<commit_before>import logging
from xml.dom import minidom
import time

try:
    from xml.etree import ElementTree
except ImportError:
    from elementtree import ElementTree

try:
    from urllib import urlencode
except ImportError:
    from urllib.parse import urlencode
try:
    from urllib import urlopen
except ImportError:
    from urllib.request import urlopen
try:
    from urlparse import urljoin
except ImportError:
    from urllib.parse import urljoin


from django.conf import settings
from django.contrib.auth import get_user_model

from cas.exceptions import CasTicketException
from cas.models import Tgt, PgtIOU
from cas.utils import cas_response_callbacks

__all__ = ['CASBackend']

logger = logging.getLogger(__name__)


def _verify_cas1(ticket, service):
    """
    Verifies CAS 1.0 authentication ticket.

    :param: ticket
    :param: service

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}
    url = (urljoin(settings.CAS_SERVER_URL, 'validate') + '?' +
           urlencode(params))
    page = urlopen(url)

    try:
        verified = page.readline().strip()
        if verified == 'yes':
            return page.readline().strip()
        else:
            return None
    finally:
        page.close()


def _verify_cas2(ticket, service):
    """
    Verifies CAS 2.0+ XML-based authentication ticket.

    :param: ticket
    :param: service
    """
    return _internal_verify_cas(ticket, service, 'proxyValidate')


def _verify_cas3(ticket, service):
    return _internal_verify_cas(ticket, service, 'p3/proxyValidate')


def _internal_verify_cas(ticket, service, suffix):
    """Verifies CAS 2.0 and 3.0 XML-based authentication ticket.

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}
    if settings.CAS_PROXY_CALLBACK:
        params['pgtUrl'] = settings.CAS_PROXY_CALLBACK

    url = (urljoin(settings.CAS_SERVER_URL, suffix) + '?' +
           urlencode(params))

    page = urlopen(url)

    username = None

    try:
        response = page.read()
        tree = ElementTree.fromstring(response)
        document = minidom.parseString(response)

        if tree[0].tag.endswith('authenticationSuccess'):
            if settings.CAS_RESPONSE_CALLBACKS:
                cas_response_callbacks(tree)

            username = tree[0][0].text
            
            # The CAS Response includes the PGT_IOU, which we use to lookup the PGT/TGT.
            pgt_element = document.getElementsByTagName('cas:proxyGrantingTicket')

            if pgt_element:
                pgt_iou_token = pgt_element[0].firstChild.nodeValue
                try:
                    pgt_iou_mapping = _get_pgt_iou_mapping(pgt_iou_token)
                except Exception as e:
                    logger.warning('Failed to do proxy authentication. %s' % e)
                else:
                    try:
                        tgt = Tgt.objects.get(username=username)
                    except Tgt.DoesNotExist:
                        Tgt.objects.create(username=username, tgt=pgt_iou_mapping.tgt)
                        logger.info('Creating TGT ticket for {user}'.format(user=username))
                    else:
                        tgt.tgt = pgt_iou_mapping.tgt
                        tgt.save()
                    pgt_iou_mapping.delete()

        else:
            failure = document.getElementsByTagName('cas:authenticationFailure')
            if failure:
                logger.warn('Authentication failed from CAS server: %s',
                            failure[0].firstChild.nodeValue)

    except Exception as e:
        logger.error('Failed to verify CAS authentication: {message}'.format(
            message=e
        ))

    finally:
        page.close()

    return username


def verify_proxy_ticket(ticket, service):
    """
    Verifies CAS 2.0+ XML-based proxy ticket.

    :param: ticket
    :param: service

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}

    url = (urljoin(settings.CAS_SERVER_URL, 'proxyValidate') + '?' +
           urlencode(params))

    page = urlopen(url)

    try:
        response = page.read()
        tree = ElementTree.fromstring(response)
        if tree[0].tag.endswith('authenticationSuccess'):
            username = tree[0][0].text
            proxies = []
            if len(tree[0]) > 1:
                for element in tree[0][1]:
                    proxies.append(element.text)
            return {"username": username, "proxies": proxies}
        else:
            return None
    finally:
        page.close()


_PROTOCOLS = {'1': _verify_cas1, '2': _verify_cas2, '3': _verify_cas3}

if settings.CAS_VERSION not in _PROTOCOLS:
    raise ValueError('Unsupported CAS_VERSION %r' % settings.CAS_VERSION)

_verify = _PROTOCOLS[settings.CAS_VERSION]


def _get_pgt_iou_mapping(pgt_iou):
    """
     Returns the instance of PgtIou -> Pgt mapping which is associated with the provided pgt_iou token.
     Because this mapping is created in a  different request which the CAS server makes to the proxy callback url which
     has completed before this call it may not be found in the database by this calling thread, hence the attempt to get
     the ticket is retried for up to 5 seconds.
     This should be handled some better way.

