gva/gnuviechadmin/osusers/models.py

"""
This module defines the database models of operating system users.

"""
from __future__ import unicode_literals

import base64
from datetime import date
import logging
import os
import six

from django.db import models, transaction
from django.conf import settings
from django.core.exceptions import ValidationError
from django.utils import timezone
from django.utils.encoding import python_2_unicode_compatible
from django.utils.translation import ugettext as _

from model_utils.models import TimeStampedModel

from passlib.hash import sha512_crypt
from passlib.utils import generate_password

from taskresults.models import TaskResult

from ldaptasks.tasks import (
    add_ldap_user_to_group,
    create_ldap_group,
    create_ldap_user,
    delete_ldap_group,
    delete_ldap_user,
    remove_ldap_user_from_group,
    set_ldap_user_password,
)

from fileservertasks.tasks import (
    delete_file_mail_userdir,
    delete_file_sftp_userdir,
    set_file_ssh_authorized_keys,
    setup_file_mail_userdir,
    setup_file_sftp_userdir,
)


_LOGGER = logging.getLogger(__name__)


CANNOT_USE_PRIMARY_GROUP_AS_ADDITIONAL = _(
    "You can not use a user's primary group.")


class GroupManager(models.Manager):
    """
    Manager class for :py:class:`osusers.models.Group`.

    """

    def get_next_gid(self):
        """
        Get the next available group id.

        :returns: group id
        :rtype: int

        """
        q = self.aggregate(models.Max('gid'))
        if q['gid__max'] is None:
            return settings.OSUSER_MINGID
        return max(settings.OSUSER_MINGID, q['gid__max'] + 1)


@python_2_unicode_compatible
class Group(TimeStampedModel, models.Model):
    """
    This entity class corresponds to an operating system group.

    """
    groupname = models.CharField(
        _('Group name'), max_length=16, unique=True)
    gid = models.PositiveSmallIntegerField(
        _('Group ID'), unique=True, primary_key=True)
    descr = models.TextField(_('Description'), blank=True)
    passwd = models.CharField(
        _('Group password'), max_length=128, blank=True)

    objects = GroupManager()

    class Meta:
        verbose_name = _('Group')
        verbose_name_plural = _('Groups')

    def __str__(self):
        return '{0} ({1})'.format(self.groupname, self.gid)

    @transaction.atomic
    def save(self, *args, **kwargs):
        """
        Save the group to the database and synchronizes group information to
        LDAP.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :return: self
        :rtype: :py:class:`osusers.models.Group`

        """
        super(Group, self).save(*args, **kwargs)
        dn = create_ldap_group.delay(
            self.groupname, self.gid, self.descr).get()
        _LOGGER.info("created LDAP group with dn %s", dn)
        return self

    @transaction.atomic
    def delete(self, *args, **kwargs):
        """
        Delete the group from LDAP and the database.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.delete`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.delete`

        """
        TaskResult.objects.create_task_result(
            delete_ldap_group.delay(self.groupname),
            'delete_ldap_group'
        )
        super(Group, self).delete(*args, **kwargs)


class UserManager(models.Manager):
    """
    Manager class for :py:class:`osusers.models.User`.

    """

    def get_next_uid(self):
        """
        Get the next available user id.

        :return: user id
        :rtype: int

        """
        q = self.aggregate(models.Max('uid'))
        if q['uid__max'] is None:
            return settings.OSUSER_MINUID
        return max(settings.OSUSER_MINUID, q['uid__max'] + 1)

    def get_next_username(self):
        """
        Get the next available user name.

        :return: user name
        :rtype: str

        """
        count = 1
        usernameformat = "{0}{1:02d}"
        nextuser = usernameformat.format(settings.OSUSER_USERNAME_PREFIX,
                                         count)
        for user in self.values('username').filter(
            username__startswith=settings.OSUSER_USERNAME_PREFIX
        ).order_by('username'):
            if user['username'] == nextuser:
                count += 1
                nextuser = usernameformat.format(
                    settings.OSUSER_USERNAME_PREFIX, count)
            else:
                break
        return nextuser

    @transaction.atomic
    def create_user(
        self, customer, username=None, password=None, commit=False
    ):
        """
        Create a new user with a primary group named the same as the user and
        an initial password.

