<commit_before>; Copyright © 2013 - 2016 Dr. <NAME> <<EMAIL>>
; Licensed under the terms of the GNU Affero General Public License v3.
; See the "LICENSE.txt" file provided with this software.


(ns cider-ci.auth.anti-forgery
  (:require

    [crypto.random]

    [clj-logging-config.log4j :as logging-config]
    [clojure.tools.logging :as logging]
    [logbug.debug :as debug :refer [I> I>>]]
    [logbug.ring :refer [wrap-handler-with-logging]]
    [logbug.thrown :as thrown]
    ))

(def cookie-name "cider-ci_anti-forgery-token")

(defn cookie [token]
  {:value token
   :http-only true
   :path "/"
   })

(defn- session-authentication? [request]
  (boolean
    (when (-> request :authenticated-user) ; only users can use session auth
      (not (#{"basic-auth"}
             (-> request :authenticated-user :authentication-method))))))

(defn- safe-request? [request]
  (boolean
    ( #{:get :head :options :trace} (-> request :request-method keyword))))

(defn- valid-forgery-protection? [token request]
  (boolean
    (when token
      (when-let [x-csrf-header-token (-> request :headers (get "x-csrf-token"))]
        (= x-csrf-header-token token)))))

(def response-401
  (let [msg "Mutating requests must either authenticate
            with basic authentication or provide a valid
            X-CSRF-TOKEN header!"]
    response-401 {:status 401
                  :body msg
                  :headers {"WWW-Authenticate" msg}}))

(defn process [request handler]
  (logging/info request)
  (let [token (or (-> request :cookies (get cookie-name nil) :value)
                  (crypto.random/base64 32))
        resp (if (and (not (safe-request? request))
                      (not (valid-forgery-protection? token request))<commit_msg>Remove logging statement<commit_after>; Copyright © 2013 - 2016 Dr. <NAME> <<EMAIL>>
; Licensed under the terms of the GNU Affero General Public License v3.
; See the "LICENSE.txt" file provided with this software.


(ns cider-ci.auth.anti-forgery
  (:require

    [crypto.random]

    [clj-logging-config.log4j :as logging-config]
    [clojure.tools.logging :as logging]
    [logbug.debug :as debug :refer [I> I>>]]
    [logbug.ring :refer [wrap-handler-with-logging]]
    [logbug.thrown :as thrown]
    ))

(def cookie-name "cider-ci_anti-forgery-token")

(defn cookie [token]
  {:value token
   :http-only true
   :path "/"
   })

(defn- session-authentication? [request]
  (boolean
    (when (-> request :authenticated-user) ; only users can use session auth
      (not (#{"basic-auth"}
             (-> request :authenticated-user :authentication-method))))))

(defn- safe-request? [request]
  (boolean
    ( #{:get :head :options :trace} (-> request :request-method keyword))))

(defn- valid-forgery-protection? [token request]
  (boolean
    (when token
      (when-let [x-csrf-header-token (-> request :headers (get "x-csrf-token"))]
        (= x-csrf-header-token token)))))

(def response-401
  (let [msg "Mutating requests must either authenticate
            with basic authentication or provide a valid
            X-CSRF-TOKEN header!"]
    response-401 {:status 401
                  :body msg
                  :headers {"WWW-Authenticate" msg}}))

(defn process [request handler]
  (let [token (or (-> request :cookies (get cookie-name nil) :value)
                  (crypto.random/base64 32))
        resp (if (and (not (safe-request? request))
                      (not (valid-forgery-protection? token request))
{'fraction_non_alphanumeric': 0.140598044853364, 'fraction_numerical': 0.013225991949396205, 'mean_word_length': 2.8063457330415753, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 25, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '801520', 'n_tokens_mistral': 1149, 'n_tokens_neox': 1088, 'n_words': 315}