2018-02-06 10:32:02 +00:00
|
|
|
# ~*~ coding: utf-8 ~*~
|
2018-09-03 03:24:25 +00:00
|
|
|
from django.shortcuts import get_object_or_404
|
2018-02-06 10:32:02 +00:00
|
|
|
from rest_framework.response import Response
|
2022-02-17 12:13:31 +00:00
|
|
|
from rest_framework.decorators import action
|
2018-07-23 04:55:13 +00:00
|
|
|
|
2021-12-09 09:18:16 +00:00
|
|
|
from common.utils import get_logger, get_object_or_none
|
2022-02-16 08:18:20 +00:00
|
|
|
from common.utils.crypto import get_aes_crypto
|
2022-02-17 12:13:31 +00:00
|
|
|
from common.permissions import IsValidUser
|
|
|
|
from common.mixins.api import SuggestionMixin
|
2019-08-21 12:27:21 +00:00
|
|
|
from orgs.mixins.api import OrgBulkModelViewSet
|
2019-10-18 07:05:45 +00:00
|
|
|
from orgs.mixins import generics
|
2021-06-07 02:40:07 +00:00
|
|
|
from orgs.utils import tmp_to_root_org
|
2022-02-16 08:18:20 +00:00
|
|
|
from ..models import SystemUser, CommandFilterRule
|
2018-02-06 10:32:02 +00:00
|
|
|
from .. import serializers
|
2021-05-31 07:01:14 +00:00
|
|
|
from ..serializers import SystemUserWithAuthInfoSerializer, SystemUserTempAuthSerializer
|
2019-08-21 12:27:21 +00:00
|
|
|
from ..tasks import (
|
|
|
|
push_system_user_to_assets_manual, test_system_user_connectivity_manual,
|
2020-12-08 09:29:22 +00:00
|
|
|
push_system_user_to_assets
|
2019-08-21 12:27:21 +00:00
|
|
|
)
|
2018-02-06 10:32:02 +00:00
|
|
|
|
|
|
|
logger = get_logger(__file__)
|
|
|
|
__all__ = [
|
2019-03-18 02:15:33 +00:00
|
|
|
'SystemUserViewSet', 'SystemUserAuthInfoApi', 'SystemUserAssetAuthInfoApi',
|
2020-11-09 11:17:00 +00:00
|
|
|
'SystemUserCommandFilterRuleListApi', 'SystemUserTaskApi', 'SystemUserAssetsListView',
|
2021-05-31 07:01:14 +00:00
|
|
|
'SystemUserTempAuthInfoApi', 'SystemUserAppAuthInfoApi',
|
2018-02-06 10:32:02 +00:00
|
|
|
]
|
|
|
|
|
|
|
|
|
2021-09-12 13:00:51 +00:00
|
|
|
class SystemUserViewSet(SuggestionMixin, OrgBulkModelViewSet):
|
2018-02-06 10:32:02 +00:00
|
|
|
"""
|
|
|
|
System user api set, for add,delete,update,list,retrieve resource
|
|
|
|
"""
|
2019-10-18 07:05:45 +00:00
|
|
|
model = SystemUser
|
2021-01-07 11:05:55 +00:00
|
|
|
filterset_fields = {
|
|
|
|
'name': ['exact'],
|
|
|
|
'username': ['exact'],
|
2021-07-08 06:23:18 +00:00
|
|
|
'protocol': ['exact', 'in'],
|
|
|
|
'type': ['exact', 'in'],
|
2021-01-07 11:05:55 +00:00
|
|
|
}
|
2021-01-07 02:53:10 +00:00
|
|
|
search_fields = filterset_fields
|
2018-02-06 10:32:02 +00:00
|
|
|
serializer_class = serializers.SystemUserSerializer
|
2020-03-12 08:24:38 +00:00
|
|
|
serializer_classes = {
|
|
|
|
'default': serializers.SystemUserSerializer,
|
2021-09-12 13:00:51 +00:00
|
|
|
'suggestion': serializers.MiniSystemUserSerializer
|
2020-03-12 08:24:38 +00:00
|
|
|
}
|
2021-10-27 02:57:40 +00:00
|
|
|
ordering_fields = ('name', 'protocol', 'login_mode')
|
2021-10-22 06:27:54 +00:00
|
|
|
ordering = ('name', )
|
2018-10-31 07:31:09 +00:00
|
|
|
|
2021-11-05 08:11:29 +00:00
|
|
|
@action(methods=['get'], detail=False, url_path='su-from')
|
|
|
|
