def post(self, user_id=None, name=None, key_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
try:
key = get_public_key(self.session, user.id, key_id)
delete_public_key(self.session, user.id, key_id)
except KeyNotFound:
return self.notfound()
AuditLog.log(self.session,
self.current_user.id,
'delete_public_key',
'Deleted public key: {}'.format(key.fingerprint_sha256),
on_user_id=user.id)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "removed",
}
send_email(self.session, [user.name], 'Public SSH key removed',
'ssh_keys_changed', settings, email_context)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = UserPasswordForm(self.request.arguments)
if not form.validate():
return self.render("user-password-add.html", form=form, user=user, alerts=self.get_form_alerts(form.errors))
pass_name = form.data["name"]
password = form.data["password"]
try:
add_new_user_password(self.session, pass_name, password, user.id)
except PasswordAlreadyExists:
self.session.rollback()
form.name.errors.append("Name already in use.")
return self.render("user-password-add.html", form=form, user=user, alerts=self.get_form_alerts(form.errors))
AuditLog.log(
self.session,
self.current_user.id,
"add_password",
"Added password: {}".format(pass_name),
on_user_id=user.id,
)
email_context = {"actioner": self.current_user.name, "changed_user": user.name, "pass_name": pass_name}
send_email(self.session, [user.name], "User password created", "user_password_created", settings, email_context)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None, key_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
key = self.session.query(PublicKey).filter_by(id=key_id, user_id=user.id).scalar()
if not key:
return self.notfound()
key.delete(self.session)
self.session.commit()
AuditLog.log(
self.session,
self.current_user.id,
"delete_public_key",
"Deleted public key: {}".format(key.fingerprint),
on_user_id=user.id,
)
email_context = {"actioner": self.current_user.name, "changed_user": user.name, "action": "removed"}
send_email(self.session, [user.name], "Public SSH key removed", "ssh_keys_changed", settings, email_context)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None, key_id=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
try:
key = get_public_key(self.session, user.id, key_id)
delete_public_key(self.session, user.id, key_id)
except KeyNotFound:
return self.notfound()
AuditLog.log(self.session, self.current_user.id, 'delete_public_key',
'Deleted public key: {}'.format(key.fingerprint),
on_user_id=user.id)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "removed",
}
send_email(self.session, [user.name], 'Public SSH key removed', 'ssh_keys_changed',
settings, email_context)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = PublicKeyForm(self.request.arguments)
if not form.validate():
return self.render(
"public-key-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
pubkey = public_key.add_public_key(self.session, user,
form.data["public_key"])
except public_key.DuplicateKey:
form.public_key.errors.append(
"Key already in use. Public keys must be unique.")
except public_key.PublicKeyParseError:
form.public_key.errors.append("Public key appears to be invalid.")
except public_key.BadPublicKey as e:
form.public_key.errors.append(str(e))
if form.public_key.errors:
return self.render(
"public-key-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(
self.session,
self.current_user.id,
"add_public_key",
"Added public key: {}".format(pubkey.fingerprint_sha256),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(
self.session,
[user.name],
"Public SSH key added",
"ssh_keys_changed",
settings,
email_context,
)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = UserTokenForm(self.request.arguments)
if not form.validate():
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
token, secret = add_new_user_token(
self.session, UserToken(name=form.data["name"], user=user))
self.session.commit()
except IntegrityError:
self.session.rollback()
form.name.errors.append("Name already in use.")
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(
self.session,
self.current_user.id,
"add_token",
"Added token: {}".format(token.name),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(
self.session,
[user.name],
"User token created",
"user_tokens_changed",
settings(),
email_context,
)
return self.render("user-token-created.html",
token=token,
secret=secret)
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = UserTokenForm(self.request.arguments)
if not form.validate():
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
token, secret = add_new_user_token(
self.session, UserToken(name=form.data["name"], user=user)
)
self.session.commit()
except IntegrityError:
self.session.rollback()
form.name.errors.append("Name already in use.")
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(
self.session,
self.current_user.id,
"add_token",
"Added token: {}".format(token.name),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(
self.session,
[user.name],
"User token created",
"user_tokens_changed",
settings(),
email_context,
)
return self.render("user-token-created.html", token=token, secret=secret)
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = UserPasswordForm(self.request.arguments)
if not form.validate():
return self.render(
"user-password-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
pass_name = form.data["name"]
password = form.data["password"]
try:
add_new_user_password(self.session, pass_name, password, user.id)
except PasswordAlreadyExists:
self.session.rollback()
form.name.errors.append("Name already in use.")
return self.render(
"user-password-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(
self.session,
self.current_user.id,
"add_password",
"Added password: {}".format(pass_name),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"pass_name": pass_name,
}
send_email(
self.session,
[user.name],
"User password created",
"user_password_created",
settings(),
email_context,
)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if (user.name != self.current_user.name) and not self.current_user.user_admin:
return self.forbidden()
form = PublicKeyForm(self.request.arguments)
if not form.validate():
return self.render(
"public-key-add.html", form=form, user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
pubkey = public_key.add_public_key(self.session, user, form.data["public_key"])
except public_key.PublicKeyParseError:
form.public_key.errors.append(
"Key failed to parse and is invalid."
)
return self.render(
"public-key-add.html", form=form, user=user,
alerts=self.get_form_alerts(form.errors),
)
except public_key.DuplicateKey:
form.public_key.errors.append(
"Key already in use. Public keys must be unique."
)
return self.render(
"public-key-add.html", form=form, user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(self.session, self.current_user.id, 'add_public_key',
'Added public key: {}'.format(pubkey.fingerprint),
on_user_id=user.id)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(self.session, [user.name], 'Public SSH key added', 'ssh_keys_changed',
settings, email_context)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, user_id=None, name=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = UserTokenForm(self.request.arguments)
if not form.validate():
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
token, secret = add_new_user_token(
self.session, UserToken(name=form.data["name"], user=user))
self.session.commit()
except IntegrityError:
self.session.rollback()
form.name.errors.append("Name already in use.")
return self.render(
"user-token-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(self.session,
self.current_user.id,
'add_token',
'Added token: {}'.format(token.name),
on_user_id=user.id)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(self.session, [user.name], 'User token created',
'user_tokens_changed', settings, email_context)
return self.render("user-token-created.html",
token=token,
secret=secret)
def post(self, user_id=None, name=None):
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if user.name != self.current_user.name and not (
self.current_user.has_permission(USER_ADMIN) and user.role_user
):
return self.forbidden()
form = UserTokenForm(self.request.arguments)
if not form.validate():
return self.render(
"user-token-add.html", form=form, user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
token, secret = add_new_user_token(self.session, UserToken(name=form.data["name"],
user=user))
self.session.commit()
except IntegrityError:
self.session.rollback()
form.name.errors.append(
"Name already in use."
