osm_nbi/admin_topics.py

   1 # -*- coding: utf-8 -*-
   2
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6 #
   7 #    http://www.apache.org/licenses/LICENSE-2.0
   8 #
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
  12 # implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 # import logging
  17 from uuid import uuid4
  18 from hashlib import sha256
  19 from http import HTTPStatus
  20 from time import time
  21 from validation import user_new_schema, user_edit_schema, project_new_schema, project_edit_schema
  22 from validation import vim_account_new_schema, vim_account_edit_schema, sdn_new_schema, sdn_edit_schema
  23 from validation import wim_account_new_schema, wim_account_edit_schema, roles_new_schema, roles_edit_schema
  24 from validation import validate_input
  25 from validation import ValidationError
  26 from validation import is_valid_uuid    # To check that User/Project Names don't look like UUIDs
  27 from base_topic import BaseTopic, EngineException
  28 from osm_common.dbbase import deep_update_rfc7396
  29 from authconn import AuthconnNotFoundException, AuthconnConflictException
  30 # from authconn_keystone import AuthconnKeystone
  31
  32 __author__ = "Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
  33
  34
  35 class UserTopic(BaseTopic):
  36     topic = "users"
  37     topic_msg = "users"
  38     schema_new = user_new_schema
  39     schema_edit = user_edit_schema
  40     multiproject = False
  41
  42     def __init__(self, db, fs, msg):
  43         BaseTopic.__init__(self, db, fs, msg)
  44
  45     @staticmethod
  46     def _get_project_filter(session):
  47         """
  48         Generates a filter dictionary for querying database users.
  49         Current policy is admin can show all, non admin, only its own user.
  50         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
  51         :return:
  52         """
  53         if session["admin"]:  # allows all
  54             return {}
  55         else:
  56             return {"username": session["username"]}
  57
  58     def check_conflict_on_new(self, session, indata):
  59         # check username not exists
  60         if self.db.get_one(self.topic, {"username": indata.get("username")}, fail_on_empty=False, fail_on_more=False):
  61             raise EngineException("username '{}' exists".format(indata["username"]), HTTPStatus.CONFLICT)
  62         # check projects
  63         if not session["force"]:
  64             for p in indata.get("projects") or []:
  65                 # To allow project addressing by Name as well as ID
  66                 if not self.db.get_one("projects", {BaseTopic.id_field("projects", p): p}, fail_on_empty=False,
  67                                        fail_on_more=False):
  68                     raise EngineException("project '{}' does not exist".format(p), HTTPStatus.CONFLICT)
  69
  70     def check_conflict_on_del(self, session, _id, db_content):
  71         """
  72         Check if deletion can be done because of dependencies if it is not force. To override
  73         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
  74         :param _id: internal _id
  75         :param db_content: The database content of this item _id
  76         :return: None if ok or raises EngineException with the conflict
  77         """
  78         if _id == session["username"]:
  79             raise EngineException("You cannot delete your own user", http_code=HTTPStatus.CONFLICT)
  80
  81     @staticmethod
  82     def format_on_new(content, project_id=None, make_public=False):
  83         BaseTopic.format_on_new(content, make_public=False)
  84         # Removed so that the UUID is kept, to allow User Name modification
  85         # content["_id"] = content["username"]
  86         salt = uuid4().hex
  87         content["_admin"]["salt"] = salt
  88         if content.get("password"):
  89             content["password"] = sha256(content["password"].encode('utf-8') + salt.encode('utf-8')).hexdigest()
  90         if content.get("project_role_mappings"):
  91             projects = [mapping["project"] for mapping in content["project_role_mappings"]]
  92
  93             if content.get("projects"):
  94                 content["projects"] += projects
  95             else:
  96                 content["projects"] = projects
  97
  98     @staticmethod
  99     def format_on_edit(final_content, edit_content):
 100         BaseTopic.format_on_edit(final_content, edit_content)
 101         if edit_content.get("password"):
 102             salt = uuid4().hex
 103             final_content["_admin"]["salt"] = salt
 104             final_content["password"] = sha256(edit_content["password"].encode('utf-8') +
 105                                                salt.encode('utf-8')).hexdigest()
 106         return None
 107
 108     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 109         if not session["admin"]:
 110             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 111         # Names that look like UUIDs are not allowed
 112         name = (indata if indata else kwargs).get("username")
 113         if is_valid_uuid(name):
 114             raise EngineException("Usernames that look like UUIDs are not allowed",
 115                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 116         return BaseTopic.edit(self, session, _id, indata=indata, kwargs=kwargs, content=content)
 117
 118     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 119         if not session["admin"]:
 120             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 121         # Names that look like UUIDs are not allowed
 122         name = indata["username"] if indata else kwargs["username"]
 123         if is_valid_uuid(name):
 124             raise EngineException("Usernames that look like UUIDs are not allowed",
 125                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 126         return BaseTopic.new(self, rollback, session, indata=indata, kwargs=kwargs, headers=headers)
 127
 128
 129 class ProjectTopic(BaseTopic):
 130     topic = "projects"
 131     topic_msg = "projects"
 132     schema_new = project_new_schema
 133     schema_edit = project_edit_schema
 134     multiproject = False
 135
 136     def __init__(self, db, fs, msg):
 137         BaseTopic.__init__(self, db, fs, msg)
 138
 139     @staticmethod
 140     def _get_project_filter(session):
 141         """
