def users_in_group(group_id):
'''
:return: 返回某个group下的所有用户信息
'''
checkexist = group_service.GroupService().get_group_info(group_id)
if not checkexist:
logging.info('no such group_id')
return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER)
params = {
'ORDER': [
['id', 'desc'],
],
'PAGINATION': {
'page_size': request.values.get('page_size', 20),
'page_no': request.values.get('page_no', 1),
}
}
total_nums, data = user_group_service.UserGroupService().get_alluser_group(
group_id)
resp = UsersGroup()
resp.total = total_nums
for i in data:
_user_group_info = user_group_info.UserGroupInfo().user_group_info(i)
resp.rows.append(_user_group_info)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS,
data=resp.to_json())
def check(group_id, user_id):
if not user_id or not group_id:
logging.info(
'no user_id or group_id or rold_id when add user to a group')
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
group_info = group_s.GroupService().get_group_info(group_id)
if not group_info[1]:
logging.info('no such group_id %s when add user to a group', group_id)
return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER)
user_group = user_g_s.UserGroupService().query_user_role_group(
user_id, group_id)
if user_group[1]:
logging.info(
'same user %s already in group %s when add user to a group',
user_id, group_id)
return json_helper.format_api_resp(code=ErrorCode.DUPLICATED_ERR,
msg='用户已经存在于该组，请不要重复加入')
params = {
'WHERE_AND': {
'=': {
'group_id': group_id,
}
}
}
is_exist_role_group = access_service.AccessService().query_info(params)
if not is_exist_role_group[1]:
# 查询access表中是否存在这个role-group的对应关系，(不查area)没有就报错
logging.info('not such role_group_area mapping exist')
return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER,
msg="该组没有角色权限对应关系，不能添加新用户")
def user_permisson(user_id):
'''
获取用户的所有操作权限
:param user_id:
:return: {u'instance': [u'create', u'delete', u'shutdown'],u'host':[u'create', u'delete']}
'''
user_permisson_list = []
user_group_nums, user_group_data = user_g_s.UserGroupService(
).get_allgroup_user(user_id)
# 新用户没有组
if user_group_nums <= 0:
return None
for _user_group in user_group_data:
_group_id = _user_group['group_id']
_group_name = _user_group['group_name']
# 通过group_id找到access表中对应的role_id，这里是默认一个组只有一个角色的
# _role_info = access_service.AccessService().get_one('group_id', _group_id)
num, _role_info = user_g_s.UserGroupService().get_user_role(
user_id, _group_id)
if num <= 0:
_role_id = None
else:
_role_id = _role_info[0]['role_id']
# 查询role_permission表中role_id对应的全部permission_id
_role_permission_list = role_service.RolePermissionService(
).role_permission_list(_role_id)
if _role_permission_list < 0:
return None
_host_list = []
_instance_list = []
_permission_dict = {}
for _i in _role_permission_list:
if _i.keys()[0] == 'instance':
_instance_list.append(_i.values()[0])
if _i.keys()[0] == 'host':
_host_list.append(_i.values()[0])
_permission_dict['instance'] = _instance_list
_permission_dict['host'] = _host_list
_permission_dict['role_id'] = _role_id
_permission_dict['group_id'] = _group_id
_permission_dict['group_name'] = _group_name
user_permisson_list.append(_permission_dict)
return user_permisson_list
def current_user_groups_by_userid(user_id):
'''
获取指定用户的所属应用组
:return:
'''
groups_list = []
user_groups_num, user_groups_data = user_g_s.UserGroupService(
).get_allgroup_user(user_id)
for _user_group in user_groups_data:
_group_num, _group_data = group_s.GroupService().get_group_info(
_user_group['group_id'])
if _group_num > 0:
groups_list.append(_group_data[0])
return groups_list
def init_group_info(group_id):
'''
用户编辑组时的初始化信息
:param group_id:
:return:
'''
resp = {}
group_tuple = group_s.GroupService().get_group_info(group_id)
group_dict = group_tuple[1][0]
area_list = group_area_info(group_id)
# role_info = access_service.AccessService().get_one('group_id', group_id)
# role_id = role_info['role_id']
num, role_info = user_g_s.UserGroupService().get_user_role(
group_dict['owner'], group_id)
if num <= 0:
role_id = None
else:
role_id = role_info[0]['role_id']
used_area = []
result_dict = {
'vm': group_dict['vm'],
'disk': group_dict['disk'],
'cpu': group_dict['cpu'],
'mem': group_dict['mem'],
'owner': group_dict['owner'],
'role_id': role_id,
'name': group_dict['name'],
'area_list': area_list,
'p_cluster_id': group_dict['p_cluster_id']
}
used_area.append(result_dict)
# used_area = group_init_info.GroupInitInfo().init_group_info(result_dict)
resp['used_area'] = used_area
ret_init = area.get_area_info()
for i in ret_init:
if i["parent_id"] == -1:
i["parent_id"] = i["id"]
i["parent_name"] = i["name"]
i["name"] = None
i["id"] = None
all_area = []
for i in ret_init:
all_area = []
resp['all_area'] = ret_init
return json_helper.format_api_resp(code=ErrorCode.SUCCESS, data=resp)