)
return self.render(
"user-token-add.html", form=form, user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(self.session, self.current_user.id, 'add_token',
'Added token: {}'.format(token.name),
on_user_id=user.id)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(self.session, [user.name], 'User token created', 'user_tokens_changed',
settings, email_context)
return self.render("user-token-created.html", token=token, secret=secret)
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
key_id = kwargs["key_id"] # type: int
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
try:
key = get_public_key(self.session, user.id, key_id)
delete_public_key(self.session, user.id, key_id)
except KeyNotFound:
return self.notfound()
AuditLog.log(
self.session,
self.current_user.id,
"delete_public_key",
"Deleted public key: {}".format(key.fingerprint_sha256),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "removed",
}
send_email(
self.session,
[user.name],
"Public SSH key removed",
"ssh_keys_changed",
settings(),
email_context,
)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
key_id = kwargs["key_id"] # type: int
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
try:
key = get_public_key(self.session, user.id, key_id)
delete_public_key(self.session, user.id, key_id)
except KeyNotFound:
return self.notfound()
AuditLog.log(
self.session,
self.current_user.id,
"delete_public_key",
"Deleted public key: {}".format(key.fingerprint_sha256),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "removed",
}
send_email(
self.session,
[user.name],
"Public SSH key removed",
"ssh_keys_changed",
settings(),
email_context,
)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group)
if not form.validate():
return self.render("group-join.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
member = self._get_member(form.data["member"])
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(group,
member,
role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
return self.render("group-join.html",
form=form,
group=group,
alerts=[
Alert('danger', fail_message,
'Audit Policy Enforcement')
])
if group.canjoin == "nobody":
fail_message = 'This group cannot be joined at this time.'
return self.render("group-join.html",
form=form,
group=group,
alerts=[Alert('danger', fail_message)])
# We only use the default expiration time if no expiration time was given
# This does mean that if a user wishes to join a group with no expiration
# (even with an owner's permission) that has an auto expiration, they must
# first be accepted to the group and then have the owner edit the user to
# have no expiration.
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
elif group.auto_expire:
expiration = datetime.utcnow() + group.auto_expire
request = group.add_member(requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=GROUP_JOIN_CHOICES[group.canjoin],
expiration=expiration,
role=form.data["role"])
self.session.commit()
if group.canjoin == 'canask':
AuditLog.log(self.session,
self.current_user.id,
'join_group',
'{} requested to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
mail_to = [
user.name for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ('manager', 'owner',
'np-owner')
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"request_id": request.id,
"group_name": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
"references_header": request.reference_id,
}
subj = self.render_template('email/pending_request_subj.tmpl',
group=group.name,
user=self.current_user.name)
send_email(self.session, mail_to, subj, 'pending_request',
settings, email_context)
elif group.canjoin == 'canjoin':
AuditLog.log(self.session,
self.current_user.id,
'join_group',
'{} auto-approved to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
else:
raise Exception('Need to update the GroupJoin.post audit logging')
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, *args: Any, **kwargs: Any) -> None:
name = self.get_path_argument("name")
group = Group.get(self.session, name=name)
if not group or not group.enabled:
return self.notfound()
members = group.my_members()
member_groups = {g for t, g in members if t == "Group"}
user_is_member = self._is_user_a_member(group, members)
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group, member_groups,
user_is_member)
if not form.validate():
return self.render("group-join.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
member = self._get_member(form.data["member"])
if not member:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert(
"danger", "Unknown user or group: {}".format(
form.data["member"]))
],
)
try:
assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[Alert("danger", str(e), "Audit Policy Enforcement")],
)
if group.canjoin == "nobody":
fail_message = "This group cannot be joined at this time."
return self.render("group-join.html",
form=form,
group=group,
alerts=[Alert("danger", fail_message)])
if group.require_clickthru_tojoin:
if not form.data["clickthru_agreement"]:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert(
"danger",
"please accept review of the group's description",
"Clickthru Enforcement",
)
],
)
# We only use the default expiration time if no expiration time was given
# This does mean that if a user wishes to join a group with no expiration
# (even with an owner's permission) that has an auto expiration, they must
# first be accepted to the group and then have the owner edit the user to
# have no expiration.
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
elif group.auto_expire:
expiration = datetime.utcnow() + group.auto_expire
# If the requested role is member, set the status based on the group's canjoin setting,
# which automatically actions the request if the group can be joined by anyone and
# otherwise sets it pending.
#
# However, we don't want to let people autojoin as owner or np-owner even to otherwise open
# groups, so if the role is not member, force the status to pending.
if form.data["role"] == "member":
status = GROUP_JOIN_CHOICES[group.canjoin]
else:
status = "pending"
try:
request = group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=status,
expiration=expiration,
role=form.data["role"],
)
except InvalidRoleForMember as e:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[Alert("danger", str(e), "Invalid Role")],
)
self.session.commit()
if status == "pending":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} requested to join with role: {}".format(
member.name, form.data["role"]),
on_group_id=group.id,
)
mail_to = [
user.name for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ("manager", "owner",
"np-owner")
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"request_id": request.id,
"group_name": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
"references_header": request.reference_id,
}
subj = self.render_template("email/pending_request_subj.tmpl",
group=group.name,
user=self.current_user.name)
send_email(self.session, mail_to, subj, "pending_request",
settings(), email_context)
elif status == "actioned":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} auto-approved to join with role: {}".format(
member.name, form.data["role"]),
on_group_id=group.id,
)
else:
raise Exception(f"Unknown join status {status}")
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, request_id, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
members = group.my_members()
my_role = self.current_user.my_role(members)
if my_role not in ("manager", "owner", "np-owner"):
return self.forbidden()
request = self.session.query(Request).filter_by(id=request_id).scalar()
if not request:
return self.notfound()
form = GroupRequestModifyForm(self.request.arguments)
form.status.choices = self._get_choices(request.status)
updates = request.my_status_updates()
if not form.validate():
return self.render(
"group-request-update.html", group=group, request=request,
members=members, form=form, alerts=self.get_form_alerts(form.errors),
statuses=REQUEST_STATUS_CHOICES, updates=updates
)
# We have to test this here, too, to ensure that someone can't sneak in with a pending
# request that used to be allowed.
if form.data["status"] != "cancelled":
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(request.requesting, request.get_on_behalf(),
role=request.edge.role)
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
return self.render(
"group-request-update.html", group=group, request=request,
members=members, form=form, statuses=REQUEST_STATUS_CHOICES, updates=updates,
alerts=[
Alert('danger', fail_message, 'Audit Policy Enforcement')
]
)
request.update_status(
self.current_user,
form.data["status"],
form.data["reason"]
)
self.session.commit()
AuditLog.log(self.session, self.current_user.id, 'update_request',
'Updated request to status: {}'.format(form.data["status"]),
on_group_id=group.id, on_user_id=request.requester.id)
edge = self.session.query(GroupEdge).filter_by(
id=request.edge_id
).one()
if form.data['status'] == 'actioned':
send_email(
self.session,
[request.requester.name],
'Added to group: {}'.format(group.groupname),
'request_actioned',
settings,
{
'group': group.name,
'actioned_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': edge.expiration,
'role': edge.role,
}
)
elif form.data['status'] == 'cancelled':
send_email(
self.session,
[request.requester.name],
'Request to join cancelled: {}'.format(group.groupname),
'request_cancelled',
settings,
{
'group': group.name,
'cancelled_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': edge.expiration,
'role': edge.role,
}
)
# No explicit refresh because handler queries SQL.
if form.data['redirect_aggregate']:
return self.redirect("/user/requests")
else:
return self.redirect("/groups/{}/requests".format(group.name))
def post(self, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group)
if not form.validate():
return self.render(
"group-join.html", form=form, group=group,
alerts=self.get_form_alerts(form.errors)
)
member = self._get_member(form.data["member"])
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
return self.render(
"group-join.html", form=form, group=group,
alerts=[
Alert('danger', fail_message, 'Audit Policy Enforcement')
]
)
if group.canjoin == "nobody":
fail_message = 'This group cannot be joined at this time.'
