Add auth module to thirdpart

thirdpart/auth/__init__.py

@@ -0,0 +1,103 @@
+import datetime
+from warnings import warn
+from django.core.exceptions import ImproperlyConfigured
+from django.utils.importlib import import_module
+
+SESSION_KEY = '_auth_user_id'
+BACKEND_SESSION_KEY = '_auth_user_backend'
+REDIRECT_FIELD_NAME = 'next'
+
+def load_backend(path):
+    i = path.rfind('.')
+    module, attr = path[:i], path[i+1:]
+    try:
+        mod = import_module(module)
+    except ImportError, e:
+        raise ImproperlyConfigured('Error importing authentication backend %s: "%s"' % (module, e))
+    except ValueError, e:
+        raise ImproperlyConfigured('Error importing authentication backends. Is AUTHENTICATION_BACKENDS a correctly defined list or tuple?')
+    try:
+        cls = getattr(mod, attr)
+    except AttributeError:
+        raise ImproperlyConfigured('Module "%s" does not define a "%s" authentication backend' % (module, attr))
+    try:
+        getattr(cls, 'supports_object_permissions')
+    except AttributeError:
+        warn("Authentication backends without a `supports_object_permissions` attribute are deprecated. Please define it in %s." % cls,
+             PendingDeprecationWarning)
+        cls.supports_object_permissions = False
+    try:
+        getattr(cls, 'supports_anonymous_user')
+    except AttributeError:
+        warn("Authentication backends without a `supports_anonymous_user` attribute are deprecated. Please define it in %s." % cls,
+             PendingDeprecationWarning)
+        cls.supports_anonymous_user = False
+    return cls()
+
+def get_backends():
+    from django.conf import settings
+    backends = []
+    for backend_path in settings.AUTHENTICATION_BACKENDS:
+        backends.append(load_backend(backend_path))
+    return backends
+
+def authenticate(**credentials):
+    """
+    If the given credentials are valid, return a User object.
+    """
+    for backend in get_backends():
+        try:
+            user = backend.authenticate(**credentials)
+        except TypeError:
+            # This backend doesn't accept these credentials as arguments. Try the next one.
+            continue
+        if user is None:
+            continue
+        # Annotate the user object with the path of the backend.
+        user.backend = "%s.%s" % (backend.__module__, backend.__class__.__name__)
+        return user
+
+def login(request, user):
+    """
+    Persist a user id and a backend in the request. This way a user doesn't
+    have to reauthenticate on every request.
+    """
+    if user is None:
+        user = request.user
+    # TODO: It would be nice to support different login methods, like signed cookies.
+    user.last_login = datetime.datetime.now()
+    user.save()
+
+    if SESSION_KEY in request.session:
+        if request.session[SESSION_KEY] != user.id:
+            # To avoid reusing another user's session, create a new, empty
+            # session if the existing session corresponds to a different
+            # authenticated user.
+            request.session.flush()
+    else:
+        request.session.cycle_key()
+    request.session[SESSION_KEY] = user.id
+    request.session[BACKEND_SESSION_KEY] = user.backend
+    if hasattr(request, 'user'):
+        request.user = user
+
+def logout(request):
+    """
+    Removes the authenticated user's ID from the request and flushes their
+    session data.
+    """
+    request.session.flush()
+    if hasattr(request, 'user'):
+        from django.contrib.auth.models import AnonymousUser
+        request.user = AnonymousUser()
+
+def get_user(request):
+    from django.contrib.auth.models import AnonymousUser
+    try:
+        user_id = request.session[SESSION_KEY]
+        backend_path = request.session[BACKEND_SESSION_KEY]
+        backend = load_backend(backend_path)
+        user = backend.get_user(user_id) or AnonymousUser()
+    except KeyError:
+        user = AnonymousUser()
+    return user

thirdpart/auth/admin.py

@@ -0,0 +1,143 @@
+from django import template
+from django.db import transaction
+from django.conf import settings
+from django.contrib import admin
+from django.contrib.auth.forms import UserCreationForm, UserChangeForm, AdminPasswordChangeForm
+from django.contrib.auth.models import User, Group
+from django.contrib import messages
+from django.core.exceptions import PermissionDenied
+from django.http import HttpResponseRedirect, Http404
+from django.shortcuts import render_to_response, get_object_or_404
+from django.template import RequestContext
+from django.utils.html import escape
+from django.utils.decorators import method_decorator
+from django.utils.translation import ugettext, ugettext_lazy as _
+from django.views.decorators.csrf import csrf_protect
+
+csrf_protect_m = method_decorator(csrf_protect)
+
+class GroupAdmin(admin.ModelAdmin):
+    search_fields = ('name',)
+    ordering = ('name',)
+    filter_horizontal = ('permissions',)
+
+class UserAdmin(admin.ModelAdmin):
+    add_form_template = 'admin/auth/user/add_form.html'
+    change_user_password_template = None
+    fieldsets = (
+        (None, {'fields': ('username', 'password')}),
+        (_('Personal info'), {'fields': ('first_name', 'last_name', 'email')}),
+        (_('Permissions'), {'fields': ('is_active', 'is_staff', 'is_superuser', 'user_permissions')}),
+        (_('Important dates'), {'fields': ('last_login', 'date_joined')}),
+        (_('Groups'), {'fields': ('groups',)}),
+    )
+    add_fieldsets = (
+        (None, {
+            'classes': ('wide',),
+            'fields': ('username', 'password1', 'password2')}
+        ),
+    )
+    form = UserChangeForm
+    add_form = UserCreationForm
+    change_password_form = AdminPasswordChangeForm
+    list_display = ('username', 'email', 'first_name', 'last_name', 'is_staff')
+    list_filter = ('is_staff', 'is_superuser', 'is_active')
+    search_fields = ('username', 'first_name', 'last_name', 'email')
+    ordering = ('username',)
+    filter_horizontal = ('user_permissions',)
+
+    def __call__(self, request, url):
+        # this should not be here, but must be due to the way __call__ routes
+        # in ModelAdmin.
+        if url is None:
+            return self.changelist_view(request)
+        if url.endswith('password'):
+            return self.user_change_password(request, url.split('/')[0])
+        return super(UserAdmin, self).__call__(request, url)
+
+    def get_fieldsets(self, request, obj=None):
+        if not obj:
+            return self.add_fieldsets
+        return super(UserAdmin, self).get_fieldsets(request, obj)
+
+    def get_form(self, request, obj=None, **kwargs):
+        """
+        Use special form during user creation
+        """
+        defaults = {}
+        if obj is None:
+            defaults.update({
+                'form': self.add_form,
+                'fields': admin.util.flatten_fieldsets(self.add_fieldsets),
+            })
+        defaults.update(kwargs)
+        return super(UserAdmin, self).get_form(request, obj, **defaults)
+
+    def get_urls(self):
+        from django.conf.urls.defaults import patterns
+        return patterns('',
+            (r'^(\d+)/password/$', self.admin_site.admin_view(self.user_change_password))
+        ) + super(UserAdmin, self).get_urls()
+
+    @csrf_protect_m
+    @transaction.commit_on_success
+    def add_view(self, request, form_url='', extra_context=None):
+        # It's an error for a user to have add permission but NOT change
+        # permission for users. If we allowed such users to add users, they
+        # could create superusers, which would mean they would essentially have
+        # the permission to change users. To avoid the problem entirely, we
+        # disallow users from adding users if they don't have change
+        # permission.
+        if not self.has_change_permission(request):
+            if self.has_add_permission(request) and settings.DEBUG:
+                # Raise Http404 in debug mode so that the user gets a helpful
+                # error message.
+                raise Http404('Your user does not have the "Change user" permission. In order to add users, Django requires that your user account have both the "Add user" and "Change user" permissions set.')
+            raise PermissionDenied
+        if extra_context is None:
+            extra_context = {}
+        defaults = {
+            'auto_populated_fields': (),
+            'username_help_text': self.model._meta.get_field('username').help_text,
+        }
+        extra_context.update(defaults)
+        return super(UserAdmin, self).add_view(request, form_url, extra_context)
+
+    def user_change_password(self, request, id):
+        if not self.has_change_permission(request):
+            raise PermissionDenied
+        user = get_object_or_404(self.model, pk=id)
+        if request.method == 'POST':
+            form = self.change_password_form(user, request.POST)
+            if form.is_valid():
+                new_user = form.save()
+                msg = ugettext('Password changed successfully.')
+                messages.success(request, msg)
+                return HttpResponseRedirect('..')
+        else:
+            form = self.change_password_form(user)
+
+        fieldsets = [(None, {'fields': form.base_fields.keys()})]
+        adminForm = admin.helpers.AdminForm(form, fieldsets, {})
+
+        return render_to_response(self.change_user_password_template or 'admin/auth/user/change_password.html', {
+            'title': _('Change password: %s') % escape(user.username),
+            'adminForm': adminForm,
+            'form': form,
+            'is_popup': '_popup' in request.REQUEST,
+            'add': True,
+            'change': False,
+            'has_delete_permission': False,
+            'has_change_permission': True,
+            'has_absolute_url': False,
+            'opts': self.model._meta,
+            'original': user,
+            'save_as': False,
+            'show_save': True,
+            'root_path': self.admin_site.root_path,
+        }, context_instance=RequestContext(request))
+
+
+admin.site.register(Group, GroupAdmin)
+admin.site.register(User, UserAdmin)
+

thirdpart/auth/backends.py

@@ -0,0 +1,119 @@
+from django.db import connection
+from django.contrib.auth.models import User, Permission
+
+
+class ModelBackend(object):
+    """
+    Authenticates against django.contrib.auth.models.User.
+    """
+    supports_object_permissions = False
+    supports_anonymous_user = True
+
+    # TODO: Model, login attribute name and password attribute name should be
+    # configurable.
+    def authenticate(self, username=None, password=None):
+        try:
+            user = User.objects.get(username=username)
+            if user.check_password(password):
+                return user
+        except User.DoesNotExist:
+            return None
+
+    def get_group_permissions(self, user_obj):
+        """
+        Returns a set of permission strings that this user has through his/her
+        groups.
+        """
+        if not hasattr(user_obj, '_group_perm_cache'):
+            perms = Permission.objects.filter(group__user=user_obj
+                ).values_list('content_type__app_label', 'codename'
+                ).order_by()
+            user_obj._group_perm_cache = set(["%s.%s" % (ct, name) for ct, name in perms])
+        return user_obj._group_perm_cache
+
+    def get_all_permissions(self, user_obj):
+        if user_obj.is_anonymous():
+            return set()
+        if not hasattr(user_obj, '_perm_cache'):
+            user_obj._perm_cache = set([u"%s.%s" % (p.content_type.app_label, p.codename) for p in user_obj.user_permissions.select_related()])
+            user_obj._perm_cache.update(self.get_group_permissions(user_obj))
+        return user_obj._perm_cache
+
+    def has_perm(self, user_obj, perm):
+        return perm in self.get_all_permissions(user_obj)
+
+    def has_module_perms(self, user_obj, app_label):
+        """
+        Returns True if user_obj has any permissions in the given app_label.
+        """
+        for perm in self.get_all_permissions(user_obj):
+            if perm[:perm.index('.')] == app_label:
+                return True
+        return False
+
+    def get_user(self, user_id):
+        try:
+            return User.objects.get(pk=user_id)
+        except User.DoesNotExist:
+            return None
+
+
+class RemoteUserBackend(ModelBackend):
+    """
+    This backend is to be used in conjunction with the ``RemoteUserMiddleware``
+    found in the middleware module of this package, and is used when the server
+    is handling authentication outside of Django.
+
+    By default, the ``authenticate`` method creates ``User`` objects for
+    usernames that don't already exist in the database.  Subclasses can disable
+    this behavior by setting the ``create_unknown_user`` attribute to
+    ``False``.
+    """
+
+    # Create a User object if not already in the database?
+    create_unknown_user = True
+
+    def authenticate(self, remote_user):
+        """
+        The username passed as ``remote_user`` is considered trusted.  This
+        method simply returns the ``User`` object with the given username,
+        creating a new ``User`` object if ``create_unknown_user`` is ``True``.
+
+        Returns None if ``create_unknown_user`` is ``False`` and a ``User``
+        object with the given username is not found in the database.
+        """
+        if not remote_user:
+            return
+        user = None
+        username = self.clean_username(remote_user)
+
+        # Note that this could be accomplished in one try-except clause, but
+        # instead we use get_or_create when creating unknown users since it has
+        # built-in safeguards for multiple threads.
+        if self.create_unknown_user:
+            user, created = User.objects.get_or_create(username=username)
+            if created:
+                user = self.configure_user(user)
+        else:
+            try:
+                user = User.objects.get(username=username)
+            except User.DoesNotExist:
+                pass
+        return user
+
+    def clean_username(self, username):
+        """
+        Performs any cleaning on the "username" prior to using it to get or
+        create the user object.  Returns the cleaned username.
+
+        By default, returns the username unchanged.
+        """
+        return username
+
+    def configure_user(self, user):
+        """
+        Configures a user after creation and returns the updated user.
+
+        By default, returns the user unmodified.
+        """
+        return user

