This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/passbook/core/models.py

300 lines
9.5 KiB
Python
Raw Normal View History

2018-11-11 12:41:48 +00:00
"""passbook core models"""
import re
from logging import getLogger
2018-12-09 20:20:34 +00:00
from random import SystemRandom
from time import sleep
from uuid import uuid4
2018-11-11 12:41:48 +00:00
import reversion
from django.contrib.auth.models import AbstractUser
from django.db import models
2018-12-10 13:49:15 +00:00
from django.urls import reverse_lazy
2018-11-26 21:08:48 +00:00
from django.utils.translation import gettext as _
2018-11-16 08:10:35 +00:00
from model_utils.managers import InheritanceManager
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
from passbook.lib.models import CreatedUpdatedModel, UUIDModel
2018-11-11 12:41:48 +00:00
LOGGER = getLogger(__name__)
class Group(UUIDModel):
"""Custom Group model which supports a basic hierarchy"""
name = models.CharField(_('name'), max_length=80)
parent = models.ForeignKey('Group', blank=True, null=True,
on_delete=models.SET_NULL, related_name='children')
extra_data = models.TextField(blank=True)
def __str__(self):
return "Group %s" % self.name
class Meta:
unique_together = (('name', 'parent',),)
2018-11-11 12:41:48 +00:00
class User(AbstractUser):
"""Custom User model to allow easier adding o f user-based settings"""
uuid = models.UUIDField(default=uuid4, editable=False)
2018-11-11 12:41:48 +00:00
sources = models.ManyToManyField('Source', through='UserSourceConnection')
2018-11-16 10:41:14 +00:00
applications = models.ManyToManyField('Application')
groups = models.ManyToManyField('Group')
2018-11-16 10:41:14 +00:00
@reversion.register()
class Provider(models.Model):
"""Application-independent Provider instance. For example SAML2 Remote, OAuth2 Application"""
2018-11-16 10:41:14 +00:00
2018-11-25 19:38:49 +00:00
objects = InheritanceManager()
2018-11-16 10:41:14 +00:00
# This class defines no field for easier inheritance
def __str__(self):
if hasattr(self, 'name'):
return getattr(self, 'name')
return super().__str__()
2018-11-11 12:41:48 +00:00
class RuleModel(UUIDModel, CreatedUpdatedModel):
"""Base model which can have rules applied to it"""
rules = models.ManyToManyField('Rule', blank=True)
def passes(self, user: User) -> bool:
"""Return true if user passes, otherwise False or raise Exception"""
for rule in self.rules:
if not rule.passes(user):
return False
return True
2018-11-11 12:41:48 +00:00
@reversion.register()
class Application(RuleModel):
2018-11-11 12:41:48 +00:00
"""Every Application which uses passbook for authentication/identification/authorization
needs an Application record. Other authentication types can subclass this Model to
add custom fields and other properties"""
name = models.TextField()
2018-12-26 16:17:39 +00:00
slug = models.SlugField()
2018-11-11 12:41:48 +00:00
launch_url = models.URLField(null=True, blank=True)
icon_url = models.TextField(null=True, blank=True)
provider = models.OneToOneField('Provider', null=True,
default=None, on_delete=models.SET_DEFAULT)
skip_authorization = models.BooleanField(default=False)
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
2018-11-11 12:41:48 +00:00
def user_is_authorized(self, user: User) -> bool:
"""Check if user is authorized to use this application"""
2018-12-09 20:07:38 +00:00
from passbook.core.rules import RuleEngine
return RuleEngine(self).for_user(user).result
2018-11-11 12:41:48 +00:00
def __str__(self):
return self.name
@reversion.register()
class Source(RuleModel):
2018-11-11 12:41:48 +00:00
"""Base Authentication source, i.e. an OAuth Provider, SAML Remote or LDAP Server"""
name = models.TextField()
slug = models.SlugField()
2018-11-16 08:10:35 +00:00
form = '' # ModelForm-based class ued to create/edit instance
2018-11-11 12:41:48 +00:00
enabled = models.BooleanField(default=True)
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
@property
def is_link(self):
"""Return true if Source should get a link on the login page"""
return False
@property
def get_url(self):
"""Return URL used for logging in"""
raise NotImplementedError
2018-11-11 12:41:48 +00:00
def __str__(self):
return self.name
@reversion.register()
class UserSourceConnection(CreatedUpdatedModel):
"""Connection between User and Source."""
user = models.ForeignKey(User, on_delete=models.CASCADE)
source = models.ForeignKey(Source, on_delete=models.CASCADE)
class Meta:
unique_together = (('user', 'source'),)
@reversion.register()
class Rule(UUIDModel, CreatedUpdatedModel):
2018-11-11 12:41:48 +00:00
"""Rules which specify if a user is authorized to use an Application. Can be overridden by
other types to add other fields, more logic, etc."""
