567 lines
22 KiB
Python
567 lines
22 KiB
Python
# authentic2 - versatile identity manager
|
|
# Copyright (C) 2010-2019 Entr'ouvert
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
import json
|
|
|
|
from django.core.exceptions import PermissionDenied, ValidationError
|
|
from django.utils.translation import ugettext_lazy as _
|
|
from django.urls import reverse
|
|
from django.views.generic import FormView, TemplateView
|
|
from django.views.generic.detail import SingleObjectMixin
|
|
from django.contrib import messages
|
|
from django.contrib.contenttypes.models import ContentType
|
|
from django.db import transaction
|
|
from django.db.models.query import Q, Prefetch
|
|
from django.db.models import Count, F
|
|
from django.contrib.auth import get_user_model
|
|
|
|
from django_rbac.utils import get_role_model, get_permission_model, get_ou_model
|
|
|
|
from authentic2.forms.profile import modelform_factory
|
|
from authentic2.utils import redirect
|
|
from authentic2 import hooks, data_transfer
|
|
|
|
from . import tables, views, resources, forms, app_settings
|
|
from .utils import has_show_username
|
|
|
|
|
|
class RolesMixin(object):
|
|
service_roles = True
|
|
admin_roles = False
|
|
|
|
def get_queryset(self):
|
|
qs = super(RolesMixin, self).get_queryset()
|
|
qs = qs.select_related('ou')
|
|
Permission = get_permission_model()
|
|
permission_ct = ContentType.objects.get_for_model(Permission)
|
|
ct_ct = ContentType.objects.get_for_model(ContentType)
|
|
ou_ct = ContentType.objects.get_for_model(get_ou_model())
|
|
permission_qs = Permission.objects.filter(target_ct_id__in=[ct_ct.id, ou_ct.id]) \
|
|
.values_list('id', flat=True)
|
|
# only non role-admin roles, they are accessed through the
|
|
# RoleManager views
|
|
if not self.admin_roles:
|
|
qs = qs.filter(
|
|
Q(admin_scope_ct__isnull=True) | Q(admin_scope_ct=permission_ct, admin_scope_id__in=permission_qs))
|
|
if not self.service_roles:
|
|
qs = qs.filter(service__isnull=True)
|
|
return qs
|
|
|
|
|
|
class RolesView(views.HideOUColumnMixin, RolesMixin, views.BaseTableView):
|
|
template_name = 'authentic2/manager/roles.html'
|
|
model = get_role_model()
|
|
table_class = tables.RoleTable
|
|
search_form_class = forms.RoleSearchForm
|
|
permissions = ['a2_rbac.search_role']
|
|
title = _('Roles')
|
|
|
|
def get_queryset(self):
|
|
qs = super(RolesView, self).get_queryset()
|
|
qs = qs.annotate(member_count=Count('members'))
|
|
return qs
|
|
|
|
def get_search_form_kwargs(self):
|
|
kwargs = super(RolesView, self).get_search_form_kwargs()
|
|
kwargs['queryset'] = self.get_queryset()
|
|
return kwargs
|
|
|
|
listing = RolesView.as_view()
|
|
|
|
|
|
class RoleAddView(views.BaseAddView):
|
|
template_name = 'authentic2/manager/role_add.html'
|
|
model = get_role_model()
|
|
title = _('Add role')
|
|
success_view_name = 'a2-manager-role-members'
|
|
exclude_fields = ('slug',)
|
|
|
|
def get_initial(self):
|
|
initial = super().get_initial()
|
|
search_ou = self.request.GET.get('search-ou')
|
|
if search_ou:
|
|
initial['ou'] = search_ou
|
|
return initial
|
|
|
|
def get_form_class(self):
|
|
form = forms.get_role_form_class()
|
|
fields = [x for x in form.base_fields.keys() if x not in self.exclude_fields]
|
|
return modelform_factory(self.model, form=form, fields=fields)
|
|
|
|
def form_valid(self, form):
|
|
response = super(RoleAddView, self).form_valid(form)
|
|
hooks.call_hooks('event', name='manager-add-role', user=self.request.user,
|
|
instance=form.instance, form=form)
|
|
return response
|
|
|
|
|
|
add = RoleAddView.as_view()
|
|
|
|
|
|
class RolesExportView(views.ExportMixin, RolesView):
|
|
resource_class = resources.RoleResource
|
|
export_prefix = 'roles-export-'
|
|
|
|
def get(self, request, *args, **kwargs):
|
|
export_format = kwargs['format'].lower()
|
|
if export_format == 'json':
|
|
export = data_transfer.export_site(
|
|
data_transfer.ExportContext(
|
|
role_qs=self.get_table_data(),
|
|
