user.py
488 lines
| 16.9 KiB
| text/x-python
|
PythonLexer
r761 | # -*- coding: utf-8 -*- | |||
r1206 | # This program is free software: you can redistribute it and/or modify | |||
# it under the terms of the GNU General Public License as published by | ||||
# the Free Software Foundation, either version 3 of the License, or | ||||
# (at your option) any later version. | ||||
r1203 | # | |||
r629 | # This program is distributed in the hope that it will be useful, | |||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
# GNU General Public License for more details. | ||||
r1203 | # | |||
r629 | # You should have received a copy of the GNU General Public License | |||
r1206 | # along with this program. If not, see <http://www.gnu.org/licenses/>. | |||
|
r4116 | """ | ||
rhodecode.model.user | ||||
~~~~~~~~~~~~~~~~~~~~ | ||||
users model for RhodeCode | ||||
:created_on: Apr 9, 2010 | ||||
:author: marcink | ||||
:copyright: (c) 2013 RhodeCode GmbH. | ||||
:license: GPLv3, see LICENSE for more details. | ||||
""" | ||||
r750 | ||||
r629 | import logging | |||
import traceback | ||||
r1731 | from pylons import url | |||
r761 | from pylons.i18n.translation import _ | |||
r2479 | from sqlalchemy.exc import DatabaseError | |||
|
r4116 | |||
r2479 | ||||
|
r4017 | from rhodecode.lib.utils2 import safe_unicode, generate_api_key, get_current_rhodecode_user | ||
r1669 | from rhodecode.lib.caching_query import FromCache | |||
r761 | from rhodecode.model import BaseModel | |||
|
r4116 | from rhodecode.model.db import User, UserToPerm, Notification, \ | ||
UserEmailMap, UserIpMap | ||||
r1269 | from rhodecode.lib.exceptions import DefaultUserException, \ | |||
UserOwnsReposException | ||||
r3401 | from rhodecode.model.meta import Session | |||
r713 | ||||
r761 | ||||
log = logging.getLogger(__name__) | ||||
r629 | ||||
r1267 | ||||
r752 | class UserModel(BaseModel): | |||
r2522 | cls = User | |||
r1716 | ||||
r1594 | def get(self, user_id, cache=False): | |||
r629 | user = self.sa.query(User) | |||
if cache: | ||||
user = user.options(FromCache("sql_cache_short", | ||||
"get_user_%s" % user_id)) | ||||
return user.get(user_id) | ||||
r2009 | def get_user(self, user): | |||
r2432 | return self._get_user(user) | |||
r2009 | ||||
r1594 | def get_by_username(self, username, cache=False, case_insensitive=False): | |||
r750 | ||||
r742 | if case_insensitive: | |||
user = self.sa.query(User).filter(User.username.ilike(username)) | ||||
else: | ||||
|
r4116 | user = self.sa.query(User)\ | ||
.filter(User.username == username) | ||||
r629 | if cache: | |||
user = user.options(FromCache("sql_cache_short", | ||||
"get_user_%s" % username)) | ||||
return user.scalar() | ||||
r2522 | def get_by_email(self, email, cache=False, case_insensitive=False): | |||
return User.get_by_email(email, case_insensitive, cache) | ||||
r1594 | def get_by_api_key(self, api_key, cache=False): | |||
r1693 | return User.get_by_api_key(api_key, cache) | |||
r1117 | ||||
|
r4017 | def create(self, form_data, cur_user=None): | ||
if not cur_user: | ||||
r4018 | cur_user = getattr(get_current_rhodecode_user(), 'username', None) | |||
r4074 | ||||
from rhodecode.lib.hooks import log_create_user, check_allowed_create_user | ||||
_fd = form_data | ||||
r4075 | user_data = { | |||
r4074 | 'username': _fd['username'], 'password': _fd['password'], | |||
'email': _fd['email'], 'firstname': _fd['firstname'], 'lastname': _fd['lastname'], | ||||
'active': _fd['active'], 'admin': False | ||||
} | ||||