def add_insideuser_to_group(group_id):
'''
在user_group表中将顺丰用户添加到某个组
'''
user_id = request.values.get('user_id')
group_name = request.values.get('group_name')
check_info = check(group_id, user_id)
if check_info:
return check_info
params = {
'WHERE_AND': {
'=': {
'userid': user_id,
'auth_type': '0',
}
}
}
user_info = user_service.UserService().query_data(**params)
if not user_info or not user_info[1]:
user_name = ''
# logging.error("query user error, no such user_id:%s", str(user_id))
# return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER, msg="该用户请先登录平台，再来添加")
else:
user_name = user_info[1][0]['username']
user_group_data = user_g_s.get_data_by_group_name(group_name)
if not user_group_data:
logging.error(
"group %s role id no exist in db when add insideuser to group",
group_name)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
insert_user_data = {
'user_id': user_id,
'user_name': user_name,
'group_id': group_id,
'group_name': group_name,
'role_id': user_group_data['role_id'],
'status': '0',
'created_at': get_datetime_str()
}
ret = user_g_s.UserGroupService().add_user_group(insert_user_data)
if ret == -1:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS)
def group_list():
'''
查询组列表，不传参直接返回所有group列表，传参owner或者group_name筛选group列表
'''
search = request.values.get('search')
params = {
'WHERE_AND': {
'=': {
'isdeleted': '0'
},
'like': {
'name': None,
'owner': None,
'user_id': None
}
},
'page_size': request.values.get('page_size', 20),
'page_no': request.values.get('page_no', 1),
}
if search:
json_search = json.loads(search)
owner = json_search.get('owner')
if owner:
params['WHERE_AND']['like']['owner'] = '%' + owner + '%'
group_name = json_search.get('group_name')
if group_name:
params['WHERE_AND']['like']['name'] = '%' + group_name + '%'
user_id = json_search.get('user_id')
if user_id:
params['WHERE_AND']['like']['user_id'] = '%' + user_id + '%'
# 超级管理员组内的成员可以看到所有组
user_groups_num, user_groups_data = user_g_s.UserGroupService().get_allgroup_user(get_user()['user_id'])
super_group_flag = False
for _user_group in user_groups_data:
if _user_group['group_name'] == "supergroup":
super_group_flag = True
break
total_nums, data = group.user_group_list(get_user()['user_id'], is_super_group=super_group_flag, **params)
resp = GroupListResp()
resp.total = total_nums
for i in data:
_user_info = group_info.GroupInitInfo().init_from_db(i)
resp.rows.append(_user_info)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS, data=resp.to_json())
def current_user_group_ids():
'''
获取当前用户的所属应用组ID
:return:
'''
c_user = get_user()
c_user_id = c_user['user_id']
if not c_user_id:
return None
group_ids_list = []
user_groups_num, user_groups_data = user_g_s.UserGroupService(
).get_allgroup_user(c_user_id)
for _user_group in user_groups_data:
group_ids_list.append(_user_group['group_id'])
return list(set(group_ids_list))
def current_user_role_ids():
'''
获取当前用户的角色ID
:return:
'''
c_user = get_user()
c_user_id = c_user['user_id']
if not c_user_id:
return None
user_group_nums, user_group_data = user_g_s.UserGroupService(
).get_allgroup_user(c_user_id)
# 新用户没有组
if user_group_nums <= 0:
return None
role_ids_list = [user_group['role_id'] for user_group in user_group_data]
return list(set(role_ids_list))
def current_user_groups():
'''
获取当前用户的所属应用组
:return:
'''
c_user = get_user()
c_user_id = c_user['user_id']
if not c_user_id:
return None
groups_list = []
user_groups_num, user_groups_data = user_g_s.UserGroupService(
).get_allgroup_user(c_user_id)
for _user_group in user_groups_data:
_group_num, _group_data = group_s.GroupService().get_group_info(
_user_group['group_id'])
if _group_num > 0:
groups_list.append(_group_data[0])
return groups_list
def delete_user_group():
'''
将组中的某个用户删除
'''
user_id = request.values.get('user_id')
group_id = request.values.get('group_id')
if not user_id or not group_id:
logging.info('no user_id or group_id when delete user from a group')
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
user_group_num, user_group_data = user_g_s.UserGroupService(
).query_user_role_group(user_id, group_id)
if user_group_num < 0:
logging.info(
'no such user %s in group %s when delete user from a group',
user_id, group_id)
return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER)
groups_num, groups_data = group_s.GroupService().get_group_info(group_id)
if groups_num < 0:
logging.error('no group %s info in db when delete user from a group',
group_id)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
# 不能删除组所有者
if groups_data[0]['owner'] == user_id:
logging.warn(
'not allow delete group %s owner %s when delete user from a group',
group_id, user_id)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR,
msg='不能删除组的所有者!')