 142         Generates a filter dictionary for querying database users.
 143         Current policy is admin can show all, non admin, only its own user.
 144         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 145         :return:
 146         """
 147         if session["admin"]:  # allows all
 148             return {}
 149         else:
 150             return {"_id.cont": session["project_id"]}
 151
 152     def check_conflict_on_new(self, session, indata):
 153         if not indata.get("name"):
 154             raise EngineException("missing 'name'")
 155         # check name not exists
 156         if self.db.get_one(self.topic, {"name": indata.get("name")}, fail_on_empty=False, fail_on_more=False):
 157             raise EngineException("name '{}' exists".format(indata["name"]), HTTPStatus.CONFLICT)
 158
 159     @staticmethod
 160     def format_on_new(content, project_id=None, make_public=False):
 161         BaseTopic.format_on_new(content, None)
 162         # Removed so that the UUID is kept, to allow Project Name modification
 163         # content["_id"] = content["name"]
 164
 165     def check_conflict_on_del(self, session, _id, db_content):
 166         """
 167         Check if deletion can be done because of dependencies if it is not force. To override
 168         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 169         :param _id: internal _id
 170         :param db_content: The database content of this item _id
 171         :return: None if ok or raises EngineException with the conflict
 172         """
 173         if _id in session["project_id"]:
 174             raise EngineException("You cannot delete your own project", http_code=HTTPStatus.CONFLICT)
 175         if session["force"]:
 176             return
 177         _filter = {"projects": _id}
 178         if self.db.get_list("users", _filter):
 179             raise EngineException("There is some USER that contains this project", http_code=HTTPStatus.CONFLICT)
 180
 181     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 182         if not session["admin"]:
 183             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 184         # Names that look like UUIDs are not allowed
 185         name = (indata if indata else kwargs).get("name")
 186         if is_valid_uuid(name):
 187             raise EngineException("Project names that look like UUIDs are not allowed",
 188                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 189         return BaseTopic.edit(self, session, _id, indata=indata, kwargs=kwargs, content=content)
 190
 191     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 192         if not session["admin"]:
 193             raise EngineException("needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED)
 194         # Names that look like UUIDs are not allowed
 195         name = indata["name"] if indata else kwargs["name"]
 196         if is_valid_uuid(name):
 197             raise EngineException("Project names that look like UUIDs are not allowed",
 198                                   http_code=HTTPStatus.UNPROCESSABLE_ENTITY)
 199         return BaseTopic.new(self, rollback, session, indata=indata, kwargs=kwargs, headers=headers)
 200
 201
 202 class CommonVimWimSdn(BaseTopic):
 203     """Common class for VIM, WIM SDN just to unify methods that are equal to all of them"""
 204     config_to_encrypt = ()     # what keys at config must be encrypted because contains passwords
 205     password_to_encrypt = ""   # key that contains a password
 206
 207     @staticmethod
 208     def _create_operation(op_type, params=None):
 209         """
 210         Creates a dictionary with the information to an operation, similar to ns-lcm-op
 211         :param op_type: can be create, edit, delete
 212         :param params: operation input parameters
 213         :return: new dictionary with
 214         """
 215         now = time()
 216         return {
 217             "lcmOperationType": op_type,
 218             "operationState": "PROCESSING",
 219             "startTime": now,
 220             "statusEnteredTime": now,
 221             "detailed-status": "",
 222             "operationParams": params,
 223         }
 224
 225     def check_conflict_on_new(self, session, indata):
 226         """
 227         Check that the data to be inserted is valid. It is checked that name is unique
 228         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 229         :param indata: data to be inserted
 230         :return: None or raises EngineException
 231         """
 232         self.check_unique_name(session, indata["name"], _id=None)
 233
 234     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 235         """
 236         Check that the data to be edited/uploaded is valid. It is checked that name is unique
 237         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 238         :param final_content: data once modified. This method may change it.
 239         :param edit_content: incremental data that contains the modifications to apply
 240         :param _id: internal _id
 241         :return: None or raises EngineException
 242         """
 243         if not session["force"] and edit_content.get("name"):
 244             self.check_unique_name(session, edit_content["name"], _id=_id)
 245
 246     def format_on_edit(self, final_content, edit_content):
 247         """
 248         Modifies final_content inserting admin information upon edition
 249         :param final_content: final content to be stored at database
 250         :param edit_content: user requested update content
 251         :return: operation id
 252         """
 253
 254         # encrypt passwords
 255         schema_version = final_content.get("schema_version")
 256         if schema_version:
 257             if edit_content.get(self.password_to_encrypt):
 258                 final_content[self.password_to_encrypt] = self.db.encrypt(edit_content[self.password_to_encrypt],
 259                                                                           schema_version=schema_version,
 260                                                                           salt=final_content["_id"])
 261             if edit_content.get("config") and self.config_to_encrypt:
 262                 for p in self.config_to_encrypt:
 263                     if edit_content["config"].get(p):
 264                         final_content["config"][p] = self.db.encrypt(edit_content["config"][p],
 265                                                                      schema_version=schema_version,
 266                                                                      salt=final_content["_id"])
 267
 268         # create edit operation
 269         final_content["_admin"]["operations"].append(self._create_operation("edit"))
 270         return "{}:{}".format(final_content["_id"], len(final_content["_admin"]["operations"]) - 1)
 271
 272     def format_on_new(self, content, project_id=None, make_public=False):
 273         """
 274         Modifies content descriptor to include _admin and insert create operation
 275         :param content: descriptor to be modified
 276         :param project_id: if included, it add project read/write permissions. Can be None or a list
 277         :param make_public: if included it is generated as public for reading.
