osm_nbi/admin_topics.py

   1 # -*- coding: utf-8 -*-
   2
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6 #
   7 #    http://www.apache.org/licenses/LICENSE-2.0
   8 #
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
  12 # implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 # import logging
  17 from uuid import uuid4
  18 from hashlib import sha256
  19 from http import HTTPStatus
  20 from time import time
  21 from validation import user_new_schema, user_edit_schema, project_new_schema, project_edit_schema
  22 from validation import vim_account_new_schema, vim_account_edit_schema, sdn_new_schema, sdn_edit_schema
  23 from validation import wim_account_new_schema, wim_account_edit_schema, roles_new_schema, roles_edit_schema
  24 from validation import validate_input
  25 from validation import ValidationError
  26 from validation import is_valid_uuid    # To check that User/Project Names don't look like UUIDs
  27 from base_topic import BaseTopic, EngineException
  28 from authconn_keystone import AuthconnKeystone
  29
  30 __author__ = "Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
  31
  32
  33 class UserTopic(BaseTopic):
  34     topic = "users"
  35     topic_msg = "users"
  36     schema_new = user_new_schema
  37     schema_edit = user_edit_schema
  38     multiproject = False
  39
  40     def __init__(self, db, fs, msg):
  41         BaseTopic.__init__(self, db, fs, msg)
  42
  43     @staticmethod
  44     def _get_project_filter(session):
  45         """
  46         Generates a filter dictionary for querying database users.
  47         Current policy is admin can show all, non admin, only its own user.
  48         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
  49         :return:
  50         """
  51         if session["admin"]:  # allows all
  52             return {}
  53         else:
  54             return {"username": session["username"]}
  55
  56     def check_conflict_on_new(self, session, indata):
  57         # check username not exists
  58         if self.db.get_one(self.topic, {"username": indata.get("username")}, fail_on_empty=False, fail_on_more=False):
  59             raise EngineException("username '{}' exists".format(indata["username"]), HTTPStatus.CONFLICT)
  60         # check projects
  61         if not session["force"]:
  62             for p in indata.get("projects") or []:
  63                 # To allow project addressing by Name as well as ID
  64                 if not self.db.get_one("projects", {BaseTopic.id_field("projects", p): p}, fail_on_empty=False,
  65                                        fail_on_more=False):
  66                     raise EngineException("project '{}' does not exist".format(p), HTTPStatus.CONFLICT)
  67
  68     def check_conflict_on_del(self, session, _id, db_content):
  69         """
  70         Check if deletion can be done because of dependencies if it is not force. To override
  71         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
  72         :param _id: internal _id
  73         :param db_content: The database content of this item _id
  74         :return: None if ok or raises EngineException with the conflict
  75         """
  76         if _id == session["username"]:
  77             raise EngineException("You cannot delete your own user", http_code=HTTPStatus.CONFLICT)
  78
  79     @staticmethod
  80     def format_on_new(content, project_id=None, make_public=False):
  81         BaseTopic.format_on_new(content, make_public=False)
  82         # Removed so that the UUID is kept, to allow User Name modification
  83         # content["_id"] = content["username"]
  84         salt = uuid4().hex
  85         content["_admin"]["salt"] = salt
  86         if content.get("password"):
  87             content["password"] = sha256(content["password"].encode('utf-8') + salt.encode('utf-8')).hexdigest()
  88         if content.get("project_role_mappings"):
  89             projects = [mapping[0] for mapping in content["project_role_mappings"]]
  90
  91             if content.get("projects"):
  92                 content["projects"] += projects
  93             else:
  94                 content["projects"] = projects
  95
  96     @staticmethod
  97     def format_on_edit(final_content, edit_content):
  98         BaseTopic.format_on_edit(final_content, edit_content)
  99         if edit_content.get("password"):
 100             salt = uuid4().hex
 101             final_content["_admin"]["salt"] = salt
 102             final_content["password"] = sha256(edit_content["password"].encode('utf-8') +
 103                                                salt.encode('utf-8')).hexdigest()
 104         return None
 105
 106     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 107         if not session["admin"]:
 108             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 109         # Names that look like UUIDs are not allowed
 110         name = (indata if indata else kwargs).get("username")
 111         if is_valid_uuid(name):
 112             raise EngineException("Usernames that look like UUIDs are not allowed",
 113                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 114         return BaseTopic.edit(self, session, _id, indata=indata, kwargs=kwargs, content=content)
 115
 116     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 117         if not session["admin"]:
 118             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 119         # Names that look like UUIDs are not allowed
 120         name = indata["username"] if indata else kwargs["username"]
 121         if is_valid_uuid(name):
 122             raise EngineException("Usernames that look like UUIDs are not allowed",
 123                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 124         return BaseTopic.new(self, rollback, session, indata=indata, kwargs=kwargs, headers=headers)
 125
 126
 127 class ProjectTopic(BaseTopic):
 128     topic = "projects"
 129     topic_msg = "projects"
 130     schema_new = project_new_schema
 131     schema_edit = project_edit_schema
 132     multiproject = False
 133
 134     def __init__(self, db, fs, msg):
 135         BaseTopic.__init__(self, db, fs, msg)
 136
 137     @staticmethod
 138     def _get_project_filter(session):
 139         """