export_roles=True,
|
|
export_ous=False))
|
|
return self.export_response(json.dumps(export, indent=4), 'application/json', 'json')
|
|
return super(RolesExportView, self).get(request, *args, **kwargs)
|
|
|
|
|
|
export = RolesExportView.as_view()
|
|
|
|
|
|
class RoleViewMixin(RolesMixin):
|
|
model = get_role_model()
|
|
|
|
|
|
class RoleEditView(RoleViewMixin, views.BaseEditView):
|
|
template_name = 'authentic2/manager/role_edit.html'
|
|
title = _('Edit role description')
|
|
|
|
def get_form_class(self):
|
|
return forms.get_role_form_class()
|
|
|
|
def form_valid(self, form):
|
|
response = super(RoleEditView, self).form_valid(form)
|
|
hooks.call_hooks('event', name='manager-edit-role', user=self.request.user,
|
|
instance=form.instance, form=form)
|
|
return response
|
|
|
|
edit = RoleEditView.as_view()
|
|
|
|
|
|
class RoleMembersView(views.HideOUColumnMixin, RoleViewMixin, views.BaseSubTableView):
|
|
template_name = 'authentic2/manager/role_members.html'
|
|
table_class = tables.RoleMembersTable
|
|
form_class = forms.ChooseUserForm
|
|
success_url = '.'
|
|
search_form_class = forms.UserSearchForm
|
|
permissions = ['a2_rbac.view_role']
|
|
|
|
@property
|
|
def title(self):
|
|
return self.get_instance_name()
|
|
|
|
@property
|
|
def can_manage_members(self):
|
|
return self.object.can_manage_members and getattr(self, '_can_manage_members', False)
|
|
|
|
@can_manage_members.setter
|
|
def can_manage_members(self, value):
|
|
self._can_manage_members = value
|
|
|
|
def get_table_queryset(self):
|
|
children = self.object.children(include_self=False)
|
|
via_prefetch = Prefetch('roles', queryset=children, to_attr='via')
|
|
return self.object.all_members().prefetch_related(via_prefetch)
|
|
|
|
def form_valid(self, form):
|
|
user = form.cleaned_data['user']
|
|
action = form.cleaned_data['action']
|
|
if self.can_manage_members:
|
|
if action == 'add':
|
|
if self.object.members.filter(pk=user.pk).exists():
|
|
messages.warning(self.request, _('User already in this role.'))
|
|
else:
|
|
self.object.members.add(user)
|
|
hooks.call_hooks('event', name='manager-add-role-member',
|
|
user=self.request.user, role=self.object, member=user)
|
|
elif action == 'remove':
|
|
if not self.object.members.filter(pk=user.pk).exists():
|
|
messages.warning(self.request, _('User was not in this role.'))
|
|
else:
|
|
self.object.members.remove(user)
|
|
hooks.call_hooks('event', name='manager-remove-role-member',
|
|
user=self.request.user, role=self.object, member=user)
|
|
else:
|
|
messages.warning(self.request, _('You are not authorized'))
|
|
return super(RoleMembersView, self).form_valid(form)
|
|
|
|
def get_form_kwargs(self):
|
|
kwargs = super(RoleMembersView, self).get_form_kwargs()
|
|
# if role's members can only be from the same OU we filter user based on the role's OU
|
|
if app_settings.ROLE_MEMBERS_FROM_OU:
|
|
kwargs['ou'] = self.object.ou
|
|
return kwargs
|
|
|
|
def get_context_data(self, **kwargs):
|
|
ctx = super(RoleMembersView, self).get_context_data(**kwargs)
|
|
ctx['children'] = views.filter_view(self.request,
|
|
self.object.children(include_self=False, annotate=True))
|
|
ctx['parents'] = views.filter_view(self.request, self.object.parents(
|
|
include_self=False, annotate=True).order_by(F('ou').asc(nulls_first=True), 'name'))
|
|
ctx['has_multiple_ou'] = get_ou_model().objects.count() > 1
|
|
ctx['admin_roles'] = views.filter_view(self.request,
|
|
self.object.get_admin_role().children(include_self=False,
|
|
annotate=True))
|
|
ctx['from_ldap'] = self._can_manage_members and not self.can_manage_members
|
|
return ctx
|
|
|
|
def is_ou_specified(self):
|
|
return self.search_form.is_valid() \
|
|
and self.search_form.cleaned_data.get('ou')
|
|
|
|
def get_table(self, **kwargs):
|
|
show_username = has_show_username()
|
|
if not show_username and self.is_ou_specified():
|
|
show_username = self.is_ou_specified().show_username
|
|
if not show_username:
|
|