 278         :return: op_id: operation id on asynchronous operation, None otherwise. In addition content is modified
 279         """
 280         super().format_on_new(content, project_id=project_id, make_public=make_public)
 281         content["schema_version"] = schema_version = "1.1"
 282
 283         # encrypt passwords
 284         if content.get(self.password_to_encrypt):
 285             content[self.password_to_encrypt] = self.db.encrypt(content[self.password_to_encrypt],
 286                                                                 schema_version=schema_version,
 287                                                                 salt=content["_id"])
 288         if content.get("config") and self.config_to_encrypt:
 289             for p in self.config_to_encrypt:
 290                 if content["config"].get(p):
 291                     content["config"][p] = self.db.encrypt(content["config"][p],
 292                                                            schema_version=schema_version,
 293                                                            salt=content["_id"])
 294
 295         content["_admin"]["operationalState"] = "PROCESSING"
 296
 297         # create operation
 298         content["_admin"]["operations"] = [self._create_operation("create")]
 299         content["_admin"]["current_operation"] = None
 300
 301         return "{}:0".format(content["_id"])
 302
 303     def delete(self, session, _id, dry_run=False):
 304         """
 305         Delete item by its internal _id
 306         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 307         :param _id: server internal id
 308         :param dry_run: make checking but do not delete
 309         :return: operation id if it is ordered to delete. None otherwise
 310         """
 311
 312         filter_q = self._get_project_filter(session)
 313         filter_q["_id"] = _id
 314         db_content = self.db.get_one(self.topic, filter_q)
 315
 316         self.check_conflict_on_del(session, _id, db_content)
 317         if dry_run:
 318             return None
 319
 320         # remove reference from project_read. If not last delete
 321         if session["project_id"]:
 322             for project_id in session["project_id"]:
 323                 if project_id in db_content["_admin"]["projects_read"]:
 324                     db_content["_admin"]["projects_read"].remove(project_id)
 325                 if project_id in db_content["_admin"]["projects_write"]:
 326                     db_content["_admin"]["projects_write"].remove(project_id)
 327         else:
 328             db_content["_admin"]["projects_read"].clear()
 329             db_content["_admin"]["projects_write"].clear()
 330
 331         update_dict = {"_admin.projects_read": db_content["_admin"]["projects_read"],
 332                        "_admin.projects_write": db_content["_admin"]["projects_write"]
 333                        }
 334
 335         # check if there are projects referencing it (apart from ANY that means public)....
 336         if db_content["_admin"]["projects_read"] and (len(db_content["_admin"]["projects_read"]) > 1 or
 337                                                       db_content["_admin"]["projects_read"][0] != "ANY"):
 338             self.db.set_one(self.topic, filter_q, update_dict=update_dict)  # remove references but not delete
 339             return None
 340
 341         # It must be deleted
 342         if session["force"]:
 343             self.db.del_one(self.topic, {"_id": _id})
 344             op_id = None
 345             self._send_msg("deleted", {"_id": _id, "op_id": op_id})
 346         else:
 347             update_dict["_admin.to_delete"] = True
 348             self.db.set_one(self.topic, {"_id": _id},
 349                             update_dict=update_dict,
 350                             push={"_admin.operations": self._create_operation("delete")}
 351                             )
 352             # the number of operations is the operation_id. db_content does not contains the new operation inserted,
 353             # so the -1 is not needed
 354             op_id = "{}:{}".format(db_content["_id"], len(db_content["_admin"]["operations"]))
 355             self._send_msg("delete", {"_id": _id, "op_id": op_id})
 356         return op_id
 357
 358
 359 class VimAccountTopic(CommonVimWimSdn):
 360     topic = "vim_accounts"
 361     topic_msg = "vim_account"
 362     schema_new = vim_account_new_schema
 363     schema_edit = vim_account_edit_schema
 364     multiproject = True
 365     password_to_encrypt = "vim_password"
 366     config_to_encrypt = ("admin_password", "nsx_password", "vcenter_password")
 367
 368
 369 class WimAccountTopic(CommonVimWimSdn):
 370     topic = "wim_accounts"
 371     topic_msg = "wim_account"
 372     schema_new = wim_account_new_schema
 373     schema_edit = wim_account_edit_schema
 374     multiproject = True
 375     password_to_encrypt = "wim_password"
 376     config_to_encrypt = ()
 377
 378
 379 class SdnTopic(CommonVimWimSdn):
 380     topic = "sdns"
 381     topic_msg = "sdn"
 382     schema_new = sdn_new_schema
 383     schema_edit = sdn_edit_schema
 384     multiproject = True
 385     password_to_encrypt = "password"
 386     config_to_encrypt = ()
 387
 388
 389 class UserTopicAuth(UserTopic):
 390     # topic = "users"
 391     # topic_msg = "users"
 392     schema_new = user_new_schema
 393     schema_edit = user_edit_schema
 394
 395     def __init__(self, db, fs, msg, auth):
 396         UserTopic.__init__(self, db, fs, msg)
 397         self.auth = auth
 398
 399     def check_conflict_on_new(self, session, indata):
 400         """
 401         Check that the data to be inserted is valid
 402
 403         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 404         :param indata: data to be inserted
 405         :return: None or raises EngineException
 406         """
 407         username = indata.get("username")
 408         if is_valid_uuid(username):
 409             raise EngineException("username '{}' cannot have a uuid format".format(username),
 410                                   HTTPStatus.UNPROCESSABLE_ENTITY)
 411
 412         # Check that username is not used, regardless keystone already checks this
 413         if self.auth.get_user_list(filter_q={"name": username}):
 414             raise EngineException("username '{}' is already used".format(username), HTTPStatus.CONFLICT)
 415
 416         if "projects" in indata.keys():
 417             # convert to new format project_role_mappings
 418             role = self.auth.get_role_list({"name": "project_admin"})
 419             if not role:
 420                 role = self.auth.get_role_list()
 421             if not role:
 422                 raise AuthconnNotFoundException("Can't find default role for user '{}'".format(username))
 423             rid = role[0]["_id"]
 424             if not indata.get("project_role_mappings"):
 425                 indata["project_role_mappings"] = []
 426             for project in indata["projects"]:
 427                 pid = self.auth.get_project(project)["_id"]
 428                 prm = {"project": pid, "role": rid}
 429                 if prm not in indata["project_role_mappings"]:
 430                     indata["project_role_mappings"].append(prm)
 431             # raise EngineException("Format invalid: the keyword 'projects' is not allowed for keystone authentication",
 432             #                       HTTPStatus.BAD_REQUEST)
 433
 434     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 435         """
 436         Check that the data to be edited/uploaded is valid
 437
 438         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 439         :param final_content: data once modified
 440         :param edit_content: incremental data that contains the modifications to apply
 441         :param _id: internal _id
 442         :return: None or raises EngineException
 443         """
 444
 445         if "username" in edit_content:
 446             username = edit_content.get("username")
 447             if is_valid_uuid(username):
 448                 raise EngineException("username '{}' cannot have an uuid format".format(username),
 449                                       HTTPStatus.UNPROCESSABLE_ENTITY)
 450
 451             # Check that username is not used, regardless keystone already checks this
 452             if self.auth.get_user_list(filter_q={"name": username}):
 453                 raise EngineException("username '{}' is already used".format(username), HTTPStatus.CONFLICT)
 454
 455         if final_content["username"] == "admin":
 456             for mapping in edit_content.get("remove_project_role_mappings", ()):
 457                 if mapping["project"] == "admin" and mapping.get("role") in (None, "system_admin"):
 458                     # TODO make this also available for project id and role id
 459                     raise EngineException("You cannot remove system_admin role from admin user",
 460                                           http_code=HTTPStatus.FORBIDDEN)
 461
 462     def check_conflict_on_del(self, session, _id, db_content):
 463         """
 464         Check if deletion can be done because of dependencies if it is not force. To override
 465         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 466         :param _id: internal _id
 467         :param db_content: The database content of this item _id
 468         :return: None if ok or raises EngineException with the conflict
 469         """
 470         if db_content["username"] == session["username"]:
 471             raise EngineException("You cannot delete your own login user ", http_code=HTTPStatus.CONFLICT)
 472         # TODO: Check that user is not logged in ? How? (Would require listing current tokens)
 473
 474     @staticmethod
 475     def format_on_show(content):
 476         """
 477         Modifies the content of the role information to separate the role
 478         metadata from the role definition.
 479         """
 480         project_role_mappings = []
 481
 482         if "projects" in content:
 483             for project in content["projects"]:
 484                 for role in project["roles"]:
 485                     project_role_mappings.append({"project": project["_id"],
 486                                                   "project_name": project["name"],
 487                                                   "role": role["_id"],
 488                                                   "role_name": role["name"]})
 489             del content["projects"]
 490         content["project_role_mappings"] = project_role_mappings
 491
 492         return content
 493
 494     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 495         """
 496         Creates a new entry into the authentication backend.
 497
 498         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
 499
 500         :param rollback: list to append created items at database in case a rollback may to be done
 501         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 502         :param indata: data to be inserted
 503         :param kwargs: used to override the indata descriptor
 504         :param headers: http request headers
 505         :return: _id: identity of the inserted data, operation _id (None)
 506         """
 507         try:
 508             content = BaseTopic._remove_envelop(indata)
 509
 510             # Override descriptor with query string kwargs
 511             BaseTopic._update_input_with_kwargs(content, kwargs)
 512             content = self._validate_input_new(content, session["force"])
 513             self.check_conflict_on_new(session, content)
 514             # self.format_on_new(content, session["project_id"], make_public=session["public"])
 515             now = time()
 516             content["_admin"] = {"created": now, "modified": now}
 517             prms = []
 518             for prm in content.get("project_role_mappings", []):
 519                 proj = self.auth.get_project(prm["project"], not session["force"])
 520                 role = self.auth.get_role(prm["role"], not session["force"])
 521                 pid = proj["_id"] if proj else None
 522                 rid = role["_id"] if role else None
 523                 prl = {"project": pid, "role": rid}
 524                 if prl not in prms:
 525                     prms.append(prl)
 526             content["project_role_mappings"] = prms
 527             # _id = self.auth.create_user(content["username"], content["password"])["_id"]
 528             _id = self.auth.create_user(content)["_id"]
 529
 530             rollback.append({"topic": self.topic, "_id": _id})
 531             # del content["password"]
 532             # self._send_msg("create", content)
 533             return _id, None
 534         except ValidationError as e:
 535             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 536
 537     def show(self, session, _id):
 538         """
 539         Get complete information on an topic
 540
 541         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 542         :param _id: server internal id
 543         :return: dictionary, raise exception if not found.
 544         """
 545         # Allow _id to be a name or uuid
 546         filter_q = {self.id_field(self.topic, _id): _id}
 547         users = self.auth.get_user_list(filter_q)
 548
 549         if len(users) == 1:
 550             return self.format_on_show(users[0])
 551         elif len(users) > 1:
 552             raise EngineException("Too many users found", HTTPStatus.CONFLICT)
 553         else:
 554             raise EngineException("User not found", HTTPStatus.NOT_FOUND)
 555
 556     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 557         """
 558         Updates an user entry.
 559
 560         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 561         :param _id:
 562         :param indata: data to be inserted
 563         :param kwargs: used to override the indata descriptor
 564         :param content:
 565         :return: _id: identity of the inserted data.
