From 7e94f5e9414bc77ec2e03be4dcf3ef2d8c3ab523 Mon Sep 17 00:00:00 2001
From: saj-derilinx <lakshitha@derilinx.com>
Date: Fri, 17 Nov 2023 12:21:11 +0000
Subject: [PATCH 1/6] Enable email login

---
 ckanext/security/utils.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ckanext/security/utils.py b/ckanext/security/utils.py
index bd19991..3da7385 100644
--- a/ckanext/security/utils.py
+++ b/ckanext/security/utils.py
@@ -123,6 +123,8 @@ def login():
 
         user_name = identity['login']
         user = model.User.by_name(user_name)
+        if not user:
+            user = model.User.by_email(user_name)
 
         login_throttle_key = get_login_throttle_key(request, user_name)
         if login_throttle_key is None:
@@ -174,7 +176,6 @@ def login():
                 log.info('User %s supplied invalid 2fa code', user_name)
                 response_status = 403
                 throttle.increment()
-
         return (response_status, json.dumps(res))
 
     except Exception as err:

From 4e0b483f0e43b3555c083c7f19e53128c8aacba3 Mon Sep 17 00:00:00 2001
From: saj-derilinx <lakshitha@derilinx.com>
Date: Fri, 17 Nov 2023 12:40:16 +0000
Subject: [PATCH 2/6] Get user name from user model object

---
 ckanext/security/authenticator.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/ckanext/security/authenticator.py b/ckanext/security/authenticator.py
index 84955a2..44102a8 100644
--- a/ckanext/security/authenticator.py
+++ b/ckanext/security/authenticator.py
@@ -6,6 +6,7 @@
     import pylons
     from ckan.lib.cli import MockTranslator
 
+from ckan import model
 from ckan.lib.authenticator import UsernamePasswordAuthenticator
 from ckan.model import User
 from ckan.common import config
@@ -73,6 +74,10 @@ def authenticate(self, environ, identity):
         to log into a specific account within a period of time."""
         try:
             user_name = identity['login']
+            user = model.User.by_name(user_name)
+            if not user:
+                user = model.User.by_email(user_name)
+            user_name = user.name
         except KeyError:
             return None
 

From 2bdfc0c8d377a5188329dab31ea2ee9bae0a8647 Mon Sep 17 00:00:00 2001
From: saj-derilinx <lakshitha@derilinx.com>
Date: Fri, 17 Nov 2023 12:44:27 +0000
Subject: [PATCH 3/6] Fix form label and disable help link

---
 ckanext/security/templates/user/snippets/login_form.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ckanext/security/templates/user/snippets/login_form.html b/ckanext/security/templates/user/snippets/login_form.html
index 6268c72..83d84e0 100644
--- a/ckanext/security/templates/user/snippets/login_form.html
+++ b/ckanext/security/templates/user/snippets/login_form.html
@@ -29,7 +29,7 @@
   <div id="login-form">
 
     <div id="login-fields">
-      {{ form.input('login', label=_("Username"), id='field-login', value="", error=username_error, classes=["control-medium"]) }}
+      {{ form.input('login', label=_("Username or Email"), id='field-login', value="", error=username_error, classes=["control-medium"]) }}
 
       {{ form.input('password', label=_("Password"), id='field-password', type="password", value="", error=password_error, classes=["control-medium"]) }}
     </div>
@@ -61,7 +61,7 @@
 
     <input id="mfa-form-active" name="mfa-form-active" type="hidden" value="" />
     <div class="form-actions">
-      <a id="mfa-help-link" href="/" style="display: none; margin-right: 20px;">{{_('Need help?')}}</a>
+      {# <a id="mfa-help-link" href="/" style="display: none; margin-right: 20px;">{{_('Need help?')}}</a> #}
       <button class="btn btn-primary" type="submit">{{ _('Submit') }}</button>
     </div>
   </div>

From 5eb06bfbe879b24c1f668d1f233f281287c47865 Mon Sep 17 00:00:00 2001
From: saj-derilinx <lakshitha@derilinx.com>
Date: Mon, 4 Dec 2023 13:32:00 +0000
Subject: [PATCH 4/6] Change text