# raises UserCreationError if it's not allowed | ||||
r4075 | check_allowed_create_user(user_data, cur_user) | |||
r2467 | from rhodecode.lib.auth import get_crypt_password | |||
r629 | try: | |||
new_user = User() | ||||
for k, v in form_data.items(): | ||||
r2467 | if k == 'password': | |||
v = get_crypt_password(v) | ||||
r2544 | if k == 'firstname': | |||
k = 'name' | ||||
r629 | setattr(new_user, k, v) | |||
r1116 | new_user.api_key = generate_api_key(form_data['username']) | |||
r629 | self.sa.add(new_user) | |||
|
r4016 | |||
|
r4017 | log_create_user(new_user.get_dict(), cur_user) | ||
|
r1586 | return new_user | ||
r3631 | except Exception: | |||
r629 | log.error(traceback.format_exc()) | |||
raise | ||||
r2513 | def create_or_update(self, username, password, email, firstname='', | |||
|
r4116 | lastname='', active=True, admin=False, | ||
extern_type=None, extern_name=None, cur_user=None): | ||||
r1634 | """ | |||
Creates a new instance if not found, or updates current one | ||||
r1818 | ||||
r1634 | :param username: | |||
:param password: | ||||
:param email: | ||||
:param active: | ||||
r2513 | :param firstname: | |||
r1634 | :param lastname: | |||
:param active: | ||||
:param admin: | ||||
|
r4116 | :param extern_name: | ||
:param extern_type: | ||||
r4019 | :param cur_user: | |||
r1634 | """ | |||
|
r4017 | if not cur_user: | ||
r4018 | cur_user = getattr(get_current_rhodecode_user(), 'username', None) | |||
r1728 | ||||
|
r4116 | from rhodecode.lib.auth import get_crypt_password, check_password | ||
r4074 | from rhodecode.lib.hooks import log_create_user, check_allowed_create_user | |||
r4075 | user_data = { | |||
r4074 | 'username': username, 'password': password, | |||
'email': email, 'firstname': firstname, 'lastname': lastname, | ||||
'active': active, 'admin': admin | ||||
} | ||||
# raises UserCreationError if it's not allowed | ||||
r4075 | check_allowed_create_user(user_data, cur_user) | |||
r1728 | ||||
r1976 | log.debug('Checking for %s account in RhodeCode database' % username) | |||
r1634 | user = User.get_by_username(username, case_insensitive=True) | |||
if user is None: | ||||
r1976 | log.debug('creating new user %s' % username) | |||
r1634 | new_user = User() | |||
r2513 | edit = False | |||
r1634 | else: | |||
r1976 | log.debug('updating user %s' % username) | |||
r1634 | new_user = user | |||
r2513 | edit = True | |||
r1728 | ||||
r1634 | try: | |||
new_user.username = username | ||||
new_user.admin = admin | ||||
new_user.email = email | ||||
new_user.active = active | ||||
|
r4116 | new_user.extern_name = safe_unicode(extern_name) if extern_name else None | ||
new_user.extern_type = safe_unicode(extern_type) if extern_type else None | ||||
r2513 | new_user.name = firstname | |||
r1634 | new_user.lastname = lastname | |||
|
r4116 | |||
if not edit: | ||||
new_user.api_key = generate_api_key(username) | ||||
# set password only if creating an user or password is changed | ||||
password_change = new_user.password and not check_password(password, | ||||
new_user.password) | ||||
if not edit or password_change: | ||||
reason = 'new password' if edit else 'new user' | ||||
log.debug('Updating password reason=>%s' % (reason,)) | ||||
new_user.password = get_crypt_password(password) if password else None | ||||
r1634 | self.sa.add(new_user) | |||
|
r4016 | |||
if not edit: | ||||
|
r4017 | log_create_user(new_user.get_dict(), cur_user) | ||
r1634 | return new_user | |||
except (DatabaseError,): | ||||