exclude = kwargs.setdefault('exclude', [])
|
|
if 'username' not in exclude:
|
|
exclude.append('username')
|
|
return super().get_table(**kwargs)
|
|
|
|
|
|
members = RoleMembersView.as_view()
|
|
|
|
|
|
class RoleDeleteView(RoleViewMixin, views.BaseDeleteView):
|
|
title = _('Delete role')
|
|
template_name = 'authentic2/manager/role_delete.html'
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
if not self.can_delete:
|
|
raise PermissionDenied
|
|
return super(RoleDeleteView, self).post(request, *args, **kwargs)
|
|
|
|
def get_success_url(self):
|
|
return reverse('a2-manager-roles')
|
|
|
|
def form_valid(self, form):
|
|
response = super(RoleDeleteView, self).form_valid(form)
|
|
hooks.call_hooks('event', name='manager-delete-role', user=self.request.user,
|
|
role=form.instance)
|
|
return response
|
|
|
|
delete = RoleDeleteView.as_view()
|
|
|
|
|
|
class RolePermissionsView(RoleViewMixin, views.BaseSubTableView):
|
|
template_name = 'authentic2/manager/role_permissions.html'
|
|
table_class = tables.PermissionTable
|
|
form_class = forms.ChoosePermissionForm
|
|
success_url = '.'
|
|
permissions = ['a2_rbac.admin_permission']
|
|
title = _('Permissions')
|
|
|
|
def get_table_queryset(self):
|
|
return self.object.permissions.all()
|
|
|
|
def form_valid(self, form):
|
|
if self.can_change:
|
|
operation = form.cleaned_data.get('operation')
|
|
ou = form.cleaned_data.get('ou')
|
|
target = form.cleaned_data.get('target')
|
|
action = form.cleaned_data.get('action')
|
|
Permission = get_permission_model()
|
|
if action == 'add' and operation and target:
|
|
perm, created = Permission.objects \
|
|
.get_or_create(operation=operation, ou=ou,
|
|
target_ct=ContentType.objects.get_for_model(
|
|
target),
|
|
target_id=target.pk)
|
|
self.object.permissions.add(perm)
|
|
hooks.call_hooks('event', name='manager-add-permission', user=self.request.user,
|
|
role=self.object, permission=perm)
|
|
elif action == 'remove':
|
|
try:
|
|
permission_id = int(self.request.POST.get('permission', ''))
|
|
perm = Permission.objects.get(id=permission_id)
|
|
except (ValueError, Permission.DoesNotExist):
|
|
pass
|
|
else:
|
|
if self.object.permissions.filter(id=permission_id).exists():
|
|
self.object.permissions.remove(perm)
|
|
hooks.call_hooks('event', name='manager-remove-permission',
|
|
user=self.request.user, role=self.object, permission=perm)
|
|
else:
|
|
messages.warning(self.request, _('You are not authorized'))
|
|
return super(RolePermissionsView, self).form_valid(form)
|
|
|
|
permissions = RolePermissionsView.as_view()
|
|
|
|
|
|
class RoleMembersExportView(views.ExportMixin, RoleMembersView):
|
|
resource_class = resources.UserResource
|
|
permissions = ['a2_rbac.view_role']
|
|
|
|
def get_data(self):
|
|
return self.get_table_data()
|
|
|
|
members_export = RoleMembersExportView.as_view()
|
|
|
|
|
|
class RoleAddChildView(views.AjaxFormViewMixin, views.TitleMixin,
|
|
views.PermissionMixin, views.FormNeedsRequest,
|
|
SingleObjectMixin, FormView):
|
|
title = _('Add child role')
|
|
model = get_role_model()
|
|
form_class = forms.RolesForm
|
|
success_url = '..'
|
|
template_name = 'authentic2/manager/form.html'
|
|
permissions = ['a2_rbac.manage_members_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
return super(RoleAddChildView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def form_valid(self, form):
|
|
parent = self.get_object()
|
|
for role in form.cleaned_data['roles']:
|
|
parent.add_child(role)
|
|
hooks.call_hooks('event', name='manager-add-child-role', user=self.request.user,
|
|
parent=parent, child=role)
|
|
return super(RoleAddChildView, self).form_valid(form)
|
|
|
|
add_child = RoleAddChildView.as_view()
|
|
|
|
|
|
class RoleAddParentView(views.AjaxFormViewMixin, views.TitleMixin,
|
|
views.FormNeedsRequest, SingleObjectMixin, FormView):
|
|
title = _('Add parent role')
|
|
model = get_role_model()
|
|
form_class = forms.RoleParentsForm
|
|
success_url = '..'