---
 ckanext/security/templates/user/snippets/login_form.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ckanext/security/templates/user/snippets/login_form.html b/ckanext/security/templates/user/snippets/login_form.html
index 83d84e0..de43fc5 100644
--- a/ckanext/security/templates/user/snippets/login_form.html
+++ b/ckanext/security/templates/user/snippets/login_form.html
@@ -46,7 +46,7 @@
   <div id="mfa-form" style="display: none;">
     <fieldset id="mfa-setup" style="display: none;">
       <legend>{{_('Scan this QR code with your two factor authentication app')}}</legend>
-      <p>{% trans %}If you don't already have an authenticator app, you could try Google Authenticator.{% endtrans %}</p>
+      <p>{% trans %}If you don't already have an authenticator app, you could try Microsoft Authenticator.{% endtrans %}</p>
 
       <div>
         <canvas class="radius-lg padding-sm margin-b-sm border-solid" id="qr-code-container"></canvas>

From 0c6d8ee5aa79a0caa6bcf7a6f3234387eeb6c6fb Mon Sep 17 00:00:00 2001
From: Eric Soroos <eric@derilinx.com>
Date: Mon, 11 Dec 2023 11:44:09 +0000
Subject: [PATCH 5/6] Add the validations as get_validators instead of monkey
 patching

---
 ckanext/security/plugin/__init__.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/ckanext/security/plugin/__init__.py b/ckanext/security/plugin/__init__.py
index fc0f311..4269957 100644
--- a/ckanext/security/plugin/__init__.py
+++ b/ckanext/security/plugin/__init__.py
@@ -9,6 +9,7 @@
     validate_upload_type, validate_upload_presence
 )
 from ckanext.security.logic import auth, action
+from ckanext.security import validators
 
 try:
     tk.requires_ckan_version("2.9")
@@ -26,6 +27,7 @@ class CkanSecurityPlugin(MixinPlugin, p.SingletonPlugin):
     p.implements(p.IActions)
     p.implements(p.IAuthFunctions)
     p.implements(p.ITemplateHelpers)
+    p.implements(p.IValidators)
 
     # BEGIN Hooks for IConfigurer
 
@@ -50,6 +52,14 @@ def update_config(self, config):
 
     # END Hooks for IConfigurer
 
+    # BEGIN hooks for IValidators
+    def get_validators(self):
+        return {
+            'user_password_validator': validators.user_password_validator,
+            'old_username_validator': validators.old_username_validator,
+        }
+    # END hooks for IValidators
+    
     # BEGIN Hooks for IResourceController
 
     def before_create(self, context, resource):

From 51075b558267eac254c01887501e5ffcdeeba973 Mon Sep 17 00:00:00 2001
From: Eric Soroos <eric@derilinx.com>
Date: Wed, 20 Dec 2023 17:47:35 +0000
Subject: [PATCH 6/6] add validation for too many repeated characters

---
 ckanext/security/validators.py | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/ckanext/security/validators.py b/ckanext/security/validators.py
index c884d0e..0f4ffac 100644
--- a/ckanext/security/validators.py
+++ b/ckanext/security/validators.py
@@ -1,6 +1,7 @@
 # encoding: utf-8
 import six
 import string
+import collections
 
 from ckan import authz
 from ckan.common import _
@@ -10,9 +11,24 @@
 MIN_LEN_ERROR = (
     'Your password must be {} characters or longer, and consist of at least '
     'three of the following character sets: uppercase characters, lowercase '
-    'characters, digits, punctuation & special characters.'
+    'characters, digits, punctuation & special characters, and not contain '
+    'too many repeated characters.'
 )
 
+def _too_many_repeated_characters(value):
+    """ does the password contain too many repeated characters 
+
+    Returns True if the most frequent character is >= 1/3 of the characters.
+    e.g. "password" is false: ct(s)==2 < 8/3
+         "aaaaword" is true: ct(a)==4 > 8/3
+
+    :param s: proposed password
+    :returns: boolean, True if password is ok by this criteria
+    """
+    char_counts = collections.Counter(value)
+    # note, will fail on empty password, but caller checks MIN_PASSWORD_LENGTH
+    return (char_counts.most_common(1)[0][1] >=  (len(value)/3))
+
 
 def user_password_validator(key, data, errors, context):
     value = data[key]
@@ -31,7 +47,8 @@ def user_password_validator(key, data, errors, context):
             any(x.isdigit() for x in value),
             any(x in string.punctuation for x in value)
         ]
-        if len(value) < MIN_PASSWORD_LENGTH or sum(rules) < 3:
+        if len(value) < MIN_PASSWORD_LENGTH or sum(rules) < 3 \
+           or _too_many_repeated_characters(value):
             raise Invalid(_(MIN_LEN_ERROR.format(MIN_PASSWORD_LENGTH)))