Produits Entr'ouvert » Authentic 2

    def find_duplicates(self, first_name=None, last_name=None, fullname=None, birthdate=None):

        if fullname is not None:

            name = fullname

        else:

            assert first_name is not None and last_name is not None

            name = '%s %s' % (first_name, last_name)

# Copyright (C) 2010-2020 Entr'ouvert

# authentic2 - versatile identity manager

# Copyright (C) 2010-2020 Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib.auth import get_user_model

from django.utils.translation import ugettext_lazy as _

from authentic2.journal_event_types import get_attributes_label, EventTypeWithService

from authentic2.apps.journal.models import EventTypeDefinition

from authentic2.apps.journal.utils import form_to_old_new

from django_rbac.utils import get_role_model

User = get_user_model()

Role = get_role_model()

class ManagerUserCreation(EventTypeDefinition):

    name = 'manager.user.creation'

    label = _('user creation')

    @classmethod

    def record(cls, user, session, form):

        super().record(user=user, session=session, references=[form.instance])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        # user journal page

        if context and context == user:

            return _('creation by administrator')

        elif user:

            # manager gloabal journal page

            return _('creation of user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserProfileEdit(EventTypeDefinition):

    name = 'manager.user.profile.edit'

    label = _('user profile edit')

    @classmethod

    def record(cls, user, session, form):

        super().record(user=user, session=session, references=[form.instance], data=form_to_old_new(form))

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        new = event.get_data('new') or {}

        edited_attributes = ', '.join(get_attributes_label(new)) or ''

        if context and context == user:

            return _('edit by administrator (%s)') % edited_attributes

        elif user:

            user_full_name = user.get_full_name()

            return _('edit of user "{0}" ({1})').format(user_full_name, edited_attributes)

        return super().get_message(event, context)

class ManagerUserEmailChangeRequest(EventTypeDefinition):

    name = 'manager.user.email.change.request'

    label = _('email change request')

    @classmethod

    def record(cls, user, session, form):

        data = {

            'old_email': form.instance.email,

            'email': form.cleaned_data.get('new_email'),

        }

        super().record(user=user, session=session, references=[form.instance], data=data)

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        new_email = event.get_data('email')

        if context and context == user:

            return _('email change for email address "%s" requested by administrator') % new_email

        elif user:

            user_full_name = user.get_full_name()

            return _('email change of user "{0}" for email address "{1}"').format(user_full_name, new_email)

        return super().get_message(event, context)

class ManagerUserPasswordChange(EventTypeDefinition):

    name = 'manager.user.password.change'

    label = _('user password change')

    @classmethod

    def record(cls, user, session, form):

        data = {

            'generate_password': form.cleaned_data['generate_password'],

            'send_mail': form.cleaned_data['send_mail'],

        }

        super().record(user=user, session=session, references=[form.instance], data=data)

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        send_mail = event.get_data('send_mail')

        if context and context == user:

            if send_mail:

                return _('password change by administrator and notification by mail')

            else:

                return _('password change by administrator')

        elif user:

            user_full_name = user.get_full_name()

            if send_mail:

                return _('password change of user "%s" and notification by mail') % user_full_name

            else:

                return _('password change of user "%s"') % user_full_name

        return super().get_message(event, context)

class ManagerUserPasswordResetRequest(EventTypeDefinition):

    name = 'manager.user.password.reset.request'

    label = _('user password reset request')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(

            user=user, session=session, references=[target_user], data={'email': target_user.email}

        )

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        email = event.get_data('email')

        if context and context == user:

            return _('password reset request by administrator sent to "%s"') % email

        elif user:

            return _('password reset request of "{0}" sent to "{1}"').format(user.get_full_name(), email)

        return super().get_message(event, context)

class ManagerUserPasswordChangeForce(EventTypeDefinition):

    name = 'manager.user.password.change.force'

    label = _('mandatory password change at next login set')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(user=user, session=session, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        if context and context == user:

            return _('mandatory password change at next login set by administrator')

        elif user:

            return _('mandatory password change at next login set for user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserPasswordChangeUnforce(EventTypeDefinition):

    name = 'manager.user.password.change.unforce'

    label = _('mandatory password change at next login unset')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(user=user, session=session, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        if context and context == user:

            return _('mandatory password change at next login unset by administrator')

        elif user:

            return _('mandatory password change at next login unset for user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserActivation(EventTypeDefinition):

    name = 'manager.user.activation'

    label = _('user activation')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(user=user, session=session, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        if context and context == user:

            return _('activation by administrator')

        elif user:

            return _('activation of user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserDeactivation(EventTypeDefinition):

    name = 'manager.user.deactivation'

    label = _('user deactivation')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(user=user, session=session, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        if context and context == user:

            return _('deactivation by administrator')

        elif user:

            return _('deactivation of user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserDeletion(EventTypeDefinition):

    name = 'manager.user.deletion'

    label = _('user deletion')

