Produits Entr'ouvert » Authentic 2

        from django.db.models.signals import post_delete, post_migrate, post_save

        from authentic2.models import Service

        from . import models, signal_handlers, signals

        # update role parenting when new role parenting is created

        # update role parenting when role parenting is deleted

        # or soft-created

        signals.post_soft_create.connect(

        )

        # or soft-deleted

        signals.post_soft_delete.connect(

        )

        # create CRUD operations and admin

        post_migrate.connect(signal_handlers.create_base_operations, sender=self)

from django.db.models.query import Prefetch, Q

from django.db.transaction import atomic

from . import models as a2_models

from . import signals

class AbstractBaseManager(models.Manager):

        target_query = query.Q(target_ct=ContentType.objects.get_for_model(ContentType), target_id=ct.pk)

        if isinstance(object_or_model, models.Model):

            target_query |= query.Q(target_ct=ct, target_id=object.pk)

        qs = qs.filter(operation__slug=operation_slug)

        qs = qs.filter(ou_query & target_query)

        return qs.exists()

    def get_by_natural_key(self, operation_slug, ou_nk, target_ct, target_nk):

        qs = self.filter(operation__slug=operation_slug)

        if ou_nk:

            try:

                raise self.model.DoesNotExist

            qs = qs.filter(ou=ou)

        else:

        """Retrieve all permissions hold by an user through its role and

        inherited roles.

        """

        return self.filter(roles__in=roles)

    def cleanup(self):

    tls = Local()

    def get_by_natural_key(self, parent_nk, child_nk, direct):

        try:

            raise self.model.DoesNotExist

        try:

            raise self.model.DoesNotExist

        return self.get(parent=parent, child=child, direct=direct)

@contextlib.contextmanager

def defer_update_transitive_closure():

    RoleParentingManager.tls.DO_UPDATE_CLOSURE = False

    try:

        yield

        if RoleParentingManager.tls.CLOSURE_UPDATED:

    finally:

        RoleParentingManager.tls.DO_UPDATE_CLOSURE = True

        RoleParentingManager.tls.CLOSURE_UPDATED = False

from django.db import migrations, models

class Migration(migrations.Migration):

            model_name='organizationalunit',

            name='uuid',

            field=models.CharField(

            ),

        ),

        migrations.AlterField(

            model_name='role',

            name='uuid',

            field=models.CharField(

            ),

        ),

    ]

from authentic2.decorators import errorcollector

from authentic2.utils.cache import GlobalCache

from authentic2.validators import HexaColourValidator

class AbstractBase(models.Model):

    slug

    """

    name = models.CharField(max_length=256, verbose_name=_('name'))

    slug = models.SlugField(max_length=256, verbose_name=_('slug'))

    description = models.TextField(verbose_name=_('description'), blank=True)

    def save(self, *args, **kwargs):

        # truncate slug and add a hash if it's too long

        if not self.slug:

        if len(self.slug) > 256:

            self.slug = self.slug[:252] + hashlib.md5(self.slug).hexdigest()[:4]

        if not self.uuid:

        return super().save(*args, **kwargs)

    def natural_key(self):

        to='a2_rbac.Operation', verbose_name=_('operation'), on_delete=models.CASCADE

    )

    ou = models.ForeignKey(

        verbose_name=_('organizational unit'),

        related_name='scoped_permission',

        null=True,

class Role(AbstractBase):

    ou = models.ForeignKey(

        verbose_name=_('organizational unit'),

        swappable=True,

        blank=True,

    members = models.ManyToManyField(

        to=settings.AUTH_USER_MODEL, swappable=True, blank=True, related_name='roles'

    )

    name = models.TextField(verbose_name=_('name'))

    admin_scope_ct = models.ForeignKey(

        to='contenttypes.ContentType',

    objects = managers.RoleQuerySet.as_manager()

    def add_child(self, child):