thirdpart/auth/context_processors.py

@@ -0,0 +1,33 @@
+from django.core.context_processors import PermWrapper
+from django.utils.functional import lazy, memoize, SimpleLazyObject
+from django.contrib import messages
+
+def auth(request):
+    """
+    Returns context variables required by apps that use Django's authentication
+    system.
+
+    If there is no 'user' attribute in the request, uses AnonymousUser (from
+    django.contrib.auth).
+    """
+    # If we access request.user, request.session is accessed, which results in
+    # 'Vary: Cookie' being sent in every request that uses this context
+    # processor, which can easily be every request on a site if
+    # TEMPLATE_CONTEXT_PROCESSORS has this context processor added.  This kills
+    # the ability to cache.  So, we carefully ensure these attributes are lazy.
+    # We don't use django.utils.functional.lazy() for User, because that
+    # requires knowing the class of the object we want to proxy, which could
+    # break with custom auth backends.  LazyObject is a less complete but more
+    # flexible solution that is a good enough wrapper for 'User'.
+    def get_user():
+        if hasattr(request, 'user'):
+            return request.user
+        else:
+            from django.contrib.auth.models import AnonymousUser
+            return AnonymousUser()
+
+    return {
+        'user': SimpleLazyObject(get_user),
+        'messages': messages.get_messages(request),
+        'perms':  lazy(lambda: PermWrapper(get_user()), PermWrapper)(),
+    }

thirdpart/auth/create_superuser.py

@@ -0,0 +1,8 @@
+"""
+Create a superuser from the command line. Deprecated; use manage.py
+createsuperuser instead.
+"""
+
+if __name__ == "__main__":
+    from django.core.management import call_command
+    call_command("createsuperuser")

thirdpart/auth/decorators.py

@@ -0,0 +1,52 @@
+try:
+    from functools import update_wrapper, wraps
+except ImportError:
+    from django.utils.functional import update_wrapper, wraps  # Python 2.4 fallback.
+
+from django.contrib.auth import REDIRECT_FIELD_NAME
+from django.http import HttpResponseRedirect
+from django.utils.decorators import available_attrs
+from django.utils.http import urlquote
+
+
+def user_passes_test(test_func, login_url=None, redirect_field_name=REDIRECT_FIELD_NAME):
+    """
+    Decorator for views that checks that the user passes the given test,
+    redirecting to the log-in page if necessary. The test should be a callable
+    that takes the user object and returns True if the user passes.
+    """
+    if not login_url:
+        from django.conf import settings
+        login_url = settings.LOGIN_URL
+
+    def decorator(view_func):
+        def _wrapped_view(request, *args, **kwargs):
+            if test_func(request.user):
+                return view_func(request, *args, **kwargs)
+            path = urlquote(request.get_full_path())
+            tup = login_url, redirect_field_name, path
+            return HttpResponseRedirect('%s?%s=%s' % tup)
+        return wraps(view_func, assigned=available_attrs(view_func))(_wrapped_view)
+    return decorator
+
+
+def login_required(function=None, redirect_field_name=REDIRECT_FIELD_NAME):
+    """
+    Decorator for views that checks that the user is logged in, redirecting
+    to the log-in page if necessary.
+    """
+    actual_decorator = user_passes_test(
+        lambda u: u.is_authenticated(),
+        redirect_field_name=redirect_field_name
+    )
+    if function:
+        return actual_decorator(function)
+    return actual_decorator
+
+
+def permission_required(perm, login_url=None):
+    """
+    Decorator for views that checks whether a user has a particular permission
+    enabled, redirecting to the log-in page if necessary.
+    """
+    return user_passes_test(lambda u: u.has_perm(perm), login_url=login_url)

thirdpart/auth/fixtures/authtestdata.json

@@ -0,0 +1,56 @@
+[
+    {
+        "pk": "1", 
+        "model": "auth.user", 
+        "fields": {
+            "username": "testclient", 
+            "first_name": "Test", 
+            "last_name": "Client", 
+            "is_active": true, 
+            "is_superuser": false, 
+            "is_staff": false, 
+            "last_login": "2006-12-17 07:03:31", 
+            "groups": [], 
+            "user_permissions": [], 
+            "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", 
+            "email": "testclient@example.com", 
+            "date_joined": "2006-12-17 07:03:31"
+        }
+    },
+    {
+        "pk": "2", 
+        "model": "auth.user", 
+        "fields": {
+            "username": "inactive", 
+            "first_name": "Inactive", 
+            "last_name": "User", 
+            "is_active": false, 
+            "is_superuser": false, 
+            "is_staff": false, 
+            "last_login": "2006-12-17 07:03:31", 
+            "groups": [], 
+            "user_permissions": [], 
+            "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", 
+            "email": "testclient@example.com", 
+            "date_joined": "2006-12-17 07:03:31"
+        }
+    },
+    {
+        "pk": "3", 
+        "model": "auth.user", 
+        "fields": {
+            "username": "staff", 
+            "first_name": "Staff", 
+            "last_name": "Member", 
+            "is_active": true, 
+            "is_superuser": false, 
+            "is_staff": true, 
+            "last_login": "2006-12-17 07:03:31", 
+            "groups": [], 
+            "user_permissions": [], 
+            "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", 
+            "email": "staffmember@example.com", 
+            "date_joined": "2006-12-17 07:03:31"
+        }
+    }
+]

thirdpart/auth/forms.py

@@ -0,0 +1,214 @@
+from django.contrib.auth.models import User
+from django.contrib.auth import authenticate
+from django.contrib.auth.tokens import default_token_generator
+from django.contrib.sites.models import Site
+from django.template import Context, loader
+from django import forms
+from django.utils.translation import ugettext_lazy as _
+from django.utils.http import int_to_base36
+
+class UserCreationForm(forms.ModelForm):
+    """
+    A form that creates a user, with no privileges, from the given username and password.
+    """
+    username = forms.RegexField(label=_("Username"), max_length=30, regex=r'^[\w.@+-]+$',
+        help_text = _("Required. 30 characters or fewer. Letters, digits and @/./+/-/_ only."),
+        error_messages = {'invalid': _("This value may contain only letters, numbers and @/./+/-/_ characters.")})
+    password1 = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
+    password2 = forms.CharField(label=_("Password confirmation"), widget=forms.PasswordInput,
+        help_text = _("Enter the same password as above, for verification."))
+
+    class Meta:
+        model = User
+        fields = ("username",)
+
+    def clean_username(self):
+        username = self.cleaned_data["username"]
+        try:
+            User.objects.get(username=username)
+        except User.DoesNotExist:
+            return username
+        raise forms.ValidationError(_("A user with that username already exists."))
+
+    def clean_password2(self):
+        password1 = self.cleaned_data.get("password1", "")
+        password2 = self.cleaned_data["password2"]
+        if password1 != password2:
+            raise forms.ValidationError(_("The two password fields didn't match."))
+        return password2
+
+    def save(self, commit=True):
+        user = super(UserCreationForm, self).save(commit=False)
+        user.set_password(self.cleaned_data["password1"])
+        if commit:
+            user.save()
+        return user
+
+class UserChangeForm(forms.ModelForm):
+    username = forms.RegexField(label=_("Username"), max_length=30, regex=r'^[\w.@+-]+$',
+        help_text = _("Required. 30 characters or fewer. Letters, digits and @/./+/-/_ only."),
+        error_messages = {'invalid': _("This value may contain only letters, numbers and @/./+/-/_ characters.")})
+
+    class Meta:
+        model = User
+
+    def __init__(self, *args, **kwargs):
+        super(UserChangeForm, self).__init__(*args, **kwargs)
+        f = self.fields.get('user_permissions', None)
+        if f is not None:
+            f.queryset = f.queryset.select_related('content_type')
+
+class AuthenticationForm(forms.Form):
+    """
+    Base class for authenticating users. Extend this to get a form that accepts
+    username/password logins.
+    """
+    username = forms.CharField(label=_("Username"), max_length=30)
+    password = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
+
+    def __init__(self, request=None, *args, **kwargs):
+        """
+        If request is passed in, the form will validate that cookies are
+        enabled. Note that the request (a HttpRequest object) must have set a
+        cookie with the key TEST_COOKIE_NAME and value TEST_COOKIE_VALUE before
+        running this validation.
+        """
+        self.request = request
+        self.user_cache = None
+        super(AuthenticationForm, self).__init__(*args, **kwargs)
+
+    def clean(self):
+        username = self.cleaned_data.get('username')
+        password = self.cleaned_data.get('password')
+
+        if username and password:
+            self.user_cache = authenticate(username=username, password=password)
+            if self.user_cache is None:
+                raise forms.ValidationError(_("Please enter a correct username and password. Note that both fields are case-sensitive."))
+            elif not self.user_cache.is_active:
+                raise forms.ValidationError(_("This account is inactive."))
+
+        # TODO: determine whether this should move to its own method.
+        if self.request:
+            if not self.request.session.test_cookie_worked():
+                raise forms.ValidationError(_("Your Web browser doesn't appear to have cookies enabled. Cookies are required for logging in."))
+
+        return self.cleaned_data
+
+    def get_user_id(self):
+        if self.user_cache:
+            return self.user_cache.id
+        return None
+
+    def get_user(self):
+        return self.user_cache
+
+class PasswordResetForm(forms.Form):
+    email = forms.EmailField(label=_("E-mail"), max_length=75)
+
+    def clean_email(self):
+        """
+        Validates that a user exists with the given e-mail address.
+        """
+        email = self.cleaned_data["email"]
+        self.users_cache = User.objects.filter(email__iexact=email)
+        if len(self.users_cache) == 0:
+            raise forms.ValidationError(_("That e-mail address doesn't have an associated user account. Are you sure you've registered?"))
+        return email
+
+    def save(self, domain_override=None, email_template_name='registration/password_reset_email.html',
+             use_https=False, token_generator=default_token_generator):
+        """
+        Generates a one-use only link for resetting password and sends to the user
+        """
+        from django.core.mail import send_mail
+        for user in self.users_cache:
+            if not domain_override:
+                current_site = Site.objects.get_current()
+                site_name = current_site.name
+                domain = current_site.domain
+            else:
+                site_name = domain = domain_override
+            t = loader.get_template(email_template_name)
+            c = {
+                'email': user.email,
+                'domain': domain,
+                'site_name': site_name,
+                'uid': int_to_base36(user.id),
+                'user': user,
+                'token': token_generator.make_token(user),
+                'protocol': use_https and 'https' or 'http',
+            }
+            send_mail(_("Password reset on %s") % site_name,
+                t.render(Context(c)), None, [user.email])
+
+class SetPasswordForm(forms.Form):
+    """
+    A form that lets a user change set his/her password without
+    entering the old password
+    """
+    new_password1 = forms.CharField(label=_("New password"), widget=forms.PasswordInput)
+    new_password2 = forms.CharField(label=_("New password confirmation"), widget=forms.PasswordInput)
+
+    def __init__(self, user, *args, **kwargs):
+        self.user = user
+        super(SetPasswordForm, self).__init__(*args, **kwargs)
+
+    def clean_new_password2(self):
+        password1 = self.cleaned_data.get('new_password1')
+        password2 = self.cleaned_data.get('new_password2')
+        if password1 and password2:
+            if password1 != password2:
+                raise forms.ValidationError(_("The two password fields didn't match."))
+        return password2
+
+    def save(self, commit=True):
+        self.user.set_password(self.cleaned_data['new_password1'])
+        if commit:
+            self.user.save()
+        return self.user
+
+class PasswordChangeForm(SetPasswordForm):
+    """
+    A form that lets a user change his/her password by entering
+    their old password.
+    """
+    old_password = forms.CharField(label=_("Old password"), widget=forms.PasswordInput)
+
+    def clean_old_password(self):
+        """
+        Validates that the old_password field is correct.
+        """
+        old_password = self.cleaned_data["old_password"]
+        if not self.user.check_password(old_password):
+            raise forms.ValidationError(_("Your old password was entered incorrectly. Please enter it again."))
+        return old_password
+PasswordChangeForm.base_fields.keyOrder = ['old_password', 'new_password1', 'new_password2']
+
+class AdminPasswordChangeForm(forms.Form):
+    """
+    A form used to change the password of a user in the admin interface.
+    """
+    password1 = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
+    password2 = forms.CharField(label=_("Password (again)"), widget=forms.PasswordInput)
+
+    def __init__(self, user, *args, **kwargs):
+        self.user = user
+        super(AdminPasswordChangeForm, self).__init__(*args, **kwargs)
+
+    def clean_password2(self):
+        password1 = self.cleaned_data.get('password1')
+        password2 = self.cleaned_data.get('password2')
+        if password1 and password2:
+            if password1 != password2:
+                raise forms.ValidationError(_("The two password fields didn't match."))
+        return password2
+
+    def save(self, commit=True):
+        """
+        Saves the new password.
+        """
+        self.user.set_password(self.cleaned_data["password1"])
+        if commit:
+            self.user.save()
+        return self.user

