# Path: apps/core/backends/sudo.py
# def sudo_password_needed(session: SessionBase) -> bool:
#     """
#     Check whether password reentry is necessary for sudo actions
#     """
#     timestamp = int(session.get(SUDO_SESSION_KEY, '0'))
#     time_diff = time.time() - timestamp
#     return time_diff >= SUDO_TIMEOUT_SEC or time_diff < 0
# 
# def sudo_renew(request) -> None:
#     """
#     Renew sudo session timeout
#     """
#     request.session[SUDO_SESSION_KEY] = time.time()


import logging
from functools import wraps
from django.contrib.auth.hashers import check_password
from django.core.exceptions import PermissionDenied
from django.shortcuts import redirect, render
from apps.core.backends.sudo import sudo_password_needed, sudo_renew
    return _user_required(
        lambda u: not u.profile.test_only,
        raise_error=True,
    )(view_func)


# sudo mode is required
def sudo_required(view_func):
    @wraps(view_func)
    def _wrapped_view(request, *args, **kwargs):
        logger = logging.getLogger('sso.auth')
        user = request.user
        if not user.has_usable_password():
            return view_func(request, *args, **kwargs)

        if not sudo_password_needed(request.session):
            sudo_renew(request)
            return view_func(request, *args, **kwargs)

        fail = False
        if request.method == 'POST':
            password = request.POST.get('password', '')
            success = check_password(password, user.password)

            log_msg = 'success' if success else 'fail'
            (logger.info if success else logger.warning)(f'sudo.{log_msg}', {
                'r': request,
                'extra': [('path', request.path)],
            })
            if success:

# Path: apps/core/backends/sudo.py
# def sudo_password_needed(session: SessionBase) -> bool:
#     """
#     Check whether password reentry is necessary for sudo actions
#     """
#     timestamp = int(session.get(SUDO_SESSION_KEY, '0'))
#     time_diff = time.time() - timestamp
#     return time_diff >= SUDO_TIMEOUT_SEC or time_diff < 0
# 
# def sudo_renew(request) -> None:
#     """
#     Renew sudo session timeout
#     """
#     request.session[SUDO_SESSION_KEY] = time.time()


# Path: apps/core/backends/decorator.py
import logging
from functools import wraps
from django.contrib.auth.hashers import check_password
from django.core.exceptions import PermissionDenied
from django.shortcuts import redirect, render
from apps.core.backends.sudo import sudo_password_needed, sudo_renew

    return _user_required(
        lambda u: not u.profile.test_only,
        raise_error=True,
    )(view_func)


# sudo mode is required
def sudo_required(view_func):
    @wraps(view_func)
    def _wrapped_view(request, *args, **kwargs):
        logger = logging.getLogger('sso.auth')
        user = request.user
        if not user.has_usable_password():
            return view_func(request, *args, **kwargs)

        if not sudo_password_needed(request.session):
            sudo_renew(request)
            return view_func(request, *args, **kwargs)

        fail = False
        if request.method == 'POST':
            password = request.POST.get('password', '')
            success = check_password(password, user.password)

            log_msg = 'success' if success else 'fail'
            (logger.info if success else logger.warning)(f'sudo.{log_msg}', {
                'r': request,
                'extra': [('path', request.path)],
            })
            if success:

                sudo_renew(request)