 140         Generates a filter dictionary for querying database users.
 141         Current policy is admin can show all, non admin, only its own user.
 142         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 143         :return:
 144         """
 145         if session["admin"]:  # allows all
 146             return {}
 147         else:
 148             return {"_id.cont": session["project_id"]}
 149
 150     def check_conflict_on_new(self, session, indata):
 151         if not indata.get("name"):
 152             raise EngineException("missing 'name'")
 153         # check name not exists
 154         if self.db.get_one(self.topic, {"name": indata.get("name")}, fail_on_empty=False, fail_on_more=False):
 155             raise EngineException("name '{}' exists".format(indata["name"]), HTTPStatus.CONFLICT)
 156
 157     @staticmethod
 158     def format_on_new(content, project_id=None, make_public=False):
 159         BaseTopic.format_on_new(content, None)
 160         # Removed so that the UUID is kept, to allow Project Name modification
 161         # content["_id"] = content["name"]
 162
 163     def check_conflict_on_del(self, session, _id, db_content):
 164         """
 165         Check if deletion can be done because of dependencies if it is not force. To override
 166         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 167         :param _id: internal _id
 168         :param db_content: The database content of this item _id
 169         :return: None if ok or raises EngineException with the conflict
 170         """
 171         if _id in session["project_id"]:
 172             raise EngineException("You cannot delete your own project", http_code=HTTPStatus.CONFLICT)
 173         if session["force"]:
 174             return
 175         _filter = {"projects": _id}
 176         if self.db.get_list("users", _filter):
 177             raise EngineException("There is some USER that contains this project", http_code=HTTPStatus.CONFLICT)
 178
 179     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 180         if not session["admin"]:
 181             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 182         # Names that look like UUIDs are not allowed
 183         name = (indata if indata else kwargs).get("name")
 184         if is_valid_uuid(name):
 185             raise EngineException("Project names that look like UUIDs are not allowed",
 186                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 187         return BaseTopic.edit(self, session, _id, indata=indata, kwargs=kwargs, content=content)
 188
 189     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 190         if not session["admin"]:
 191             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 192         # Names that look like UUIDs are not allowed
 193         name = indata["name"] if indata else kwargs["name"]
 194         if is_valid_uuid(name):
 195             raise EngineException("Project names that look like UUIDs are not allowed",
 196                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 197         return BaseTopic.new(self, rollback, session, indata=indata, kwargs=kwargs, headers=headers)
 198
 199
 200 class CommonVimWimSdn(BaseTopic):
 201     """Common class for VIM, WIM SDN just to unify methods that are equal to all of them"""
 202     config_to_encrypt = ()     # what keys at config must be encrypted because contains passwords
 203     password_to_encrypt = ""   # key that contains a password
 204
 205     @staticmethod
 206     def _create_operation(op_type, params=None):
 207         """
 208         Creates a dictionary with the information to an operation, similar to ns-lcm-op
 209         :param op_type: can be create, edit, delete
 210         :param params: operation input parameters
 211         :return: new dictionary with
 212         """
 213         now = time()
 214         return {
 215             "lcmOperationType": op_type,
 216             "operationState": "PROCESSING",
 217             "startTime": now,
 218             "statusEnteredTime": now,
 219             "detailed-status": "",
 220             "operationParams": params,
 221         }
 222
 223     def check_conflict_on_new(self, session, indata):
 224         """
 225         Check that the data to be inserted is valid. It is checked that name is unique
 226         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 227         :param indata: data to be inserted
 228         :return: None or raises EngineException
 229         """
 230         self.check_unique_name(session, indata["name"], _id=None)
 231
 232     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 233         """
 234         Check that the data to be edited/uploaded is valid. It is checked that name is unique
 235         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 236         :param final_content: data once modified. This method may change it.
 237         :param edit_content: incremental data that contains the modifications to apply
 238         :param _id: internal _id
 239         :return: None or raises EngineException
 240         """
 241         if not session["force"] and edit_content.get("name"):
 242             self.check_unique_name(session, edit_content["name"], _id=_id)
 243
 244     def format_on_edit(self, final_content, edit_content):
 245         """
 246         Modifies final_content inserting admin information upon edition
 247         :param final_content: final content to be stored at database
 248         :param edit_content: user requested update content
 249         :return: operation id
 250         """
 251
 252         # encrypt passwords
 253         schema_version = final_content.get("schema_version")
 254         if schema_version:
 255             if edit_content.get(self.password_to_encrypt):
 256                 final_content[self.password_to_encrypt] = self.db.encrypt(edit_content[self.password_to_encrypt],
 257                                                                           schema_version=schema_version,
 258                                                                           salt=final_content["_id"])
 259             if edit_content.get("config") and self.config_to_encrypt:
 260                 for p in self.config_to_encrypt:
 261                     if edit_content["config"].get(p):
 262                         final_content["config"][p] = self.db.encrypt(edit_content["config"][p],
 263                                                                      schema_version=schema_version,
 264                                                                      salt=final_content["_id"])
 265
 266         # create edit operation
 267         final_content["_admin"]["operations"].append(self._create_operation("edit"))
 268         return "{}:{}".format(final_content["_id"], len(final_content["_admin"]["operations"]) - 1)
 269
 270     def format_on_new(self, content, project_id=None, make_public=False):
 271         """
 272         Modifies content descriptor to include _admin and insert create operation
 273         :param content: descriptor to be modified
 274         :param project_id: if included, it add project read/write permissions. Can be None or a list
 275         :param make_public: if included it is generated as public for reading.
