|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
|
# Copyright 2010 - 2017 RhodeCode GmbH and the AppEnlight project authors
|
|
|
#
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
# you may not use this file except in compliance with the License.
|
|
|
# You may obtain a copy of the License at
|
|
|
#
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
#
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
# See the License for the specific language governing permissions and
|
|
|
# limitations under the License.
|
|
|
|
|
|
from pyramid.security import Allow, Everyone, Authenticated, ALL_PERMISSIONS
|
|
|
from pyramid.authentication import CallbackAuthenticationPolicy
|
|
|
import appenlight.models.resource
|
|
|
from appenlight.models.services.auth_token import AuthTokenService
|
|
|
from appenlight.models.services.application import ApplicationService
|
|
|
from appenlight.models.services.report_group import ReportGroupService
|
|
|
from appenlight.models.services.plugin_config import PluginConfigService
|
|
|
from appenlight.lib import to_integer_safe
|
|
|
from pyramid.httpexceptions import HTTPNotFound, HTTPBadRequest
|
|
|
from ziggurat_foundations.permissions import permission_to_04_acls
|
|
|
import defusedxml.ElementTree as ElementTree
|
|
|
import urllib.request, urllib.error, urllib.parse
|
|
|
import logging
|
|
|
import re
|
|
|
from xml.sax.saxutils import quoteattr
|
|
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
|
|
|
def groupfinder(userid, request):
|
|
|
if userid and hasattr(request, 'user') and request.user:
|
|
|
groups = ['group:%s' % g.id for g in request.user.groups]
|
|
|
return groups
|
|
|
return []
|
|
|
|
|
|
|
|
|
class AuthTokenAuthenticationPolicy(CallbackAuthenticationPolicy):
|
|
|
def __init__(self, callback=None):
|
|
|
self.callback = callback
|
|
|
|
|
|
def remember(self, request, principal, **kw):
|
|
|
return []
|
|
|
|
|
|
def forget(self, request):
|
|
|
return []
|
|
|
|
|
|
def unauthenticated_userid(self, request):
|
|
|
token = request.headers.get('x-appenlight-auth-token')
|
|
|
if token:
|
|
|
auth_token = AuthTokenService.by_token(token)
|
|
|
if auth_token and not auth_token.is_expired:
|
|
|
log.info('%s is valid' % auth_token)
|
|
|
return auth_token.owner_id
|
|
|
elif auth_token:
|
|
|
log.warning('%s is expired' % auth_token)
|
|
|
else:
|
|
|
log.warning('token: %s is not found' % token)
|
|
|
|
|
|
def authenticated_userid(self, request):
|
|
|
return self.unauthenticated_userid(request)
|
|
|
|
|
|
|
|
|
def rewrite_root_perm(perm_user, perm_name):
|
|
|
"""
|
|
|
Translates root_administration into ALL_PERMISSIONS object
|
|
|
"""
|
|
|
if perm_name == 'root_administration':
|
|
|
return (Allow, perm_user, ALL_PERMISSIONS,)
|
|
|
else:
|
|
|
return (Allow, perm_user, perm_name,)
|
|
|
|
|
|
|
|
|
def add_root_superperm(request, context):
|
|
|
"""
|
|
|
Adds ALL_PERMISSIONS to every resource if user somehow has 'root_permission'
|
|
|
non-resource permission
|
|
|
"""
|
|
|
if hasattr(request, 'user') and request.user:
|
|
|
acls = permission_to_04_acls(request.user.permissions)
|
|
|
for perm_user, perm_name in acls:
|
|
|
if perm_name == 'root_administration':
|
|
|
context.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
|
|
|
|
|
|
class RootFactory(object):
|
|
|
"""
|
|
|
General factory for non-resource/report specific pages
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
self.__acl__ = [(Allow, Authenticated, 'authenticated'),
|
|
|
(Allow, Authenticated, 'create_resources')]
|
|
|
# general page factory - append custom non resource permissions
|
|
|
if hasattr(request, 'user') and request.user:
|
|
|
acls = permission_to_04_acls(request.user.permissions)
|
|
|
for perm_user, perm_name in acls:
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
|
|
|
class ResourceFactory(object):
|
|
|
"""
|
|
|
Checks permissions to specific resource based on user permissions or
|
|
|
API key headers
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
Resource = appenlight.models.resource.Resource
|
|
|
|
|
|
self.__acl__ = []
|
|
|
resource_id = request.matchdict.get("resource_id",
|
|
|