ACTION_ALLOW = 'allow'
ACTION_DENY = 'deny'
ACTIONS = (
(ACTION_ALLOW, ACTION_ALLOW),
(ACTION_DENY, ACTION_DENY),
)
name = models.TextField(blank=True, null=True)
action = models.CharField(max_length=20, choices=ACTIONS)
negate = models.BooleanField(default=False)
2018-11-25 19:38:49 +00:00
order = models.IntegerField(default=0)
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
2018-11-11 12:41:48 +00:00
def __str__(self):
if self.name:
return self.name
return "%s action %s" % (self.name, self.action)
2018-11-11 12:41:48 +00:00
def passes(self, user: User) -> bool:
2018-11-11 12:41:48 +00:00
"""Check if user instance passes this rule"""
raise NotImplementedError()
@reversion.register()
class FieldMatcherRule(Rule):
"""Rule which checks if a field of the User model matches/doesn't match a
certain pattern"""
MATCH_STARTSWITH = 'startswith'
MATCH_ENDSWITH = 'endswith'
MATCH_CONTAINS = 'contains'
MATCH_REGEXP = 'regexp'
MATCH_EXACT = 'exact'
MATCHES = (
2018-11-26 21:08:48 +00:00
(MATCH_STARTSWITH, _('Starts with')),
(MATCH_ENDSWITH, _('Ends with')),
(MATCH_ENDSWITH, _('Contains')),
(MATCH_REGEXP, _('Regexp')),
(MATCH_EXACT, _('Exact')),
2018-11-11 12:41:48 +00:00
)
USER_FIELDS = (
('username', 'username',),
('first_name', 'first_name',),
('last_name', 'last_name',),
('email', 'email',),
('is_staff', 'is_staff',),
('is_active', 'is_active',),
('data_joined', 'data_joined',),
)
user_field = models.TextField(choices=USER_FIELDS)
2018-11-11 12:41:48 +00:00
match_action = models.CharField(max_length=50, choices=MATCHES)
value = models.TextField()
2018-11-26 21:08:48 +00:00
form = 'passbook.core.forms.rules.FieldMatcherRuleForm'
2018-11-11 12:41:48 +00:00
def __str__(self):
description = "%s, user.%s %s '%s'" % (self.name, self.user_field,
self.match_action, self.value)
2018-11-11 12:41:48 +00:00
if self.name:
description = "%s: %s" % (self.name, description)
return description
def passes(self, user: User) -> bool:
2018-11-11 12:41:48 +00:00
"""Check if user instance passes this role"""
if not hasattr(user, self.user_field):
raise ValueError("Field does not exist")
user_field_value = getattr(user, self.user_field, None)
LOGGER.debug("Checked '%s' %s with '%s'...",
user_field_value, self.match_action, self.value)
passes = False
if self.match_action == FieldMatcherRule.MATCH_STARTSWITH:
passes = user_field_value.startswith(self.value)
if self.match_action == FieldMatcherRule.MATCH_ENDSWITH:
passes = user_field_value.endswith(self.value)
if self.match_action == FieldMatcherRule.MATCH_CONTAINS:
passes = self.value in user_field_value
if self.match_action == FieldMatcherRule.MATCH_REGEXP:
pattern = re.compile(self.value)
2018-11-30 13:33:33 +00:00
passes = bool(pattern.match(user_field_value))
2018-11-11 12:41:48 +00:00
if self.negate:
passes = not passes
LOGGER.debug("User got '%r'", passes)
return passes
2018-11-26 21:08:48 +00:00
class Meta:
verbose_name = _('Field matcher Rule')
verbose_name_plural = _('Field matcher Rules')
2018-11-27 15:23:04 +00:00
@reversion.register()
class WebhookRule(Rule):
"""Rule that asks webhook"""
METHOD_GET = 'GET'
METHOD_POST = 'POST'
METHOD_PATCH = 'PATCH'
METHOD_DELETE = 'DELETE'
METHOD_PUT = 'PUT'
METHODS = (
(METHOD_GET, METHOD_GET),
(METHOD_POST, METHOD_POST),
(METHOD_PATCH, METHOD_PATCH),
(METHOD_DELETE, METHOD_DELETE),
(METHOD_PUT, METHOD_PUT),
)
url = models.URLField()
method = models.CharField(max_length=10, choices=METHODS)
json_body = models.TextField()
json_headers = models.TextField()
result_jsonpath = models.TextField()
result_json_value = models.TextField()
form = 'passbook.core.forms.rules.WebhookRuleForm'
def passes(self, user: User):
"""Call webhook asynchronously and report back"""
raise NotImplementedError()
class Meta:
verbose_name = _('Webhook Rule')
verbose_name_plural = _('Webhook Rules')
@reversion.register()
class DebugRule(Rule):
"""Rule used for debugging the RuleEngine. Returns a fixed result,
but takes a random time to process."""
result = models.BooleanField(default=False)
wait_min = models.IntegerField(default=5)
wait_max = models.IntegerField(default=30)
form = 'passbook.core.forms.rules.DebugRuleForm'
def passes(self, user: User):
"""Wait random time then return result"""
2018-12-09 20:20:34 +00:00
wait = SystemRandom().randrange(self.wait_min, self.wait_max)
LOGGER.debug("Rule '%s' waiting for %ds", self.name, wait)
sleep(wait)
return self.result
class Meta:
verbose_name = _('Debug Rule')
verbose_name_plural = _('Debug Rules')
2018-12-10 12:48:22 +00:00
2018-12-10 13:49:15 +00:00
class Invitation(UUIDModel):
2018-12-10 13:21:42 +00:00
"""Single-use invitation link"""
2018-12-10 12:48:22 +00:00
created_by = models.ForeignKey('User', on_delete=models.CASCADE)
expires = models.DateTimeField(default=None, blank=True, null=True)
fixed_username = models.TextField(blank=True, default=None)
fixed_email = models.TextField(blank=True, default=None)
2018-12-10 13:49:15 +00:00
@property
def link(self):
"""Get link to use invitation"""
return reverse_lazy('passbook_core:auth-sign-up') + '?invitation=%s' % self.uuid
2018-12-10 12:48:22 +00:00
def __str__(self):
2018-12-10 13:49:15 +00:00
return "Invitation %s created by %s" % (self.uuid, self.created_by)
2018-12-10 12:48:22 +00:00
class Meta:
2018-12-10 13:49:15 +00:00
verbose_name = _('Invitation')
2018-12-10 13:21:42 +00:00
verbose_name_plural = _('Invitations')