def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False, op_menu=False)
defaults = signature()[1]
client_dir = client_id_dir(client_id)
logger.debug('in peersaction: %s' % user_arguments_dict)
(validate_status, accepted) = validate_input(user_arguments_dict,
defaults,
output_objects,
allow_rejects=False)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
title_entry = find_entry(output_objects, 'title')
title_entry['text'] = 'Save Peers'
output_objects.append({'object_type': 'header', 'text': 'Save Peers'})
admin_email = configuration.admin_email
smtp_server = configuration.smtp_server
user_pending = os.path.abspath(configuration.user_pending)
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of peers permission
if not user_dict or \
not peers_permit_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to permit peers!" % client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can permit external peers!'
})
return (output_objects, returnvalues.CLIENT_ERROR)
action = accepted['action'][-1].strip()
label = accepted['peers_label'][-1].strip()
kind = accepted['peers_kind'][-1].strip()
raw_expire = accepted['peers_expire'][-1].strip()
peers_content = accepted['peers_content']
peers_format = accepted['peers_format'][-1].strip()
peers_invite = accepted['peers_invite'][-1].strip()
do_invite = (peers_invite.lower() in ['on', 'true', 'yes', '1'])
try:
expire = datetime.datetime.strptime(raw_expire, '%Y-%m-%d')
if datetime.datetime.now() > expire:
raise ValueError("specified expire value is in the past!")
except Exception as exc:
logger.error("expire %r could not be parsed into a (future) date" %
raw_expire)
output_objects.append({
'object_type':
'text',
'text':
'No valid expire provided - using default: %d days' %
default_expire_days
})
expire = datetime.datetime.now()
expire += datetime.timedelta(days=default_expire_days)
expire = expire.date().isoformat()
if not action in peer_actions:
output_objects.append({
'object_type':
'error_text',
'text':
'Unsupported peer action %r - only %s are allowed' %
(action, ', '.join(peer_actions))
})
return (output_objects, returnvalues.CLIENT_ERROR)
if not kind in peer_kinds:
output_objects.append({
'object_type':
'error_text',
'text':
'Unsupported peer kind %r - only %s are allowed' %
(kind, ', '.join(peer_kinds))
})
return (output_objects, returnvalues.CLIENT_ERROR)
# TODO: implement and enable more formats?
if peers_format not in ("csvform", 'userid'):
output_objects.append({
'object_type':
'error_text',
'text':
'Only Import Peers is implemented so far!'
})
return (output_objects, returnvalues.CLIENT_ERROR)
peers_path = os.path.join(configuration.user_settings, client_dir,
peers_filename)
try:
all_peers = load(peers_path)
except Exception as exc:
logger.warning("could not load peers from: %s" % exc)
all_peers = {}
# Extract peer(s) from request
(peers, err) = parse_peers(configuration, peers_content, peers_format)
if not err and not peers:
err = ["No valid peers provided"]
if err:
output_objects.append({
'object_type': 'error_text',
'text': 'Parsing failed: %s' % '.\n '.join(err)
})
output_objects.append({
'object_type': 'link',
'destination': 'peers.py',
'text': 'Back to peers'
})
return (output_objects, returnvalues.CLIENT_ERROR)
# NOTE: general cases of operation here:
# * import multiple peers in one go (add new, update existing)
# * add one or more new peers
# * update one or more existing peers
# * remove one or more existing peers
# * accept one or more pending requests
# * reject one or more pending requests
# The kind and expire values are generally applied for all included peers.
# NOTE: we check all peers before any action
for user in peers:
fill_distinguished_name(user)
peer_id = user['distinguished_name']
cur_peer = all_peers.get(peer_id, {})
if 'add' == action and cur_peer:
output_objects.append({
'object_type': 'error_text',
'text': 'Peer %r already exists!' % peer_id
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif 'update' == action and not cur_peer:
output_objects.append({
'object_type': 'error_text',
'text': 'Peer %r does not exists!' % peer_id
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif 'remove' == action and not cur_peer:
output_objects.append({
'object_type': 'error_text',
'text': 'Peer %r does not exists!' % peer_id
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif 'accept' == action and cur_peer:
output_objects.append({
'object_type': 'error_text',
'text': 'Peer %r already accepted!' % peer_id
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif 'reject' == action and cur_peer:
output_objects.append({
'object_type': 'error_text',
'text': 'Peer %r already accepted!' % peer_id
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif 'import' == action and cur_peer:
# Only warn on import with existing match
output_objects.append({
'object_type': 'text',
'text': 'Updating existing peer %r' % peer_id
})
# Now apply changes
for user in peers:
peer_id = user['distinguished_name']
cur_peer = all_peers.get(peer_id, {})
user.update({'label': label, 'kind': kind, 'expire': expire})
if 'add' == action:
all_peers[peer_id] = user
elif 'update' == action:
all_peers[peer_id] = user
elif 'remove' == action:
del all_peers[peer_id]
elif 'accept' == action:
all_peers[peer_id] = user
elif 'reject' == action:
pass
elif 'import' == action:
all_peers[peer_id] = user
logger.info("%s peer %s" % (action, peer_id))
try:
dump(all_peers, peers_path)
logger.debug('%s %s peers %s in %s' %
(client_id, action, all_peers, peers_path))
output_objects.append({
'object_type': 'text',
'text': "Completed %s peers" % action
})
for user in peers:
output_objects.append({
'object_type': 'text',
'text': "%(distinguished_name)s" % user
})
if action in ['import', 'add', 'update']:
client_name = extract_field(client_id, 'full_name')
client_email = extract_field(client_id, 'email')
if do_invite:
succeeded, failed = [], []
email_header = '%s Invitation' % configuration.short_title
email_msg_template = """Hi %%s,
This is an automatic email sent on behalf of %s who vouched for you to get a
user account on %s. You can accept the invitation by going to
%%s
entering a password of your choice and submitting the form.
If you do not want a user account you can safely ignore this email.
We would be grateful if you report any abuse of the invitation system to the
site administrators (%s).
""" % (client_name, configuration.short_title, admin_email)
for peer_user in peers:
peer_name = peer_user['full_name']
peer_email = peer_user['email']
peer_url = os.path.join(
configuration.migserver_https_sid_url, 'cgi-sid',
'reqoid.py')
peer_req = {}
for field in peers_fields:
peer_req[field] = peer_user.get(field, '')
peer_req['comment'] = 'Invited by %s (%s) for %s purposes' \
% (client_name, client_email, kind)
# Mark ID fields as readonly in the form to limit errors
peer_req['ro_fields'] = keyword_auto
peer_url += '?%s' % urllib.urlencode(peer_req)
email_msg = email_msg_template % (peer_name, peer_url)
logger.info(
'Sending invitation: to: %s, header: %s, msg: %s, smtp_server: %s'
% (peer_email, email_header, email_msg, smtp_server))
if send_email(peer_email, email_header, email_msg, logger,
configuration):
succeeded.append(peer_email)
else:
failed.append(peer_email)
if failed:
output_objects.append({
'object_type':
'error_text',
'text':
"""An error occured trying to email the peer
invitation to %s . Please inform the site admins (%s) if the problem persists.
""" % (', '.join(failed), admin_email)
})
if succeeded:
output_objects.append({
'object_type':
'text',
'text':
"""Sent invitation to %s with a link to a mostly pre-filled %s account request
form with the exact ID fields you provided here.""" %
(', '.join(succeeded), configuration.short_title)
})
else:
output_objects.append({
'object_type':
'text',
'text':
"""Please tell your peers
to request an account at %s with the exact ID fields you provided here and
importantly mentioning the purpose and your email (%s) in the sign up Comment
field. Alternatively you can use the invite button to send out an email with a
link to a mostly prefilled request form.""" %
(configuration.short_title, client_email)
})
except Exception as exc:
logger.error('Failed to save %s peers to %s: %s' %
(client_id, peers_path, exc))
output_objects.append({
'object_type':
'error_text',
'text':
'''
Could not %s peers %r. Please contact the site admins on %s if this error
persists.
''' % (action, label, admin_email)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
if action in ["accept", "reject"]:
changed = [(i['distinguished_name'], i) for i in peers]
if not manage_pending_peers(configuration, client_id, "remove",
changed):
logger.warning('could not update pending peers for %s after %s' %
(client_id, action))
logger.info('%s completed for %s peers for %s in %s' %
(action, label, client_id, peers_path))
user_lines = []
pretty_peers = {'label': label, 'kind': kind, 'expire': expire}
for user in peers:
user_lines.append(user['distinguished_name'])
pretty_peers['user_lines'] = '\n'.join(user_lines)
email_header = '%s Peers %s' % (configuration.short_title, action)
email_msg = """Received %s peers from %s
""" % (action, client_id)
email_msg += """
Kind: %(kind)s , Expire: %(expire)s, Label: %(label)s , Peers:
%(user_lines)s
""" % pretty_peers
logger.info('Sending email: to: %s, header: %s, msg: %s, smtp_server: %s' %
(admin_email, email_header, email_msg, smtp_server))
if not send_email(admin_email, email_header, email_msg, logger,
configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'''
An error occured trying to send the email about your %s peers to the site
administrators. Please manually inform them (%s) if the problem persists.