 566         """
 567         indata = self._remove_envelop(indata)
 568
 569         # Override descriptor with query string kwargs
 570         if kwargs:
 571             BaseTopic._update_input_with_kwargs(indata, kwargs)
 572         try:
 573             indata = self._validate_input_edit(indata, force=session["force"])
 574
 575             if not content:
 576                 content = self.show(session, _id)
 577             self.check_conflict_on_edit(session, content, indata, _id=_id)
 578             # self.format_on_edit(content, indata)
 579
 580             if not ("password" in indata or "username" in indata or indata.get("remove_project_role_mappings") or
 581                     indata.get("add_project_role_mappings") or indata.get("project_role_mappings") or
 582                     indata.get("projects") or indata.get("add_projects")):
 583                 return _id
 584             if indata.get("project_role_mappings") \
 585                     and (indata.get("remove_project_role_mappings") or indata.get("add_project_role_mappings")):
 586                 raise EngineException("Option 'project_role_mappings' is incompatible with 'add_project_role_mappings"
 587                                       "' or 'remove_project_role_mappings'", http_code=HTTPStatus.BAD_REQUEST)
 588
 589             if indata.get("projects") or indata.get("add_projects"):
 590                 role = self.auth.get_role_list({"name": "project_admin"})
 591                 if not role:
 592                     role = self.auth.get_role_list()
 593                 if not role:
 594                     raise AuthconnNotFoundException("Can't find a default role for user '{}'"
 595                                                     .format(content["username"]))
 596                 rid = role[0]["_id"]
 597                 if "add_project_role_mappings" not in indata:
 598                     indata["add_project_role_mappings"] = []
 599                 for proj in indata.get("projects", []) + indata.get("add_projects", []):
 600                     indata["add_project_role_mappings"].append({"project": proj, "role": rid})
 601
 602             # user = self.show(session, _id)   # Already in 'content'
 603             original_mapping = content["project_role_mappings"]
 604
 605             mappings_to_add = []
 606             mappings_to_remove = []
 607
 608             # remove
 609             for to_remove in indata.get("remove_project_role_mappings", ()):
 610                 for mapping in original_mapping:
 611                     if to_remove["project"] in (mapping["project"], mapping["project_name"]):
 612                         if not to_remove.get("role") or to_remove["role"] in (mapping["role"], mapping["role_name"]):
 613                             mappings_to_remove.append(mapping)
 614
 615             # add
 616             for to_add in indata.get("add_project_role_mappings", ()):
 617                 for mapping in original_mapping:
 618                     if to_add["project"] in (mapping["project"], mapping["project_name"]) and \
 619                             to_add["role"] in (mapping["role"], mapping["role_name"]):
 620
 621                         if mapping in mappings_to_remove:   # do not remove
 622                             mappings_to_remove.remove(mapping)
 623                         break  # do not add, it is already at user
 624                 else:
 625                     pid = self.auth.get_project(to_add["project"])["_id"]
 626                     rid = self.auth.get_role(to_add["role"])["_id"]
 627                     mappings_to_add.append({"project": pid, "role": rid})
 628
 629             # set
 630             if indata.get("project_role_mappings"):
 631                 for to_set in indata["project_role_mappings"]:
 632                     for mapping in original_mapping:
 633                         if to_set["project"] in (mapping["project"], mapping["project_name"]) and \
 634                                 to_set["role"] in (mapping["role"], mapping["role_name"]):
 635                             if mapping in mappings_to_remove:   # do not remove
 636                                 mappings_to_remove.remove(mapping)
 637                             break  # do not add, it is already at user
 638                     else:
 639                         pid = self.auth.get_project(to_set["project"])["_id"]
 640                         rid = self.auth.get_role(to_set["role"])["_id"]
 641                         mappings_to_add.append({"project": pid, "role": rid})
 642                 for mapping in original_mapping:
 643                     for to_set in indata["project_role_mappings"]:
 644                         if to_set["project"] in (mapping["project"], mapping["project_name"]) and \
 645                                 to_set["role"] in (mapping["role"], mapping["role_name"]):
 646                             break
 647                     else:
 648                         # delete
 649                         if mapping not in mappings_to_remove:   # do not remove
 650                             mappings_to_remove.append(mapping)
 651
 652             self.auth.update_user({"_id": _id, "username": indata.get("username"), "password": indata.get("password"),
 653                                    "add_project_role_mappings": mappings_to_add,
 654                                    "remove_project_role_mappings": mappings_to_remove
 655                                    })
 656
 657             # return _id
 658         except ValidationError as e:
 659             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 660
 661     def list(self, session, filter_q=None):
 662         """
 663         Get a list of the topic that matches a filter
 664         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 665         :param filter_q: filter of data to be applied
 666         :return: The list, it can be empty if no one match the filter.
