From c26e9e477ed3c464b643e234dc1b401c9a281136 Mon Sep 17 00:00:00 2001
From: Nicolas ROCHE <nroche@entrouvert.com>
Date: Fri, 9 Aug 2019 15:23:19 +0200
Subject: [PATCH] agent: redeploy roles when authentic get a new service to
 manage (#35345)

---
 hobo/agent/authentic2/management/commands/hobo_deploy.py | 9 +++++++++
 tests_authentic/test_hobo_deploy.py                      | 5 +++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/hobo/agent/authentic2/management/commands/hobo_deploy.py b/hobo/agent/authentic2/management/commands/hobo_deploy.py
index 4f0c634..92b5c58 100644
--- a/hobo/agent/authentic2/management/commands/hobo_deploy.py
+++ b/hobo/agent/authentic2/management/commands/hobo_deploy.py
@@ -15,16 +15,17 @@ from django.utils.translation import ugettext as _, activate
 from django.core import serializers
 
 from django_rbac.utils import get_role_model, get_ou_model
 from django.conf import settings
 
 from tenant_schemas.utils import tenant_context
 
 from hobo.agent.common.management.commands import hobo_deploy
+from hobo.agent.authentic2.provisionning import Provisionning
 
 User = get_user_model()
 
 
 class Command(hobo_deploy.Command):
     help = 'Deploy multitenant authentic service from hobo'
 
     def __init__(self, *args, **kwargs):
@@ -200,16 +201,24 @@ class Command(hobo_deploy.Command):
                     content_type=provider_type)
                 # load skeleton if service is new
                 if service.get('template_name'):
                     # if there are more of the same servie, we will create an
                     # ou
                     self.load_skeleton(provider, service['service-id'],
                                        service['template_name'])
 
+                if service_created:
+                    # mass provision roles
+                    engine = Provisionning()
+                    roles = get_role_model().objects.all()
+                    ous = {provider.ou.id: provider.ou}
+                    engine.notify_roles(ous, roles, full=True)
+
+
     def load_skeleton(self, provider, service_id, template_name,
                       create_ou=False):
         if not getattr(settings, 'HOBO_SKELETONS_DIR', None):
             self.logger.debug('no skeleton: no HOBO_SKELETONS_DIR setting')
             return
         # ex.: /var/lib/authentic2-multitenant/skeletons/communes/wcs/
         skeleton_dir = os.path.join(settings.HOBO_SKELETONS_DIR, template_name,
                                     service_id)
diff --git a/tests_authentic/test_hobo_deploy.py b/tests_authentic/test_hobo_deploy.py
index 41467fb..06b7edf 100644
--- a/tests_authentic/test_hobo_deploy.py
+++ b/tests_authentic/test_hobo_deploy.py
@@ -48,19 +48,19 @@ def test_hobo_deploy(tenant_base, mocker, skeleton_dir):
                 'model': 'a2_rbac.role',
                 'fields': {
                     'name': u'Service état-civil',
                     'slug': u'service-etat-civil',
                 },
             },
         ], roles_json)
 
-    # As a user is created, notify_agents is called, as celery is not running
+    # notify_agents is called on service creation, as celery is not running
     # we just block it
-    mocker.patch('hobo.agent.authentic2.provisionning.notify_agents')
+    mock_notify = mocker.patch('hobo.agent.authentic2.provisionning.notify_agents')
     requests_get = mocker.patch('requests.get')
     meta1 = '''<?xml version="1.0"?>
 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
     xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
     entityID="http://eservices.example.net/saml/metadata">
   <SPSSODescriptor
     AuthnRequestsSigned="true" WantAssertionsSigned="true"
@@ -302,16 +302,17 @@ def test_hobo_deploy(tenant_base, mocker, skeleton_dir):
             },
         ]
     }
     hobo_json_content = json.dumps(env)
     hobo_json = tempfile.NamedTemporaryFile()
     hobo_json.write(hobo_json_content)
     hobo_json.flush()
     call_command('hobo_deploy', 'http://sso.example.net', hobo_json.name)
+    assert mock_notify.call_count == len(env['services'])
 
     from hobo.multitenant.middleware import TenantMiddleware
     tenants = list(TenantMiddleware.get_tenants())
     assert len(tenants) == 1
     tenant = tenants[0]
     assert tenant.domain_url == 'sso.example.net'
     assert tenant.schema_name == 'sso_example_net'
     tenant_directory = tenant.get_directory()
-- 
2.20.1