log.error(traceback.format_exc()) | ||||
raise | ||||
r1728 | ||||
r629 | def create_registration(self, form_data): | |||
r1731 | from rhodecode.model.notification import NotificationModel | |||
r629 | try: | |||
r2248 | form_data['admin'] = False | |||
|
r4116 | form_data['extern_name'] = 'rhodecode' | ||
form_data['extern_type'] = 'rhodecode' | ||||
r2248 | new_user = self.create(form_data) | |||
r629 | ||||
self.sa.add(new_user) | ||||
r1731 | self.sa.flush() | |||
# notification to admins | ||||
|
r3654 | subject = _('New user registration') | ||
r689 | body = ('New user registration\n' | |||
r1731 | '---------------------\n' | |||
'- Username: %s\n' | ||||
'- Full Name: %s\n' | ||||
'- Email: %s\n') | ||||
r4019 | body = body % (new_user.username, new_user.full_name, new_user.email) | |||
r1731 | edit_url = url('edit_user', id=new_user.user_id, qualified=True) | |||
r1950 | kw = {'registered_user_url': edit_url} | |||
r1731 | NotificationModel().create(created_by=new_user, subject=subject, | |||
body=body, recipients=None, | ||||
type_=Notification.TYPE_REGISTRATION, | ||||
email_kwargs=kw) | ||||
r689 | ||||
r3631 | except Exception: | |||
r629 | log.error(traceback.format_exc()) | |||
raise | ||||
r3021 | def update(self, user_id, form_data, skip_attrs=[]): | |||
r2488 | from rhodecode.lib.auth import get_crypt_password | |||
r629 | try: | |||
r1594 | user = self.get(user_id, cache=False) | |||
|
r4116 | if user.username == User.DEFAULT_USER: | ||
r629 | raise DefaultUserException( | |||
|
r4116 | _("You can't Edit this user since it's " | ||
"crucial for entire application")) | ||||
r713 | ||||
r629 | for k, v in form_data.items(): | |||
r3021 | if k in skip_attrs: | |||
continue | ||||
r2544 | if k == 'new_password' and v: | |||
r2488 | user.password = get_crypt_password(v) | |||
r629 | else: | |||
|
r4116 | # old legacy thing orm models store firstname as name, | ||
# need proper refactor to username | ||||
r2544 | if k == 'firstname': | |||
k = 'name' | ||||
r1116 | setattr(user, k, v) | |||
self.sa.add(user) | ||||
r3631 | except Exception: | |||
r629 | log.error(traceback.format_exc()) | |||
raise | ||||
r2657 | def update_user(self, user, **kwargs): | |||
from rhodecode.lib.auth import get_crypt_password | ||||
try: | ||||
user = self._get_user(user) | ||||
|
r4116 | if user.username == User.DEFAULT_USER: | ||
r2657 | raise DefaultUserException( | |||
_("You can't Edit this user since it's" | ||||
" crucial for entire application") | ||||
) | ||||
for k, v in kwargs.items(): | ||||
if k == 'password' and v: | ||||
v = get_crypt_password(v) | ||||
setattr(user, k, v) | ||||
self.sa.add(user) | ||||
return user | ||||
r3631 | except Exception: | |||
r2657 | log.error(traceback.format_exc()) | |||
raise | ||||
|
r4017 | def delete(self, user, cur_user=None): | ||
if not cur_user: | ||||
r4018 | cur_user = getattr(get_current_rhodecode_user(), 'username', None) | |||
r2432 | user = self._get_user(user) | |||
r1818 | ||||
r629 | try: | |||
|
r4116 | if user.username == User.DEFAULT_USER: | ||
r629 | raise DefaultUserException( | |||
r2153 | _(u"You can't remove this user since it's" | |||
r2124 | " crucial for entire application") | |||
) | ||||
r713 | if user.repositories: | |||
r2153 | repos = [x.repo_name for x in user.repositories] | |||
r2124 | raise UserOwnsReposException( | |||
r2153 | _(u'user "%s" still owns %s repositories and cannot be ' | |||
'removed. Switch owners or remove those repositories. %s') | ||||
% (user.username, len(repos), ', '.join(repos)) | ||||
