TT#152750 build: permissions

* We want to split build releases from hotfix perms
* create dev and devops groups and assign desired permissions.
  These groups will match LDAP groups.
* create permissions using hack stolen from
  https://stackoverflow.com/questions/29296757/django-data-migrate-permissions

Change-Id: I1b82ebf13aa3cba05e4733e4bef186fbbb52bb13

build/migrations/0006_alter_buildrelease_options.py

@@ -0,0 +1,21 @@
+# Generated by Django 3.2.13 on 2022-06-14 16:37
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("build", "0005_buildrelease_triggered_jobs"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="buildrelease",
+            options={
+                "permissions": [
+                    ("can_trigger", "can trigger build releases"),
+                    ("can_trigger_hotfix", "can trigger hotfix builds"),
+                ]
+            },
+        ),
+    ]

build/models.py

@@ -154,6 +154,12 @@ class BuildRelease(models.Model):
     triggered_jobs = models.TextField(null=True, editable=False)
     objects = BuildReleaseManager()
 
+    class Meta:
+        permissions = [
+            ("can_trigger", "can trigger build releases"),
+            ("can_trigger_hotfix", "can trigger hotfix builds"),
+        ]
+
     def __str__(self):
         return "%s[%s]" % (self.release, self.uuid)
 

hotfix/models.py

@@ -1,4 +1,4 @@
-# Copyright (C) 2015 The Sipwise Team - http://sipwise.com
+# Copyright (C) 2015-2022 The Sipwise Team - http://sipwise.com
 #
 # This program is free software: you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by the Free

repoapi/migrations/0011_ldap_groups.py

@@ -0,0 +1,62 @@
+# Generated by Django 3.2.13 on 2022-06-14 16:12
+from django.contrib.auth.management import create_permissions
+from django.db import migrations
+
+
+def add_permissions(apps, schema_editor):
+    """ContentType table is populated after all the migrations applied"""
+    for app_config in apps.get_app_configs():
+        app_config.models_module = True
+        create_permissions(app_config, verbosity=0)
+        app_config.models_module = None
+
+
+def forwards_func(apps, schema_editor):
+    add_permissions(apps, schema_editor)
+    Group = apps.get_model("auth", "Group")
+    Permission = apps.get_model("auth", "Permission")
+    ContentType = apps.get_model("contenttypes", "ContentType")
+    db_alias = schema_editor.connection.alias
+
+    Group.objects.using(db_alias).bulk_create(
+        [Group(name="dev"), Group(name="devops")]
+    )
+    dev_grp = Group.objects.using(db_alias).get(name="dev")
+    devops_grp = Group.objects.using(db_alias).get(name="devops")
+
+    BuildRelease = apps.get_model("build", "BuildRelease")
+    ct = ContentType.objects.get_for_model(BuildRelease)
+
+    dev_grp.permissions.set(
+        [
+            Permission.objects.using(db_alias).get(
+                content_type=ct, codename="can_trigger"
+            ),
+        ]
+    )
+    devops_grp.permissions.set(
+        [
+            Permission.objects.using(db_alias).get(
+                content_type=ct, codename="can_trigger_hotfix"
+            ),
+        ]
+    )
+
+
+def reverse_func(apps, schema_editor):
+    Group = apps.get_model("auth", "Group")
+    db_alias = schema_editor.connection.alias
+    Group.objects.using(db_alias).filter(name="dev").delete()
+    Group.objects.using(db_alias).filter(name="devops").delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("repoapi", "0010_gerritrepoinfo_projectname"),
+        ("build", "0006_alter_buildrelease_options"),
+    ]
+
+    operations = [
+        migrations.RunPython(forwards_func, reverse_func),
+    ]

repoapi/settings/prod.py

@@ -52,6 +52,11 @@ ALLOWED_HOSTS = [".mgm.sipwise.com"]
 LOGGING["loggers"]["repoapi"]["level"] = os.getenv(  # noqa
     "DJANGO_LOG_LEVEL", "INFO"
 )  # noqa
+# for now lets see debug for auth ldap
+LOGGING["loggers"]["django_auth_ldap"] = {  # noqa
+    "level": "DEBUG",
+    "handlers": ["console"],
+}
 
 server_config = RawConfigParser()
 server_config.read(VAR_DIR / "server.ini")
@@ -73,10 +78,21 @@ AUTH_LDAP_REQUIRE_GROUP_LIST = server_config.get(
 ).split(",")
 require_grp_list_size = len(AUTH_LDAP_REQUIRE_GROUP_LIST)
 AUTH_LDAP_USER_DN_TEMPLATE = "uid=%(user)s," + AUTH_LDAP_USER_BASE
+AUTH_LDAP_USER_ATTR_MAP = {
+    "first_name": "givenName",
+    "last_name": "sn",
+    "email": "mail",
+}
+AUTH_LDAP_ALWAYS_UPDATE_USER = True
 AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
     AUTH_LDAP_GROUP_BASE, ldap.SCOPE_SUBTREE, "(objectClass=posixGroup)"
 )
 AUTH_LDAP_GROUP_TYPE = PosixGroupType()
+AUTH_LDAP_USER_FLAGS_BY_GROUP = {
+    "is_staff": f"cn=devops,{AUTH_LDAP_GROUP_BASE}",
+}
+AUTH_LDAP_FIND_GROUP_PERMS = True
+AUTH_LDAP_CACHE_TIMEOUT = 3600
 
 if require_grp_list_size > 1:
     AUTH_LDAP_REQUIRE_GROUP = reduce(