''' % (action, admin_email)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
'''
Informed the site admins about your %s peers action to let them accept peer
account requests you already validated.''' % action
})
output_objects.append({
'object_type': 'link',
'destination': 'peers.py',
'text': 'Back to peers'
})
return (output_objects, returnvalues.OK)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
client_dir = client_id_dir(client_id)
defaults = signature()[1]
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
logger.debug("User: %s executing %s", client_id, op_name)
if not configuration.site_enable_cloud:
output_objects.append(
{'object_type': 'error_text', 'text':
'The cloud service is not enabled on the system'})
return (output_objects, returnvalues.SYSTEM_ERROR)
status = returnvalues.OK
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional limitation of cloud access permission
if not user_dict or not cloud_access_allowed(configuration, user_dict):
output_objects.append(
{'object_type': 'error_text', 'text':
"You don't have permission to access the cloud facilities on "
"this site"})
return (output_objects, returnvalues.CLIENT_ERROR)
services = configuration.cloud_services
# Show cloud services menu
(add_import, add_init, add_ready) = man_base_js(configuration, [])
add_init += '''
function get_instance_id() {
console.log("in get_instance_id");
console.log("found val: "+$("#select-instance-id").val());
return $("#select-instance-id").val();
}
function get_instance_label() {
console.log("in get_instance_label");
console.log("found val: "+$("#select-instance-id > option:selected").text());
return $("#select-instance-id > option:selected").text();
}
'''
add_ready += '''
/* NOTE: requires managers CSS fix for proper tab bar height */
$(".cloud-tabs").tabs();
'''
title_entry = find_entry(output_objects, 'title')
title_entry['script']['advanced'] += add_import
title_entry['script']['init'] += add_init
title_entry['script']['ready'] += add_ready
output_objects.append({'object_type': 'html_form',
'text': man_base_html(configuration)})
output_objects.append({'object_type': 'header',
'text': 'Select a Cloud Service'})
fill_helpers = {
'cloud_tabs': ''.join(['<li><a href="#%s-tab">%s</a></li>' %
(service['service_name'],
service['service_title'])
for service in services])
}
output_objects.append({'object_type': 'html_form', 'text': '''
<div id="wrap-tabs" class="cloud-tabs">
<ul>
%(cloud_tabs)s
</ul>
''' % fill_helpers})
form_method = 'post'
csrf_limit = get_csrf_limit(configuration)
fill_helpers = {'site': configuration.short_title,
'form_method': form_method, 'csrf_field': csrf_field,
'csrf_limit': csrf_limit}
target_op = 'reqcloudservice'
csrf_token = make_csrf_token(configuration, form_method, target_op,
client_id, csrf_limit)
fill_helpers.update({'target_op': target_op, 'csrf_token': csrf_token})
action_list = [('start', 'Start'), ('stop', 'Stop'),
('softrestart', 'Soft boot'), ('hardrestart', 'Hard boot'),
('status', 'Status'),
# NOTE: expose console on status page
#('webaccess', 'Console'),
('updatekeys', 'Set keys on'),
('create', 'Create'), ('delete', 'Delete')]
# Delete instance form helper shared for all cloud services
helper = html_post_helper("%s" % target_op, '%s.py' % target_op,
{'instance_id': '__DYNAMIC__',
'service': '__DYNAMIC__',
'action': 'delete',
csrf_field: csrf_token})
output_objects.append({'object_type': 'html_form', 'text': helper})
for service in services:
logger.debug("service: %s" % service)
cloud_id = service['service_name']
cloud_title = service['service_title']
rules_of_conduct = service['service_rules_of_conduct']
cloud_flavor = service.get("service_provider_flavor", "openstack")
output_objects.append({'object_type': 'html_form',
'text': '''
<div id="%s-tab">
''' % cloud_id})
if service['service_desc']:
output_objects.append({'object_type': 'sectionheader',
'text': 'Service Description'})
output_objects.append({'object_type': 'html_form', 'text': '''
<div class="cloud-description">
<span>%s</span>
</div>
''' % service['service_desc']})
output_objects.append({'object_type': 'html_form', 'text': '''
<br/>
'''})
if not check_cloud_available(configuration, client_id, cloud_id,
cloud_flavor):
logger.error("Failed to connect to cloud: %s" % cloud_id)
output_objects.append(
{'object_type': 'error_text', 'text':
'The %s cloud service is currently unavailable' % \
cloud_title})
output_objects.append({'object_type': 'html_form', 'text': '''
</div>
'''})
status = returnvalues.SYSTEM_ERROR
continue
# Lookup user-specific allowed images (colon-separated image names)
allowed_images = allowed_cloud_images(configuration, client_id,
cloud_id, cloud_flavor)
if not allowed_images:
output_objects.append({
'object_type': 'error_text', 'text':
"No valid instance images for %s" % cloud_title})
output_objects.append({'object_type': 'html_form', 'text': '''
</div>
'''})
continue
fill_helpers.update({'cloud_id': cloud_id, 'cloud_title': cloud_title,
'target_op': target_op,
'rules_of_conduct': rules_of_conduct})
delete_html = ""
# Manage existing instances
saved_instances = cloud_load_instance(configuration, client_id,
cloud_id, keyword_all)
saved_fields = ['INSTANCE_IMAGE']
instance_fields = ['public_fqdn', 'status']
status_map = status_all_cloud_instances(
configuration, client_id, cloud_id, cloud_flavor,
saved_instances.keys(), instance_fields)
# TODO: halfwidth styling does not really work on select elements
delete_html += """
<div class='cloud-instance-delete fillwidth'>
<h3>Permanently delete a %(cloud_title)s cloud instance</h3>
<form class='delete-cloud-instance' target='#'>
<p class='cloud-instance-input fillwidth'>
<label class='fieldlabel halfwidth'>Instance</label>
<span class='halfwidth'>
<select id='select-instance-id'
class='styled-select html-select halfwidth padspace'
name='instance_id'>
""" % fill_helpers
output_objects.append({'object_type': 'html_form', 'text': """
<div class='cloud-management fillwidth'>
<h3>Manage %(cloud_title)s instances</h3>
<br/>
<div class='cloud-instance-grid'>
<div class='cloud-instance-grid-left'>
<label class='fieldlabel fieldheader'>Name</label>
</div>
<div class='cloud-instance-grid-middle'>
<label class='fieldlabel fieldheader'>Instance Details</label>
</div>
<div class='cloud-instance-grid-right'>
<label class='fieldlabel fieldheader'>Actions</label>
</div>
""" % fill_helpers})
for (instance_id, instance_dict) in saved_instances.items():
instance_label = instance_dict.get('INSTANCE_LABEL', instance_id)
logger.debug("Management entries for %s %s cloud instance %s" %
(client_id, cloud_id, instance_id))
instance_html = """
<div class='cloud-instance-grid-left'>
<label class='fieldlabel'>%s</label>
</div>
<div class='cloud-instance-grid-middle'>
""" % instance_label
for field in saved_fields:
field_val = saved_instances[instance_id].get(field, "-")
if field == 'INSTANCE_IMAGE':
for (img_name, _, img_alias) in allowed_images:
if img_name == field_val:
field_val = img_alias
instance_html += """
<span class='fieldstatus entry leftpad'>%s</span>
""" % field_val
for field in instance_fields:
field_val = status_map[instance_id].get(field, "-")
instance_html += """
<span class='fieldstatus entry leftpad'>%s</span>
""" % field_val
instance_html += """
</div>
<div class='cloud-instance-grid-right'>
"""
output_objects.append({'object_type': 'html_form', 'text': instance_html})
for (action, title) in action_list:
if action in cloud_edit_actions:
continue
query = 'action=%s;service=%s;instance_id=%s' % \
(action, cloud_id, instance_id)
url = 'reqcloudservice.py?%s' % query
#output_service = {
# 'object_type': 'service',
# 'name': "%s" % title,
# 'targetlink': url
#}
#output_objects.append(output_service)
output_objects.append({
'object_type': 'link', 'destination': url, 'text': title,
'class': 'ui-button',
'title': '%s %s' % (title, instance_label)})
output_objects.append({'object_type': 'html_form', 'text': """
</div>
"""})
delete_html += """<option value='%s'>%s</option>
""" % (instance_id, instance_label)
output_objects.append({'object_type': 'html_form', 'text': """
</div>
</div>
"""})
delete_html += """
</select>
</span>
</p>
<p class='fillwidth'>
<input type='submit' value='Delete Instance' onClick='javascript:confirmDialog(%(target_op)s, \"Really permanently delete your %(cloud_title)s \"+get_instance_label()+\" instance including all local data?\", undefined, {instance_id: get_instance_id(), service: \"%(cloud_id)s\"}); return false;' />
</p>
</form>
</div>
""" % fill_helpers
# Create new instance
create_html = """
<div class='cloud-instance-create fillwidth'>
<h3>Create a new %(cloud_title)s cloud instance</h3>
<form class='create_cloud_instance' method='%(form_method)s' action='%(target_op)s.py'>
<input type='hidden' name='%(csrf_field)s' value='%(csrf_token)s' />
<input type='hidden' name='service' value='%(cloud_id)s' />
<input type='hidden' name='action' value='create' />
<p class='cloud-instance-input fillwidth'>
<label class='fieldlabel halfwidth'>Label</label>
<span class='halfwidth'>
<input class='halfwidth padspace' type='text' name='instance_label' value='' />
</span>
</p>
<p class='cloud-instance-input fillwidth'>
<label class='fieldlabel halfwidth'>Image</label>
<span class='halfwidth'>
<select class='styled-select html-select halfwidth padspace' name='instance_image'>
"""
for (image_name, _, image_alias) in allowed_images:
create_html += """<option value='%s'>%s</option>
""" % (image_name, image_alias)
create_html += """
</select>
</span>
</p>
<p class='cloud-instance-input fillwidth'>
<label class='fieldlabel halfwidth'>
Accept <a href='%(rules_of_conduct)s'>Cloud Rules of Conduct</a>
</label>
<span class='halfwidth'>
<label class='switch'>
<input type='checkbox' mandatory name='accept_terms'>
<span class='slider round'></span></label>
</span>
</p>
<p class='fillwidth'>
<input type='submit' value='Create Instance' />
</p>
</form>
</div>
"""
output_objects.append({'object_type': 'html_form', 'text':
create_html % fill_helpers})
if saved_instances:
output_objects.append({'object_type': 'html_form', 'text':
delete_html % fill_helpers})
output_objects.append({'object_type': 'html_form', 'text': '''
</div>
'''})
output_objects.append({'object_type': 'html_form', 'text': '''
</div>
'''})
return (output_objects, status)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
title_entry = find_entry(output_objects, 'title')
label = "%s" % configuration.site_vgrid_label
title_entry['text'] = "Add %s Resource" % label
output_objects.append({
'object_type': 'header',
'text': 'Add %s Resource(s)' % label
})
status = returnvalues.OK
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
vgrid_name = accepted['vgrid_name'][-1].strip()
res_id_list = accepted['unique_resource_name']
request_name = unhexlify(accepted['request_name'][-1])
rank_list = accepted['rank'] + ['' for _ in res_id_list]
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of manage vgrid permission
if not user_dict or \
not vgrid_manage_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to manage vgrids!" % client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can manage %ss' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# make sure vgrid settings allow this owner to edit resources
(allow_status, allow_msg) = allow_resources_adm(configuration, vgrid_name,
client_id)
if not allow_status:
output_objects.append({'object_type': 'error_text', 'text': allow_msg})
return (output_objects, returnvalues.CLIENT_ERROR)
res_id_added = []
for (res_id, rank_str) in zip(res_id_list, rank_list):
unique_resource_name = res_id.lower().strip()
try:
rank = int(rank_str)
except ValueError:
rank = None
# Validity of user and vgrid names is checked in this init function so
# no need to worry about illegal directory traversal through variables
(ret_val, msg, ret_variables) = \
init_vgrid_script_add_rem(vgrid_name, client_id,
unique_resource_name, 'resource',
configuration)
if not ret_val:
output_objects.append({'object_type': 'error_text', 'text': msg})
status = returnvalues.CLIENT_ERROR
continue
elif msg:
# In case of warnings, msg is non-empty while ret_val remains True
output_objects.append({'object_type': 'warning', 'text': msg})
# don't add if already in vgrid or parent vgrid unless rank is given
if rank is None and vgrid_is_resource(vgrid_name, unique_resource_name,
configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'%s is already a resource in the %s' %
(unique_resource_name, label)
})
status = returnvalues.CLIENT_ERROR
continue
# don't add if already in subvgrid
(list_status,
subvgrids) = vgrid_list_subvgrids(vgrid_name, configuration)
if not list_status:
output_objects.append({
'object_type':
'error_text',
'text':
'Error getting list of sub%ss: %s' % (label, subvgrids)
})
status = returnvalues.SYSTEM_ERROR
continue
skip_entity = False
for subvgrid in subvgrids:
if vgrid_is_resource(subvgrid,
unique_resource_name,
configuration,
recursive=False):
output_objects.append({
'object_type': 'error_text',
'text': '''%(res_name)s is already in a
sub-%(vgrid_label)s (%(subvgrid)s). Please remove the resource from the
sub-%(vgrid_label)s and try again''' % {
'res_name': unique_resource_name,
'subvgrid': subvgrid,
'vgrid_label': label
}
})
status = returnvalues.CLIENT_ERROR
skip_entity = True
break
if skip_entity:
continue
# Check if only rank change was requested and apply if so
if rank is not None:
(add_status, add_msg) = vgrid_add_resources(configuration,
vgrid_name,
[unique_resource_name],
rank=rank)
if not add_status:
output_objects.append({
'object_type': 'error_text',
'text': add_msg
})
status = returnvalues.SYSTEM_ERROR
else:
output_objects.append({
'object_type':
'text',
'text':
'changed %s to resource %d' % (res_id, rank)
})
# No further action after rank change as everything else exists
continue
# Getting here means res_id is neither resource of any parent or
# sub-vgrids.
# Please note that base_dir must end in slash to avoid access to other
# vgrid dirs when own name is a prefix of another name
base_dir = os.path.abspath(configuration.vgrid_home + os.sep +
vgrid_name) + os.sep
resources_file = base_dir + 'resources'
# Add to list and pickle
(add_status, add_msg) = vgrid_add_resources(configuration, vgrid_name,
[unique_resource_name])
if not add_status:
output_objects.append({
'object_type': 'error_text',
'text': '%s' % add_msg
})
status = returnvalues.SYSTEM_ERROR
continue
res_id_added.append(unique_resource_name)
if request_name:
request_dir = os.path.join(configuration.vgrid_home, vgrid_name)
if not delete_access_request(configuration, request_dir, request_name):
logger.error("failed to delete res request for %s in %s" %
(vgrid_name, request_name))
output_objects.append({
'object_type':
'error_text',
'text':
'Failed to remove saved request for %s in %s!' %
(vgrid_name, request_name)
})
if res_id_added:
output_objects.append({
'object_type':
'html_form',
'text':
'New resource(s)<br />%s<br />successfully added to %s %s!'