r2124 | ) | |||
r629 | self.sa.delete(user) | |||
|
r4016 | |||
from rhodecode.lib.hooks import log_delete_user | ||||
|
r4017 | log_delete_user(user.get_dict(), cur_user) | ||
r3631 | except Exception: | |||
r629 | log.error(traceback.format_exc()) | |||
raise | ||||
r1417 | def reset_password_link(self, data): | |||
from rhodecode.lib.celerylib import tasks, run_task | ||||
r3401 | from rhodecode.model.notification import EmailNotificationModel | |||
user_email = data['email'] | ||||
try: | ||||
user = User.get_by_email(user_email) | ||||
if user: | ||||
log.debug('password reset user found %s' % user) | ||||
link = url('reset_password_confirmation', key=user.api_key, | ||||
qualified=True) | ||||
reg_type = EmailNotificationModel.TYPE_PASSWORD_RESET | ||||
body = EmailNotificationModel().get_email_tmpl(reg_type, | ||||
**{'user': user.short_contact, | ||||
'reset_url': link}) | ||||
log.debug('sending email') | ||||
run_task(tasks.send_email, user_email, | ||||
|
r3654 | _("Password reset link"), body, body) | ||
r3401 | log.info('send new password mail to %s' % user_email) | |||
else: | ||||
log.debug("password reset email %s not found" % user_email) | ||||
r3631 | except Exception: | |||
r3401 | log.error(traceback.format_exc()) | |||
return False | ||||
return True | ||||
r1417 | ||||
r629 | def reset_password(self, data): | |||
from rhodecode.lib.celerylib import tasks, run_task | ||||
r3401 | from rhodecode.lib import auth | |||
user_email = data['email'] | ||||
r4075 | pre_db = True | |||
r3401 | try: | |||
r4075 | user = User.get_by_email(user_email) | |||
new_passwd = auth.PasswordGenerator().gen_password(8, | ||||
auth.PasswordGenerator.ALPHABETS_BIG_SMALL) | ||||
if user: | ||||
user.password = auth.get_crypt_password(new_passwd) | ||||
Session().add(user) | ||||
Session().commit() | ||||
log.info('change password for %s' % user_email) | ||||
if new_passwd is None: | ||||
raise Exception('unable to generate new password') | ||||
r3401 | ||||
r4075 | pre_db = False | |||
r3401 | run_task(tasks.send_email, user_email, | |||
_('Your new password'), | ||||
r4019 | _('Your new RhodeCode password:%s') % (new_passwd,)) | |||
r3401 | log.info('send new password mail to %s' % user_email) | |||
r3631 | except Exception: | |||
r3401 | log.error('Failed to update user password') | |||
log.error(traceback.format_exc()) | ||||
r4075 | if pre_db: | |||
# we rollback only if local db stuff fails. If it goes into | ||||
# run_task, we're pass rollback state this wouldn't work then | ||||
Session().rollback() | ||||
r3401 | ||||
return True | ||||
r673 | ||||
|
r4116 | def fill_data(self, auth_user, user_id=None, api_key=None, username=None): | ||
r673 | """ | |||
r1117 | Fetches auth_user by user_id,or api_key if present. | |||
Fills auth_user attributes with those taken from database. | ||||
r1203 | Additionally set's is_authenitated if lookup fails | |||
r673 | present in database | |||
r1203 | ||||
r1117 | :param auth_user: instance of user to set attributes | |||
:param user_id: user id to fetch by | ||||
:param api_key: api key to fetch by | ||||
|
r4116 | :param username: username to fetch by | ||
r673 | """ | |||
|
r4116 | if user_id is None and api_key is None and username is None: | ||
raise Exception('You need to pass user_id, api_key or username') | ||||
r686 | ||||
r1117 | try: | |||
|
r4116 | dbuser = None | ||
if user_id: | ||||
dbuser = self.get(user_id) | ||||
elif api_key: | ||||
r1117 | dbuser = self.get_by_api_key(api_key) | |||