request.GET.get("resource_id"))
|
|
|
resource_id = to_integer_safe(resource_id)
|
|
|
self.resource = Resource.by_resource_id(resource_id) \
|
|
|
if resource_id else None
|
|
|
if self.resource and request.user:
|
|
|
self.__acl__ = self.resource.__acl__
|
|
|
permissions = self.resource.perms_for_user(request.user)
|
|
|
for perm_user, perm_name in permission_to_04_acls(permissions):
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
add_root_superperm(request, self)
|
|
|
|
|
|
|
|
|
class ResourceReportFactory(object):
|
|
|
"""
|
|
|
Checks permissions to specific resource based on user permissions or
|
|
|
API key headers
|
|
|
Resource is fetched based on report group information
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
Resource = appenlight.models.resource.Resource
|
|
|
|
|
|
self.__acl__ = []
|
|
|
group_id = request.matchdict.get("group_id",
|
|
|
request.params.get("group_id"))
|
|
|
group_id = to_integer_safe(group_id)
|
|
|
self.report_group = ReportGroupService.by_id(
|
|
|
group_id) if group_id else None
|
|
|
if not self.report_group:
|
|
|
raise HTTPNotFound()
|
|
|
|
|
|
self.public = self.report_group.public
|
|
|
self.resource = Resource.by_resource_id(self.report_group.resource_id) \
|
|
|
if self.report_group else None
|
|
|
|
|
|
if self.resource:
|
|
|
self.__acl__ = self.resource.__acl__
|
|
|
if request.user:
|
|
|
permissions = self.resource.perms_for_user(request.user)
|
|
|
for perm_user, perm_name in permission_to_04_acls(permissions):
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
if self.public:
|
|
|
self.__acl__.append((Allow, Everyone, 'view',))
|
|
|
if not request.user:
|
|
|
# unauthed users need to visit using both group and report pair
|
|
|
report_id = request.params.get('reportId',
|
|
|
request.params.get('report_id', -1))
|
|
|
report = self.report_group.get_report(report_id, public=True)
|
|
|
if not report:
|
|
|
raise HTTPNotFound()
|
|
|
add_root_superperm(request, self)
|
|
|
|
|
|
|
|
|
class APIFactory(object):
|
|
|
"""
|
|
|
Checks permissions to perform client API actions based on keys
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
self.__acl__ = []
|
|
|
self.possibly_public = False
|
|
|
private_api_key = request.headers.get(
|
|
|
'x-appenlight-api-key',
|
|
|
request.params.get('api_key')
|
|
|
)
|
|
|
log.debug("private key: %s" % private_api_key)
|
|
|
if private_api_key:
|
|
|
self.resource = ApplicationService.by_api_key_cached()(
|
|
|
private_api_key)
|
|
|
# then try public key
|
|
|
else:
|
|
|
public_api_key = request.headers.get(
|
|
|
'x-appenlight-public-api-key',
|
|
|
request.GET.get('public_api_key'))
|
|
|
log.debug("public key: %s" % public_api_key)
|
|
|
self.resource = ApplicationService.by_public_api_key(
|
|
|
public_api_key, from_cache=True, request=request)
|
|
|
self.possibly_public = True
|
|
|
if self.resource:
|
|
|
self.__acl__.append((Allow, Everyone, 'create',))
|
|
|
|
|
|
|
|
|
class AirbrakeV2APIFactory(object):
|
|
|
"""
|
|
|
Check permission based on Airbrake XML report
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
self.__acl__ = []
|
|
|
self.possibly_public = False
|
|
|
fixed_xml_data = ''
|
|
|
try:
|
|
|
data = request.GET.get('data')
|
|
|
if data:
|
|
|
self.possibly_public = True
|
|
|
except (UnicodeDecodeError, UnicodeEncodeError) as exc:
|
|
|
log.warning(
|
|
|
'Problem parsing Airbrake data: %s, failed decoding' % exc)
|
|
|
raise HTTPBadRequest()
|
|
|
try:
|
|
|
if not data:
|
|
|
data = request.body
|
|
|
# fix shitty airbrake js client not escaping line method attr
|
|
|
|
|
|
def repl(input):
|
|
|
return 'line method=%s file' % quoteattr(input.group(1))
|
|
|
|
|
|
fixed_xml_data = re.sub('line method="(.*?)" file', repl, data)
|
|
|
root = ElementTree.fromstring(fixed_xml_data)
|
|
|
except Exception as exc:
|
|
|
log.info(
|
|
|
'Problem parsing Airbrake '
|
|
|
'data: %s, trying unquoting' % exc)
|
|
|
self.possibly_public = True
|
|
|
try:
|
|
|
root = ElementTree.fromstring(urllib.parse.unquote(fixed_xml_data))
|
|
|
except Exception as exc:
|
|
|
log.warning('Problem parsing Airbrake '
|
|
|
'data: %s, failed completly' % exc)
|
|
|
raise HTTPBadRequest()
