From 10ce513d2081e8f311cce2e0a20109bde35dd07d Mon Sep 17 00:00:00 2001 From: Victor Seva Date: Tue, 14 Jun 2022 16:11:09 +0200 Subject: [PATCH] TT#152750 build: permissions * We want to split build releases from hotfix perms * create dev and devops groups and assign desired permissions. These groups will match LDAP groups. * create permissions using hack stolen from https://stackoverflow.com/questions/29296757/django-data-migrate-permissions Change-Id: I1b82ebf13aa3cba05e4733e4bef186fbbb52bb13 --- .../0006_alter_buildrelease_options.py | 21 +++++++ build/models.py | 6 ++ hotfix/models.py | 2 +- repoapi/migrations/0011_ldap_groups.py | 62 +++++++++++++++++++ repoapi/settings/prod.py | 16 +++++ 5 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 build/migrations/0006_alter_buildrelease_options.py create mode 100644 repoapi/migrations/0011_ldap_groups.py diff --git a/build/migrations/0006_alter_buildrelease_options.py b/build/migrations/0006_alter_buildrelease_options.py new file mode 100644 index 0000000..6fb919e --- /dev/null +++ b/build/migrations/0006_alter_buildrelease_options.py @@ -0,0 +1,21 @@ +# Generated by Django 3.2.13 on 2022-06-14 16:37 +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ("build", "0005_buildrelease_triggered_jobs"), + ] + + operations = [ + migrations.AlterModelOptions( + name="buildrelease", + options={ + "permissions": [ + ("can_trigger", "can trigger build releases"), + ("can_trigger_hotfix", "can trigger hotfix builds"), + ] + }, + ), + ] diff --git a/build/models.py b/build/models.py index 7141552..8f966d2 100644 --- a/build/models.py +++ b/build/models.py @@ -154,6 +154,12 @@ class BuildRelease(models.Model): triggered_jobs = models.TextField(null=True, editable=False) objects = BuildReleaseManager() + class Meta: + permissions = [ + ("can_trigger", "can trigger build releases"), + ("can_trigger_hotfix", "can trigger hotfix builds"), + ] + def __str__(self): return "%s[%s]" % (self.release, self.uuid) diff --git a/hotfix/models.py b/hotfix/models.py index 6e4111b..e90c9ae 100644 --- a/hotfix/models.py +++ b/hotfix/models.py @@ -1,4 +1,4 @@ -# Copyright (C) 2015 The Sipwise Team - http://sipwise.com +# Copyright (C) 2015-2022 The Sipwise Team - http://sipwise.com # # This program is free software: you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the Free diff --git a/repoapi/migrations/0011_ldap_groups.py b/repoapi/migrations/0011_ldap_groups.py new file mode 100644 index 0000000..bcd0011 --- /dev/null +++ b/repoapi/migrations/0011_ldap_groups.py @@ -0,0 +1,62 @@ +# Generated by Django 3.2.13 on 2022-06-14 16:12 +from django.contrib.auth.management import create_permissions +from django.db import migrations + + +def add_permissions(apps, schema_editor): + """ContentType table is populated after all the migrations applied""" + for app_config in apps.get_app_configs(): + app_config.models_module = True + create_permissions(app_config, verbosity=0) + app_config.models_module = None + + +def forwards_func(apps, schema_editor): + add_permissions(apps, schema_editor) + Group = apps.get_model("auth", "Group") + Permission = apps.get_model("auth", "Permission") + ContentType = apps.get_model("contenttypes", "ContentType") + db_alias = schema_editor.connection.alias + + Group.objects.using(db_alias).bulk_create( + [Group(name="dev"), Group(name="devops")] + ) + dev_grp = Group.objects.using(db_alias).get(name="dev") + devops_grp = Group.objects.using(db_alias).get(name="devops") + + BuildRelease = apps.get_model("build", "BuildRelease") + ct = ContentType.objects.get_for_model(BuildRelease) + + dev_grp.permissions.set( + [ + Permission.objects.using(db_alias).get( + content_type=ct, codename="can_trigger" + ), + ] + ) + devops_grp.permissions.set( + [ + Permission.objects.using(db_alias).get( + content_type=ct, codename="can_trigger_hotfix" + ), + ] + ) + + +def reverse_func(apps, schema_editor): + Group = apps.get_model("auth", "Group") + db_alias = schema_editor.connection.alias + Group.objects.using(db_alias).filter(name="dev").delete() + Group.objects.using(db_alias).filter(name="devops").delete() + + +class Migration(migrations.Migration): + + dependencies = [ + ("repoapi", "0010_gerritrepoinfo_projectname"), + ("build", "0006_alter_buildrelease_options"), + ] + + operations = [ + migrations.RunPython(forwards_func, reverse_func), + ] diff --git a/repoapi/settings/prod.py b/repoapi/settings/prod.py index 33b0cbe..ddb85b8 100644 --- a/repoapi/settings/prod.py +++ b/repoapi/settings/prod.py @@ -52,6 +52,11 @@ ALLOWED_HOSTS = [".mgm.sipwise.com"] LOGGING["loggers"]["repoapi"]["level"] = os.getenv( # noqa "DJANGO_LOG_LEVEL", "INFO" ) # noqa +# for now lets see debug for auth ldap +LOGGING["loggers"]["django_auth_ldap"] = { # noqa + "level": "DEBUG", + "handlers": ["console"], +} server_config = RawConfigParser() server_config.read(VAR_DIR / "server.ini") @@ -73,10 +78,21 @@ AUTH_LDAP_REQUIRE_GROUP_LIST = server_config.get( ).split(",") require_grp_list_size = len(AUTH_LDAP_REQUIRE_GROUP_LIST) AUTH_LDAP_USER_DN_TEMPLATE = "uid=%(user)s," + AUTH_LDAP_USER_BASE +AUTH_LDAP_USER_ATTR_MAP = { + "first_name": "givenName", + "last_name": "sn", + "email": "mail", +} +AUTH_LDAP_ALWAYS_UPDATE_USER = True AUTH_LDAP_GROUP_SEARCH = LDAPSearch( AUTH_LDAP_GROUP_BASE, ldap.SCOPE_SUBTREE, "(objectClass=posixGroup)" ) AUTH_LDAP_GROUP_TYPE = PosixGroupType() +AUTH_LDAP_USER_FLAGS_BY_GROUP = { + "is_staff": f"cn=devops,{AUTH_LDAP_GROUP_BASE}", +} +AUTH_LDAP_FIND_GROUP_PERMS = True +AUTH_LDAP_CACHE_TIMEOUT = 3600 if require_grp_list_size > 1: AUTH_LDAP_REQUIRE_GROUP = reduce(