jumpserver/apps/perms/api/user_remote_app_permission.py

126 lines
4.3 KiB
Python
Raw Normal View History

2019-07-01 13:48:25 +00:00
# -*- coding: utf-8 -*-
import uuid
2019-07-01 13:48:25 +00:00
from django.shortcuts import get_object_or_404
from rest_framework.views import APIView, Response
from common.permissions import IsValidUser, IsOrgAdminOrAppUser
from common.tree import TreeNodeSerializer
from orgs.mixins import generics
2019-07-01 13:48:25 +00:00
from ..utils import (
RemoteAppPermissionUtil, construct_remote_apps_tree_root,
parse_remote_app_to_tree_node,
)
from ..hands import User, RemoteApp, RemoteAppSerializer, UserGroup, SystemUser
from .mixin import UserPermissionMixin
from .. import serializers
2019-07-01 13:48:25 +00:00
__all__ = [
'UserGrantedRemoteAppsApi', 'ValidateUserRemoteAppPermissionApi',
'UserGrantedRemoteAppsAsTreeApi', 'UserGroupGrantedRemoteAppsApi',
'UserGrantedRemoteAppSystemUsersApi',
2019-07-01 13:48:25 +00:00
]
class UserGrantedRemoteAppsApi(generics.ListAPIView):
2019-07-01 13:48:25 +00:00
permission_classes = (IsOrgAdminOrAppUser,)
serializer_class = RemoteAppSerializer
filter_fields = ['name', 'id']
search_fields = ['name']
2019-07-01 13:48:25 +00:00
def get_object(self):
user_id = self.kwargs.get('pk', '')
if user_id:
user = get_object_or_404(User, id=user_id)
else:
user = self.request.user
return user
def get_queryset(self):
util = RemoteAppPermissionUtil(self.get_object())
queryset = util.get_remote_apps()
return queryset
def get_permissions(self):
if self.kwargs.get('pk') is None:
self.permission_classes = (IsValidUser,)
return super().get_permissions()
2019-09-10 13:11:22 +00:00
class UserGrantedRemoteAppsAsTreeApi(UserGrantedRemoteAppsApi):
2019-07-01 13:48:25 +00:00
serializer_class = TreeNodeSerializer
permission_classes = (IsOrgAdminOrAppUser,)
def get_serializer(self, remote_apps=None, *args, **kwargs):
if remote_apps is None:
remote_apps = []
2019-09-10 13:11:22 +00:00
only_remote_app = self.request.query_params.get('only', '0') == '1'
tree_root = None
data = []
if not only_remote_app:
tree_root = construct_remote_apps_tree_root()
data.append(tree_root)
for remote_app in remote_apps:
2019-07-01 13:48:25 +00:00
node = parse_remote_app_to_tree_node(tree_root, remote_app)
2019-09-10 13:11:22 +00:00
data.append(node)
data.sort()
return super().get_serializer(data, many=True)
2019-07-01 13:48:25 +00:00
class UserGrantedRemoteAppSystemUsersApi(UserPermissionMixin, generics.ListAPIView):
permission_classes = (IsOrgAdminOrAppUser,)
serializer_class = serializers.RemoteAppSystemUserSerializer
only_fields = serializers.RemoteAppSystemUserSerializer.Meta.only_fields
def get_queryset(self):
util = RemoteAppPermissionUtil(self.obj)
remote_app_id = self.kwargs.get('remote_app_id')
remote_app = get_object_or_404(RemoteApp, id=remote_app_id)
system_users = util.get_remote_app_system_users(remote_app)
return system_users
2019-07-01 13:48:25 +00:00
class ValidateUserRemoteAppPermissionApi(APIView):
permission_classes = (IsOrgAdminOrAppUser,)
def get(self, request, *args, **kwargs):
user_id = request.query_params.get('user_id', '')
remote_app_id = request.query_params.get('remote_app_id', '')
system_id = request.query_params.get('system_user_id', '')
try:
user_id = uuid.UUID(user_id)
remote_app_id = uuid.UUID(remote_app_id)
system_id = uuid.UUID(system_id)
except ValueError:
return Response({'msg': False}, status=403)
2019-07-01 13:48:25 +00:00
2019-09-10 13:11:22 +00:00
user = get_object_or_404(User, id=user_id)
remote_app = get_object_or_404(RemoteApp, id=remote_app_id)
system_user = get_object_or_404(SystemUser, id=system_id)
2019-07-01 13:48:25 +00:00
util = RemoteAppPermissionUtil(user)
system_users = util.get_remote_app_system_users(remote_app)
if system_user in system_users:
2019-09-10 13:11:22 +00:00
return Response({'msg': True}, status=200)
2019-09-10 13:11:22 +00:00
return Response({'msg': False}, status=403)
# RemoteApp permission
class UserGroupGrantedRemoteAppsApi(generics.ListAPIView):
permission_classes = (IsOrgAdminOrAppUser, )
serializer_class = RemoteAppSerializer
def get_queryset(self):
queryset = []
user_group_id = self.kwargs.get('pk')
if not user_group_id:
return queryset
user_group = get_object_or_404(UserGroup, id=user_group_id)
util = RemoteAppPermissionUtil(user_group)
queryset = util.get_remote_apps()
return queryset