jumpserver/apps/perms/api.py

332 lines
11 KiB
Python
Raw Normal View History

2016-08-09 09:27:37 +00:00
# ~*~ coding: utf-8 ~*~
#
2017-01-17 08:34:47 +00:00
from django.shortcuts import get_object_or_404
2016-10-19 11:30:55 +00:00
from rest_framework.views import APIView, Response
from rest_framework.generics import ListAPIView, get_object_or_404, RetrieveUpdateAPIView
2016-11-09 16:18:57 +00:00
from rest_framework import viewsets
2018-07-10 08:33:28 +00:00
from rest_framework.pagination import LimitOffsetPagination
2017-12-21 10:54:29 +00:00
2018-05-23 07:15:27 +00:00
from common.utils import set_or_append_attr_bulk, get_object_or_none
2018-07-23 04:55:13 +00:00
from common.permissions import IsValidUser, IsOrgAdmin, IsOrgAdminOrAppUser
2018-04-08 12:02:40 +00:00
from .utils import AssetPermissionUtil
from .models import AssetPermission
from .hands import AssetGrantedSerializer, User, UserGroup, Asset, Node, \
NodeGrantedSerializer, SystemUser, NodeSerializer
2016-11-04 10:33:16 +00:00
from . import serializers
2016-11-09 16:18:57 +00:00
class AssetPermissionViewSet(viewsets.ModelViewSet):
"""
资产授权列表的增删改查api
"""
2018-07-14 16:55:05 +00:00
queryset = AssetPermission.objects.all()
2018-02-01 09:14:15 +00:00
serializer_class = serializers.AssetPermissionCreateUpdateSerializer
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
2016-10-19 11:30:55 +00:00
2018-02-01 09:14:15 +00:00
def get_serializer_class(self):
if self.action in ("list", 'retrieve'):
return serializers.AssetPermissionListSerializer
return self.serializer_class
2016-11-15 11:33:04 +00:00
2018-04-10 12:29:06 +00:00
def get_queryset(self):
queryset = super().get_queryset()
asset_id = self.request.query_params.get('asset')
node_id = self.request.query_params.get('node')
inherit_nodes = set()
if not asset_id and not node_id:
return queryset
permissions = set()
if asset_id:
asset = get_object_or_404(Asset, pk=asset_id)
permissions = set(queryset.filter(assets=asset))
for node in asset.nodes.all():
2018-05-31 11:47:57 +00:00
inherit_nodes.update(set(node.get_ancestor(with_self=True)))
2018-04-10 12:29:06 +00:00
elif node_id:
node = get_object_or_404(Node, pk=node_id)
permissions = set(queryset.filter(nodes=node))
2018-05-31 11:47:57 +00:00
inherit_nodes = node.get_ancestor()
2018-04-10 12:29:06 +00:00
for n in inherit_nodes:
_permissions = queryset.filter(nodes=n)
set_or_append_attr_bulk(_permissions, "inherit", n.value)
permissions.update(_permissions)
return permissions
2016-11-15 11:33:04 +00:00
class UserGrantedAssetsApi(ListAPIView):
"""
用户授权的所有资产
"""
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
2016-11-15 11:33:04 +00:00
serializer_class = AssetGrantedSerializer
def get_queryset(self):
user_id = self.kwargs.get('pk', '')
2017-01-17 08:34:47 +00:00
queryset = []
2018-02-07 15:25:15 +00:00
2016-11-15 11:33:04 +00:00
if user_id:
user = get_object_or_404(User, id=user_id)
2018-02-07 15:25:15 +00:00
else:
user = self.request.user
2016-11-15 11:33:04 +00:00
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user)
for k, v in util.get_assets().items():
2018-07-25 02:22:32 +00:00
system_users_granted = [s for s in v if s.protocol == k.protocol]
k.system_users_granted = system_users_granted
2018-02-07 15:25:15 +00:00
queryset.append(k)
return queryset
2016-11-15 11:33:04 +00:00
2018-02-07 15:25:15 +00:00
def get_permissions(self):
if self.kwargs.get('pk') is None:
self.permission_classes = (IsValidUser,)
return super().get_permissions()
class UserGrantedNodesApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = NodeSerializer
def get_queryset(self):
user_id = self.kwargs.get('pk', '')
if user_id:
user = get_object_or_404(User, id=user_id)
else:
user = self.request.user
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user)
nodes = util.get_nodes_with_assets()
return nodes.keys()
def get_permissions(self):