        If username is None the result of :py:meth:`get_next_username` is used.
        If password is None a new password will be generated using passlib's
        :py:func:`generate_password`.

        :param customer: Django User instance this user is associated to
        :param str username: the username or None
        :param str password: the password or None
        :param boolean commit: whether to commit the user data to the database
            or not
        :return: new user
        :rtype: :py:class:`osusers.models.User`

        """
        uid = self.get_next_uid()
        gid = Group.objects.get_next_gid()
        if username is None:
            username = self.get_next_username()
        if password is None:
            password = generate_password()
        homedir = os.path.join(settings.OSUSER_HOME_BASEPATH, username)
        group = Group.objects.create(groupname=username, gid=gid)
        user = self.create(username=username, group=group, uid=uid,
                           homedir=homedir, customer=customer,
                           shell=settings.OSUSER_DEFAULT_SHELL)
        user.set_password(password)
        if commit:
            user.save()
        return user


@python_2_unicode_compatible
class User(TimeStampedModel, models.Model):
    """
    This entity class corresponds to an operating system user.

    """
    username = models.CharField(
        _('User name'), max_length=64, unique=True)
    uid = models.PositiveSmallIntegerField(
        _('User ID'), unique=True, primary_key=True)
    group = models.ForeignKey(Group, verbose_name=_('Group'))
    gecos = models.CharField(_('Gecos field'), max_length=128, blank=True)
    homedir = models.CharField(_('Home directory'), max_length=256)
    shell = models.CharField(_('Login shell'), max_length=64)
    customer = models.ForeignKey(settings.AUTH_USER_MODEL)

    objects = UserManager()

    class Meta:
        verbose_name = _('User')
        verbose_name_plural = _('Users')

    def __str__(self):
        return '{0} ({1})'.format(self.username, self.uid)

    @transaction.atomic
    def set_password(self, password):
        """
        Set the password of the user.

        The password is set to the user's
        :py:class:`Shadow <osusers.models.Shadow>` instance and to LDAP.

        :param str password: the new password

        """
        if hasattr(self, 'shadow'):
            self.shadow.set_password(password)
            success = set_ldap_user_password.delay(
                self.username, password).get()
            if success:
                _LOGGER.info(
                    "successfully set LDAP password for %s", self.username)
            else:
                _LOGGER.error(
                    "setting the LDAP password for %s failed", self.username)
            return success
        else:
            self.shadow = Shadow.objects.create_shadow(
                user=self, password=password
            )
            dn = create_ldap_user.delay(
                self.username, self.uid, self.group.gid, self.gecos,
                self.homedir, self.shell, password
            ).get()
            _LOGGER.info("set LDAP password for %s", dn)
            return True

    def is_sftp_user(self):
        return self.additionalgroup_set.filter(
            group__groupname=settings.OSUSER_SFTP_GROUP
        ).exists()

    @transaction.atomic
    def save(self, *args, **kwargs):
        """
        Save the user to the database, create user directories and synchronize
        user information to LDAP.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :return: self
        :rtype: :py:class:`osusers.models.User`

        """
        dn = create_ldap_user.delay(
            self.username, self.uid, self.group.gid, self.gecos,
            self.homedir, self.shell, password=None).get()
        TaskResult.objects.create_task_result(
            setup_file_sftp_userdir.delay(self.username),
            'setup_file_sftp_userdir'
        )
        TaskResult.objects.create_task_result(
            setup_file_mail_userdir.delay(self.username),
            'setup_file_mail_userdir'
        )
        _LOGGER.info(
            "created user %(user)s with LDAP dn %(dn)s, scheduled home "
            "directory and mail base directory creation.", {
                'user': self, 'dn': dn,
            })
        return super(User, self).save(*args, **kwargs)

    @transaction.atomic
    def delete(self, *args, **kwargs):
        """
        Delete the user and its groups from LDAP and the database and remove
        the user's directories.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.delete`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.delete`

        """
        TaskResult.objects.create_task_result(
            delete_file_mail_userdir.delay(self.username),
            'delete_file_mail_userdir'
        )
        TaskResult.objects.create_task_result(
            delete_file_sftp_userdir.delay(self.username),
            'delete_file_sftp_userdir'
        )
        for group in [ag.group for ag in self.additionalgroup_set.all()]:
            remove_ldap_user_from_group.delay(
                self.username, group.groupname).get()
        delete_ldap_user.delay(self.username).get()
        self.group.delete()
        super(User, self).delete(*args, **kwargs)


class ShadowManager(models.Manager):
    """
    Manager class for :py:class:`osusers.models.Shadow`.

