Produits Entr'ouvert » w.c.s.

# w.c.s. - web application for online forms

# Copyright (C) 2005-2014  Entr'ouvert

#

# This program is free software; you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation; either version 2 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, see <http://www.gnu.org/licenses/>.

import os

import sys

import json

from wcs.roles import Role

from qommon.ctl import Command

from qommon.publisher import get_cfg

class CmdNotify(Command):

    name = 'notify'

    def execute(self, base_options, sub_options, args):

        import publisher

        self.base_options = base_options

        if sub_options.extra:

            if not self.config.has_section('extra'):

                self.config.add_section('extra')

            for i, extra in enumerate(sub_options.extra):

                self.config.set('extra', 'cmd_line_extra_%d' % i, extra)

        publisher.WcsPublisher.configure(self.config)

        pub = publisher.WcsPublisher.create_publisher()

        global_app_dir = pub.app_dir

        if args[1] == '-':

            # get environment definition from stdin

            notification = json.load(sys.stdin)

        else:

            notification = json.load(file(args[1]))

        if not isinstance(notification, dict) \

            or '@type' not in notification \

            or notification['@type'] not in ['provision', 'deprovision'] \

            or 'objects' not in notification \

            or 'audience' not in notification \

            or not isinstance(notification['audience'], list) \

                or not isinstance(notification['objects'], list):

            sys.exit(1)

        action = notification['@type']

        audience = notification['audience']

        full = notification['full'] if full in notification else False

        for hostname in os.listdir(global_app_dir):

            pub.app_dir = os.path.join(global_app_dir, hostname)

            pub.set_config()

            # Verify tenant is in audience

            entity_id = get_cfg('sp', {}).get('saml2_providerid')

            if not entity_id or entity_id not in audience:

                continue

            uuids = set()

            # Now provision/deprovision

            for o in notification['objects']:

                t = o['@type']

                if t != 'role' \

                   or 'uuid' not in o \

                   or 'name' not in o \

                   or 'slug' not in o:

                    continue

                uuid = o['uuid'].encode(publisher.site_charset)

                uuids.add(uuid)

                slug = o['slug'].encode(publisher.site_charset)

                name = o['name'].encode(publisher.site_charset)

                # Find existing role

                try:

                    role = Role.get_on_index(uuid, 'slug')

                except KeyError:

                    try:

                        role = Role.get_on_index(slug, 'slug')

                    except KeyError:

                        # New role

                        if action != 'provision':

                            continue

                        role = Role(name=name)

                if action == 'provision':

                    # Provision/rename

                    role.name = name

                    role.slug = uuid

                    role.store()

                elif action == 'provision':

                    # Deprovision

                    role.remove_self()

            # All roles have been sent

            if full:

                for role in Role.select():

                    if role.slug not in uuids:

                        role.remove_self()