ret = user_g_s.delete_user(user_id, group_id)
if ret <= 0:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS)
def add_outuser_to_group(group_id):
'''
为某个组增加外部用户，需要插入tb_user表，user_group表
'''
user_id = request.values.get('user_id')
user_name = request.values.get('user_name')
password = request.values.get('password')
email = request.values.get('email')
group_name = request.values.get('group_name')
auth_type = request.values.get('auth_type')
if not user_name or not email or not password:
logging.info('not enough params when add outuser to a group')
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
check_info = check(group_id, user_id)
if check_info:
return check_info
# 检查用户ID是否已存在，如果已经存在，直接将该用户添加至组中
userid_exist = user_service.UserService().check_userid_exist(user_id,
auth_type=1)
if userid_exist:
# todo:如果已经存在，直接将该用户添加至组中
logging.error(
"user %s has exist in group %s when add outuser to a group",
user_id, group_id)
return json_helper.format_api_resp(code=ErrorCode.EXIST_USER,
msg='该用户ID已被使用，请更换新用户ID')
user_group_data = user_g_s.get_data_by_group_name(group_name)
if not user_group_data:
logging.error(
"group %s role id no exist in db when add outuser to group",
group_name)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
user_data = {
'userid': user_id,
'username': user_name,
'password': password,
'created_at': get_datetime_str(),
'email': email,
'auth_type': auth_type,
}
ret = user_service.UserService().add_user(user_data)
# 添加安全日志
field_data = {'User_name': user_name, 'Oper_type': 'add'}
# 先记录再返回
if ret == -1:
field_data.update({
'Oper_result': '0 Fail',
'fail_reason': 'insert new user info to db fail'
})
else:
field_data.update({'Oper_result': '1 Success'})
CloudLogger.audit(AuditType.USERMGR, field_data)
if ret == -1:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
user_group_data = {
'user_id': user_id,
'user_name': user_name,
'group_id': group_id,
'group_name': group_name,
'role_id': user_group_data['role_id'],
'status': '0',
'created_at': get_datetime_str(),
}
rest = user_g_s.UserGroupService().add_user_group(user_group_data)
if rest == -1:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS)
def add_group():
name = request.values.get('name')
owner = request.values.get('owner')
cpu = request.values.get('cpu')
mem = request.values.get('mem')
disk = request.values.get('disk')
vm = request.values.get('vm')
env = request.values.get('dc_type')
role_id = request.values.get('role_id')
area_str = request.values.get('area_str')
p_cluster_id = request.values.get('p_cluster_id')
if not name or not owner or not area_str or not str(env):
logging.info('no name or owner or area_str or env when add group')
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
role_exist = role_service.RoleService().query_role('id', role_id)
if not role_exist:
logging.info('no such role %s when add group', role_id)
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
# 应用组名不能重复
if _check_duplicated_group_name(name, str(env)):
logging.error('duplicated group name %s when add group', name)
return json_helper.format_api_resp(code=ErrorCode.DUPLICATED_ERR,
msg="应用组名不能重复，请更改应用组名!")