 667         """
 668         users = [self.format_on_show(user) for user in self.auth.get_user_list(filter_q)]
 669
 670         return users
 671
 672     def delete(self, session, _id, dry_run=False):
 673         """
 674         Delete item by its internal _id
 675
 676         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 677         :param _id: server internal id
 678         :param force: indicates if deletion must be forced in case of conflict
 679         :param dry_run: make checking but do not delete
 680         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
 681         """
 682         # Allow _id to be a name or uuid
 683         user = self.auth.get_user(_id)
 684         uid = user["_id"]
 685         self.check_conflict_on_del(session, uid, user)
 686         if not dry_run:
 687             v = self.auth.delete_user(uid)
 688             return v
 689         return None
 690
 691
 692 class ProjectTopicAuth(ProjectTopic):
 693     # topic = "projects"
 694     # topic_msg = "projects"
 695     schema_new = project_new_schema
 696     schema_edit = project_edit_schema
 697
 698     def __init__(self, db, fs, msg, auth):
 699         ProjectTopic.__init__(self, db, fs, msg)
 700         self.auth = auth
 701
 702     def check_conflict_on_new(self, session, indata):
 703         """
 704         Check that the data to be inserted is valid
 705
 706         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 707         :param indata: data to be inserted
 708         :return: None or raises EngineException
 709         """
 710         project_name = indata.get("name")
 711         if is_valid_uuid(project_name):
 712             raise EngineException("project name '{}' cannot have an uuid format".format(project_name),
 713                                   HTTPStatus.UNPROCESSABLE_ENTITY)
 714
 715         project_list = self.auth.get_project_list(filter_q={"name": project_name})
 716
 717         if project_list:
 718             raise EngineException("project '{}' exists".format(project_name), HTTPStatus.CONFLICT)
 719
 720     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 721         """
 722         Check that the data to be edited/uploaded is valid
 723
 724         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 725         :param final_content: data once modified
 726         :param edit_content: incremental data that contains the modifications to apply
 727         :param _id: internal _id
 728         :return: None or raises EngineException
 729         """
 730
 731         project_name = edit_content.get("name")
 732         if project_name != final_content["name"]:  # It is a true renaming
 733             if is_valid_uuid(project_name):
 734                 raise EngineException("project name  '{}' cannot have an uuid format".format(project_name),
 735                                       HTTPStatus.UNPROCESSABLE_ENTITY)
 736
 737             if final_content["name"] == "admin":
 738                 raise EngineException("You cannot rename project 'admin'", http_code=HTTPStatus.CONFLICT)
 739
 740             # Check that project name is not used, regardless keystone already checks this
 741             if self.auth.get_project_list(filter_q={"name": project_name}):
 742                 raise EngineException("project '{}' is already used".format(project_name), HTTPStatus.CONFLICT)
 743
 744     def check_conflict_on_del(self, session, _id, db_content):
 745         """
 746         Check if deletion can be done because of dependencies if it is not force. To override
 747
 748         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 749         :param _id: internal _id
 750         :param db_content: The database content of this item _id
 751         :return: None if ok or raises EngineException with the conflict
 752         """
 753
 754         def check_rw_projects(topic, title, id_field):
 755             for desc in self.db.get_list(topic):
 756                 if _id in desc["_admin"]["projects_read"] + desc["_admin"]["projects_write"]:
 757                     raise EngineException("Project '{}' ({}) is being used by {} '{}'"
 758                                           .format(db_content["name"], _id, title, desc[id_field]), HTTPStatus.CONFLICT)
 759
 760         if _id in session["project_id"]:
 761             raise EngineException("You cannot delete your own project", http_code=HTTPStatus.CONFLICT)
 762
 763         if db_content["name"] == "admin":
 764             raise EngineException("You cannot delete project 'admin'", http_code=HTTPStatus.CONFLICT)
 765
 766         # If any user is using this project, raise CONFLICT exception
 767         if not session["force"]:
 768             for user in self.auth.get_user_list():
 769                 if _id in [proj["_id"] for proj in user.get("projects", [])]:
 770                     raise EngineException("Project '{}' ({}) is being used by user '{}'"
 771                                           .format(db_content["name"], _id, user["username"]), HTTPStatus.CONFLICT)
 772
 773         # If any VNFD, NSD, NST, PDU, etc. is using this project, raise CONFLICT exception
 774         if not session["force"]:
 775             check_rw_projects("vnfds", "VNF Descriptor", "id")
 776             check_rw_projects("nsds", "NS Descriptor", "id")
 777             check_rw_projects("nsts", "NS Template", "id")
 778             check_rw_projects("pdus", "PDU Descriptor", "name")
 779
 780     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 781         """
 782         Creates a new entry into the authentication backend.
 783
 784         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
 785
 786         :param rollback: list to append created items at database in case a rollback may to be done
 787         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 788         :param indata: data to be inserted
 789         :param kwargs: used to override the indata descriptor
 790         :param headers: http request headers
 791         :return: _id: identity of the inserted data, operation _id (None)
 792         """
 793         try:
 794             content = BaseTopic._remove_envelop(indata)
 795
 796             # Override descriptor with query string kwargs
 797             BaseTopic._update_input_with_kwargs(content, kwargs)
 798             content = self._validate_input_new(content, session["force"])
 799             self.check_conflict_on_new(session, content)
 800             self.format_on_new(content, project_id=session["project_id"], make_public=session["public"])
 801             _id = self.auth.create_project(content)
 802             rollback.append({"topic": self.topic, "_id": _id})
 803             # self._send_msg("create", content)
 804             return _id, None
 805         except ValidationError as e:
 806             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 807
 808     def show(self, session, _id):
 809         """
 810         Get complete information on an topic
 811
 812         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 813         :param _id: server internal id
 814         :return: dictionary, raise exception if not found.
 815         """
 816         # Allow _id to be a name or uuid
 817         filter_q = {self.id_field(self.topic, _id): _id}
 818         projects = self.auth.get_project_list(filter_q=filter_q)
 819
 820         if len(projects) == 1:
 821             return projects[0]
 822         elif len(projects) > 1:
 823             raise EngineException("Too many projects found", HTTPStatus.CONFLICT)
 824         else:
 825             raise EngineException("Project not found", HTTPStatus.NOT_FOUND)
 826
 827     def list(self, session, filter_q=None):
 828         """
 829         Get a list of the topic that matches a filter
 830
 831         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 832         :param filter_q: filter of data to be applied
 833         :return: The list, it can be empty if no one match the filter.
