This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/passbook/core/models.py

170 lines
5.7 KiB
Python
Raw Normal View History

2018-11-11 12:41:48 +00:00
"""passbook core models"""
import re
from logging import getLogger
import reversion
from django.contrib.auth.models import AbstractUser
from django.db import models
2018-11-16 08:10:35 +00:00
from model_utils.managers import InheritanceManager
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
from passbook.lib.models import CreatedUpdatedModel, UUIDModel
2018-11-11 12:41:48 +00:00
LOGGER = getLogger(__name__)
@reversion.register()
class User(AbstractUser):
"""Custom User model to allow easier adding o f user-based settings"""
sources = models.ManyToManyField('Source', through='UserSourceConnection')
2018-11-16 10:41:14 +00:00
applications = models.ManyToManyField('Application')
@reversion.register()
class Provider(models.Model):
"""Application-independent Provider instance. For example SAML2 Remote, OAuth2 Application"""
2018-11-16 10:41:14 +00:00
2018-11-25 19:38:49 +00:00
objects = InheritanceManager()
2018-11-16 10:41:14 +00:00
# This class defines no field for easier inheritance
def __str__(self):
if hasattr(self, 'name'):
return getattr(self, 'name')
return super().__str__()
2018-11-11 12:41:48 +00:00
class RuleModel(UUIDModel, CreatedUpdatedModel):
"""Base model which can have rules applied to it"""
rules = models.ManyToManyField('Rule', blank=True)
def passes(self, user: User) -> bool:
"""Return true if user passes, otherwise False or raise Exception"""
for rule in self.rules:
if not rule.passes(user):
return False
return True
2018-11-11 12:41:48 +00:00
@reversion.register()
class Application(RuleModel):
2018-11-11 12:41:48 +00:00
"""Every Application which uses passbook for authentication/identification/authorization
needs an Application record. Other authentication types can subclass this Model to
add custom fields and other properties"""
name = models.TextField()
launch_url = models.URLField(null=True, blank=True)
icon_url = models.TextField(null=True, blank=True)
provider = models.OneToOneField('Provider', null=True,
default=None, on_delete=models.SET_DEFAULT)
skip_authorization = models.BooleanField(default=False)
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
2018-11-11 12:41:48 +00:00
def user_is_authorized(self, user: User) -> bool:
"""Check if user is authorized to use this application"""
raise NotImplementedError()
def __str__(self):
return self.name
@reversion.register()
class Source(RuleModel):
2018-11-11 12:41:48 +00:00
"""Base Authentication source, i.e. an OAuth Provider, SAML Remote or LDAP Server"""
name = models.TextField()
slug = models.SlugField()
2018-11-16 08:10:35 +00:00
form = '' # ModelForm-based class ued to create/edit instance
2018-11-11 12:41:48 +00:00
enabled = models.BooleanField(default=True)
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
2018-11-11 12:41:48 +00:00
def __str__(self):
return self.name
@reversion.register()
class UserSourceConnection(CreatedUpdatedModel):
"""Connection between User and Source."""
user = models.ForeignKey(User, on_delete=models.CASCADE)
source = models.ForeignKey(Source, on_delete=models.CASCADE)
class Meta:
unique_together = (('user', 'source'),)
@reversion.register()
2018-11-16 08:10:35 +00:00
class Rule(UUIDModel, CreatedUpdatedModel):
2018-11-11 12:41:48 +00:00
"""Rules which specify if a user is authorized to use an Application. Can be overridden by
other types to add other fields, more logic, etc."""
ACTION_ALLOW = 'allow'
ACTION_DENY = 'deny'
ACTIONS = (
(ACTION_ALLOW, ACTION_ALLOW),
(ACTION_DENY, ACTION_DENY),
)
name = models.TextField(blank=True, null=True)
action = models.CharField(max_length=20, choices=ACTIONS)
negate = models.BooleanField(default=False)
2018-11-25 19:38:49 +00:00
order = models.IntegerField(default=0)
2018-11-11 12:41:48 +00:00
2018-11-16 08:10:35 +00:00
objects = InheritanceManager()
2018-11-11 12:41:48 +00:00
def __str__(self):
if self.name:
return self.name
return "%s action %s" % (self.name, self.action)
2018-11-11 12:41:48 +00:00
def passes(self, user: User) -> bool:
2018-11-11 12:41:48 +00:00
"""Check if user instance passes this rule"""
raise NotImplementedError()
@reversion.register()
class FieldMatcherRule(Rule):
"""Rule which checks if a field of the User model matches/doesn't match a
certain pattern"""
MATCH_STARTSWITH = 'startswith'
MATCH_ENDSWITH = 'endswith'
MATCH_CONTAINS = 'contains'
MATCH_REGEXP = 'regexp'
MATCH_EXACT = 'exact'
MATCHES = (
(MATCH_STARTSWITH, MATCH_STARTSWITH),
(MATCH_ENDSWITH, MATCH_ENDSWITH),
(MATCH_ENDSWITH, MATCH_CONTAINS),
(MATCH_REGEXP, MATCH_REGEXP),
(MATCH_EXACT, MATCH_EXACT),
)
user_field = models.TextField()
match_action = models.CharField(max_length=50, choices=MATCHES)
value = models.TextField()
def __str__(self):
description = "%s, user.%s %s '%s'" % (self.name, self.user_field,
self.match_action, self.value)
2018-11-11 12:41:48 +00:00
if self.name:
description = "%s: %s" % (self.name, description)
return description
def passes(self, user: User) -> bool:
2018-11-11 12:41:48 +00:00
"""Check if user instance passes this role"""
if not hasattr(user, self.user_field):
raise ValueError("Field does not exist")
user_field_value = getattr(user, self.user_field, None)
LOGGER.debug("Checked '%s' %s with '%s'...",
user_field_value, self.match_action, self.value)
passes = False
if self.match_action == FieldMatcherRule.MATCH_STARTSWITH:
passes = user_field_value.startswith(self.value)
if self.match_action == FieldMatcherRule.MATCH_ENDSWITH:
passes = user_field_value.endswith(self.value)
if self.match_action == FieldMatcherRule.MATCH_CONTAINS:
passes = self.value in user_field_value
if self.match_action == FieldMatcherRule.MATCH_REGEXP:
pattern = re.compile(self.value)
passes = pattern.match(user_field_value)
if self.negate:
passes = not passes
LOGGER.debug("User got '%r'", passes)
return passes