return self.render(
"group-join.html", form=form, group=group,
alerts=[
Alert('danger', fail_message)
]
)
# We only use the default expiration time if no expiration time was given
# This does mean that if a user wishes to join a group with no expiration
# (even with an owner's permission) that has an auto expiration, they must
# first be accepted to the group and then have the owner edit the user to
# have no expiration.
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
elif group.auto_expire:
expiration = datetime.utcnow() + group.auto_expire
request = group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=GROUP_JOIN_CHOICES[group.canjoin],
expiration=expiration,
role=form.data["role"]
)
self.session.commit()
if group.canjoin == 'canask':
AuditLog.log(self.session, self.current_user.id, 'join_group',
'{} requested to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
mail_to = [
user.name
for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ('manager', 'owner', 'np-owner')
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"request_id": request.id,
"group_name": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
"references_header": request.reference_id,
}
subj = self.render_template(
'email/pending_request_subj.tmpl',
group=group.name,
user=self.current_user.name
)
send_email(self.session, mail_to, subj,
'pending_request', settings, email_context)
elif group.canjoin == 'canjoin':
AuditLog.log(self.session, self.current_user.id, 'join_group',
'{} auto-approved to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
else:
raise Exception('Need to update the GroupJoin.post audit logging')
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group)
if not form.validate():
return self.render(
"group-join.html", form=form, group=group,
alerts=self.get_form_alerts(form.errors)
)
member = self._get_member(form.data["member"])
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
return self.render(
"group-join.html", form=form, group=group,
alerts=[
Alert('danger', fail_message, 'Audit Policy Enforcement')
]
)
if group.canjoin == "nobody":
fail_message = 'This group cannot be joined at this time.'
return self.render(
"group-join.html", form=form, group=group,
alerts=[
Alert('danger', fail_message)
]
)
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=GROUP_JOIN_CHOICES[group.canjoin],
expiration=expiration,
role=form.data["role"]
)
self.session.commit()
if group.canjoin == 'canask':
AuditLog.log(self.session, self.current_user.id, 'join_group',
'{} requested to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
mail_to = [
user.name
for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ('manager', 'owner', 'np-owner')
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"requested": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
}
send_email(self.session, mail_to, 'Request to join: {}'.format(group.name),
'pending_request', settings, email_context)
elif group.canjoin == 'canjoin':
AuditLog.log(self.session, self.current_user.id, 'join_group',
'{} auto-approved to join with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
else:
raise Exception('Need to update the GroupJoin.post audit logging')
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self):
form = AuditCreateForm(self.request.arguments)
if not form.validate():
return self.render("audit-create.html",
form=form,
alerts=self.get_form_alerts(form.errors))
user = self.get_current_user()
if not user_has_permission(self.session, user, AUDIT_MANAGER):
return self.forbidden()
# Step 1, detect if there are non-completed audits and fail if so.
open_audits = self.session.query(Audit).filter(
Audit.complete == False).all()
if open_audits:
raise Exception("Sorry, there are audits in progress.")
ends_at = datetime.strptime(form.data["ends_at"], "%m/%d/%Y")
# Step 2, find all audited groups and schedule audits for each.
audited_groups = []
for groupname in self.graph.groups:
if not self.graph.get_group_details(groupname)["audited"]:
continue
group = Group.get(self.session, name=groupname)
audit = Audit(group_id=group.id, ends_at=ends_at)
try:
audit.add(self.session)
self.session.flush()
except IntegrityError:
self.session.rollback()
raise Exception("Failed to start the audit. Please try again.")
# Update group with new audit
audited_groups.append(group)
group.audit_id = audit.id
# Step 3, now get all members of this group and set up audit rows for those edges.
for member in group.my_members().values():
auditmember = AuditMember(audit_id=audit.id,
edge_id=member.edge_id)
try:
auditmember.add(self.session)
except IntegrityError:
self.session.rollback()
raise Exception(
"Failed to start the audit. Please try again.")
self.session.commit()
AuditLog.log(
self.session,
self.current_user.id,
"start_audit",
"Started global audit.",
category=AuditLogCategory.audit,
)
# Calculate schedule of emails, basically we send emails at various periods in advance
# of the end of the audit period.
schedule_times = []
not_before = datetime.utcnow() + timedelta(1)
for days_prior in (28, 21, 14, 7, 3, 1):
email_time = ends_at - timedelta(days_prior)
email_time.replace(hour=17, minute=0, second=0)
if email_time > not_before:
schedule_times.append((days_prior, email_time))
# Now send some emails. We do this separately/later to ensure that the audits are all
# created. Email notifications are sent multiple times if group audits are still
# outstanding.
for group in audited_groups:
mail_to = [
member.name for member in group.my_users()
if GROUP_EDGE_ROLES[member.role] in ("owner", "np-owner")
]
send_email(
self.session,
mail_to,
"Group Audit: {}".format(group.name),
"audit_notice",
settings,
{
"group": group.name,
"ends_at": ends_at
},
)
for days_prior, email_time in schedule_times:
send_async_email(
self.session,
mail_to,
"Group Audit: {} - {} day(s) left".format(
group.name, days_prior),
"audit_notice_reminder",
settings,
{
"group": group.name,
"ends_at": ends_at,
"days_left": days_prior
},
email_time,
async_key="audit-{}".format(group.id),
)
return self.redirect("/audits")
def create_request(session, user, group, permission, argument, reason):
"""
Creates an permission request and sends notification to the responsible approvers.
Args:
session(sqlalchemy.orm.session.Session): database session
user(models.User): user requesting permission
group(models.Group): group requested permission would be applied to
permission(models.Permission): permission in question to request
argument(str): argument for the given permission
reason(str): reason the permission should be granted
Raises:
RequestAlreadyExists if trying to create a request that is already pending
NoOwnersAvailable if no owner is available for the requested perm + arg.
grouper.audit.UserNotAuditor if the group has owners that are not auditors
"""
# check if group already has perm + arg pair
for _, existing_perm_name, _, existing_perm_argument, _ in group.my_permissions():
if permission.name == existing_perm_name and argument == existing_perm_argument:
raise RequestAlreadyGranted()
# check if request already pending for this perm + arg pair
existing_count = session.query(PermissionRequest).filter(
PermissionRequest.group_id == group.id,
PermissionRequest.permission_id == permission.id,
PermissionRequest.argument == argument,
PermissionRequest.status == "pending",
).count()
if existing_count > 0:
raise RequestAlreadyExists()
# determine owner(s)
owners_by_arg_by_perm = get_owners_by_grantable_permission(session, separate_global=True)
owner_arg_list = get_owner_arg_list(
session,
permission,
argument,
owners_by_arg_by_perm=owners_by_arg_by_perm,
)
if not owner_arg_list:
raise NoOwnersAvailable()
if permission.audited:
# will raise UserNotAuditor if any owner of the group is not an auditor
assert_controllers_are_auditors(group)
pending_status = "pending"
now = datetime.utcnow()
# multiple steps to create the request
request = PermissionRequest(
requester_id=user.id,
group_id=group.id,
permission_id=permission.id,
argument=argument,
status=pending_status,
requested_at=now,
).add(session)
session.flush()
request_status_change = PermissionRequestStatusChange(
request=request,
user=user,
to_status=pending_status,
change_at=now,
).add(session)
session.flush()
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=request_status_change.id,
user_id=user.id,
comment=reason,
created_on=now,
).add(session)
# send notification
email_context = {
"user_name": user.name,
"group_name": group.name,
"permission_name": permission.name,
"argument": argument,
"reason": reason,
"request_id": request.id,
"references_header": request.reference_id,
}
# TODO: would be nicer if it told you which group you're an approver of
# that's causing this notification
mail_to = []
global_owners = owners_by_arg_by_perm[GLOBAL_OWNERS]["*"]
non_wildcard_owners = filter(lambda grant: grant[1] != '*', owner_arg_list)
non_global_owners = filter(lambda grant: grant[0] not in global_owners, owner_arg_list)
if any(non_wildcard_owners):
# non-wildcard owners should get all the notifications
mailto_owner_arg_list = non_wildcard_owners
elif any(non_global_owners):
mailto_owner_arg_list = non_global_owners
else:
# only the wildcards so they get the notifications
mailto_owner_arg_list = owner_arg_list
for owner, arg in mailto_owner_arg_list:
mail_to += [u for t, u in owner.my_members() if t == 'User']
subj = get_template_env().get_template('email/pending_permission_request_subj.tmpl').render(
permission=permission.name, group=group.name
)
send_email(session, set(mail_to), subj,
"pending_permission_request", settings, email_context)
return request
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
group_id = kwargs.get("group_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
if not user_can_manage_group(self.session, group, self.current_user):
return self.forbidden()
members = group.my_members()
my_role = user_role(self.current_user, members)
form = self.get_form(role=my_role)
if not form.validate():
return self.render(
"group-add.html", form=form, group=group, alerts=self.get_form_alerts(form.errors)
)
member = get_user_or_group(self.session, form.data["member"])
if member.type == "User" and is_role_user(self.session, member):
# For service accounts, we want to always add the group to other groups, not the user
member = get_role_user(self.session, user=member).group
if not member:
form.member.errors.append("User or group not found.")