thirdpart/auth/handlers/modpython.py

@@ -0,0 +1,56 @@
+from mod_python import apache
+import os
+
+def authenhandler(req, **kwargs):
+    """
+    Authentication handler that checks against Django's auth database.
+    """
+
+    # mod_python fakes the environ, and thus doesn't process SetEnv.  This fixes
+    # that so that the following import works
+    os.environ.update(req.subprocess_env)
+
+    # apache 2.2 requires a call to req.get_basic_auth_pw() before 
+    # req.user and friends are available.
+    req.get_basic_auth_pw()
+
+    # check for PythonOptions
+    _str_to_bool = lambda s: s.lower() in ('1', 'true', 'on', 'yes')
+
+    options = req.get_options()
+    permission_name = options.get('DjangoPermissionName', None)
+    staff_only = _str_to_bool(options.get('DjangoRequireStaffStatus', "on"))
+    superuser_only = _str_to_bool(options.get('DjangoRequireSuperuserStatus', "off"))
+    settings_module = options.get('DJANGO_SETTINGS_MODULE', None)
+    if settings_module:
+        os.environ['DJANGO_SETTINGS_MODULE'] = settings_module
+
+    from django.contrib.auth.models import User
+    from django import db
+    db.reset_queries()
+
+    # check that the username is valid
+    kwargs = {'username': req.user, 'is_active': True}
+    if staff_only:
+        kwargs['is_staff'] = True
+    if superuser_only:
+        kwargs['is_superuser'] = True
+    try:
+        try:
+            user = User.objects.get(**kwargs)
+        except User.DoesNotExist:
+            return apache.HTTP_UNAUTHORIZED
+    
+        # check the password and any permission given
+        if user.check_password(req.get_basic_auth_pw()):
+            if permission_name:
+                if user.has_perm(permission_name):
+                    return apache.OK
+                else:
+                    return apache.HTTP_UNAUTHORIZED
+            else:
+                return apache.OK
+        else:
+            return apache.HTTP_UNAUTHORIZED
+    finally:
+        db.connection.close()

thirdpart/auth/management/__init__.py

@@ -0,0 +1,50 @@
+"""
+Creates permissions for all installed apps that need permissions.
+"""
+
+from django.db.models import get_models, signals
+from django.contrib.auth import models as auth_app
+
+def _get_permission_codename(action, opts):
+    return u'%s_%s' % (action, opts.object_name.lower())
+
+def _get_all_permissions(opts):
+    "Returns (codename, name) for all permissions in the given opts."
+    perms = []
+    for action in ('add', 'change', 'delete'):
+        perms.append((_get_permission_codename(action, opts), u'Can %s %s' % (action, opts.verbose_name_raw)))
+    return perms + list(opts.permissions)
+
+def create_permissions(app, created_models, verbosity, **kwargs):
+    from django.contrib.contenttypes.models import ContentType
+    from django.contrib.auth.models import Permission
+    app_models = get_models(app)
+    if not app_models:
+        return
+    for klass in app_models:
+        ctype = ContentType.objects.get_for_model(klass)
+        for codename, name in _get_all_permissions(klass._meta):
+            p, created = Permission.objects.get_or_create(codename=codename, content_type__pk=ctype.id,
+                defaults={'name': name, 'content_type': ctype})
+            if created and verbosity >= 2:
+                print "Adding permission '%s'" % p
+
+def create_superuser(app, created_models, verbosity, **kwargs):
+    from django.contrib.auth.models import User
+    from django.core.management import call_command
+    if User in created_models and kwargs.get('interactive', True):
+        msg = "\nYou just installed Django's auth system, which means you don't have " \
+                "any superusers defined.\nWould you like to create one now? (yes/no): "
+        confirm = raw_input(msg)
+        while 1:
+            if confirm not in ('yes', 'no'):
+                confirm = raw_input('Please enter either "yes" or "no": ')
+                continue
+            if confirm == 'yes':
+                call_command("createsuperuser", interactive=True)
+            break
+
+signals.post_syncdb.connect(create_permissions,
+    dispatch_uid = "django.contrib.auth.management.create_permissions")
+signals.post_syncdb.connect(create_superuser,
+    sender=auth_app, dispatch_uid = "django.contrib.auth.management.create_superuser")

thirdpart/auth/management/commands/changepassword.py

@@ -0,0 +1,48 @@
+from django.core.management.base import BaseCommand, CommandError
+from django.contrib.auth.models import User
+import getpass
+
+class Command(BaseCommand):
+    help = "Change a user's password for django.contrib.auth."
+
+    requires_model_validation = False
+
+    def _get_pass(self, prompt="Password: "):
+        p = getpass.getpass(prompt=prompt)
+        if not p:
+            raise CommandError("aborted")
+        return p
+
+    def handle(self, *args, **options):
+        if len(args) > 1:
+            raise CommandError("need exactly one or zero arguments for username")
+
+        if args:
+            username, = args
+        else:
+            username = getpass.getuser()
+
+        try:
+            u = User.objects.get(username=username)
+        except User.DoesNotExist:
+            raise CommandError("user '%s' does not exist" % username)
+
+        print "Changing password for user '%s'" % u.username
+
+        MAX_TRIES = 3
+        count = 0
+        p1, p2 = 1, 2  # To make them initially mismatch.
+        while p1 != p2 and count < MAX_TRIES:
+            p1 = self._get_pass()
+            p2 = self._get_pass("Password (again): ")
+            if p1 != p2:
+                print "Passwords do not match. Please try again."
+                count = count + 1
+
+        if count == MAX_TRIES:
+            raise CommandError("Aborting password change for user '%s' after %s attempts" % (username, count))
+
+        u.set_password(p1)
+        u.save()
+
+        return "Password changed successfully for user '%s'" % u.username

thirdpart/auth/management/commands/createsuperuser.py

@@ -0,0 +1,135 @@
+"""
+Management utility to create superusers.
+"""
+
+import getpass
+import os
+import re
+import sys
+from optparse import make_option
+from django.contrib.auth.models import User
+from django.core import exceptions
+from django.core.management.base import BaseCommand, CommandError
+from django.utils.translation import ugettext as _
+
+RE_VALID_USERNAME = re.compile('[\w.@+-]+$')
+
+EMAIL_RE = re.compile(
+    r"(^[-!#$%&'*+/=?^_`{}|~0-9A-Z]+(\.[-!#$%&'*+/=?^_`{}|~0-9A-Z]+)*"  # dot-atom
+    r'|^"([\001-\010\013\014\016-\037!#-\[\]-\177]|\\[\001-\011\013\014\016-\177])*"' # quoted-string
+    r')@(?:[A-Z0-9-]+\.)+[A-Z]{2,6}$', re.IGNORECASE)  # domain
+
+def is_valid_email(value):
+    if not EMAIL_RE.search(value):
+        raise exceptions.ValidationError(_('Enter a valid e-mail address.'))
+
+class Command(BaseCommand):
+    option_list = BaseCommand.option_list + (
+        make_option('--username', dest='username', default=None,
+            help='Specifies the username for the superuser.'),
+        make_option('--email', dest='email', default=None,
+            help='Specifies the email address for the superuser.'),
+        make_option('--noinput', action='store_false', dest='interactive', default=True,
+            help='Tells Django to NOT prompt the user for input of any kind. '    \
+                 'You must use --username and --email with --noinput, and '      \
+                 'superusers created with --noinput will not be able to log in '  \
+                 'until they\'re given a valid password.'),
+    )
+    help = 'Used to create a superuser.'
+
+    def handle(self, *args, **options):
+        username = options.get('username', None)
+        email = options.get('email', None)
+        interactive = options.get('interactive')
+        
+        # Do quick and dirty validation if --noinput
+        if not interactive:
+            if not username or not email:
+                raise CommandError("You must use --username and --email with --noinput.")
+            if not RE_VALID_USERNAME.match(username):
+                raise CommandError("Invalid username. Use only letters, digits, and underscores")
+            try:
+                is_valid_email(email)
+            except exceptions.ValidationError:
+                raise CommandError("Invalid email address.")
+
+        password = ''
+
+        # Try to determine the current system user's username to use as a default.
+        try:
+            import pwd
+            default_username = pwd.getpwuid(os.getuid())[0].replace(' ', '').lower()
+        except (ImportError, KeyError):
+            # KeyError will be raised by getpwuid() if there is no
+            # corresponding entry in the /etc/passwd file (a very restricted
+            # chroot environment, for example).
+            default_username = ''
+
+        # Determine whether the default username is taken, so we don't display
+        # it as an option.
+        if default_username:
+            try:
+                User.objects.get(username=default_username)
+            except User.DoesNotExist:
+                pass
+            else:
+                default_username = ''
+
+        # Prompt for username/email/password. Enclose this whole thing in a
+        # try/except to trap for a keyboard interrupt and exit gracefully.
+        if interactive:
+            try:
+            
+                # Get a username
+                while 1:
+                    if not username:
+                        input_msg = 'Username'
+                        if default_username:
+                            input_msg += ' (Leave blank to use %r)' % default_username
+                        username = raw_input(input_msg + ': ')
+                    if default_username and username == '':
+                        username = default_username
+                    if not RE_VALID_USERNAME.match(username):
+                        sys.stderr.write("Error: That username is invalid. Use only letters, digits and underscores.\n")
+                        username = None
+                        continue
+                    try:
+                        User.objects.get(username=username)
+                    except User.DoesNotExist:
+                        break
+                    else:
+                        sys.stderr.write("Error: That username is already taken.\n")
+                        username = None
+            
+                # Get an email
+                while 1:
+                    if not email:
+                        email = raw_input('E-mail address: ')
+                    try:
+                        is_valid_email(email)
+                    except exceptions.ValidationError:
+                        sys.stderr.write("Error: That e-mail address is invalid.\n")
+                        email = None
+                    else:
+                        break
+            
+                # Get a password
+                while 1:
+                    if not password:
+                        password = getpass.getpass()
+                        password2 = getpass.getpass('Password (again): ')
+                        if password != password2:
+                            sys.stderr.write("Error: Your passwords didn't match.\n")
+                            password = None
+                            continue
+                    if password.strip() == '':
+                        sys.stderr.write("Error: Blank passwords aren't allowed.\n")
+                        password = None
+                        continue
+                    break
+            except KeyboardInterrupt:
+                sys.stderr.write("\nOperation cancelled.\n")
+                sys.exit(1)
+        
+        User.objects.create_superuser(username, email, password)
+        print "Superuser created successfully."

thirdpart/auth/middleware.py

@@ -0,0 +1,81 @@
+from django.contrib import auth
+from django.core.exceptions import ImproperlyConfigured
+
+
+class LazyUser(object):
+    def __get__(self, request, obj_type=None):
+        if not hasattr(request, '_cached_user'):
+            from django.contrib.auth import get_user
+            request._cached_user = get_user(request)
+        return request._cached_user
+
+
+class AuthenticationMiddleware(object):
+    def process_request(self, request):
+        assert hasattr(request, 'session'), "The Django authentication middleware requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'."
+        request.__class__.user = LazyUser()
+        return None
+
+
+class RemoteUserMiddleware(object):
+    """
+    Middleware for utilizing web-server-provided authentication.
+
+    If request.user is not authenticated, then this middleware attempts to
+    authenticate the username passed in the ``REMOTE_USER`` request header.
+    If authentication is successful, the user is automatically logged in to
+    persist the user in the session.
+
+    The header used is configurable and defaults to ``REMOTE_USER``.  Subclass
+    this class and change the ``header`` attribute if you need to use a
+    different header.
+    """
+
+    # Name of request header to grab username from.  This will be the key as
+    # used in the request.META dictionary, i.e. the normalization of headers to
+    # all uppercase and the addition of "HTTP_" prefix apply.
+    header = "REMOTE_USER"
+
+    def process_request(self, request):
+        # AuthenticationMiddleware is required so that request.user exists.
+        if not hasattr(request, 'user'):
+            raise ImproperlyConfigured(
+                "The Django remote user auth middleware requires the"
+                " authentication middleware to be installed.  Edit your"
+                " MIDDLEWARE_CLASSES setting to insert"
+                " 'django.contrib.auth.middleware.AuthenticationMiddleware'"
+                " before the RemoteUserMiddleware class.")
+        try:
+            username = request.META[self.header]
+        except KeyError:
+            # If specified header doesn't exist then return (leaving
+            # request.user set to AnonymousUser by the
+            # AuthenticationMiddleware).
+            return
+        # If the user is already authenticated and that user is the user we are
+        # getting passed in the headers, then the correct user is already
+        # persisted in the session and we don't need to continue.
+        if request.user.is_authenticated():
+            if request.user.username == self.clean_username(username, request):
+                return
+        # We are seeing this user for the first time in this session, attempt
+        # to authenticate the user.
+        user = auth.authenticate(remote_user=username)
+        if user:
+            # User is valid.  Set request.user and persist user in the session
+            # by logging the user in.
+            request.user = user
+            auth.login(request, user)
+
+    def clean_username(self, username, request):
+        """
+        Allows the backend to clean the username, if the backend defines a
+        clean_username method.
+        """
+        backend_str = request.session[auth.BACKEND_SESSION_KEY]
+        backend = auth.load_backend(backend_str)
+        try:
+            username = backend.clean_username(username)
+        except AttributeError: # Backend has no clean_username method.
+            pass
+        return username

