osm_nbi/admin_topics.py

   1 # -*- coding: utf-8 -*-
   2
   3 # Licensed under the Apache License, Version 2.0 (the "License");
   4 # you may not use this file except in compliance with the License.
   5 # You may obtain a copy of the License at
   6 #
   7 #    http://www.apache.org/licenses/LICENSE-2.0
   8 #
   9 # Unless required by applicable law or agreed to in writing, software
  10 # distributed under the License is distributed on an "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
  12 # implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16 # import logging
  17 from uuid import uuid4
  18 from hashlib import sha256
  19 from http import HTTPStatus
  20 from time import time
  21 from osm_nbi.validation import (
  22     user_new_schema,
  23     user_edit_schema,
  24     project_new_schema,
  25     project_edit_schema,
  26     vim_account_new_schema,
  27     vim_account_edit_schema,
  28     sdn_new_schema,
  29     sdn_edit_schema,
  30     wim_account_new_schema,
  31     wim_account_edit_schema,
  32     roles_new_schema,
  33     roles_edit_schema,
  34     k8scluster_new_schema,
  35     k8scluster_edit_schema,
  36     k8srepo_new_schema,
  37     k8srepo_edit_schema,
  38     vca_new_schema,
  39     vca_edit_schema,
  40     osmrepo_new_schema,
  41     osmrepo_edit_schema,
  42     validate_input,
  43     ValidationError,
  44     is_valid_uuid,
  45 )  # To check that User/Project Names don't look like UUIDs
  46 from osm_nbi.base_topic import BaseTopic, EngineException
  47 from osm_nbi.authconn import AuthconnNotFoundException, AuthconnConflictException
  48 from osm_common.dbbase import deep_update_rfc7396
  49 import copy
  50
  51 __author__ = "Alfonso Tierno <alfonso.tiernosepulveda@telefonica.com>"
  52
  53
  54 class UserTopic(BaseTopic):
  55     topic = "users"
  56     topic_msg = "users"
  57     schema_new = user_new_schema
  58     schema_edit = user_edit_schema
  59     multiproject = False
  60
  61     def __init__(self, db, fs, msg, auth):
  62         BaseTopic.__init__(self, db, fs, msg, auth)
  63
  64     @staticmethod
  65     def _get_project_filter(session):
  66         """
  67         Generates a filter dictionary for querying database users.
  68         Current policy is admin can show all, non admin, only its own user.
  69         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
  70         :return:
  71         """
  72         if session["admin"]:  # allows all
  73             return {}
  74         else:
  75             return {"username": session["username"]}
  76
  77     def check_conflict_on_new(self, session, indata):
  78         # check username not exists
  79         if self.db.get_one(
  80             self.topic,
  81             {"username": indata.get("username")},
  82             fail_on_empty=False,
  83             fail_on_more=False,
  84         ):
  85             raise EngineException(
  86                 "username '{}' exists".format(indata["username"]), HTTPStatus.CONFLICT
  87             )
  88         # check projects
  89         if not session["force"]:
  90             for p in indata.get("projects") or []:
  91                 # To allow project addressing by Name as well as ID
  92                 if not self.db.get_one(
  93                     "projects",
  94                     {BaseTopic.id_field("projects", p): p},
  95                     fail_on_empty=False,
  96                     fail_on_more=False,
  97                 ):
  98                     raise EngineException(
  99                         "project '{}' does not exist".format(p), HTTPStatus.CONFLICT
 100                     )
 101
 102     def check_conflict_on_del(self, session, _id, db_content):
 103         """
 104         Check if deletion can be done because of dependencies if it is not force. To override
 105         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 106         :param _id: internal _id
 107         :param db_content: The database content of this item _id
 108         :return: None if ok or raises EngineException with the conflict
 109         """
 110         if _id == session["username"]:
 111             raise EngineException(
 112                 "You cannot delete your own user", http_code=HTTPStatus.CONFLICT
 113             )
 114
 115     @staticmethod
 116     def format_on_new(content, project_id=None, make_public=False):
 117         BaseTopic.format_on_new(content, make_public=False)
 118         # Removed so that the UUID is kept, to allow User Name modification
 119         # content["_id"] = content["username"]
 120         salt = uuid4().hex
 121         content["_admin"]["salt"] = salt
 122         if content.get("password"):
 123             content["password"] = sha256(
 124                 content["password"].encode("utf-8") + salt.encode("utf-8")
 125             ).hexdigest()
 126         if content.get("project_role_mappings"):
 127             projects = [
 128                 mapping["project"] for mapping in content["project_role_mappings"]
 129             ]
 130
 131             if content.get("projects"):
 132                 content["projects"] += projects
 133             else:
 134                 content["projects"] = projects
 135
 136     @staticmethod
 137     def format_on_edit(final_content, edit_content):
 138         BaseTopic.format_on_edit(final_content, edit_content)
 139         if edit_content.get("password"):
 140             salt = uuid4().hex
 141             final_content["_admin"]["salt"] = salt
 142             final_content["password"] = sha256(
 143                 edit_content["password"].encode("utf-8") + salt.encode("utf-8")
 144             ).hexdigest()
 145         return None
 146
 147     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 148         if not session["admin"]:
 149             raise EngineException(
 150                 "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
 151             )
 152         # Names that look like UUIDs are not allowed
 153         name = (indata if indata else kwargs).get("username")
 154         if is_valid_uuid(name):
 155             raise EngineException(
 156                 "Usernames that look like UUIDs are not allowed",
 157                 http_code=HTTPStatus.UNPROCESSABLE_ENTITY,
 158             )
 159         return BaseTopic.edit(
 160             self, session, _id, indata=indata, kwargs=kwargs, content=content
 161         )
 162
 163     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 164         if not session["admin"]:
 165             raise EngineException(
 166                 "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
 167             )
 168         # Names that look like UUIDs are not allowed
 169         name = indata["username"] if indata else kwargs["username"]
 170         if is_valid_uuid(name):
 171             raise EngineException(
 172                 "Usernames that look like UUIDs are not allowed",
 173                 http_code=HTTPStatus.UNPROCESSABLE_ENTITY,
 174             )
 175         return BaseTopic.new(
 176             self, rollback, session, indata=indata, kwargs=kwargs, headers=headers
 177         )
 178
 179
 180 class ProjectTopic(BaseTopic):
 181     topic = "projects"
 182     topic_msg = "projects"
 183     schema_new = project_new_schema
 184     schema_edit = project_edit_schema
 185     multiproject = False
 186
 187     def __init__(self, db, fs, msg, auth):
 188         BaseTopic.__init__(self, db, fs, msg, auth)
 189
 190     @staticmethod
 191     def _get_project_filter(session):
 192         """
