Files
notifications-admin/requirements.txt

238 lines
4.7 KiB
Plaintext
Raw Normal View History

#
# This file is autogenerated by pip-compile with python 3.6
# To update, run:
#
# pip-compile requirements.in
#
ago==0.0.93
# via -r requirements.in
2021-05-31 14:54:12 +01:00
awscli==1.19.84
# via
# awscli-cwlogs
# notifications-utils
awscli-cwlogs==1.4.6
# via -r requirements.in
bleach==3.3.0
# via notifications-utils
blinker==1.4
# via
# -r requirements.in
# gds-metrics
2021-05-31 14:54:12 +01:00
boto3==1.17.84
# via notifications-utils
botocore==1.20.84
# via
# awscli
# boto3
# s3transfer
2021-05-31 14:54:13 +01:00
cachetools==4.2.2
# via notifications-utils
certifi==2021.5.30
# via requests
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
cffi==1.14.5
# via cryptography
chardet==4.0.0
# via requests
2021-05-31 14:54:14 +01:00
click==8.0.1
# via flask
2021-06-02 15:11:00 +01:00
colorama==0.4.3
# via awscli
cryptography==3.3.2
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
# via
# -r requirements.in
# fido2
dataclasses==0.8
# via werkzeug
2021-06-02 15:11:00 +01:00
dnspython==1.16.0
# via eventlet
docopt==0.6.2
# via notifications-python-client
2021-06-02 15:11:00 +01:00
docutils==0.15.2
# via awscli
2021-05-31 14:54:17 +01:00
et-xmlfile==1.1.0
# via openpyxl
eventlet==0.30.2 # pyup: ignore
# via -r requirements.in
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
fido2==0.9.1
# via -r requirements.in
flask==1.1.2
# via
# -r requirements.in
# flask-login
# flask-redis
# flask-wtf
# gds-metrics
# notifications-utils
flask-login==0.5.0
# via -r requirements.in
flask-redis==0.4.0
# via notifications-utils
flask-wtf==0.15.1
# via -r requirements.in
gds-metrics==0.2.4
# via -r requirements.in
geojson==2.5.0
# via notifications-utils
govuk-bank-holidays==0.8
# via
# -r requirements.in
# notifications-utils
2021-09-16 12:05:32 +01:00
govuk-frontend-jinja @ git+https://github.com/alphagov/govuk-frontend-jinja.git@v0.5.8-alpha
# via -r requirements.in
2021-05-31 14:54:17 +01:00
greenlet==1.1.0
# via eventlet
2021-04-05 14:55:04 +01:00
gunicorn==20.1.0
# via -r requirements.in
2021-05-31 14:54:06 +01:00
humanize==3.6.0
# via -r requirements.in
2021-06-02 15:11:00 +01:00
idna==2.10
# via requests
importlib-metadata==4.2.0
# via
# -r requirements.in
# click
itsdangerous==1.1.0
# via
# -r requirements.in
# flask
# flask-wtf
# notifications-utils
jinja2==2.11.3
# via
# flask
# govuk-frontend-jinja
# notifications-utils
jmespath==0.10.0
# via
# boto3
# botocore
lml==0.1.0
# via
# pyexcel
# pyexcel-io
lxml==4.6.3
# via
# pyexcel-ezodf
# pyexcel-ods3
2021-05-31 14:54:18 +01:00
markupsafe==2.0.1
# via
# jinja2
# wtforms
mistune==0.8.4
# via notifications-utils
2021-10-11 12:26:56 +01:00
notifications-python-client==6.3.0
# via -r requirements.in
2021-09-16 12:05:32 +01:00
notifications-utils @ git+https://github.com/alphagov/notifications-utils.git@46.1.0
# via -r requirements.in
2021-03-15 13:55:08 +00:00
openpyxl==3.0.7
# via pyexcel-xlsx
orderedset==2.0.3
# via notifications-utils
packaging==20.9
# via bleach
phonenumbers==8.12.24
# via notifications-utils
prometheus-client==0.10.1
# via
# -r requirements.in
# gds-metrics
pyasn1==0.4.8
# via rsa
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
pycparser==2.20
# via cffi
pyexcel==0.6.6