elif (member.type, member.name) in group.my_members():
form.member.errors.append("User or group is already a member of this group.")
elif group.name == member.name:
form.member.errors.append("By definition, this group is a member of itself already.")
# Ensure this doesn't violate auditing constraints
fail_message = "This join is denied with this role at this time."
try:
user_can_join = assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = str(e)
if not user_can_join:
form.member.errors.append(fail_message)
if form.member.errors:
return self.render(
"group-add.html", form=form, group=group, alerts=self.get_form_alerts(form.errors)
)
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
try:
group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status="actioned",
expiration=expiration,
role=form.data["role"],
)
except InvalidRoleForMember as e:
return self.render(
"group-add.html", form=form, group=group, alerts=[Alert("danger", str(e))]
)
self.session.commit()
on_user_id = member.id if member.type == "User" else None
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} added to group with role: {}".format(member.name, form.data["role"]),
on_group_id=group.id,
on_user_id=on_user_id,
)
if member.type == "User":
send_email(
self.session,
[member.name],
"Added to group: {}".format(group.name),
"request_actioned",
settings(),
{
"group_name": group.name,
"actioned_by": self.current_user.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
},
)
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
user_id = kwargs.get("user_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
user = User.get(self.session, user_id, name)
if not user:
return self.notfound()
if not self.check_access(self.session, self.current_user, user):
return self.forbidden()
form = PublicKeyForm(self.request.arguments)
if not form.validate():
return self.render(
"public-key-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
try:
pubkey = public_key.add_public_key(self.session, user, form.data["public_key"])
except public_key.DuplicateKey:
form.public_key.errors.append("Key already in use. Public keys must be unique.")
except public_key.PublicKeyParseError:
form.public_key.errors.append("Public key appears to be invalid.")
except public_key.BadPublicKey as e:
form.public_key.errors.append(str(e))
if form.public_key.errors:
return self.render(
"public-key-add.html",
form=form,
user=user,
alerts=self.get_form_alerts(form.errors),
)
AuditLog.log(
self.session,
self.current_user.id,
"add_public_key",
"Added public key: {}".format(pubkey.fingerprint_sha256),
on_user_id=user.id,
)
email_context = {
"actioner": self.current_user.name,
"changed_user": user.name,
"action": "added",
}
send_email(
self.session,
[user.name],
"Public SSH key added",
"ssh_keys_changed",
settings(),
email_context,
)
return self.redirect("/users/{}?refresh=yes".format(user.name))
def post(self, *args: Any, **kwargs: Any) -> None:
name = self.get_path_argument("name")
group = Group.get(self.session, name=name)
if not group:
return self.notfound()
if not user_can_manage_group(self.session, group, self.current_user):
return self.forbidden()
members = group.my_members()
my_role = user_role(self.current_user, members)
form = self.get_form(role=my_role)
if not form.validate():
return self.render("group-add.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
member = get_user_or_group(self.session, form.data["member"])
if member.type == "User" and is_role_user(self.session, member):
# For service accounts, we want to always add the group to other groups, not the user
member = get_role_user(self.session, user=member).group
if not member:
form.member.errors.append("User or group not found.")
elif (member.type, member.name) in group.my_members():
form.member.errors.append(
"User or group is already a member of this group.")
elif group.name == member.name:
form.member.errors.append(
"By definition, this group is a member of itself already.")
# Ensure this doesn't violate auditing constraints
try:
assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
form.member.errors.append(str(e))
if form.member.errors:
return self.render("group-add.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
try:
group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status="actioned",
expiration=expiration,
role=form.data["role"],
)
except InvalidRoleForMember as e:
return self.render("group-add.html",
form=form,
group=group,
alerts=[Alert("danger", str(e))])
self.session.commit()
on_user_id = member.id if member.type == "User" else None
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} added to group with role: {}".format(member.name,
form.data["role"]),
on_group_id=group.id,
on_user_id=on_user_id,
)
if member.type == "User":
send_email(
self.session,
[member.name],
"Added to group: {}".format(group.name),
"request_actioned",
settings(),
{
"group_name": group.name,
"actioned_by": self.current_user.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
},
)
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def update_request(session, request, user, new_status, comment):
"""Update a request.
Args:
session(sqlalchemy.orm.session.Session): database session
request(models.PermissionRequest): request to update
user(models.User): user making update
new_status(models.base.constants.REQUEST_STATUS_CHOICES): new status
comment(str): comment to include with status change
Raises:
grouper.audit.UserNotAuditor in case we're trying to add an audited
permission to a group without auditors
"""
if request.status == new_status:
# nothing to do
return
# make sure the grant can happen
if new_status == "actioned":
if request.permission.audited:
# will raise UserNotAuditor if no auditors are owners of the group
assert_controllers_are_auditors(request.group)
# all rows we add have the same timestamp
now = datetime.utcnow()
# new status change row
permission_status_change = PermissionRequestStatusChange(
request=request,
user_id=user.id,
from_status=request.status,
to_status=new_status,
change_at=now,
).add(session)
session.flush()
# new comment
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=permission_status_change.id,
user_id=user.id,
comment=comment,
created_on=now,
).add(session)
# update permissionRequest status
request.status = new_status
session.commit()
if new_status == "actioned":
# actually grant permission
try:
grant_permission(session, request.group.id, request.permission.id, request.argument)
except IntegrityError:
session.rollback()
# audit log
AuditLog.log(
session, user.id, "update_perm_request",
"updated permission request to status: {}".format(new_status),
on_group_id=request.group_id, on_user_id=request.requester_id,
on_permission_id=request.permission.id,
)
session.commit()
# send notification
subj_template = 'email/pending_permission_request_subj.tmpl'
subject = "Re: " + get_template_env().get_template(subj_template).render(
permission=request.permission.name, group=request.group.name
)
if new_status == "actioned":
email_template = "permission_request_actioned"
else:
email_template = "permission_request_cancelled"
email_context = {
'group_name': request.group.name,
'action_taken_by': user.name,
'reason': comment,
'permission_name': request.permission.name,
'argument': request.argument,
}
send_email(session, [request.requester.name], subject, email_template,
settings, email_context)
def update_request(session: Session, request: PermissionRequest, user: User,
new_status: str, comment: str) -> None:
"""Update a request.