     Users can opt out of this waiting period by setting CAS_PGT_FETCH_WAIT = False

     :param: pgt_iou

     """
    retries_left = 5

    if not settings.CAS_PGT_FETCH_WAIT:
        retries_left = 1

    while retries_left:
        try:<commit_msg>Tidied up the grammar in the _get_pgt_iou_mapping documentation.<commit_after>import logging
from xml.dom import minidom
import time

try:
    from xml.etree import ElementTree
except ImportError:
    from elementtree import ElementTree

try:
    from urllib import urlencode
except ImportError:
    from urllib.parse import urlencode
try:
    from urllib import urlopen
except ImportError:
    from urllib.request import urlopen
try:
    from urlparse import urljoin
except ImportError:
    from urllib.parse import urljoin


from django.conf import settings
from django.contrib.auth import get_user_model

from cas.exceptions import CasTicketException
from cas.models import Tgt, PgtIOU
from cas.utils import cas_response_callbacks

__all__ = ['CASBackend']

logger = logging.getLogger(__name__)


def _verify_cas1(ticket, service):
    """
    Verifies CAS 1.0 authentication ticket.

    :param: ticket
    :param: service

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}
    url = (urljoin(settings.CAS_SERVER_URL, 'validate') + '?' +
           urlencode(params))
    page = urlopen(url)

    try:
        verified = page.readline().strip()
        if verified == 'yes':
            return page.readline().strip()
        else:
            return None
    finally:
        page.close()


def _verify_cas2(ticket, service):
    """
    Verifies CAS 2.0+ XML-based authentication ticket.

    :param: ticket
    :param: service
    """
    return _internal_verify_cas(ticket, service, 'proxyValidate')


def _verify_cas3(ticket, service):
    return _internal_verify_cas(ticket, service, 'p3/proxyValidate')


def _internal_verify_cas(ticket, service, suffix):
    """Verifies CAS 2.0 and 3.0 XML-based authentication ticket.

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}
    if settings.CAS_PROXY_CALLBACK:
        params['pgtUrl'] = settings.CAS_PROXY_CALLBACK

    url = (urljoin(settings.CAS_SERVER_URL, suffix) + '?' +
           urlencode(params))

    page = urlopen(url)

    username = None

    try:
        response = page.read()
        tree = ElementTree.fromstring(response)
        document = minidom.parseString(response)

        if tree[0].tag.endswith('authenticationSuccess'):
            if settings.CAS_RESPONSE_CALLBACKS:
                cas_response_callbacks(tree)

            username = tree[0][0].text
            
            # The CAS Response includes the PGT_IOU, which we use to lookup the PGT/TGT.
            pgt_element = document.getElementsByTagName('cas:proxyGrantingTicket')

            if pgt_element:
                pgt_iou_token = pgt_element[0].firstChild.nodeValue
                try:
                    pgt_iou_mapping = _get_pgt_iou_mapping(pgt_iou_token)
                except Exception as e:
                    logger.warning('Failed to do proxy authentication. %s' % e)
                else:
                    try:
                        tgt = Tgt.objects.get(username=username)
                    except Tgt.DoesNotExist:
                        Tgt.objects.create(username=username, tgt=pgt_iou_mapping.tgt)
                        logger.info('Creating TGT ticket for {user}'.format(user=username))
                    else:
                        tgt.tgt = pgt_iou_mapping.tgt
                        tgt.save()
                    pgt_iou_mapping.delete()

        else:
            failure = document.getElementsByTagName('cas:authenticationFailure')
            if failure:
                logger.warn('Authentication failed from CAS server: %s',
                            failure[0].firstChild.nodeValue)

    except Exception as e:
        logger.error('Failed to verify CAS authentication: {message}'.format(
            message=e
        ))

    finally:
        page.close()

    return username


def verify_proxy_ticket(ticket, service):
    """
    Verifies CAS 2.0+ XML-based proxy ticket.

    :param: ticket
    :param: service

    Returns username on success and None on failure.
    """

    params = {'ticket': ticket, 'service': service}

    url = (urljoin(settings.CAS_SERVER_URL, 'proxyValidate') + '?' +
           urlencode(params))

    page = urlopen(url)

    try:
        response = page.read()
        tree = ElementTree.fromstring(response)
        if tree[0].tag.endswith('authenticationSuccess'):
            username = tree[0][0].text
            proxies = []
            if len(tree[0]) > 1:
                for element in tree[0][1]:
                    proxies.append(element.text)
            return {"username": username, "proxies": proxies}
        else:
            return None
    finally:
        page.close()


_PROTOCOLS = {'1': _verify_cas1, '2': _verify_cas2, '3': _verify_cas3}

if settings.CAS_VERSION not in _PROTOCOLS:
    raise ValueError('Unsupported CAS_VERSION %r' % settings.CAS_VERSION)

_verify = _PROTOCOLS[settings.CAS_VERSION]


def _get_pgt_iou_mapping(pgt_iou):
    """
     Returns the instance of PgtIou -> Pgt mapping which is associated with the provided pgt_iou token.
     Because this mapping is created in a  different request which the CAS server makes to the proxy callback url, the
     PGTIOU->PGT mapping might not be found yet in the database by this calling thread, hence the attempt to get
     the ticket is retried for up to 5 seconds.
     This should be handled some better way.

     Users can opt out of this waiting period by setting CAS_PGT_FETCH_WAIT = False

     :param: pgt_iou

     """
    retries_left = 5

    if not settings.CAS_PGT_FETCH_WAIT:
        retries_left = 1

    while retries_left:
        try:
{'fraction_non_alphanumeric': 0.08528222261297697, 'fraction_numerical': 0.006154387198874627, 'mean_word_length': 2.3544677086405192, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5473933', 'n_tokens_mistral': 3400, 'n_tokens_neox': 3220, 'n_words': 907}