Produits Entr'ouvert » Hobo

To run this plugin well, you have to set some files in /etc/hobo/ozwillo :

- the files are in the folder examples.

- it's a common recipe for your publik, and two extracts of user and agent combo.

You have to set several var in a settings.json too :

-OZWILLO_SECRET

-OZWILLO_ENV_DOMAIN (e.g: sictiam.dev.entrouvert.org)

-OZWILLO_DESTRUCTION_URI 

-OZWILLO_DESTRUCTION_SECRET

And finally you have to enable in INSTALLED_APPS hobo.contrib.ozwillo.

[

    {

        "cells": [

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 1,

                    "placeholder": "content",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": "services",

                    "text": "<h2>Bienvenue</h2>\r\n"

                },

                "model": "data.textcell"

            }

        ],

        "fields": {

            "exclude_from_navigation": false,

            "groups": [],

            "order": 1,

            "parent": null,

            "public": false,

            "redirect_url": "",

            "slug": "index",

            "template_name": "standard",

            "title": "Accueil"

        }

    }

]

[

    {

        "cells": [

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 0,

                    "placeholder": "content",

                    "public": true,

                    "restricted_to_unlogged": true,

                    "slug": "",

                    "text": "<h2>Bienvenue</h2>\r\n\r\n<p>Bienvenue sur votre compte usager.</p>\r\n\r\n<p>Pour suivre vos d&eacute;marches en cours, cr&eacute;ez votre compte personnel ou identifiez-vous depuis <a href=\"/login/\">la page de connexion</a>.</p>\r\n"

                },

                "model": "data.textcell"

            },

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 1,

                    "placeholder": "content",

                    "public": false,

                    "restricted_to_unlogged": false,

                    "slug": "",

                    "text": "<h2>Bienvenue</h2>\r\n\r\n<p>Bienvenue sur votre compte usager.</p>\r\n"

                },

                "model": "data.textcell"

            },

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 2,

                    "placeholder": "right",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": "",

                    "wcs_site": ""

                },

                "model": "wcs.trackingcodeinputcell"

            },

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 3,

                    "placeholder": "right",

                    "public": true,

                    "restricted_to_unlogged": true,

                    "slug": "",

                    "text": "<h2>Demandes en cours</h2>\r\n\r\n<p>Connectez-vous pour voir vos demandes en cours.</p>\r\n"

                },

                "model": "data.textcell"

            },

            {

                "fields": {

                    "current_forms": true,

                    "done_forms": false,

                    "extra_css_class": "",

                    "groups": [],

                    "order": 4,

                    "placeholder": "right",

                    "public": false,

                    "restricted_to_unlogged": false,

                    "slug": "",

                    "wcs_site": ""

                },

                "model": "wcs.wcscurrentformscell"

            },

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 5,

                    "placeholder": "footer",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": "",

                    "text": "<p>Ce service est propos&eacute; par le <a href=\"http://www.sictiam.fr/\">SICTIAM</a>.</p>\r\n"

                },

                "model": "data.textcell"

            },

            {

                "fields": {

                    "category_reference": "eservices:nous-contacter",

                    "extra_css_class": "",

                    "groups": [],

                    "limit": null,

                    "manual_order": {

                        "data": []

                    },

                    "order": 6,

                    "ordering": "popularity",

                    "placeholder": "content",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": ""

                },

                "model": "wcs.wcsformsofcategorycell"

            }

        ],

        "fields": {

            "exclude_from_navigation": false,

            "groups": [],

            "order": 1,

            "parent": null,

            "public": true,

            "redirect_url": "",

            "slug": "index",

            "template_name": "two-columns",

            "title": "Accueil"

        }

    },

    {

        "cells": [

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 0,

                    "placeholder": "footer",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": ""

                },

                "model": "data.parentcontentcell"

            }

        ],

        "fields": {

            "exclude_from_navigation": false,

            "groups": [],

            "order": 2,

            "parent": null,

            "public": true,

            "redirect_url": "https://connexion-instance_name.sictiam.dev.entrouvert.org/accounts/",

            "slug": "mon-compte",

            "template_name": "standard",

            "title": "Mon compte"