|
|
template_name = 'authentic2/manager/form.html'
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
if self.object.is_internal():
|
|
raise PermissionDenied
|
|
return super(RoleAddParentView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def form_valid(self, form):
|
|
child = self.get_object()
|
|
for role in form.cleaned_data['roles']:
|
|
child.add_parent(role)
|
|
hooks.call_hooks('event', name='manager-add-child-role', user=self.request.user,
|
|
parent=role, child=child)
|
|
return super(RoleAddParentView, self).form_valid(form)
|
|
|
|
add_parent = RoleAddParentView.as_view()
|
|
|
|
|
|
class RoleRemoveChildView(views.AjaxFormViewMixin, SingleObjectMixin,
|
|
views.PermissionMixin, TemplateView):
|
|
title = _('Remove child role')
|
|
model = get_role_model()
|
|
success_url = '../..'
|
|
template_name = 'authentic2/manager/role_remove_child.html'
|
|
permissions = ['a2_rbac.manage_members_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
self.child = self.get_queryset().get(pk=kwargs['child_pk'])
|
|
return super(RoleRemoveChildView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def get_context_data(self, **kwargs):
|
|
ctx = super(RoleRemoveChildView, self).get_context_data(**kwargs)
|
|
ctx['child'] = self.child
|
|
return ctx
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
self.object.remove_child(self.child)
|
|
hooks.call_hooks('event', name='manager-remove-child-role', user=self.request.user,
|
|
parent=self.object, child=self.child)
|
|
return redirect(self.request, self.success_url)
|
|
|
|
remove_child = RoleRemoveChildView.as_view()
|
|
|
|
|
|
class RoleRemoveParentView(views.AjaxFormViewMixin, SingleObjectMixin,
|
|
TemplateView):
|
|
title = _('Remove parent role')
|
|
model = get_role_model()
|
|
success_url = '../..'
|
|
template_name = 'authentic2/manager/role_remove_parent.html'
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
if self.object.is_internal():
|
|
raise PermissionDenied
|
|
self.parent = self.get_queryset().get(pk=kwargs['parent_pk'])
|
|
return super(RoleRemoveParentView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def get_context_data(self, **kwargs):
|
|
ctx = super(RoleRemoveParentView, self).get_context_data(**kwargs)
|
|
ctx['parent'] = self.parent
|
|
return ctx
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
if not self.request.user.has_perm('a2_rbac.manage_members_role', self.parent):
|
|
raise PermissionDenied
|
|
self.object.remove_parent(self.parent)
|
|
hooks.call_hooks('event', name='manager-remove-child-role', user=self.request.user,
|
|
parent=self.parent, child=self.object)
|
|
return redirect(self.request, self.success_url)
|
|
|
|
remove_parent = RoleRemoveParentView.as_view()
|
|
|
|
|
|
class RoleAddAdminRoleView(views.AjaxFormViewMixin, views.TitleMixin,
|
|
views.PermissionMixin, views.FormNeedsRequest,
|
|
SingleObjectMixin, FormView):
|
|
title = _('Add admin role')
|
|
model = get_role_model()
|
|
form_class = forms.RolesForm
|
|
success_url = '..'
|
|
template_name = 'authentic2/manager/form.html'
|
|
permissions = ['a2_rbac.change_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
return super(RoleAddAdminRoleView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def form_valid(self, form):
|
|
administered_role = self.get_object()
|
|
for role in form.cleaned_data['roles']:
|
|
administered_role.get_admin_role().add_child(role)
|
|
hooks.call_hooks('event', name='manager-add-admin-role', user=self.request.user,
|
|
role=administered_role, admin_role=role)
|
|
return super(RoleAddAdminRoleView, self).form_valid(form)
|
|
|
|
add_admin_role = RoleAddAdminRoleView.as_view()
|
|
|
|
|
|
class RoleRemoveAdminRoleView(views.TitleMixin, views.AjaxFormViewMixin,
|
|
SingleObjectMixin, views.PermissionMixin,
|
|
TemplateView):
|
|
title = _('Remove admin role')
|
|
model = get_role_model()
|
|
success_url = '../..'