'' % ('<br />'.join(res_id_added), vgrid_name, label)
})
res_id_fields = ''
for res_id in res_id_added:
res_id_fields += """
<input type=hidden name=unique_resource_name value='%s' />""" % res_id
form_method = 'post'
csrf_limit = get_csrf_limit(configuration)
fill_helpers = {
'vgrid_name': vgrid_name,
'unique_resource_name': unique_resource_name,
'protocol': any_protocol,
'short_title': configuration.short_title,
'vgrid_label': label,
'res_id_fields': res_id_fields,
'form_method': form_method,
'csrf_field': csrf_field,
'csrf_limit': csrf_limit
}
target_op = 'sendrequestaction'
csrf_token = make_csrf_token(configuration, form_method, target_op,
client_id, csrf_limit)
fill_helpers.update({'target_op': target_op, 'csrf_token': csrf_token})
output_objects.append({
'object_type':
'html_form',
'text':
"""
<form method='%(form_method)s' action='%(target_op)s.py'>
<input type='hidden' name='%(csrf_field)s' value='%(csrf_token)s' />
<input type=hidden name=request_type value='vgridaccept' />
<input type=hidden name=vgrid_name value='%(vgrid_name)s' />
%(res_id_fields)s
<input type=hidden name=protocol value='%(protocol)s' />
<table>
<tr>
<td class='title'>Custom message to resource owners</td>
</tr><tr>
<td><textarea name=request_text cols=72 rows=10>
We have granted your %(unique_resource_name)s resource access to our
%(vgrid_name)s %(vgrid_label)s.
You can assign it to accept jobs from the %(vgrid_name)s %(vgrid_label)s from
your Resources page on %(short_title)s.
Regards, the %(vgrid_name)s %(vgrid_label)s owners
</textarea></td>
</tr>
<tr>
<td><input type='submit' value='Inform owners' /></td>
</tr>
</table>
</form>
<br />
""" % fill_helpers
})
output_objects.append({
'object_type': 'link',
'destination': 'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text': 'Back to administration for %s' % vgrid_name
})
return (output_objects, returnvalues.OK)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
client_dir = client_id_dir(client_id)
defaults = signature()[1]
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
logger.debug("User: %s executing %s" % (client_id, op_name))
if not configuration.site_enable_cloud:
output_objects.append({
'object_type':
'error_text',
'text':
'The cloud service is not enabled on the system'
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type': 'header',
'text': 'Cloud Instance Management'
})
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional limitation of cload access vgrid permission
if not user_dict or not cloud_access_allowed(configuration, user_dict):
output_objects.append({
'object_type':
'error_text',
'text':
"You don't have permission to access the cloud facilities on "
"this site"
})
return (output_objects, returnvalues.CLIENT_ERROR)
return_status = returnvalues.OK
action = accepted['action'][-1]
# NOTE: instance_X may be empty list - fall back to empty string
instance_id = ([''] + accepted['instance_id'])[-1]
instance_label = ([''] + accepted['instance_label'])[-1]
instance_image = ([''] + accepted['instance_image'])[-1]
accept_terms = (([''] + accepted['accept_terms'])[-1] in ('yes', 'on'))
cloud_id = accepted['service'][-1]
service = {
k: v
for options in configuration.cloud_services
for k, v in options.items() if options['service_name'] == cloud_id
}
if not service:
valid_services = [
options['service_name'] for options in configuration.cloud_services
]
output_objects.append({
'object_type':
'error_text',
'text':
'%s is not among the valid cloud services: %s' %
(cloud_id, ', '.join(valid_services))
})
return (output_objects, returnvalues.CLIENT_ERROR)
valid_service = valid_cloud_service(configuration, service)
if not valid_service:
output_objects.append({
'object_type':
'error_text',
'text':
'The service %s appears to be misconfigured, '
'please contact a system administrator about this issue' % cloud_id
})
return (output_objects, returnvalues.SYSTEM_ERROR)
service_title = service['service_title']
if not action in valid_actions:
output_objects.append({
'object_type':
'error_text',
'text':
'%s is not a valid action '
'allowed actions include %s' % (action, ', '.join(valid_actions))
})
return (output_objects, returnvalues.CLIENT_ERROR)
elif action in cloud_edit_actions:
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
cloud_flavor = service.get("service_flavor", "openstack")
user_home_dir = os.path.join(configuration.user_home, client_dir)
client_email = extract_field(client_id, 'email')
if not client_email:
logger.error("could not extract client email for %s!" % client_id)
output_objects.append({
'object_type': 'error_text',
'text': "No client ID found - can't continue"
})
return (output_objects, returnvalues.SYSTEM_ERROR)
ssh_auth_msg = "Login requires your private key for your public key:"
instance_missing_msg = "Found no '%s' instance at %s. Please contact a " \
+ "site administrator if it should be there."
_label = instance_label
if instance_id and not _label:
_, _label, _ = cloud_split_instance_id(configuration, client_id,
instance_id)
if "create" == action:
if not accept_terms:
logger.error("refusing create without accepting terms for %s!" %
client_id)
output_objects.append({
'object_type':
'error_text',
'text':
"You MUST accept the cloud user terms to create instances"
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Load all instances and make sure none contains label in ID
saved_instances = cloud_load_instance(configuration, client_id,
cloud_id, keyword_all)
for (saved_id, instance) in saved_instances.items():
if instance_label == instance.get('INSTANCE_LABEL', saved_id):
logger.error("Refused %s re-create %s cloud instance %s!" %
(client_id, cloud_id, instance_label))
output_objects.append({
'object_type':
'error_text',
'text':
"You already have an instance with the label '%s'!" %
instance_label
})
return (output_objects, returnvalues.CLIENT_ERROR)
max_instances = lookup_user_service_value(
configuration, client_id, service, 'service_max_user_instances')
max_user_instances = int(max_instances)
# NOTE: a negative max value means unlimited but 0 or more is enforced
if max_user_instances >= 0 and \
len(saved_instances) >= max_user_instances:
logger.error("Refused %s create additional %s cloud instances!" %
(client_id, cloud_id))
output_objects.append({
'object_type':
'error_text',
'text':
"You already have the maximum allowed %s instances (%d)!" %
(service_title, max_user_instances)
})
return (output_objects, returnvalues.CLIENT_ERROR)
if not instance_label:
logger.error("Refused %s create unlabelled %s cloud instance!" %
(client_id, cloud_id))
output_objects.append({
'object_type': 'error_text',
'text': "No instance label provided!"
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Lookup user-specific allowed images (colon-separated image names)
allowed_images = allowed_cloud_images(configuration, client_id,
cloud_id, cloud_flavor)
if not allowed_images:
output_objects.append({
'object_type':
'error_text',
'text':
"No valid / allowed cloud images found!"
})
return (output_objects, returnvalues.CLIENT_ERROR)
if not instance_image:
instance_image = allowed_images[0]
logger.info("No image specified - using first for %s in %s: %s" %
(client_id, cloud_id, instance_image))
image_id = None
for (img_name, img_id, img_alias) in allowed_images:
if instance_image == img_name:
image_id = img_id
break
if not image_id:
logger.error("No matching image ID found for %s in %s: %s" %
(client_id, cloud_id, instance_image))
output_objects.append({
'object_type':
'error_text',
'text':
"No such image found: %s" % instance_image
})
return (output_objects, returnvalues.CLIENT_ERROR)
# TODO: remove this direct key injection if we can delay it
cloud_settings = load_cloud(client_id, configuration)
raw_keys = cloud_settings.get('authkeys', '').split('\n')
auth_keys = [i.split('#', 1)[0].strip() for i in raw_keys]
auth_keys = [i for i in auth_keys if i]
if not auth_keys:
logger.error("No cloud pub keys setup for %s - refuse create" %
client_id)
output_objects.append({
'object_type':
'error_text',
'text':
"""
You haven't provided any valid ssh pub key(s) for cloud instance login, which
is stricly required for all use. Please do so before you try again.
"""
})
output_objects.append({
'object_type': 'link',
'destination': 'setup.py?topic=cloud',
'text': 'Open cloud setup',
'class': 'cloudsetuplink iconspace',
'title': 'open cloud setup',
'target': '_blank'
})
return (output_objects, returnvalues.CLIENT_ERROR)
logger.debug("Continue create for %s with auth_keys: %s" %
(client_id, auth_keys))
# Create a new internal keyset and session id
(priv_key, pub_key) = generate_ssh_rsa_key_pair(encode_utf8=True)
session_id = generate_random_ascii(session_id_bytes,
charset='0123456789abcdef')
# We make sure to create instance with a globally unique ID on the
# cloud while only showing the requested instance_label to the user.
instance_id = cloud_build_instance_id(configuration, client_email,
instance_label, session_id)