 834         """
 835         return self.auth.get_project_list(filter_q)
 836
 837     def delete(self, session, _id, dry_run=False):
 838         """
 839         Delete item by its internal _id
 840
 841         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 842         :param _id: server internal id
 843         :param dry_run: make checking but do not delete
 844         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
 845         """
 846         # Allow _id to be a name or uuid
 847         proj = self.auth.get_project(_id)
 848         pid = proj["_id"]
 849         self.check_conflict_on_del(session, pid, proj)
 850         if not dry_run:
 851             v = self.auth.delete_project(pid)
 852             return v
 853         return None
 854
 855     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 856         """
 857         Updates a project entry.
 858
 859         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 860         :param _id:
 861         :param indata: data to be inserted
 862         :param kwargs: used to override the indata descriptor
 863         :param content:
 864         :return: _id: identity of the inserted data.
 865         """
 866         indata = self._remove_envelop(indata)
 867
 868         # Override descriptor with query string kwargs
 869         if kwargs:
 870             BaseTopic._update_input_with_kwargs(indata, kwargs)
 871         try:
 872             indata = self._validate_input_edit(indata, force=session["force"])
 873
 874             if not content:
 875                 content = self.show(session, _id)
 876             self.check_conflict_on_edit(session, content, indata, _id=_id)
 877             self.format_on_edit(content, indata)
 878
 879             if "name" in indata:
 880                 content["name"] = indata["name"]
 881             self.auth.update_project(content["_id"], content)
 882         except ValidationError as e:
 883             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 884
 885
 886 class RoleTopicAuth(BaseTopic):
 887     topic = "roles"
 888     topic_msg = None    # "roles"
 889     schema_new = roles_new_schema
 890     schema_edit = roles_edit_schema
 891     multiproject = False
 892
 893     def __init__(self, db, fs, msg, auth, ops):
 894         BaseTopic.__init__(self, db, fs, msg)
 895         self.auth = auth
 896         self.operations = ops
 897         # self.topic = "roles_operations" if isinstance(auth, AuthconnKeystone) else "roles"
 898
 899     @staticmethod
 900     def validate_role_definition(operations, role_definitions):
 901         """
 902         Validates the role definition against the operations defined in
 903         the resources to operations files.
 904
 905         :param operations: operations list
 906         :param role_definitions: role definition to test
 907         :return: None if ok, raises ValidationError exception on error
 908         """
 909         if not role_definitions.get("permissions"):
 910             return
 911         ignore_fields = ["admin", "default"]
 912         for role_def in role_definitions["permissions"].keys():
 913             if role_def in ignore_fields:
 914                 continue
 915             if role_def[-1] == ":":
 916                 raise ValidationError("Operation cannot end with ':'")
 917
 918             role_def_matches = [op for op in operations if op.startswith(role_def)]
 919
 920             if len(role_def_matches) == 0:
 921                 raise ValidationError("Invalid permission '{}'".format(role_def))
 922
 923     def _validate_input_new(self, input, force=False):
 924         """
 925         Validates input user content for a new entry.
 926
 927         :param input: user input content for the new topic
 928         :param force: may be used for being more tolerant
 929         :return: The same input content, or a changed version of it.
 930         """
 931         if self.schema_new:
 932             validate_input(input, self.schema_new)
 933             self.validate_role_definition(self.operations, input)
 934
 935         return input
 936
 937     def _validate_input_edit(self, input, force=False):
 938         """
 939         Validates input user content for updating an entry.
 940
 941         :param input: user input content for the new topic
 942         :param force: may be used for being more tolerant
 943         :return: The same input content, or a changed version of it.
 944         """
 945         if self.schema_edit:
 946             validate_input(input, self.schema_edit)
 947             self.validate_role_definition(self.operations, input)
 948
 949         return input
 950
 951     def check_conflict_on_new(self, session, indata):
 952         """
 953         Check that the data to be inserted is valid
 954
 955         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 956         :param indata: data to be inserted
 957         :return: None or raises EngineException
 958         """
 959         # check name not exists
 960         name = indata["name"]
 961         # if self.db.get_one(self.topic, {"name": indata.get("name")}, fail_on_empty=False, fail_on_more=False):
 962         if self.auth.get_role_list({"name": name}):
 963             raise EngineException("role name '{}' exists".format(name), HTTPStatus.CONFLICT)
 964
 965     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 966         """
 967         Check that the data to be edited/uploaded is valid
 968
 969         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 970         :param final_content: data once modified
 971         :param edit_content: incremental data that contains the modifications to apply
 972         :param _id: internal _id
 973         :return: None or raises EngineException
 974         """
 975         if "default" not in final_content["permissions"]:
 976             final_content["permissions"]["default"] = False
 977         if "admin" not in final_content["permissions"]:
 978             final_content["permissions"]["admin"] = False
 979
 980         # check name not exists
 981         if "name" in edit_content:
 982             role_name = edit_content["name"]
 983             # if self.db.get_one(self.topic, {"name":role_name,"_id.ne":_id}, fail_on_empty=False, fail_on_more=False):
 984             roles = self.auth.get_role_list({"name": role_name})
 985             if roles and roles[0][BaseTopic.id_field("roles", _id)] != _id:
 986                 raise EngineException("role name '{}' exists".format(role_name), HTTPStatus.CONFLICT)
 987
 988     def check_conflict_on_del(self, session, _id, db_content):
 989         """
 990         Check if deletion can be done because of dependencies if it is not force. To override
 991
 992         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 993         :param _id: internal _id
 994         :param db_content: The database content of this item _id
 995         :return: None if ok or raises EngineException with the conflict
 996         """
 997         role = self.auth.get_role(_id)
 998         if role["name"] in ["system_admin", "project_admin"]:
 999             raise EngineException("You cannot delete role '{}'".format(role["name"]), http_code=HTTPStatus.FORBIDDEN)
1000
1001         # If any user is using this role, raise CONFLICT exception
1002         for user in self.auth.get_user_list():
1003             if _id in [prl["_id"] for proj in user.get("projects", []) for prl in proj.get("roles", [])]:
1004                 raise EngineException("Role '{}' ({}) is being used by user '{}'"
1005                                       .format(role["name"], _id, user["username"]), HTTPStatus.CONFLICT)
1006
1007     @staticmethod
1008     def format_on_new(content, project_id=None, make_public=False):   # TO BE REMOVED ?