thirdpart/auth/models.py

@@ -0,0 +1,471 @@
+import datetime
+import urllib
+
+from django.contrib import auth
+from django.core.exceptions import ImproperlyConfigured
+from django.db import models
+from django.db.models.manager import EmptyManager
+from django.contrib.contenttypes.models import ContentType
+from django.utils.encoding import smart_str
+from django.utils.hashcompat import md5_constructor, sha_constructor
+from django.utils.translation import ugettext_lazy as _
+
+
+UNUSABLE_PASSWORD = '!' # This will never be a valid hash
+
+def get_hexdigest(algorithm, salt, raw_password):
+    """
+    Returns a string of the hexdigest of the given plaintext password and salt
+    using the given algorithm ('md5', 'sha1' or 'crypt').
+    """
+    raw_password, salt = smart_str(raw_password), smart_str(salt)
+    if algorithm == 'crypt':
+        try:
+            import crypt
+        except ImportError:
+            raise ValueError('"crypt" password algorithm not supported in this environment')
+        return crypt.crypt(raw_password, salt)
+
+    if algorithm == 'md5':
+        return md5_constructor(salt + raw_password).hexdigest()
+    elif algorithm == 'sha1':
+        return sha_constructor(salt + raw_password).hexdigest()
+    raise ValueError("Got unknown password algorithm type in password.")
+
+def check_password(raw_password, enc_password):
+    """
+    Returns a boolean of whether the raw_password was correct. Handles
+    encryption formats behind the scenes.
+    """
+    algo, salt, hsh = enc_password.split('$')
+    return hsh == get_hexdigest(algo, salt, raw_password)
+
+class SiteProfileNotAvailable(Exception):
+    pass
+
+class PermissionManager(models.Manager):
+    def get_by_natural_key(self, codename, app_label, model):
+        return self.get(
+            codename=codename,
+            content_type=ContentType.objects.get_by_natural_key(app_label, model)
+        )
+
+class Permission(models.Model):
+    """The permissions system provides a way to assign permissions to specific users and groups of users.
+
+    The permission system is used by the Django admin site, but may also be useful in your own code. The Django admin site uses permissions as follows:
+
+        - The "add" permission limits the user's ability to view the "add" form and add an object.
+        - The "change" permission limits a user's ability to view the change list, view the "change" form and change an object.
+        - The "delete" permission limits the ability to delete an object.
+
+    Permissions are set globally per type of object, not per specific object instance. It is possible to say "Mary may change news stories," but it's not currently possible to say "Mary may change news stories, but only the ones she created herself" or "Mary may only change news stories that have a certain status or publication date."
+
+    Three basic permissions -- add, change and delete -- are automatically created for each Django model.
+    """
+    name = models.CharField(_('name'), max_length=50)
+    content_type = models.ForeignKey(ContentType)
+    codename = models.CharField(_('codename'), max_length=100)
+    objects = PermissionManager()
+
+    class Meta:
+        verbose_name = _('permission')
+        verbose_name_plural = _('permissions')
+        unique_together = (('content_type', 'codename'),)
+        ordering = ('content_type__app_label', 'content_type__model', 'codename')
+
+    def __unicode__(self):
+        return u"%s | %s | %s" % (
+            unicode(self.content_type.app_label),
+            unicode(self.content_type),
+            unicode(self.name))
+
+    def natural_key(self):
+        return (self.codename,) + self.content_type.natural_key()
+    natural_key.dependencies = ['contenttypes.contenttype']
+
+class Group(models.Model):
+    """Groups are a generic way of categorizing users to apply permissions, or some other label, to those users. A user can belong to any number of groups.
+
+    A user in a group automatically has all the permissions granted to that group. For example, if the group Site editors has the permission can_edit_home_page, any user in that group will have that permission.
+
+    Beyond permissions, groups are a convenient way to categorize users to apply some label, or extended functionality, to them. For example, you could create a group 'Special users', and you could write code that would do special things to those users -- such as giving them access to a members-only portion of your site, or sending them members-only e-mail messages.
+    """
+    name = models.CharField(_('name'), max_length=80, unique=True)
+    permissions = models.ManyToManyField(Permission, verbose_name=_('permissions'), blank=True)
+
+    class Meta:
+        verbose_name = _('group')
+        verbose_name_plural = _('groups')
+
+    def __unicode__(self):
+        return self.name
+
+class UserManager(models.Manager):
+    def create_user(self, username, email, password=None):
+        """
+        Creates and saves a User with the given username, e-mail and password.
+        """
+
+        now = datetime.datetime.now()
+        
+        # Normalize the address by lowercasing the domain part of the email
+        # address.
+        try:
+            email_name, domain_part = email.strip().split('@', 1)
+        except ValueError:
+            pass
+        else:
+            email = '@'.join([email_name, domain_part.lower()])
+
+        user = self.model(username=username, email=email, is_staff=False,
+                         is_active=True, is_superuser=False, last_login=now,
+                         date_joined=now)
+
+        if password:
+            user.set_password(password)
+        else:
+            user.set_unusable_password()
+        user.save(using=self._db)
+        return user
+
+    def create_superuser(self, username, email, password):
+        u = self.create_user(username, email, password)
+        u.is_staff = True
+        u.is_active = True
+        u.is_superuser = True
+        u.save(using=self._db)
+        return u
+
+    def make_random_password(self, length=10, allowed_chars='abcdefghjkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789'):
+        "Generates a random password with the given length and given allowed_chars"
+        # Note that default value of allowed_chars does not have "I" or letters
+        # that look like it -- just to avoid confusion.
+        from random import choice
+        return ''.join([choice(allowed_chars) for i in range(length)])
+
+
+# A few helper functions for common logic between User and AnonymousUser.
+def _user_get_all_permissions(user, obj):
+    permissions = set()
+    anon = user.is_anonymous()
+    for backend in auth.get_backends():
+        if not anon or backend.supports_anonymous_user:
+            if hasattr(backend, "get_all_permissions"):
+                if obj is not None:
+                    if backend.supports_object_permissions:
+                        permissions.update(
+                            backend.get_all_permissions(user, obj)
+                        )
+                else:
+                    permissions.update(backend.get_all_permissions(user))
+    return permissions
+
+
+def _user_has_perm(user, perm, obj):
+    anon = user.is_anonymous()
+    for backend in auth.get_backends():
+        if not anon or backend.supports_anonymous_user:
+            if hasattr(backend, "has_perm"):
+                if obj is not None:
+                    if (backend.supports_object_permissions and
+                        backend.has_perm(user, perm, obj)):
+                            return True
+                else:
+                    if backend.has_perm(user, perm):
+                        return True
+    return False
+
+
+def _user_has_module_perms(user, app_label):
+    anon = user.is_anonymous()
+    for backend in auth.get_backends():
+        if not anon or backend.supports_anonymous_user:
+            if hasattr(backend, "has_module_perms"):
+                if backend.has_module_perms(user, app_label):
+                    return True
+    return False
+
+
+class User(models.Model):
+    """
+    Users within the Django authentication system are represented by this model.
+
+    Username and password are required. Other fields are optional.
+    """
+    username = models.CharField(_('username'), max_length=30, unique=True, help_text=_("Required. 30 characters or fewer. Letters, numbers and @/./+/-/_ characters"))
+    first_name = models.CharField(_('first name'), max_length=30, blank=True)
+    last_name = models.CharField(_('last name'), max_length=30, blank=True)
+    email = models.EmailField(_('e-mail address'), blank=True)
+    password = models.CharField(_('password'), max_length=128, help_text=_("Use '[algo]$[salt]$[hexdigest]' or use the <a href=\"password/\">change password form</a>."))
+    is_staff = models.BooleanField(_('staff status'), default=False, help_text=_("Designates whether the user can log into this admin site."))
+    is_active = models.BooleanField(_('active'), default=True, help_text=_("Designates whether this user should be treated as active. Unselect this instead of deleting accounts."))
+    is_superuser = models.BooleanField(_('superuser status'), default=False, help_text=_("Designates that this user has all permissions without explicitly assigning them."))
+    last_login = models.DateTimeField(_('last login'), default=datetime.datetime.now)
+    date_joined = models.DateTimeField(_('date joined'), default=datetime.datetime.now)
+    groups = models.ManyToManyField(Group, verbose_name=_('groups'), blank=True,
+        help_text=_("In addition to the permissions manually assigned, this user will also get all permissions granted to each group he/she is in."))
+    user_permissions = models.ManyToManyField(Permission, verbose_name=_('user permissions'), blank=True)
+    objects = UserManager()
+
+    class Meta:
+        verbose_name = _('user')
+        verbose_name_plural = _('users')
+
+    def __unicode__(self):
+        return self.username
+
+    def get_absolute_url(self):
+        return "/users/%s/" % urllib.quote(smart_str(self.username))
+
+    def is_anonymous(self):
+        """
+        Always returns False. This is a way of comparing User objects to
+        anonymous users.
+        """
+        return False
+
+    def is_authenticated(self):
+        """
+        Always return True. This is a way to tell if the user has been
+        authenticated in templates.
+        """
+        return True
+
+    def get_full_name(self):
+        "Returns the first_name plus the last_name, with a space in between."
+        full_name = u'%s %s' % (self.first_name, self.last_name)
+        return full_name.strip()
+
+    def set_password(self, raw_password):
+        import random
+        algo = 'sha1'
+        salt = get_hexdigest(algo, str(random.random()), str(random.random()))[:5]
+        hsh = get_hexdigest(algo, salt, raw_password)
+        self.password = '%s$%s$%s' % (algo, salt, hsh)
+
+    def check_password(self, raw_password):
+        """
+        Returns a boolean of whether the raw_password was correct. Handles
+        encryption formats behind the scenes.
+        """
+        # Backwards-compatibility check. Older passwords won't include the
+        # algorithm or salt.
+        if '$' not in self.password:
+            is_correct = (self.password == get_hexdigest('md5', '', raw_password))
+            if is_correct:
+                # Convert the password to the new, more secure format.
+                self.set_password(raw_password)
+                self.save()
+            return is_correct
+        return check_password(raw_password, self.password)
+
+    def set_unusable_password(self):
+        # Sets a value that will never be a valid hash
+        self.password = UNUSABLE_PASSWORD
+
+    def has_usable_password(self):
+        return self.password != UNUSABLE_PASSWORD
+
+    def get_group_permissions(self, obj=None):
+        """
+        Returns a list of permission strings that this user has through
+        his/her groups. This method queries all available auth backends.
+        If an object is passed in, only permissions matching this object
+        are returned.
+        """
+        permissions = set()
+        for backend in auth.get_backends():
+            if hasattr(backend, "get_group_permissions"):
+                if obj is not None:
+                    if backend.supports_object_permissions:
+                        permissions.update(
+                            backend.get_group_permissions(self, obj)
+                        )
+                else:
+                    permissions.update(backend.get_group_permissions(self))
+        return permissions
+
+    def get_all_permissions(self, obj=None):
+        return _user_get_all_permissions(self, obj)
+
+    def has_perm(self, perm, obj=None):
+        """
+        Returns True if the user has the specified permission. This method
+        queries all available auth backends, but returns immediately if any
+        backend returns True. Thus, a user who has permission from a single
+        auth backend is assumed to have permission in general. If an object
+        is provided, permissions for this specific object are checked.
+        """
+        # Inactive users have no permissions.
+        if not self.is_active:
+            return False
+
+        # Superusers have all permissions.
+        if self.is_superuser:
+            return True
+
+        # Otherwise we need to check the backends.
+        return _user_has_perm(self, perm, obj)
+
+    def has_perms(self, perm_list, obj=None):
+        """
+        Returns True if the user has each of the specified permissions.
+        If object is passed, it checks if the user has all required perms
+        for this object.
+        """
+        for perm in perm_list:
+            if not self.has_perm(perm, obj):
+                return False
+        return True
+
+    def has_module_perms(self, app_label):
+        """
+        Returns True if the user has any permissions in the given app
+        label. Uses pretty much the same logic as has_perm, above.
+        """
+        if not self.is_active:
+            return False
+
+        if self.is_superuser:
+            return True
+
+        return _user_has_module_perms(self, app_label)
+
+    def get_and_delete_messages(self):
+        messages = []
+        for m in self.message_set.all():
+            messages.append(m.message)
+            m.delete()
+        return messages
+
+    def email_user(self, subject, message, from_email=None):
+        "Sends an e-mail to this User."
+        from django.core.mail import send_mail
+        send_mail(subject, message, from_email, [self.email])
+
+    def get_profile(self):
+        """
+        Returns site-specific profile for this user. Raises
+        SiteProfileNotAvailable if this site does not allow profiles.
+        """
+        if not hasattr(self, '_profile_cache'):
+            from django.conf import settings
+            if not getattr(settings, 'AUTH_PROFILE_MODULE', False):
+                raise SiteProfileNotAvailable('You need to set AUTH_PROFILE_MO'
+                                              'DULE in your project settings')
+            try:
+                app_label, model_name = settings.AUTH_PROFILE_MODULE.split('.')
+            except ValueError:
+                raise SiteProfileNotAvailable('app_label and model_name should'
+                        ' be separated by a dot in the AUTH_PROFILE_MODULE set'
+                        'ting')
+
+            try:
+                model = models.get_model(app_label, model_name)
+                if model is None:
+                    raise SiteProfileNotAvailable('Unable to load the profile '
+                        'model, check AUTH_PROFILE_MODULE in your project sett'
+                        'ings')
+                self._profile_cache = model._default_manager.using(self._state.db).get(user__id__exact=self.id)
+                self._profile_cache.user = self
+            except (ImportError, ImproperlyConfigured):
+                raise SiteProfileNotAvailable
+        return self._profile_cache
+
+    def _get_message_set(self):
+        import warnings
+        warnings.warn('The user messaging API is deprecated. Please update'
+                      ' your code to use the new messages framework.',
+                      category=PendingDeprecationWarning)
+        return self._message_set
+    message_set = property(_get_message_set)
+
+class Message(models.Model):
+    """
+    The message system is a lightweight way to queue messages for given
+    users. A message is associated with a User instance (so it is only
+    applicable for registered users). There's no concept of expiration or
+    timestamps. Messages are created by the Django admin after successful
+    actions. For example, "The poll Foo was created successfully." is a
+    message.
+    """
+    user = models.ForeignKey(User, related_name='_message_set')
+    message = models.TextField(_('message'))
+
+    def __unicode__(self):
+        return self.message
+
+class AnonymousUser(object):
+    id = None
+    username = ''
+    is_staff = False
+    is_active = False
+    is_superuser = False
+    _groups = EmptyManager()
+    _user_permissions = EmptyManager()
+
+    def __init__(self):
+        pass
+
+    def __unicode__(self):
+        return 'AnonymousUser'
+
+    def __str__(self):
+        return unicode(self).encode('utf-8')
+
+    def __eq__(self, other):
+        return isinstance(other, self.__class__)
+
+    def __ne__(self, other):
+        return not self.__eq__(other)
+
+    def __hash__(self):
+        return 1 # instances always return the same hash value
+
+    def save(self):
+        raise NotImplementedError
+
+    def delete(self):
+        raise NotImplementedError
+
+    def set_password(self, raw_password):
+        raise NotImplementedError
+
+    def check_password(self, raw_password):
+        raise NotImplementedError
+
+    def _get_groups(self):
+        return self._groups
+    groups = property(_get_groups)
+
+    def _get_user_permissions(self):
+        return self._user_permissions
+    user_permissions = property(_get_user_permissions)
+
+    def get_group_permissions(self, obj=None):
+        return set()
+
+    def get_all_permissions(self, obj=None):
+        return _user_get_all_permissions(self, obj=obj)
+
+    def has_perm(self, perm, obj=None):
+        return _user_has_perm(self, perm, obj=obj)
+
+    def has_perms(self, perm_list, obj=None):
+        for perm in perm_list:
+            if not self.has_perm(perm, obj):
+                return False
+        return True
+
+    def has_module_perms(self, module):
+        return _user_has_module_perms(self, module)
+
+    def get_and_delete_messages(self):
+        return []
+
+    def is_anonymous(self):
+        return True
+
+    def is_authenticated(self):
+        return False