# TODO: make more fields flexible/conf
cloud_dict = {
'INSTANCE_ID': instance_id,
'INSTANCE_LABEL': instance_label,
'INSTANCE_IMAGE': instance_image,
'IMAGE_ID': image_id,
'AUTH_KEYS': auth_keys,
'USER_CERT': client_id,
'INSTANCE_PRIVATE_KEY': priv_key,
'INSTANCE_PUBLIC_KEY': pub_key,
# don't need fraction precision, also not all systems provide fraction
# precision.
'CREATED_TIMESTAMP': int(time.time()),
# Init unset ssh address and leave for floating IP assigment below
'INSTANCE_SSH_IP': '',
'INSTANCE_SSH_PORT': 22,
}
(action_status,
action_msg) = create_cloud_instance(configuration, client_id,
cloud_id, cloud_flavor,
instance_id, image_id, auth_keys)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, instance_label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# On success the action_msg contains the assigned floating IP address
instance_ssh_fqdn = action_msg
cloud_dict['INSTANCE_SSH_IP'] = instance_ssh_fqdn
if not cloud_save_instance(configuration, client_id, cloud_id,
instance_id, cloud_dict):
logger.error("save new %s cloud instance %s for %s failed" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
'Error saving your %s cloud instance setup' % service_title
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, instance_label, service_title, "success")
})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, cloud_dict,
instance_id)
})
elif "delete" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to delete" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = delete_cloud_instance(configuration, client_id,
cloud_id, cloud_flavor,
instance_id)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
if not cloud_purge_instance(configuration, client_id, cloud_id,
instance_id):
logger.error("purge %s cloud instance %s for %s failed" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
'Error deleting your %s cloud instance setup' % service_title
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, "success")
})
elif "status" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to query" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = status_of_cloud_instance(configuration, client_id,
cloud_id, cloud_flavor,
instance_id)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, action_msg)
})
# Show instance access details if running
if action_msg in ('ACTIVE', 'RUNNING'):
# Only include web console if explicitly configured
if configuration.user_cloud_console_access:
(console_status, console_msg) = web_access_cloud_instance(
configuration, client_id, cloud_id, cloud_flavor,
instance_id)
if not console_status:
logger.error(
"%s cloud instance %s console for %s failed: %s" % \
(cloud_id, instance_id, client_id, console_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Failed to get instance %s at %s console: %s' %
(_label, service_title, console_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
logger.info("%s cloud instance %s console for %s: %s" %
(cloud_id, instance_id, client_id, console_msg))
output_objects.append({
'object_type': 'link',
'destination': console_msg,
'text': 'Open web console',
'class': 'consolelink iconspace',
'title': 'open web console',
'target': '_blank'
})
output_objects.append({'object_type': 'text', 'text': ''})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, saved_instance,
instance_id)
})
output_objects.append({'object_type': 'text', 'text': ''})
elif "start" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to start" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = start_cloud_instance(configuration, client_id, cloud_id,
cloud_flavor, instance_id)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, "success")
})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, saved_instance,
instance_id)
})
elif action in ("softrestart", "hardrestart"):
boot_strength = action.replace("restart", "").upper()
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to restart" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = restart_cloud_instance(configuration, client_id,
cloud_id, cloud_flavor,
instance_id, boot_strength)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, "success")
})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, saved_instance,
instance_id)
})
elif "stop" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to %s" %
(cloud_id, instance_id, client_id, action))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = stop_cloud_instance(configuration, client_id, cloud_id,
cloud_flavor, instance_id)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, "success")
})
elif "webaccess" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to query" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
if not configuration.user_cloud_console_access:
logger.error("web console not enabled in conf!")
output_objects.append({
'object_type':
'error_text',
'text':
'Site does not expose cloud web console!'
})
return (output_objects, returnvalues.CLIENT_ERROR)
(action_status,
action_msg) = web_access_cloud_instance(configuration, client_id,
cloud_id, cloud_flavor,
instance_id)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, service_title, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s" % (action, _label, service_title)
})
output_objects.append({
'object_type': 'link',
'destination': action_msg,
'text': 'Open web console',
'class': 'consolelink iconspace',
'title': 'open web console',
'target': '_blank'
})
output_objects.append({'object_type': 'text', 'text': ''})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, saved_instance,
instance_id)
})
elif "updatekeys" == action:
saved_instance = cloud_load_instance(configuration, client_id,
cloud_id, instance_id)
if not saved_instance:
logger.error("no saved %s cloud instance %s for %s to update" %
(cloud_id, instance_id, client_id))
output_objects.append({
'object_type':
'error_text',
'text':
instance_missing_msg % (_label, service_title)
})
return (output_objects, returnvalues.CLIENT_ERROR)
cloud_settings = load_cloud(client_id, configuration)
auth_keys = cloud_settings.get('authkeys', '').split('\n')
(action_status,
action_msg) = update_cloud_instance_keys(configuration, client_id,
cloud_id, cloud_flavor,
instance_id, auth_keys)
if not action_status:
logger.error(
"%s %s cloud instance %s for %s failed: %s" %
(action, cloud_id, instance_id, client_id, action_msg))
output_objects.append({
'object_type':
'error_text',
'text':
'Your %s instance %s at %s did not succeed: %s' %
(action, _label, service_title, action_msg)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
"%s instance %s at %s: %s" %
(action, _label, service_title, "success")
})
output_objects.append({
'object_type':
'html_form',
'text':
_ssh_help(configuration, client_id, cloud_id, saved_instance,
instance_id)
})
output_objects.append({'object_type': 'text', 'text': ssh_auth_msg})
for pub_key in auth_keys:
output_objects.append({'object_type': 'text', 'text': pub_key})
else:
output_objects.append({
'object_type': 'error_text',
'text': 'Unknown action: %s' % action
})
return_status = returnvalues.CLIENT_ERROR
output_objects.append({
'object_type': 'link',
'destination': 'cloud.py',
'class': 'backlink iconspace',
'title': 'Go back to cloud management',
'text': 'Back to cloud management'
})
return (output_objects, return_status)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
title_entry = find_entry(output_objects, 'title')
label = "%s" % configuration.site_vgrid_label
title_entry['text'] = "Add %s Owner" % label
output_objects.append({
'object_type': 'header',
'text': 'Add %s Owner(s)' % label
})
status = returnvalues.OK
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
vgrid_name = accepted['vgrid_name'][-1].strip()
cert_id_list = accepted['cert_id']
request_name = unhexlify(accepted['request_name'][-1])
rank_list = accepted['rank'] + ['' for _ in cert_id_list]
# inherited vgrid membership
inherit_vgrid_member = False
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of manage vgrid permission
if not user_dict or \
not vgrid_manage_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to manage vgrids!" % client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can manage %ss' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# make sure vgrid settings allow this owner to edit owners
(allow_status, allow_msg) = allow_owners_adm(configuration, vgrid_name,
client_id)
if not allow_status:
output_objects.append({'object_type': 'error_text', 'text': allow_msg})
return (output_objects, returnvalues.CLIENT_ERROR)
cert_id_added = []
for (cert_id, rank_str) in zip(cert_id_list, rank_list):
cert_id = cert_id.strip()
cert_dir = client_id_dir(cert_id)
try:
rank = int(rank_str)
except ValueError:
rank = None
# Allow openid alias as subject if openid with alias is enabled
if configuration.user_openid_providers and configuration.user_openid_alias:
cert_id = expand_openid_alias(cert_id, configuration)
# Validity of user and vgrid names is checked in this init function so
# no need to worry about illegal directory traversal through variables
(ret_val, msg, _) = \
init_vgrid_script_add_rem(vgrid_name, client_id, cert_id,
'owner', configuration)
if not ret_val:
output_objects.append({'object_type': 'error_text', 'text': msg})
status = returnvalues.CLIENT_ERROR
continue
# don't add if already an owner unless rank is given
if rank is None and vgrid_is_owner(vgrid_name, cert_id, configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'%s is already an owner of %s or a parent %s.' %
(cert_id, vgrid_name, label)
})
status = returnvalues.CLIENT_ERROR
continue
# don't add if already a direct member
if vgrid_is_member(vgrid_name, cert_id, configuration,
recursive=False):
output_objects.append({
'object_type':
'error_text',
'text':
'%s is already a member of %s - please remove first.' %
(cert_id, vgrid_name)
})
status = returnvalues.CLIENT_ERROR
continue
# owner of subvgrid?
(list_status,
subvgrids) = vgrid_list_subvgrids(vgrid_name, configuration)
if not list_status:
output_objects.append({
'object_type':
'error_text',
'text':
'Error getting list of sub%ss: %s' % (label, subvgrids)
})
status = returnvalues.SYSTEM_ERROR
continue
skip_entity = False
for subvgrid in subvgrids:
if vgrid_is_owner(subvgrid,
cert_id,
configuration,
recursive=False):
output_objects.append({
'object_type':
'error_text',
'text':
"""%s is already an owner of a sub-%s ('%s'). Please
remove the person first and then try this operation again.""" %
(cert_id, label, subvgrid)
})
status = returnvalues.CLIENT_ERROR
skip_entity = True
break
if vgrid_is_member(subvgrid,
cert_id,
configuration,
recursive=False):
output_objects.append({
'object_type':
'error_text',
'text':
"""%s is already a member of a sub-%s ('%s'). Please
remove the person first and then try this operation again.""" %
(cert_id, label, subvgrid)
})
status = returnvalues.CLIENT_ERROR
skip_entity = True
break
if skip_entity:
continue
# we DO allow ownership if member of parent vgrid - only handle with care
if vgrid_is_member(vgrid_name, cert_id, configuration):
# list is in top-down order
parent_vgrids = vgrid_list_parents(vgrid_name, configuration)
inherit_vgrid_member = vgrid_name
for parent in parent_vgrids:
if vgrid_is_member(parent,
cert_id,
configuration,
recursive=False):
inherit_vgrid_member = parent
break
output_objects.append({
'object_type':
'text',
'text':
'''NOTE: %s is already a member of parent %s %s.''' %
(cert_id, label, inherit_vgrid_member)
})
# Check if only rank change was requested and apply if so
if rank is not None:
(add_status, add_msg) = vgrid_add_owners(configuration,
vgrid_name, [cert_id],
rank=rank)
if not add_status:
output_objects.append({
'object_type': 'error_text',
'text': add_msg
})
status = returnvalues.SYSTEM_ERROR
else:
output_objects.append({
'object_type':
'text',
'text':
'changed %s to owner %d' % (cert_id, rank)
})
# No further action after rank change as everything else exists
continue
# Getting here means cert_id is not owner of any parent or child vgrids.
# may still be member of a parent grid but not a child vgrid.
public_base_dir = \
os.path.abspath(os.path.join(configuration.vgrid_public_base,
vgrid_name)) + os.sep
private_base_dir = \
os.path.abspath(os.path.join(configuration.vgrid_private_base,
vgrid_name)) + os.sep
# Please note that base_dir must end in slash to avoid access to other
# user dirs when own name is a prefix of another user name
user_dir = os.path.abspath(
os.path.join(configuration.user_home, cert_dir)) + os.sep
user_public_base = os.path.abspath(
os.path.join(user_dir, 'public_base')) + os.sep
user_private_base = os.path.abspath(
os.path.join(user_dir, 'private_base')) + os.sep
# make sure all dirs can be created (that a file or directory with the same
# name do not exist prior to adding the owner)
if os.path.exists(user_public_base + vgrid_name):
output_objects.append({
'object_type':
'error_text',
'text':
'''Could not add owner, a file or directory in public_base
exists with the same name! %s''' % user_dir + vgrid_name
})
status = returnvalues.CLIENT_ERROR
continue
if os.path.exists(user_private_base + vgrid_name):
output_objects.append({
'object_type':
'error_text',
'text':
'''Could not add owner, a file or directory in private_base
exists with the same name!'''
})
status = returnvalues.CLIENT_ERROR
continue
# vgrid share already exists if user is a member of parent vgrid
if not inherit_vgrid_member and os.path.exists(user_dir + vgrid_name):
output_objects.append({
'object_type':
'error_text',
'text':
'''Could not add owner, a file or directory in the home
directory exists with the same name!'''