params_u = {
'WHERE_AND': {
'=': {
'userid': owner,
'isdeleted': '0',
},
},
}
user_num, user_data = user_s.UserService().query_data(**params_u)
if user_num <= 0:
username = ''
# 用户不存在，新增
user_data = {
'userid': owner,
'username': username,
'status': '0',
'created_at': get_datetime_str()
}
user_ret = user_s.UserService().add_user(user_data)
# 记录安全日志
field_data = {'User_name': owner or None, 'Oper_type': 'add'}
if user_ret.get('row_num') > 0:
field_data.update({'Oper_result': '1 Success'})
CloudLogger.audit(AuditType.USERMGR, field_data)
else:
field_data.update({
'Oper_result': '0 Fail',
'fail_reason': 'insert new user info to db fail'
})
CloudLogger.audit(AuditType.USERMGR, field_data)
return False, 'add new user info to db fail'
# logging.error('no user %s info when add group', owner)
# return json_helper.format_api_resp(code=ErrorCode.NOT_EXIST_USER, msg='不存在该用户，请检查用户ID')
else:
username = user_data[0]['username']
insert_data = {
'name': name,
'displayname': name,
'isdeleted': '0',
'owner': owner,
'cpu': cpu,
'mem': mem,
'disk': disk,
'vm': vm,
'dc_type': str(env),
'p_cluster_id': p_cluster_id,
'created_at': get_datetime_str()
}
ret = group_s.GroupService().add_group_info(insert_data)
if ret.get('row_num') <= 0:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
group_id = ret.get('last_id')
ret_result = access_service.add_access_list(int(group_id), int(role_id),
str(area_str))
if ret_result.get('row_num') <= 0:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
user_group_data = {
'user_id': owner,
'user_name': username,
'group_id': group_id,
'group_name': name,
'role_id': role_id,
'status': '0',
'created_at': get_datetime_str(),
'expire_at': get_datetime_str(), # todo
}
ret_u_g = user_g_s.UserGroupService().add_user_group(user_group_data)
if ret_u_g.get('row_num') <= 0:
logging.error(
'add user group info error when add group, insert_data:%s',
user_group_data)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS)
def update_group(group_id):
'''
修改应用组信息
:param group_id:
:return:
'''
name_n = request.values.get('name')
owner_n = request.values.get('owner')
cpu_n = request.values.get('cpu')
mem_n = request.values.get('mem')
disk_n = request.values.get('disk')
vm_n = request.values.get('vm')
area_str_n = request.values.get('area_str')
role_id_c = request.values.get('role_id')
p_cluster_id = request.values.get('p_cluster_id')
if not cpu_n or not mem_n or not disk_n or not vm_n or not area_str_n or not role_id_c:
logging.info('param is invalid when update group')
return json_helper.format_api_resp(code=ErrorCode.PARAM_ERR)
group_num_c, group_data_c = group_s.GroupService().get_group_info(group_id)
if group_num_c <= 0:
logging.error('no group %s info when update group', group_id)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
update_data = {
'cpu': cpu_n,
'mem': mem_n,
'disk': disk_n,
'vm': vm_n,
'updated_at': get_datetime_str()
}
# 只能超级管理员组成员和组所有者才能修改组名和所有者，超级管理员组ID为1
user_group_ids = current_user_group_ids()
if group_data_c[0]['owner'] != get_user(
)['user_id'] and 1 not in user_group_ids:
if name_n or owner_n:
logging.error(
'only allow super group member or group owner %s to update group %s name or owner',
group_data_c[0]['owner'], group_id)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR,
msg='您没有权限修改该应用组的组名和所有者!')
if name_n:
if group_data_c[0]['name'] != name_n and _check_duplicated_group_name(
name_n):
logging.error('duplicated group name %s when update group', name_n)
return json_helper.format_api_resp(code=ErrorCode.DUPLICATED_ERR,
msg="应用组名不能重复，请更改应用组名!")
update_data['name'] = name_n
if owner_n:
# 新所有者一定要在该应用组里
group_user_num, group_user_data = user_g_s.UserGroupService(
).get_alluser_group(group_id)
in_group_flag = False
for _group in group_user_data:
if _group['user_id'] == owner_n:
in_group_flag = True
break
if not in_group_flag:
logging.error(
'new owner %s must exist in group %s when update group',
owner_n, group_id)
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR,
msg='应用组新所有者必须属于该组，请先添加入组!')