    @classmethod

    def record(cls, user, session, target_user):

        super().record(user=user, session=session, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        (user,) = event.get_typed_references(User)

        if context and context == user:

            return _('deletion by administrator')

        elif user:

            return _('deletion of user "%s"') % user.get_full_name()

        return super().get_message(event, context)

class ManagerUserSSOAuthorizationDeletion(EventTypeWithService):

    name = 'manager.user.sso.authorization.deletion'

    label = _('delete authorization')

    @classmethod

    def record(cls, user, session, service, target_user):

        super().record(user=user, session=session, service=service, references=[target_user])

    @classmethod

    def get_message(cls, event, context):

        # first reference is to the service

        __, user = event.get_typed_references(None, User)

        service_name = cls.get_service_name(event)

        if context and context == user:

            return _('deletion of authorization of single sign on with "%s" by administrator') % service_name

        elif user:

            return _('deletion of authorization of single sign on with "%s" of user "%s"') % (

                service_name,

                user.get_full_name(),

            )

        return super().get_message(event, context)

class RoleEventsMixin(EventTypeDefinition):

    @classmethod

    def record(self, user, session, role, references=None, data=None):

        references = references or []

        references = [role] + references

        data = data or {}

        data.update(

            {'role_name': str(role), 'role_uuid': role.uuid,}

        )

        super().record(

            user=user, session=session, references=references, data=data,

        )

class ManagerRoleCreation(RoleEventsMixin):

    name = 'manager.role.creation'

    label = _('role creation')

    @classmethod

    def get_message(cls, event, context):

        (role,) = event.get_typed_references(Role)

        role = role or event.get_data('role_name')

        if context != role:

            return _('creation of role "%s"') % role

        else:

            return _('creation')

class ManagerRoleEdit(RoleEventsMixin):

    name = 'manager.role.edit'

    label = _('role edit')

    @classmethod

    def record(cls, user, session, role, form):

        super().record(user=user, session=session, role=role, data=form_to_old_new(form))

    @classmethod

    def get_message(cls, event, context):

        (role,) = event.get_typed_references(Role)

        role = role or event.get_data('role_name')

        new = event.get_data('new')

        edited_attributes = ', '.join(get_attributes_label(new)) or ''

        if context != role:

            return _('edit of role "%s" (%s)') % (role, edited_attributes)

        else:

            return _('edit (%s)') % edited_attributes

class ManagerRoleDeletion(RoleEventsMixin):

    name = 'manager.role.deletion'

    label = _('role deletion')

    @classmethod

    def get_message(cls, event, context):

        (role,) = event.get_typed_references(Role)

        role = role or event.get_data('role_name')

        if context != role:

            return _('deletion of role "%s"') % role

        else:

            return _('deletion')

class ManagerRoleMembershipGrant(RoleEventsMixin):

    name = 'manager.role.membership.grant'

    label = _('role membership grant')

    @classmethod

    def record(cls, user, session, role, member):

        data = {'member_name': member.get_full_name()}

        super().record(user=user, session=session, role=role, references=[member], data=data)

    @classmethod

    def get_message(cls, event, context):

        role, member = event.get_typed_references(Role, User)

        role = role or event.get_data('role_name')

        member = member or event.get_data('member_name')

        if context == member:

            return _('membership grant in role "%s"') % role

        elif context == role:

            return _('membership grant to user "%s"') % member

        else:

            return _('membership grant to user "{member}" in role "{role}"').format(member=member, role=role)

class ManagerRoleMembershipRemoval(RoleEventsMixin):

    name = 'manager.role.membership.removal'

    label = _('role membership removal')

    @classmethod

    def record(cls, user, session, role, member):

        data = {'member_name': member.get_full_name()}

        super().record(user=user, session=session, role=role, references=[member], data=data)

    @classmethod

    def get_message(cls, event, context):

        role, member = event.get_typed_references(Role, User)

        role = role or event.get_data('role_name')

        member = member or event.get_data('member_name')

        if context == member:

            return _('membership removal from role "%s"') % role

        elif context == role:

            return _('membership removal of user "%s"') % member

        else:

            return _('membership removal of user "{member}" from role "{role}"').format(

                member=member, role=role

            )

class ManagerRoleInheritanceAddition(RoleEventsMixin):

    name = 'manager.role.inheritance.addition'

    label = _('role inheritance addition')