})
status = returnvalues.CLIENT_ERROR
continue
# Add
(add_status, add_msg) = vgrid_add_owners(configuration, vgrid_name,
[cert_id])
if not add_status:
output_objects.append({
'object_type': 'error_text',
'text': add_msg
})
status = returnvalues.SYSTEM_ERROR
continue
vgrid_name_parts = vgrid_name.split('/')
is_subvgrid = len(vgrid_name_parts) > 1
# create public_base in cert_ids home dir if it does not exists
try:
os.mkdir(user_public_base)
except Exception as exc:
pass
# create private_base in cert_ids home dir if it does not exists
try:
os.mkdir(user_private_base)
except Exception as exc:
pass
if is_subvgrid:
share_dir = None
try:
# Example:
# vgrid_name = IMADA/STUD/BACH
# vgrid_name_last_fragment = BACH
# vgrid_name_without_last_fragment = IMADA/STUD/
vgrid_name_last_fragment = \
vgrid_name_parts[len(vgrid_name_parts) - 1].strip()
vgrid_name_without_last_fragment = \
('/'.join(vgrid_name_parts[0:len(vgrid_name_parts) - 1]) +
os.sep).strip()
# create dirs if they do not exist
share_dir = user_dir + vgrid_name_without_last_fragment
if not os.path.isdir(share_dir):
os.makedirs(share_dir)
pub_dir = user_public_base + vgrid_name_without_last_fragment
if not os.path.isdir(pub_dir):
os.makedirs(pub_dir)
priv_dir = user_private_base + vgrid_name_without_last_fragment
if not os.path.isdir(priv_dir):
os.makedirs(priv_dir)
except Exception as exc:
# out of range? should not be possible due to is_subvgrid check
output_objects.append({
'object_type':
'error_text',
'text': ('Could not create needed dirs on %s server! %s' %
(configuration.short_title, exc))
})
logger.error('%s when looking for dir %s.' % (exc, share_dir))
status = returnvalues.SYSTEM_ERROR
continue
# create symlink from users home directory to vgrid file directory
# unless member of parent vgrid so that it is included already
link_src = os.path.abspath(configuration.vgrid_files_home + os.sep +
vgrid_name) + os.sep
link_dst = user_dir + vgrid_name
if not inherit_vgrid_member and \
not make_symlink(link_src, link_dst, logger):
output_objects.append({
'object_type':
'error_text',
'text':
'Could not create link to %s share!' % label
})
logger.error('Could not create link to %s files (%s -> %s)' %
(label, link_src, link_dst))
status = returnvalues.SYSTEM_ERROR
continue
public_base_dst = user_public_base + vgrid_name
# create symlink for public_base files
if not make_symlink(public_base_dir, public_base_dst, logger):
output_objects.append({
'object_type':
'error_text',
'text':
'Could not create link to public_base dir!'
})
logger.error(
'Could not create link to public_base dir (%s -> %s)' %
(public_base_dir, public_base_dst))
status = returnvalues.SYSTEM_ERROR
continue
private_base_dst = user_private_base + vgrid_name
# create symlink for private_base files
if not make_symlink(private_base_dir, private_base_dst, logger):
output_objects.append({
'object_type':
'error_text',
'text':
'Could not create link to private_base dir!'
})
status = returnvalues.SYSTEM_ERROR
continue
if configuration.trac_admin_path:
public_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_public_base, vgrid_name, '.vgridtracker'))
private_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_private_base, vgrid_name, '.vgridtracker'))
vgrid_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_files_home, vgrid_name, '.vgridtracker'))
for tracker_dir in [
public_tracker_dir, private_tracker_dir, vgrid_tracker_dir
]:
if not add_tracker_admin(configuration, cert_id, vgrid_name,
tracker_dir, output_objects):
status = returnvalues.SYSTEM_ERROR
continue
cert_id_added.append(cert_id)
if request_name:
request_dir = os.path.join(configuration.vgrid_home, vgrid_name)
if not delete_access_request(configuration, request_dir, request_name):
logger.error("failed to delete owner request for %s in %s" %
(vgrid_name, request_name))
output_objects.append({
'object_type':
'error_text',
'text':
'Failed to remove saved request for %s in %s!' %
(vgrid_name, request_name)
})
if cert_id_added:
output_objects.append({
'object_type':
'html_form',
'text':
'New owner(s)<br />%s<br />successfully added to %s %s!'
'' % ('<br />'.join(cert_id_added), vgrid_name, label)
})
cert_id_fields = ''
for cert_id in cert_id_added:
cert_id_fields += """<input type=hidden name=cert_id value='%s' />
""" % cert_id
form_method = 'post'
csrf_limit = get_csrf_limit(configuration)
fill_helpers = {
'vgrid_name': vgrid_name,
'cert_id': cert_id,
'protocol': any_protocol,
'short_title': configuration.short_title,
'vgrid_label': label,
'cert_id_fields': cert_id_fields,
'form_method': form_method,
'csrf_field': csrf_field,
'csrf_limit': csrf_limit
}
target_op = 'sendrequestaction'
csrf_token = make_csrf_token(configuration, form_method, target_op,
client_id, csrf_limit)
fill_helpers.update({'target_op': target_op, 'csrf_token': csrf_token})
output_objects.append({
'object_type':
'html_form',
'text':
"""
<form method='%(form_method)s' action='%(target_op)s.py'>
<input type='hidden' name='%(csrf_field)s' value='%(csrf_token)s' />
<input type=hidden name=request_type value='vgridaccept' />
<input type=hidden name=vgrid_name value='%(vgrid_name)s' />
%(cert_id_fields)s
<input type=hidden name=protocol value='%(protocol)s' />
<table>
<tr>
<td class='title'>Custom message to user(s)</td>
</tr><tr>
<td><textarea name=request_text cols=72 rows=10>
We have granted you ownership access to our %(vgrid_name)s %(vgrid_label)s.
You can access the %(vgrid_label)s administration page from the
%(vgrid_label)ss page on %(short_title)s.
Regards, the %(vgrid_name)s %(vgrid_label)s owners
</textarea></td>
</tr>
<tr>
<td><input type='submit' value='Inform user(s)' /></td>
</tr>
</table>
</form>
<br />
""" % fill_helpers
})
output_objects.append({
'object_type': 'link',
'destination': 'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text': 'Back to administration for %s' % vgrid_name
})
return (output_objects, status)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
title_entry = find_entry(output_objects, 'title')
label = "%s" % configuration.site_vgrid_label
title_entry['text'] = "Remove %s Resource" % label
output_objects.append({
'object_type': 'header',
'text': 'Remove %s Resource' % label
})
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
vgrid_name = accepted['vgrid_name'][-1]
unique_resource_name = accepted['unique_resource_name'][-1].lower()
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of manage vgrid permission
if not user_dict or \
not vgrid_manage_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to manage vgrids!" % client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can manage %ss' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# make sure vgrid settings allow this owner to edit resources
(allow_status, allow_msg) = allow_resources_adm(configuration, vgrid_name,
client_id)
if not allow_status:
output_objects.append({'object_type': 'error_text', 'text': allow_msg})
return (output_objects, returnvalues.CLIENT_ERROR)
# Validity of user and vgrid names is checked in this init function so
# no need to worry about illegal directory traversal through variables
(ret_val, msg, ret_variables) = \
init_vgrid_script_add_rem(vgrid_name, client_id,
unique_resource_name, 'resource',
configuration)
if not ret_val:
output_objects.append({'object_type': 'error_text', 'text': msg})
return (output_objects, returnvalues.CLIENT_ERROR)
elif msg:
# In case of warnings, msg is non-empty while ret_val remains True
output_objects.append({'object_type': 'warning', 'text': msg})
if not vgrid_is_owner(vgrid_name, client_id, configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'''You must be an owner of the %s to
remove a resource!''' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# don't remove if not a participant
if not vgrid_is_resource(vgrid_name, unique_resource_name, configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'%s is not a resource in %s or a parent %s.' %
(unique_resource_name, vgrid_name, label)
})
return (output_objects, returnvalues.CLIENT_ERROR)
# remove
(rm_status, rm_msg) = vgrid_remove_resources(configuration, vgrid_name,
[unique_resource_name])
if not rm_status:
output_objects.append({'object_type': 'error_text', 'text': rm_msg})
output_objects.append({
'object_type': 'error_text',
'text': '''%(res_name)s might be listed as a resource
of this %(vgrid_label)s because it is a resource of a parent %(vgrid_label)s.
Removal must be performed from the most significant %(vgrid_label)s possible.
''' % {
'res_name': unique_resource_name,
'vgrid_label': label
}
})
return (output_objects, returnvalues.SYSTEM_ERROR)
output_objects.append({
'object_type':
'text',
'text':
'Resource %s successfully removed from %s %s!' %
(unique_resource_name, vgrid_name, label)
})
output_objects.append({
'object_type': 'link',
'destination': 'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text': 'Back to administration for %s' % vgrid_name
})
return (output_objects, returnvalues.OK)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
client_dir = client_id_dir(client_id)
title_entry = find_entry(output_objects, 'title')
title_entry['text'] = 'Peers'
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
logger.info("%s begin for %s" % (op_name, client_id))
# IMPORTANT: single line here to avoid breaking javascript inlining
expire_help = "For security reasons peer accounts should be closed when no longer required. Expire is used to limit account access time for that purpose, and you can always extend it later if needed. For courses and workshops a few weeks or months should usually suffice, while projects and long-term collaboration often extend to months or years. Peer accounts still need to be renewed at least annually, but the peer users can do so themselves without your repeated explicit acceptance, as long as it does not exceed your provided expire date."