 193         Generates a filter dictionary for querying database users.
 194         Current policy is admin can show all, non admin, only its own user.
 195         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 196         :return:
 197         """
 198         if session["admin"]:  # allows all
 199             return {}
 200         else:
 201             return {"_id.cont": session["project_id"]}
 202
 203     def check_conflict_on_new(self, session, indata):
 204         if not indata.get("name"):
 205             raise EngineException("missing 'name'")
 206         # check name not exists
 207         if self.db.get_one(
 208             self.topic,
 209             {"name": indata.get("name")},
 210             fail_on_empty=False,
 211             fail_on_more=False,
 212         ):
 213             raise EngineException(
 214                 "name '{}' exists".format(indata["name"]), HTTPStatus.CONFLICT
 215             )
 216
 217     @staticmethod
 218     def format_on_new(content, project_id=None, make_public=False):
 219         BaseTopic.format_on_new(content, None)
 220         # Removed so that the UUID is kept, to allow Project Name modification
 221         # content["_id"] = content["name"]
 222
 223     def check_conflict_on_del(self, session, _id, db_content):
 224         """
 225         Check if deletion can be done because of dependencies if it is not force. To override
 226         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 227         :param _id: internal _id
 228         :param db_content: The database content of this item _id
 229         :return: None if ok or raises EngineException with the conflict
 230         """
 231         if _id in session["project_id"]:
 232             raise EngineException(
 233                 "You cannot delete your own project", http_code=HTTPStatus.CONFLICT
 234             )
 235         if session["force"]:
 236             return
 237         _filter = {"projects": _id}
 238         if self.db.get_list("users", _filter):
 239             raise EngineException(
 240                 "There is some USER that contains this project",
 241                 http_code=HTTPStatus.CONFLICT,
 242             )
 243
 244     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 245         if not session["admin"]:
 246             raise EngineException(
 247                 "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
 248             )
 249         # Names that look like UUIDs are not allowed
 250         name = (indata if indata else kwargs).get("name")
 251         if is_valid_uuid(name):
 252             raise EngineException(
 253                 "Project names that look like UUIDs are not allowed",
 254                 http_code=HTTPStatus.UNPROCESSABLE_ENTITY,
 255             )
 256         return BaseTopic.edit(
 257             self, session, _id, indata=indata, kwargs=kwargs, content=content
 258         )
 259
 260     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 261         if not session["admin"]:
 262             raise EngineException(
 263                 "needed admin privileges", http_code=HTTPStatus.UNAUTHORIZED
 264             )
 265         # Names that look like UUIDs are not allowed
 266         name = indata["name"] if indata else kwargs["name"]
 267         if is_valid_uuid(name):
 268             raise EngineException(
 269                 "Project names that look like UUIDs are not allowed",
 270                 http_code=HTTPStatus.UNPROCESSABLE_ENTITY,
 271             )
 272         return BaseTopic.new(
 273             self, rollback, session, indata=indata, kwargs=kwargs, headers=headers
 274         )
 275
 276
 277 class CommonVimWimSdn(BaseTopic):
 278     """Common class for VIM, WIM SDN just to unify methods that are equal to all of them"""
 279
 280     config_to_encrypt = (
 281         {}
 282     )  # what keys at config must be encrypted because contains passwords
 283     password_to_encrypt = ""  # key that contains a password
 284
 285     @staticmethod
 286     def _create_operation(op_type, params=None):
 287         """
 288         Creates a dictionary with the information to an operation, similar to ns-lcm-op
 289         :param op_type: can be create, edit, delete
 290         :param params: operation input parameters
 291         :return: new dictionary with
 292         """
 293         now = time()
 294         return {
 295             "lcmOperationType": op_type,
 296             "operationState": "PROCESSING",
 297             "startTime": now,
 298             "statusEnteredTime": now,
 299             "detailed-status": "",
 300             "operationParams": params,
 301         }
 302
 303     def check_conflict_on_new(self, session, indata):
 304         """
 305         Check that the data to be inserted is valid. It is checked that name is unique
 306         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 307         :param indata: data to be inserted
 308         :return: None or raises EngineException
 309         """
 310         self.check_unique_name(session, indata["name"], _id=None)
 311
 312     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 313         """
 314         Check that the data to be edited/uploaded is valid. It is checked that name is unique
 315         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 316         :param final_content: data once modified. This method may change it.
 317         :param edit_content: incremental data that contains the modifications to apply
 318         :param _id: internal _id
 319         :return: None or raises EngineException
 320         """
 321         if not session["force"] and edit_content.get("name"):
 322             self.check_unique_name(session, edit_content["name"], _id=_id)
 323
 324         return final_content
 325
 326     def format_on_edit(self, final_content, edit_content):
 327         """
 328         Modifies final_content inserting admin information upon edition
 329         :param final_content: final content to be stored at database
 330         :param edit_content: user requested update content
 331         :return: operation id
 332         """
 333         super().format_on_edit(final_content, edit_content)
 334
 335         # encrypt passwords
 336         schema_version = final_content.get("schema_version")
 337         if schema_version:
 338             if edit_content.get(self.password_to_encrypt):
 339                 final_content[self.password_to_encrypt] = self.db.encrypt(
 340                     edit_content[self.password_to_encrypt],
 341                     schema_version=schema_version,
 342                     salt=final_content["_id"],
 343                 )
 344             config_to_encrypt_keys = self.config_to_encrypt.get(
 345                 schema_version
 346             ) or self.config_to_encrypt.get("default")
 347             if edit_content.get("config") and config_to_encrypt_keys:
 348
 349                 for p in config_to_encrypt_keys:
 350                     if edit_content["config"].get(p):
 351                         final_content["config"][p] = self.db.encrypt(
 352                             edit_content["config"][p],
 353                             schema_version=schema_version,
 354                             salt=final_content["_id"],
 355                         )
 356
 357         # create edit operation
 358         final_content["_admin"]["operations"].append(self._create_operation("edit"))
 359         return "{}:{}".format(
 360             final_content["_id"], len(final_content["_admin"]["operations"]) - 1
 361         )
 362
 363     def format_on_new(self, content, project_id=None, make_public=False):
 364         """
 365         Modifies content descriptor to include _admin and insert create operation
 366         :param content: descriptor to be modified
 367         :param project_id: if included, it add project read/write permissions. Can be None or a list
 368         :param make_public: if included it is generated as public for reading.
 369         :return: op_id: operation id on asynchronous operation, None otherwise. In addition content is modified
 370         """
 371         super().format_on_new(content, project_id=project_id, make_public=make_public)
 372         content["schema_version"] = schema_version = "1.11"
 373
 374         # encrypt passwords
 375         if content.get(self.password_to_encrypt):
 376             content[self.password_to_encrypt] = self.db.encrypt(
 377                 content[self.password_to_encrypt],
 378                 schema_version=schema_version,
 379                 salt=content["_id"],
 380             )
 381         config_to_encrypt_keys = self.config_to_encrypt.get(
 382             schema_version
 383         ) or self.config_to_encrypt.get("default")
 384         if content.get("config") and config_to_encrypt_keys:
 385             for p in config_to_encrypt_keys:
 386                 if content["config"].get(p):
 387                     content["config"][p] = self.db.encrypt(
 388                         content["config"][p],
 389                         schema_version=schema_version,
 390                         salt=content["_id"],
 391                     )
 392
 393         content["_admin"]["operationalState"] = "PROCESSING"
 394
 395         # create operation
 396         content["_admin"]["operations"] = [self._create_operation("create")]
 397         content["_admin"]["current_operation"] = None
 398         # create Resource in Openstack based VIM
 399         if content.get("vim_type"):
 400             if content["vim_type"] == "openstack":
 401                 compute = {
 402                     "ram": {"total": None, "used": None},
 403                     "vcpus": {"total": None, "used": None},
 404                     "instances": {"total": None, "used": None},
 405                 }
 406                 storage = {
 407                     "volumes": {"total": None, "used": None},
 408                     "snapshots": {"total": None, "used": None},
 409                     "storage": {"total": None, "used": None},
 410                 }
 411                 network = {
 412                     "networks": {"total": None, "used": None},
 413                     "subnets": {"total": None, "used": None},
 414                     "floating_ips": {"total": None, "used": None},
 415                 }
 416                 content["resources"] = {
 417                     "compute": compute,
 418                     "storage": storage,
 419                     "network": network,
 420                 }
 421
 422         return "{}:0".format(content["_id"])
 423
 424     def delete(self, session, _id, dry_run=False, not_send_msg=None):
 425         """
 426         Delete item by its internal _id
 427         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 428         :param _id: server internal id
 429         :param dry_run: make checking but do not delete
 430         :param not_send_msg: To not send message (False) or store content (list) instead
 431         :return: operation id if it is ordered to delete. None otherwise
 432         """
 433
 434         filter_q = self._get_project_filter(session)
 435         filter_q["_id"] = _id
 436         db_content = self.db.get_one(self.topic, filter_q)
 437
 438         self.check_conflict_on_del(session, _id, db_content)
 439         if dry_run:
 440             return None
 441
 442         # remove reference from project_read if there are more projects referencing it. If it last one,
 443         # do not remove reference, but order via kafka to delete it
 444         if session["project_id"] and session["project_id"]:
 445             other_projects_referencing = next(
 446                 (
 447                     p
 448                     for p in db_content["_admin"]["projects_read"]
 449                     if p not in session["project_id"] and p != "ANY"
 450                 ),
 451                 None,
 452             )
 453
 454             # check if there are projects referencing it (apart from ANY, that means, public)....