    """

    @transaction.atomic
    def create_shadow(self, user, password):
        """
        Create a new shadow instance with typical Linux settings for the given
        user with the given password.

        :param user: :py:class:`User <osusers.models.User>` instance
        :param str password: the password
        :return: new Shadow instance
        :rtype: :py:class:`osusers.models.Shadow` instance

        """
        changedays = (timezone.now().date() - date(1970, 1, 1)).days
        shadow = self.create(
            user=user, changedays=changedays,
            minage=0, maxage=None, gracedays=7,
            inactdays=30, expiredays=None
        )
        shadow.set_password(password)
        shadow.save()
        return shadow


@python_2_unicode_compatible
class Shadow(TimeStampedModel, models.Model):
    """
    This entity class corresponds to an operating system user's shadow file
    entry.

    """
    user = models.OneToOneField(User, primary_key=True, verbose_name=_('User'))
    passwd = models.CharField(_('Encrypted password'), max_length=128)
    changedays = models.PositiveSmallIntegerField(
        _('Date of last change'),
        help_text=_('This is expressed in days since Jan 1, 1970'),
        blank=True, null=True)
    minage = models.PositiveSmallIntegerField(
        _('Minimum age'),
        help_text=_('Minimum number of days before the password can be'
                    ' changed'),
        blank=True, null=True)
    maxage = models.PositiveSmallIntegerField(
        _('Maximum age'),
        help_text=_('Maximum number of days after which the password has to'
                    ' be changed'),
        blank=True, null=True)
    gracedays = models.PositiveSmallIntegerField(
        _('Grace period'),
        help_text=_('The number of days before the password is going to'
                    ' expire'),
        blank=True, null=True)
    inactdays = models.PositiveSmallIntegerField(
        _('Inactivity period'),
        help_text=_('The number of days after the password has expired during'
                    ' which the password should still be accepted'),
        blank=True, null=True)
    expiredays = models.PositiveSmallIntegerField(
        _('Account expiration date'),
        help_text=_('The date of expiration of the account, expressed as'
                    ' number of days since Jan 1, 1970'),
        blank=True, null=True, default=None)

    objects = ShadowManager()

    class Meta:
        verbose_name = _('Shadow password')
        verbose_name_plural = _('Shadow passwords')

    def __str__(self):
        return 'for user {0}'.format(self.user)

    def set_password(self, password):
        """
        Set and encrypt the password.

        :param str password: the password
        """
        self.passwd = sha512_crypt.encrypt(password)


@python_2_unicode_compatible
class AdditionalGroup(TimeStampedModel, models.Model):
    """
    This entity class corresponds to additional group assignments for an
    :py:class:`operating system user <osusers.models.User>`.

    """
    user = models.ForeignKey(User)
    group = models.ForeignKey(Group)

    class Meta:
        unique_together = ('user', 'group')
        verbose_name = _('Additional group')
        verbose_name_plural = _('Additional groups')

    def __str__(self):
        return '{0} in {1}'.format(self.user, self.group)

    def clean(self):
        """
        Ensure that the assigned group is different from the user's primary
        group.

        """
        if self.user.group == self.group:
            raise ValidationError(CANNOT_USE_PRIMARY_GROUP_AS_ADDITIONAL)

    @transaction.atomic
    def save(self, *args, **kwargs):
        """
        Persists the group assignment to LDAP and the database.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.save`
        :return: this instance
        :rtype: :py:class:`AdditionalGroup <osusers.models.AdditionalGroup>`

        """
        add_ldap_user_to_group.delay(
            self.user.username, self.group.groupname).get()
        return super(AdditionalGroup, self).save(*args, **kwargs)

    @transaction.atomic
    def delete(self, *args, **kwargs):
        """
        Delete the group assignment from LDAP and the database.