# jquery support for tablesorter and confirmation on delete
# table initially sorted by col. 5 (kind), then 0 (name)
refresh_call = 'ajax_peers()'
table_spec = {'table_id': 'peers', 'sort_order':
'[[5,0],[0,0]]',
'refresh_call': refresh_call}
(add_import, add_init, add_ready) = man_base_js(configuration,
[table_spec])
add_init += '''
/* Helper to define countries for which State field makes sense */
var enable_state = ["US", "CA", "AU"];
function show_info(title, msg) {
$("#info_dialog").dialog("option", "title", title);
$("#info_dialog").html("<p>"+msg+"</p>");
$("#info_dialog").dialog("open");
}
function toggle_state() {
$("#fields-tab .save_peers .field_group").each(function() {
var country = $(this).find(".entry-field.country").val();
if (country && enable_state.indexOf(country) > -1) {
//console.debug("unlock state for "+country);
$(this).find("input.entry-field.state").prop("readonly", false);
} else {
//console.debug("lock state for "+country);
$(this).find("input.entry-field.state").prop("readonly", true);
/* NOTE: reset state on change to other country */
$(this).find("input.entry-field.state").val("");
}
}
);
}
function transfer_id_fields() {
//console.log("in transfer_id_fields");
var peer_count = 0;
var peer_id;
$("#fields-tab .save_peers .field_group").each(function() {
var group = $(this);
peer_id = '';
var full_name = $(group).find("input.entry-field.full_name").val();
var organization = $(group).find("input.entry-field.organization").val();
var email = $(group).find("input.entry-field.email").val();
var country = $(group).find(".entry-field.country").val();
var state = $(group).find("input.entry-field.state").val();
if (!state) {
state = "NA"
}
if (full_name && organization && email && country && state) {
peer_id = "/C="+country+"/ST="+state+"/L=NA/O="+ \
organization+"/OU=NA/CN="+full_name+"/emailAddress="+email;
//console.debug("built peer_id: "+peer_id);
peer_count += 1;
}
/* Always set peer_id to reset empty rows */
$(group).find("input.id-collector").val(peer_id);
console.log("set collected peer_id: "+$(group).find("input.id-collector").val());
});
if (peer_count > 0) {
return true;
} else {
return false;
}
}
'''
add_ready += '''
$(".peers-tabs").tabs();
$(".peers-tabs .accordion").accordion({
collapsible: true,
active: false,
icons: {"header": "ui-icon-plus", "activeHeader": "ui-icon-minus"},
heightStyle: "content"
});
/* fix and reduce accordion spacing */
$(".peers-tabs .accordion .ui-accordion-header").css("padding-top", 0).css("padding-bottom", 0).css("margin", 0);
$(".peers-tabs .init-expanded.accordion ").accordion("option", "active", 0);
$("#fields-tab .save_peers").on("submit", transfer_id_fields);
$("#info_dialog").dialog(
{ autoOpen: false,
width: 500,
modal: true,
closeOnEscape: true,
buttons: { "Ok": function() { $(this).dialog("close"); }}
});
'''
title_entry['script']['advanced'] += add_import
title_entry['script']['init'] += add_init
title_entry['script']['ready'] += add_ready
output_objects.append({'object_type': 'html_form',
'text': man_base_html(configuration)})
output_objects.append({'object_type': 'header', 'text': 'Peers'})
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of peers permission
peers_permit_class = 'hidden'
if user_dict and peers_permit_allowed(configuration, user_dict):
peers_permit_class = ''
form_method = 'post'
csrf_limit = get_csrf_limit(configuration)
target_op = 'peersaction'
csrf_token = make_csrf_token(configuration, form_method, target_op,
client_id, csrf_limit)
fill_helpers = {'peers_notice': configuration.site_peers_notice,
'site': configuration.short_title,
'peers_permit_class': peers_permit_class,
'form_method': form_method,
'csrf_field': csrf_field, 'csrf_limit': csrf_limit,
'target_op': target_op, 'csrf_token': csrf_token,
'expire_help': expire_help,
'csv_header': csv_sep.join([i for i in peers_fields])}
form_prefix_html = '''
<form class="save_peers save_general" method="%(form_method)s"
action="%(target_op)s.py">
'''
form_suffix_html = '''
<input type="submit" value="Save Peers" /><br/>
</form>
'''
form_accept_html = '''
<input type="submit" value="Apply" /><br/>
</form>
'''
shared_peer_html = '''
<input type="hidden" name="%(csrf_field)s" value="%(csrf_token)s" />
<div class="form-row three-col-grid">
<div class="col-md-4 mb-3 form-cell">
<label for="peers_label">Label</label>
<input class="form-control fill-width" type="text" name="peers_label"
value="" pattern="[^ ]*" title="Label for peers"
placeholder="Peers name or label" />
</div>
<div class="col-md-4 mb-3 form-cell">
<label for="peers_kind">Kind</label>
<select class="form-control themed-select html-select" name="peers_kind">
'''
for name in peer_kinds:
shared_peer_html += '''
<option value="%s">%s
''' % (name, name.capitalize())
shared_peer_html += '''
</select>
</div>
<div class="col-md-4 mb-3 form-cell">
<label for="peers_expire">Expire
<span class="info leftpad iconspace" title="%(expire_help)s"
onClick="show_info(\'Expire Help\', \'%(expire_help)s\');"/>
</label>
<input class="form-control themed-select html-select fill-width"
type="date" name="peers_expire" required pattern="[0-9/-]+"
title="Access expiry date" />
</div>
</div>
'''
fill_helpers['form_prefix_html'] = form_prefix_html % fill_helpers
fill_helpers['form_suffix_html'] = form_suffix_html % fill_helpers
fill_helpers['form_accept_html'] = form_accept_html % fill_helpers
fill_helpers['shared_peer_html'] = shared_peer_html % fill_helpers
peers_path = os.path.join(configuration.user_settings, client_dir,
peers_filename)
try:
all_peers = load(peers_path)
except Exception as exc:
logger.warning("could not load peers from %s: %s" % (peers_path, exc))
all_peers = {}
pending_peers_path = os.path.join(configuration.user_settings, client_dir,
pending_peers_filename)
try:
pending_peers = load(pending_peers_path)
except Exception as exc:
logger.warning("could not load pending peers from %s: %s" %
(pending_peers_path, exc))
pending_peers = []
tabs_html = '''
<div id="info_dialog" class="hidden"></div>
<div id="wrap-tabs" class="peers-tabs">
<ul>
<li><a href="#show-tab">Show Peers</a></li>
<li class="%(peers_permit_class)s"><a href="#requests-tab">Requested Peers</a></li>
<li class="%(peers_permit_class)s"><a href="#fields-tab">Enter Peers</a></li>
<li class="%(peers_permit_class)s"><a href="#import-tab">Import Peers</a></li>
<!-- TODO: enable additional methods when ready? -->
<li class="%(peers_permit_class)s hidden"><a href="#urlfetch-tab">Fetch Peers From URL</a></li>
</ul>
<div id="show-tab">
<p>
%(peers_notice)s
This is an overview of your registered peers. That is, people that you have
vouched for to get an account on %(site)s because they need it for a particular
course/workshop, research project or for general long term collaboration with
you. The site admins will use this information to accept account requests and
extensions from your peers until the given time of expiry.
</p>
<div class="peer_entries">
'''
output_objects.append(
{'object_type': 'html_form', 'text': tabs_html % fill_helpers})
output_objects.append({'object_type': 'table_pager', 'entry_name': 'peers',
'default_entries': default_pager_entries})
peers = []
for (peer_id, entry) in all_peers.items():
filled_entry = dict([(field, '') for field in
('label', 'kind', 'expire')])
fill_distinguished_name(entry)
filled_entry.update(entry)
filled_entry['anon_peer_id'] = anon_user_id(peer_id)
filled_entry['object_type'] = 'peer'
# NOTE: very simple edit dialog to change only expire through confirm.
# We could add similar buttons for kind and label fields but they can
# be edited with Update in Edit Peers until we make a dedicated dialog
filled_entry['editpeerlink'] = {
'object_type': 'link',
'destination':
"javascript: confirmDialog(%s, '%s', '%s', %s);" %
('peer_action', 'Update %(full_name)s (%(email)s) expire date (YYYY-MM-DD)?' % filled_entry,
'peers_expire',
"{action: 'update', peers_label: '%(label)s', peers_kind: '%(kind)s', peers_content: '%(distinguished_name)s', peers_invite: false}" % filled_entry),
'class': 'editlink iconspace',
'title': 'Update %(distinguished_name)s Expire value in peers' % filled_entry,
'text': ''}
filled_entry['invitepeerlink'] = {
'object_type': 'link',
'destination':
"javascript: confirmDialog(%s, '%s', %s, %s);" %
('peer_action', 'Send invitation email to %(distinguished_name)s?' % filled_entry,
'undefined',
"{action: 'update', peers_label: '%(label)s', peers_kind: '%(kind)s', peers_expire:'%(expire)s', peers_content: '%(distinguished_name)s', peers_invite: true}" % filled_entry),
'class': 'invitelink iconspace',
'title': 'Invite %(distinguished_name)s as peer' % filled_entry,
'text': ''}
filled_entry['viewpeerlink'] = {
'object_type': 'link',
'destination': 'viewuser.py?cert_id=%(anon_peer_id)s' % filled_entry,
'class': 'userlink iconspace',
'title': 'Lookup %(distinguished_name)s user details' % filled_entry,
'text': ''}
filled_entry['delpeerlink'] = {
'object_type': 'link',
'destination':
"javascript: confirmDialog(%s, '%s', %s, %s);" %
('peer_action', 'Really remove %(distinguished_name)s?' % filled_entry,
'undefined',
"{action: 'remove', peers_label: '%(label)s', peers_kind: '%(kind)s', peers_expire:'%(expire)s', peers_content: '%(distinguished_name)s', peers_invite: false}" % filled_entry),
'class': 'removelink iconspace',
'title': 'Remove %(distinguished_name)s from peers' % filled_entry,
'text': ''}
peers.append(filled_entry)
output_objects.append({'object_type': 'peers',
'peers': peers})
# NOTE: reset tabs_html here
tabs_html = '''
</div>
</div>
<div id="fields-tab">
<p>
You may enter your individual peers in the form fields below and assign a
shared kind and account expiry time for all entries. Just leave the Action
field to <em>Add</em> unless you want to <em>Update</em> or <em>Remove</em>
existing peers. You are free to leave rows empty, but each field in a peer row
MUST be filled for the row to be treated.
</p>
<div class="enter-form form_container">
%(form_prefix_html)s
%(shared_peer_html)s
<input type="hidden" name="peers_format" value="userid" />
<div class="form-row one-col-grid">
<div class="col-md-12 mb-1 form-cell">
<label for="action">Action</label>
<select class="form-control themed-select html-select fill-width" name="action">
<option value="add">Add</option>
<option value="update">Update</option>
<option value="remove">Remove</option>
</select>
</div>
</div>
'''
sorted_countries = list_country_codes(configuration)
# TODO: switch to JS rows with automagic addition to always keep spare row?
for index in range(edit_entries):
# NOTE: we arrange each entry into a field_group_N div with a hidden
# user ID collector where the field values are merged on submit
# and the actual fields are not passed to the backend.
tabs_html += '''
<div id="field_group_%s" class="field_group">
<input class="id-collector" type="hidden" name="peers_content" value="" />
<div class="form-row five-col-grid">
''' % index
for field in peers_fields:
title = ' '.join([i.capitalize() for i in field.split('_')])
placeholder = title
field_extras = 'type="text"'
# Lock state field until applicable (JS)
locked = ""
cols = "col-md-3 mb-3"
if field.lower() == 'full_name':
field_extras = 'minlength=3'
elif field.lower() == 'organization':
field_extras = 'minlength=2'
elif field.lower() == 'email':
placeholder = "Email at organization"
field_extras = 'type="email" minlength=5'
cols = "col-md-2 mb-2"
elif field.lower() == 'country':
# NOTE: use country drop-down if available
title = "Country (ISO 3166)"
placeholder = "2-Letter country code"
field_extras = 'minlength=2 maxlength=2'
cols = "col-md-2 mb-2"
elif field.lower() == 'state':
title = "State (if applicable)"
placeholder = "2-Letter state code"
field_extras += ' minlength=0 maxlength=2'
locked = "readonly"
cols = "col-md-2 mb-2"
entry_fill = {'field': field, 'title': title, 'placeholder':
placeholder, 'extras': field_extras, 'locked':
locked, 'cols': cols}
tabs_html += '''
<div class="%(cols)s form-cell %(field)s-cell">
<label for="%(field)s">%(title)s</label><br/>
''' % entry_fill
if field == 'country' and sorted_countries:
# Generate drop-down of countries and codes if available, else
# simple input
tabs_html += '''
<select class="form-control %(field)s themed-select html-select entry-field fill-with"
%(extras)s placeholder="%(placeholder)s" %(locked)s onChange="toggle_state();">
''' % entry_fill
for (name, code) in [('', '')] + sorted_countries:
tabs_html += " <option value='%s'>%s</option>\n" % \
(code, name)
tabs_html += """
</select>
"""
else:
tabs_html += '''
<input class="form-control %(field)s entry-field fill-width" %(extras)s
placeholder="%(placeholder)s" %(locked)s onBlur="toggle_state();" />
''' % entry_fill
tabs_html += '''
</div>
''' % entry_fill
tabs_html += '''
</div>
</div>
'''
tabs_html += '''
<p>
<span class="switch-label">Invite on email</span>
<label class="switch" for="fields_invite">
<input id="fields_invite" type="checkbox" name="peers_invite">
<span class="slider round small" title="Optional email invitation"></span>
</label>
</p>
%(form_suffix_html)s
</div>
</div>
'''
tabs_html += '''
<div id="import-tab" >
<p>
You can paste or enter a CSV-formatted list below to create or update your
existing peers. The contents must start with a single header line to define
the field order in the following individual user lines as shown in the example
at the bottom.
</p>
<div class="import-form form_container">
<h2>Import/Update Peers</h2>
%(form_prefix_html)s
%(shared_peer_html)s
<input type="hidden" name="peers_format" value="csvform" />
<input type="hidden" name="action" value="import" />
<textarea class="fillwidth" name="peers_content" rows=10 title="CSV list of peers"
placeholder="Paste or enter CSV-formatted list of peers ..."></textarea>
<p>
<span class="switch-label">Invite on email</span>
<label class="switch" for="import_invite">
<input id="import_invite" type="checkbox" name="peers_invite">
<span class="slider round small" title="Optional email invitation"></span>
</label>
</p>
%(form_suffix_html)s
</div>
'''
tabs_html += '''
<br/>
<div class="peers_export init-collapsed accordion invert-theme">
<h4>Example Peers</h4>
<p class="verbatim">%s
%s
...