    @classmethod

    def record(cls, user, session, parent, child):

        data = {

            'child_name': str(child),

            'child_uuid': child.uuid,

        }

        super().record(user=user, session=session, role=parent, references=[child], data=data)

    @classmethod

    def get_message(cls, event, context):

        parent, child = event.get_typed_references(Role, Role)

        parent = parent or event.get_data('role_name')

        child = child or event.get_data('child_name')

        if context == child:

            return _('inheritance addition from parent role "%s"') % parent

        elif context == parent:

            return _('inheritance addition to child role "%s"') % child

        else:

            return _('inheritance addition from parent role "{parent}" to child role "{child}"').format(

                parent=parent, child=child

            )

class ManagerRoleInheritanceRemoval(ManagerRoleInheritanceAddition):

    name = 'manager.role.inheritance.removal'

    label = _('role inheritance removal')

    @classmethod

    def get_message(cls, event, context):

        parent, child = event.get_typed_references(Role, Role)

        parent = parent or event.get_data('role_name')

        child = child or event.get_data('child_name')

        if context == child:

            return _('inheritance removal from parent role "%s"') % parent

        elif context == parent:

            return _('inheritance removal to child role "%s"') % child

        else:

            return _('inheritance removal from parent role "{parent}" to child role "{child}"').format(

                parent=parent, child=child

            )

class ManagerRoleAdministratorRoleAddition(RoleEventsMixin):

    name = 'manager.role.administrator.role.addition'

    label = _('role administrator role addition')

    @classmethod

    def record(cls, user, session, role, admin_role):

        data = {

            'admin_role_name': str(admin_role),

            'admin_role_uuid': admin_role.uuid,

        }

        super().record(user=user, session=session, role=role, references=[admin_role], data=data)

    @classmethod

    def get_message(cls, event, context):

        role, admin_role = event.get_typed_references(Role, Role)

        role = role or event.get_data('role_name')

        admin_role = admin_role or event.get('admin_role_name')

        if context == role:

            return _('addition of role "%s" as administrator') % admin_role

        elif context == admin_role:

            return _('addition as administrator of role "%s"') % role

        else:

            return _('addition of role "{admin_role}" as administrator of role "{role}"').format(

                admin_role=admin_role, role=role

            )

class ManagerRoleAdministratorRoleRemoval(ManagerRoleAdministratorRoleAddition):

    name = 'manager.role.administrator.role.removal'

    label = _('role administrator role removal')

    @classmethod

    def get_message(cls, event, context):

        role, admin_role = event.get_typed_references(Role, Role)

        role = role or event.get_data('role_name')

        admin_role = admin_role or event.get('admin_role_name')

        if context == role:

            return _('removal of role "%s" as administrator') % admin_role

        elif context == admin_role:

            return _('removal as administrator of role "%s"') % role

        else:

            return _('removal of role "{admin_role}" as administrator of role "{role}"').format(

                admin_role=admin_role, role=role

            )

class ManagerRoleAdministratorUserAddition(RoleEventsMixin):

    name = 'manager.role.administrator.user.addition'

    label = _('role administrator user addition')

    @classmethod

    def record(cls, user, session, role, admin_user):

        data = {

            'admin_user_name': admin_user.get_full_name(),

            'admin_user_uuid': admin_user.uuid,

        }

        super().record(user=user, session=session, role=role, references=[admin_user], data=data)

    @classmethod

    def get_message(cls, event, context):

        role, admin_user = event.get_typed_references(Role, User)

        role = role or event.get_data('role_name')

        admin_user = admin_user or event.get_data('admin_user_name')

        if context == role:

            return _('addition of user "%s" as administrator') % admin_user

        elif context == admin_user:

            return _('addition as administrator of role "%s"') % role

        else:

            return _('addition of user "{admin_user}" as administrator of role "{role}"').format(

                admin_user=admin_user, role=role

            )

class ManagerRoleAdministratorUserRemoval(ManagerRoleAdministratorUserAddition):

    name = 'manager.role.administrator.user.removal'

    label = _('role administrator user removal')

    @classmethod

    def get_message(cls, event, context):

        role, admin_user = event.get_typed_references(Role, User)

        role = role or event.get_data('role_name')

        admin_user = admin_user or event.get_data('admin_user_name')

        if context == role:

            return _('removal of user "%s" as administrator') % admin_user

        elif context == admin_user:

            return _('removal as administrator of role "%s"') % role

        else:

            return _('removal of user "{admin_user}" as administrator of role "{role}"').format(

                admin_user=admin_user, role=role

            )