thirdpart/auth/tests/__init__.py

@@ -0,0 +1,17 @@
+from django.contrib.auth.tests.auth_backends import BackendTest, RowlevelBackendTest, AnonymousUserBackendTest, NoAnonymousUserBackendTest
+from django.contrib.auth.tests.basic import BASIC_TESTS
+from django.contrib.auth.tests.decorators import LoginRequiredTestCase
+from django.contrib.auth.tests.forms import UserCreationFormTest, AuthenticationFormTest, SetPasswordFormTest, PasswordChangeFormTest, UserChangeFormTest, PasswordResetFormTest
+from django.contrib.auth.tests.remote_user \
+        import RemoteUserTest, RemoteUserNoCreateTest, RemoteUserCustomTest
+from django.contrib.auth.tests.models import ProfileTestCase
+from django.contrib.auth.tests.tokens import TOKEN_GENERATOR_TESTS
+from django.contrib.auth.tests.views \
+        import PasswordResetTest, ChangePasswordTest, LoginTest, LogoutTest
+
+# The password for the fixture data users is 'password'
+
+__test__ = {
+    'BASIC_TESTS': BASIC_TESTS,
+    'TOKEN_GENERATOR_TESTS': TOKEN_GENERATOR_TESTS,
+}

thirdpart/auth/tests/auth_backends.py

@@ -0,0 +1,247 @@
+from django.conf import settings
+from django.contrib.auth.models import User, Group, Permission, AnonymousUser
+from django.contrib.contenttypes.models import ContentType
+from django.test import TestCase
+
+
+class BackendTest(TestCase):
+
+    backend = 'django.contrib.auth.backends.ModelBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = (self.backend,)
+        User.objects.create_user('test', 'test@example.com', 'test')
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        user = User.objects.get(username='test')
+        self.assertEqual(user.has_perm('auth.test'), False)
+        user.is_staff = True
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), False)
+        user.is_superuser = True
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), True)
+        user.is_staff = False
+        user.is_superuser = False
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), False)
+        user.is_staff = True
+        user.is_superuser = True
+        user.is_active = False
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), False)
+
+    def test_custom_perms(self):
+        user = User.objects.get(username='test')
+        content_type=ContentType.objects.get_for_model(Group)
+        perm = Permission.objects.create(name='test', content_type=content_type, codename='test')
+        user.user_permissions.add(perm)
+        user.save()
+
+        # reloading user to purge the _perm_cache
+        user = User.objects.get(username='test')
+        self.assertEqual(user.get_all_permissions() == set([u'auth.test']), True)
+        self.assertEqual(user.get_group_permissions(), set([]))
+        self.assertEqual(user.has_module_perms('Group'), False)
+        self.assertEqual(user.has_module_perms('auth'), True)
+        perm = Permission.objects.create(name='test2', content_type=content_type, codename='test2')
+        user.user_permissions.add(perm)
+        user.save()
+        perm = Permission.objects.create(name='test3', content_type=content_type, codename='test3')
+        user.user_permissions.add(perm)
+        user.save()
+        user = User.objects.get(username='test')
+        self.assertEqual(user.get_all_permissions(), set([u'auth.test2', u'auth.test', u'auth.test3']))
+        self.assertEqual(user.has_perm('test'), False)
+        self.assertEqual(user.has_perm('auth.test'), True)
+        self.assertEqual(user.has_perms(['auth.test2', 'auth.test3']), True)
+        perm = Permission.objects.create(name='test_group', content_type=content_type, codename='test_group')
+        group = Group.objects.create(name='test_group')
+        group.permissions.add(perm)
+        group.save()
+        user.groups.add(group)
+        user = User.objects.get(username='test')
+        exp = set([u'auth.test2', u'auth.test', u'auth.test3', u'auth.test_group'])
+        self.assertEqual(user.get_all_permissions(), exp)
+        self.assertEqual(user.get_group_permissions(), set([u'auth.test_group']))
+        self.assertEqual(user.has_perms(['auth.test3', 'auth.test_group']), True)
+
+        user = AnonymousUser()
+        self.assertEqual(user.has_perm('test'), False)
+        self.assertEqual(user.has_perms(['auth.test2', 'auth.test3']), False)
+
+    def test_has_no_object_perm(self):
+        """Regressiontest for #12462"""
+        user = User.objects.get(username='test')
+        content_type=ContentType.objects.get_for_model(Group)
+        perm = Permission.objects.create(name='test', content_type=content_type, codename='test')
+        user.user_permissions.add(perm)
+        user.save()
+
+        self.assertEqual(user.has_perm('auth.test', 'object'), False)
+        self.assertEqual(user.get_all_permissions('object'), set([]))
+        self.assertEqual(user.has_perm('auth.test'), True)
+        self.assertEqual(user.get_all_permissions(), set(['auth.test']))
+
+
+class TestObj(object):
+    pass
+
+
+class SimpleRowlevelBackend(object):
+    supports_object_permissions = True
+
+    # This class also supports tests for anonymous user permissions,
+    # via subclasses which just set the 'supports_anonymous_user' attribute.
+
+    def has_perm(self, user, perm, obj=None):
+        if not obj:
+            return # We only support row level perms
+
+        if isinstance(obj, TestObj):
+            if user.username == 'test2':
+                return True
+            elif user.is_anonymous() and perm == 'anon':
+                # not reached due to supports_anonymous_user = False
+                return True
+        return False
+
+    def has_module_perms(self, user, app_label):
+        return app_label == "app1"
+
+    def get_all_permissions(self, user, obj=None):
+        if not obj:
+            return [] # We only support row level perms
+
+        if not isinstance(obj, TestObj):
+            return ['none']
+
+        if user.is_anonymous():
+            return ['anon']
+        if user.username == 'test2':
+            return ['simple', 'advanced']
+        else:
+            return ['simple']
+
+    def get_group_permissions(self, user, obj=None):
+        if not obj:
+            return # We only support row level perms
+
+        if not isinstance(obj, TestObj):
+            return ['none']
+
+        if 'test_group' in [group.name for group in user.groups.all()]:
+            return ['group_perm']
+        else:
+            return ['none']
+
+
+class RowlevelBackendTest(TestCase):
+    """
+    Tests for auth backend that supports object level permissions
+    """
+    backend = 'django.contrib.auth.tests.auth_backends.SimpleRowlevelBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth + (self.backend,)
+        self.user1 = User.objects.create_user('test', 'test@example.com', 'test')
+        self.user2 = User.objects.create_user('test2', 'test2@example.com', 'test')
+        self.user3 = User.objects.create_user('test3', 'test3@example.com', 'test')
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user2.has_perm('perm', TestObj()), True)
+        self.assertEqual(self.user2.has_perm('perm'), False)
+        self.assertEqual(self.user2.has_perms(['simple', 'advanced'], TestObj()), True)
+        self.assertEqual(self.user3.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user3.has_perm('anon', TestObj()), False)
+        self.assertEqual(self.user3.has_perms(['simple', 'advanced'], TestObj()), False)
+
+    def test_get_all_permissions(self):
+        self.assertEqual(self.user1.get_all_permissions(TestObj()), set(['simple']))
+        self.assertEqual(self.user2.get_all_permissions(TestObj()), set(['simple', 'advanced']))
+        self.assertEqual(self.user2.get_all_permissions(), set([]))
+
+    def test_get_group_permissions(self):
+        content_type=ContentType.objects.get_for_model(Group)
+        group = Group.objects.create(name='test_group')
+        self.user3.groups.add(group)
+        self.assertEqual(self.user3.get_group_permissions(TestObj()), set(['group_perm']))
+
+
+class AnonymousUserBackend(SimpleRowlevelBackend):
+
+    supports_anonymous_user = True
+
+
+class NoAnonymousUserBackend(SimpleRowlevelBackend):
+
+    supports_anonymous_user = False
+
+
+class AnonymousUserBackendTest(TestCase):
+    """
+    Tests for AnonymousUser delegating to backend if it has 'supports_anonymous_user' = True
+    """
+
+    backend = 'django.contrib.auth.tests.auth_backends.AnonymousUserBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = (self.backend,)
+        self.user1 = AnonymousUser()
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user1.has_perm('anon', TestObj()), True)
+
+    def test_has_perms(self):
+        self.assertEqual(self.user1.has_perms(['anon'], TestObj()), True)
+        self.assertEqual(self.user1.has_perms(['anon', 'perm'], TestObj()), False)
+
+    def test_has_module_perms(self):
+        self.assertEqual(self.user1.has_module_perms("app1"), True)
+        self.assertEqual(self.user1.has_module_perms("app2"), False)
+
+    def test_get_all_permissions(self):
+        self.assertEqual(self.user1.get_all_permissions(TestObj()), set(['anon']))
+
+
+class NoAnonymousUserBackendTest(TestCase):
+    """
+    Tests that AnonymousUser does not delegate to backend if it has 'supports_anonymous_user' = False
+    """
+    backend = 'django.contrib.auth.tests.auth_backends.NoAnonymousUserBackend'
+
+    def setUp(self):
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth + (self.backend,)
+        self.user1 = AnonymousUser()
+
+    def tearDown(self):
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+    def test_has_perm(self):
+        self.assertEqual(self.user1.has_perm('perm', TestObj()), False)
+        self.assertEqual(self.user1.has_perm('anon', TestObj()), False)
+
+    def test_has_perms(self):
+        self.assertEqual(self.user1.has_perms(['anon'], TestObj()), False)
+
+    def test_has_module_perms(self):
+        self.assertEqual(self.user1.has_module_perms("app1"), False)
+        self.assertEqual(self.user1.has_module_perms("app2"), False)
+
+    def test_get_all_permissions(self):
+        self.assertEqual(self.user1.get_all_permissions(TestObj()), set())

thirdpart/auth/tests/basic.py

@@ -0,0 +1,77 @@
+
+BASIC_TESTS = """
+>>> from django.contrib.auth.models import User, AnonymousUser
+>>> u = User.objects.create_user('testuser', 'test@example.com', 'testpw')
+>>> u.has_usable_password()
+True
+>>> u.check_password('bad')
+False
+>>> u.check_password('testpw')
+True
+>>> u.set_unusable_password()
+>>> u.save()
+>>> u.check_password('testpw')
+False
+>>> u.has_usable_password()
+False
+>>> u2 = User.objects.create_user('testuser2', 'test2@example.com')
+>>> u2.has_usable_password()
+False
+
+>>> u.is_authenticated()
+True
+>>> u.is_staff
+False
+>>> u.is_active
+True
+>>> u.is_superuser
+False
+
+>>> a = AnonymousUser()
+>>> a.is_authenticated()
+False
+>>> a.is_staff
+False
+>>> a.is_active
+False
+>>> a.is_superuser
+False
+>>> a.groups.all()
+[]
+>>> a.user_permissions.all()
+[]
+
+# superuser tests.
+>>> super = User.objects.create_superuser('super', 'super@example.com', 'super')
+>>> super.is_superuser
+True
+>>> super.is_active
+True
+>>> super.is_staff
+True
+
+#
+# Tests for createsuperuser management command.
+# It's nearly impossible to test the interactive mode -- a command test helper
+# would be needed (and *awesome*) -- so just test the non-interactive mode.
+# This covers most of the important validation, but not all.
+#
+>>> from django.core.management import call_command
+
+>>> call_command("createsuperuser", interactive=False, username="joe", email="joe@somewhere.org")
+Superuser created successfully.
+
+>>> u = User.objects.get(username="joe")
+>>> u.email
+u'joe@somewhere.org'
+>>> u.password
+u'!'
+>>> call_command("createsuperuser", interactive=False, username="joe+admin@somewhere.org", email="joe@somewhere.org")
+Superuser created successfully.
+
+>>> u = User.objects.get(username="joe+admin@somewhere.org")
+>>> u.email
+u'joe@somewhere.org'
+>>> u.password
+u'!'
+"""

