0001-provisionning-log-received-provisionning-messages-an.patch

Benjamin Dauvergne, 30 septembre 2021 22:20

Voir les différences: en ligne côte à côte

Subject: [PATCH] provisionning: log received provisionning messages and
 actions (#56907)

 .../common/management/commands/hobo_notify.py |   5 +
 hobo/multitenant/utils.py                     |  10 +-
 hobo/provisionning/middleware.py              |   6 +-
 hobo/provisionning/utils.py                   | 103 +++++++++++++-----
 tests_multitenant/test_hobo_notify.py         |   6 +-
 5 files changed, 99 insertions(+), 31 deletions(-)

     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     import json
     import logging
     import os
     import sys
-...
     from hobo.multitenant.middleware import TenantMiddleware
     from hobo.provisionning.utils import NotificationProcessing, TryAgain
     logger = logging.getLogger(__name__)
     class Command(BaseCommand, NotificationProcessing):
         requires_system_checks = False
-...
             if entity_id not in audience:
                 return
             object_type = notification['objects']['@type']
             msg = 'received request for %sing %%d %%s objects (Celery)' % action
             logger.info(msg, len(notification['objects']['data']), object_type)
             for i in range(20):
                 try:
                     getattr(cls, 'provision_' + object_type)(

         logger = logging.getLogger(__name__)
         existing_pks = user.groups.values_list('pk', flat=True)
         not_found = set(uuids)
         for role in Role.objects.filter(uuid__in=uuids).exclude(pk__in=existing_pks):
             not_found.discard(role.uuid)
             if role.pk in existing_pks:
                 continue
             user.groups.through.objects.get_or_create(group=role, user=user)
             logger.info(u'adding role %s to %s (%s)', role, user, user.pk)
             logger.info('adding role %s to %s (%s)', role, user, user.pk)
         qs = user.groups.through.objects.filter(user=user, group__role__isnull=False).exclude(
             group__role__uuid__in=uuids
+        )
-...
             except DatabaseError:
                 pass
             else:
                 logger.info(u'removed role %s from %s (%s)', rel.group, user, user.pk)
                 logger.info('removed role %s from %s (%s)', rel.group, user, user.pk)
         for uuid in not_found:
             logger.warning('role %s of user %s does not exist', uuid, user)

     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     import json
     import logging
     import sys
     from django.conf import settings
-...
     from hobo.provisionning.utils import NotificationProcessing
     from hobo.rest_authentication import PublikAuthentication, PublikAuthenticationFailed
     logger = logging.getLogger(__name__)
     class ProvisionningMiddleware(MiddlewareMixin, NotificationProcessing):
         def process_request(self, request):
-...
             full = notification['full'] if 'full' in notification else False
             data = notification['objects']['data']
             msg = 'received request for %sing %%d %%s objects (HTTP)' % action
             logger.info(msg, len(notification['objects']['data']), object_type)
             if 'uwsgi' in sys.modules and 'sync' not in request.GET:
                 from hobo.provisionning.spooler import provision
-...
+                )
             else:
                 self.provision(object_type=object_type, issuer=issuer, action=action, data=data, full=full)
             return JsonResponse({'err': 0})
         def hobo_specific_setup(self):

