auth.py
436 lines
| 14.6 KiB
| text/x-python
|
PythonLexer
r252 | #!/usr/bin/env python | |||
# encoding: utf-8 | ||||
# authentication and permission libraries | ||||
# Copyright (C) 2009-2010 Marcin Kuzminski <marcin@python-works.com> | ||||
r316 | ||||
r252 | # This program is free software; you can redistribute it and/or | |||
# modify it under the terms of the GNU General Public License | ||||
# as published by the Free Software Foundation; version 2 | ||||
# of the License or (at your opinion) any later version of the license. | ||||
# | ||||
# This program is distributed in the hope that it will be useful, | ||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
# GNU General Public License for more details. | ||||
# | ||||
# You should have received a copy of the GNU General Public License | ||||
# along with this program; if not, write to the Free Software | ||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, | ||||
# MA 02110-1301, USA. | ||||
""" | ||||
Created on April 4, 2010 | ||||
@author: marcink | ||||
""" | ||||
r343 | from beaker.cache import cache_region | |||
r190 | from functools import wraps | |||
r343 | from pylons import config, session, url, request | |||
r52 | from pylons.controllers.util import abort, redirect | |||
r343 | from pylons_app.lib.utils import get_repo_slug | |||
|
r64 | from pylons_app.model import meta | ||
r316 | from pylons_app.model.db import User, Repo2Perm, Repository, Permission | |||
r190 | from sqlalchemy.exc import OperationalError | |||
|
r64 | from sqlalchemy.orm.exc import NoResultFound, MultipleResultsFound | ||
r190 | import crypt | |||
import logging | ||||
r343 | ||||
r316 | log = logging.getLogger(__name__) | |||
|
r41 | |||
|
r64 | def get_crypt_password(password): | ||
r190 | """ | |||
Cryptographic function used for password hashing | ||||
@param password: password to hash | ||||
""" | ||||
|
r64 | return crypt.crypt(password, '6a') | ||
|
r46 | |||
r343 | ||||
@cache_region('super_short_term', 'cached_user') | ||||
def get_user_cached(username): | ||||
sa = meta.Session | ||||
r350 | try: | |||
user = sa.query(User).filter(User.username == username).one() | ||||
finally: | ||||
meta.Session.remove() | ||||
r343 | return user | |||
|
r41 | def authfunc(environ, username, password): | ||
|
r64 | password_crypt = get_crypt_password(password) | ||
r42 | try: | |||
r343 | user = get_user_cached(username) | |||
|
r64 | except (NoResultFound, MultipleResultsFound, OperationalError) as e: | ||
r42 | log.error(e) | |||
|
r64 | user = None | ||
if user: | ||||
if user.active: | ||||
if user.username == username and user.password == password_crypt: | ||||
|
r41 | log.info('user %s authenticated correctly', username) | ||
return True | ||||
else: | ||||
log.error('user %s is disabled', username) | ||||
return False | ||||
r190 | class AuthUser(object): | |||
""" | ||||
A simple object that handles a mercurial username for authentication | ||||
""" | ||||
def __init__(self): | ||||
r316 | self.username = 'None' | |||
r355 | self.name = '' | |||
self.lastname = '' | ||||
r316 | self.user_id = None | |||
self.is_authenticated = False | ||||
self.is_admin = False | ||||
self.permissions = {} | ||||
r239 | ||||
def set_available_permissions(config): | ||||
""" | ||||
This function will propagate pylons globals with all available defined | ||||
permission given in db. We don't wannt to check each time from db for new | ||||
permissions since adding a new permission also requires application restart | ||||
ie. to decorate new views with the newly created permission | ||||
@param config: | ||||
""" | ||||
r316 | log.info('getting information about all available permissions') | |||
r350 | try: | |||
sa = meta.Session | ||||
all_perms = sa.query(Permission).all() | ||||
finally: | ||||
meta.Session.remove() | ||||