        RoleParenting.objects.soft_create(self, child)

    def remove_child(self, child):

        RoleParenting.objects.soft_delete(self, child)

    def add_parent(self, parent):

        RoleParenting.objects.soft_create(parent, self)

    def remove_parent(self, parent):

        RoleParenting.objects.soft_delete(parent, self)

    def parents(self, include_self=True, annotate=False, direct=None):

    def has_self_administration(self, op=None):

        if not op:

            op = MANAGE_MEMBERS_OP

        self_perm, dummy = Permission.objects.get_or_create(

            operation=operation,

            target_ct=ContentType.objects.get_for_model(self),

        'Add permission to role so that it is self-administered'

        if not op:

            op = MANAGE_MEMBERS_OP

        self_perm, dummy = Permission.objects.get_or_create(

            operation=operation, target_ct=ContentType.objects.get_for_model(self), target_id=self.pk

        )

        if isinstance(operation_tpl, str):

            operation = Operation.objects.get(slug=operation_tpl)

        else:

        permission, _ = Permission.objects.get_or_create(

            operation=operation, target_ct=target_ct, target_id=target_id, ou=ou

        )

        if isinstance(operation_tpl, str):

            operation = Operation.objects.get(slug=operation_tpl)

        else:

        qs = Permission.objects.filter(target_ct=target_ct, target_id=target_id, operation=operation)

        if ou:

            qs = qs.filter(ou=ou)

class RoleParenting(models.Model):

    parent = models.ForeignKey(

        swappable=True,

        related_name='child_relation',

        on_delete=models.CASCADE,

    )

    child = models.ForeignKey(

        swappable=True,

        related_name='parent_relation',

        on_delete=models.CASCADE,

from django.utils.translation import gettext as _

from django.utils.translation import override

from authentic2.utils.misc import get_fk_model

from .managers import defer_update_transitive_closure

def create_default_ou(app_config, verbosity=2, interactive=True, using=DEFAULT_DB_ALIAS, **kwargs):

def fix_role_parenting_closure(app_config, verbosity=2, interactive=True, using=DEFAULT_DB_ALIAS, **kwargs):

    '''Close the role parenting relation after migrations'''

        return

# You should have received a copy of the GNU Affero General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

from django.contrib.auth import get_user_model

from django.contrib.contenttypes.models import ContentType

from django.utils.text import slugify

from . import models

def get_default_ou():

    try:

        return models.OrganizationalUnit.objects.get(default=True)

def get_view_user_perm(ou=None):

    User = get_user_model()

    view_user_perm, dummy = models.Permission.objects.get_or_create(

        target_ct=ContentType.objects.get_for_model(ContentType),

        target_id=ContentType.objects.get_for_model(User).pk,

        ou__isnull=ou is None,

def get_search_ou_perm(ou=None):

    if ou:

        view_ou_perm, dummy = models.Permission.objects.get_or_create(

            target_ct=ContentType.objects.get_for_model(ou),

            target_id=ou.pk,

            ou__isnull=True,

        )

    else:

        view_ou_perm, dummy = models.Permission.objects.get_or_create(

            target_ct=ContentType.objects.get_for_model(ContentType),

            target_id=ContentType.objects.get_for_model(models.OrganizationalUnit).pk,

            ou__isnull=True,

def get_manage_authorizations_user_perm(ou=None):

    User = get_user_model()

    manage_authorizations_user_perm, dummy = models.Permission.objects.get_or_create(

        target_ct=ContentType.objects.get_for_model(ContentType),

        target_id=ContentType.objects.get_for_model(User).pk,

        ou__isnull=ou is None,

from django.db import models

from django.db.models.query import Q

def get_fk_model(model, fieldname):