 276         :return: op_id: operation id on asynchronous operation, None otherwise. In addition content is modified
 277         """
 278         super().format_on_new(content, project_id=project_id, make_public=make_public)
 279         content["schema_version"] = schema_version = "1.1"
 280
 281         # encrypt passwords
 282         if content.get(self.password_to_encrypt):
 283             content[self.password_to_encrypt] = self.db.encrypt(content[self.password_to_encrypt],
 284                                                                 schema_version=schema_version,
 285                                                                 salt=content["_id"])
 286         if content.get("config") and self.config_to_encrypt:
 287             for p in self.config_to_encrypt:
 288                 if content["config"].get(p):
 289                     content["config"][p] = self.db.encrypt(content["config"][p],
 290                                                            schema_version=schema_version,
 291                                                            salt=content["_id"])
 292
 293         content["_admin"]["operationalState"] = "PROCESSING"
 294
 295         # create operation
 296         content["_admin"]["operations"] = [self._create_operation("create")]
 297         content["_admin"]["current_operation"] = None
 298
 299         return "{}:0".format(content["_id"])
 300
 301     def delete(self, session, _id, dry_run=False):
 302         """
 303         Delete item by its internal _id
 304         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 305         :param _id: server internal id
 306         :param dry_run: make checking but do not delete
 307         :return: operation id if it is ordered to delete. None otherwise
 308         """
 309
 310         filter_q = self._get_project_filter(session)
 311         filter_q["_id"] = _id
 312         db_content = self.db.get_one(self.topic, filter_q)
 313
 314         self.check_conflict_on_del(session, _id, db_content)
 315         if dry_run:
 316             return None
 317
 318         # remove reference from project_read. If not last delete
 319         if session["project_id"]:
 320             for project_id in session["project_id"]:
 321                 if project_id in db_content["_admin"]["projects_read"]:
 322                     db_content["_admin"]["projects_read"].remove(project_id)
 323                 if project_id in db_content["_admin"]["projects_write"]:
 324                     db_content["_admin"]["projects_write"].remove(project_id)
 325         else:
 326             db_content["_admin"]["projects_read"].clear()
 327             db_content["_admin"]["projects_write"].clear()
 328
 329         update_dict = {"_admin.projects_read": db_content["_admin"]["projects_read"],
 330                        "_admin.projects_write": db_content["_admin"]["projects_write"]
 331                        }
 332
 333         # check if there are projects referencing it (apart from ANY that means public)....
 334         if db_content["_admin"]["projects_read"] and (len(db_content["_admin"]["projects_read"]) > 1 or
 335                                                       db_content["_admin"]["projects_read"][0] != "ANY"):
 336             self.db.set_one(self.topic, filter_q, update_dict=update_dict)  # remove references but not delete
 337             return None
 338
 339         # It must be deleted
 340         if session["force"]:
 341             self.db.del_one(self.topic, {"_id": _id})
 342             op_id = None
 343             self._send_msg("deleted", {"_id": _id, "op_id": op_id})
 344         else:
 345             update_dict["_admin.to_delete"] = True
 346             self.db.set_one(self.topic, {"_id": _id},
 347                             update_dict=update_dict,
 348                             push={"_admin.operations": self._create_operation("delete")}
 349                             )
 350             # the number of operations is the operation_id. db_content does not contains the new operation inserted,
 351             # so the -1 is not needed
 352             op_id = "{}:{}".format(db_content["_id"], len(db_content["_admin"]["operations"]))
 353             self._send_msg("delete", {"_id": _id, "op_id": op_id})
 354         return op_id
 355
 356
 357 class VimAccountTopic(CommonVimWimSdn):
 358     topic = "vim_accounts"
 359     topic_msg = "vim_account"
 360     schema_new = vim_account_new_schema
 361     schema_edit = vim_account_edit_schema
 362     multiproject = True
 363     password_to_encrypt = "vim_password"
 364     config_to_encrypt = ("admin_password", "nsx_password", "vcenter_password")
 365
 366
 367 class WimAccountTopic(CommonVimWimSdn):
 368     topic = "wim_accounts"
 369     topic_msg = "wim_account"
 370     schema_new = wim_account_new_schema
 371     schema_edit = wim_account_edit_schema
 372     multiproject = True
 373     password_to_encrypt = "wim_password"
 374     config_to_encrypt = ()
 375
 376
 377 class SdnTopic(CommonVimWimSdn):
 378     topic = "sdns"
 379     topic_msg = "sdn"
 380     schema_new = sdn_new_schema
 381     schema_edit = sdn_edit_schema
 382     multiproject = True
 383     password_to_encrypt = "password"
 384     config_to_encrypt = ()
 385
 386
 387 class UserTopicAuth(UserTopic):
 388     # topic = "users"
 389     # topic_msg = "users"
 390     schema_new = user_new_schema
 391     schema_edit = user_edit_schema
 392
 393     def __init__(self, db, fs, msg, auth):
 394         UserTopic.__init__(self, db, fs, msg)
 395         self.auth = auth
 396
 397     def check_conflict_on_new(self, session, indata):
 398         """
 399         Check that the data to be inserted is valid
 400
 401         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 402         :param indata: data to be inserted
 403         :return: None or raises EngineException
 404         """
 405         username = indata.get("username")
 406         if is_valid_uuid(username):
 407             raise EngineException("username '{}' cannot have a uuid format".format(username),
 408                                   HTTPStatus.UNPROCESSABLE_ENTITY)
 409
 410         # Check that username is not used, regardless keystone already checks this
 411         if self.auth.get_user_list(filter_q={"name": username}):
 412             raise EngineException("username '{}' is already used".format(username), HTTPStatus.CONFLICT)
 413
 414         if "projects" in indata.keys():
 415             # convert to new format project_role_mappings
 416             if not indata.get("project_role_mappings"):
 417                 indata["project_role_mappings"] = []
 418             for project in indata["projects"]:
 419                 indata["project_role_mappings"].append({"project": project, "role": "project_user"})