|
r4116 | elif username: | ||
dbuser = self.get_by_username(username) | ||||
r1117 | ||||
|
r1618 | if dbuser is not None and dbuser.active: | ||
r1976 | log.debug('filling %s data' % dbuser) | |||
|
r4116 | for k, v in dbuser.get_dict().iteritems(): | ||
if k not in ['api_keys', 'permissions']: | ||||
setattr(auth_user, k, v) | ||||
|
r1618 | else: | ||
return False | ||||
r1117 | ||||
r3631 | except Exception: | |||
r1117 | log.error(traceback.format_exc()) | |||
auth_user.is_authenticated = False | ||||
|
r1618 | return False | ||
r1117 | ||||
|
r1618 | return True | ||
r686 | ||||
r1749 | def has_perm(self, user, perm): | |||
r2709 | perm = self._get_perm(perm) | |||
r2432 | user = self._get_user(user) | |||
r1749 | ||||
r1758 | return UserToPerm.query().filter(UserToPerm.user == user)\ | |||
r1749 | .filter(UserToPerm.permission == perm).scalar() is not None | |||
def grant_perm(self, user, perm): | ||||
r1982 | """ | |||
Grant user global permissions | ||||
r1749 | ||||
r1982 | :param user: | |||
:param perm: | ||||
""" | ||||
r2432 | user = self._get_user(user) | |||
perm = self._get_perm(perm) | ||||
r2078 | # if this permission is already granted skip it | |||
_perm = UserToPerm.query()\ | ||||
.filter(UserToPerm.user == user)\ | ||||
.filter(UserToPerm.permission == perm)\ | ||||
.scalar() | ||||
if _perm: | ||||
return | ||||
r1749 | new = UserToPerm() | |||
r1758 | new.user = user | |||
r1749 | new.permission = perm | |||
self.sa.add(new) | ||||
|
r4116 | return new | ||
r1749 | ||||
def revoke_perm(self, user, perm): | ||||
r1982 | """ | |||
Revoke users global permissions | ||||
r1818 | ||||
r1982 | :param user: | |||
:param perm: | ||||
""" | ||||
r2432 | user = self._get_user(user) | |||
perm = self._get_perm(perm) | ||||
r1818 | ||||
r2078 | obj = UserToPerm.query()\ | |||
.filter(UserToPerm.user == user)\ | ||||
.filter(UserToPerm.permission == perm)\ | ||||
.scalar() | ||||
r1758 | if obj: | |||
self.sa.delete(obj) | ||||
r2330 | ||||
def add_extra_email(self, user, email): | ||||
""" | ||||
Adds email address to UserEmailMap | ||||
:param user: | ||||
:param email: | ||||
""" | ||||
r2479 | from rhodecode.model import forms | |||
form = forms.UserExtraEmailForm()() | ||||
data = form.to_python(dict(email=email)) | ||||
r2432 | user = self._get_user(user) | |||
r2479 | ||||
r2330 | obj = UserEmailMap() | |||
obj.user = user | ||||
r2479 | obj.email = data['email'] | |||
r2330 | self.sa.add(obj) | |||
return obj | ||||
def delete_extra_email(self, user, email_id): | ||||
""" | ||||
Removes email address from UserEmailMap | ||||
:param user: | ||||
:param email_id: | ||||
""" | ||||
r2432 | user = self._get_user(user) | |||
r2330 | obj = UserEmailMap.query().get(email_id) | |||
if obj: | ||||
r2478 | self.sa.delete(obj) | |||
r3125 | ||||
def add_extra_ip(self, user, ip): | ||||
""" | ||||
Adds ip address to UserIpMap | ||||
:param user: | ||||
:param ip: | ||||
""" | ||||
from rhodecode.model import forms | ||||
form = forms.UserExtraIpForm()() | ||||
data = form.to_python(dict(ip=ip)) | ||||
user = self._get_user(user) | ||||
obj = UserIpMap() | ||||
obj.user = user | ||||
obj.ip_addr = data['ip'] | ||||
self.sa.add(obj) | ||||
return obj | ||||
def delete_extra_ip(self, user, ip_id): | ||||
""" | ||||
Removes ip address from UserIpMap | ||||
:param user: | ||||
:param ip_id: | ||||
""" | ||||
user = self._get_user(user) | ||||
obj = UserIpMap.query().get(ip_id) | ||||
if obj: | ||||
self.sa.delete(obj) | ||||