        """

        if not hasattr(user_obj, '_rbac_perms_cache'):

            perms_cache = {}

            qs = Permission.objects.for_user(user_obj)

            ct_ct = ContentType.objects.get_for_model(ContentType)

            qs = qs.select_related('operation')

        perm_or_perms = set(perm_or_perms)

        cache = self.get_permission_cache(user_obj)

        model = qs.model

        has_ou_field = get_fk_model(model, 'ou') == OU

        if perm_or_perms & cache.get('__all__', set()):

            return True

        return perm in self.get_permission_cache(user_obj).get('ou.%s' % ou.pk, ())

    def ous_with_perm(self, user_obj, perm, queryset=None):

        qs = queryset or OU.objects.all()

        if user_obj.is_anonymous:

from authentic2.a2_rbac.models import ADMIN_OP

from authentic2.a2_rbac.models import OrganizationalUnit as OU

from authentic2.a2_rbac.models import Permission, Role

from authentic2.custom_user.models import User

try:

    from authentic2.a2_rbac.models import MANAGE_MEMBERS_OP  # pylint: disable=C0412

from django.conf import settings

from django.db import migrations, models

class Migration(migrations.Migration):

                (

                    'uuid',

                    models.CharField(

                        unique=True,

                        max_length=32,

                        verbose_name='uuid',

                (

                    'uuid',

                    models.CharField(

                        unique=True,

                        max_length=32,

                        verbose_name='uuid',

    Permission,

    Role,

)

from authentic2.apps.journal.models import Event

from authentic2.custom_user.models import DeletedUser

from authentic2.models import UserExternalId

from authentic2_auth_oidc.models import OIDCAccount, OIDCProvider

from .utils import call_command, login

from authentic2.a2_rbac.models import MANAGE_MEMBERS_OP, VIEW_OP

from authentic2.a2_rbac.models import OrganizationalUnit as OU

from authentic2.a2_rbac.models import Permission, Role

from authentic2.apps.journal.models import Event

from authentic2.models import Service

from authentic2.validators import EmailValidator

from .utils import assert_event, get_link_from_mail, login, request_select2, text_content

from django.db.models import Q

from django.test.utils import CaptureQueriesContext

from authentic2.custom_user import backends

User = get_user_model()

def test_role_parenting_soft_delete_children(db):

    ou = OrganizationalUnit.objects.create(name='ou')

    roles = []

    for i in range(10):

def test_role_parenting_soft_delete_parents(db):

    ou = OrganizationalUnit.objects.create(name='ou')

    roles = []

    for i in range(10):

        relations.append(RoleParenting(parent=roles[i], child=roles[(i - 1) // SPAN]))

    RoleParenting.objects.bulk_create(relations)

    RoleParenting.objects.update_transitive_closure()

    perm, _ = Permission.objects.get_or_create(

        operation=operation,

        target_ct=ContentType.objects.get_for_model(ContentType),

    roles[0].members.add(user)

    Role.objects.get(pk=roles[-1].pk).permissions.add(perm)

    for i in range(SIZE):

    for i in range(SIZE):

        assert list(Role.objects.for_user(user).order_by('pk')) == list(Role.objects.order_by('pk'))

def test_rbac_backend(db):

    user1 = User.objects.create(username='john.doe')

    ct_ct = ContentType.objects.get_for_model(ContentType)

    role_ct = ContentType.objects.get_for_model(Role)

    perm1 = Permission.objects.create(operation=change_op, target_ct=ct_ct, target_id=role_ct.pk)

    perm2 = Permission.objects.create(operation=view_op, target_ct=ct_ct, target_id=role_ct.pk)

    Role.objects.all().delete()

from authentic2.a2_rbac.models import VIEW_OP

from authentic2.a2_rbac.models import OrganizationalUnit as OU

from authentic2.a2_rbac.models import Permission, Role

from authentic2.apps.journal.models import Event

from authentic2.custom_user.models import User

from authentic2.manager import user_import

from authentic2.models import Attribute, AttributeValue

from authentic2_idp_oidc.models import OIDCAuthorization, OIDCClient

from .utils import get_link_from_mail, login, logout