update_data['owner'] = owner_n
if p_cluster_id:
update_data['p_cluster_id'] = p_cluster_id
where_data = {
'id': group_id,
}
ret = group_s.update_group_info(update_data, where_data)
if ret < 0:
logging.error("update group error, update_data:%s, where_data:%s",
str(update_data), str(where_data))
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
# 删除access中所有group_id的数据，然后插入前端提交的数据
delete_access = access.delete_access_info(group_id)
if delete_access < 0:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
ret_result = access_service.add_access_list(int(group_id), int(role_id_c),
str(area_str_n))
if ret_result < 0:
return json_helper.format_api_resp(code=ErrorCode.SYS_ERR)
return json_helper.format_api_resp(code=ErrorCode.SUCCESS)
def _user_group_check(env, sys_code, sys_opr_name, sys_opr_id, cluster_id):
# 检查应用系统管理员用户是否存在，不存在则新增
user = user_s.UserService().get_user_info_by_user_id(sys_opr_id)
if not user:
# 用户不存在，新增，并将用户锁定，待后续开放用户运维在解锁
user_data = {
'userid': sys_opr_id,
'username': sys_opr_name,
'status': '1',
'created_at': get_datetime_str()
}
user_ret = user_s.UserService().add_user(user_data)
# 记录安全日志
field_data = {'User_name': sys_opr_name or None, 'Oper_type': 'add'}
if user_ret.get('row_num') > 0:
field_data.update({'Oper_result': '1 Success'})
CloudLogger.audit(AuditType.USERMGR, field_data)
else:
field_data.update({
'Oper_result': '0 Fail',
'fail_reason': 'insert new user info to db fail'
})
CloudLogger.audit(AuditType.USERMGR, field_data)
return False, 'add new user info to db fail'
# 检查应用组是否存在，不存在新建
group = group_s.get_group_info_by_name_and_env(sys_code, env)
if not group:
group_data = {
'name': sys_code,
'displayname': sys_code,
'isdeleted': '0',
'dc_type': env,
'owner': sys_opr_id,
'cpu': 20000,
'mem': 40000,
'disk': 1000000,
'vm': 5000,
'p_cluster_id': cluster_id,
'created_at': get_datetime_str()
}
group_ret = group_s.GroupService().add_group_info(group_data)
if group_ret.get('row_num') <= 0:
return False, 'add group info to db fail'
group_id = group_ret.get('last_id')
role_id = 2
area_zb_ret = area_s.AreaService().get_area_zb_info()
if not area_zb_ret:
return False, 'get zongbu area id fail'
area_zb_id = area_zb_ret['id']
ret_result = access_service.add_access_list(int(group_id),
int(role_id),
str(area_zb_id))
if ret_result.get('row_num') <= 0:
return False, 'add access info to db fail'
user_group_data = {
'user_id': sys_opr_id,
'user_name': sys_opr_name,
'group_id': group_id,
'group_name': sys_code,
'role_id': role_id,
'status': '0',
'created_at': get_datetime_str(),
'expire_at': get_datetime_str(), # todo
}
ret_u_g = user_g_s.UserGroupService().add_user_group(user_group_data)
if ret_u_g.get('row_num') <= 0:
logging.error(
'add user group info error when add group, insert_data:%s',
user_group_data)
return False, 'add user group info to db fail'
else:
# 获取应用组对应用户信息
role_id = 2
opr_is_exist = False
group_id = group['id']
ret_num, ret_query_g_u = user_g_s.UserGroupService().get_alluser_group(
group_id)
for one_ret_query_g_u in ret_query_g_u:
if one_ret_query_g_u['user_id'] == sys_opr_id:
opr_is_exist = True
if not opr_is_exist:
# 将用户加入应用组中
user_group_data = {
'user_id': sys_opr_id,
'user_name': sys_opr_name,
'group_id': group_id,
'group_name': sys_code,
'role_id': role_id,
'status': '0',
'created_at': get_datetime_str(),
'expire_at': get_datetime_str(), # todo
}
ret_u_g = user_g_s.UserGroupService().add_user_group(
user_group_data)
if ret_u_g.get('row_num') <= 0:
logging.error(
'add user group info error when add group, insert_data:%s',
user_group_data)
return False, 'add user group info to db fail'
# 修改应用组owner
update_data = {'owner': sys_opr_id}
where_data = {
'id': group_id,
}
ret_change_owner = group_s.update_group_info(
update_data, where_data)
if ret_change_owner < 0:
logging.error(
"update group error, update_data:%s, where_data:%s",
str(update_data), str(where_data))
return False, 'update group owner to db fail'
return True, group_id