Python group.Group类代码示例

def test_sa_pubkeys(session, users, http_client, base_url):
    user = users['[email protected]']

    # Add account
    create_role_user(session, user, '[email protected]', 'Hi', 'canjoin')

    u = User.get(session, name="[email protected]")
    g = Group.get(session, name="[email protected]")

    assert u is not None
    assert g is not None
    assert is_role_user(session, user=u)
    assert is_role_user(session, group=g)
    assert get_role_user(session, user=u).group.id == g.id
    assert get_role_user(session, group=g).user.id == u.id
    assert not is_role_user(session, user=user)
    assert not is_role_user(session, group=Group.get(session, name="team-sre"))

    assert not get_public_keys_of_user(session, user.id)

    with pytest.raises(HTTPError):
        # add it
        fe_url = url(base_url, '/users/{}/public-key/add'.format("[email protected]"))
        resp = yield http_client.fetch(fe_url, method="POST",
                body=urlencode({'public_key': SSH_KEY_1}),
                headers={'X-Grouper-User': "[email protected]"})

    # add it
    fe_url = url(base_url, '/users/{}/public-key/add'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="POST",
            body=urlencode({'public_key': SSH_KEY_1}),
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200

    # add bad key -- shouldn't add
    fe_url = url(base_url, '/users/{}/public-key/add'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="POST",
            body=urlencode({'public_key': SSH_KEY_BAD}),
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200

    sa = User.get(session, name="[email protected]")
    keys = get_public_keys_of_user(session, sa.id)
    assert len(keys) == 1
    assert keys[0].public_key == SSH_KEY_1

    with pytest.raises(HTTPError):
        # delete it
        fe_url = url(base_url, '/users/{}/public-key/{}/delete'.format("[email protected]", keys[0].id))
        resp = yield http_client.fetch(fe_url, method="POST", body='',
                headers={'X-Grouper-User': "[email protected]"})

    # delete it
    fe_url = url(base_url, '/users/{}/public-key/{}/delete'.format("[email protected]", keys[0].id))
    resp = yield http_client.fetch(fe_url, method="POST", body='',
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200

    sa = User.get(session, name="[email protected]")
    assert not get_public_keys_of_user(session, sa.id)

def test_sa_tokens(session, users, http_client, base_url):
    user = users['[email protected]']

    # Add account
    create_role_user(session, user, '[email protected]', 'Hi', 'canjoin')

    u = User.get(session, name="[email protected]")
    g = Group.get(session, name="[email protected]")

    assert u is not None
    assert g is not None
    assert is_role_user(session, user=u)
    assert is_role_user(session, group=g)
    assert get_role_user(session, user=u).group.id == g.id
    assert get_role_user(session, group=g).user.id == u.id
    assert not is_role_user(session, user=user)
    assert not is_role_user(session, group=Group.get(session, name="team-sre"))

    with pytest.raises(HTTPError):
        # Add token
        fe_url = url(base_url, '/users/{}/tokens/add'.format("[email protected]"))
        resp = yield http_client.fetch(fe_url, method="POST",
                body=urlencode({'name': 'myDHDToken'}),
                headers={'X-Grouper-User': "[email protected]"})

    # Add token
    fe_url = url(base_url, '/users/{}/tokens/add'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="POST",
            body=urlencode({'name': 'myDHDToken'}),
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200

    # Verify add
    fe_url = url(base_url, '/users/{}'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="GET",
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200
    assert "Added token: myDHDToken" in resp.body

    with pytest.raises(HTTPError):
        # Disable token
        fe_url = url(base_url, '/users/{}/tokens/1/disable'.format("[email protected]"))
        resp = yield http_client.fetch(fe_url, method="POST",
                body="",
                headers={'X-Grouper-User': "[email protected]"})

    # Disable token
    fe_url = url(base_url, '/users/{}/tokens/1/disable'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="POST",
            body="",
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200

    # Verify disable
    fe_url = url(base_url, '/users/{}'.format("[email protected]"))
    resp = yield http_client.fetch(fe_url, method="GET",
            headers={'X-Grouper-User': user.username})
    assert resp.code == 200
    assert "Disabled token: myDHDToken" in resp.body

 def run(self, session, **kwargs):
     if kwargs.get("group"):
         Group.get_or_create(session, groupname=groupname)
         session.commit()
     elif kwargs.get("key") == "valuewith=":
         User.get_or_create(session, username=other_username)
         session.commit()
     else:
         User.get_or_create(session, username=username)
         session.commit()

def test_group_name_checks(session, tmpdir, users, groups):  # noqa: F811
    username = "[email protected]"
    groupname = "team-sre"