        :param args: positional arguments to be passed on to
            :py:meth:`django.db.Model.delete`
        :param kwargs: keyword arguments to be passed on to
            :py:meth:`django.db.Model.delete`
        """
        TaskResult.objects.create_task_result(
            remove_ldap_user_from_group.delay(
                self.user.username, self.group.groupname),
            'remove_ldap_user_from_group'
        )
        super(AdditionalGroup, self).delete(*args, **kwargs)


class SshPublicKeyManager(models.Manager):
    """
    Default manager for :py:class:`SSH public key
    <osusers.models.SshPublicKey>` instances.

    """

    def parse_keytext(self, keytext):
        """
        Parse a SSH public key in OpenSSH or :rfc:`4716` format into its
        components algorithm, key data and comment.

        :param str keytext: key text
        :return: triple of algorithm name, key data and comment
        :rtype: triple of str

        """
        if keytext.startswith('---- BEGIN SSH2 PUBLIC KEY ----'):
            comment = ''
            data = ''
            continued = ''
            headers = {}
            for line in keytext.splitlines():
                if line == '---- BEGIN SSH2 PUBLIC KEY ----':
                    continue
                elif ':' in line:  # a header line
                    header_tag, header_value = [
                        item.strip() for item in line.split(':', 1)]
                    if header_value.endswith('\\'):
                        continued = header_value[:-1]
                    else:
                        headers[header_tag.lower()] = header_value
                elif continued:
                    if line.endswith('\\'):
                        continued += line[:-1]
                        continue
                    header_value = continued + line
                    headers[header_tag.lower()] = header_value
                    continued = ''
                elif line == '---- END SSH2 PUBLIC KEY ----':
                    break
                elif line:  # ignore empty lines
                    data += line
            if 'comment' in headers:
                comment = headers['comment']
        else:
            parts = keytext.split(None, 2)
            if len(parts) < 2:
                raise ValueError('invalid SSH public key')
            data = parts[1]
            comment = len(parts) == 3 and parts[2] or ""
        try:
            keybytes = base64.b64decode(data)
        except TypeError:
            raise ValueError('invalid SSH public key')
        parts = keybytes.split(b'\x00' * 3)
        alglength = six.byte2int(parts[1])
        algname = parts[1][1:1+alglength]
        return algname, data, comment

    def create_ssh_public_key(self, user, keytext):
        """
        Create a new :py:class:`SSH public key <osusers.models.SshPublicKey>`
        for a user from the given key text representation. The text can be
        either in openssh format or :rfc:`4716` format.

        :param user: :py:class:`operating system user <osusers.models.User>`
        :param str keytext: key text
        :return: public key
        :retype: :py:class:`osusers.models.SshPublicKey`

        """
        algorithm, data, comment = self.parse_keytext(keytext)
        return self.create(
            user=user, algorithm=algorithm, data=data, comment=comment)


@python_2_unicode_compatible
class SshPublicKey(TimeStampedModel):
    """
    This entity class represents single SSH keys for an :py:class:`operating
    system user <osusers.models.User>`.

    """
    user = models.ForeignKey(User, verbose_name=_('User'))
    algorithm = models.CharField(_('Algorithm'), max_length=20)
    data = models.TextField(_('Key bytes'),
                            help_text=_('Base64 encoded key bytes'))
    comment = models.TextField(_('Comment'), blank=True)

    objects = SshPublicKeyManager()

    class Meta:
        verbose_name = _('SSH public key')
        verbose_name_plural = _('SSH public keys')
        unique_together = [('user', 'algorithm', 'data')]

    def __str__(self):
        return "{algorithm} {data} {comment}".format(
            algorithm=self.algorithm, data=self.data, comment=self.comment
        ).strip()

    def save(self, **kwargs):
        key = super(SshPublicKey, self).save(**kwargs)
        TaskResult.objects.create_task_result(
            set_file_ssh_authorized_keys.delay(
                self.user.username, [
                    str(key) for key in
                    SshPublicKey.objects.filter(user=self.user)]),
            'set_file_ssh_authorized_keys'
        )
        return key

    def delete(self, **kwargs):
        super(SshPublicKey, self).delete(**kwargs)
        TaskResult.objects.create_task_result(
            set_file_ssh_authorized_keys.delay(
                self.user.username, [
                    str(key) for key in
                    SshPublicKey.objects.filter(user=self.user)]),
            'set_file_ssh_authorized_keys'
        )