|
|
|
self.airbrake_xml_etree = root
|
|
|
api_key = root.findtext('api-key', '')
|
|
|
|
|
|
self.resource = ApplicationService.by_api_key_cached()(api_key)
|
|
|
if not self.resource:
|
|
|
self.resource = ApplicationService.by_public_api_key(api_key,
|
|
|
from_cache=True,
|
|
|
request=request)
|
|
|
if self.resource:
|
|
|
self.possibly_public = True
|
|
|
|
|
|
if self.resource:
|
|
|
self.__acl__.append((Allow, Everyone, 'create',))
|
|
|
|
|
|
|
|
|
def parse_sentry_header(header):
|
|
|
parsed = header.split(' ', 1)[1].split(',') or []
|
|
|
return dict([x.strip().split('=') for x in parsed])
|
|
|
|
|
|
|
|
|
class SentryAPIFactory(object):
|
|
|
"""
|
|
|
Check permission based on Sentry payload
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
self.__acl__ = []
|
|
|
self.possibly_public = False
|
|
|
if request.headers.get('X-Sentry-Auth', '').startswith('Sentry'):
|
|
|
header_string = request.headers['X-Sentry-Auth']
|
|
|
result = parse_sentry_header(header_string)
|
|
|
elif request.headers.get('Authorization', '').startswith('Sentry'):
|
|
|
header_string = request.headers['Authorization']
|
|
|
result = parse_sentry_header(header_string)
|
|
|
else:
|
|
|
result = dict((k, v) for k, v in list(request.GET.items())
|
|
|
if k.startswith('sentry_'))
|
|
|
key = result.get('sentry_key')
|
|
|
log.info('sentry request {}'.format(result))
|
|
|
|
|
|
self.resource = ApplicationService.by_api_key_cached()(key)
|
|
|
if not self.resource or \
|
|
|
result.get('sentry_client', '').startswith('raven-js'):
|
|
|
self.resource = ApplicationService.by_public_api_key(
|
|
|
key, from_cache=True, request=request)
|
|
|
if self.resource:
|
|
|
self.__acl__.append((Allow, Everyone, 'create',))
|
|
|
|
|
|
|
|
|
class ResourcePluginConfigFactory(object):
|
|
|
|
|
|
def __init__(self, request):
|
|
|
Resource = appenlight.models.resource.Resource
|
|
|
self.__acl__ = []
|
|
|
self.resource = None
|
|
|
plugin_id = to_integer_safe(request.matchdict.get('id'))
|
|
|
self.plugin = PluginConfigService.by_id(plugin_id)
|
|
|
if not self.plugin:
|
|
|
raise HTTPNotFound()
|
|
|
if self.plugin.resource_id:
|
|
|
self.resource = Resource.by_resource_id(self.plugin.resource_id)
|
|
|
if self.resource:
|
|
|
self.__acl__ = self.resource.__acl__
|
|
|
if request.user and self.resource:
|
|
|
permissions = self.resource.perms_for_user(request.user)
|
|
|
for perm_user, perm_name in permission_to_04_acls(permissions):
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
|
|
|
add_root_superperm(request, self)
|
|
|
|
|
|
|
|
|
class ResourceJSONBodyFactory(object):
|
|
|
"""
|
|
|
Checks permissions to specific resource based on user permissions or
|
|
|
API key headers from json body
|
|
|
"""
|
|
|
|
|
|
def __init__(self, request):
|
|
|
Resource = appenlight.models.resource.Resource
|
|
|
|
|
|
self.__acl__ = []
|
|
|
resource_id = request.unsafe_json_body().get('resource_id')
|
|
|
resource_id = to_integer_safe(resource_id)
|
|
|
self.resource = Resource.by_resource_id(resource_id)
|
|
|
if self.resource and request.user:
|
|
|
self.__acl__ = self.resource.__acl__
|
|
|
permissions = self.resource.perms_for_user(request.user)
|
|
|
for perm_user, perm_name in permission_to_04_acls(permissions):
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
add_root_superperm(request, self)
|
|
|
|
|
|
|
|
|
class ResourcePluginMixedFactory(object):
|
|
|
def __init__(self, request):
|
|
|
Resource = appenlight.models.resource.Resource
|
|
|
self.__acl__ = []
|
|
|
json_body = request.safe_json_body
|
|
|
self.resource = None
|
|
|
if json_body:
|
|
|
resource_id = json_body.get('resource_id')
|
|
|
else:
|
|
|
resource_id = request.GET.get('resource_id')
|
|
|
if resource_id:
|
|
|
resource_id = to_integer_safe(resource_id)
|
|
|
self.resource = Resource.by_resource_id(resource_id)
|
|
|
if self.resource and request.user:
|
|
|
self.__acl__ = self.resource.__acl__
|
|
|
permissions = self.resource.perms_for_user(request.user)
|
|
|
for perm_user, perm_name in permission_to_04_acls(permissions):
|
|
|
self.__acl__.append(rewrite_root_perm(perm_user, perm_name))
|
|
|
add_root_superperm(request, self)
|
|
|
|