def su_from(self, request, *args, **kwargs):
|
|
|
|
""" API 获取可选的 su_from 系统用户"""
|
|
|
|
queryset = self.filter_queryset(self.get_queryset())
|
|
|
|
queryset = queryset.filter(
|
|
|
|
protocol=SystemUser.Protocol.ssh, login_mode=SystemUser.LOGIN_AUTO
|
|
|
|
)
|
|
|
|
return self.get_paginate_response_if_need(queryset)
|
|
|
|
|
|
|
|
@action(methods=['get'], detail=True, url_path='su-to')
|
|
|
|
def su_to(self, request, *args, **kwargs):
|
|
|
|
""" 获取系统用户的所有 su_to 系统用户 """
|
|
|
|
pk = kwargs.get('pk')
|
|
|
|
system_user = get_object_or_404(SystemUser, pk=pk)
|
|
|
|
queryset = system_user.su_to.all()
|
|
|
|
queryset = self.filter_queryset(queryset)
|
|
|
|
return self.get_paginate_response_if_need(queryset)
|
|
|
|
|
|
|
|
def get_paginate_response_if_need(self, queryset):
|
|
|
|
page = self.paginate_queryset(queryset)
|
|
|
|
if page is not None:
|
|
|
|
serializer = self.get_serializer(page, many=True)
|
|
|
|
return self.get_paginated_response(serializer.data)
|
|
|
|
serializer = self.get_serializer(queryset, many=True)
|
|
|
|
return Response(serializer.data)
|
|
|
|
|
2018-02-06 10:32:02 +00:00
|
|
|
|
2018-05-17 03:39:04 +00:00
|
|
|
class SystemUserAuthInfoApi(generics.RetrieveUpdateDestroyAPIView):
|
2018-02-06 10:32:02 +00:00
|
|
|
"""
|
|
|
|
Get system user auth info
|
|
|
|
"""
|
2019-10-18 07:05:45 +00:00
|
|
|
model = SystemUser
|
2020-03-12 08:24:38 +00:00
|
|
|
serializer_class = SystemUserWithAuthInfoSerializer
|
2022-02-17 12:13:31 +00:00
|
|
|
rbac_perms = {
|
|
|
|
'retrieve': 'assets.view_systemusersecret',
|
|
|
|
'list': 'assets.view_systemusersecret',
|
|
|
|
'change': 'assets.change_systemuser',
|
|
|
|
'destroy': 'assets.change_systemuser',
|
|
|
|
}
|
2018-02-06 10:32:02 +00:00
|
|
|
|
2018-05-17 03:39:04 +00:00
|
|
|
def destroy(self, request, *args, **kwargs):
|
|
|
|
instance = self.get_object()
|
|
|
|
instance.clear_auth()
|
|
|
|
return Response(status=204)
|
|
|
|
|
2018-02-06 10:32:02 +00:00
|
|
|
|
2021-05-31 07:01:14 +00:00
|
|
|
class SystemUserTempAuthInfoApi(generics.CreateAPIView):
|
|
|
|
model = SystemUser
|
|
|
|
permission_classes = (IsValidUser,)
|
|
|
|
serializer_class = SystemUserTempAuthSerializer
|
|
|
|
|
2022-02-16 08:18:20 +00:00
|
|
|
def decrypt_data_if_need(self, data):
|
|
|
|
csrf_token = self.request.META.get('CSRF_COOKIE')
|
|
|
|
aes = get_aes_crypto(csrf_token, 'ECB')
|
|
|
|
password = data.get('password', '')
|
|
|
|
try:
|
|
|
|
data['password'] = aes.decrypt(password)
|
|
|
|
except:
|
|
|
|
pass
|
|
|
|
return data
|
|
|
|
|
2021-05-31 07:01:14 +00:00
|
|
|
def create(self, request, *args, **kwargs):
|
|
|
|
serializer = super().get_serializer(data=request.data)
|
|
|
|
serializer.is_valid(raise_exception=True)
|
2022-02-16 08:18:20 +00:00
|
|
|
|
2021-05-31 07:01:14 +00:00
|
|
|
pk = kwargs.get('pk')
|
2022-02-16 08:18:20 +00:00
|
|
|
data = self.decrypt_data_if_need(serializer.validated_data)
|
2021-05-31 07:01:14 +00:00
|
|
|
instance_id = data.get('instance_id')
|
2021-06-07 02:40:07 +00:00
|
|
|
|
|
|
|
with tmp_to_root_org():
|
|
|
|
