitelisted_domains
    except AttributeError:
        # Anonymous user or setting not defined
        pass
    return False

send_activation_email

send_activation_email(user, site=None, email_template='users/activation/email.txt', email_subject_template='users/activation/email_subject.txt', redirect_url='')

Send the activation email. The activation key is the username, signed using TimestampSigner.

Source code in hypha/apply/users/utils.py

def send_activation_email(
    user,
    site=None,
    email_template="users/activation/email.txt",
    email_subject_template="users/activation/email_subject.txt",
    redirect_url="",
):
    """
    Send the activation email. The activation key is the username,
    signed using TimestampSigner.
    """
    token_generator = PasswordResetTokenGenerator()
    token = token_generator.make_token(user)

    uid = urlsafe_base64_encode(force_bytes(user.pk))

    activation_path = reverse("users:activate", kwargs={"uidb64": uid, "token": token})
    if redirect_url:
        activation_path = f"{activation_path}?next={redirect_url}"

    timeout_minutes = settings.PASSWORD_ACTIVATION_TIMEOUT // 60

    context = {
        "user": user,
        "name": user.get_full_name(),
        "username": user.get_username(),
        "activation_path": activation_path,
        "timeout_minutes": timeout_minutes,
        "ORG_LONG_NAME": settings.ORG_LONG_NAME,
        "ORG_SHORT_NAME": settings.ORG_SHORT_NAME,
    }

    if site:
        context.update(site=site)

    subject = render_to_string(email_subject_template, context)
    # Force subject to a single line to avoid header-injection issues.
    subject = "".join(subject.splitlines())
    message = render_to_string(email_template, context)
    user.email_user(subject, message, settings.DEFAULT_FROM_EMAIL)

send_confirmation_email

send_confirmation_email(user, token, updated_email=None, site=None)

Send the confirmation email. The confirmation token is the update email, signed using TimestampSigner.

Source code in hypha/apply/users/utils.py

def send_confirmation_email(user, token, updated_email=None, site=None):
    """
    Send the confirmation email. The confirmation token is the update email,
    signed using TimestampSigner.
    """

    uid = urlsafe_base64_encode(force_bytes(user.pk))

    activation_path = reverse(
        "users:confirm_email", kwargs={"uidb64": uid, "token": token}
    )

    timeout_minutes = settings.PASSWORD_RESET_TIMEOUT // 60

    context = {
        "user": user,
        "name": user.get_full_name(),
        "username": user.get_username(),
        "unverified_email": updated_email,
        "activation_path": activation_path,
        "timeout_minutes": timeout_minutes,
        "ORG_LONG_NAME": settings.ORG_LONG_NAME,
        "ORG_SHORT_NAME": settings.ORG_SHORT_NAME,
    }

    if site:
        context.update(site=site)

    subject = _("Confirmation email for {unverified_email} at {ORG_LONG_NAME}").format(
        **context
    )
    # Force subject to a single line to avoid header-injection issues.
    subject = "".join(subject.splitlines())
    message = render_to_string("users/email_change/confirm_email.txt", context)
    if updated_email:
        send_mail(subject, message, settings.DEFAULT_FROM_EMAIL, [updated_email])
    else:
        user.email_user(subject, message, settings.DEFAULT_FROM_EMAIL)

get_redirect_url

get_redirect_url(request, redirect_field, success_url_allowed_hosts=None)

Return the user-originating redirect URL if it's safe.

Parameters:

• request (HttpRequest) –

  The request object.

• redirect_field (str) –

  The name of a field containing the redirect URL.

• success_url_allowed_hosts (set, default: None ) –

  A set of allowed hosts for the redirect URL.

Source code in hypha/apply/users/utils.py

def get_redirect_url(
    request, redirect_field: str, success_url_allowed_hosts=None
) -> str:
    """
    Return the user-originating redirect URL if it's safe.

    Args:
        request (HttpRequest): The request object.
        redirect_field (str): The name of a field containing the redirect URL.
        success_url_allowed_hosts (set): A set of allowed hosts for the redirect URL.
    """
    # If no allowed hosts are provided, use settings.ALLOWED_HOSTS
    if success_url_allowed_hosts is None:
        success_url_allowed_hosts = set(settings.ALLOWED_HOSTS)

    # Try to get the redirect URL from the request's POST data, and if it's not
    # there, try to get it from the request's GET data. If it's not in either,
    # default to an empty string.
    redirect_to = request.POST.get(redirect_field, request.GET.get(redirect_field, ""))

    # Check if the redirect URL is safe. If it is, return it. Otherwise, return
    # an empty string.
    url_is_safe = url_has_allowed_host_and_scheme(
        url=redirect_to,
        allowed_hosts={request.get_host(), *success_url_allowed_hosts},
        require_https=request.is_secure(),
    )
    return redirect_to if url_is_safe else ""

generate_numeric_token

generate_numeric_token(length=6)

Generate a random 6 digit string of numbers. We use this formatting to allow leading 0s.