# authentic2 - versatile identity manager

# Copyright (C) 2010-2020 Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import uuid

from django.contrib.auth import get_user_model

from django.core.exceptions import PermissionDenied, ValidationError

from django.core.validators import EmailValidator

from django.db.models import Q

from django.utils.translation import ugettext_lazy as _

from authentic2.apps.journal.forms import JournalForm

from authentic2.apps.journal.search_engine import JournalSearchEngine

from authentic2.apps.journal.views import JournalView

from . import views

User = get_user_model()

class JournalSearchEngine(JournalSearchEngine):

    def search_by_uuid(self, lexem):

        # by user uuid

        try:

            user_uuid = uuid.UUID(lexem)

        except ValueError:

            yield self.q_false

        else:

            yield Q(user__uuid=user_uuid.hex)

    search_by_uuid.documentation = _(

        '''\

You can use <tt>uuid:1234</tt> to find all events related \

to user whose UUID is <tt>1234</tt>.'''

    )

    unmatched = None

    def lexem_queries(self, lexem):

        queries = list(super().lexem_queries(lexem))

        if queries:

            yield from queries

        elif '@' in lexem:

            # fallback for raw email

            try:

                EmailValidator(lexem)

            except ValidationError:

                pass

            else:

                yield from super().lexem_queries('email:' + lexem)

                yield from super().lexem_queries('username:' + lexem)

    def unmatched_lexems_query(self, lexems):

        fullname = ' '.join(lexem.strip() for lexem in lexems if lexem.strip())

        if fullname:

            users = User.objects.find_duplicates(fullname=fullname)

            return self.query_for_users(users)

class JournalForm(JournalForm):

    search_engine_class = JournalSearchEngine

class BaseJournalView(views.TitleMixin, views.MediaMixin, JournalView):

    template_name = 'authentic2/manager/journal.html'

    title = _('Journal')

    form_class = JournalForm

    def get_context_data(self, **kwargs):

        ctx = super().get_context_data(**kwargs)

        date_hierarchy = ctx['date_hierarchy']

        if date_hierarchy.title:

            ctx['title'] = _('Journal of %s') % date_hierarchy.title

        return ctx

class GlobalJournalView(BaseJournalView):

    template_name = 'authentic2/manager/journal.html'

    def dispatch(self, request, *args, **kwargs):

        if not request.user.is_superuser:

            raise PermissionDenied

        return super().dispatch(request, *args, **kwargs)

journal = GlobalJournalView.as_view()

from django.utils.functional import cached_property

from django.shortcuts import get_object_or_404

from authentic2.apps.journal.views import JournalViewWithContext

from .journal_views import BaseJournalView

OU = get_ou_model()

        ou_ct = ContentType.objects.get_for_model(OU)

class SearchOUMixin:

    @cached_property

    def ou(self):

        try:

            ou_id = int(self.request.GET['search-ou'])

        except (ValueError, KeyError):

            return None

        else:

            return OU.objects.filter(pk=ou_id).first()

    def get_context_data(self, **kwargs):

        return super().get_context_data(ou=self.ou, **kwargs)

class RolesView(SearchOUMixin, views.HideOUColumnMixin, RolesMixin,

                views.BaseTableView):

        self.request.journal.record('manager.role.creation', role=form.instance)

        self.request.journal.record('manager.role.edit', role=form.instance, form=form)

                    self.request.journal.record('manager.role.membership.grant', role=self.object, member=user)

                    self.request.journal.record('manager.role.membership.removal', role=self.object, member=user)

        ctx['has_multiple_ou'] = OU.objects.count() > 1

            self.request.journal.record('manager.role.inheritance.addition', parent=parent, child=role)

            self.request.journal.record('manager.role.inheritance.addition', parent=role, child=child)

        self.request.journal.record('manager.role.inheritance.removal', parent=self.object, child=self.child)

        self.request.journal.record('manager.role.inheritance.removal', parent=self.parent, child=self.object)

            self.request.journal.record('manager.role.administrator.role.addition',

                                        role=administered_role, admin_role=role)

        self.request.journal.record('manager.role.administrator.role.removal',

                                    role=self.object, admin_role=self.child)

            self.request.journal.record('manager.role.administrator.user.addition',

                                        role=administered_role, admin_user=user)

        self.request.journal.record('manager.role.administrator.user.removal',

                                    role=self.object, admin_user=self.user)

class RoleJournal(views.MultipleOUMixin, views.PermissionMixin, JournalViewWithContext, BaseJournalView):

    template_name = 'authentic2/manager/role_journal.html'

    permissions = ['a2_rbac.view_role']

    title = _('Journal')