thirdpart/auth/tests/decorators.py

@@ -0,0 +1,25 @@
+from unittest import TestCase
+
+from django.contrib.auth.decorators import login_required
+
+
+class LoginRequiredTestCase(TestCase):
+    """
+    Tests the login_required decorators
+    """
+    def testCallable(self):
+        """
+        Check that login_required is assignable to callable objects.
+        """
+        class CallableView(object):
+            def __call__(self, *args, **kwargs):
+                pass
+        login_required(CallableView())
+        
+    def testView(self):
+        """
+        Check that login_required is assignable to normal views.
+        """
+        def normal_view(request):
+            pass
+        login_required(normal_view)

thirdpart/auth/tests/forms.py

@@ -0,0 +1,252 @@
+from django.contrib.auth.models import User
+from django.contrib.auth.forms import UserCreationForm, AuthenticationForm,  PasswordChangeForm, SetPasswordForm, UserChangeForm, PasswordResetForm
+from django.test import TestCase
+
+
+class UserCreationFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_user_already_exists(self):
+        data = {
+            'username': 'testclient',
+            'password1': 'test123',
+            'password2': 'test123',
+            }
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["username"].errors,
+                         [u'A user with that username already exists.'])
+
+    def test_invalid_data(self):
+        data = {
+            'username': 'jsmith!',
+            'password1': 'test123',
+            'password2': 'test123',
+            }
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["username"].errors,
+                         [u'This value may contain only letters, numbers and @/./+/-/_ characters.'])
+
+
+    def test_password_verification(self):
+        # The verification password is incorrect.
+        data = {
+            'username': 'jsmith',
+            'password1': 'test123',
+            'password2': 'test',
+            }
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["password2"].errors,
+                         [u"The two password fields didn't match."])
+
+
+    def test_both_passwords(self):
+        # One (or both) passwords weren't given
+        data = {'username': 'jsmith'}
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form['password1'].errors,
+                         [u'This field is required.'])
+        self.assertEqual(form['password2'].errors,
+                         [u'This field is required.'])
+
+
+        data['password2'] = 'test123'
+        form = UserCreationForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form['password1'].errors,
+                         [u'This field is required.'])
+
+    def test_success(self):
+        # The success case.
+
+        data = {
+            'username': 'jsmith@example.com',
+            'password1': 'test123',
+            'password2': 'test123',
+            }
+        form = UserCreationForm(data)
+        self.assertTrue(form.is_valid())
+        u = form.save()
+        self.assertEqual(repr(u), '<User: jsmith@example.com>')
+
+
+class AuthenticationFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_invalid_username(self):
+        # The user submits an invalid username.
+
+        data = {
+            'username': 'jsmith_does_not_exist',
+            'password': 'test123',
+            }
+        form = AuthenticationForm(None, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.non_field_errors(),
+                         [u'Please enter a correct username and password. Note that both fields are case-sensitive.'])
+
+    def test_inactive_user(self):
+        # The user is inactive.
+        data = {
+            'username': 'inactive',
+            'password': 'password',
+            }
+        form = AuthenticationForm(None, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.non_field_errors(),
+                         [u'This account is inactive.'])
+
+
+    def test_success(self):
+        # The success case
+        data = {
+            'username': 'testclient',
+            'password': 'password',
+            }
+        form = AuthenticationForm(None, data)
+        self.assertTrue(form.is_valid())
+        self.assertEqual(form.non_field_errors(), [])
+
+
+class SetPasswordFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_password_verification(self):
+        # The two new passwords do not match.
+        user = User.objects.get(username='testclient')
+        data = {
+            'new_password1': 'abc123',
+            'new_password2': 'abc',
+            }
+        form = SetPasswordForm(user, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["new_password2"].errors,
+                         [u"The two password fields didn't match."])
+
+    def test_success(self):
+        user = User.objects.get(username='testclient')
+        data = {
+            'new_password1': 'abc123',
+            'new_password2': 'abc123',
+            }
+        form = SetPasswordForm(user, data)
+        self.assertTrue(form.is_valid())
+
+
+class PasswordChangeFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_incorrect_password(self):
+        user = User.objects.get(username='testclient')
+        data = {
+            'old_password': 'test',
+            'new_password1': 'abc123',
+            'new_password2': 'abc123',
+            }
+        form = PasswordChangeForm(user, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["old_password"].errors,
+                         [u'Your old password was entered incorrectly. Please enter it again.'])
+
+
+    def test_password_verification(self):
+        # The two new passwords do not match.
+        user = User.objects.get(username='testclient')
+        data = {
+            'old_password': 'password',
+            'new_password1': 'abc123',
+            'new_password2': 'abc',
+            }
+        form = PasswordChangeForm(user, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form["new_password2"].errors,
+                         [u"The two password fields didn't match."])
+
+
+    def test_success(self):
+        # The success case.
+        user = User.objects.get(username='testclient')
+        data = {
+            'old_password': 'password',
+            'new_password1': 'abc123',
+            'new_password2': 'abc123',
+            }
+        form = PasswordChangeForm(user, data)
+        self.assertTrue(form.is_valid())
+
+    def test_field_order(self):
+        # Regression test - check the order of fields:
+        user = User.objects.get(username='testclient')
+        self.assertEqual(PasswordChangeForm(user, {}).fields.keys(),
+                         ['old_password', 'new_password1', 'new_password2'])
+
+class UserChangeFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_username_validity(self):
+        user = User.objects.get(username='testclient')
+        data = {'username': 'not valid'}
+        form = UserChangeForm(data, instance=user)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form['username'].errors,
+                         [u'This value may contain only letters, numbers and @/./+/-/_ characters.'])
+
+    def test_bug_14242(self):
+        # A regression test, introduce by adding an optimization for the
+        # UserChangeForm.
+
+        class MyUserForm(UserChangeForm):
+            def __init__(self, *args, **kwargs):
+                super(MyUserForm, self).__init__(*args, **kwargs)
+                self.fields['groups'].help_text = 'These groups give users different permissions'
+
+            class Meta(UserChangeForm.Meta):
+                fields = ('groups',)
+
+        # Just check we can create it
+        form = MyUserForm({})
+
+
+class PasswordResetFormTest(TestCase):
+
+    fixtures = ['authtestdata.json']
+
+    def test_invalid_email(self):
+        data = {'email':'not valid'}
+        form = PasswordResetForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form['email'].errors,
+                         [u'Enter a valid e-mail address.'])
+
+    def test_nonexistant_email(self):
+        # Test nonexistant email address
+        data = {'email':'foo@bar.com'}
+        form = PasswordResetForm(data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.errors,
+                         {'email': [u"That e-mail address doesn't have an associated user account. Are you sure you've registered?"]})
+
+    def test_cleaned_data(self):
+        # Regression test
+        user = User.objects.create_user("jsmith3", "jsmith3@example.com", "test123")
+        data = {'email':'jsmith3@example.com'}
+        form = PasswordResetForm(data)
+        self.assertTrue(form.is_valid())
+        self.assertEqual(form.cleaned_data['email'], u'jsmith3@example.com')
+
+
+    def test_bug_5605(self):
+        # bug #5605, preserve the case of the user name (before the @ in the
+        # email address) when creating a user.
+        user = User.objects.create_user('forms_test2', 'tesT@EXAMple.com', 'test')
+        self.assertEqual(user.email, 'tesT@example.com')
+        user = User.objects.create_user('forms_test3', 'tesT', 'test')
+        self.assertEqual(user.email, 'tesT')

thirdpart/auth/tests/models.py

@@ -0,0 +1,35 @@
+from django.conf import settings
+from django.test import TestCase
+from django.contrib.auth.models import User, SiteProfileNotAvailable
+
+class ProfileTestCase(TestCase):
+    fixtures = ['authtestdata.json']
+    def setUp(self):
+        """Backs up the AUTH_PROFILE_MODULE"""
+        self.old_AUTH_PROFILE_MODULE = getattr(settings,
+                                               'AUTH_PROFILE_MODULE', None)
+
+    def tearDown(self):
+        """Restores the AUTH_PROFILE_MODULE -- if it was not set it is deleted,
+        otherwise the old value is restored"""
+        if self.old_AUTH_PROFILE_MODULE is None and \
+                hasattr(settings, 'AUTH_PROFILE_MODULE'):
+            del settings.AUTH_PROFILE_MODULE
+
+        if self.old_AUTH_PROFILE_MODULE is not None:
+            settings.AUTH_PROFILE_MODULE = self.old_AUTH_PROFILE_MODULE
+
+    def test_site_profile_not_available(self):
+        # calling get_profile without AUTH_PROFILE_MODULE set
+        if hasattr(settings, 'AUTH_PROFILE_MODULE'):
+            del settings.AUTH_PROFILE_MODULE
+        user = User.objects.get(username='testclient')
+        self.assertRaises(SiteProfileNotAvailable, user.get_profile)
+
+        # Bad syntax in AUTH_PROFILE_MODULE: 
+        settings.AUTH_PROFILE_MODULE = 'foobar'
+        self.assertRaises(SiteProfileNotAvailable, user.get_profile)
+
+        # module that doesn't exist
+        settings.AUTH_PROFILE_MODULE = 'foo.bar'
+        self.assertRaises(SiteProfileNotAvailable, user.get_profile)

thirdpart/auth/tests/remote_user.py

@@ -0,0 +1,170 @@
+from datetime import datetime
+
+from django.conf import settings
+from django.contrib.auth.backends import RemoteUserBackend
+from django.contrib.auth.models import User
+from django.test import TestCase
+
+
+class RemoteUserTest(TestCase):
+
+    urls = 'django.contrib.auth.tests.urls'
+    middleware = 'django.contrib.auth.middleware.RemoteUserMiddleware'
+    backend = 'django.contrib.auth.backends.RemoteUserBackend'
+
+    # Usernames to be passed in REMOTE_USER for the test_known_user test case.
+    known_user = 'knownuser'
+    known_user2 = 'knownuser2'
+
+    def setUp(self):
+        self.curr_middleware = settings.MIDDLEWARE_CLASSES
+        self.curr_auth = settings.AUTHENTICATION_BACKENDS
+        settings.MIDDLEWARE_CLASSES += (self.middleware,)
+        settings.AUTHENTICATION_BACKENDS = (self.backend,)
+
+    def test_no_remote_user(self):
+        """
+        Tests requests where no remote user is specified and insures that no
+        users get created.
+        """
+        num_users = User.objects.count()
+
+        response = self.client.get('/remote_user/')
+        self.assert_(response.context['user'].is_anonymous())
+        self.assertEqual(User.objects.count(), num_users)
+
+        response = self.client.get('/remote_user/', REMOTE_USER=None)
+        self.assert_(response.context['user'].is_anonymous())
+        self.assertEqual(User.objects.count(), num_users)
+
+        response = self.client.get('/remote_user/', REMOTE_USER='')
+        self.assert_(response.context['user'].is_anonymous())
+        self.assertEqual(User.objects.count(), num_users)
+
+    def test_unknown_user(self):
+        """
+        Tests the case where the username passed in the header does not exist
+        as a User.
+        """
+        num_users = User.objects.count()
+        response = self.client.get('/remote_user/', REMOTE_USER='newuser')
+        self.assertEqual(response.context['user'].username, 'newuser')
+        self.assertEqual(User.objects.count(), num_users + 1)
+        User.objects.get(username='newuser')
+
+        # Another request with same user should not create any new users.
+        response = self.client.get('/remote_user/', REMOTE_USER='newuser')
+        self.assertEqual(User.objects.count(), num_users + 1)
+
+    def test_known_user(self):
+        """
+        Tests the case where the username passed in the header is a valid User.
+        """
+        User.objects.create(username='knownuser')
+        User.objects.create(username='knownuser2')
+        num_users = User.objects.count()
+        response = self.client.get('/remote_user/', REMOTE_USER=self.known_user)
+        self.assertEqual(response.context['user'].username, 'knownuser')
+        self.assertEqual(User.objects.count(), num_users)
+        # Test that a different user passed in the headers causes the new user
+        # to be logged in.
+        response = self.client.get('/remote_user/', REMOTE_USER=self.known_user2)
+        self.assertEqual(response.context['user'].username, 'knownuser2')
+        self.assertEqual(User.objects.count(), num_users)
+
+    def test_last_login(self):
+        """
+        Tests that a user's last_login is set the first time they make a
+        request but not updated in subsequent requests with the same session.
+        """
+        user = User.objects.create(username='knownuser')
+        # Set last_login to something so we can determine if it changes.
+        default_login = datetime(2000, 1, 1)
+        user.last_login = default_login
+        user.save()
+
+        response = self.client.get('/remote_user/', REMOTE_USER=self.known_user)
+        self.assertNotEqual(default_login, response.context['user'].last_login)
+
+        user = User.objects.get(username='knownuser')
+        user.last_login = default_login
+        user.save()
+        response = self.client.get('/remote_user/', REMOTE_USER=self.known_user)
+        self.assertEqual(default_login, response.context['user'].last_login)
+
+    def tearDown(self):
+        """Restores settings to avoid breaking other tests."""
+        settings.MIDDLEWARE_CLASSES = self.curr_middleware
+        settings.AUTHENTICATION_BACKENDS = self.curr_auth
+
+
+class RemoteUserNoCreateBackend(RemoteUserBackend):
+    """Backend that doesn't create unknown users."""
+    create_unknown_user = False
+
+
+class RemoteUserNoCreateTest(RemoteUserTest):
+    """
+    Contains the same tests as RemoteUserTest, but using a custom auth backend
+    class that doesn't create unknown users.
+    """
+
+    backend =\
+        'django.contrib.auth.tests.remote_user.RemoteUserNoCreateBackend'
+
+    def test_unknown_user(self):
+        num_users = User.objects.count()
+        response = self.client.get('/remote_user/', REMOTE_USER='newuser')
+        self.assert_(response.context['user'].is_anonymous())
+        self.assertEqual(User.objects.count(), num_users)
+
+
+class CustomRemoteUserBackend(RemoteUserBackend):
+    """
+    Backend that overrides RemoteUserBackend methods.
+    """
+
+    def clean_username(self, username):
+        """
+        Grabs username before the @ character.
+        """
+        return username.split('@')[0]
+
+    def configure_user(self, user):
+        """
+        Sets user's email address.
+        """
+        user.email = 'user@example.com'
+        user.save()
+        return user
+
+
+class RemoteUserCustomTest(RemoteUserTest):
+    """
+    Tests a custom RemoteUserBackend subclass that overrides the clean_username
+    and configure_user methods.
+    """
+
+    backend =\
+        'django.contrib.auth.tests.remote_user.CustomRemoteUserBackend'
+    # REMOTE_USER strings with e-mail addresses for the custom backend to
+    # clean.
+    known_user = 'knownuser@example.com'
+    known_user2 = 'knownuser2@example.com'
+
+    def test_known_user(self):
+        """
+        The strings passed in REMOTE_USER should be cleaned and the known users
+        should not have been configured with an email address.
+        """
+        super(RemoteUserCustomTest, self).test_known_user()
+        self.assertEqual(User.objects.get(username='knownuser').email, '')
+        self.assertEqual(User.objects.get(username='knownuser2').email, '')
+
+    def test_unknown_user(self):
+        """
+        The unknown user created should be configured with an email address.
+        """
+        super(RemoteUserCustomTest, self).test_unknown_user()
+        newuser = User.objects.get(username='newuser')
+        self.assertEqual(newuser.email, 'user@example.com')