Args:
session: Database session
request: Request to update
user: User making update
new_status: New status
comment: Comment to include with status change
Raises:
grouper.audit.UserNotAuditor in case we're trying to add an audited permission to a group
without auditors
"""
if request.status == new_status:
# nothing to do
return
# make sure the grant can happen
if new_status == "actioned":
if request.permission.audited:
# will raise UserNotAuditor if no auditors are owners of the group
assert_controllers_are_auditors(request.group)
# all rows we add have the same timestamp
now = datetime.utcnow()
# new status change row
permission_status_change = PermissionRequestStatusChange(
request=request,
user_id=user.id,
from_status=request.status,
to_status=new_status,
change_at=now,
).add(session)
session.flush()
# new comment
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=permission_status_change.id,
user_id=user.id,
comment=comment,
created_on=now,
).add(session)
# update permissionRequest status
request.status = new_status
session.commit()
if new_status == "actioned":
# actually grant permission
try:
grant_permission(session, request.group.id, request.permission.id,
request.argument)
except IntegrityError:
session.rollback()
# audit log
AuditLog.log(
session,
user.id,
"update_perm_request",
"updated permission request to status: {}".format(new_status),
on_group_id=request.group_id,
on_user_id=request.requester_id,
on_permission_id=request.permission.id,
)
session.commit()
# send notification
template_engine = EmailTemplateEngine(settings())
subject_template = template_engine.get_template(
"email/pending_permission_request_subj.tmpl")
subject = "Re: " + subject_template.render(
permission=request.permission.name, group=request.group.name)
if new_status == "actioned":
email_template = "permission_request_actioned"
else:
email_template = "permission_request_cancelled"
email_context = {
"group_name": request.group.name,
"action_taken_by": user.name,
"reason": comment,
"permission_name": request.permission.name,
"argument": request.argument,
}
send_email(session, [request.requester.name], subject, email_template,
settings(), email_context)
def post(self, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
if not user_can_manage_group(self.session, group, self.current_user):
return self.forbidden()
members = group.my_members()
my_role = user_role(self.current_user, members)
form = self.get_form(role=my_role)
if not form.validate():
return self.render("group-add.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
member = get_user_or_group(self.session, form.data["member"])
if member.type == "User" and is_role_user(self.session, member):
# For service accounts, we want to always add the group to other groups, not the user
member = get_role_user(self.session, user=member).group
if not member:
form.member.errors.append("User or group not found.")
elif (member.type, member.name) in group.my_members():
form.member.errors.append(
"User or group is already a member of this group.")
elif group.name == member.name:
form.member.errors.append(
"By definition, this group is a member of itself already.")
# Ensure this doesn't violate auditing constraints
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(group,
member,
role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
form.member.errors.append(fail_message)
if form.member.errors:
return self.render("group-add.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
try:
group.add_member(requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status='actioned',
expiration=expiration,
role=form.data["role"])
except InvalidRoleForMember as e:
return self.render("group-add.html",
form=form,
group=group,
alerts=[Alert('danger', e.message)])
self.session.commit()
on_user_id = member.id if member.type == "User" else None
AuditLog.log(self.session,
self.current_user.id,
'join_group',
'{} added to group with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id,
on_user_id=on_user_id)
if member.type == "User":
send_email(
self.session, [member.name],
'Added to group: {}'.format(group.name), 'request_actioned',
settings, {
'group_name': group.name,
'actioned_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': expiration,
'role': form.data['role'],
})
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
request_id = kwargs["request_id"] # type: int
group_id = kwargs.get("group_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
members = group.my_members()
my_role = user_role(self.current_user, members)
if my_role not in ("manager", "owner", "np-owner"):
return self.forbidden()
request = self.session.query(Request).filter_by(id=request_id).scalar()
if not request:
return self.notfound()
on_behalf = get_on_behalf_by_request(self.session, request)
form = GroupRequestModifyForm(self.request.arguments)
form.status.choices = self._get_choices(request.status)
updates = request.my_status_updates()
if not form.status.choices:
alerts = [Alert("info", "Request has already been processed")]
return self.render(
"group-request-update.html",
group=group,
request=request,
on_behalf=on_behalf,
members=members,
form=form,
alerts=alerts,
statuses=REQUEST_STATUS_CHOICES,
updates=updates,
)
if not form.validate():
return self.render(
"group-request-update.html",
group=group,
request=request,
on_behalf=on_behalf,
members=members,
form=form,
alerts=self.get_form_alerts(form.errors),
statuses=REQUEST_STATUS_CHOICES,
updates=updates,
)
# We have to test this here, too, to ensure that someone can't sneak in with a pending
# request that used to be allowed.
if form.data["status"] != "cancelled":
fail_message = "This join is denied with this role at this time."
try:
user_can_join = assert_can_join(
request.requesting, on_behalf, role=request.edge.role
)
except UserNotAuditor as e:
user_can_join = False
fail_message = str(e)
if not user_can_join:
return self.render(
"group-request-update.html",
group=group,
request=request,
on_behalf=on_behalf,
members=members,
form=form,
statuses=REQUEST_STATUS_CHOICES,
updates=updates,
alerts=[Alert("danger", fail_message, "Audit Policy Enforcement")],
)
request.update_status(self.current_user, form.data["status"], form.data["reason"])
self.session.commit()
AuditLog.log(
self.session,
self.current_user.id,
"update_request",
"Updated request to status: {}".format(form.data["status"]),
on_group_id=group.id,
on_user_id=request.requester.id,
)
edge = self.session.query(GroupEdge).filter_by(id=request.edge_id).one()
approver_mail_to = [
user.name
for user in group.my_approver_users()
if user.name != self.current_user.name and user.name != request.requester.username
]
subj = "Re: " + self.render_template(
"email/pending_request_subj.tmpl", group=group.name, user=request.requester.username
)
send_email(
self.session,
approver_mail_to,
subj,
"approver_request_updated",
settings(),
{
"group_name": group.name,
"requester": request.requester.username,
"changed_by": self.current_user.name,
"status": form.data["status"],
"role": edge.role,
"reason": form.data["reason"],
"references_header": request.reference_id,
},
)
if form.data["status"] == "actioned":
send_email(
self.session,
[request.requester.name],
"Added to group: {}".format(group.groupname),
"request_actioned",
settings(),
{
"group_name": group.name,
"actioned_by": self.current_user.name,
"reason": form.data["reason"],
"expiration": edge.expiration,
"role": edge.role,
},
)
elif form.data["status"] == "cancelled":
send_email(
self.session,
[request.requester.name],
"Request to join cancelled: {}".format(group.groupname),
"request_cancelled",
settings(),
{
"group_name": group.name,
"cancelled_by": self.current_user.name,
"reason": form.data["reason"],
"expiration": edge.expiration,
"role": edge.role,
},
)
# No explicit refresh because handler queries SQL.
if form.data["redirect_aggregate"]:
return self.redirect("/user/requests")
else:
return self.redirect("/groups/{}/requests".format(group.name))
def update_request(session, request, user, new_status, comment):
"""Update a request.