        }

    },

    {

        "cells": [

            {

                "fields": {

                    "extra_css_class": "",

                    "groups": [],

                    "order": 0,

                    "placeholder": "footer",

                    "public": true,

                    "restricted_to_unlogged": false,

                    "slug": ""

                },

                "model": "data.parentcontentcell"

            }

        ],

        "fields": {

            "exclude_from_navigation": false,

            "groups": [],

            "order": 3,

            "parent": null,

            "public": true,

            "redirect_url": "https://demarches-instance_name.sictiam.dev.entrouvert.org/saisine-par-voie-electronique/tryauth",

            "slug": "nous-contacter",

            "template_name": "standard",

            "title": "Nous contacter"

        }

    }

]

{

   "steps" : [

      {

         "create-hobo" : {

            "url" : "https://${hobo}/"

         }

      },

      {

         "create-authentic" : {

            "title" : "Connexion",

            "url" : "https://${authentic}/"

         }

      },

      {

         "set-idp" : {}

      },

      {

         "create-superuser" : {

           "username" : "admin",

           "email" : "admin@example.net"

         }

      },

      {

         "create-combo" : {

            "template_name" : "portal-user",

            "title" : "Compte citoyen",

            "url" : "https://${combo}/"

         }

      },

      {

         "create-combo" : {

            "template_name" : "portal-agent",

            "title" : "Portail agent",

            "url" : "https://${combo_agent}/",

            "slug" : "portal-agent"

         }

      },

      {

         "create-wcs" : {

            "url" : "https://${wcs}/",

            "title" : "Démarches",

            "template_name": "export.wcs"

         }

      },

      {

	 "create-fargo" : {

	    "url" : "https://${fargo}/",

            "title" : "Porte documents"

         }

      },	 

      {

         "create-passerelle" : {

            "url" : "https://${passerelle}/",

            "title" : "Passerelle"

         }

      },

      {

       	 "set-theme" : {

                          "theme" : "publik"

                       }

      }

   ],

   "variables" : {

      "authentic" : "connexion-instance_name.sictiam.dev.entrouvert.org",

      "combo" : "instance_name.sictiam.dev.entrouvert.org",

      "combo_agent" : "agents-instance_name.sictiam.dev.entrouvert.org",

      "hobo" : "hobo-instance_name.sictiam.dev.entrouvert.org",

      "wcs" : "demarches-instance_name.sictiam.dev.entrouvert.org",

      "passerelle": "passerelle-instance_name.sictiam.dev.entrouvert.org",

      "fargo": "porte-documents-instance_name.sictiam.dev.entrouvert.org"

   }

}

# Ozwillo plugin to deploy

# Copyright (C) 2017  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.conf.urls import patterns, url, include

from . import views

urlpatterns = patterns('',

    url(r'create-publik-instance', views.create_publik_instance, name='ozwillo-create-publik-instance'),

    url(r'delete-publik-instance', views.delete_publik_instance, name='ozwillo-delete-publik-instance'),

)

# Ozwillo plugin to deploy Publik

# Copyright (C) 2017  Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import os

import logging

import requests

import io

import json

import subprocess

import hmac

import tempfile

from hashlib import sha1

from django.conf import settings

from django.http import HttpResponseForbidden, HttpResponseBadRequest, HttpResponseNotFound

from django.core.management import call_command

logger = logging.getLogger(__name__)

def valid_signature_required(func):

    signature_header_name = 'X-Hub-Signature'

    api_secret = settings.OZWILLO_SECRET

    def wrapper(request):

        if signature_header_name in request.headers:

             if request.headers[signature_header_name].startswith('sha1='):

                 algo, received_hmac = request.headers[signature_header_name].rsplit('=')

                 computed_hmac = hmac.new(api_secret, request.data, sha1).hexdigest()

