mirror of https://github.com/jumpserver/jumpserver
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
101 lines
3.9 KiB
101 lines
3.9 KiB
# ~*~ coding: utf-8 ~*~ |
|
from __future__ import absolute_import, unicode_literals |
|
|
|
from collections import defaultdict |
|
from datetime import timedelta |
|
|
|
from celery import shared_task |
|
from django.conf import settings |
|
from django.db.transaction import atomic |
|
from django.utils.translation import gettext_lazy as _ |
|
|
|
from common.const.crontab import CRONTAB_AT_AM_TEN |
|
from common.utils import get_logger |
|
from common.utils.timezone import local_now, dt_parser |
|
from ops.celery.decorator import register_as_period_task |
|
from orgs.utils import tmp_to_root_org |
|
from perms.models import AssetPermission |
|
from perms.notifications import ( |
|
PermedAssetsWillExpireUserMsg, |
|
AssetPermsWillExpireForOrgAdminMsg, |
|
) |
|
from perms.utils import UserPermTreeExpireUtil |
|
|
|
logger = get_logger(__file__) |
|
|
|
|
|
@shared_task( |
|
verbose_name=_('Check asset permission expired'), |
|
description=_( |
|
"""The cache of organizational collections, which have completed user authorization tree |
|
construction, will expire. Therefore, expired collections need to be cleared from the |
|
cache, and this task will be executed periodically based on the time interval specified |
|
by PERM_EXPIRED_CHECK_PERIODIC in the system configuration file config.txt""" |
|
) |
|
) |
|
@register_as_period_task(interval=settings.PERM_EXPIRED_CHECK_PERIODIC) |
|
@atomic() |
|
@tmp_to_root_org() |
|
def check_asset_permission_expired(): |
|
""" 这里的任务要足够短，不要影响周期任务 """ |
|
perms = AssetPermission.objects.get_expired_permissions() |
|
perm_ids = list(perms.distinct().values_list('id', flat=True)) |
|
show_perm_ids = perm_ids[:5] |
|
logger.info(f'Checking expired permissions: {show_perm_ids} ...') |
|
UserPermTreeExpireUtil().expire_perm_tree_for_perms(perm_ids) |
|
|
|
|
|
@shared_task( |
|
verbose_name=_('Send asset permission expired notification'), |
|
description=_( |
|
"""Check every day at 10 a.m. and send a notification message to users associated with |
|
assets whose authorization is about to expire, as well as to the organization's |
|
administrators, 3 days in advance, to remind them that the asset authorization will |
|
expire in a few days""" |
|
) |
|
) |
|
@register_as_period_task(crontab=CRONTAB_AT_AM_TEN) |
|
@atomic() |
|
@tmp_to_root_org() |
|
def check_asset_permission_will_expired(): |
|
start = local_now() |
|
end = start + timedelta(days=3) |
|
|
|
user_asset_remain_day_mapper = defaultdict(dict) |
|
org_perm_remain_day_mapper = defaultdict(dict) |
|
|
|
asset_perms = AssetPermission.objects.filter( |
|
date_expired__gte=start, |
|
date_expired__lte=end |
|
).distinct() |
|
|
|
for asset_perm in asset_perms: |
|
date_expired = dt_parser(asset_perm.date_expired) |
|
remain_days = (date_expired - start).days |
|
|
|
org = asset_perm.org |
|
# 资产授权按照组织分类 |
|
if org in org_perm_remain_day_mapper[remain_days]: |
|
org_perm_remain_day_mapper[remain_days][org].add(asset_perm) |
|
else: |
|
org_perm_remain_day_mapper[remain_days][org] = {asset_perm, } |
|
|
|
# 计算每个用户即将过期的资产 |
|
users = asset_perm.get_all_users() |
|
assets = asset_perm.get_all_assets() |
|
|
|
for u in users: |
|
if u in user_asset_remain_day_mapper[remain_days]: |
|
user_asset_remain_day_mapper[remain_days][u].update(assets) |
|
else: |
|
user_asset_remain_day_mapper[remain_days][u] = set(assets) |
|
|
|
for day_count, user_asset_mapper in user_asset_remain_day_mapper.items(): |
|
for user, assets in user_asset_mapper.items(): |
|
PermedAssetsWillExpireUserMsg(user, assets, day_count).publish_async() |
|
|
|
for day_count, org_perm_mapper in org_perm_remain_day_mapper.items(): |
|
for org, perms in org_perm_mapper.items(): |
|
org_admins = org.admins.all() |
|
for org_admin in org_admins: |
|
AssetPermsWillExpireForOrgAdminMsg(org_admin, perms, org, day_count).publish_async()
|
|
|