 455             if other_projects_referencing:
 456                 # remove references but not delete
 457                 update_dict_pull = {
 458                     "_admin.projects_read": session["project_id"],
 459                     "_admin.projects_write": session["project_id"],
 460                 }
 461                 self.db.set_one(
 462                     self.topic, filter_q, update_dict=None, pull_list=update_dict_pull
 463                 )
 464                 return None
 465             else:
 466                 can_write = next(
 467                     (
 468                         p
 469                         for p in db_content["_admin"]["projects_write"]
 470                         if p == "ANY" or p in session["project_id"]
 471                     ),
 472                     None,
 473                 )
 474                 if not can_write:
 475                     raise EngineException(
 476                         "You have not write permission to delete it",
 477                         http_code=HTTPStatus.UNAUTHORIZED,
 478                     )
 479
 480         # It must be deleted
 481         if session["force"]:
 482             self.db.del_one(self.topic, {"_id": _id})
 483             op_id = None
 484             self._send_msg(
 485                 "deleted", {"_id": _id, "op_id": op_id}, not_send_msg=not_send_msg
 486             )
 487         else:
 488             update_dict = {"_admin.to_delete": True}
 489             self.db.set_one(
 490                 self.topic,
 491                 {"_id": _id},
 492                 update_dict=update_dict,
 493                 push={"_admin.operations": self._create_operation("delete")},
 494             )
 495             # the number of operations is the operation_id. db_content does not contains the new operation inserted,
 496             # so the -1 is not needed
 497             op_id = "{}:{}".format(
 498                 db_content["_id"], len(db_content["_admin"]["operations"])
 499             )
 500             self._send_msg(
 501                 "delete", {"_id": _id, "op_id": op_id}, not_send_msg=not_send_msg
 502             )
 503         return op_id
 504
 505
 506 class VimAccountTopic(CommonVimWimSdn):
 507     topic = "vim_accounts"
 508     topic_msg = "vim_account"
 509     schema_new = vim_account_new_schema
 510     schema_edit = vim_account_edit_schema
 511     multiproject = True
 512     password_to_encrypt = "vim_password"
 513     config_to_encrypt = {
 514         "1.1": ("admin_password", "nsx_password", "vcenter_password"),
 515         "default": (
 516             "admin_password",
 517             "nsx_password",
 518             "vcenter_password",
 519             "vrops_password",
 520         ),
 521     }
 522
 523     def check_conflict_on_del(self, session, _id, db_content):
 524         """
 525         Check if deletion can be done because of dependencies if it is not force. To override
 526         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 527         :param _id: internal _id
 528         :param db_content: The database content of this item _id
 529         :return: None if ok or raises EngineException with the conflict
 530         """
 531         if session["force"]:
 532             return
 533         # check if used by VNF
 534         if self.db.get_list("vnfrs", {"vim-account-id": _id}):
 535             raise EngineException(
 536                 "There is at least one VNF using this VIM account",
 537                 http_code=HTTPStatus.CONFLICT,
 538             )
 539         super().check_conflict_on_del(session, _id, db_content)
 540
 541
 542 class WimAccountTopic(CommonVimWimSdn):
 543     topic = "wim_accounts"
 544     topic_msg = "wim_account"
 545     schema_new = wim_account_new_schema
 546     schema_edit = wim_account_edit_schema
 547     multiproject = True
 548     password_to_encrypt = "password"
 549     config_to_encrypt = {}
 550
 551
 552 class SdnTopic(CommonVimWimSdn):
 553     topic = "sdns"
 554     topic_msg = "sdn"
 555     quota_name = "sdn_controllers"
 556     schema_new = sdn_new_schema
 557     schema_edit = sdn_edit_schema
 558     multiproject = True
 559     password_to_encrypt = "password"
 560     config_to_encrypt = {}
 561
 562     def _obtain_url(self, input, create):
 563         if input.get("ip") or input.get("port"):
 564             if not input.get("ip") or not input.get("port") or input.get("url"):
 565                 raise ValidationError(
 566                     "You must provide both 'ip' and 'port' (deprecated); or just 'url' (prefered)"
 567                 )
 568             input["url"] = "http://{}:{}/".format(input["ip"], input["port"])
 569             del input["ip"]
 570             del input["port"]
 571         elif create and not input.get("url"):
 572             raise ValidationError("You must provide 'url'")
 573         return input
 574
 575     def _validate_input_new(self, input, force=False):
 576         input = super()._validate_input_new(input, force)
 577         return self._obtain_url(input, True)
 578
 579     def _validate_input_edit(self, input, content, force=False):
 580         input = super()._validate_input_edit(input, content, force)
 581         return self._obtain_url(input, False)
 582
 583
 584 class K8sClusterTopic(CommonVimWimSdn):
 585     topic = "k8sclusters"
 586     topic_msg = "k8scluster"
 587     schema_new = k8scluster_new_schema
 588     schema_edit = k8scluster_edit_schema
 589     multiproject = True
 590     password_to_encrypt = None
 591     config_to_encrypt = {}
 592
 593     def format_on_new(self, content, project_id=None, make_public=False):
 594         oid = super().format_on_new(content, project_id, make_public)
 595         self.db.encrypt_decrypt_fields(
 596             content["credentials"],
 597             "encrypt",
 598             ["password", "secret"],
 599             schema_version=content["schema_version"],
 600             salt=content["_id"],
 601         )
 602         # Add Helm/Juju Repo lists
 603         repos = {"helm-chart": [], "juju-bundle": []}
 604         for proj in content["_admin"]["projects_read"]:
 605             if proj != "ANY":
 606                 for repo in self.db.get_list(
 607                     "k8srepos", {"_admin.projects_read": proj}
 608                 ):
 609                     if repo["_id"] not in repos[repo["type"]]:
 610                         repos[repo["type"]].append(repo["_id"])
 611         for k in repos:
 612             content["_admin"][k.replace("-", "_") + "_repos"] = repos[k]
 613         return oid
 614
 615     def format_on_edit(self, final_content, edit_content):
 616         if final_content.get("schema_version") and edit_content.get("credentials"):
 617             self.db.encrypt_decrypt_fields(
 618                 edit_content["credentials"],
 619                 "encrypt",
 620                 ["password", "secret"],
 621                 schema_version=final_content["schema_version"],
 622                 salt=final_content["_id"],
 623             )
 624             deep_update_rfc7396(
 625                 final_content["credentials"], edit_content["credentials"]
 626             )
 627         oid = super().format_on_edit(final_content, edit_content)
 628         return oid
 629
 630     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 631         final_content = super(CommonVimWimSdn, self).check_conflict_on_edit(
 632             session, final_content, edit_content, _id
 633         )
 634         final_content = super().check_conflict_on_edit(
 635             session, final_content, edit_content, _id
 636         )
 637         # Update Helm/Juju Repo lists
 638         repos = {"helm-chart": [], "juju-bundle": []}
 639         for proj in session.get("set_project", []):
 640             if proj != "ANY":
 641                 for repo in self.db.get_list(
 642                     "k8srepos", {"_admin.projects_read": proj}
 643                 ):
 644                     if repo["_id"] not in repos[repo["type"]]:
 645                         repos[repo["type"]].append(repo["_id"])
 646         for k in repos:
 647             rlist = k.replace("-", "_") + "_repos"
 648             if rlist not in final_content["_admin"]:
 649                 final_content["_admin"][rlist] = []
 650             final_content["_admin"][rlist] += repos[k]
 651         return final_content
 652
 653     def check_conflict_on_del(self, session, _id, db_content):
 654         """
 655         Check if deletion can be done because of dependencies if it is not force. To override
 656         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 657         :param _id: internal _id
 658         :param db_content: The database content of this item _id
 659         :return: None if ok or raises EngineException with the conflict
 660         """
 661         if session["force"]:
 662             return
 663         # check if used by VNF
 664         filter_q = {"kdur.k8s-cluster.id": _id}
 665         if session["project_id"]:
 666             filter_q["_admin.projects_read.cont"] = session["project_id"]
 667         if self.db.get_list("vnfrs", filter_q):
 668             raise EngineException(
 669                 "There is at least one VNF using this k8scluster",
 670                 http_code=HTTPStatus.CONFLICT,
 671             )