%s
</p>
</div>
</div>
''' % (fill_helpers['csv_header'],
csv_sep.join([sample_users[0].get(i, '') for i in peers_fields]),
csv_sep.join([sample_users[-1].get(i, '') for i in peers_fields]))
tabs_html += '''
<div id="requests-tab" >
<p>
If someone requests an external user account on %(site)s and explicitly
references you as sponsor or contact person the site admins will generally
forward the request, so that it shows up here for you to confirm. You can then
accept or reject the individual requests below to let the site admins proceed
with account creation or rejection. Please select an expire date to provide
limited but sufficiently long account access - it can always be extended later.
</p>
'''
pending_count = 0
for (peer_id, user) in pending_peers:
# TODO: consider still showing if expired?
# Skip already accepted request
if peer_id in all_peers:
continue
pending_count += 1
tabs_html += '''
<div class="requests-form form_container">
%(form_prefix_html)s
%(shared_peer_html)s
<br/>
<input type="hidden" name="peers_format" value="userid" />
<div class="form-row six-col-grid">
<div class="col-md-2 mb-6 form-cell">
<label for="action">Action</label>
<select class="form-control themed-select html-select fill-width" name="action">
<option value="accept">Accept</option>
<option value="reject">Reject</option>
</select>
</div>
'''
tabs_html += '''
<input type="hidden" name="peers_content" value="%(distinguished_name)s" />
''' % user
for field in peers_fields:
title = ' '.join([i.capitalize() for i in field.split('_')])
tabs_html += '''
<div class="col-md-2 mb-6 form-cell">
<label for="%(field)s">%(title)s</label>
<input class="form-control fill-width" type="text" value="%(value)s"
readonly />
</div>''' % {'field': field, 'title': title, 'value': user.get(field, '')}
tabs_html += '''
</div>
%(form_accept_html)s
</div>
'''
if pending_count < 1:
tabs_html += '''
<p class="info icon iconpadding">
No pending requests ...
</p>
'''
tabs_html += '''
</div>
'''
tabs_html += '''
<div id="urlfetch-tab" >
<p>
In case you have a general project participation list online you can specify the URL here to fetch and parse the list into a peers list. Please note that this memberlist should still be on the machine readbale format described on the upload tab.
</p>
<div class="urlfetch-form form_container">
%(form_prefix_html)s
%(shared_peer_html)s
<br/>
<input type="hidden" name="action" value="import" />
<input type="hidden" name="peers_format" value="csvurl" />
<input class="fillwidth" type="text" name="peers_content" value=""
placeholder="URL to fetch CSV-formatted list of peers from ..." /><br/>
%(form_suffix_html)s
</div>
</div>
'''
# End wrap-tabs div
tabs_html += '''
</div >
'''
output_objects.append(
{'object_type': 'html_form', 'text': tabs_html % fill_helpers})
# Helper form for post
helper = html_post_helper('peer_action', '%s.py' % target_op,
{'action': '__DYNAMIC__',
'peers_label': '__DYNAMIC__',
'peers_kind': '__DYNAMIC__',
'peers_expire': '__DYNAMIC__',
'peers_content': '__DYNAMIC__',
'peers_invite': '__DYNAMIC__',
'peers_format': 'userid',
csrf_field: csrf_token})
output_objects.append({'object_type': 'html_form', 'text':
helper})
logger.info("%s end for %s" % (op_name, client_id))
return (output_objects, returnvalues.OK)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
title_entry = find_entry(output_objects, 'title')
label = "%s" % configuration.site_vgrid_label
title_entry['text'] = "Remove %s Member" % label
output_objects.append({
'object_type': 'header',
'text': 'Remove %s Member' % label
})
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
vgrid_name = accepted['vgrid_name'][-1]
cert_id = accepted['cert_id'][-1]
cert_dir = client_id_dir(cert_id)
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
# always allow member to remove self
if client_id != cert_id:
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of manage vgrid permission
if not user_dict or \
not vgrid_manage_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to manage vgrids!" %
client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can manage %ss' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# make sure vgrid settings allow this owner to edit other members
(allow_status, allow_msg) = allow_members_adm(configuration,
vgrid_name, client_id)
if not allow_status:
output_objects.append({
'object_type': 'error_text',
'text': allow_msg
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Validity of user and vgrid names is checked in this init function so
# no need to worry about illegal directory traversal through variables
(ret_val, msg, _) = \
init_vgrid_script_add_rem(vgrid_name, client_id, cert_id,
'member', configuration)
if not ret_val:
output_objects.append({'object_type': 'error_text', 'text': msg})
return (output_objects, returnvalues.CLIENT_ERROR)
# don't remove if not a member
if not vgrid_is_member(vgrid_name, cert_id, configuration):
output_objects.append({
'object_type':
'error_text',
'text':
'%s is not a member of %s or a parent %s.' %
(cert_id, vgrid_name, label)
})
return (output_objects, returnvalues.CLIENT_ERROR)
# owner of subvgrid?
(list_status, subvgrids) = vgrid_list_subvgrids(vgrid_name, configuration)
if not list_status:
output_objects.append({
'object_type':
'error_text',
'text':
'Error getting list of sub%ss: %s' % (label, subvgrids)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# TODO: we DO allow ownership of sub vgrids with parent membership so we
# should support the (cumbersome) relinking of vgrid shares here. Leave it
# to user to do it manually for now with temporary removal of ownership
for subvgrid in subvgrids:
if vgrid_is_owner(subvgrid, cert_id, configuration, recursive=False):
output_objects.append({
'object_type': 'error_text',
'text':
"""%(cert_id)s is already an owner of a sub-%(vgrid_label)s
('%(subvgrid)s'). While we DO support members being owners of
sub-%(vgrid_label)ss, we do not support removing parent %(vgrid_label)s members
at the moment. Please (temporarily) remove the person as owner of all
sub-%(vgrid_label)ss first and then try this operation again.""" % {
'cert_id': cert_id,
'subvgrid': subvgrid,
'vgrid_label': label
}
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Please note that base_dir must end in slash to avoid access to other
# vgrid dirs when own name is a prefix of another name
base_dir = os.path.abspath(
os.path.join(configuration.vgrid_home, vgrid_name)) + os.sep
# remove symlink from users home directory to vgrid directory
# Please note that base_dir must end in slash to avoid access to other
# user dirs when own name is a prefix of another user name
user_dir = os.path.abspath(os.path.join(configuration.user_home,
cert_dir)) + os.sep
dst = user_dir + vgrid_name
try:
os.remove(dst)
except Exception as exc:
# ouch, not good. Email admin?
pass
if os.path.exists(dst):
output_objects.append({
'object_type':
'error_text',
'text':
'Could not remove link to %s files!' % label
})
logger.error('Removed member might still have access to %s files! %s' %
(label, dst))
return (output_objects, returnvalues.SYSTEM_ERROR)
vgrid_name_parts = vgrid_name.split('/')
# make sure there are no "" entries in list
while True:
try:
vgrid_name_parts.remove('')
vgrid_name_parts.remove('/')
except:
# no such item
break
is_subvgrid = len(vgrid_name_parts) >= 2
if is_subvgrid:
# remove placeholder dirs (empty dirs created to hold subvgrid)
# reverse list to remove files and directories of subdirs first
list_range = range(len(vgrid_name_parts))
list_range.reverse()
reverse_list = list_range
# remove first entry in reversed list (SUBVGRID in VGRID/SUBVGRID since
# we know it was the symbolic link and is not a dir)
reverse_list = reverse_list[1:]
# remove empty placeholder dirs in home dir, private_base and
# public_base dirs
base_dirs = [user_dir]
for base_dir in base_dirs:
for loop_count in reverse_list:
# note that loop_count is decreasing!
current_vgrid_path = \
'/'.join(vgrid_name_parts[0:loop_count + 1])
current_path = base_dir + current_vgrid_path
if not os.path.isdir(current_path):
output_objects.append({
'object_type':
'error_text',
'text':
'''Error removing %s placeholder dirs:
%s is not a directory, not going to remove.''' % (label, current_vgrid_path)
})
continue
if os.listdir(current_path):
output_objects.append({
'object_type':
'error_text',
'text':
'''Could not remove %s placeholder dirs:
%s is not an empty directory (not critical)''' % (label, current_vgrid_path)
})
else:
# remove empty directory
try:
os.rmdir(current_path)
except Exception as exc:
output_objects.append({
'object_type':
'error_text',
'text':
'''Error removing %s placeholder dirs:
exception removing empty directory %s''' % (label, exc)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# remove from list
(rm_status, rm_msg) = vgrid_remove_members(configuration, vgrid_name,
[cert_id])
if not rm_status:
output_objects.append({
'object_type':
'error_text',
'text':
'%s of member of %s' % (rm_msg, vgrid_name)
})
output_objects.append({
'object_type': 'error_text',
'text': '''(If %(vgrid_label)s %(vgrid_name)s has
sub-%(vgrid_label)ss then removal must be performed from the most significant
%(vgrid_label)s possible.)''' % {
'vgrid_name': vgrid_name,
'vgrid_label': label
}
})
return (output_objects, returnvalues.SYSTEM_ERROR)
unmap_inheritance(configuration, vgrid_name, cert_id)
output_objects.append({
'object_type':
'text',
'text':
'%s successfully removed as member of %s %s!' %
(cert_id, vgrid_name, label)
})
output_objects.append({
'object_type': 'link',
'destination': 'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text': 'Back to administration for %s' % vgrid_name
})
return (output_objects, returnvalues.OK)
def main(client_id, user_arguments_dict):
"""Main function used by front end"""
(configuration, logger, output_objects, op_name) = \
initialize_main_variables(client_id, op_header=False)
defaults = signature()[1]
title_entry = find_entry(output_objects, 'title')
label = "%s" % configuration.site_vgrid_label
title_entry['text'] = "Remove %s Owner" % label
output_objects.append({
'object_type': 'header',
'text': 'Remove %s Owner' % label
})
(validate_status, accepted) = validate_input_and_cert(
user_arguments_dict,
defaults,
output_objects,
client_id,
configuration,
allow_rejects=False,
)
if not validate_status:
return (accepted, returnvalues.CLIENT_ERROR)
vgrid_name = accepted['vgrid_name'][-1]
flags = ''.join(accepted['flags'])
cert_id = accepted['cert_id'][-1]
cert_dir = client_id_dir(cert_id)
# inherited vgrid membership
inherit_vgrid_member = False
if not safe_handler(configuration, 'post', op_name, client_id,
get_csrf_limit(configuration), accepted):
output_objects.append({
'object_type':
'error_text',
'text':
'''Only accepting
CSRF-filtered POST requests to prevent unintended updates'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
# always allow owner to remove self
if client_id != cert_id:
user_map = get_full_user_map(configuration)
user_dict = user_map.get(client_id, None)
# Optional site-wide limitation of manage vgrid permission
if not user_dict or \
not vgrid_manage_allowed(configuration, user_dict):
logger.warning("user %s is not allowed to manage vgrids!" %
client_id)
output_objects.append({
'object_type':
'error_text',
'text':
'Only privileged users can manage %ss' % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# make sure vgrid settings allow this owner to edit other owners
(allow_status, allow_msg) = allow_owners_adm(configuration, vgrid_name,
client_id)
if not allow_status:
output_objects.append({
'object_type': 'error_text',
'text': allow_msg
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Validity of user and vgrid names is checked in this init function so
# no need to worry about illegal directory traversal through variables
(ret_val, msg, _) = \
init_vgrid_script_add_rem(vgrid_name, client_id, cert_id,
'owner', configuration)
if not ret_val:
output_objects.append({'object_type': 'error_text', 'text': msg})
return (output_objects, returnvalues.CLIENT_ERROR)
# don't remove if not already an owner
if not vgrid_is_owner(vgrid_name, cert_id, configuration):
logger.warning('%s is not allowed to remove owner %s from %s' %
(client_id, cert_id, vgrid_name))
output_objects.append({
'object_type':
'error_text',
'text':
'%s is not an owner of %s or a parent %s.' %
(cert_id, vgrid_name, label)
})
return (output_objects, returnvalues.CLIENT_ERROR)
# we need the local owners file to detect inherited ownerships
(owners_status, owners_direct) = vgrid_owners(vgrid_name, configuration,
False)
(all_status, owners) = vgrid_owners(vgrid_name, configuration, True)
if not owners_status or not all_status:
logger.error('Error loading owners for %s: %s / %s' %
(vgrid_name, owners_direct, owners))
output_objects.append({
'object_type':
'error_text',
'text':
'An internal error occurred, error conditions have been logged.'