if self.kwargs.get('pk') is None:
self.permission_classes = (IsValidUser,)
return super().get_permissions()
2018-02-07 15:25:15 +00:00
class UserGrantedNodesWithAssetsApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
2018-02-07 15:25:15 +00:00
serializer_class = NodeGrantedSerializer
2016-11-15 11:33:04 +00:00
def get_queryset(self):
user_id = self.kwargs.get('pk', '')
2017-11-14 01:44:16 +00:00
queryset = []
2018-02-07 15:25:15 +00:00
if not user_id:
user = self.request.user
else:
user = get_object_or_404(User, id=user_id)
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user)
nodes = util.get_nodes_with_assets()
2018-04-08 12:02:40 +00:00
for node, _assets in nodes.items():
assets = _assets.keys()
2018-04-11 04:13:49 +00:00
for k, v in _assets.items():
2018-07-25 02:22:32 +00:00
system_users_granted = [s for s in v if s.protocol == k.protocol]
2018-04-11 04:13:49 +00:00
k.system_users_granted = system_users_granted
2018-04-08 12:02:40 +00:00
node.assets_granted = assets
2018-02-07 15:25:15 +00:00
queryset.append(node)
return queryset
2018-02-07 15:25:15 +00:00
def get_permissions(self):
if self.kwargs.get('pk') is None:
self.permission_classes = (IsValidUser,)
return super().get_permissions()
2016-11-15 15:09:36 +00:00
2018-04-08 12:02:40 +00:00
class UserGrantedNodeAssetsApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
2018-04-08 12:02:40 +00:00
serializer_class = AssetGrantedSerializer
def get_queryset(self):
user_id = self.kwargs.get('pk', '')
node_id = self.kwargs.get('node_id')
if user_id:
user = get_object_or_404(User, id=user_id)
else:
user = self.request.user
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user)
node = get_object_or_404(Node, id=node_id)
2018-06-01 07:34:08 +00:00
nodes = util.get_nodes_with_assets()
2018-04-08 12:02:40 +00:00
assets = nodes.get(node, [])
for asset, system_users in assets.items():
asset.system_users_granted = system_users
return assets
2018-04-11 03:34:15 +00:00
def get_permissions(self):
if self.kwargs.get('pk') is None:
self.permission_classes = (IsValidUser,)
return super().get_permissions()
2018-04-08 12:02:40 +00:00
2016-11-15 15:09:36 +00:00
class UserGroupGrantedAssetsApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
2016-11-15 15:09:36 +00:00
serializer_class = AssetGrantedSerializer
def get_queryset(self):
user_group_id = self.kwargs.get('pk', '')
2018-02-07 15:25:15 +00:00
queryset = []
2016-11-15 15:09:36 +00:00
2018-02-07 15:25:15 +00:00
if not user_group_id:
return queryset
user_group = get_object_or_404(UserGroup, id=user_group_id)
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user_group)
assets = util.get_assets()
2018-02-07 15:25:15 +00:00
for k, v in assets.items():
k.system_users_granted = v
queryset.append(k)
2016-11-15 15:09:36 +00:00
return queryset
class UserGroupGrantedNodesApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = NodeSerializer
def get_queryset(self):
group_id = self.kwargs.get('pk', '')
queryset = []
if group_id:
group = get_object_or_404(UserGroup, id=group_id)
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(group)
nodes = util.get_nodes_with_assets()
2018-04-08 12:02:40 +00:00
return nodes.keys()
return queryset
class UserGroupGrantedNodesWithAssetsApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
2018-02-07 15:25:15 +00:00
serializer_class = NodeGrantedSerializer
2016-11-15 15:09:36 +00:00
def get_queryset(self):
user_group_id = self.kwargs.get('pk', '')
2018-02-07 15:25:15 +00:00
queryset = []
2016-11-15 15:09:36 +00:00
2018-02-07 15:25:15 +00:00
if not user_group_id:
return queryset
user_group = get_object_or_404(UserGroup, id=user_group_id)
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user_group)
nodes = util.get_nodes_with_assets()
2018-04-08 12:02:40 +00:00
for node, _assets in nodes.items():
assets = _assets.keys()
for asset, system_users in _assets.items():