 420             # raise EngineException("Format invalid: the keyword 'projects' is not allowed for keystone authentication",
 421             #                       HTTPStatus.BAD_REQUEST)
 422
 423     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 424         """
 425         Check that the data to be edited/uploaded is valid
 426
 427         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 428         :param final_content: data once modified
 429         :param edit_content: incremental data that contains the modifications to apply
 430         :param _id: internal _id
 431         :return: None or raises EngineException
 432         """
 433
 434         if "username" in edit_content:
 435             username = edit_content.get("username")
 436             if is_valid_uuid(username):
 437                 raise EngineException("username '{}' cannot have an uuid format".format(username),
 438                                       HTTPStatus.UNPROCESSABLE_ENTITY)
 439
 440             # Check that username is not used, regardless keystone already checks this
 441             if self.auth.get_user_list(filter_q={"name": username}):
 442                 raise EngineException("username '{}' is already used".format(username), HTTPStatus.CONFLICT)
 443
 444         if final_content["username"] == "admin":
 445             for mapping in edit_content.get("remove_project_role_mappings", ()):
 446                 if mapping["project"] == "admin" and mapping.get("role") in (None, "system_admin"):
 447                     # TODO make this also available for project id and role id
 448                     raise EngineException("You cannot remove system_admin role from admin user",
 449                                           http_code=HTTPStatus.FORBIDDEN)
 450
 451     def check_conflict_on_del(self, session, _id, db_content):
 452         """
 453         Check if deletion can be done because of dependencies if it is not force. To override
 454         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 455         :param _id: internal _id
 456         :param db_content: The database content of this item _id
 457         :return: None if ok or raises EngineException with the conflict
 458         """
 459         if db_content["username"] == session["username"]:
 460             raise EngineException("You cannot delete your own login user ", http_code=HTTPStatus.CONFLICT)
 461
 462     # @staticmethod
 463     # def format_on_new(content, project_id=None, make_public=False):
 464     #     """
 465     #     Modifies content descriptor to include _id.
 466     #
 467     #     NOTE: No password salt required because the authentication backend
 468     #     should handle these security concerns.
 469     #
 470     #     :param content: descriptor to be modified
 471     #     :param make_public: if included it is generated as public for reading.
 472     #     :return: None, but content is modified
 473     #     """
 474     #     BaseTopic.format_on_new(content, make_public=False)
 475     #     content["_id"] = content["username"]
 476     #     content["password"] = content["password"]
 477
 478     # @staticmethod
 479     # def format_on_edit(final_content, edit_content):
 480     #     """
 481     #     Modifies final_content descriptor to include the modified date.
 482     #
 483     #     NOTE: No password salt required because the authentication backend
 484     #     should handle these security concerns.
 485     #
 486     #     :param final_content: final descriptor generated
 487     #     :param edit_content: alterations to be include
 488     #     :return: None, but final_content is modified
 489     #     """
 490     #     BaseTopic.format_on_edit(final_content, edit_content)
 491     #     if "password" in edit_content:
 492     #         final_content["password"] = edit_content["password"]
 493     #     else:
 494     #         final_content["project_role_mappings"] = edit_content["project_role_mappings"]
 495
 496     @staticmethod
 497     def format_on_show(content):
 498         """
 499         Modifies the content of the role information to separate the role
 500         metadata from the role definition.
 501         """
 502         project_role_mappings = []
 503
 504         for project in content["projects"]:
 505             for role in project["roles"]:
 506                 project_role_mappings.append({"project": project["_id"],
 507                                               "project_name": project["name"],
 508                                               "role": role["_id"],
 509                                               "role_name": role["name"]})
 510
 511         del content["projects"]
 512         content["project_role_mappings"] = project_role_mappings
 513
 514         return content
 515
 516     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 517         """
 518         Creates a new entry into the authentication backend.
 519
 520         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
 521
 522         :param rollback: list to append created items at database in case a rollback may to be done
 523         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 524         :param indata: data to be inserted
 525         :param kwargs: used to override the indata descriptor
 526         :param headers: http request headers
 527         :return: _id: identity of the inserted data.
 528         """
 529         try:
 530             content = BaseTopic._remove_envelop(indata)
 531
 532             # Override descriptor with query string kwargs
 533             BaseTopic._update_input_with_kwargs(content, kwargs)
 534             content = self._validate_input_new(content, session["force"])
 535             self.check_conflict_on_new(session, content)
 536             # self.format_on_new(content, session["project_id"], make_public=session["public"])
 537             _id = self.auth.create_user(content["username"], content["password"])["_id"]
 538
 539             if "project_role_mappings" in content.keys():
 540                 for mapping in content["project_role_mappings"]:
 541                     self.auth.assign_role_to_user(_id, mapping["project"], mapping["role"])
 542
 543             rollback.append({"topic": self.topic, "_id": _id})
 544             # del content["password"]
 545             # self._send_msg("create", content)
 546             return _id
 547         except ValidationError as e:
 548             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 549
 550     def show(self, session, _id):
 551         """
 552         Get complete information on an topic
 553
 554         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 555         :param _id: server internal id
 556         :return: dictionary, raise exception if not found.