instance = get_object_or_404(SystemUser, pk=pk)
|
2022-02-16 08:18:20 +00:00
|
|
|
instance.set_temp_auth(instance_id, self.request.user, data)
|
2021-05-31 07:01:14 +00:00
|
|
|
return Response(serializer.data, status=201)
|
|
|
|
|
|
|
|
|
2019-03-18 02:15:33 +00:00
|
|
|
class SystemUserAssetAuthInfoApi(generics.RetrieveAPIView):
|
|
|
|
"""
|
|
|
|
Get system user with asset auth info
|
|
|
|
"""
|
2019-10-18 07:05:45 +00:00
|
|
|
model = SystemUser
|
2020-03-12 08:24:38 +00:00
|
|
|
serializer_class = SystemUserWithAuthInfoSerializer
|
|
|
|
|
2021-05-31 07:01:14 +00:00
|
|
|
def get_object(self):
|
|
|
|
instance = super().get_object()
|
|
|
|
asset_id = self.kwargs.get('asset_id')
|
|
|
|
user_id = self.request.query_params.get("user_id")
|
|
|
|
username = self.request.query_params.get("username")
|
2021-10-13 06:32:47 +00:00
|
|
|
instance.load_asset_more_auth(asset_id, username, user_id)
|
2021-05-31 07:01:14 +00:00
|
|
|
return instance
|
|
|
|
|
|
|
|
|
|
|
|
class SystemUserAppAuthInfoApi(generics.RetrieveAPIView):
|
|
|
|
"""
|
|
|
|
Get system user with asset auth info
|
|
|
|
"""
|
|
|
|
model = SystemUser
|
|
|
|
serializer_class = SystemUserWithAuthInfoSerializer
|
2022-02-17 12:13:31 +00:00
|
|
|
rbac_perms = {
|
|
|
|
'retrieve': 'assets.view_systemusersecret',
|
|
|
|
}
|
2019-03-18 02:15:33 +00:00
|
|
|
|
|
|
|
def get_object(self):
|
|
|
|
instance = super().get_object()
|
2021-05-31 07:01:14 +00:00
|
|
|
app_id = self.kwargs.get('app_id')
|
|
|
|
user_id = self.request.query_params.get("user_id")
|
2021-12-14 11:00:28 +00:00
|
|
|
username = self.request.query_params.get("username")
|
|
|
|
instance.load_app_more_auth(app_id, username, user_id)
|
2021-05-31 07:01:14 +00:00
|
|
|
return instance
|
2018-02-06 10:32:02 +00:00
|
|
|
|
|
|
|
|
2020-03-12 08:24:38 +00:00
|
|
|
class SystemUserTaskApi(generics.CreateAPIView):
|
|
|
|
serializer_class = serializers.SystemUserTaskSerializer
|
|
|
|
|
2021-03-08 02:08:51 +00:00
|
|
|
def do_push(self, system_user, asset_ids=None):
|
|
|
|
if asset_ids is None:
|
2020-03-12 08:24:38 +00:00
|
|
|
task = push_system_user_to_assets_manual.delay(system_user)
|
|
|
|
else:
|
|
|
|
username = self.request.query_params.get('username')
|
2020-12-08 09:29:22 +00:00
|
|
|
task = push_system_user_to_assets.delay(
|
2021-03-08 02:08:51 +00:00
|
|
|
system_user.id, asset_ids, username=username
|
2020-03-12 08:24:38 +00:00
|
|
|
)
|
|
|
|
return task
|
|
|
|
|
|
|
|
@staticmethod
|
2021-05-19 09:59:15 +00:00
|
|
|
def do_test(system_user, asset_ids):
|
|
|
|
task = test_system_user_connectivity_manual.delay(system_user, asset_ids)
|
2020-03-12 08:24:38 +00:00
|
|
|
return task
|
2018-09-03 03:24:25 +00:00
|
|
|
|
|
|
|
def get_object(self):
|
|
|
|
pk = self.kwargs.get('pk')
|
|
|
|
return get_object_or_404(SystemUser, pk=pk)
|
|
|
|
|
2022-02-17 12:13:31 +00:00
|
|
|
def check_permissions(self, request):
|
|
|
|
action = request.data.get('action')
|
|
|
|
action_perm_require = {
|
|
|
|
'push': 'assets.push_systemuser',
|
|
|
|
'test': 'assets.test_connectivity'
|