})
output_objects.append({
'object_type':
'text',
'text':
'''
You can help us fix the problem by notifying the administrators
via mail about what you wanted to do when the error happened.'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
logger.info('%s removing owner %s from %s' %
(client_id, cert_id, vgrid_name))
# find out whether to just remove an owner or delete the whole thing.
# ask about delete if last or no direct owners.
if len(owners_direct) > 1:
logger.debug('Removing %s, one of several owners, from %s.' %
(cert_id, vgrid_name))
if not (cert_id in owners_direct):
# the owner owns an upper vgrid, ownership is inherited
# cannot remove, not last (inherited) owner
logger.warning('Cannot delete: Inherited ownership.' +
'\n Owners: %s,\n Direct owners: %s.' %
(owners, owners_direct))
output_objects.append({
'object_type':
'error_text',
'text':
'''%s is owner of a parent %s.
Owner removal has to be performed at the topmost vgrid''' % (cert_id, label)
})
return (output_objects, returnvalues.CLIENT_ERROR)
else:
# Remove any tracker admin rights
if configuration.trac_admin_path:
public_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_public_base, vgrid_name,
'.vgridtracker'))
private_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_private_base, vgrid_name,
'.vgridtracker'))
vgrid_tracker_dir = \
os.path.abspath(os.path.join(
configuration.vgrid_files_home, vgrid_name,
'.vgridtracker'))
for tracker_dir in [
public_tracker_dir, private_tracker_dir,
vgrid_tracker_dir
]:
if not rm_tracker_admin(configuration, cert_id, vgrid_name,
tracker_dir, output_objects):
return (output_objects, returnvalues.SYSTEM_ERROR)
user_dir = os.path.abspath(
os.path.join(configuration.user_home, cert_dir)) + os.sep
# Do not touch vgrid share if still a member of a parent vgrid
if vgrid_is_member(vgrid_name, cert_id, configuration):
# list is in top-down order
parent_vgrids = vgrid_list_parents(vgrid_name, configuration)
inherit_vgrid_member = vgrid_name
for parent in parent_vgrids:
if vgrid_is_member(parent,
cert_id,
configuration,
recursive=False):
inherit_vgrid_member = parent
break
output_objects.append({
'object_type':
'text',
'text':
'''NOTE: %s is still a member of parent %s %s.
Preserving access to corresponding %s.''' %
(cert_id, label, inherit_vgrid_member, label)
})
else:
(success, msg) = unlink_share(user_dir, vgrid_name)
if not success:
logger.error('Could not remove share link: %s.' % msg)
output_objects.append({
'object_type':
'error_text',
'text':
'Could not remove share links: %s.' % msg
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# unlink shared web folders
(success, msg) = unlink_web_folders(user_dir, vgrid_name)
if not success:
logger.error('Could not remove web links: %s.' % msg)
output_objects.append({
'object_type':
'error_text',
'text':
'Could not remove web links: %s.' % msg
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# remove user from saved owners list
(rm_status, rm_msg) = vgrid_remove_owners(configuration,
vgrid_name, [cert_id])
if not rm_status:
output_objects.append({
'object_type':
'error_text',
'text':
'%s of owners of %s' % (rm_msg, vgrid_name)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
# Any parent vgrid membership is left untouched here as we only
# force a normal refresh in unmap_inheritance
unmap_inheritance(configuration, vgrid_name, cert_id)
output_objects.append({
'object_type':
'text',
'text':
'%s successfully removed as owner of %s!' %
(cert_id, vgrid_name)
})
output_objects.append({
'object_type':
'link',
'destination':
'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text':
'Back to administration for %s' % vgrid_name
})
return (output_objects, returnvalues.OK)
else:
# no more direct owners - we try to remove this VGrid
logger.debug('Leave %s from %s with no more direct owners: delete' %
(vgrid_name, cert_id))
if not force(flags):
output_objects.append({
'object_type':
'text',
'text':
'''
No more direct owners of %s - leaving will result in the %s getting
deleted. Please use either of the links below to confirm or cancel.
''' % (vgrid_name, label)
})
# Reuse csrf token from this request
target_op = 'rmvgridowner'
js_name = target_op
csrf_token = accepted[csrf_field][-1]
helper = html_post_helper(
js_name, '%s.py' % target_op, {
'vgrid_name': vgrid_name,
'cert_id': cert_id,
'flags': 'f',
csrf_field: csrf_token
})
output_objects.append({'object_type': 'html_form', 'text': helper})
output_objects.append({
'object_type':
'link',
'destination':
"javascript: %s();" % js_name,
'class':
'removelink iconspace',
'text':
'Really leave and delete %s' % vgrid_name
})
output_objects.append({'object_type': 'text', 'text': ''})
output_objects.append({
'object_type':
'link',
'destination':
'adminvgrid.py?vgrid_name=%s' % vgrid_name,
'text':
'Back to administration for %s' % vgrid_name
})
return (output_objects, returnvalues.OK)
# check if any resources participate or sub-vgrids depend on this one
(list_status, subs) = vgrid_list_subvgrids(vgrid_name, configuration)
if not list_status:
logger.error('Error loading sub-vgrid for %s: %s)' %
(vgrid_name, subs))
output_objects.append({
'object_type':
'error_text',
'text':
'''
An internal error occurred, error conditions have been logged.'''
})
output_objects.append({
'object_type':
'text',
'text':
'''
You can help us fix the problem by notifying the administrators
via mail about what you wanted to do when the error happened.'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
if len(subs) > 0:
logger.debug('Cannot delete: still has sub-vgrids: %s' % subs)
output_objects.append({
'object_type':
'error_text',
'text':
'%s has one or more child %ss and cannot be deleted.' %
(vgrid_name, label)
})
output_objects.append({
'object_type':
'text',
'text':
'''To leave (and delete) %s
first remove all its children: %s.''' % (vgrid_name, ', '.join(subs))
})
return (output_objects, returnvalues.CLIENT_ERROR)
# we consider the local members and resources here, not inherited ones
(member_status,
members_direct) = vgrid_members(vgrid_name, configuration, False)
(resource_status,
resources_direct) = vgrid_resources(vgrid_name, configuration, False)
if not member_status or not resource_status:
logger.warning('failed to load %s members or resources: %s %s' %
(vgrid_name, members_direct, resources_direct))
output_objects.append({
'object_type':
'error_text',
'text':
'could not load %s members or resources for %s.' %
(label, vgrid_name)
})
return (output_objects, returnvalues.SYSTEM_ERROR)
if len(resources_direct) > 0:
logger.debug('Cannot delete: still has direct resources %s.' %
resources_direct)
output_objects.append({
'object_type':
'error_text',
'text':
'%s still has resources and cannot be deleted.' % vgrid_name
})
output_objects.append({
'object_type':
'text',
'text':
'''
To leave (and delete) %s, first remove the participating resources.''' %
vgrid_name
})
return (output_objects, returnvalues.CLIENT_ERROR)
if len(members_direct) > 0:
logger.debug('Cannot delete: still has direct members %s.' %
members_direct)
output_objects.append({
'object_type':
'error_text',
'text':
'%s still has members and cannot be deleted.' % vgrid_name
})
output_objects.append({
'object_type':
'text',
'text':
'''
To leave (and delete) %s, first remove all members.''' % vgrid_name
})
return (output_objects, returnvalues.CLIENT_ERROR)
# Deleting write restricted VGrid is not allowed
(load_status, saved_settings) = vgrid_settings(vgrid_name,
configuration,
recursive=True,
as_dict=True)
if not load_status:
output_objects.append({
'object_type':
'error_text',
'text':
'failed to load saved %s settings' % vgrid_name
})
return (output_objects, returnvalues.SYSTEM_ERROR)
if saved_settings.get('write_shared_files', keyword_members) != \
keyword_members:
logger.warning("%s can't delete vgrid %s - write limited!" %
(client_id, vgrid_name))
output_objects.append({
'object_type':
'error_text',
'text':
"""You can't delete
write-restricted %ss - first remove any write restrictions for shared files
on the admin page and then try again.""" % label
})
return (output_objects, returnvalues.CLIENT_ERROR)
# When reaching here, OK to remove the VGrid.
# if top-level: unlink, remove all files and directories,
# in all cases: remove configuration entry for the VGrid
# unlink and move new-style vgrid sub dir to parent
logger.info('Deleting %s and all related data as requested by %s' %
(vgrid_name, cert_id))
if (cert_id in owners_direct):
# owner owns this vgrid, direct ownership
logger.debug('%s looks like a top-level vgrid.' % vgrid_name)
logger.debug('Deleting all related files.')
user_dir = os.path.abspath(
os.path.join(configuration.user_home, cert_dir)) + os.sep
(share_lnk, share_msg) = unlink_share(user_dir, vgrid_name)
(web_lnk, web_msg) = unlink_web_folders(user_dir, vgrid_name)
(files_act,
files_msg) = abandon_vgrid_files(vgrid_name, configuration)
else:
# owner owns some parent vgrid - ownership is only inherited
logger.debug('%s looks like a sub-vgrid, ownership inherited.' %
vgrid_name)
logger.debug('Only removing entry, leaving files in place.')
share_lnk, share_msg = True, ''
web_lnk, web_msg = True, ''
(files_act,
files_msg) = inherit_vgrid_files(vgrid_name, configuration)
(removed, entry_msg) = remove_vgrid_entry(vgrid_name, configuration)
output_objects.append({
'object_type':
'text',
'text':
'%s has been removed with last owner.' % vgrid_name
})
output_objects.append({
'object_type': 'link',
'destination': 'vgridman.py',
'text': 'Back to the overview.'
})
if not share_lnk or not web_lnk or not files_act or not removed:
err = '\n'.join([share_msg, web_msg, files_msg, entry_msg])
logger.error('Errors while removing %s:\n%s.' % (vgrid_name, err))
output_objects.append({
'object_type':
'error_text',
'text':
'''
An internal error occurred, error conditions have been logged.'''
})
output_objects.append({
'object_type':
'text',
'text':
'''
You can help us fix the problem by notifying the administrators
via mail about what you wanted to do when the error happened.'''
})
return (output_objects, returnvalues.CLIENT_ERROR)
else:
# Remove vgrid from vgrid cache (after deleting all)
unmap_vgrid(configuration, vgrid_name)
return (output_objects, returnvalues.OK)