    @cached_property

    def context(self):

        return get_object_or_404(get_role_model(), pk=self.kwargs['pk'])

    def get_context_data(self, **kwargs):

        ctx = super().get_context_data(**kwargs)

        ctx['object'] = self.context

        return ctx

journal = RoleJournal.as_view()

class RolesJournal(SearchOUMixin, views.MultipleOUMixin, views.PermissionMixin,

                   JournalViewWithContext, BaseJournalView):

    template_name = 'authentic2/manager/roles_journal.html'

    permissions = ['a2_rbac.view_role']

    title = _('Journal')

    @cached_property

    def context(self):

        return get_role_model()

roles_journal = RolesJournal.as_view()

        function FitToContent(id, maxHeight)

        {

           var text = id && id.style ? id : document.getElementById(id);

           if ( !text )

              return;

        }

        $('textarea.js-autoresize').each(function () {

          this.setAttribute('style', 'height:' + (this.scrollHeight) + 'px;overflow-y:hidden;');

        })

        $(document).on('input', 'textarea.js-autoresize', function () {

          this.style.height = 'auto';

          this.style.height = (this.scrollHeight) + 'px';

          return true;

        });

{% extends "authentic2/manager/base.html" %}

{% load i18n gadjo %}

{% block page-title %}{{ block.super }} - {% trans "Journal" %}{% endblock %}

{% block breadcrumb %}

  {{ block.super }}

  {% block breadcrumb-before-title %}

  {% endblock %}

  <a href="#">{% trans 'Journal' %}</a>

  {% for caption, url in date_hierarchy.back_urls %}

      <a href="{{ url }}">{{ caption }}</a>

  {% endfor %}

{% endblock %}

{% block sidebar %}

  <aside id="sidebar">

      <h3>{% trans "Search" context "title" %}</h3>

      <div class="journal-list--search-form">

          <form action="{{ form.url }}">

              {{ form|with_template }}

              <button>{% trans "Search" %}</button>

          </form>

      </div>

      {% if date_hierarchy.choice_name %}

          <h4>{{ date_hierarchy.choice_name }}</h4>

          <p>

              {% for caption, url in date_hierarchy.choice_urls %}

                  <a href="{{ url }}">{{ caption }}</a>

              {% endfor %}

          </p>

      {% endif %}

      <div class="documentation">

          {% for documentation in form.search_engine_class.documentation %}

            <p>{{ documentation|safe }}</p>

          {% endfor %}

      </div>

  </aside>

{% endblock %}

{% block main %}

  {% include "journal/event_list.html" %}

{% endblock %}

  {% firstof ou object.ou as current_ou %}

  {% if multiple_ou and current_ou %}

    <a href="{% url 'a2-manager-roles' %}?search-ou={{ current_ou.id }}">{{ current_ou }}</a>

  {% endif %}

{% extends "authentic2/manager/journal.html" %}

{% load i18n gadjo %}

{% block breadcrumb-before-title %}

  <a href="{% url 'a2-manager-roles' %}">{% trans 'Roles' %}</a>

  {% if multiple_ou and object.ou %}

    <a href="../?search-ou={{ object.ou.pk }}">{{ object.ou }}</a>

  {% endif %}

  <a href="../">{{ object }}</a>

{% endblock %}

    <a class="extra-actions-menu-opener"></a>

    <ul class="extra-actions-menu">

      <li><a href="{% url "a2-manager-role-journal" pk=object.pk %}">{% trans "Journal" %}</a></li>

    </ul>

{% block page_title %}{% if multiple_ou and ou %}{{ ou }}{% else %}{{ block.super }}{% endif %}{% endblock %}

      <li><a href="{% url "a2-manager-roles-journal" %}{% if multiple_ou and ou %}?search-ou={{ ou.id }}{% endif %}">{% trans "Journal" %}</a></li>

{% extends "authentic2/manager/journal.html" %}

{% load i18n gadjo %}

{% block breadcrumb-before-title %}

  <a href="{% url 'a2-manager-roles' %}">{% trans 'Roles' %}</a>

  {% if multiple_ou and ou %}

    <a href="../?search-ou={{ ou.id }}">{{ ou }}</a>

  {% endif %}

{% endblock %}

      <li><a href="{% url "a2-manager-user-journal" pk=object.pk %}">{% trans "Journal" %}</a></li>

{% extends "authentic2/manager/journal.html" %}

{% load i18n gadjo %}

{% block breadcrumb-before-title %}

  <a href="{% url 'a2-manager-users' %}">{% trans 'Users' %}</a>

  <a href="{% url 'a2-manager-user-detail' pk=object.pk %}">{{ object.get_full_name }}</a>