Args:
session(sqlalchemy.orm.session.Session): database session
request(models.PermissionRequest): request to update
user(models.User): user making update
new_status(models.base.constants.REQUEST_STATUS_CHOICES): new status
comment(str): comment to include with status change
Raises:
grouper.audit.UserNotAuditor in case we're trying to add an audited
permission to a group without auditors
"""
if request.status == new_status:
# nothing to do
return
# make sure the grant can happen
if new_status == "actioned":
if request.permission.audited:
# will raise UserNotAuditor if no auditors are owners of the group
assert_controllers_are_auditors(request.group)
# all rows we add have the same timestamp
now = datetime.utcnow()
# new status change row
permission_status_change = PermissionRequestStatusChange(
request=request,
user_id=user.id,
from_status=request.status,
to_status=new_status,
change_at=now,
).add(session)
session.flush()
# new comment
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=permission_status_change.id,
user_id=user.id,
comment=comment,
created_on=now,
).add(session)
# update permissionRequest status
request.status = new_status
session.commit()
if new_status == "actioned":
# actually grant permission
try:
grant_permission(session, request.group.id, request.permission.id, request.argument)
except IntegrityError:
session.rollback()
# audit log
AuditLog.log(
session, user.id, "update_perm_request",
"updated permission request to status: {}".format(new_status),
on_group_id=request.group_id, on_user_id=request.requester_id,
on_permission_id=request.permission.id,
)
session.commit()
# send notification
subj_template = 'email/pending_permission_request_subj.tmpl'
subject = "Re: " + get_template_env().get_template(subj_template).render(
permission=request.permission.name, group=request.group.name
)
if new_status == "actioned":
email_template = "permission_request_actioned"
else:
email_template = "permission_request_cancelled"
email_context = {
'group_name': request.group.name,
'action_taken_by': user.name,
'reason': comment,
'permission_name': request.permission.name,
'argument': request.argument,
}
send_email(session, [request.requester.name], subject, email_template,
settings, email_context)
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
group_id = kwargs.get("group_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
group = Group.get(self.session, group_id, name)
if not group or not group.enabled:
return self.notfound()
members = group.my_members()
member_groups = {g for t, g in members if t == "Group"}
user_is_member = self._is_user_a_member(group, members)
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group, member_groups,
user_is_member)
if not form.validate():
return self.render("group-join.html",
form=form,
group=group,
alerts=self.get_form_alerts(form.errors))
member = self._get_member(form.data["member"])
if not member:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert(
"danger", "Unknown user or group: {}".format(
form.data["member"]))
],
)
fail_message = "This join is denied with this role at this time."
try:
user_can_join = assert_can_join(group,
member,
role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = str(e)
if not user_can_join:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert("danger", fail_message, "Audit Policy Enforcement")
],
)
if group.canjoin == "nobody":
fail_message = "This group cannot be joined at this time."
return self.render("group-join.html",
form=form,
group=group,
alerts=[Alert("danger", fail_message)])
if group.require_clickthru_tojoin:
if not form.data["clickthru_agreement"]:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert(
"danger",
"please accept review of the group's description",
"Clickthru Enforcement",
)
],
)
# We only use the default expiration time if no expiration time was given
# This does mean that if a user wishes to join a group with no expiration
# (even with an owner's permission) that has an auto expiration, they must
# first be accepted to the group and then have the owner edit the user to
# have no expiration.
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
elif group.auto_expire:
expiration = datetime.utcnow() + group.auto_expire
request = group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=GROUP_JOIN_CHOICES[group.canjoin],
expiration=expiration,
role=form.data["role"],
)
self.session.commit()
if group.canjoin == "canask":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} requested to join with role: {}".format(
member.name, form.data["role"]),
on_group_id=group.id,
)
mail_to = [
user.name for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ("manager", "owner",
"np-owner")
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"request_id": request.id,
"group_name": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
"references_header": request.reference_id,
}
subj = self.render_template("email/pending_request_subj.tmpl",
group=group.name,
user=self.current_user.name)
send_email(self.session, mail_to, subj, "pending_request",
settings(), email_context)
elif group.canjoin == "canjoin":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} auto-approved to join with role: {}".format(
member.name, form.data["role"]),
on_group_id=group.id,
)
else:
raise Exception("Need to update the GroupJoin.post audit logging")
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self):
form = AuditCreateForm(self.request.arguments)
if not form.validate():
return self.render(
"audit-create.html", form=form,
alerts=self.get_form_alerts(form.errors)
)
user = self.get_current_user()
if not user.has_permission(AUDIT_MANAGER):
return self.forbidden()
# Step 1, detect if there are non-completed audits and fail if so.
open_audits = self.session.query(Audit).filter(
Audit.complete == False).all()
if open_audits:
raise Exception("Sorry, there are audits in progress.")
ends_at = datetime.strptime(form.data["ends_at"], "%m/%d/%Y")
# Step 2, find all audited groups and schedule audits for each.
audited_groups = []
for groupname in self.graph.groups:
if not self.graph.get_group_details(groupname)["audited"]:
continue
group = Group.get(self.session, name=groupname)
audit = Audit(
group_id=group.id,
ends_at=ends_at,
)
try:
audit.add(self.session)
self.session.flush()
except IntegrityError:
self.session.rollback()
raise Exception("Failed to start the audit. Please try again.")
# Update group with new audit
audited_groups.append(group)
group.audit_id = audit.id
# Step 3, now get all members of this group and set up audit rows for those edges.
for member in group.my_members().values():
auditmember = AuditMember(
audit_id=audit.id, edge_id=member.edge_id
)
try:
auditmember.add(self.session)
except IntegrityError:
self.session.rollback()
raise Exception("Failed to start the audit. Please try again.")
self.session.commit()
AuditLog.log(self.session, self.current_user.id, 'start_audit',
'Started global audit.', category=AuditLogCategory.audit)
# Calculate schedule of emails, basically we send emails at various periods in advance
# of the end of the audit period.
schedule_times = []
not_before = datetime.utcnow() + timedelta(1)
for days_prior in (28, 21, 14, 7, 3, 1):
email_time = ends_at - timedelta(days_prior)
email_time.replace(hour=17, minute=0, second=0)
if email_time > not_before:
schedule_times.append((days_prior, email_time))
# Now send some emails. We do this separately/later to ensure that the audits are all
# created. Email notifications are sent multiple times if group audits are still
# outstanding.
for group in audited_groups:
mail_to = [
member.name
for member in group.my_users()
if GROUP_EDGE_ROLES[member.role] in ('owner', 'np-owner')
]
send_email(self.session, mail_to, 'Group Audit: {}'.format(group.name), 'audit_notice',
settings, {"group": group.name, "ends_at": ends_at})
for days_prior, email_time in schedule_times:
send_async_email(
self.session,
mail_to,
'Group Audit: {} - {} day(s) left'.format(group.name, days_prior),
'audit_notice_reminder',
settings,
{
"group": group.name,
"ends_at": ends_at,
"days_left": days_prior,
},
email_time,
async_key='audit-{}'.format(group.id),
)
return self.redirect("/audits")
def create_request(session: Session, user: User, group: Group,
permission: Permission, argument: str,
reason: str) -> PermissionRequest:
"""Creates an permission request and sends notification to the responsible approvers.
Args:
session: Database session
user: User requesting permission
group: Group requested permission would be applied to
permission: Permission in question to request
argument: argument for the given permission
reason: reason the permission should be granted
Raises:
RequestAlreadyExists: Trying to create a request that is already pending
NoOwnersAvailable: No owner is available for the requested perm + arg.
