25 Commits (b0b646db5b91d42c9f043340b1b41614cd4edac9)

Author	SHA1	Message	Date
Rene Krenn	de0595c089	MT#59447 admin user LDAP authentication #1 ... Change-Id: Ic31236d933f022b567c74998959267ef9a549b7e	5 months ago
Kirill Solomko	d9f283cbc8	MT#59449 enhance password validation and handling ... * passwords are now validated based on - minlen - maxlen - min lower case chars - min uppper case chars - min digits - min special chars * Data::Password::zxcvbn is used to calculate password score and reject passwords with score < 3 as weak (this library is ported from the Dropbox password validation) * Add password journals and check last used passwords in the journals * Improve password generator javascript function to generate a password with at least 4 of each of the char group types. * Currently affected are subcriber and admin entry creation or modification via UI/API * NGCP::Utils::Auth add optional bcrypt_cost support as last argument for generate_salted_hash and get_usr_salted_pass Change-Id: I100c25107d91741d5101bc58d29a3fa558b0b017	9 months ago
Kirill Solomko	205b27a267	MT#59478 API better transaction and error handling ... * Role/Entities*: POST/PUT/PATCH/DELETE methods changes: - support deadlock detection and transaction retry (2 retry attempts at the moment) - improve transaction control, use local $guard instead of saving the ref to $c->stash, as in that case it went out of scope too late and also reported an error message into the log about abnormal $guard out of scope interruption - move all non transaction related code outside of the scope - add error handling when methods such as update_item, and a like do not return the expected data, instead of simply going out of scope and resulting in an uncontrolled reply * Role/API: - rework transaction control: + get_transaction_control() is renamed to start_transaction() to better reflect what it does + complete_transaction() is renamed to commit_transaction() + remove unused %params arg + pass $guard into commit_transaction() instead of having it stored as $c->stash->{transaction_guard) that caused the $guard ref to be destroyed much late than expected (there was also a typo as transaction_quard, which is not relevant anymore with the changes + add check_deadlock() that is invoked when an exception is caught or an $c->errors contain an error, and if the error message represents a transaction error, the transaction block is re-invoked via "goto TX_START" - rework error(): + it now accepts args as following: ($self, $c, $code, $message, @errors) # code -> returned as HTTP code in the reply # message -> returned as HTTP message in the reply # errors -> contain errors for internal logging, last element often contains a DBIx exception + populates all @errors into $c->error so they are available on demend in the code via $c->error or $c->last_error + $c->log->error is not invoked now as the errors become printed in log_response() - log_response() now prints collected errors from $c->error correctly as a separate log line, that is alike to the other api logs so that those can be looked up by the request's tx_id, also all errors are now printed only into api.log * Adjust all $self->error() calls in catch($e) to include $e as the last argument, as well as the duplicate $c->log->error is removed from those ocassions * Remove all $c->log->error() calls as they are replaced with either $self->error() (that logs it correctly into api.log) or $c->error('err') that also adds it correctly into api.log * API::CallForwards: rework to use Entities/EntitiesItem * API::Contracts: rework POST to use Entities * API::PeeringGroups: rework POST to use Entities * API::SubscriberRegistrations: rework POST to use Entities * API::RewriteRuleSets: improve create_item() functionality * Utils/Message: add 'api_retry' log type * $c->session->{api_request_tx_id} is changed to $c->stash->{api_request_tx_id} because sometimes the session ref is different and a different tx_id becomes used Change-Id: I633ce7a8047b1bf00a2f6889003088edf0825dcd	1 year ago