    # check user/group name
    call_main(session, tmpdir, "group", "add_member", "--member", "invalid group name", username)
    assert (u"User", username) not in Group.get(session, name=groupname).my_members()

    bad_username = "not_a_valid_username"
    call_main(session, tmpdir, "group", "add_member", "--member", groupname, bad_username)
    assert (u"User", bad_username) not in Group.get(session, name=groupname).my_members()

def test_group_bulk_add_remove(session, tmpdir, users, groups):  # noqa: F811
    groupname = "team-sre"

    # bulk add
    usernames = {"[email protected]", "[email protected]", "[email protected]"}
    call_main(session, tmpdir, "group", "add_member", "--member", groupname, *usernames)
    members = {u for _, u in Group.get(session, name=groupname).my_members()}
    assert usernames.issubset(members)

    # bulk remove
    call_main(session, tmpdir, "group", "remove_member", groupname, *usernames)
    members = {u for _, u in Group.get(session, name=groupname).my_members()}
    assert not members.intersection(usernames)

def test_group_disable_group_owner(get_plugin_proxy, session, tmpdir, users, groups):  # noqa: F811
    get_plugin_proxy.return_value = PluginProxy([GroupOwnershipPolicyPlugin()])

    username = "[email protected]"
    groupname = "team-sre"

    # add
    call_main(session, tmpdir, "group", "add_member", "--owner", groupname, username)
    assert (u"User", username) in Group.get(session, name=groupname).my_members()

    # disable (fails)
    call_main(session, tmpdir, "user", "disable", username)
    assert (u"User", username) in Group.get(session, name=groupname).my_members()

def test_group_name_checks(make_session, session, users, groups):
    make_session.return_value = session

    username = '[email protected]'
    groupname = 'team-sre'

    # check user/group name
    call_main('group', 'add_member', '--member', 'invalid group name', username)
    assert (u'User', username) not in Group.get(session, name=groupname).my_members()

    bad_username = 'not_a_valid_username'
    call_main('group', 'add_member', '--member', groupname, bad_username)
    assert (u'User', bad_username) not in Group.get(session, name=groupname).my_members()

def test_group_add_remove_member(session, tmpdir, users, groups):  # noqa: F811
    username = "[email protected]"
    groupname = "team-sre"

    # add
    assert (u"User", username) not in groups[groupname].my_members()
    call_main(session, tmpdir, "group", "add_member", "--member", groupname, username)
    all_members = Group.get(session, name=groupname).my_members()
    assert (u"User", username) in all_members
    _, _, _, role, _, _ = all_members[(u"User", username)]
    assert GROUP_EDGE_ROLES[role] == "member"

    # remove
    call_main(session, tmpdir, "group", "remove_member", groupname, username)
    assert (u"User", username) not in Group.get(session, name=groupname).my_members()

def test_group_bulk_add_remove(make_session, session, users, groups):
    make_session.return_value = session

    groupname = 'team-sre'

    # bulk add
    usernames = {'[email protected]', '[email protected]', '[email protected]'}
    call_main('group', 'add_member', '--member', groupname, *usernames)
    members = {u for _, u in Group.get(session, name=groupname).my_members().keys()}
    assert usernames.issubset(members)

    # bulk remove
    call_main('group', 'remove_member', groupname, *usernames)
    members = {u for _, u in Group.get(session, name=groupname).my_members().keys()}
    assert not members.intersection(usernames)

    def get(self, *args, **kwargs):
        # type: (*Any, **Any) -> None
        group_id = kwargs.get("group_id")  # type: Optional[int]
        name = kwargs.get("name")  # type: Optional[str]

        group = Group.get(self.session, group_id, name)
        if not group:
            return self.notfound()