{% endblock %}

from . import views, role_views, ou_views, user_views, service_views, journal_views

        url(r'^users/(?P<pk>\d+)/authorizations/$',

            user_views.user_authorizations,

            name='a2-manager-user-authorizations'),

        url(r'^users/(?P<pk>\d+)/journal/$',

            user_views.user_journal,

            name='a2-manager-user-journal'),

        url(r'^users/uuid:(?P<slug>[a-z0-9]+)/journal/$',

            user_views.user_journal,

            name='a2-manager-user-journal'),

        url(r'^roles/journal/$', role_views.roles_journal,

            name='a2-manager-roles-journal'),

        url(r'^roles/(?P<pk>\d+)/journal/$', role_views.journal,

            name='a2-manager-role-journal'),

        # Journal

        url(r'^journal/$', journal_views.journal,

            name='a2-manager-journal'),

from django.utils.functional import cached_property

from django.shortcuts import get_object_or_404

from authentic2.apps.journal.views import JournalViewWithContext

from django_rbac.utils import get_role_model, get_role_parenting_model, get_ou_model

from .journal_views import BaseJournalView

        self.request.journal.record('manager.user.creation', form=form)

        request.journal.record('manager.user.password.change.force', target_user=self.object)

        request.journal.record('manager.user.activation', target_user=self.object)

            request.journal.record('manager.user.deactivation', target_user=self.object)

        request.journal.record('manager.user.password.reset.request', target_user=self.object)

        request.journal.record('manager.user.password.change.unforce', target_user=self.object)

        if form.has_changed():

            hooks.call_hooks('event', name='manager-edit-user', user=self.request.user,

                             instance=form.instance, form=form)

            self.request.journal.record('manager.user.profile.edit', form=form)

        self.request.journal.record('manager.user.password.change', form=form)

                self.request.journal.record('manager.role.membership.grant', member=user, role=role)

            if not user.roles.filter(pk=role.pk).exists():

                user.roles.remove(role)

                hooks.call_hooks('event', name='manager-remove-role-member', user=self.request.user,

                                 role=role, member=user)

                self.request.journal.record('manager.role.membership.removal', member=user, role=role)

        request.journal.record('manager.user.deletion', target_user=self.object)

            oidc_authorization = qs.first()

            count, cascade = qs.delete()

            if count:

                self.request.journal.record(

                    'manager.user.sso.authorization.deletion',

                    service=oidc_authorization.client,

                    target_user=self.object)

class UserJournal(PermissionMixin, JournalViewWithContext, BaseJournalView):

    template_name = 'authentic2/manager/user_journal.html'

    permissions = ['custom_user.view_user']

    title = _('Journal')

    @cached_property

    def context(self):

        return get_object_or_404(User, pk=self.kwargs['pk'])

    def get_context_data(self, **kwargs):

        ctx = super().get_context_data(**kwargs)

        ctx['object'] = self.context

        return ctx

user_journal = UserJournal.as_view()

import itertools

        {

            'class': 'icon-journal',

            'href': reverse_lazy('a2-manager-journal'),

            'label': _('Journal'),

            'order': -1,

            'permission': 'superuser',

            'slug': 'journal',

        },

        for hook_entries in itertools.chain(

                self.default_entries,

                hooks.call_hooks('manager_homepage_entries', self)):

                permission = entry.get('permission')

                if permission == 'superuser' and not self.request.user.is_superuser:

                    continue

                elif permission and not self.request.user.has_perm_any(permission):

# authentic2 - versatile identity manager

# Copyright (C) 2010-2020 Entr'ouvert

#

# This program is free software: you can redistribute it and/or modify it

# under the terms of the GNU Affero General Public License as published

# by the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU Affero General Public License for more details.

#

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import datetime

import mock

from authentic2.custom_user.models import User

from authentic2.a2_rbac.utils import get_default_ou

from authentic2.a2_rbac.models import Role

from authentic2.models import Service

from authentic2.apps.journal.models import Event, _registry

from authentic2.journal import journal

from django.contrib.sessions.models import Session

from django.utils.timezone import make_aware

import pytest

from .utils import login, text_content

def test_journal_authorization(app, db, admin):

    response = login(app, admin, path='/manage/')

    assert 'Journal' not in response

    app.get('/manage/journal/', status=403)

@pytest.fixture(autouse=True)

def events(db, freezer):

    session1 = Session(session_key="1234")

    session2 = Session(session_key="abcd")

    ou = get_default_ou()

    user = User.objects.create(

        username="user", email="user@example.com", ou=ou, uuid="1" * 32, first_name='Johnny', last_name='doe'