grouper.audit.UserNotAuditor: The group has owners that are not auditors
"""
# check if group already has perm + arg pair
for _, existing_perm_name, _, existing_perm_argument, _ in group.my_permissions(
):
if permission.name == existing_perm_name and argument == existing_perm_argument:
raise RequestAlreadyGranted()
# check if request already pending for this perm + arg pair
existing_count = (session.query(PermissionRequest).filter(
PermissionRequest.group_id == group.id,
PermissionRequest.permission_id == permission.id,
PermissionRequest.argument == argument,
PermissionRequest.status == "pending",
).count())
if existing_count > 0:
raise RequestAlreadyExists()
# determine owner(s)
owners_by_arg_by_perm = get_owners_by_grantable_permission(
session, separate_global=True)
owner_arg_list = get_owner_arg_list(
session,
permission,
argument,
owners_by_arg_by_perm=owners_by_arg_by_perm)
if not owner_arg_list:
raise NoOwnersAvailable()
if permission.audited:
# will raise UserNotAuditor if any owner of the group is not an auditor
assert_controllers_are_auditors(group)
pending_status = "pending"
now = datetime.utcnow()
# multiple steps to create the request
request = PermissionRequest(
requester_id=user.id,
group_id=group.id,
permission_id=permission.id,
argument=argument,
status=pending_status,
requested_at=now,
).add(session)
session.flush()
request_status_change = PermissionRequestStatusChange(
request=request, user=user, to_status=pending_status,
change_at=now).add(session)
session.flush()
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=request_status_change.id,
user_id=user.id,
comment=reason,
created_on=now,
).add(session)
# send notification
email_context = {
"user_name": user.name,
"group_name": group.name,
"permission_name": permission.name,
"argument": argument,
"reason": reason,
"request_id": request.id,
"references_header": request.reference_id,
}
# TODO: would be nicer if it told you which group you're an approver of
# that's causing this notification
mail_to = []
global_owners = owners_by_arg_by_perm[GLOBAL_OWNERS]["*"]
non_wildcard_owners = [
grant for grant in owner_arg_list if grant[1] != "*"
]
non_global_owners = [
grant for grant in owner_arg_list if grant[0] not in global_owners
]
if any(non_wildcard_owners):
# non-wildcard owners should get all the notifications
mailto_owner_arg_list = non_wildcard_owners
elif any(non_global_owners):
mailto_owner_arg_list = non_global_owners
else:
# only the wildcards so they get the notifications
mailto_owner_arg_list = owner_arg_list
for owner, arg in mailto_owner_arg_list:
if owner.email_address:
mail_to.append(owner.email_address)
else:
mail_to.extend([u for t, u in owner.my_members() if t == "User"])
template_engine = EmailTemplateEngine(settings())
subject_template = template_engine.get_template(
"email/pending_permission_request_subj.tmpl")
subject = subject_template.render(permission=permission.name,
group=group.name)
send_email(session, set(mail_to), subject, "pending_permission_request",
settings(), email_context)
return request
def create_request(session, user, group, permission, argument, reason):
"""
Creates an permission request and sends notification to the responsible approvers.
Args:
session(sqlalchemy.orm.session.Session): database session
user(models.User): user requesting permission
group(models.Group): group requested permission would be applied to
permission(models.Permission): permission in question to request
argument(str): argument for the given permission
reason(str): reason the permission should be granted
Raises:
RequestAlreadyExists if trying to create a request that is already pending
NoOwnersAvailable if no owner is available for the requested perm + arg.
"""
# check if group already has perm + arg pair
for _, existing_perm_name, _, existing_perm_argument, _ in group.my_permissions():
if permission.name == existing_perm_name and argument == existing_perm_argument:
raise RequestAlreadyGranted()
# check if request already pending for this perm + arg pair
existing_count = session.query(PermissionRequest).filter(
PermissionRequest.group_id == group.id,
PermissionRequest.permission_id == permission.id,
PermissionRequest.argument == argument,
PermissionRequest.status == "pending",
).count()
if existing_count > 0:
raise RequestAlreadyExists()
# determine owner(s)
owner_arg_list = get_owner_arg_list(session, permission, argument)
if not owner_arg_list:
raise NoOwnersAvailable()
pending_status = "pending"
now = datetime.utcnow()
# multiple steps to create the request
request = PermissionRequest(
requester_id=user.id,
group_id=group.id,
permission_id=permission.id,
argument=argument,
status=pending_status,
requested_at=now,
).add(session)
session.flush()
request_status_change = PermissionRequestStatusChange(
request=request,
user=user,
to_status=pending_status,
change_at=now,
).add(session)
session.flush()
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=request_status_change.id,
user_id=user.id,
comment=reason,
created_on=now,
).add(session)
# send notification
email_context = {
"user_name": user.name,
"group_name": group.name,
"permission_name": permission.name,
"argument": argument,
"reason": reason,
"request_id": request.id,
}
# TODO: would be nicer if it told you which group you're an approver of
# that's causing this notification
mail_to = []
non_wildcard_owners = [(owner, arg) for owner, arg in owner_arg_list if arg != "*"]
if any(non_wildcard_owners):
# non-wildcard owners should get all the notifications
mailto_owner_arg_list = non_wildcard_owners
else:
# only the wildcards so they get the notifications
mailto_owner_arg_list = owner_arg_list
for owner, arg in mailto_owner_arg_list:
mail_to += [u for t, u in owner.my_members() if t == 'User']
send_email(session, set(mail_to), "Request for permission: {}".format(permission.name),
"pending_permission_request", settings, email_context)
def create_request(session, user, group, permission, argument, reason):
"""
Creates an permission request and sends notification to the responsible approvers.
Args:
session(sqlalchemy.orm.session.Session): database session
user(models.User): user requesting permission
group(models.Group): group requested permission would be applied to
permission(models.Permission): permission in question to request
argument(str): argument for the given permission
reason(str): reason the permission should be granted
Raises:
RequestAlreadyExists if trying to create a request that is already pending
NoOwnersAvailable if no owner is available for the requested perm + arg.
"""
# check if group already has perm + arg pair
for _, existing_perm_name, _, existing_perm_argument, _ in group.my_permissions():
if permission.name == existing_perm_name and argument == existing_perm_argument:
raise RequestAlreadyGranted()
# check if request already pending for this perm + arg pair
existing_count = session.query(PermissionRequest).filter(
PermissionRequest.group_id == group.id,
PermissionRequest.permission_id == permission.id,
PermissionRequest.argument == argument,
PermissionRequest.status == "pending",
).count()
if existing_count > 0:
raise RequestAlreadyExists()
# determine owner(s)
owners_by_arg_by_perm = get_owners_by_grantable_permission(session, separate_global=True)
owner_arg_list = get_owner_arg_list(
session,
permission,
argument,
owners_by_arg_by_perm=owners_by_arg_by_perm,
)
if not owner_arg_list:
raise NoOwnersAvailable()
pending_status = "pending"
now = datetime.utcnow()
# multiple steps to create the request
request = PermissionRequest(
requester_id=user.id,
group_id=group.id,
permission_id=permission.id,
argument=argument,
status=pending_status,
requested_at=now,
).add(session)
session.flush()
request_status_change = PermissionRequestStatusChange(
request=request,
user=user,
to_status=pending_status,
change_at=now,
).add(session)
session.flush()
Comment(
obj_type=OBJ_TYPES_IDX.index("PermissionRequestStatusChange"),
obj_pk=request_status_change.id,
user_id=user.id,
comment=reason,
created_on=now,
).add(session)
# send notification
email_context = {
"user_name": user.name,
"group_name": group.name,
"permission_name": permission.name,
"argument": argument,
"reason": reason,
"request_id": request.id,
"references_header": request.reference_id,
}
# TODO: would be nicer if it told you which group you're an approver of
# that's causing this notification
mail_to = []
global_owners = owners_by_arg_by_perm[GLOBAL_OWNERS]["*"]
non_wildcard_owners = filter(lambda grant: grant[1] != '*', owner_arg_list)
non_global_owners = filter(lambda grant: grant[0] not in global_owners, owner_arg_list)
if any(non_wildcard_owners):
# non-wildcard owners should get all the notifications
mailto_owner_arg_list = non_wildcard_owners
elif any(non_global_owners):
mailto_owner_arg_list = non_global_owners
else:
# only the wildcards so they get the notifications
mailto_owner_arg_list = owner_arg_list
for owner, arg in mailto_owner_arg_list:
mail_to += [u for t, u in owner.my_members() if t == 'User']
subj = get_template_env().get_template('email/pending_permission_request_subj.tmpl').render(
permission=permission.name, group=group.name
)
send_email(session, set(mail_to), subj,
"pending_permission_request", settings, email_context)
return request
def post(self, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
if not self.current_user.can_manage(group):
return self.forbidden()
members = group.my_members()
my_role = self.current_user.my_role(members)
form = self.get_form(role=my_role)
if not form.validate():
return self.render(
"group-add.html", form=form, group=group,
alerts=self.get_form_alerts(form.errors)
)
member = get_user_or_group(self.session, form.data["member"])
if not member:
form.member.errors.append("User or group not found.")
elif (member.type, member.name) in group.my_members():
form.member.errors.append("User or group is already a member of this group.")
elif group.name == member.name:
form.member.errors.append("By definition, this group is a member of itself already.")