|
|
|
}
|
|
|
|
perm_required = action_perm_require.get(action)
|
|
|
|
has = self.request.user.has_perm(perm_required)
|
|
|
|
|
|
|
|
if not has:
|
|
|
|
self.permission_denied(request)
|
|
|
|
|
2020-03-12 08:24:38 +00:00
|
|
|
def perform_create(self, serializer):
|
|
|
|
action = serializer.validated_data["action"]
|
|
|
|
asset = serializer.validated_data.get('asset')
|
2021-05-19 09:59:15 +00:00
|
|
|
|
|
|
|
if asset:
|
|
|
|
assets = [asset]
|
|
|
|
else:
|
|
|
|
assets = serializer.validated_data.get('assets') or []
|
|
|
|
|
|
|
|
asset_ids = [asset.id for asset in assets]
|
|
|
|
asset_ids = asset_ids if asset_ids else None
|
2020-12-08 09:29:22 +00:00
|
|
|
|
2018-09-03 03:24:25 +00:00
|
|
|
system_user = self.get_object()
|
2020-03-12 08:24:38 +00:00
|
|
|
if action == 'push':
|
2021-03-08 02:08:51 +00:00
|
|
|
task = self.do_push(system_user, asset_ids)
|
2020-03-12 08:24:38 +00:00
|
|
|
else:
|
2021-05-19 09:59:15 +00:00
|
|
|
task = self.do_test(system_user, asset_ids)
|
2020-03-12 08:24:38 +00:00
|
|
|
data = getattr(serializer, '_data', {})
|
|
|
|
data["task"] = task.id
|
|
|
|
setattr(serializer, '_data', data)
|
2018-10-10 07:37:20 +00:00
|
|
|
|
|
|
|
|
|
|
|
class SystemUserCommandFilterRuleListApi(generics.ListAPIView):
|
2022-02-17 12:13:31 +00:00
|
|
|
rbac_perms = {
|
|
|
|
'list': 'assets.view_commandfilterule'
|
|
|
|
}
|
2018-10-10 07:37:20 +00:00
|
|
|
|
|
|
|
def get_serializer_class(self):
|
|
|
|
from ..serializers import CommandFilterRuleSerializer
|
|
|
|
return CommandFilterRuleSerializer
|
|
|
|
|
|
|
|
def get_queryset(self):
|
2021-12-09 09:18:16 +00:00
|
|
|
user_id = self.request.query_params.get('user_id')
|
|
|
|
user_group_id = self.request.query_params.get('user_group_id')
|
|
|
|
system_user_id = self.kwargs.get('pk', None)
|
|
|
|
system_user = get_object_or_none(SystemUser, pk=system_user_id)
|
|
|
|
if not system_user:
|
|
|
|
system_user_id = self.request.query_params.get('system_user_id')
|
|
|
|
asset_id = self.request.query_params.get('asset_id')
|
|
|
|
application_id = self.request.query_params.get('application_id')
|
2022-01-19 09:48:44 +00:00
|
|
|
rules = CommandFilterRule.get_queryset(
|
|
|
|
user_id=user_id,
|
|
|
|
user_group_id=user_group_id,
|
|
|
|
system_user_id=system_user_id,
|
|
|
|
asset_id=asset_id,
|
|
|
|
application_id=application_id
|
|
|
|
)
|
2021-12-09 09:18:16 +00:00
|
|
|
return rules
|
2020-11-09 11:17:00 +00:00
|
|
|
|
|
|
|
|
|
|
|
class SystemUserAssetsListView(generics.ListAPIView):
|
|
|
|
serializer_class = serializers.AssetSimpleSerializer
|
2021-01-07 02:53:10 +00:00
|
|
|
filterset_fields = ("hostname", "ip")
|
|
|
|
search_fields = filterset_fields
|
2022-02-17 12:13:31 +00:00
|
|
|
rbac_perms = {
|
|
|
|
'list': 'assets.view_asset'
|
|
|
|
}
|
2020-11-09 11:17:00 +00:00
|
|
|
|
|
|
|
def get_object(self):
|
|
|
|
pk = self.kwargs.get('pk')
|
|
|
|
return get_object_or_404(SystemUser, pk=pk)
|
|
|
|
|
|
|
|
def get_queryset(self):
|
|
|
|
system_user = self.get_object()
|
|
|
|
return system_user.get_all_assets()
|