    )

    agent = User.objects.create(username="agent", email="agent@example.com", ou=ou, uuid="2" * 32)

    role_user = Role.objects.create(name="role1", ou=ou)

    role_agent = Role.objects.create(name="role2", ou=ou)

    service = Service.objects.create(name="service")

    class EventFactory:

        date = make_aware(datetime.datetime(2020, 1, 1))

        def __call__(self, name, **kwargs):

            freezer.move_to(self.date)

            journal.record(name, **kwargs)

            assert Event.objects.latest("timestamp").type.name == name

            self.date += datetime.timedelta(hours=1)

    make = EventFactory()

    make("user.registration.request", email=user.email)

    make(

        "user.registration", user=user, session=session1, service=service, how="franceconnect",

    )

    make("user.logout", user=user, session=session1)

    make("user.login.failure", username="user")

    make("user.login.failure", username="agent")

    make("user.login", user=user, session=session1, how="password")

    make("user.password.change", user=user, session=session1)

    edit_profile_form = mock.Mock()

    edit_profile_form.initial = {'email': "user@example.com", 'first_name': "John"}

    edit_profile_form.changed_data = ["first_name"]

    edit_profile_form.cleaned_data = {'first_name': "Jane"}

    make("user.profile.edit", user=user, session=session1, form=edit_profile_form)

    make("user.service.sso.authorization", user=user, session=session1, service=service)

    make("user.service.sso", user=user, session=session1, service=service, how="password")

    make("user.service.sso.unauthorization", user=user, session=session1, service=service)

    make("user.deletion", user=user, session=session1, service=service)

    make("user.password.reset.request", email="USER@example.com", user=user)

    make("user.password.reset.failure", email="USER@example.com")

    make("user.password.reset", user=user)

    make("user.login", user=agent, session=session2, how="saml")

    create_form = mock.Mock(spec=["instance"])

    create_form.instance = user

    make("manager.user.creation", user=agent, session=session2, form=create_form)

    edit_form = mock.Mock(spec=["instance", "initial", "changed_data", "cleaned_data"])

    edit_form.instance = user

    edit_form.initial = {'email': "user@example.com", 'first_name': "John"}

    edit_form.changed_data = ["first_name"]

    edit_form.cleaned_data = {'first_name': "Jane"}

    make("manager.user.profile.edit", user=agent, session=session2, form=edit_form)

    change_email_form = mock.Mock(spec=["instance", "cleaned_data"])

    change_email_form.instance = user

    change_email_form.cleaned_data = {'new_email': "jane@example.com"}

    make(

        "manager.user.email.change.request", user=agent, session=session2, form=change_email_form,

    )

    password_change_form = mock.Mock(spec=["instance", "cleaned_data"])

    password_change_form.instance = user

    password_change_form.cleaned_data = {'generate_password': False, 'send_mail': False}

    make(

        "manager.user.password.change", user=agent, session=session2, form=password_change_form,

    )

    password_change_form.cleaned_data["send_mail"] = True

    make(

        "manager.user.password.change", user=agent, session=session2, form=password_change_form,

    )

    make(

        "manager.user.password.reset.request", user=agent, session=session2, target_user=user,

    )

    make(

        "manager.user.password.change.force", user=agent, session=session2, target_user=user,

    )

    make(

        "manager.user.password.change.unforce", user=agent, session=session2, target_user=user,

    )

    make("manager.user.activation", user=agent, session=session2, target_user=user)

    make("manager.user.deactivation", user=agent, session=session2, target_user=user)

    make("manager.user.deletion", user=agent, session=session2, target_user=user)

    make(

        "manager.user.sso.authorization.deletion",

        user=agent,

        session=session2,

        service=service,

        target_user=user,

    )

    make("manager.role.creation", user=agent, session=session2, role=role_user)

    role_edit_form = mock.Mock(spec=["instance", "initial", "changed_data", "cleaned_data"])

    role_edit_form.instance = role_user

    role_edit_form.initial = {'name': role_user.name}

    role_edit_form.changed_data = ["name"]

    role_edit_form.cleaned_data = {'name': "changed role name"}

    make(

        "manager.role.edit", user=agent, session=session2, role=role_user, form=role_edit_form,

    )

    make("manager.role.deletion", user=agent, session=session2, role=role_user)

    make(

        "manager.role.membership.grant", user=agent, session=session2, role=role_user, member=user,

    )

    make(

        "manager.role.membership.removal", user=agent, session=session2, role=role_user, member=user,

    )

    make(

        "manager.role.inheritance.addition", user=agent, session=session2, parent=role_agent, child=role_user,