     from hobo.agent.common.models import Role
     from hobo.multitenant.utils import provision_user_groups
     logger = logging.getLogger(__name__)
     class TryAgain(Exception):
         pass
     def user_str(user):
         '''Compute a string representation of user'''
         s = ''
         if user.first_name or user.last_name:
             s += '"'
             if user.first_name:
                 s += user.first_name
             if user.first_name and user.last_name:
                 s += ' '
             if user.last_name:
                 s += user.last_name
             s += '" '
         if user.email:
             s += user.email + ' '
         s += user.username
         return s
     class NotificationProcessing:
         @classmethod
         def check_valid_notification(cls, notification):
-...
                 try:
                     with atomic():
                         if action == 'provision':
                             new = False
                             updated = set()
                             attributes = {
                                 'first_name': o['first_name'][:30],
                                 'last_name': o['last_name'][:150],
                                 'email': o['email'][:254],
                                 'username': o['uuid'][:150],
                                 'is_superuser': o['is_superuser'],
                                 'is_staff': o['is_superuser'],
                                 'is_active': o.get('is_active', True),
+                            }
                             assert cls.check_valid_user(o)
                             try:
                                 mellon_user = UserSAMLIdentifier.objects.get(
-...
+                                    )
                                 except User.DoesNotExist:
                                     # temp user object
                                     random_uid = str(random.randint(1, 10000000000000))
                                     user = User.objects.create(username=random_uid)
                                     user = User.objects.create(**attributes)
                                     new = True
                                 saml_issuer, created = Issuer.objects.get_or_create(entity_id=issuer)
                                 mellon_user = UserSAMLIdentifier.objects.create(
                                     user=user, issuer=saml_issuer, name_id=o['uuid']
+                                )
                             user.first_name = o['first_name'][:30]
                             user.last_name = o['last_name'][:150]
                             user.email = o['email'][:254]
                             user.username = o['uuid'][:150]
                             user.is_superuser = o['is_superuser']
                             user.is_staff = o['is_superuser']
                             user.is_active = o.get('is_active', True)
                             user.save()
                             if new:
                                 logger.info('provisionned new user %s', user_str(user))
                             else:
                                 for key in attributes:
                                     if getattr(user, key) != attributes[key]:
                                         setattr(user, key, attributes[key])
                                         updated.add(key)
                                 if updated:
                                     user.save()
                                     logger.info('updated user %s(%s)', user_str(user), updated)
                             role_uuids = [role['uuid'] for role in o.get('roles', [])]
                             provision_user_groups(user, role_uuids)
                         elif action == 'deprovision':
-...
                     uuids.add(o['uuid'])
                 except IntegrityError:
                     raise TryAgain
             if full and action == 'provision':
                 for usi in UserSAMLIdentifier.objects.exclude(name_id__in=uuids):
                     usi.user.delete()
             elif action == 'deprovision':
                 for user in User.objects.filter(saml_identifiers__name_id__in=uuids):
                     user.delete()
             if (full and action == 'provision') or (action == 'deprovision'):
                 if action == 'deprovision':
                     qs = User.objects.filter(saml_identifiers__name_id__in=uuids)
                 else:
                     qs = User.objects.exclude(saml_identifiers__name_id__in=uuids)
                 # retrieve users before deleting them
                 qs = qs[:]
                 qs.delete()
                 for user in qs:
                     logger.info('deprovisionning user %s', user_str(user))
         group_name_max_length = Group._meta.get_field('name').max_length
-...
         @classmethod
         def provision_role(cls, issuer, action, data, full=False):
             logger = logging.getLogger(__name__)
             uuids = set()
             roles_by_uuid = dict()
-...
                 assert 'uuid' in o
                 uuids.add(o['uuid'])
                 if action == 'provision':
                     created = False
                     save = False
                     assert cls.check_valid_role(o)
                     role_name = cls.truncate_role_name(o['name'])
                     try:
-...
                                     defaults={
                                         'uuid': o['uuid'],
                                         'description': o['description'],
                                         'details': o.get('details', u''),
                                         'details': o.get('details', ''),
                                         'emails': o.get('emails', []),
                                         'emails_to_members': o.get('emails_to_members', True),
                                     },
+                                )
                         except IntegrityError:
                             # Can happen if uuid and name already exist
                             logger.error(u'cannot provision role "%s" (%s)', o['name'], o['uuid'])
                             logger.error('cannot provision role "%s" (%s)', o['name'], o['uuid'])
                             continue
                     if not created:
                         save = False
                         if role.name != role_name:
                             role.name = role_name
                             save = True
-...
                         if role.description != o['description']:
                             role.description = o['description']
                             save = True
                         if role.details != o.get('details', u''):
                             role.details = o.get('details', u'')
                         if role.details != o.get('details', ''):
                             role.details = o.get('details', '')
                             save = True
                         if role.emails != o.get('emails', []):
                             role.emails = o.get('emails', [])
-...
                                     role.save()
                             except IntegrityError:
                                 # Can happen if uuid and name already exist
                                 logger.error(u'cannot provision role "%s" (%s)', o['name'], o['uuid'])
                                 logger.error('cannot provision role "%s" (%s)', o['name'], o['uuid'])
                                 continue
                     if created:
                         logger.info('provisionned new role %s (%s)', o['name'], o['uuid'])
                     if save:
                         logger.info('updated role %s (%s)', o['name'], o['uuid'])
             if full and action == 'provision':
                 Role.objects.exclude(uuid__in=uuids).delete()
                 qs = Role.objects.exclude(uuid__in=uuids)
                 logger.info(
                     'deprovisionning roles %s',
                     ', '.join('%s (%s)' % (name, uuid) for name, uuid in qs.values_list('name', 'uuid')),
+                )
                 qs.delete()
                 for role in qs:
                     role.delete()
             elif action == 'deprovision':
                 Role.objects.filter(uuid__in=uuids).delete()
                 qs = Role.objects.filter(uuid__in=uuids)
                 logger.info(
                     'deprovisionning roles %s',
                     ', '.join('%s (%s)' % (name, uuid) for name, uuid in qs.values_list('name', 'uuid')),
+                )
                 qs.delete()
         @classmethod
         def provision(cls, object_type, issuer, action, data, full):

     import logging
     import pytest
     from django.db import connection
     from django.test.utils import CaptureQueriesContext
     import pytest
     pytestmark = pytest.mark.django_db
-...
+                }
                 with CaptureQueriesContext(connection) as ctx:
                     Command.process_notification(tenant, notification)
                     assert len(ctx.captured_queries) == 33
                     assert len(ctx.captured_queries) == 39
                 assert Group.objects.count() == 1
                 assert Role.objects.count() == 1
-...
+                }
                 with CaptureQueriesContext(connection) as ctx:
                     Command.process_notification(tenant, notification)
                     assert len(ctx.captured_queries) == 15
                     assert len(ctx.captured_queries) == 18
                 assert Group.objects.count() == 0
                 assert Role.objects.count() == 0
+    -

Projet

Général

Profil

Produits Entr'ouvert » Hobo

0001-provisionning-log-received-provisionning-messages-an.patch