Rene Krenn	308a974059	MT#58762 harmonize restapi wildcard filters ... - all standard LIKE search are migrated - will avoid LIKE unless a pattern (* wildcard) is used as a search term. this encourage db index usage, will be faster - supports wildcard escape sequence \\* - harmonize swagger UI descriptions of filters Change-Id: Iea155871c9be6c284e6970a562d4e6af73fedc4b	1 year ago
Kirill Solomko	f4154b1dbc	TT#154500 tighten /api/admins roles ... * An attempt to change own role, login, flags (except for can_reset_password) now returns 403 Forbidden, User cannot modify own permissions * POST checks if the admin has necessarry permissions to create another admin * PUT/PATCH changing own role is now forbidden * PUT/PATCH changing other's admin role now checks permissions * DELETE checks role permissions Change-Id: I990609985ae9cab6213cf47f5f5c8afba2efdda3	3 years ago
Kirill Solomko	e95ed81ca7	TT#154500 improve admin users behaviour ... * admin users with is_master = 0, cannot see other admin users (this includes system users) and brings the is_master flag to the common behaviour * ccareadmin, ccare users can now access te UI Admins page as well as /api/admins but they are limited to see/manage only themselves * admin users cannot see system users (UI/API) * reseller users cannot see system/admin users (UI/API) * admin users cannot modify their own role and flags except for: email, password, can_reset_password (UI/API) * UI edit form now does not render fields that are not meant to be modified by a user (exception: "login") Change-Id: I82e1946437fd2ec4651abd24074470c695a40582	3 years ago
Oleksandr Duts	9855b6ab45	TT#149461 Enhance /api/admins to accept the role data property ... - Optional "role" parameter is added for POST PUT PATCH. If "role" is provided then the passed flags are ignored and are applied internally by the server according to the provided role. If "role" is not provided then the former flags based approach is applied. Change-Id: Ib6e591ff6dc50122e0ec49a348153ca820fc2e03	3 years ago
Oleksandr Duts	e58cb2cc39	TT#149456 Admins introduce role_id flag ... - role_id is taken from billing.acl_roles and written into the billing.admins table when a new admin user is created/updated via UI/API. This is the first step towards the role based admin user handling. Change-Id: I0804379cbbcab174cebbb292397a39cb3ea01a31	3 years ago
Kirill Solomko	7862a87639	TT#76111 add lintercept role ... * new c.users.role 'lintercept', that set to when an admin user has enabled 'lawful_intercept' flag * only Administrator page /api/admins and /api/interceptions are available for the role * 'lintercept' role can only see own user and only change password and email Change-Id: Iadcb022a124afbd77b224e734026f380af0170e8	5 years ago
Andreas Granig	8f8e1d5fc9	TT#78557 - Use bcrypt to hash webpassword ... * Change the way webpassword is handled accross NGCP Panel UI/API to comply with new password encryption * At login, if password is not encrypted with high cost due to the ngcp-bcrypt-webpassword script, encrypt it with proper cost * Accept old password format as well until all webpasswords are encrypted Change-Id: Iefa9584a62ab4b7d2a224d10bdd415e9cbb8dfb5	5 years ago
Irina Peshinskaya	1d9907ad45	TT#35429 Allow both 0/1 an true/false as boolean input in /api/admins ... Change-Id: I4c9805ebce17586674f52a9fe97f280fb9991612	7 years ago
Irina Peshinskaya	75d6edbcd9	TT#28460 Format: add line between subs in API controllers ... Change-Id: I67f11fef716941dc965dffd4e8fbb1a211791bbf	7 years ago
Irina Peshinskaya	84c1bacc40	TT#28462 Rewrite admins API to Entities ... Change-Id: I3bf47038bfb48c09f95030eed5d83550e392ff0c	7 years ago
Gerhard Jungwirth	24de4232e6	TT#30507 remove DataHal workaround layer ... (NGCP::Panel was loaded every time this was used) Change-Id: I62861e0756aaaf548c9be42b4842e9a06127119c	7 years ago
Andreas Granig	0d3bf6b1ce	TT#22827 Implement form factory ... This patch reuses existing forms by clearing them, rather than re-instantiating them again and again. Also, panel start time should be better due to less package pre-loading. Change-Id: Ia3e64fd4b4084bb5ec35a669c5840c9fc3c58f2e	8 years ago