asset.system_users_granted = system_users
node.assets_granted = assets
2018-02-07 15:25:15 +00:00
queryset.append(node)
2017-01-17 08:34:47 +00:00
return queryset
2018-04-08 12:02:40 +00:00
class UserGroupGrantedNodeAssetsApi(ListAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
2018-04-08 12:02:40 +00:00
serializer_class = AssetGrantedSerializer
def get_queryset(self):
user_group_id = self.kwargs.get('pk', '')
node_id = self.kwargs.get('node_id')
user_group = get_object_or_404(UserGroup, id=user_group_id)
node = get_object_or_404(Node, id=node_id)
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user_group)
nodes = util.get_nodes_with_assets()
2018-04-08 12:02:40 +00:00
assets = nodes.get(node, [])
for asset, system_users in assets.items():
asset.system_users_granted = system_users
return assets
class ValidateUserAssetPermissionView(APIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
2017-01-17 08:34:47 +00:00
@staticmethod
def get(request):
2017-01-20 05:59:53 +00:00
user_id = request.query_params.get('user_id', '')
asset_id = request.query_params.get('asset_id', '')
system_id = request.query_params.get('system_user_id', '')
2017-01-17 08:34:47 +00:00
user = get_object_or_404(User, id=user_id)
asset = get_object_or_404(Asset, id=asset_id)
system_user = get_object_or_404(SystemUser, id=system_id)
2017-01-17 08:34:47 +00:00
2018-06-01 07:34:08 +00:00
util = AssetPermissionUtil(user)
assets_granted = util.get_assets()
if system_user in assets_granted.get(asset, []):
return Response({'msg': True}, status=200)
else:
return Response({'msg': False}, status=403)
class AssetPermissionRemoveUserApi(RetrieveUpdateAPIView):
"""
将用户从授权中移除Detail页面会调用
"""
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = serializers.AssetPermissionUpdateUserSerializer
2018-07-14 16:55:05 +00:00
queryset = AssetPermission.objects.all()
def update(self, request, *args, **kwargs):
perm = self.get_object()
serializer = self.serializer_class(data=request.data)
if serializer.is_valid():
users = serializer.validated_data.get('users')
if users:
perm.users.remove(*tuple(users))
return Response({"msg": "ok"})
else:
return Response({"error": serializer.errors})
class AssetPermissionAddUserApi(RetrieveUpdateAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = serializers.AssetPermissionUpdateUserSerializer
2018-07-14 16:55:05 +00:00
queryset = AssetPermission.objects.all()
def update(self, request, *args, **kwargs):
perm = self.get_object()
serializer = self.serializer_class(data=request.data)
if serializer.is_valid():
users = serializer.validated_data.get('users')
if users:
perm.users.add(*tuple(users))
return Response({"msg": "ok"})
else:
return Response({"error": serializer.errors})
class AssetPermissionRemoveAssetApi(RetrieveUpdateAPIView):
"""
将用户从授权中移除Detail页面会调用
"""
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = serializers.AssetPermissionUpdateAssetSerializer
2018-07-14 16:55:05 +00:00
queryset = AssetPermission.objects.all()
def update(self, request, *args, **kwargs):
perm = self.get_object()
serializer = self.serializer_class(data=request.data)
if serializer.is_valid():
assets = serializer.validated_data.get('assets')
if assets:
perm.assets.remove(*tuple(assets))
return Response({"msg": "ok"})
else:
return Response({"error": serializer.errors})
class AssetPermissionAddAssetApi(RetrieveUpdateAPIView):
2018-07-23 04:55:13 +00:00
permission_classes = (IsOrgAdmin,)
serializer_class = serializers.AssetPermissionUpdateAssetSerializer
2018-07-14 16:55:05 +00:00
queryset = AssetPermission.objects.all()
def update(self, request, *args, **kwargs):
perm = self.get_object()
serializer = self.serializer_class(data=request.data)
if serializer.is_valid():
assets = serializer.validated_data.get('assets')
if assets:
perm.assets.add(*tuple(assets))
return Response({"msg": "ok"})
else:
return Response({"error": serializer.errors})