Commit Graph

52 Commits

Author SHA1 Message Date
Sybren A. Stüvel f17453ba10 Added 'operations hash_auth_tokens' CLI command. 2017-10-05 13:04:44 +02:00
Sybren A. Stüvel c57aefd48b Hash authentication tokens before storing in the database. 2017-10-05 12:57:16 +02:00
Sybren A. Stüvel 230c15d51c Fix snag that happens when PUTting a user document without roles key. 2017-09-14 11:23:35 +02:00
Dalai Felinto 216b9278af A user should not be able to vote on own content
This should be hidden in the UI as well, but the backend should support this too.
We also want to set initial rating of 1 for contents that need it.

This commit includes a new unittest for this case.

Reviewers: sybren

Differential Revision: https://developer.blender.org/D2825
2017-09-06 13:51:32 +02:00
Sybren A. Stüvel a6f56a4811 OAuth test: checking email address too 2017-08-25 12:53:21 +02:00
Francesco Siddi 41a82c44c5 Tests for providers callbacks
Also added SERVER_NAME in config_testing and pre-populated the  keys of OAUTH_CREDENTIALS, since the implementation of providers is part of the application.
2017-08-25 10:55:35 +02:00
Francesco Siddi cecf81a07d Initial tests for OAuthSignIn 2017-08-25 10:55:35 +02:00
Sybren A. Stüvel b9ae4396e5 Orgs: show "My Organizations" in the user's menu
This is shown only when the user is member of or administrator for one or
more organizations, otherwise it's hidden.
2017-08-24 14:28:18 +02:00
Sybren A. Stüvel be12bd7d99 Orgs: allow users to leave an organization 2017-08-24 14:28:18 +02:00
Sybren A. Stüvel 1e1bd83baf Orgs: refresh all members' roles after org changed roles 2017-08-24 14:28:18 +02:00
Sybren A. Stüvel f1edb901d1 Orgs: allow setting org admin via web interface / PATCH request 2017-08-24 14:28:18 +02:00
Sybren A. Stüvel 1bd6e07fe2 Orgs: Allow adding individual known users by user ID.
This is used for the selection by user search.
2017-08-24 14:28:17 +02:00
Sybren A. Stüvel 72404d0fd9 Handle registration of previously unknown organization members.
When a new user is created, two things happen:
  - before inserting into MongoDB, the organizational roles are given
  - after inserting, the organizations are updated to move the user from
    `unknown_members` to `members`.
2017-08-24 14:26:19 +02:00
Sybren A. Stüvel b53d485960 Added access control to organizations Eve endpoints 2017-08-24 14:26:19 +02:00
Sybren A. Stüvel cf51d1a280 Added utility function current_user() that acts like flask_login.current_user
This actually returns an AnonymousUser object, instead of None, when the
user is not logged in.

For compatibility with existing code, this function doesn't set
g.current_user to that AnonymousUser instance. We may decide to do this
later.
2017-08-24 14:26:19 +02:00
Sybren A. Stüvel efc1890871 Added PATCH support for organizations
With a PATCH request you can now:
  - assign users,
  - remove a user,
  - edit the name, description, and website fields.

Only the organization admin user can do this.
2017-08-24 14:26:19 +02:00
Sybren A. Stüvel 93d534fe94 Added Organization Manager.
This is a Flamenco/Attract-style Manager object that's instantiated by
the PillarApplication. It can create Organizations and assign/remove
users.

Also I updated the Organization schema to reflect the currently desired
design.

NOTA BENE: this does not include any security/authorisation checks on Eve's
organizations collection.
2017-08-24 14:25:52 +02:00
Sybren A. Stüvel 575a7ed1a7 Introduced role-based capability system.
It's still rather limited and hard-coded, but it works.
2017-08-18 14:47:42 +02:00
Sybren A. Stüvel 566a23d3b6 Unified user representation for web and API calls
Both approaches now use a pillar.auth.UserClass instance. g.current_user
is now always set to that instance, even for web entry points.

This UserClass instance can still be keyed like the old dict, but this is
for temporary compatibility and shouldn't be relied on in new or touched
code.
2017-08-18 13:19:34 +02:00
Sybren A. Stüvel bd13d89817 Added permission check to DELETE of nodes. 2017-07-13 17:29:46 +02:00
Sybren A. Stüvel 2ad8c5186c Storage backends: added exists() method
This method returns whether the file exists on the backend.
2017-06-06 15:33:05 +02:00
Francesco Siddi a7d3ba24b4 Refactor cli scripts in submodules 2017-05-24 19:41:35 +02:00
Sybren A. Stüvel 5e721c61b9 Added function to easily remove someone from a group. 2017-05-24 10:56:53 +02:00
Sybren A. Stüvel 59a95450e5 Updated Eve, Flask, and Werkzeug. Adjusted code to make Pillar work again.
Eve     : 0.6.3   → 0.7.3
Flask   : 0.10.1  → 0.12.2
Werkzeug: 0.11.10 → 0.11.15