 557         """
 558         # Allow _id to be a name or uuid
 559         filter_q = {self.id_field(self.topic, _id): _id}
 560         users = self.auth.get_user_list(filter_q)
 561
 562         if len(users) == 1:
 563             return self.format_on_show(users[0])
 564         elif len(users) > 1:
 565             raise EngineException("Too many users found", HTTPStatus.CONFLICT)
 566         else:
 567             raise EngineException("User not found", HTTPStatus.NOT_FOUND)
 568
 569     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 570         """
 571         Updates an user entry.
 572
 573         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 574         :param _id:
 575         :param indata: data to be inserted
 576         :param kwargs: used to override the indata descriptor
 577         :param content:
 578         :return: _id: identity of the inserted data.
 579         """
 580         indata = self._remove_envelop(indata)
 581
 582         # Override descriptor with query string kwargs
 583         if kwargs:
 584             BaseTopic._update_input_with_kwargs(indata, kwargs)
 585         try:
 586             indata = self._validate_input_edit(indata, force=session["force"])
 587
 588             if not content:
 589                 content = self.show(session, _id)
 590             self.check_conflict_on_edit(session, content, indata, _id=_id)
 591             # self.format_on_edit(content, indata)
 592
 593             if "password" in indata or "username" in indata:
 594                 self.auth.update_user(_id, new_name=indata.get("username"), new_password=indata.get("password"))
 595             if not indata.get("remove_project_role_mappings") and not indata.get("add_project_role_mappings") and \
 596                     not indata.get("project_role_mappings"):
 597                 return _id
 598             if indata.get("project_role_mappings") and \
 599                     (indata.get("remove_project_role_mappings") or indata.get("add_project_role_mappings")):
 600                 raise EngineException("Option 'project_role_mappings' is incompatible with 'add_project_role_mappings"
 601                                       "' or 'remove_project_role_mappings'", http_code=HTTPStatus.BAD_REQUEST)
 602
 603             user = self.show(session, _id)
 604             original_mapping = user["project_role_mappings"]
 605
 606             mappings_to_add = []
 607             mappings_to_remove = []
 608
 609             # remove
 610             for to_remove in indata.get("remove_project_role_mappings", ()):
 611                 for mapping in original_mapping:
 612                     if to_remove["project"] in (mapping["project"], mapping["project_name"]):
 613                         if not to_remove.get("role") or to_remove["role"] in (mapping["role"], mapping["role_name"]):
 614                             mappings_to_remove.append(mapping)
 615
 616             # add
 617             for to_add in indata.get("add_project_role_mappings", ()):
 618                 for mapping in original_mapping:
 619                     if to_add["project"] in (mapping["project"], mapping["project_name"]) and \
 620                             to_add["role"] in (mapping["role"], mapping["role_name"]):
 621
 622                         if mapping in mappings_to_remove:   # do not remove
 623                             mappings_to_remove.remove(mapping)
 624                         break  # do not add, it is already at user
 625                 else:
 626                     mappings_to_add.append(to_add)
 627
 628             # set
 629             if indata.get("project_role_mappings"):
 630                 for to_set in indata["project_role_mappings"]:
 631                     for mapping in original_mapping:
 632                         if to_set["project"] in (mapping["project"], mapping["project_name"]) and \
 633                                 to_set["role"] in (mapping["role"], mapping["role_name"]):
 634
 635                             if mapping in mappings_to_remove:   # do not remove
 636                                 mappings_to_remove.remove(mapping)
 637                             break  # do not add, it is already at user
 638                     else:
 639                         mappings_to_add.append(to_set)
 640                 for mapping in original_mapping:
 641                     for to_set in indata["project_role_mappings"]:
 642                         if to_set["project"] in (mapping["project"], mapping["project_name"]) and \
 643                                 to_set["role"] in (mapping["role"], mapping["role_name"]):
 644                             break
 645                     else:
 646                         # delete
 647                         if mapping not in mappings_to_remove:   # do not remove
 648                             mappings_to_remove.append(mapping)
 649
 650             for mapping in mappings_to_remove:
 651                 self.auth.remove_role_from_user(
 652                     _id,
 653                     mapping["project"],
 654                     mapping["role"]
 655                 )
 656
 657             for mapping in mappings_to_add:
 658                 self.auth.assign_role_to_user(
 659                     _id,
 660                     mapping["project"],
 661                     mapping["role"]
 662                 )
 663
 664             return "_id"
 665         except ValidationError as e:
 666             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 667
 668     def list(self, session, filter_q=None):
 669         """
 670         Get a list of the topic that matches a filter
 671         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 672         :param filter_q: filter of data to be applied
 673         :return: The list, it can be empty if no one match the filter.