|
|
template_name = 'authentic2/manager/role_remove_admin_role.html'
|
|
permissions = ['a2_rbac.change_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
self.child = self.get_queryset().get(pk=kwargs['role_pk'])
|
|
return super(RoleRemoveAdminRoleView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def get_context_data(self, **kwargs):
|
|
ctx = super(RoleRemoveAdminRoleView, self).get_context_data(**kwargs)
|
|
ctx['child'] = self.child
|
|
return ctx
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
self.object.get_admin_role().remove_child(self.child)
|
|
hooks.call_hooks('event', name='manager-remove-admin-role',
|
|
user=self.request.user, role=self.object, admin_role=self.child)
|
|
return redirect(self.request, self.success_url)
|
|
|
|
remove_admin_role = RoleRemoveAdminRoleView.as_view()
|
|
|
|
|
|
class RoleAddAdminUserView(views.AjaxFormViewMixin, views.TitleMixin,
|
|
views.PermissionMixin, views.FormNeedsRequest,
|
|
SingleObjectMixin, FormView):
|
|
title = _('Add admin user')
|
|
model = get_role_model()
|
|
form_class = forms.UsersForm
|
|
success_url = '..'
|
|
template_name = 'authentic2/manager/form.html'
|
|
permissions = ['a2_rbac.change_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
return super(RoleAddAdminUserView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def form_valid(self, form):
|
|
administered_role = self.get_object()
|
|
for user in form.cleaned_data['users']:
|
|
administered_role.get_admin_role().members.add(user)
|
|
hooks.call_hooks('event', name='manager-add-admin-role-user', user=self.request.user,
|
|
role=administered_role, admin=user)
|
|
return super(RoleAddAdminUserView, self).form_valid(form)
|
|
|
|
add_admin_user = RoleAddAdminUserView.as_view()
|
|
|
|
|
|
class RoleRemoveAdminUserView(views.TitleMixin, views.AjaxFormViewMixin,
|
|
SingleObjectMixin, views.PermissionMixin,
|
|
TemplateView):
|
|
title = _('Remove admin user')
|
|
model = get_role_model()
|
|
success_url = '../..'
|
|
template_name = 'authentic2/manager/role_remove_admin_user.html'
|
|
permissions = ['a2_rbac.change_role']
|
|
|
|
def dispatch(self, request, *args, **kwargs):
|
|
self.object = self.get_object()
|
|
self.user = get_user_model().objects.get(pk=kwargs['user_pk'])
|
|
return super(RoleRemoveAdminUserView, self).dispatch(request, *args, **kwargs)
|
|
|
|
def get_context_data(self, **kwargs):
|
|
ctx = super(RoleRemoveAdminUserView, self).get_context_data(**kwargs)
|
|
ctx['user'] = self.user
|
|
return ctx
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
self.object.get_admin_role().members.remove(self.user)
|
|
hooks.call_hooks('event', name='remove-remove-admin-role-user', user=self.request.user,
|
|
role=self.object, admin=self.user)
|
|
return redirect(self.request, self.success_url)
|
|
|
|
remove_admin_user = RoleRemoveAdminUserView.as_view()
|
|
|
|
|
|
class RolesImportView(views.PermissionMixin, views.TitleMixin, views.MediaMixin, views.FormNeedsRequest,
|
|
FormView):
|
|
form_class = forms.RolesImportForm
|
|
model = get_role_model()
|
|
template_name = 'authentic2/manager/import_form.html'
|
|
title = _('Roles Import')
|
|
|
|
def get_initial(self):
|
|
initial = super().get_initial()
|
|
search_ou = self.request.GET.get('search-ou')
|
|
if search_ou:
|
|
initial['ou'] = search_ou
|
|
return initial
|
|
|
|
def post(self, request, *args, **kwargs):
|
|
if not self.can_add:
|
|
raise PermissionDenied
|
|
return super().post(request, *args, **kwargs)
|
|
|
|
def form_valid(self, form):
|
|
self.ou = form.cleaned_data['ou']
|
|
try:
|
|
context = data_transfer.ImportContext(import_ous=False, set_ou=self.ou)
|
|
with transaction.atomic():
|
|
data_transfer.import_site(form.cleaned_data['site_json'], context)
|
|
except ValidationError as e:
|
|
form.add_error('site_json', e)
|
|
return self.form_invalid(form)
|
|
|
|
return super().form_valid(form)
|
|
|
|
def get_success_url(self):
|
|
messages.success(
|
|
self.request,
|
|
_('Roles have been successfully imported inside "%s" organizational unit.') % self.ou
|
|
)
|
|
return reverse('a2-manager-roles') + '?search-ou=%s' % self.ou.pk
|
|
|
|
|
|
roles_import = RolesImportView.as_view()
|