 672         super().check_conflict_on_del(session, _id, db_content)
 673
 674
 675 class VcaTopic(CommonVimWimSdn):
 676     topic = "vca"
 677     topic_msg = "vca"
 678     schema_new = vca_new_schema
 679     schema_edit = vca_edit_schema
 680     multiproject = True
 681     password_to_encrypt = None
 682
 683     def format_on_new(self, content, project_id=None, make_public=False):
 684         oid = super().format_on_new(content, project_id, make_public)
 685         content["schema_version"] = schema_version = "1.11"
 686         for key in ["secret", "cacert"]:
 687             content[key] = self.db.encrypt(
 688                 content[key], schema_version=schema_version, salt=content["_id"]
 689             )
 690         return oid
 691
 692     def format_on_edit(self, final_content, edit_content):
 693         oid = super().format_on_edit(final_content, edit_content)
 694         schema_version = final_content.get("schema_version")
 695         for key in ["secret", "cacert"]:
 696             if key in edit_content:
 697                 final_content[key] = self.db.encrypt(
 698                     edit_content[key],
 699                     schema_version=schema_version,
 700                     salt=final_content["_id"],
 701                 )
 702         return oid
 703
 704     def check_conflict_on_del(self, session, _id, db_content):
 705         """
 706         Check if deletion can be done because of dependencies if it is not force. To override
 707         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 708         :param _id: internal _id
 709         :param db_content: The database content of this item _id
 710         :return: None if ok or raises EngineException with the conflict
 711         """
 712         if session["force"]:
 713             return
 714         # check if used by VNF
 715         filter_q = {"vca": _id}
 716         if session["project_id"]:
 717             filter_q["_admin.projects_read.cont"] = session["project_id"]
 718         if self.db.get_list("vim_accounts", filter_q):
 719             raise EngineException(
 720                 "There is at least one VIM account using this vca",
 721                 http_code=HTTPStatus.CONFLICT,
 722             )
 723         super().check_conflict_on_del(session, _id, db_content)
 724
 725
 726 class K8sRepoTopic(CommonVimWimSdn):
 727     topic = "k8srepos"
 728     topic_msg = "k8srepo"
 729     schema_new = k8srepo_new_schema
 730     schema_edit = k8srepo_edit_schema
 731     multiproject = True
 732     password_to_encrypt = None
 733     config_to_encrypt = {}
 734
 735     def format_on_new(self, content, project_id=None, make_public=False):
 736         oid = super().format_on_new(content, project_id, make_public)
 737         # Update Helm/Juju Repo lists
 738         repo_list = content["type"].replace("-", "_") + "_repos"
 739         for proj in content["_admin"]["projects_read"]:
 740             if proj != "ANY":
 741                 self.db.set_list(
 742                     "k8sclusters",
 743                     {
 744                         "_admin.projects_read": proj,
 745                         "_admin." + repo_list + ".ne": content["_id"],
 746                     },
 747                     {},
 748                     push={"_admin." + repo_list: content["_id"]},
 749                 )
 750         return oid
 751
 752     def delete(self, session, _id, dry_run=False, not_send_msg=None):
 753         type = self.db.get_one("k8srepos", {"_id": _id})["type"]
 754         oid = super().delete(session, _id, dry_run, not_send_msg)
 755         if oid:
 756             # Remove from Helm/Juju Repo lists
 757             repo_list = type.replace("-", "_") + "_repos"
 758             self.db.set_list(
 759                 "k8sclusters",
 760                 {"_admin." + repo_list: _id},
 761                 {},
 762                 pull={"_admin." + repo_list: _id},
 763             )
 764         return oid
 765
 766
 767 class OsmRepoTopic(BaseTopic):
 768     topic = "osmrepos"
 769     topic_msg = "osmrepos"
 770     schema_new = osmrepo_new_schema
 771     schema_edit = osmrepo_edit_schema
 772     multiproject = True
 773     # TODO: Implement user/password
 774
 775
 776 class UserTopicAuth(UserTopic):
 777     # topic = "users"
 778     topic_msg = "users"
 779     schema_new = user_new_schema
 780     schema_edit = user_edit_schema
 781
 782     def __init__(self, db, fs, msg, auth):
 783         UserTopic.__init__(self, db, fs, msg, auth)
 784         # self.auth = auth
 785
 786     def check_conflict_on_new(self, session, indata):
 787         """
 788         Check that the data to be inserted is valid
 789
 790         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 791         :param indata: data to be inserted
 792         :return: None or raises EngineException
 793         """
 794         username = indata.get("username")
 795         if is_valid_uuid(username):
 796             raise EngineException(
 797                 "username '{}' cannot have a uuid format".format(username),
 798                 HTTPStatus.UNPROCESSABLE_ENTITY,
 799             )
 800
 801         # Check that username is not used, regardless keystone already checks this
 802         if self.auth.get_user_list(filter_q={"name": username}):
 803             raise EngineException(
 804                 "username '{}' is already used".format(username), HTTPStatus.CONFLICT
 805             )
 806
 807         if "projects" in indata.keys():
 808             # convert to new format project_role_mappings
 809             role = self.auth.get_role_list({"name": "project_admin"})
 810             if not role:
 811                 role = self.auth.get_role_list()
 812             if not role:
 813                 raise AuthconnNotFoundException(
 814                     "Can't find default role for user '{}'".format(username)
 815                 )
 816             rid = role[0]["_id"]
 817             if not indata.get("project_role_mappings"):
 818                 indata["project_role_mappings"] = []
 819             for project in indata["projects"]:
 820                 pid = self.auth.get_project(project)["_id"]
 821                 prm = {"project": pid, "role": rid}
 822                 if prm not in indata["project_role_mappings"]:
 823                     indata["project_role_mappings"].append(prm)
 824             # raise EngineException("Format invalid: the keyword 'projects' is not allowed for keystone authentication",
 825             #                       HTTPStatus.BAD_REQUEST)
 826
 827     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
 828         """
 829         Check that the data to be edited/uploaded is valid
 830
 831         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 832         :param final_content: data once modified
 833         :param edit_content: incremental data that contains the modifications to apply
 834         :param _id: internal _id
 835         :return: None or raises EngineException
 836         """
 837
 838         if "username" in edit_content:
 839             username = edit_content.get("username")
 840             if is_valid_uuid(username):
 841                 raise EngineException(
 842                     "username '{}' cannot have an uuid format".format(username),
 843                     HTTPStatus.UNPROCESSABLE_ENTITY,
 844                 )
 845
 846             # Check that username is not used, regardless keystone already checks this
 847             if self.auth.get_user_list(filter_q={"name": username}):
 848                 raise EngineException(
 849                     "username '{}' is already used".format(username),
 850                     HTTPStatus.CONFLICT,
 851                 )
 852
 853         if final_content["username"] == "admin":
 854             for mapping in edit_content.get("remove_project_role_mappings", ()):
 855                 if mapping["project"] == "admin" and mapping.get("role") in (
 856                     None,
 857                     "system_admin",
 858                 ):
 859                     # TODO make this also available for project id and role id
 860                     raise EngineException(
 861                         "You cannot remove system_admin role from admin user",
 862                         http_code=HTTPStatus.FORBIDDEN,
 863                     )
 864
 865         return final_content
 866
 867     def check_conflict_on_del(self, session, _id, db_content):
 868         """
 869         Check if deletion can be done because of dependencies if it is not force. To override
 870         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 871         :param _id: internal _id
 872         :param db_content: The database content of this item _id
 873         :return: None if ok or raises EngineException with the conflict
 874         """
 875         if db_content["username"] == session["username"]:
 876             raise EngineException(
 877                 "You cannot delete your own login user ", http_code=HTTPStatus.CONFLICT
 878             )
 879         # TODO: Check that user is not logged in ? How? (Would require listing current tokens)
 880
 881     @staticmethod
 882     def format_on_show(content):
 883         """
 884         Modifies the content of the role information to separate the role
 885         metadata from the role definition.