 674         """
 675         users = [self.format_on_show(user) for user in self.auth.get_user_list(filter_q)]
 676
 677         return users
 678
 679     def delete(self, session, _id, dry_run=False):
 680         """
 681         Delete item by its internal _id
 682
 683         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 684         :param _id: server internal id
 685         :param force: indicates if deletion must be forced in case of conflict
 686         :param dry_run: make checking but do not delete
 687         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
 688         """
 689         # Allow _id to be a name or uuid
 690         filter_q = {self.id_field(self.topic, _id): _id}
 691         user_list = self.auth.get_user_list(filter_q)
 692         if not user_list:
 693             raise EngineException("User '{}' not found".format(_id), http_code=HTTPStatus.NOT_FOUND)
 694         _id = user_list[0]["_id"]
 695         self.check_conflict_on_del(session, _id, user_list[0])
 696         if not dry_run:
 697             v = self.auth.delete_user(_id)
 698             return v
 699         return None
 700
 701
 702 class ProjectTopicAuth(ProjectTopic):
 703     # topic = "projects"
 704     # topic_msg = "projects"
 705     schema_new = project_new_schema
 706     schema_edit = project_edit_schema
 707
 708     def __init__(self, db, fs, msg, auth):
 709         ProjectTopic.__init__(self, db, fs, msg)
 710         self.auth = auth
 711
 712     def check_conflict_on_new(self, session, indata):
 713         """
 714         Check that the data to be inserted is valid
 715
 716         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 717         :param indata: data to be inserted
 718         :return: None or raises EngineException
 719         """
 720         project_name = indata.get("name")
 721         if is_valid_uuid(project_name):
 722             raise EngineException("project name '{}' cannot have an uuid format".format(project_name),
 723                                   HTTPStatus.UNPROCESSABLE_ENTITY)
 724
 725         project_list = self.auth.get_project_list(filter_q={"name": project_name})
 726
 727         if project_list:
 728             raise EngineException("project '{}' exists".format(project_name), HTTPStatus.CONFLICT)
 729
 730     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 731         """
 732         Check that the data to be edited/uploaded is valid
 733
 734         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 735         :param final_content: data once modified
 736         :param edit_content: incremental data that contains the modifications to apply
 737         :param _id: internal _id
 738         :return: None or raises EngineException
 739         """
 740
 741         project_name = edit_content.get("name")
 742         if project_name:
 743             if is_valid_uuid(project_name):
 744                 raise EngineException("project name  '{}' cannot be an uuid format".format(project_name),
 745                                       HTTPStatus.UNPROCESSABLE_ENTITY)
 746
 747             # Check that project name is not used, regardless keystone already checks this
 748             if self.auth.get_project_list(filter_q={"name": project_name}):
 749                 raise EngineException("project '{}' is already used".format(project_name), HTTPStatus.CONFLICT)
 750
 751     def check_conflict_on_del(self, session, _id, db_content):
 752         """
 753         Check if deletion can be done because of dependencies if it is not force. To override
 754
 755         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 756         :param _id: internal _id
 757         :param db_content: The database content of this item _id
 758         :return: None if ok or raises EngineException with the conflict
 759         """
 760         # projects = self.auth.get_project_list()
 761         # current_project = [project for project in projects
 762         #                    if project["name"] in session["project_id"]][0]
 763         # TODO check that any user is using this project, raise CONFLICT exception
 764         if _id == session["project_id"]:
 765             raise EngineException("You cannot delete your own project", http_code=HTTPStatus.CONFLICT)
 766
 767     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 768         """
 769         Creates a new entry into the authentication backend.
 770
 771         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
 772
 773         :param rollback: list to append created items at database in case a rollback may to be done
 774         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 775         :param indata: data to be inserted
 776         :param kwargs: used to override the indata descriptor
 777         :param headers: http request headers
 778         :return: _id: identity of the inserted data.
 779         """
 780         try:
 781             content = BaseTopic._remove_envelop(indata)
 782
 783             # Override descriptor with query string kwargs
 784             BaseTopic._update_input_with_kwargs(content, kwargs)
 785             content = self._validate_input_new(content, session["force"])
 786             self.check_conflict_on_new(session, content)
 787             self.format_on_new(content, project_id=session["project_id"], make_public=session["public"])
 788             _id = self.auth.create_project(content["name"])
 789             rollback.append({"topic": self.topic, "_id": _id})
 790             # self._send_msg("create", content)
 791             return _id
 792         except ValidationError as e:
 793             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 794
 795     def show(self, session, _id):
 796         """
 797         Get complete information on an topic
 798
 799         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 800         :param _id: server internal id
 801         :return: dictionary, raise exception if not found.
 802         """
 803         # Allow _id to be a name or uuid
 804         filter_q = {self.id_field(self.topic, _id): _id}
 805         projects = self.auth.get_project_list(filter_q=filter_q)
 806
 807         if len(projects) == 1:
 808             return projects[0]
 809         elif len(projects) > 1:
 810             raise EngineException("Too many projects found", HTTPStatus.CONFLICT)
 811         else:
 812             raise EngineException("Project not found", HTTPStatus.NOT_FOUND)
 813
 814     def list(self, session, filter_q=None):
 815         """
 816         Get a list of the topic that matches a filter
 817
 818         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 819         :param filter_q: filter of data to be applied
 820         :return: The list, it can be empty if no one match the filter.
 821         """
 822         return self.auth.get_project_list(filter_q)
 823
 824     def delete(self, session, _id, dry_run=False):
 825         """
 826         Delete item by its internal _id
 827
 828         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 829         :param _id: server internal id
 830         :param dry_run: make checking but do not delete
 831         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
 832         """
 833         # Allow _id to be a name or uuid
 834         filter_q = {self.id_field(self.topic, _id): _id}
 835         project_list = self.auth.get_project_list(filter_q)
 836         if not project_list:
 837             raise EngineException("Project '{}' not found".format(_id), http_code=HTTPStatus.NOT_FOUND)
 838         _id = project_list[0]["_id"]
 839         self.check_conflict_on_del(session, _id, project_list[0])
 840         if not dry_run:
 841             v = self.auth.delete_project(_id)
 842             return v
 843         return None
 844
 845     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 846         """
 847         Updates a project entry.
 848
 849         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 850         :param _id:
 851         :param indata: data to be inserted
 852         :param kwargs: used to override the indata descriptor
 853         :param content:
 854         :return: _id: identity of the inserted data.