                 # the received hmac is uppercase according to

                 # http://doc.ozwillo.com/#ref-3-2-1

                 if received_hmac.lower() != computed_hmac:

                     logger.error('Invalid HMAC')

                     return HttpResponseForbidden('Invalid HMAC')

             else:

                 logger.error('Invalid HMAC algo')

                 return HttpResponseForbidden('Invalid HMAC algo')

        else:

             logger.error('No HMAC in the header')

             return HttpResponseForbidden('No HMAC in the header')

        return func(request)

    return wrapper

def is_ozwillo_enabled(func):

    if not os.path.exists('/etc/hobo/ozwillo'):

        return HttpResponseNotFound('Owillo providing is not active here.')

    return func

@is_ozwillo_enabled

@valid_signature_required

def create_publik_instance(request):

    data = json.loads(request.body)

    logger.debug(data)

    client_id = data.pop('client_id')

    client_secret = data.pop('client_secret')

    instance_id = data.pop('instance_id')

    instance_name = data.pop('organization_name', None)

    if not instance_name:

        return HttpResponseBadRequest('Missing parameter "instance_name"')

    registration_uri = data.pop('instance_registration_uri')

    organization = data['organization']

    user = data['user']

    services = {'services': [{

                    'local_id': 'publik',

                    'name': 'Publik - %s' % (instance_name),

                    'service_uri':'https://connexion-%s.%s/accounts/oidc/login' % (instance_name, settings.OZWILLO_ENV_DOMAIN),

                    'description': 'Gestion de la relation usagers',

                    'tos_uri': 'https://publik.entrouvert.com/',

                    'policy_uri': 'https://publik.entrouvert.com/',

                    'icon': 'https://publik.entrouvert.com/static/img/logo-publik.png',

                    'payment_option': 'FREE',

                    'target_audience': ['PUBLIC_BODIES',

                                        'CITIZENS',

                                        'COMPANIES'],

                    'contacts': ['https://publik.entrouvert.com/'],

                    'redirect_uris':['https://connexion-%s.%s/accounts/oidc/callback' % (instance_name, settings.OZWILLO_ENV_DOMAIN)],

                }],

                'instance_id': instance_id,

                'destruction_uri': settings.OZWILLO_DESTRUCTION_URI,

                'destruction_secret': settings.OZWILLO_DESTRUCTION_SECRET,

                'needed_scopes': []

    }

    logger.debug(services)

    template_recipe = json.load(open('/etc/hobo/ozwillo/template_recipe.json', 'rb'))

    var = template_recipe['variables']

    for key, value in var.items():

        var[key] = value.replace('instance_name', instance_name)

    template_recipe['variables'] = var

    domain = var['combo']

    domain_agent = var['combo_agent']

    imp_site_template = json.load(open('/etc/hobo/ozwillo/import-site-template.json', 'r'))

    for row in imp_site_template:

        row['fields']['redirect_url'] = row['fields']['redirect_url'].replace('instance_name', instance_name)

    combo_file_handle, combo_file_path = tempfile.mkstemp()

    recipe_file_handle, recipe_file_path = tempfile.mkstemp()

    with io.open(combo_file_path, 'w', encoding='utf-8') as f:

        f.write(unicode(json.dumps(imp_site_template, ensure_ascii=False)))

    with io.open(recipe_file_path, 'w', encoding='utf-8') as f:

        f.write(unicode(json.dumps(template_recipe, ensure_ascii=False)))

    call_command('cook', recipe_file_path)

    subprocess.call(['sudo', '-u', 'combo', 'combo-manage',

                     'tenant_command', 'import_site',

                     combo_file_path, '-d', domain])

    subprocess.call(['sudo', '-u', 'combo', 'combo-manage',

                     'tenant_command', 'import_site',

                     '/etc/hobo/import-site-agents.json', '-d', domain_agent])

    os.remove(combo_file_path)

    os.remove(recipe_file_path)

    headers = {'Content-type': 'application/json', 'Accept': 'application/json'}

    requests.post(registration_uri, data=json.dumps(services), auth=(client_id, client_secret), headers=headers)

@is_ozwillo_enabled

@valid_signature_required

def delete_publik_instance(request):

    pass

if 'hobo.contrib.ozwillo' in settings.INSTALLED_APPS:

    urlpatterns += patterns('',

                           url(r'ozwillo/', include('hobo.contrib.ozwillo.urls'))

                          )