1009         """
1010         Modifies content descriptor to include _admin
1011
1012         :param content: descriptor to be modified
1013         :param project_id: if included, it add project read/write permissions
1014         :param make_public: if included it is generated as public for reading.
1015         :return: None, but content is modified
1016         """
1017         now = time()
1018         if "_admin" not in content:
1019             content["_admin"] = {}
1020         if not content["_admin"].get("created"):
1021             content["_admin"]["created"] = now
1022         content["_admin"]["modified"] = now
1023
1024         if "permissions" not in content:
1025             content["permissions"] = {}
1026
1027         if "default" not in content["permissions"]:
1028             content["permissions"]["default"] = False
1029         if "admin" not in content["permissions"]:
1030             content["permissions"]["admin"] = False
1031
1032     @staticmethod
1033     def format_on_edit(final_content, edit_content):
1034         """
1035         Modifies final_content descriptor to include the modified date.
1036
1037         :param final_content: final descriptor generated
1038         :param edit_content: alterations to be include
1039         :return: None, but final_content is modified
1040         """
1041         if "_admin" in final_content:
1042             final_content["_admin"]["modified"] = time()
1043
1044         if "permissions" not in final_content:
1045             final_content["permissions"] = {}
1046
1047         if "default" not in final_content["permissions"]:
1048             final_content["permissions"]["default"] = False
1049         if "admin" not in final_content["permissions"]:
1050             final_content["permissions"]["admin"] = False
1051         return None
1052
1053     def show(self, session, _id):
1054         """
1055         Get complete information on an topic
1056
1057         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1058         :param _id: server internal id
1059         :return: dictionary, raise exception if not found.
1060         """
1061         filter_q = {BaseTopic.id_field(self.topic, _id): _id}
1062         roles = self.auth.get_role_list(filter_q)
1063         if not roles:
1064             raise AuthconnNotFoundException("Not found any role with filter {}".format(filter_q))
1065         elif len(roles) > 1:
1066             raise AuthconnConflictException("Found more than one role with filter {}".format(filter_q))
1067         return roles[0]
1068
1069     def list(self, session, filter_q=None):
1070         """
1071         Get a list of the topic that matches a filter
1072
1073         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1074         :param filter_q: filter of data to be applied
1075         :return: The list, it can be empty if no one match the filter.
1076         """
1077         return self.auth.get_role_list(filter_q)
1078
1079     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
1080         """
1081         Creates a new entry into database.
1082
1083         :param rollback: list to append created items at database in case a rollback may to be done
1084         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1085         :param indata: data to be inserted
1086         :param kwargs: used to override the indata descriptor
1087         :param headers: http request headers
1088         :return: _id: identity of the inserted data, operation _id (None)
1089         """
1090         try:
1091             content = self._remove_envelop(indata)
1092
1093             # Override descriptor with query string kwargs
1094             self._update_input_with_kwargs(content, kwargs)
1095             content = self._validate_input_new(content, session["force"])
1096             self.check_conflict_on_new(session, content)
1097             self.format_on_new(content, project_id=session["project_id"], make_public=session["public"])
1098             # role_name = content["name"]
1099             rid = self.auth.create_role(content)
1100             content["_id"] = rid
1101             # _id = self.db.create(self.topic, content)
1102             rollback.append({"topic": self.topic, "_id": rid})
1103             # self._send_msg("create", content)
1104             return rid, None
1105         except ValidationError as e:
1106             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1107
1108     def delete(self, session, _id, dry_run=False):
1109         """
1110         Delete item by its internal _id
1111
1112         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1113         :param _id: server internal id
1114         :param dry_run: make checking but do not delete
1115         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
1116         """
1117         filter_q = {BaseTopic.id_field(self.topic, _id): _id}
1118         roles = self.auth.get_role_list(filter_q)
1119         if not roles:
1120             raise AuthconnNotFoundException("Not found any role with filter {}".format(filter_q))
1121         elif len(roles) > 1:
1122             raise AuthconnConflictException("Found more than one role with filter {}".format(filter_q))
1123         rid = roles[0]["_id"]
1124         self.check_conflict_on_del(session, rid, None)
1125         # filter_q = {"_id": _id}
1126         # filter_q = {BaseTopic.id_field(self.topic, _id): _id}   # To allow role addressing by name
1127         if not dry_run:
1128             v = self.auth.delete_role(rid)
1129             # v = self.db.del_one(self.topic, filter_q)
1130             return v
1131         return None
1132
1133     def edit(self, session, _id, indata=None, kwargs=None, content=None):
1134         """
1135         Updates a role entry.
1136
1137         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1138         :param _id:
1139         :param indata: data to be inserted
1140         :param kwargs: used to override the indata descriptor
1141         :param content:
1142         :return: _id: identity of the inserted data.
1143         """
1144         if kwargs:
1145             self._update_input_with_kwargs(indata, kwargs)
1146         try:
1147             indata = self._validate_input_edit(indata, force=session["force"])
1148             if not content:
1149                 content = self.show(session, _id)
1150             deep_update_rfc7396(content, indata)
1151             self.check_conflict_on_edit(session, content, indata, _id=_id)
1152             self.format_on_edit(content, indata)
1153             self.auth.update_role(content)
1154         except ValidationError as e:
1155             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)