 855         """
 856         indata = self._remove_envelop(indata)
 857
 858         # Override descriptor with query string kwargs
 859         if kwargs:
 860             BaseTopic._update_input_with_kwargs(indata, kwargs)
 861         try:
 862             indata = self._validate_input_edit(indata, force=session["force"])
 863
 864             if not content:
 865                 content = self.show(session, _id)
 866             self.check_conflict_on_edit(session, content, indata, _id=_id)
 867             # self.format_on_edit(content, indata)
 868
 869             if "name" in indata:
 870                 self.auth.update_project(content["_id"], indata["name"])
 871         except ValidationError as e:
 872             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 873
 874
 875 class RoleTopicAuth(BaseTopic):
 876     topic = "roles"
 877     topic_msg = None    # "roles"
 878     schema_new = roles_new_schema
 879     schema_edit = roles_edit_schema
 880     multiproject = False
 881
 882     def __init__(self, db, fs, msg, auth, ops):
 883         BaseTopic.__init__(self, db, fs, msg)
 884         self.auth = auth
 885         self.operations = ops
 886         self.topic = "roles_operations" if isinstance(auth, AuthconnKeystone) else "roles"
 887
 888     @staticmethod
 889     def validate_role_definition(operations, role_definitions):
 890         """
 891         Validates the role definition against the operations defined in
 892         the resources to operations files.
 893
 894         :param operations: operations list
 895         :param role_definitions: role definition to test
 896         :return: None if ok, raises ValidationError exception on error
 897         """
 898         if not role_definitions.get("permissions"):
 899             return
 900         ignore_fields = ["admin", "default"]
 901         for role_def in role_definitions["permissions"].keys():
 902             if role_def in ignore_fields:
 903                 continue
 904             if role_def[-1] == ":":
 905                 raise ValidationError("Operation cannot end with ':'")
 906
 907             role_def_matches = [op for op in operations if op.startswith(role_def)]
 908
 909             if len(role_def_matches) == 0:
 910                 raise ValidationError("Invalid permission '{}'".format(role_def))
 911
 912     def _validate_input_new(self, input, force=False):
 913         """
 914         Validates input user content for a new entry.
 915
 916         :param input: user input content for the new topic
 917         :param force: may be used for being more tolerant
 918         :return: The same input content, or a changed version of it.
 919         """
 920         if self.schema_new:
 921             validate_input(input, self.schema_new)
 922             self.validate_role_definition(self.operations, input)
 923
 924         return input
 925
 926     def _validate_input_edit(self, input, force=False):
 927         """
 928         Validates input user content for updating an entry.
 929
 930         :param input: user input content for the new topic
 931         :param force: may be used for being more tolerant
 932         :return: The same input content, or a changed version of it.
 933         """
 934         if self.schema_edit:
 935             validate_input(input, self.schema_edit)
 936             self.validate_role_definition(self.operations, input)
 937
 938         return input
 939
 940     def check_conflict_on_new(self, session, indata):
 941         """
 942         Check that the data to be inserted is valid
 943
 944         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 945         :param indata: data to be inserted
 946         :return: None or raises EngineException
 947         """
 948         # check name not exists
 949         if self.db.get_one(self.topic, {"name": indata.get("name")}, fail_on_empty=False, fail_on_more=False):
 950             raise EngineException("role name '{}' exists".format(indata["name"]), HTTPStatus.CONFLICT)
 951
 952     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 953         """
 954         Check that the data to be edited/uploaded is valid
 955
 956         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 957         :param final_content: data once modified
 958         :param edit_content: incremental data that contains the modifications to apply
 959         :param _id: internal _id
 960         :return: None or raises EngineException
 961         """
 962         if "default" not in final_content["permissions"]:
 963             final_content["permissions"]["default"] = False
 964         if "admin" not in final_content["permissions"]:
 965             final_content["permissions"]["admin"] = False
 966
 967         # check name not exists
 968         if "name" in edit_content:
 969             role_name = edit_content["name"]
 970             if self.db.get_one(self.topic, {"name": role_name, "_id.ne": _id}, fail_on_empty=False, fail_on_more=False):
 971                 raise EngineException("role name '{}' exists".format(role_name), HTTPStatus.CONFLICT)
 972
 973     def check_conflict_on_del(self, session, _id, db_content):
 974         """
 975         Check if deletion can be done because of dependencies if it is not force. To override
 976
 977         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 978         :param _id: internal _id
 979         :param db_content: The database content of this item _id
 980         :return: None if ok or raises EngineException with the conflict
 981         """
 982         roles = self.auth.get_role_list()
 983         system_admin_roles = [role for role in roles if role["name"] == "system_admin"]
 984
 985         if system_admin_roles and _id == system_admin_roles[0]["_id"]:
 986             raise EngineException("You cannot delete system_admin role", http_code=HTTPStatus.FORBIDDEN)
 987
 988     @staticmethod
 989     def format_on_new(content, project_id=None, make_public=False):
 990         """
 991         Modifies content descriptor to include _admin
 992
 993         :param content: descriptor to be modified
 994         :param project_id: if included, it add project read/write permissions
 995         :param make_public: if included it is generated as public for reading.