Also updated some secondary requirements.
2017-05-18 15:46:02 +02:00
Sybren A. Stüvel ad9a981cda Added p.a.users.add_user_to_group() function 2017-05-12 13:55:55 +02:00
Sybren A. Stüvel c854ccbb4b Generic PATCH handler class.
A class-based approach is easier to extend than the function-based approach
used in the nodes. That one is still there, though -- might look at it
at a later time. This handler is primarily for Flamenco.
2017-05-09 14:08:35 +02:00
Sybren A. Stüvel fdaf4af31a Modernised some unit tests 2017-05-05 14:40:37 +02:00
Sybren A. Stüvel 69d7c5c5ce Allow service accounts to be email-less
This removes the ability of updating service accounts through the CLI
(something we never used anyway), now that service accounts cannot be
uniquely identified by their email address.
2017-05-05 14:34:18 +02:00
Sybren A. Stüvel 1a54b723aa Reworked subscription/demo role management from web to API level.
In the old situation, users had to be able to change their own roles. This
is inherently insecure.
2017-05-04 17:49:18 +02:00
Sybren A. Stüvel d0557445cd Fix privilege escalation leak
A PUT request on /api/user/{user-id} by the user themselves would allow
too much, and would allow self-granting of roles (including admin),
group membership (so join any arbitrary project) and pretend to be
service accounts.
2017-05-04 12:48:30 +02:00
Sybren A. Stüvel bd3f8d597a Allow upload of videos > 1080p
Videos that are larger than 1920x1080 pixels are scaled down so that they
fit that size. Care is taken to keep the width a multiple of 16 pixels and
the height a multiple of 8.
2017-03-31 14:52:58 +02:00
Sybren A. Stüvel b36dc63335 Added simple mocking test for GCS 2017-03-22 16:43:17 +01:00
Sybren A. Stüvel 563bb2c244 Added unittest for Bucket.copy_to_bucket() 2017-03-22 16:14:06 +01:00
Sybren A. Stüvel 6b526f6b53 Fixed bug in local file storage URL generation. 2017-03-22 16:05:38 +01:00
Sybren A. Stüvel 2e41c074b5 Python 3.6 compatibility: bytes vs strings stuff
These changes mostly revolve around the change in ObjectId constructor
when running on Python 3.6. Where on 2.7 the constructor would accept
12- and 24-byte strings, now only 12-byte bytes and 24-character strings
are accepted. Good thing, but required some changes in our code.

Other changes include hashing of strings, which isn't supported, so they
are converted to bytes first, and sometimes converted back afterwards.
2017-03-22 15:49:51 +01:00
Sybren A. Stüvel bced6cae68 Ran 2to3 on unittests, same sort of manual fixups as before 2017-03-22 15:49:51 +01:00
Sybren A. Stüvel ab375b2126 Moved node_setattr() from Attract to Pillar 2016-11-09 12:50:30 +01:00
Sybren A. Stüvel fe4d70c0d1 CLI upgrade_attachment_schema: also remove attachments form_schema
Previously they would have {'attachments': {'visible': False}}, but this
is no longer needed.
2016-11-01 16:47:55 +01:00
Sybren A. Stüvel a38e053c1a Added CLI command to create blogs. 2016-11-01 16:47:55 +01:00
Sybren A. Stüvel 0929a80f2b New data structure for attachments. 2016-11-01 16:47:55 +01:00
Sybren A. Stüvel e1678537c0 Editing comments via PATCH on pillar-web, and some other comment fixes 2016-10-20 16:47:04 +02:00
Sybren A. Stüvel e71e6a7b32 API for editing comments via PATCH 2016-10-20 16:22:11 +02:00
Sybren A. Stüvel 3afeeaccd0 Removed permission keys from node type definitions.
This prevents replace_pillar_node_type_schemas() from overwriting existing
permissions.
2016-10-20 13:05:43 +02:00
Sybren A. Stüvel eea934a86a Added username to public user fields 2016-10-19 16:57:17 +02:00
Sybren A. Stüvel 96c9e12f7f doc_diff() optionally no longer reports differences between falsey values.
If falsey_is_equal=True, all Falsey values compare as equal, i.e. this
function won't report differences between DoesNotExist, False, '', and 0.
2016-10-12 17:09:48 +02:00
Sybren A. Stüvel 7c310e12ef Added util function to compute the difference between two dicts. 2016-10-12 16:01:30 +02:00
Sybren A. Stüvel 407aefb9ad Added CLI command for moving top-level nodes between projects.
Also introduces a slightly nicer way to get the database interface, and
an object-oriented way to allow dependency injection.
2016-09-27 12:57:57 +02:00
Sybren A. Stüvel 7968c6ca37 Added node_type_utils to assign permissions to certain node types.
This separates "mechanism" from "policy".
2016-09-23 17:13:26 +02:00
Sybren A. Stüvel 68666f0650 Updated unittest code so that we can create 100% valid projects.
This means also creating a user and groups so that the references are
valid.
2016-09-08 12:03:17 +02:00
Sybren A. Stüvel eb7b875122 Copying files to other backend now works 2016-08-26 15:52:02 +02:00