        # Only members can request permissions
        if not self.current_user.is_member(group.my_members()):
            return self.forbidden()

        args_by_perm = get_grantable_permissions(
            self.session, settings().restricted_ownership_permissions
        )
        dropdown_form, text_form = GroupPermissionRequest._get_forms(args_by_perm, None)

        self.render(
            "group-permission-request.html",
            dropdown_form=dropdown_form,
            text_form=text_form,
            group=group,
            args_by_perm_json=json.dumps(args_by_perm),
            dropdown_help=settings().permission_request_dropdown_help,
            text_help=settings().permission_request_text_help,
        )

def get_auditors_group(settings, session):
    # type: (Settings, Session) -> Group
    """Retrieve the group for auditors

    Arg(s):
        settings (settings): settings, to get the `auditors_group` name
        session (session): database session

    Return:
        Group object for the group for Grouper auditors, whose name is
        specified with `auditors_group` settings.

    Raise:
        Raise NoSuchGroup exception if either the name for the
        auditors group is not configured, or the group does not exist
        in the database. Raise GroupDoesNotHaveAuditPermission if the group
        does not actually have the PERMISSION_AUDITOR permission.
    """
    # TODO: switch to exc.NoSuchGroup to remove one source dependency
    # on graph.py
    group_name = get_auditors_group_name(settings)
    if not group_name:
        raise NoSuchGroup("Please ask your admin to configure the `auditors_group` settings")
    group = Group.get(session, name=group_name)
    if not group:
        raise NoSuchGroup("Please ask your admin to configure the default group for auditors")
    if not any([p.name == PERMISSION_AUDITOR for p in group.my_permissions()]):
        raise GroupDoesNotHaveAuditPermission()
    return group

def get_role_user(session, user=None, group=None):
    # type: (Session, User, Group) -> RoleUser
    """
    Takes in a User or a Group and returns a dictionary that contains
    all of the service account components for the service account that
    the user/group is part of.

    Args:
        session: the database session
        user: a User object to check
        group: a Group object to check

    Throws:
        RoleUserNotFound: if the user or group is not part of a service account

    Returns:
        a dictionary with all components of the service account of the
            user or group passed in
    """
    if not is_role_user(session, user, group):
        raise RoleUserNotFound()

    if user:
        name = user.name
    else:
        assert group is not None
        name = group.name
    return RoleUser(User.get(session, name=name), Group.get(session, name=name))

    def get(self, group_id=None, name=None):
        group = Group.get(self.session, group_id, name)
        if not group:
            return self.notfound()

        status = self.get_argument("status", None)
        offset = int(self.get_argument("offset", 0))
        limit = int(self.get_argument("limit", 100))
        if limit > 9000:
            limit = 9000

        requests = get_requests_by_group(self.session, group, status=status).order_by(
            Request.requested_at.desc()
        )
        members = group.my_members()

        total = requests.count()
        requests = requests.offset(offset).limit(limit)

        current_user_role = {
            'is_owner': user_role_index(self.current_user, members) in OWNER_ROLE_INDICES,
            'is_approver': user_role_index(self.current_user, members) in APPROVER_ROLE_INDICES,
            'is_manager': user_role(self.current_user, members) == "manager",
            'role': user_role(self.current_user, members),
             }

        self.render(
            "group-requests.html", group=group, requests=requests,
            members=members, status=status, statuses=REQUEST_STATUS_CHOICES,
            offset=offset, limit=limit, total=total, current_user_role=current_user_role,
        )

def test_permission_exclude_inactive(session, standard_graph):
    """Ensure disabled groups are excluded from permission data."""
    group = Group.get(session, name="team-sre")
    permission = Permission.get(session, name="ssh")
    assert "team-sre" in [g[0] for g in get_groups_by_permission(session, permission)]
    group.disable()
    assert "team-sre" not in [g[0] for g in get_groups_by_permission(session, permission)]

def test_group_disable_group_owner(user_make_session, group_make_session, get_plugin_proxy, session,
                                   users, groups):
    group_make_session.return_value = session
    user_make_session.return_value = session
    get_plugin_proxy.return_value = PluginProxy([GroupOwnershipPolicyPlugin()])

    username = '[email protected]'
    groupname = 'team-sre'

    # add
    call_main('group', 'add_member', '--owner', groupname, username)
    assert (u'User', username) in Group.get(session, name=groupname).my_members()

    # disable (fails)
    call_main('user', 'disable', username)
    assert (u'User', username) in Group.get(session, name=groupname).my_members()