r316 | config['available_permissions'] = [x.permission_name for x in all_perms] | |||
def set_base_path(config): | ||||
config['base_path'] = config['pylons.app_globals'].base_path | ||||
r371 | ||||
def fill_data(user): | ||||
""" | ||||
Fills user data with those from database | ||||
@param user: | ||||
""" | ||||
sa = meta.Session | ||||
dbuser = sa.query(User).get(user.user_id) | ||||
user.username = dbuser.username | ||||
user.is_admin = dbuser.admin | ||||
user.name = dbuser.name | ||||
user.lastname = dbuser.lastname | ||||
meta.Session.remove() | ||||
return user | ||||
r316 | def fill_perms(user): | |||
r367 | """ | |||
Fills user permission attribute with permissions taken from database | ||||
@param user: | ||||
""" | ||||
r316 | sa = meta.Session | |||
user.permissions['repositories'] = {} | ||||
r371 | user.permissions['global'] = set() | |||
r316 | ||||
#first fetch default permissions | ||||
default_perms = sa.query(Repo2Perm, Repository, Permission)\ | ||||
r367 | .join((Repository, Repo2Perm.repository_id == Repository.repo_id))\ | |||
r316 | .join((Permission, Repo2Perm.permission_id == Permission.permission_id))\ | |||
.filter(Repo2Perm.user_id == sa.query(User).filter(User.username == | ||||
'default').one().user_id).all() | ||||
r239 | ||||
r316 | if user.is_admin: | |||
r371 | user.permissions['global'].add('hg.admin') | |||
r316 | #admin have all rights full | |||
for perm in default_perms: | ||||
p = 'repository.admin' | ||||
r367 | user.permissions['repositories'][perm.Repo2Perm.repository.repo_name] = p | |||
r316 | ||||
else: | ||||
r371 | user.permissions['global'].add('') | |||
r316 | for perm in default_perms: | |||
if perm.Repository.private: | ||||
#disable defaults for private repos, | ||||
p = 'repository.none' | ||||
elif perm.Repository.user_id == user.user_id: | ||||
#set admin if owner | ||||
p = 'repository.admin' | ||||
else: | ||||
p = perm.Permission.permission_name | ||||
r367 | user.permissions['repositories'][perm.Repo2Perm.repository.repo_name] = p | |||
r316 | ||||
user_perms = sa.query(Repo2Perm, Permission, Repository)\ | ||||
r367 | .join((Repository, Repo2Perm.repository_id == Repository.repo_id))\ | |||
r316 | .join((Permission, Repo2Perm.permission_id == Permission.permission_id))\ | |||
.filter(Repo2Perm.user_id == user.user_id).all() | ||||
#overwrite userpermissions with defaults | ||||
for perm in user_perms: | ||||
#set write if owner | ||||
if perm.Repository.user_id == user.user_id: | ||||
p = 'repository.write' | ||||
else: | ||||
p = perm.Permission.permission_name | ||||
r367 | user.permissions['repositories'][perm.Repo2Perm.repository.repo_name] = p | |||
r350 | meta.Session.remove() | |||
r316 | return user | |||
r299 | def get_user(session): | |||
""" | ||||
Gets user from session, and wraps permissions into user | ||||
@param session: | ||||
""" | ||||
user = session.get('hg_app_user', AuthUser()) | ||||
if user.is_authenticated: | ||||
r371 | user = fill_data(user) | |||
r316 | user = fill_perms(user) | |||
session['hg_app_user'] = user | ||||
session.save() | ||||
r299 | return user | |||
r239 | ||||
r190 | #=============================================================================== | |||
r316 | # CHECK DECORATORS | |||
r190 | #=============================================================================== | |||
class LoginRequired(object): | ||||
""" | ||||
Must be logged in to execute this function else redirect to login page | ||||
""" | ||||
r316 | ||||
r190 | def __call__(self, func): | |||
@wraps(func) | ||||
def _wrapper(*fargs, **fkwargs): | ||||
r199 | user = session.get('hg_app_user', AuthUser()) | |||
r316 | log.debug('Checking login required for user:%s', user.username) | |||
r190 | if user.is_authenticated: | |||
r316 | log.debug('user %s is authenticated', user.username) | |||