thirdpart/auth/tests/templates/registration/login.html

@@ -0,0 +1 @@
+{{ form.as_ul }}

thirdpart/auth/tests/templates/registration/password_reset_complete.html

@@ -0,0 +1 @@
+Password reset successfully

thirdpart/auth/tests/templates/registration/password_reset_confirm.html

@@ -0,0 +1,5 @@
+{% if validlink %}
+Please enter your new password: {{ form }}
+{% else %}
+The password reset link was invalid
+{% endif %}

thirdpart/auth/tests/templates/registration/password_reset_done.html

@@ -0,0 +1 @@
+E-mail sent

thirdpart/auth/tests/templates/registration/password_reset_email.html

@@ -0,0 +1 @@
+{{ protocol }}://{{ domain }}/reset/{{ uid }}-{{ token }}/

thirdpart/auth/tests/templates/registration/password_reset_form.html

@@ -0,0 +1 @@
+{{ form }}

thirdpart/auth/tests/tokens.py

@@ -0,0 +1,42 @@
+TOKEN_GENERATOR_TESTS = """
+>>> from django.contrib.auth.models import User, AnonymousUser
+>>> from django.contrib.auth.tokens import PasswordResetTokenGenerator
+>>> from django.conf import settings
+>>> u = User.objects.create_user('tokentestuser', 'test2@example.com', 'testpw')
+>>> p0 = PasswordResetTokenGenerator()
+>>> tk1 = p0.make_token(u)
+>>> p0.check_token(u, tk1)
+True
+
+>>> u = User.objects.create_user('comebackkid', 'test3@example.com', 'testpw')
+>>> p0 = PasswordResetTokenGenerator()
+>>> tk1 = p0.make_token(u)
+>>> reload = User.objects.get(username='comebackkid')
+>>> tk2 = p0.make_token(reload)
+>>> tk1 == tk2
+True
+
+Tests to ensure we can use the token after n days, but no greater.
+Use a mocked version of PasswordResetTokenGenerator so we can change
+the value of 'today'
+
+>>> class Mocked(PasswordResetTokenGenerator):
+...     def __init__(self, today):
+...         self._today_val = today
+...     def _today(self):
+...         return self._today_val
+
+>>> from datetime import date, timedelta
+>>> p1 = Mocked(date.today() + timedelta(settings.PASSWORD_RESET_TIMEOUT_DAYS))
+>>> p1.check_token(u, tk1)
+True
+>>> p2 = Mocked(date.today() + timedelta(settings.PASSWORD_RESET_TIMEOUT_DAYS + 1))
+>>> p2.check_token(u, tk1)
+False
+
+This will put a 14-digit base36 timestamp into the token, which is too large.
+>>> tk1 = p0._make_token_with_timestamp(u, 175455491841851871349)
+>>> p0.check_token(u, tk1)
+False
+
+"""

thirdpart/auth/tests/urls.py

@@ -0,0 +1,18 @@
+from django.conf.urls.defaults import patterns
+from django.contrib.auth.urls import urlpatterns
+from django.http import HttpResponse
+from django.template import Template, RequestContext
+
+def remote_user_auth_view(request):
+    "Dummy view for remote user tests"
+    t = Template("Username is {{ user }}.")
+    c = RequestContext(request, {})
+    return HttpResponse(t.render(c))
+
+# special urls for auth test cases
+urlpatterns += patterns('',
+    (r'^logout/custom_query/$', 'django.contrib.auth.views.logout', dict(redirect_field_name='follow')),
+    (r'^logout/next_page/$', 'django.contrib.auth.views.logout', dict(next_page='/somewhere/')),
+    (r'^remote_user/$', remote_user_auth_view),
+)
+

thirdpart/auth/tests/views.py

@@ -0,0 +1,274 @@
+import os
+import re
+import urllib
+
+from django.conf import settings
+from django.contrib.auth import SESSION_KEY, REDIRECT_FIELD_NAME
+from django.contrib.auth.forms import AuthenticationForm
+from django.contrib.sites.models import Site, RequestSite
+from django.contrib.auth.models import User
+from django.test import TestCase
+from django.core import mail
+from django.core.urlresolvers import reverse
+
+class AuthViewsTestCase(TestCase):
+    """
+    Helper base class for all the follow test cases.
+    """
+    fixtures = ['authtestdata.json']
+    urls = 'django.contrib.auth.urls'
+
+    def setUp(self):
+        self.old_LANGUAGES = settings.LANGUAGES
+        self.old_LANGUAGE_CODE = settings.LANGUAGE_CODE
+        settings.LANGUAGES = (('en', 'English'),)
+        settings.LANGUAGE_CODE = 'en'
+        self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS
+        settings.TEMPLATE_DIRS = (
+            os.path.join(
+                os.path.dirname(__file__),
+                'templates'
+            )
+        ,)
+
+    def tearDown(self):
+        settings.LANGUAGES = self.old_LANGUAGES
+        settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE
+        settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS
+
+class PasswordResetTest(AuthViewsTestCase):
+
+    def test_email_not_found(self):
+        "Error is raised if the provided email address isn't currently registered"
+        response = self.client.get('/password_reset/')
+        self.assertEquals(response.status_code, 200)
+        response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})
+        self.assertContains(response, "That e-mail address doesn't have an associated user account")
+        self.assertEquals(len(mail.outbox), 0)
+
+    def test_email_found(self):
+        "Email is sent if a valid email address is provided for password reset"
+        response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
+        self.assertEquals(response.status_code, 302)
+        self.assertEquals(len(mail.outbox), 1)
+        self.assert_("http://" in mail.outbox[0].body)
+
+    def _test_confirm_start(self):
+        # Start by creating the email
+        response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
+        self.assertEquals(response.status_code, 302)
+        self.assertEquals(len(mail.outbox), 1)
+        return self._read_signup_email(mail.outbox[0])
+
+    def _read_signup_email(self, email):
+        urlmatch = re.search(r"https?://[^/]*(/.*reset/\S*)", email.body)
+        self.assert_(urlmatch is not None, "No URL found in sent email")
+        return urlmatch.group(), urlmatch.groups()[0]
+
+    def test_confirm_valid(self):
+        url, path = self._test_confirm_start()
+        response = self.client.get(path)
+        # redirect to a 'complete' page:
+        self.assertEquals(response.status_code, 200)
+        self.assert_("Please enter your new password" in response.content)
+
+    def test_confirm_invalid(self):
+        url, path = self._test_confirm_start()
+        # Let's munge the token in the path, but keep the same length,
+        # in case the URLconf will reject a different length.
+        path = path[:-5] + ("0"*4) + path[-1]
+
+        response = self.client.get(path)
+        self.assertEquals(response.status_code, 200)
+        self.assert_("The password reset link was invalid" in response.content)
+
+    def test_confirm_invalid_post(self):
+        # Same as test_confirm_invalid, but trying
+        # to do a POST instead.
+        url, path = self._test_confirm_start()
+        path = path[:-5] + ("0"*4) + path[-1]
+
+        response = self.client.post(path, {'new_password1': 'anewpassword',
+                                           'new_password2':' anewpassword'})
+        # Check the password has not been changed
+        u = User.objects.get(email='staffmember@example.com')
+        self.assert_(not u.check_password("anewpassword"))
+
+    def test_confirm_complete(self):
+        url, path = self._test_confirm_start()
+        response = self.client.post(path, {'new_password1': 'anewpassword',
+                                           'new_password2': 'anewpassword'})
+        # It redirects us to a 'complete' page:
+        self.assertEquals(response.status_code, 302)
+        # Check the password has been changed
+        u = User.objects.get(email='staffmember@example.com')
+        self.assert_(u.check_password("anewpassword"))
+
+        # Check we can't use the link again
+        response = self.client.get(path)
+        self.assertEquals(response.status_code, 200)
+        self.assert_("The password reset link was invalid" in response.content)
+
+    def test_confirm_different_passwords(self):
+        url, path = self._test_confirm_start()
+        response = self.client.post(path, {'new_password1': 'anewpassword',
+                                           'new_password2':' x'})
+        self.assertEquals(response.status_code, 200)
+        self.assert_("The two password fields didn't match" in response.content)
+
+class ChangePasswordTest(AuthViewsTestCase):
+
+    def login(self, password='password'):
+        response = self.client.post('/login/', {
+            'username': 'testclient',
+            'password': password
+            }
+        )
+        self.assertEquals(response.status_code, 302)
+        self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL))
+
+    def fail_login(self, password='password'):
+        response = self.client.post('/login/', {
+            'username': 'testclient',
+            'password': password
+            }
+        )
+        self.assertEquals(response.status_code, 200)
+        self.assert_("Please enter a correct username and password. Note that both fields are case-sensitive." in response.content)
+
+    def logout(self):
+        response = self.client.get('/logout/')
+
+    def test_password_change_fails_with_invalid_old_password(self):
+        self.login()
+        response = self.client.post('/password_change/', {
+            'old_password': 'donuts',
+            'new_password1': 'password1',
+            'new_password2': 'password1',
+            }
+        )
+        self.assertEquals(response.status_code, 200)
+        self.assert_("Your old password was entered incorrectly. Please enter it again." in response.content)
+
+    def test_password_change_fails_with_mismatched_passwords(self):
+        self.login()
+        response = self.client.post('/password_change/', {
+            'old_password': 'password',
+            'new_password1': 'password1',
+            'new_password2': 'donuts',
+            }
+        )
+        self.assertEquals(response.status_code, 200)
+        self.assert_("The two password fields didn't match." in response.content)
+
+    def test_password_change_succeeds(self):
+        self.login()
+        response = self.client.post('/password_change/', {
+            'old_password': 'password',
+            'new_password1': 'password1',
+            'new_password2': 'password1',
+            }
+        )
+        self.assertEquals(response.status_code, 302)
+        self.assert_(response['Location'].endswith('/password_change/done/'))
+        self.fail_login()
+        self.login(password='password1')
+
+class LoginTest(AuthViewsTestCase):
+
+    def test_current_site_in_context_after_login(self):
+        response = self.client.get(reverse('django.contrib.auth.views.login'))
+        self.assertEquals(response.status_code, 200)
+        site = Site.objects.get_current()
+        self.assertEquals(response.context['site'], site)
+        self.assertEquals(response.context['site_name'], site.name)
+        self.assert_(isinstance(response.context['form'], AuthenticationForm), 
+                     'Login form is not an AuthenticationForm')
+
+    def test_security_check(self, password='password'):
+        login_url = reverse('django.contrib.auth.views.login')
+
+        # Those URLs should not pass the security check
+        for bad_url in ('http://example.com',
+                        'https://example.com',
+                        'ftp://exampel.com',
+                        '//example.com'):
+
+            nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
+                'url': login_url,
+                'next': REDIRECT_FIELD_NAME,
+                'bad_url': urllib.quote(bad_url)
+            }
+            response = self.client.post(nasty_url, {
+                'username': 'testclient',
+                'password': password,
+                }
+            )
+            self.assertEquals(response.status_code, 302)
+            self.assertFalse(bad_url in response['Location'], "%s should be blocked" % bad_url)
+
+        # Now, these URLs have an other URL as a GET parameter and therefore
+        # should be allowed
+        for url_ in ('http://example.com', 'https://example.com',
+                    'ftp://exampel.com',  '//example.com'):
+            safe_url = '%(url)s?%(next)s=/view/?param=%(safe_param)s' % {
+                'url': login_url,
+                'next': REDIRECT_FIELD_NAME,
+                'safe_param': urllib.quote(url_)
+            }
+            response = self.client.post(safe_url, {
+                    'username': 'testclient',
+                    'password': password,
+                }
+            )
+            self.assertEquals(response.status_code, 302)
+            self.assertTrue('/view/?param=%s' % url_ in response['Location'], "/view/?param=%s should be allowed" % url_)
+
+        
+class LogoutTest(AuthViewsTestCase):
+    urls = 'django.contrib.auth.tests.urls'
+
+    def login(self, password='password'):
+        response = self.client.post('/login/', {
+            'username': 'testclient',
+            'password': password
+            }
+        )
+        self.assertEquals(response.status_code, 302)
+        self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL))
+        self.assert_(SESSION_KEY in self.client.session)
+
+    def confirm_logged_out(self):
+        self.assert_(SESSION_KEY not in self.client.session)
+
+    def test_logout_default(self):
+        "Logout without next_page option renders the default template"
+        self.login()
+        response = self.client.get('/logout/')
+        self.assertEquals(200, response.status_code)
+        self.assert_('Logged out' in response.content)
+        self.confirm_logged_out()
+
+    def test_logout_with_next_page_specified(self): 
+        "Logout with next_page option given redirects to specified resource"
+        self.login()
+        response = self.client.get('/logout/next_page/')
+        self.assertEqual(response.status_code, 302)
+        self.assert_(response['Location'].endswith('/somewhere/'))
+        self.confirm_logged_out()
+
+    def test_logout_with_redirect_argument(self):
+        "Logout with query string redirects to specified resource"
+        self.login()
+        response = self.client.get('/logout/?next=/login/')
+        self.assertEqual(response.status_code, 302)
+        self.assert_(response['Location'].endswith('/login/'))
+        self.confirm_logged_out()
+
+    def test_logout_with_custom_redirect_argument(self):
+        "Logout with custom query string redirects to specified resource"
+        self.login()
+        response = self.client.get('/logout/custom_query/?follow=/somewhere/')
+        self.assertEqual(response.status_code, 302)
+        self.assert_(response['Location'].endswith('/somewhere/'))
+        self.confirm_logged_out()