 886         """
 887         project_role_mappings = []
 888
 889         if "projects" in content:
 890             for project in content["projects"]:
 891                 for role in project["roles"]:
 892                     project_role_mappings.append(
 893                         {
 894                             "project": project["_id"],
 895                             "project_name": project["name"],
 896                             "role": role["_id"],
 897                             "role_name": role["name"],
 898                         }
 899                     )
 900             del content["projects"]
 901         content["project_role_mappings"] = project_role_mappings
 902
 903         return content
 904
 905     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
 906         """
 907         Creates a new entry into the authentication backend.
 908
 909         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
 910
 911         :param rollback: list to append created items at database in case a rollback may to be done
 912         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 913         :param indata: data to be inserted
 914         :param kwargs: used to override the indata descriptor
 915         :param headers: http request headers
 916         :return: _id: identity of the inserted data, operation _id (None)
 917         """
 918         try:
 919             content = BaseTopic._remove_envelop(indata)
 920
 921             # Override descriptor with query string kwargs
 922             BaseTopic._update_input_with_kwargs(content, kwargs)
 923             content = self._validate_input_new(content, session["force"])
 924             self.check_conflict_on_new(session, content)
 925             # self.format_on_new(content, session["project_id"], make_public=session["public"])
 926             now = time()
 927             content["_admin"] = {"created": now, "modified": now}
 928             prms = []
 929             for prm in content.get("project_role_mappings", []):
 930                 proj = self.auth.get_project(prm["project"], not session["force"])
 931                 role = self.auth.get_role(prm["role"], not session["force"])
 932                 pid = proj["_id"] if proj else None
 933                 rid = role["_id"] if role else None
 934                 prl = {"project": pid, "role": rid}
 935                 if prl not in prms:
 936                     prms.append(prl)
 937             content["project_role_mappings"] = prms
 938             # _id = self.auth.create_user(content["username"], content["password"])["_id"]
 939             _id = self.auth.create_user(content)["_id"]
 940
 941             rollback.append({"topic": self.topic, "_id": _id})
 942             # del content["password"]
 943             self._send_msg("created", content, not_send_msg=None)
 944             return _id, None
 945         except ValidationError as e:
 946             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
 947
 948     def show(self, session, _id, filter_q=None, api_req=False):
 949         """
 950         Get complete information on an topic
 951
 952         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 953         :param _id: server internal id or username
 954         :param filter_q: dict: query parameter
 955         :param api_req: True if this call is serving an external API request. False if serving internal request.
 956         :return: dictionary, raise exception if not found.
 957         """
 958         # Allow _id to be a name or uuid
 959         filter_q = {"username": _id}
 960         # users = self.auth.get_user_list(filter_q)
 961         users = self.list(session, filter_q)  # To allow default filtering (Bug 853)
 962         if len(users) == 1:
 963             return users[0]
 964         elif len(users) > 1:
 965             raise EngineException(
 966                 "Too many users found for '{}'".format(_id), HTTPStatus.CONFLICT
 967             )
 968         else:
 969             raise EngineException(
 970                 "User '{}' not found".format(_id), HTTPStatus.NOT_FOUND
 971             )
 972
 973     def edit(self, session, _id, indata=None, kwargs=None, content=None):
 974         """
 975         Updates an user entry.
 976
 977         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
 978         :param _id:
 979         :param indata: data to be inserted
 980         :param kwargs: used to override the indata descriptor
 981         :param content:
 982         :return: _id: identity of the inserted data.
 983         """
 984         indata = self._remove_envelop(indata)
 985
 986         # Override descriptor with query string kwargs
 987         if kwargs:
 988             BaseTopic._update_input_with_kwargs(indata, kwargs)
 989         try:
 990             if not content:
 991                 content = self.show(session, _id)
 992             indata = self._validate_input_edit(indata, content, force=session["force"])
 993             content = self.check_conflict_on_edit(session, content, indata, _id=_id)
 994             # self.format_on_edit(content, indata)
 995
 996             if not (
 997                 "password" in indata
 998                 or "username" in indata
 999                 or indata.get("remove_project_role_mappings")
1000                 or indata.get("add_project_role_mappings")
1001                 or indata.get("project_role_mappings")
1002                 or indata.get("projects")
1003                 or indata.get("add_projects")
1004             ):
1005                 return _id
1006             if indata.get("project_role_mappings") and (
1007                 indata.get("remove_project_role_mappings")
1008                 or indata.get("add_project_role_mappings")
1009             ):
1010                 raise EngineException(
1011                     "Option 'project_role_mappings' is incompatible with 'add_project_role_mappings"
1012                     "' or 'remove_project_role_mappings'",
1013                     http_code=HTTPStatus.BAD_REQUEST,
1014                 )
1015
1016             if indata.get("projects") or indata.get("add_projects"):
1017                 role = self.auth.get_role_list({"name": "project_admin"})
1018                 if not role:
1019                     role = self.auth.get_role_list()
1020                 if not role:
1021                     raise AuthconnNotFoundException(
1022                         "Can't find a default role for user '{}'".format(
1023                             content["username"]
1024                         )
1025                     )
1026                 rid = role[0]["_id"]
1027                 if "add_project_role_mappings" not in indata:
1028                     indata["add_project_role_mappings"] = []
1029                 if "remove_project_role_mappings" not in indata:
1030                     indata["remove_project_role_mappings"] = []
1031                 if isinstance(indata.get("projects"), dict):
1032                     # backward compatible
1033                     for k, v in indata["projects"].items():
1034                         if k.startswith("$") and v is None:
1035                             indata["remove_project_role_mappings"].append(
1036                                 {"project": k[1:]}
1037                             )
1038                         elif k.startswith("$+"):
1039                             indata["add_project_role_mappings"].append(
1040                                 {"project": v, "role": rid}
1041                             )
1042                     del indata["projects"]
1043                 for proj in indata.get("projects", []) + indata.get("add_projects", []):
1044                     indata["add_project_role_mappings"].append(
1045                         {"project": proj, "role": rid}
1046                     )
1047
1048             # user = self.show(session, _id)   # Already in 'content'
1049             original_mapping = content["project_role_mappings"]
1050
1051             mappings_to_add = []
1052             mappings_to_remove = []
1053
1054             # remove
1055             for to_remove in indata.get("remove_project_role_mappings", ()):
1056                 for mapping in original_mapping:
1057                     if to_remove["project"] in (
1058                         mapping["project"],
1059                         mapping["project_name"],
1060                     ):
1061                         if not to_remove.get("role") or to_remove["role"] in (
1062                             mapping["role"],
1063                             mapping["role_name"],
1064                         ):
1065                             mappings_to_remove.append(mapping)
1066
1067             # add
1068             for to_add in indata.get("add_project_role_mappings", ()):
1069                 for mapping in original_mapping:
1070                     if to_add["project"] in (
1071                         mapping["project"],
1072                         mapping["project_name"],
1073                     ) and to_add["role"] in (
1074                         mapping["role"],
1075                         mapping["role_name"],
1076                     ):
1077
1078                         if mapping in mappings_to_remove:  # do not remove
1079                             mappings_to_remove.remove(mapping)
1080                         break  # do not add, it is already at user
1081                 else:
1082                     pid = self.auth.get_project(to_add["project"])["_id"]
1083                     rid = self.auth.get_role(to_add["role"])["_id"]
1084                     mappings_to_add.append({"project": pid, "role": rid})
1085
1086             # set
1087             if indata.get("project_role_mappings"):
1088                 for to_set in indata["project_role_mappings"]:
1089                     for mapping in original_mapping:
1090                         if to_set["project"] in (
1091                             mapping["project"],
1092                             mapping["project_name"],
1093                         ) and to_set["role"] in (
1094                             mapping["role"],
1095                             mapping["role_name"],
1096                         ):
1097                             if mapping in mappings_to_remove:  # do not remove
1098                                 mappings_to_remove.remove(mapping)
1099                             break  # do not add, it is already at user
1100                     else:
1101                         pid = self.auth.get_project(to_set["project"])["_id"]
1102                         rid = self.auth.get_role(to_set["role"])["_id"]
1103                         mappings_to_add.append({"project": pid, "role": rid})
1104                 for mapping in original_mapping:
1105                     for to_set in indata["project_role_mappings"]:
1106                         if to_set["project"] in (
1107                             mapping["project"],
1108                             mapping["project_name"],
1109                         ) and to_set["role"] in (
1110                             mapping["role"],
1111                             mapping["role_name"],
1112                         ):
1113                             break
1114                     else:
1115                         # delete
1116                         if mapping not in mappings_to_remove:  # do not remove
1117                             mappings_to_remove.append(mapping)
1118
1119             self.auth.update_user(
1120                 {
1121                     "_id": _id,
1122                     "username": indata.get("username"),
1123                     "password": indata.get("password"),
1124                     "old_password": indata.get("old_password"),
1125                     "add_project_role_mappings": mappings_to_add,
1126                     "remove_project_role_mappings": mappings_to_remove,
1127                 }
1128             )
1129             data_to_send = {"_id": _id, "changes": indata}
1130             self._send_msg("edited", data_to_send, not_send_msg=None)
1131
1132             # return _id
1133         except ValidationError as e:
1134             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1135
1136     def list(self, session, filter_q=None, api_req=False):
1137         """
1138         Get a list of the topic that matches a filter
1139         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1140         :param filter_q: filter of data to be applied
1141         :param api_req: True if this call is serving an external API request. False if serving internal request.