func(*fargs) | ||||
r190 | else: | |||
r316 | log.warn('user %s not authenticated', user.username) | |||
log.debug('redirecting to login page') | ||||
r190 | return redirect(url('login_home')) | |||
r52 | ||||
r190 | return _wrapper | |||
r239 | ||||
class PermsDecorator(object): | ||||
r316 | """ | |||
Base class for decorators | ||||
""" | ||||
r239 | ||||
r316 | def __init__(self, *required_perms): | |||
available_perms = config['available_permissions'] | ||||
for perm in required_perms: | ||||
r239 | if perm not in available_perms: | |||
r316 | raise Exception("'%s' permission is not defined" % perm) | |||
self.required_perms = set(required_perms) | ||||
self.user_perms = None | ||||
r239 | ||||
r316 | def __call__(self, func): | |||
r239 | @wraps(func) | |||
r316 | def _wrapper(*fargs, **fkwargs): | |||
self.user_perms = session.get('hg_app_user', AuthUser()).permissions | ||||
log.debug('checking %s permissions %s for %s', | ||||
self.__class__.__name__, self.required_perms, func.__name__) | ||||
r239 | ||||
if self.check_permissions(): | ||||
r316 | log.debug('Permission granted for %s', func.__name__) | |||
return func(*fargs) | ||||
r239 | ||||
else: | ||||
r316 | log.warning('Permission denied for %s', func.__name__) | |||
r239 | #redirect with forbidden ret code | |||
r316 | return abort(403) | |||
r239 | return _wrapper | |||
def check_permissions(self): | ||||
""" | ||||
r316 | Dummy function for overriding | |||
r239 | """ | |||
raise Exception('You have to write this function in child class') | ||||
r316 | class HasPermissionAllDecorator(PermsDecorator): | |||
r239 | """ | |||
Checks for access permission for all given predicates. All of them have to | ||||
be meet in order to fulfill the request | ||||
""" | ||||
def check_permissions(self): | ||||
r339 | if self.required_perms.issubset(self.user_perms.get('global')): | |||
r239 | return True | |||
return False | ||||
r316 | class HasPermissionAnyDecorator(PermsDecorator): | |||
r239 | """ | |||
Checks for access permission for any of given predicates. In order to | ||||
fulfill the request any of predicates must be meet | ||||
""" | ||||
def check_permissions(self): | ||||
r339 | if self.required_perms.intersection(self.user_perms.get('global')): | |||
r316 | return True | |||
return False | ||||
class HasRepoPermissionAllDecorator(PermsDecorator): | ||||
""" | ||||
Checks for access permission for all given predicates for specific | ||||
repository. All of them have to be meet in order to fulfill the request | ||||
""" | ||||
def check_permissions(self): | ||||
repo_name = get_repo_slug(request) | ||||
r339 | try: | |||
user_perms = set([self.user_perms['repositories'][repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
r316 | if self.required_perms.issubset(user_perms): | |||
return True | ||||
return False | ||||
class HasRepoPermissionAnyDecorator(PermsDecorator): | ||||
""" | ||||
Checks for access permission for any of given predicates for specific | ||||
repository. In order to fulfill the request any of predicates must be meet | ||||
""" | ||||
def check_permissions(self): | ||||
repo_name = get_repo_slug(request) | ||||
r339 | try: | |||
user_perms = set([self.user_perms['repositories'][repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
r316 | if self.required_perms.intersection(user_perms): | |||
return True | ||||
return False | ||||
#=============================================================================== | ||||
# CHECK FUNCTIONS | ||||
#=============================================================================== | ||||
class PermsFunction(object): | ||||
""" | ||||
Base function for other check functions | ||||
""" | ||||
def __init__(self, *perms): | ||||
available_perms = config['available_permissions'] | ||||
for perm in perms: | ||||