thirdpart/auth/tokens.py

@@ -0,0 +1,66 @@
+from datetime import date
+from django.conf import settings
+from django.utils.http import int_to_base36, base36_to_int
+
+class PasswordResetTokenGenerator(object):
+    """
+    Strategy object used to generate and check tokens for the password
+    reset mechanism.
+    """
+    def make_token(self, user):
+        """
+        Returns a token that can be used once to do a password reset
+        for the given user.
+        """
+        return self._make_token_with_timestamp(user, self._num_days(self._today()))
+
+    def check_token(self, user, token):
+        """
+        Check that a password reset token is correct for a given user.
+        """
+        # Parse the token
+        try:
+            ts_b36, hash = token.split("-")
+        except ValueError:
+            return False
+
+        try:
+            ts = base36_to_int(ts_b36)
+        except ValueError:
+            return False
+
+        # Check that the timestamp/uid has not been tampered with
+        if self._make_token_with_timestamp(user, ts) != token:
+            return False
+
+        # Check the timestamp is within limit
+        if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS:
+            return False
+
+        return True
+
+    def _make_token_with_timestamp(self, user, timestamp):
+        # timestamp is number of days since 2001-1-1.  Converted to
+        # base 36, this gives us a 3 digit string until about 2121
+        ts_b36 = int_to_base36(timestamp)
+
+        # By hashing on the internal state of the user and using state
+        # that is sure to change (the password salt will change as soon as
+        # the password is set, at least for current Django auth, and
+        # last_login will also change), we produce a hash that will be
+        # invalid as soon as it is used.
+        # We limit the hash to 20 chars to keep URL short
+        from django.utils.hashcompat import sha_constructor
+        hash = sha_constructor(settings.SECRET_KEY + unicode(user.id) +
+                               user.password + user.last_login.strftime('%Y-%m-%d %H:%M:%S') +
+                               unicode(timestamp)).hexdigest()[::2]
+        return "%s-%s" % (ts_b36, hash)
+
+    def _num_days(self, dt):
+        return (dt - date(2001,1,1)).days
+
+    def _today(self):
+        # Used for mocking in tests
+        return date.today()
+
+default_token_generator = PasswordResetTokenGenerator()

thirdpart/auth/urls.py

@@ -0,0 +1,17 @@
+# These URLs are normally mapped to /admin/urls.py. This URLs file is
+# provided as a convenience to those who want to deploy these URLs elsewhere.
+# This file is also used to provide a reliable view deployment for test purposes.
+
+from django.conf.urls.defaults import *
+
+urlpatterns = patterns('',
+    (r'^login/$', 'django.contrib.auth.views.login'),
+    (r'^logout/$', 'django.contrib.auth.views.logout'),
+    (r'^password_change/$', 'django.contrib.auth.views.password_change'),
+    (r'^password_change/done/$', 'django.contrib.auth.views.password_change_done'),
+    (r'^password_reset/$', 'django.contrib.auth.views.password_reset'),
+    (r'^password_reset/done/$', 'django.contrib.auth.views.password_reset_done'),
+    (r'^reset/(?P<uidb36>[0-9A-Za-z]{1,13})-(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$', 'django.contrib.auth.views.password_reset_confirm'),
+    (r'^reset/done/$', 'django.contrib.auth.views.password_reset_complete'),
+)
+

thirdpart/auth/views.py

@@ -0,0 +1,190 @@
+import re
+from django.conf import settings
+from django.contrib.auth import REDIRECT_FIELD_NAME
+# Avoid shadowing the login() view below.
+from django.contrib.auth import login as auth_login
+from django.contrib.auth.decorators import login_required
+from django.contrib.auth.forms import AuthenticationForm
+from django.contrib.auth.forms import PasswordResetForm, SetPasswordForm, PasswordChangeForm
+from django.contrib.auth.tokens import default_token_generator
+from django.views.decorators.csrf import csrf_protect
+from django.core.urlresolvers import reverse
+from django.shortcuts import render_to_response, get_object_or_404
+from django.contrib.sites.models import Site, RequestSite
+from django.http import HttpResponseRedirect, Http404
+from django.template import RequestContext
+from django.utils.http import urlquote, base36_to_int
+from django.utils.translation import ugettext as _
+from django.contrib.auth.models import User
+from django.views.decorators.cache import never_cache
+
+@csrf_protect
+@never_cache
+def login(request, template_name='registration/login.html',
+          redirect_field_name=REDIRECT_FIELD_NAME,
+          authentication_form=AuthenticationForm):
+    """Displays the login form and handles the login action."""
+
+    redirect_to = request.REQUEST.get(redirect_field_name, '')
+    
+    if request.method == "POST":
+        form = authentication_form(data=request.POST)
+        if form.is_valid():
+            # Light security check -- make sure redirect_to isn't garbage.
+            if not redirect_to or ' ' in redirect_to:
+                redirect_to = settings.LOGIN_REDIRECT_URL
+            
+            # Heavier security check -- redirects to http://example.com should 
+            # not be allowed, but things like /view/?param=http://example.com 
+            # should be allowed. This regex checks if there is a '//' *before* a
+            # question mark.
+            elif '//' in redirect_to and re.match(r'[^\?]*//', redirect_to):
+                    redirect_to = settings.LOGIN_REDIRECT_URL
+            
+            # Okay, security checks complete. Log the user in.
+            auth_login(request, form.get_user())
+
+            if request.session.test_cookie_worked():
+                request.session.delete_test_cookie()
+
+            return HttpResponseRedirect(redirect_to)
+
+    else:
+        form = authentication_form(request)
+    
+    request.session.set_test_cookie()
+    
+    if Site._meta.installed:
+        current_site = Site.objects.get_current()
+    else:
+        current_site = RequestSite(request)
+    
+    return render_to_response(template_name, {
+        'form': form,
+        redirect_field_name: redirect_to,
+        'site': current_site,
+        'site_name': current_site.name,
+    }, context_instance=RequestContext(request))
+
+def logout(request, next_page=None, template_name='registration/logged_out.html', redirect_field_name=REDIRECT_FIELD_NAME):
+    "Logs out the user and displays 'You are logged out' message."
+    from django.contrib.auth import logout
+    logout(request)
+    if next_page is None:
+        redirect_to = request.REQUEST.get(redirect_field_name, '')
+        if redirect_to:
+            return HttpResponseRedirect(redirect_to)
+        else:
+            return render_to_response(template_name, {
+                'title': _('Logged out')
+            }, context_instance=RequestContext(request))
+    else:
+        # Redirect to this page until the session has been cleared.
+        return HttpResponseRedirect(next_page or request.path)
+
+def logout_then_login(request, login_url=None):
+    "Logs out the user if he is logged in. Then redirects to the log-in page."
+    if not login_url:
+        login_url = settings.LOGIN_URL
+    return logout(request, login_url)
+
+def redirect_to_login(next, login_url=None, redirect_field_name=REDIRECT_FIELD_NAME):
+    "Redirects the user to the login page, passing the given 'next' page"
+    if not login_url:
+        login_url = settings.LOGIN_URL
+    return HttpResponseRedirect('%s?%s=%s' % (login_url, urlquote(redirect_field_name), urlquote(next)))
+
+# 4 views for password reset:
+# - password_reset sends the mail
+# - password_reset_done shows a success message for the above
+# - password_reset_confirm checks the link the user clicked and 
+#   prompts for a new password
+# - password_reset_complete shows a success message for the above
+
+@csrf_protect
+def password_reset(request, is_admin_site=False, template_name='registration/password_reset_form.html',
+        email_template_name='registration/password_reset_email.html',
+        password_reset_form=PasswordResetForm, token_generator=default_token_generator,
+        post_reset_redirect=None):
+    if post_reset_redirect is None:
+        post_reset_redirect = reverse('django.contrib.auth.views.password_reset_done')
+    if request.method == "POST":
+        form = password_reset_form(request.POST)
+        if form.is_valid():
+            opts = {}
+            opts['use_https'] = request.is_secure()
+            opts['token_generator'] = token_generator
+            if is_admin_site:
+                opts['domain_override'] = request.META['HTTP_HOST']
+            else:
+                opts['email_template_name'] = email_template_name
+                if not Site._meta.installed:
+                    opts['domain_override'] = RequestSite(request).domain
+            form.save(**opts)
+            return HttpResponseRedirect(post_reset_redirect)
+    else:
+        form = password_reset_form()
+    return render_to_response(template_name, {
+        'form': form,
+    }, context_instance=RequestContext(request))
+
+def password_reset_done(request, template_name='registration/password_reset_done.html'):
+    return render_to_response(template_name, context_instance=RequestContext(request))
+
+# Doesn't need csrf_protect since no-one can guess the URL
+def password_reset_confirm(request, uidb36=None, token=None, template_name='registration/password_reset_confirm.html',
+                           token_generator=default_token_generator, set_password_form=SetPasswordForm,
+                           post_reset_redirect=None):
+    """
+    View that checks the hash in a password reset link and presents a
+    form for entering a new password.
+    """
+    assert uidb36 is not None and token is not None # checked by URLconf
+    if post_reset_redirect is None:
+        post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete')
+    try:
+        uid_int = base36_to_int(uidb36)
+    except ValueError:
+        raise Http404
+
+    user = get_object_or_404(User, id=uid_int)
+    context_instance = RequestContext(request)
+
+    if token_generator.check_token(user, token):
+        context_instance['validlink'] = True
+        if request.method == 'POST':
+            form = set_password_form(user, request.POST)
+            if form.is_valid():
+                form.save()
+                return HttpResponseRedirect(post_reset_redirect)
+        else:
+            form = set_password_form(None)
+    else:
+        context_instance['validlink'] = False
+        form = None
+    context_instance['form'] = form
+    return render_to_response(template_name, context_instance=context_instance)
+
+def password_reset_complete(request, template_name='registration/password_reset_complete.html'):
+    return render_to_response(template_name, context_instance=RequestContext(request,
+                                                                             {'login_url': settings.LOGIN_URL}))
+
+@csrf_protect
+@login_required
+def password_change(request, template_name='registration/password_change_form.html',
+                    post_change_redirect=None, password_change_form=PasswordChangeForm):
+    if post_change_redirect is None:
+        post_change_redirect = reverse('django.contrib.auth.views.password_change_done')
+    if request.method == "POST":
+        form = password_change_form(user=request.user, data=request.POST)
+        if form.is_valid():
+            form.save()
+            return HttpResponseRedirect(post_change_redirect)
+    else:
+        form = password_change_form(user=request.user)
+    return render_to_response(template_name, {
+        'form': form,
+    }, context_instance=RequestContext(request))
+
+def password_change_done(request, template_name='registration/password_change_done.html'):
+    return render_to_response(template_name, context_instance=RequestContext(request))