    )

    make(

        "manager.role.inheritance.removal", user=agent, session=session2, parent=role_agent, child=role_user,

    )

    make(

        "manager.role.administrator.role.addition",

        user=agent,

        session=session2,

        role=role_user,

        admin_role=role_agent,

    )

    make(

        "manager.role.administrator.role.removal",

        user=agent,

        session=session2,

        role=role_user,

        admin_role=role_agent,

    )

    make(

        "manager.role.administrator.user.addition",

        user=agent,

        session=session2,

        role=role_user,

        admin_user=user,

    )

    make(

        "manager.role.administrator.user.removal",

        user=agent,

        session=session2,

        role=role_user,

        admin_user=user,

    )

    # verify we created at least one event for each type

    assert set(Event.objects.values_list("type__name", flat=True)) == set(_registry)

    return locals()

def extract_journal(response):

    rows = []

    seen_event_ids = set()

    while True:

        for tr in response.pyquery("tr[data-event-type]"):

            # page can overlap when they contain less than 20 items (to prevent orphan rows)

            event_id = tr.attrib["data-event-id"]

            if event_id not in seen_event_ids:

                rows.append(response.pyquery(tr))

                seen_event_ids.add(event_id)

        if "Previous page" not in response:

            break

        response = response.click("Previous page", index=0)

    rows.reverse()

    content = [

        {

            'timestamp': text_content(row.find(".journal-list--timestamp-column")[0]).strip(),

            'type': row[0].attrib["data-event-type"],

            'user': text_content(row.find(".journal-list--user-column")[0]).strip(),

            'message': text_content(row.find(".journal-list--message-column")[0]),

        }

        for row in rows

    ]

    return content

def test_global_journal(app, superuser, events):

    response = login(app, user=superuser, path="/manage/")

    # remove event about admin login

    Event.objects.filter(user=superuser).delete()

    response = response.click(href="journal")

    content = extract_journal(response)

    assert content == [

        {

            'message': 'registration request with email "user@example.com"',

            'timestamp': 'Jan. 1, 2020, midnight',

            'type': 'user.registration.request',

            'user': '-',

        },

        {

            'message': 'registration using franceconnect',

            'timestamp': 'Jan. 1, 2020, 1 a.m.',

            'type': 'user.registration',

            'user': 'Johnny doe',

        },

        {

            'message': 'logout',

            'timestamp': 'Jan. 1, 2020, 2 a.m.',

            'type': 'user.logout',

            'user': 'Johnny doe',

        },

        {

            'message': 'login failure with username "user"',

            'timestamp': 'Jan. 1, 2020, 3 a.m.',

            'type': 'user.login.failure',

            'user': '-',

        },

        {

            'message': 'login failure with username "agent"',

            'timestamp': 'Jan. 1, 2020, 4 a.m.',

            'type': 'user.login.failure',

            'user': '-',

        },

        {

            'message': 'login using password',

            'timestamp': 'Jan. 1, 2020, 5 a.m.',

            'type': 'user.login',

            'user': 'Johnny doe',

        },

        {

            'message': 'password change',

            'timestamp': 'Jan. 1, 2020, 6 a.m.',

            'type': 'user.password.change',

            'user': 'Johnny doe',

        },

        {

            'message': 'profile edit (first name)',

            'timestamp': 'Jan. 1, 2020, 7 a.m.',

            'type': 'user.profile.edit',

            'user': 'Johnny doe',

        },

        {

            'message': 'authorization of single sign on with "service"',

            'timestamp': 'Jan. 1, 2020, 8 a.m.',

            'type': 'user.service.sso.authorization',

            'user': 'Johnny doe',

        },

        {

            'message': 'service single sign on with "service"',

            'timestamp': 'Jan. 1, 2020, 9 a.m.',

            'type': 'user.service.sso',

            'user': 'Johnny doe',

        },

        {

            'message': 'unauthorization of single sign on with "service"',

            'timestamp': 'Jan. 1, 2020, 10 a.m.',

            'type': 'user.service.sso.unauthorization',

            'user': 'Johnny doe',

        },

        {

            'message': 'deletion',

            'timestamp': 'Jan. 1, 2020, 11 a.m.',

            'type': 'user.deletion',

            'user': 'Johnny doe',

        },

        {

            'message': 'password reset request with email "user@example.com"',

            'timestamp': 'Jan. 1, 2020, noon',

            'type': 'user.password.reset.request',

            'user': 'Johnny doe',

        },

        {

            'message': 'password reset failure with email "USER@example.com"',

            'timestamp': 'Jan. 1, 2020, 1 p.m.',

            'type': 'user.password.reset.failure',