if perm not in available_perms: | ||||
raise Exception("'%s' permission in not defined" % perm) | ||||
self.required_perms = set(perms) | ||||
self.user_perms = None | ||||
self.granted_for = '' | ||||
self.repo_name = None | ||||
def __call__(self, check_Location=''): | ||||
r333 | user = session.get('hg_app_user', False) | |||
if not user: | ||||
return False | ||||
r316 | self.user_perms = user.permissions | |||
self.granted_for = user.username | ||||
log.debug('checking %s %s', self.__class__.__name__, self.required_perms) | ||||
if self.check_permissions(): | ||||
log.debug('Permission granted for %s @%s', self.granted_for, | ||||
check_Location) | ||||
return True | ||||
else: | ||||
log.warning('Permission denied for %s @%s', self.granted_for, | ||||
check_Location) | ||||
return False | ||||
def check_permissions(self): | ||||
""" | ||||
Dummy function for overriding | ||||
""" | ||||
raise Exception('You have to write this function in child class') | ||||
class HasPermissionAll(PermsFunction): | ||||
def check_permissions(self): | ||||
r339 | if self.required_perms.issubset(self.user_perms.get('global')): | |||
r316 | return True | |||
return False | ||||
class HasPermissionAny(PermsFunction): | ||||
def check_permissions(self): | ||||
r339 | if self.required_perms.intersection(self.user_perms.get('global')): | |||
r316 | return True | |||
return False | ||||
class HasRepoPermissionAll(PermsFunction): | ||||
def __call__(self, repo_name=None, check_Location=''): | ||||
self.repo_name = repo_name | ||||
return super(HasRepoPermissionAll, self).__call__(check_Location) | ||||
def check_permissions(self): | ||||
if not self.repo_name: | ||||
self.repo_name = get_repo_slug(request) | ||||
r339 | try: | |||
self.user_perms = set([self.user_perms['repositories']\ | ||||
[self.repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
r316 | self.granted_for = self.repo_name | |||
if self.required_perms.issubset(self.user_perms): | ||||
return True | ||||
return False | ||||
class HasRepoPermissionAny(PermsFunction): | ||||
def __call__(self, repo_name=None, check_Location=''): | ||||
self.repo_name = repo_name | ||||
return super(HasRepoPermissionAny, self).__call__(check_Location) | ||||
def check_permissions(self): | ||||
if not self.repo_name: | ||||
self.repo_name = get_repo_slug(request) | ||||
r339 | try: | |||
self.user_perms = set([self.user_perms['repositories']\ | ||||
[self.repo_name]]) | ||||
except KeyError: | ||||
return False | ||||
r316 | self.granted_for = self.repo_name | |||
r239 | if self.required_perms.intersection(self.user_perms): | |||
return True | ||||
return False | ||||
r316 | #=============================================================================== | |||
# SPECIAL VERSION TO HANDLE MIDDLEWARE AUTH | ||||
#=============================================================================== | ||||
r239 | ||||
r316 | class HasPermissionAnyMiddleware(object): | |||
def __init__(self, *perms): | ||||
self.required_perms = set(perms) | ||||
def __call__(self, user, repo_name): | ||||
usr = AuthUser() | ||||
usr.user_id = user.user_id | ||||
usr.username = user.username | ||||
usr.is_admin = user.admin | ||||
try: | ||||
self.user_perms = set([fill_perms(usr)\ | ||||
.permissions['repositories'][repo_name]]) | ||||
except: | ||||
self.user_perms = set() | ||||
self.granted_for = '' | ||||
self.username = user.username | ||||
self.repo_name = repo_name | ||||
return self.check_permissions() | ||||
def check_permissions(self): | ||||
log.debug('checking mercurial protocol ' | ||||
'permissions for user:%s repository:%s', | ||||
self.username, self.repo_name) | ||||
if self.required_perms.intersection(self.user_perms): | ||||
log.debug('permission granted') | ||||
return True | ||||
log.debug('permission denied') | ||||
return False | ||||