# via -r requirements.in
pyexcel-ezodf==0.3.4
# via pyexcel-ods3
pyexcel-io==0.6.4
# via
# -r requirements.in
# pyexcel
# pyexcel-ods3
# pyexcel-xls
# pyexcel-xlsx
pyexcel-ods3==0.6.0
# via -r requirements.in
pyexcel-xls==0.6.2
# via -r requirements.in
pyexcel-xlsx==0.6.0
# via -r requirements.in
2021-05-31 14:54:19 +01:00
pyjwt==2.1.0
# via notifications-python-client
pyparsing==2.4.7
# via packaging
pypdf2==1.26.0
# via notifications-utils
python-dateutil==2.8.1
# via
# awscli-cwlogs
# botocore
python-json-logger==2.0.1
# via notifications-utils
pytz==2021.1
# via
# -r requirements.in
# notifications-utils
pyyaml==5.4.1
# via
# awscli
# notifications-utils
redis==3.5.3
# via flask-redis
requests==2.25.1
# via
# awscli-cwlogs
# govuk-bank-holidays
# notifications-python-client
# notifications-utils
2021-03-08 13:55:12 +00:00
rsa==4.7.2
# via awscli
rtreelib==0.2.0
Estimate number of phones in an arbitrary polygon We want to know how many phones are in a user-supplied polygon, so we can show the impact of a broadcast, in the same way that we do when users pick areas from our library. We already know how many phones are in each electoral ward. But there are challenges with an arbitrary polygon: - where it does overlap a ward, the overlap could be partial - it could overlap more than one ward - finding out which wards it overlaps by brute force (looping through all the wards and seeing which ones intersect with our polygon) would be way to slow to do in real time Instead we can use a data structure called an R-tree[1] to build an index which provides a much, much faster way of looking up which polygons overlap another. We can build this tree in advance and save it somewhere, which means there’s a lot of computation we don’t need to do in real time. The R-tree returns a set of objects (ward IDs) which we can go and look up in our library of electoral wards. These wards will be the ones that might have some overlap with our custom polygon. Once we have this small set of wards which might overlap our ward, we can look at the size of the area of overlap (relative to the size of the whole ward) and multiply that by the known count of phones in that ward to get an approximation of the count of phones in the overlap area. Summing these approximations give an estimate for the whole area of the custom polygon. 1. https://en.wikipedia.org/wiki/R-tree
2021-03-18 23:02:32 +00:00
# via -r requirements.in
2021-05-31 14:54:20 +01:00
s3transfer==0.4.2
# via
# awscli
# boto3
shapely==1.7.1
# via
# -r requirements.in
# notifications-utils
2021-05-31 14:54:20 +01:00
six==1.16.0
# via
# awscli-cwlogs
# bleach
# cryptography
# eventlet
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
# fido2
# govuk-bank-holidays
# python-dateutil
smartypants==2.0.1
# via notifications-utils
statsd==3.3.0
# via notifications-utils
texttable==1.6.3
# via pyexcel
typing-extensions==3.10.0.0
# via importlib-metadata
2021-05-31 14:54:21 +01:00
urllib3==1.26.5
# via
# botocore
# requests
webencodings==0.5.1
# via bleach
werkzeug==2.0.2
# via
# -r requirements.in
# flask
wtforms==2.3.3
# via flask-wtf
2021-06-02 15:11:00 +01:00
xlrd==1.2.0
# via pyexcel-xls
xlwt==1.3.0
# via pyexcel-xls
zipp==3.5.0
# via importlib-metadata
# The following packages are considered to be unsafe in a requirements file:
# setuptools