Source code in hypha/apply/users/utils.py

def generate_numeric_token(length=6):
    """
    Generate a random 6 digit string of numbers.
    We use this formatting to allow leading 0s.
    """
    return get_random_string(length, allowed_chars=string.digits)

login_ratelimit_key

login_ratelimit_key(group, request)

Per-account rate-limit key for the two-factor login wizard.

The wizard prefixes its fields, so the account identifier arrives as auth-username, not email. The later steps (OTP, backup token) post no username at all, and neither do the passwordless views that share this decorated dispatch — those fall back to the client IP.

Never return a constant for the missing-field case: django-ratelimit hashes whatever it is given, so every such request would land in a single bucket and any one client could exhaust login for everybody.

Source code in hypha/apply/users/utils.py

def login_ratelimit_key(group, request):
    """Per-account rate-limit key for the two-factor login wizard.

    The wizard prefixes its fields, so the account identifier arrives as
    `auth-username`, not `email`. The later steps (OTP, backup token) post no
    username at all, and neither do the passwordless views that share this
    decorated `dispatch` — those fall back to the client IP.

    Never return a constant for the missing-field case: django-ratelimit hashes
    whatever it is given, so every such request would land in a single bucket
    and any one client could exhaust login for everybody.
    """
    username = request.POST.get("auth-username", "").strip().lower()
    return username or f"ip:{_get_ip(request)}"

update_is_staff

update_is_staff(request, user)

Determine if the user should have is_staff

Django Admin is the only use for is_staff

Parameters:

• request –

  The edit request object (unused)

• user –

  User to modify

Source code in hypha/apply/users/utils.py

def update_is_staff(request, user):
    """Determine if the user should have `is_staff`

    Django Admin is the only use for `is_staff`

    Args:
        request: The edit request object (unused)
        user: [`User`][hypha.apply.users.models.User] to modify

    """

    if not user.is_staff and user.is_apply_staff_admin:
        user.is_staff = True
        user.save()
    elif user.is_staff and not user.is_apply_staff_admin:
        user.is_staff = False
        user.save()

get_zoneinfo

get_zoneinfo(tz_name)

Return a ZoneInfo for tz_name, or None if invalid/empty.

Source code in hypha/apply/users/utils.py

def get_zoneinfo(tz_name):
    """Return a ZoneInfo for tz_name, or None if invalid/empty."""
    if not tz_name:
        return None
    try:
        return zoneinfo.ZoneInfo(tz_name)
    except (zoneinfo.ZoneInfoNotFoundError, KeyError):
        return None

local_event_time

local_event_time(request)

Return a human-readable "now", localised to the user's timezone.

Shared by the account-security notification emails (login, passkey added/removed) so the timestamp line reads the same across them.

Source code in hypha/apply/users/utils.py

def local_event_time(request):
    """Return a human-readable "now", localised to the user's timezone.

    Shared by the account-security notification emails (login, passkey
    added/removed) so the timestamp line reads the same across them.
    """
    tz_name = (
        getattr(request, "session", {}).get("user_timezone", "") if request else ""
    )
    user_tz = get_zoneinfo(tz_name)
    return "{} ({})".format(
        formats.date_format(
            timezone.localtime(timezone=user_tz), "SHORT_DATETIME_FORMAT"
        ),
        tz_name or timezone.get_current_timezone_name(),
    )

passkeys_enabled

passkeys_enabled()

Passkeys require WEBAUTHN_RP_ID in production. In DEBUG (local/dev) we fall back to the request host so the feature can be exercised locally.

Source code in hypha/apply/users/utils.py

def passkeys_enabled() -> bool:
    """Passkeys require WEBAUTHN_RP_ID in production. In DEBUG (local/dev)
    we fall back to the request host so the feature can be exercised locally.
    """
    return bool(getattr(settings, "WEBAUTHN_RP_ID", None)) or settings.DEBUG

strip_html_and_nerf_urls

strip_html_and_nerf_urls(value)

Source code in hypha/apply/users/utils.py

def strip_html_and_nerf_urls(value: str):
    # Remove all HTML tags. This prohibits HTML without creating hurdles.
    cleaned_value = nh3.clean(value, tags=set())
    # Remove all colons and slashes to nerf URLs regardless of HTML tags.
    cleaned_value = cleaned_value.replace(":", "")
    cleaned_value = cleaned_value.replace("/", "")
    return cleaned_value