 996         :return: None, but content is modified
 997         """
 998         now = time()
 999         if "_admin" not in content:
1000             content["_admin"] = {}
1001         if not content["_admin"].get("created"):
1002             content["_admin"]["created"] = now
1003         content["_admin"]["modified"] = now
1004
1005         if "permissions" not in content:
1006             content["permissions"] = {}
1007
1008         if "default" not in content["permissions"]:
1009             content["permissions"]["default"] = False
1010         if "admin" not in content["permissions"]:
1011             content["permissions"]["admin"] = False
1012
1013     @staticmethod
1014     def format_on_edit(final_content, edit_content):
1015         """
1016         Modifies final_content descriptor to include the modified date.
1017
1018         :param final_content: final descriptor generated
1019         :param edit_content: alterations to be include
1020         :return: None, but final_content is modified
1021         """
1022         final_content["_admin"]["modified"] = time()
1023
1024         if "permissions" not in final_content:
1025             final_content["permissions"] = {}
1026
1027         if "default" not in final_content["permissions"]:
1028             final_content["permissions"]["default"] = False
1029         if "admin" not in final_content["permissions"]:
1030             final_content["permissions"]["admin"] = False
1031         return None
1032
1033     # @staticmethod
1034     # def format_on_show(content):
1035     #     """
1036     #     Modifies the content of the role information to separate the role
1037     #     metadata from the role definition. Eases the reading process of the
1038     #     role definition.
1039     #
1040     #     :param definition: role definition to be processed
1041     #     """
1042     #     content["_id"] = str(content["_id"])
1043     #
1044     # def show(self, session, _id):
1045     #     """
1046     #     Get complete information on an topic
1047     #
1048     #     :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1049     #     :param _id: server internal id
1050     #     :return: dictionary, raise exception if not found.
1051     #     """
1052     #     filter_db = {"_id": _id}
1053     #     filter_db = { BaseTopic.id_field(self.topic, _id): _id }   # To allow role addressing by name
1054     #
1055     #     role = self.db.get_one(self.topic, filter_db)
1056     #     new_role = dict(role)
1057     #     self.format_on_show(new_role)
1058     #
1059     #     return new_role
1060
1061     # def list(self, session, filter_q=None):
1062     #     """
1063     #     Get a list of the topic that matches a filter
1064     #
1065     #     :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1066     #     :param filter_q: filter of data to be applied
1067     #     :return: The list, it can be empty if no one match the filter.
1068     #     """
1069     #     if not filter_q:
1070     #         filter_q = {}
1071     #
1072     #     if ":" in filter_q:
1073     #         filter_q["root"] = filter_q[":"]
1074     #
1075     #     for key in filter_q.keys():
1076     #         if key == "name":
1077     #             continue
1078     #         filter_q[key] = filter_q[key] in ["True", "true"]
1079     #
1080     #     roles = self.db.get_list(self.topic, filter_q)
1081     #     new_roles = []
1082     #
1083     #     for role in roles:
1084     #         new_role = dict(role)
1085     #         self.format_on_show(new_role)
1086     #         new_roles.append(new_role)
1087     #
1088     #     return new_roles
1089
1090     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
1091         """
1092         Creates a new entry into database.
1093
1094         :param rollback: list to append created items at database in case a rollback may to be done
1095         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1096         :param indata: data to be inserted
1097         :param kwargs: used to override the indata descriptor
1098         :param headers: http request headers
1099         :return: _id: identity of the inserted data.
1100         """
1101         try:
1102             content = self._remove_envelop(indata)
1103
1104             # Override descriptor with query string kwargs
1105             self._update_input_with_kwargs(content, kwargs)
1106             content = self._validate_input_new(content, session["force"])
1107             self.check_conflict_on_new(session, content)
1108             self.format_on_new(content, project_id=session["project_id"], make_public=session["public"])
1109             role_name = content["name"]
1110             role_id = self.auth.create_role(role_name)
1111             content["_id"] = role_id
1112             _id = self.db.create(self.topic, content)
1113             rollback.append({"topic": self.topic, "_id": _id})
1114             # self._send_msg("create", content)
1115             return _id
1116         except ValidationError as e:
1117             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1118
1119     def delete(self, session, _id, dry_run=False):
1120         """
1121         Delete item by its internal _id
1122
1123         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1124         :param _id: server internal id
1125         :param dry_run: make checking but do not delete
1126         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
1127         """
1128         self.check_conflict_on_del(session, _id, None)
1129         # filter_q = {"_id": _id}
1130         filter_q = {BaseTopic.id_field(self.topic, _id): _id}   # To allow role addressing by name
1131         if not dry_run:
1132             self.auth.delete_role(_id)
1133             v = self.db.del_one(self.topic, filter_q)
1134             return v
1135         return None
1136
1137     def edit(self, session, _id, indata=None, kwargs=None, content=None):
1138         """
1139         Updates a role entry.
1140
1141         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1142         :param _id:
1143         :param indata: data to be inserted
1144         :param kwargs: used to override the indata descriptor
1145         :param content:
1146         :return: _id: identity of the inserted data.
1147         """
1148         _id = super().edit(session, _id, indata, kwargs, content)
1149         if indata.get("name"):
1150             self.auth.update_role(_id, name=indata.get("name"))