1142         :return: The list, it can be empty if no one match the filter.
1143         """
1144         user_list = self.auth.get_user_list(filter_q)
1145         if not session["allow_show_user_project_role"]:
1146             # Bug 853 - Default filtering
1147             user_list = [
1148                 usr for usr in user_list if usr["username"] == session["username"]
1149             ]
1150         return user_list
1151
1152     def delete(self, session, _id, dry_run=False, not_send_msg=None):
1153         """
1154         Delete item by its internal _id
1155
1156         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1157         :param _id: server internal id
1158         :param force: indicates if deletion must be forced in case of conflict
1159         :param dry_run: make checking but do not delete
1160         :param not_send_msg: To not send message (False) or store content (list) instead
1161         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
1162         """
1163         # Allow _id to be a name or uuid
1164         user = self.auth.get_user(_id)
1165         uid = user["_id"]
1166         self.check_conflict_on_del(session, uid, user)
1167         if not dry_run:
1168             v = self.auth.delete_user(uid)
1169             self._send_msg("deleted", user, not_send_msg=not_send_msg)
1170             return v
1171         return None
1172
1173
1174 class ProjectTopicAuth(ProjectTopic):
1175     # topic = "projects"
1176     topic_msg = "project"
1177     schema_new = project_new_schema
1178     schema_edit = project_edit_schema
1179
1180     def __init__(self, db, fs, msg, auth):
1181         ProjectTopic.__init__(self, db, fs, msg, auth)
1182         # self.auth = auth
1183
1184     def check_conflict_on_new(self, session, indata):
1185         """
1186         Check that the data to be inserted is valid
1187
1188         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1189         :param indata: data to be inserted
1190         :return: None or raises EngineException
1191         """
1192         project_name = indata.get("name")
1193         if is_valid_uuid(project_name):
1194             raise EngineException(
1195                 "project name '{}' cannot have an uuid format".format(project_name),
1196                 HTTPStatus.UNPROCESSABLE_ENTITY,
1197             )
1198
1199         project_list = self.auth.get_project_list(filter_q={"name": project_name})
1200
1201         if project_list:
1202             raise EngineException(
1203                 "project '{}' exists".format(project_name), HTTPStatus.CONFLICT
1204             )
1205
1206     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
1207         """
1208         Check that the data to be edited/uploaded is valid
1209
1210         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1211         :param final_content: data once modified
1212         :param edit_content: incremental data that contains the modifications to apply
1213         :param _id: internal _id
1214         :return: None or raises EngineException
1215         """
1216
1217         project_name = edit_content.get("name")
1218         if project_name != final_content["name"]:  # It is a true renaming
1219             if is_valid_uuid(project_name):
1220                 raise EngineException(
1221                     "project name '{}' cannot have an uuid format".format(project_name),
1222                     HTTPStatus.UNPROCESSABLE_ENTITY,
1223                 )
1224
1225             if final_content["name"] == "admin":
1226                 raise EngineException(
1227                     "You cannot rename project 'admin'", http_code=HTTPStatus.CONFLICT
1228                 )
1229
1230             # Check that project name is not used, regardless keystone already checks this
1231             if project_name and self.auth.get_project_list(
1232                 filter_q={"name": project_name}
1233             ):
1234                 raise EngineException(
1235                     "project '{}' is already used".format(project_name),
1236                     HTTPStatus.CONFLICT,
1237                 )
1238         return final_content
1239
1240     def check_conflict_on_del(self, session, _id, db_content):
1241         """
1242         Check if deletion can be done because of dependencies if it is not force. To override
1243
1244         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1245         :param _id: internal _id
1246         :param db_content: The database content of this item _id
1247         :return: None if ok or raises EngineException with the conflict
1248         """
1249
1250         def check_rw_projects(topic, title, id_field):
1251             for desc in self.db.get_list(topic):
1252                 if (
1253                     _id
1254                     in desc["_admin"]["projects_read"]
1255                     + desc["_admin"]["projects_write"]
1256                 ):
1257                     raise EngineException(
1258                         "Project '{}' ({}) is being used by {} '{}'".format(
1259                             db_content["name"], _id, title, desc[id_field]
1260                         ),
1261                         HTTPStatus.CONFLICT,
1262                     )
1263
1264         if _id in session["project_id"]:
1265             raise EngineException(
1266                 "You cannot delete your own project", http_code=HTTPStatus.CONFLICT
1267             )
1268
1269         if db_content["name"] == "admin":
1270             raise EngineException(
1271                 "You cannot delete project 'admin'", http_code=HTTPStatus.CONFLICT
1272             )
1273
1274         # If any user is using this project, raise CONFLICT exception
1275         if not session["force"]:
1276             for user in self.auth.get_user_list():
1277                 for prm in user.get("project_role_mappings"):
1278                     if prm["project"] == _id:
1279                         raise EngineException(
1280                             "Project '{}' ({}) is being used by user '{}'".format(
1281                                 db_content["name"], _id, user["username"]
1282                             ),
1283                             HTTPStatus.CONFLICT,
1284                         )
1285
1286         # If any VNFD, NSD, NST, PDU, etc. is using this project, raise CONFLICT exception
1287         if not session["force"]:
1288             check_rw_projects("vnfds", "VNF Descriptor", "id")
1289             check_rw_projects("nsds", "NS Descriptor", "id")
1290             check_rw_projects("nsts", "NS Template", "id")
1291             check_rw_projects("pdus", "PDU Descriptor", "name")
1292
1293     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
1294         """
1295         Creates a new entry into the authentication backend.
1296
1297         NOTE: Overrides BaseTopic functionality because it doesn't require access to database.
1298
1299         :param rollback: list to append created items at database in case a rollback may to be done
1300         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1301         :param indata: data to be inserted
1302         :param kwargs: used to override the indata descriptor
1303         :param headers: http request headers
1304         :return: _id: identity of the inserted data, operation _id (None)
1305         """
1306         try:
1307             content = BaseTopic._remove_envelop(indata)
1308
1309             # Override descriptor with query string kwargs
1310             BaseTopic._update_input_with_kwargs(content, kwargs)
1311             content = self._validate_input_new(content, session["force"])
1312             self.check_conflict_on_new(session, content)
1313             self.format_on_new(
1314                 content, project_id=session["project_id"], make_public=session["public"]
1315             )
1316             _id = self.auth.create_project(content)
1317             rollback.append({"topic": self.topic, "_id": _id})
1318             self._send_msg("created", content, not_send_msg=None)
1319             return _id, None
1320         except ValidationError as e:
1321             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1322
1323     def show(self, session, _id, filter_q=None, api_req=False):
1324         """
1325         Get complete information on an topic
1326
1327         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1328         :param _id: server internal id
1329         :param filter_q: dict: query parameter
1330         :param api_req: True if this call is serving an external API request. False if serving internal request.