Andreas Granig	a52558b411	TT#22422 Implement capabilities endpoint ... Used to fetch whether pbx, faxserver, rtcengine etc is enabled. * Fix rtcengine reseller creation: - Refuse to create reseller if rtcengine part fails - Use proper auto-generated rtcengine values (pass, domain) to not fail on reseller names which are not forming valid hostnames. * Implement /api/admins/id to support testing - add test - fix creating admins with overly long login - fix various ACL bugs handling /api/admins/ - fix creating /api/admincerts/ as r/o user * Fix test framework - use proper client cert when switching API user Change-Id: I602fdd8181c0b3f23e76e3eab0df90a1ff9e986f (cherry picked from commit 0d376bd8b59db65296090d26f2c84d704129beef)	8 years ago
Rene Krenn	72d9c10650	TT#13973 fix http method override ... the factory Catalyst::ActionRole::HTTPMethods action role is set for any action, and in race with our own NGCP::Panel::Role::HTTPMethods. the testcase could have been misleading ever since, as it uses DELETE /api/customers, which was present when implemting the method override initially, but dropped on the road to 4.5. the issue is resolved by overriding Catalyst::Controller::gather_default_action_roles. until the class hierachy refactoring is completed, only consistent way is to add the override to each api controller. the action_roles config attribute can therefore be removed. using Plack::Middleware::MethodOverride as an alternative from upstream has the drawback to work only with POST. but a required usecase is to also support translation DELETE requests to PATCH. Change-Id: I204ba59869a8327bdd5db8a867fbbb061d1c9e7c	8 years ago
Andreas Granig	8ad683d5ae	TT#12601 Move admin pass to bcrypt and drop cert ... For the migration of the admin pwd, the logic is as follows: 1. If the admin has a bcrypt password already, use this 2. If not, perform auth via md5, then clear the md5 column and write a salted bcrypt hash instead. For dropping the ssl client cert, we simply not store anymore the client certificate in the DB. As a result, you cannot download the certs (pem, p12) after creation anymore, so we immediately download the two certs in a zip file after creation. A cost of 13 takes 500ms on an i7-5500U CPU @ 2.40GHz, which seems to be a reasonable value. Change-Id: I1ce21321c58d8c57d7ddce1541995f64821b0053	8 years ago
Irina Peshinskaya	2073b9e760	TT#9309 Introduce local version of the Data::HAL::Link ... Change-Id: Ifdf95cef32f0d118330c20316ed447e00c6dae3c	8 years ago
Irina Peshinskaya	41f32401a7	TT#9309 Introduce local version of the Data::HAL with default forcearray ... Change-Id: Ie33396a75fc6d27fd28fe8f7717caba0a476c776	8 years ago
Gerhard Jungwirth	b34a7df2e1	MT#21193 use Sipwise::Base in api modules ... which implies, among others, strict and warnings. these should never be omitted and are one of the most frequent complaints of perlcritic currently. as a result TryCatch can be removed (imported by Sipwise::Base). also, "no Moose" is removed (has no effect). Change-Id: I901b6a9f0f6d426f62b73e68f2c5ad6365c1eeef	9 years ago
Rene Krenn	3e57109750	MT#19419 custom action role to support http method override ... Change-Id: I2d9fbf1f4feca76b91bdf73d4184ea707cc04e78	9 years ago
Guillem Jover	0632585eba	MT#18443 Use parent instead of base module ... Switch from the discouraged base module to the light-weight parent module. Also remove some surrounding BEGIN blocks from 'use parent' which are completely unnecessary. Change-Id: I3a669e8024f098819be45030ca9d1afa8756105c	9 years ago
Irina Peshinskaya	0272c297b8	MT#17173 Remove Moose Roles from API ... Conflicts: lib/NGCP/Panel/Controller/API/MetaConfigDefs.pm lib/NGCP/Panel/Controller/API/Root.pm Change-Id: I25597baebbec6e2436b15776da17bd6d1bfef838	9 years ago
Andreas Granig	e0f80027b1	MT#17641 Add admins resource to api ... Currently I only need to fetch a collection and create a new item within the collection, no need for update/delete an existing one. Thus, no AdminsItem.pm yet. Since we're exposing field names now, rename md5pass to password. Change-Id: I571a340f89560bc456147b0ec27d3ae737e6dbc3	9 years ago