# Ensure this doesn't violate auditing constraints
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
form.member.errors.append(fail_message)
if form.member.errors:
return self.render(
"group-add.html", form=form, group=group,
alerts=self.get_form_alerts(form.errors)
)
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status='actioned',
expiration=expiration,
role=form.data["role"]
)
self.session.commit()
AuditLog.log(self.session, self.current_user.id, 'join_group',
'{} added to group with role: {}'.format(
member.name, form.data["role"]),
on_group_id=group.id)
if member.type == "User":
send_email(
self.session,
[member.name],
'Added to group: {}'.format(group.name),
'request_actioned',
settings,
{
'group': group.name,
'actioned_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': expiration,
'role': form.data['role'],
}
)
return self.redirect("/groups/{}?refresh=yes".format(group.name))
def post(self, request_id, group_id=None, name=None):
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
members = group.my_members()
my_role = user_role(self.current_user, members)
if my_role not in ("manager", "owner", "np-owner"):
return self.forbidden()
request = self.session.query(Request).filter_by(id=request_id).scalar()
if not request:
return self.notfound()
form = GroupRequestModifyForm(self.request.arguments)
form.status.choices = self._get_choices(request.status)
updates = request.my_status_updates()
if not form.validate():
return self.render("group-request-update.html",
group=group,
request=request,
members=members,
form=form,
alerts=self.get_form_alerts(form.errors),
statuses=REQUEST_STATUS_CHOICES,
updates=updates)
# We have to test this here, too, to ensure that someone can't sneak in with a pending
# request that used to be allowed.
if form.data["status"] != "cancelled":
fail_message = 'This join is denied with this role at this time.'
try:
user_can_join = assert_can_join(request.requesting,
request.get_on_behalf(),
role=request.edge.role)
except UserNotAuditor as e:
user_can_join = False
fail_message = e
if not user_can_join:
return self.render("group-request-update.html",
group=group,
request=request,
members=members,
form=form,
statuses=REQUEST_STATUS_CHOICES,
updates=updates,
alerts=[
Alert('danger', fail_message,
'Audit Policy Enforcement')
])
request.update_status(self.current_user, form.data["status"],
form.data["reason"])
self.session.commit()
AuditLog.log(self.session,
self.current_user.id,
'update_request',
'Updated request to status: {}'.format(
form.data["status"]),
on_group_id=group.id,
on_user_id=request.requester.id)
edge = self.session.query(GroupEdge).filter_by(
id=request.edge_id).one()
approver_mail_to = [
user.name for user in group.my_approver_users()
if user.name != self.current_user.name
and user.name != request.requester.username
]
send_email(
self.session,
approver_mail_to,
"Request to join {} by {} has been {}".format(
group.groupname, request.requester.name, form.data['status']),
"approver_request_updated",
settings,
{
'group_name': group.name,
'requester': request.requester.username,
'changed_by': self.current_user.name,
'status': form.data['status'],
'role': edge.role,
'reason': form.data['reason'],
},
)
if form.data['status'] == 'actioned':
send_email(
self.session, [request.requester.name],
'Added to group: {}'.format(group.groupname),
'request_actioned', settings, {
'group_name': group.name,
'actioned_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': edge.expiration,
'role': edge.role,
})
elif form.data['status'] == 'cancelled':
send_email(
self.session, [request.requester.name],
'Request to join cancelled: {}'.format(group.groupname),
'request_cancelled', settings, {
'group_name': group.name,
'cancelled_by': self.current_user.name,
'reason': form.data['reason'],
'expiration': edge.expiration,
'role': edge.role,
})
# No explicit refresh because handler queries SQL.
if form.data['redirect_aggregate']:
return self.redirect("/user/requests")
else:
return self.redirect("/groups/{}/requests".format(group.name))
def post(self, *args, **kwargs):
# type: (*Any, **Any) -> None
group_id = kwargs.get("group_id") # type: Optional[int]
name = kwargs.get("name") # type: Optional[str]
group = Group.get(self.session, group_id, name)
if not group:
return self.notfound()
form = GroupJoinForm(self.request.arguments)
form.member.choices = self._get_choices(group)
if not form.validate():
return self.render(
"group-join.html", form=form, group=group, alerts=self.get_form_alerts(form.errors)
)
member = self._get_member(form.data["member"])
if not member:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[Alert("danger", "Unknown user or group: {}".format(form.data["member"]))],
)
fail_message = "This join is denied with this role at this time."
try:
user_can_join = assert_can_join(group, member, role=form.data["role"])
except UserNotAuditor as e:
user_can_join = False
fail_message = str(e)
if not user_can_join:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[Alert("danger", fail_message, "Audit Policy Enforcement")],
)
if group.canjoin == "nobody":
fail_message = "This group cannot be joined at this time."
return self.render(
"group-join.html", form=form, group=group, alerts=[Alert("danger", fail_message)]
)
if group.require_clickthru_tojoin:
if not form.data["clickthru_agreement"]:
return self.render(
"group-join.html",
form=form,
group=group,
alerts=[
Alert(
"danger",
"please accept review of the group's description",
"Clickthru Enforcement",
)
],
)
# We only use the default expiration time if no expiration time was given
# This does mean that if a user wishes to join a group with no expiration
# (even with an owner's permission) that has an auto expiration, they must
# first be accepted to the group and then have the owner edit the user to
# have no expiration.
expiration = None
if form.data["expiration"]:
expiration = datetime.strptime(form.data["expiration"], "%m/%d/%Y")
elif group.auto_expire:
expiration = datetime.utcnow() + group.auto_expire
request = group.add_member(
requester=self.current_user,
user_or_group=member,
reason=form.data["reason"],
status=GROUP_JOIN_CHOICES[group.canjoin],
expiration=expiration,
role=form.data["role"],
)
self.session.commit()
if group.canjoin == "canask":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} requested to join with role: {}".format(member.name, form.data["role"]),
on_group_id=group.id,
)
mail_to = [
user.name
for user in group.my_users()
if GROUP_EDGE_ROLES[user.role] in ("manager", "owner", "np-owner")
]
email_context = {
"requester": member.name,
"requested_by": self.current_user.name,
"request_id": request.id,
"group_name": group.name,
"reason": form.data["reason"],
"expiration": expiration,
"role": form.data["role"],
"references_header": request.reference_id,
}
subj = self.render_template(
"email/pending_request_subj.tmpl", group=group.name, user=self.current_user.name
)
send_email(self.session, mail_to, subj, "pending_request", settings(), email_context)
elif group.canjoin == "canjoin":
AuditLog.log(
self.session,
self.current_user.id,
"join_group",
"{} auto-approved to join with role: {}".format(member.name, form.data["role"]),
on_group_id=group.id,
)
else:
raise Exception("Need to update the GroupJoin.post audit logging")
return self.redirect("/groups/{}?refresh=yes".format(group.name))