1331         :return: dictionary, raise exception if not found.
1332         """
1333         # Allow _id to be a name or uuid
1334         filter_q = {self.id_field(self.topic, _id): _id}
1335         # projects = self.auth.get_project_list(filter_q=filter_q)
1336         projects = self.list(session, filter_q)  # To allow default filtering (Bug 853)
1337         if len(projects) == 1:
1338             return projects[0]
1339         elif len(projects) > 1:
1340             raise EngineException("Too many projects found", HTTPStatus.CONFLICT)
1341         else:
1342             raise EngineException("Project not found", HTTPStatus.NOT_FOUND)
1343
1344     def list(self, session, filter_q=None, api_req=False):
1345         """
1346         Get a list of the topic that matches a filter
1347
1348         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1349         :param filter_q: filter of data to be applied
1350         :return: The list, it can be empty if no one match the filter.
1351         """
1352         project_list = self.auth.get_project_list(filter_q)
1353         if not session["allow_show_user_project_role"]:
1354             # Bug 853 - Default filtering
1355             user = self.auth.get_user(session["username"])
1356             projects = [prm["project"] for prm in user["project_role_mappings"]]
1357             project_list = [proj for proj in project_list if proj["_id"] in projects]
1358         return project_list
1359
1360     def delete(self, session, _id, dry_run=False, not_send_msg=None):
1361         """
1362         Delete item by its internal _id
1363
1364         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1365         :param _id: server internal id
1366         :param dry_run: make checking but do not delete
1367         :param not_send_msg: To not send message (False) or store content (list) instead
1368         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
1369         """
1370         # Allow _id to be a name or uuid
1371         proj = self.auth.get_project(_id)
1372         pid = proj["_id"]
1373         self.check_conflict_on_del(session, pid, proj)
1374         if not dry_run:
1375             v = self.auth.delete_project(pid)
1376             self._send_msg("deleted", proj, not_send_msg=None)
1377             return v
1378         return None
1379
1380     def edit(self, session, _id, indata=None, kwargs=None, content=None):
1381         """
1382         Updates a project entry.
1383
1384         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1385         :param _id:
1386         :param indata: data to be inserted
1387         :param kwargs: used to override the indata descriptor
1388         :param content:
1389         :return: _id: identity of the inserted data.
1390         """
1391         indata = self._remove_envelop(indata)
1392
1393         # Override descriptor with query string kwargs
1394         if kwargs:
1395             BaseTopic._update_input_with_kwargs(indata, kwargs)
1396         try:
1397             if not content:
1398                 content = self.show(session, _id)
1399             indata = self._validate_input_edit(indata, content, force=session["force"])
1400             content = self.check_conflict_on_edit(session, content, indata, _id=_id)
1401             self.format_on_edit(content, indata)
1402             content_original = copy.deepcopy(content)
1403             deep_update_rfc7396(content, indata)
1404             self.auth.update_project(content["_id"], content)
1405             proj_data = {"_id": _id, "changes": indata, "original": content_original}
1406             self._send_msg("edited", proj_data, not_send_msg=None)
1407         except ValidationError as e:
1408             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1409
1410
1411 class RoleTopicAuth(BaseTopic):
1412     topic = "roles"
1413     topic_msg = None  # "roles"
1414     schema_new = roles_new_schema
1415     schema_edit = roles_edit_schema
1416     multiproject = False
1417
1418     def __init__(self, db, fs, msg, auth):
1419         BaseTopic.__init__(self, db, fs, msg, auth)
1420         # self.auth = auth
1421         self.operations = auth.role_permissions
1422         # self.topic = "roles_operations" if isinstance(auth, AuthconnKeystone) else "roles"
1423
1424     @staticmethod
1425     def validate_role_definition(operations, role_definitions):
1426         """
1427         Validates the role definition against the operations defined in
1428         the resources to operations files.
1429
1430         :param operations: operations list
1431         :param role_definitions: role definition to test
1432         :return: None if ok, raises ValidationError exception on error
1433         """
1434         if not role_definitions.get("permissions"):
1435             return
1436         ignore_fields = ["admin", "default"]
1437         for role_def in role_definitions["permissions"].keys():
1438             if role_def in ignore_fields:
1439                 continue
1440             if role_def[-1] == ":":
1441                 raise ValidationError("Operation cannot end with ':'")
1442
1443             match = next(
1444                 (
1445                     op
1446                     for op in operations
1447                     if op == role_def or op.startswith(role_def + ":")
1448                 ),
1449                 None,
1450             )
1451
1452             if not match:
1453                 raise ValidationError("Invalid permission '{}'".format(role_def))
1454
1455     def _validate_input_new(self, input, force=False):
1456         """
1457         Validates input user content for a new entry.
1458
1459         :param input: user input content for the new topic
1460         :param force: may be used for being more tolerant
1461         :return: The same input content, or a changed version of it.
1462         """
1463         if self.schema_new:
1464             validate_input(input, self.schema_new)
1465             self.validate_role_definition(self.operations, input)
1466
1467         return input
1468
1469     def _validate_input_edit(self, input, content, force=False):
1470         """
1471         Validates input user content for updating an entry.
1472
1473         :param input: user input content for the new topic
1474         :param force: may be used for being more tolerant
1475         :return: The same input content, or a changed version of it.
1476         """
1477         if self.schema_edit:
1478             validate_input(input, self.schema_edit)
1479             self.validate_role_definition(self.operations, input)
1480
1481         return input
1482
1483     def check_conflict_on_new(self, session, indata):
1484         """
1485         Check that the data to be inserted is valid
1486
1487         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1488         :param indata: data to be inserted
1489         :return: None or raises EngineException
1490         """
1491         # check name is not uuid
1492         role_name = indata.get("name")
1493         if is_valid_uuid(role_name):
1494             raise EngineException(
1495                 "role name '{}' cannot have an uuid format".format(role_name),
1496                 HTTPStatus.UNPROCESSABLE_ENTITY,
1497             )
1498         # check name not exists
1499         name = indata["name"]
1500         # if self.db.get_one(self.topic, {"name": indata.get("name")}, fail_on_empty=False, fail_on_more=False):
1501         if self.auth.get_role_list({"name": name}):
1502             raise EngineException(
1503                 "role name '{}' exists".format(name), HTTPStatus.CONFLICT
1504             )
1505
1506     def check_conflict_on_edit(self, session, final_content, edit_content, _id):
1507         """
1508         Check that the data to be edited/uploaded is valid
1509
1510         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1511         :param final_content: data once modified
1512         :param edit_content: incremental data that contains the modifications to apply
1513         :param _id: internal _id
1514         :return: None or raises EngineException
1515         """
1516         if "default" not in final_content["permissions"]:
1517             final_content["permissions"]["default"] = False
1518         if "admin" not in final_content["permissions"]:
1519             final_content["permissions"]["admin"] = False
1520
1521         # check name is not uuid
1522         role_name = edit_content.get("name")
1523         if is_valid_uuid(role_name):
1524             raise EngineException(
1525                 "role name '{}' cannot have an uuid format".format(role_name),
1526                 HTTPStatus.UNPROCESSABLE_ENTITY,
1527             )
1528
1529         # Check renaming of admin roles
1530         role = self.auth.get_role(_id)
1531         if role["name"] in ["system_admin", "project_admin"]:
1532             raise EngineException(
1533                 "You cannot rename role '{}'".format(role["name"]),
1534                 http_code=HTTPStatus.FORBIDDEN,
1535             )
1536
1537         # check name not exists
1538         if "name" in edit_content:
1539             role_name = edit_content["name"]
1540             # if self.db.get_one(self.topic, {"name":role_name,"_id.ne":_id}, fail_on_empty=False, fail_on_more=False):
1541             roles = self.auth.get_role_list({"name": role_name})
1542             if roles and roles[0][BaseTopic.id_field("roles", _id)] != _id:
1543                 raise EngineException(
1544                     "role name '{}' exists".format(role_name), HTTPStatus.CONFLICT
1545                 )
1546
1547         return final_content
1548
1549     def check_conflict_on_del(self, session, _id, db_content):
1550         """
1551         Check if deletion can be done because of dependencies if it is not force. To override
1552
1553         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1554         :param _id: internal _id
1555         :param db_content: The database content of this item _id
1556         :return: None if ok or raises EngineException with the conflict
1557         """
1558         role = self.auth.get_role(_id)
1559         if role["name"] in ["system_admin", "project_admin"]:
1560             raise EngineException(
1561                 "You cannot delete role '{}'".format(role["name"]),
1562                 http_code=HTTPStatus.FORBIDDEN,
1563             )
1564
1565         # If any user is using this role, raise CONFLICT exception
1566         if not session["force"]:
1567             for user in self.auth.get_user_list():
1568                 for prm in user.get("project_role_mappings"):
1569                     if prm["role"] == _id:
1570                         raise EngineException(
1571                             "Role '{}' ({}) is being used by user '{}'".format(
1572                                 role["name"], _id, user["username"]
1573                             ),
1574                             HTTPStatus.CONFLICT,
1575                         )
1576
1577     @staticmethod
1578     def format_on_new(content, project_id=None, make_public=False):  # TO BE REMOVED ?
1579         """
1580         Modifies content descriptor to include _admin
1581
1582         :param content: descriptor to be modified
1583         :param project_id: if included, it add project read/write permissions
1584         :param make_public: if included it is generated as public for reading.
1585         :return: None, but content is modified
1586         """
1587         now = time()
1588         if "_admin" not in content:
1589             content["_admin"] = {}
1590         if not content["_admin"].get("created"):
1591             content["_admin"]["created"] = now
1592         content["_admin"]["modified"] = now
1593
1594         if "permissions" not in content:
1595             content["permissions"] = {}
1596
1597         if "default" not in content["permissions"]:
1598             content["permissions"]["default"] = False
1599         if "admin" not in content["permissions"]:
1600             content["permissions"]["admin"] = False
1601
1602     @staticmethod
1603     def format_on_edit(final_content, edit_content):
1604         """
1605         Modifies final_content descriptor to include the modified date.
1606
1607         :param final_content: final descriptor generated
1608         :param edit_content: alterations to be include
1609         :return: None, but final_content is modified
1610         """
1611         if "_admin" in final_content:
1612             final_content["_admin"]["modified"] = time()
1613
1614         if "permissions" not in final_content:
1615             final_content["permissions"] = {}
1616
1617         if "default" not in final_content["permissions"]:
1618             final_content["permissions"]["default"] = False
1619         if "admin" not in final_content["permissions"]:
1620             final_content["permissions"]["admin"] = False
1621         return None
1622
1623     def show(self, session, _id, filter_q=None, api_req=False):
1624         """
1625         Get complete information on an topic
1626
1627         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1628         :param _id: server internal id
1629         :param filter_q: dict: query parameter
1630         :param api_req: True if this call is serving an external API request. False if serving internal request.
1631         :return: dictionary, raise exception if not found.
1632         """
1633         filter_q = {BaseTopic.id_field(self.topic, _id): _id}
1634         # roles = self.auth.get_role_list(filter_q)
1635         roles = self.list(session, filter_q)  # To allow default filtering (Bug 853)
1636         if not roles:
1637             raise AuthconnNotFoundException(
1638                 "Not found any role with filter {}".format(filter_q)
1639             )
1640         elif len(roles) > 1:
1641             raise AuthconnConflictException(
1642                 "Found more than one role with filter {}".format(filter_q)
1643             )
1644         return roles[0]
1645
1646     def list(self, session, filter_q=None, api_req=False):
1647         """
1648         Get a list of the topic that matches a filter
1649
1650         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1651         :param filter_q: filter of data to be applied
1652         :return: The list, it can be empty if no one match the filter.
1653         """
1654         role_list = self.auth.get_role_list(filter_q)
1655         if not session["allow_show_user_project_role"]:
1656             # Bug 853 - Default filtering
1657             user = self.auth.get_user(session["username"])
1658             roles = [prm["role"] for prm in user["project_role_mappings"]]
1659             role_list = [role for role in role_list if role["_id"] in roles]
1660         return role_list
1661
1662     def new(self, rollback, session, indata=None, kwargs=None, headers=None):
1663         """
1664         Creates a new entry into database.
1665
1666         :param rollback: list to append created items at database in case a rollback may to be done
1667         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1668         :param indata: data to be inserted
1669         :param kwargs: used to override the indata descriptor
1670         :param headers: http request headers
1671         :return: _id: identity of the inserted data, operation _id (None)
1672         """
1673         try:
1674             content = self._remove_envelop(indata)
1675
1676             # Override descriptor with query string kwargs
1677             self._update_input_with_kwargs(content, kwargs)
1678             content = self._validate_input_new(content, session["force"])
1679             self.check_conflict_on_new(session, content)
1680             self.format_on_new(
1681                 content, project_id=session["project_id"], make_public=session["public"]
1682             )
1683             # role_name = content["name"]
1684             rid = self.auth.create_role(content)
1685             content["_id"] = rid
1686             # _id = self.db.create(self.topic, content)
1687             rollback.append({"topic": self.topic, "_id": rid})
1688             # self._send_msg("created", content, not_send_msg=not_send_msg)
1689             return rid, None
1690         except ValidationError as e:
1691             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)
1692
1693     def delete(self, session, _id, dry_run=False, not_send_msg=None):
1694         """
1695         Delete item by its internal _id
1696
1697         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1698         :param _id: server internal id
1699         :param dry_run: make checking but do not delete
1700         :param not_send_msg: To not send message (False) or store content (list) instead
1701         :return: dictionary with deleted item _id. It raises EngineException on error: not found, conflict, ...
1702         """
1703         filter_q = {BaseTopic.id_field(self.topic, _id): _id}
1704         roles = self.auth.get_role_list(filter_q)
1705         if not roles:
1706             raise AuthconnNotFoundException(
1707                 "Not found any role with filter {}".format(filter_q)
1708             )
1709         elif len(roles) > 1:
1710             raise AuthconnConflictException(
1711                 "Found more than one role with filter {}".format(filter_q)
1712             )
1713         rid = roles[0]["_id"]
1714         self.check_conflict_on_del(session, rid, None)
1715         # filter_q = {"_id": _id}
1716         # filter_q = {BaseTopic.id_field(self.topic, _id): _id}   # To allow role addressing by name
1717         if not dry_run:
1718             v = self.auth.delete_role(rid)
1719             # v = self.db.del_one(self.topic, filter_q)
1720             return v
1721         return None
1722
1723     def edit(self, session, _id, indata=None, kwargs=None, content=None):
1724         """
1725         Updates a role entry.
1726
1727         :param session: contains "username", "admin", "force", "public", "project_id", "set_project"
1728         :param _id:
1729         :param indata: data to be inserted
1730         :param kwargs: used to override the indata descriptor
1731         :param content:
1732         :return: _id: identity of the inserted data.
1733         """
1734         if kwargs:
1735             self._update_input_with_kwargs(indata, kwargs)
1736         try:
1737             if not content:
1738                 content = self.show(session, _id)
1739             indata = self._validate_input_edit(indata, content, force=session["force"])
1740             deep_update_rfc7396(content, indata)
1741             content = self.check_conflict_on_edit(session, content, indata, _id=_id)
1742             self.format_on_edit(content, indata)
1743             self.auth.update_role(content)
1744         except ValidationError as e:
1745             raise EngineException(e, HTTPStatus.UNPROCESSABLE_ENTITY)