<s> """<STR_LIT>""" <EOL> import datetime <EOL> import functools <EOL> import json <EOL> import logging <EOL> import time <EOL> import urllib <EOL> import urllib2 <EOL> import flask <EOL> from flask import abort , g , redirect , render_template , request , url_for <EOL> from flask . ext . login import ( <EOL> confirm_login , current_user , fresh_login_required , login_fresh , <EOL> login_required , login_user , logout_user ) <EOL> from . import app <EOL> from . import db <EOL> from . import login <EOL> from dpxdt . server import forms <EOL> from dpxdt . server import models <EOL> from dpxdt . server import operations <EOL> from dpxdt . server import utils <EOL> GOOGLE_OAUTH2_AUTH_URL = '<STR_LIT>' <EOL> GOOGLE_OAUTH2_TOKEN_URL = '<STR_LIT>' <EOL> GOOGLE_OAUTH2_USERINFO_URL = '<STR_LIT>' <EOL> GOOGLE_OAUTH2_SCOPES = '<STR_LIT>' <EOL> FETCH_TIMEOUT_SECONDS = <NUM_LIT> <EOL> @ login . user_loader <EOL> def load_user ( user_id ) : <EOL> user = operations . UserOps ( user_id ) . load ( ) <EOL> if user and user . is_authenticated ( ) : <EOL> logging . debug ( '<STR_LIT>' , user . get_id ( ) ) <EOL> return user <EOL> @ app . context_processor <EOL> def auth_context ( ) : <EOL> """<STR_LIT>""" <EOL> return dict ( current_user = current_user ) <EOL> @ app . route ( '<STR_LIT>' ) <EOL> def login_view ( ) : <EOL> next_url = request . args . get ( '<STR_LIT>' , default = '<STR_LIT:/>' , type = str ) <EOL> if app . config . get ( '<STR_LIT>' ) : <EOL> fake_id = '<STR_LIT>' <EOL> anonymous_superuser = models . User . query . get ( fake_id ) <EOL> if not anonymous_superuser : <EOL> anonymous_superuser = models . User ( <EOL> id = fake_id , <EOL> email_address = '<STR_LIT>' , <EOL> superuser = <NUM_LIT:1> ) <EOL> db . session . add ( anonymous_superuser ) <EOL> db . session . commit ( ) <EOL> login_user ( anonymous_superuser ) <EOL> confirm_login ( ) <EOL> return redirect ( next_url ) <EOL> params = dict ( <EOL> response_type = '<STR_LIT:code>' , <EOL> client_id = app . config [ '<STR_LIT>' ] , <EOL> redirect_uri = app . config [ '<STR_LIT>' ] , <EOL> scope = GOOGLE_OAUTH2_SCOPES , <EOL> state = urllib . quote ( next_url ) , <EOL> ) <EOL> target_url = '<STR_LIT>' % ( <EOL> GOOGLE_OAUTH2_AUTH_URL , urllib . urlencode ( params ) ) <EOL> logging . debug ( '<STR_LIT>' , target_url ) <EOL> return redirect ( target_url ) <EOL> @ app . route ( '<STR_LIT>' ) <EOL> @ login_required <EOL> def logout ( ) : <EOL> logout_user ( ) <EOL> return redirect ( url_for ( '<STR_LIT>' ) ) <EOL> @ app . route ( '<STR_LIT>' ) <EOL> def login_auth ( ) : <EOL> params = dict ( <EOL> code = request . args . get ( '<STR_LIT:code>' ) , <EOL> client_id = app . config [ '<STR_LIT>' ] , <EOL> client_secret = app . config [ '<STR_LIT>' ] , <EOL> redirect_uri = app . config [ '<STR_LIT>' ] , <EOL> grant_type = '<STR_LIT>' <EOL> ) <EOL> payload = urllib . urlencode ( params ) <EOL> logging . debug ( '<STR_LIT>' , <EOL> GOOGLE_OAUTH2_TOKEN_URL , payload ) <EOL> fetch_request = urllib2 . Request ( GOOGLE_OAUTH2_TOKEN_URL , payload ) <EOL> conn = urllib2 . urlopen ( fetch_request , timeout = FETCH_TIMEOUT_SECONDS ) <EOL> data = conn . read ( ) <EOL> result_dict = json . loads ( data ) <EOL> params = dict ( <EOL> access_token = result_dict [ '<STR_LIT>' ] <EOL> ) <EOL> payload = urllib . urlencode ( params ) <EOL> target_url = '<STR_LIT>' % ( GOOGLE_OAUTH2_USERINFO_URL , payload ) <EOL> logging . debug ( '<STR_LIT>' , target_url ) <EOL> fetch_request = urllib2 . Request ( target_url ) <EOL> conn = urllib2 . urlopen ( fetch_request , timeout = FETCH_TIMEOUT_SECONDS ) <EOL> data = conn . read ( ) <EOL> result_dict = json . loads ( data ) <EOL> logging . debug ( '<STR_LIT>' , result_dict ) <EOL> email_address = result_dict [ '<STR_LIT:email>' ] <EOL> if not result_dict [ '<STR_LIT>' ] : <EOL> abort ( flask . Response ( '<STR_LIT>' , <NUM_LIT> ) ) <EOL> user_id = '<STR_LIT>' % ( models . User . GOOGLE_OAUTH2 , result_dict [ '<STR_LIT:id>' ] ) <EOL> user = models . User . query . get ( user_id ) <EOL> if not user : <EOL> user = models . User ( id = user_id ) <EOL> if user . email_address != email_address : <EOL> user . email_address = email_address <EOL> user . last_seen = datetime . datetime . utcnow ( ) <EOL> db . session . add ( user ) <EOL> db . session . commit ( ) <EOL> login_user ( user ) <EOL> confirm_login ( ) <EOL> flask . get_flashed_messages ( ) <EOL> final_url = urllib . unquote ( request . args . get ( '<STR_LIT:state>' ) ) <EOL> logging . debug ( '<STR_LIT>' , final_url ) <EOL> return redirect ( final_url ) <EOL> @ app . route ( '<STR_LIT>' ) <EOL> @ login_required <EOL> def debug_login ( ) : <EOL> return render_template ( <EOL> '<STR_LIT>' , user = current_user ) <EOL> def superuser_required ( f ) : <EOL> """<STR_LIT>""" <EOL> @ functools . wraps ( f ) <EOL> @ login_required <EOL> def wrapped ( * args , ** kwargs ) : <EOL> if not ( current_user . is_authenticated ( ) and current_user . superuser ) : <EOL> abort ( <NUM_LIT> ) <EOL> return f ( * args , ** kwargs ) <EOL> return wrapped <EOL> def can_user_access_build ( param_name ) : <EOL> """<STR_LIT>""" <EOL> build_id = ( <EOL> request . args . get ( param_name , type = int ) or <EOL> request . form . get ( param_name , type = int ) ) <EOL> if not build_id : <EOL> logging . debug ( '<STR_LIT>' , param_name ) <EOL> abort ( <NUM_LIT> ) <EOL> ops = operations . UserOps ( current_user . get_id ( ) ) <EOL> build , user_is_owner = ops . owns_build ( build_id ) <EOL> if not build : <EOL> logging . debug ( '<STR_LIT>' , build_id ) <EOL> abort ( <NUM_LIT> ) <EOL> if current_user . is_authenticated ( ) and not user_is_owner : <EOL> ops . evict ( ) <EOL> claim_invitations ( current_user ) <EOL> build , user_is_owner = ops . owns_build ( build_id ) <EOL> if not user_is_owner : <EOL> if current_user . is_authenticated ( ) and current_user . superuser : <EOL> pass <EOL> elif request . method != '<STR_LIT:GET>' : <EOL> logging . debug ( '<STR_LIT>' ) <EOL> abort ( <NUM_LIT> ) <EOL> elif build . public : <EOL> pass <EOL> elif current_user . is_authenticated ( ) : <EOL> logging . debug ( '<STR_LIT>' ) <EOL> abort ( flask . Response ( '<STR_LIT>' , <NUM_LIT> ) ) <EOL> else : <EOL> logging . debug ( '<STR_LIT>' ) <EOL> abort ( login . unauthorized ( ) ) <EOL> elif not login_fresh ( ) : <EOL> logging . debug ( '<STR_LIT>' ) <EOL> abort ( login . needs_refresh ( ) ) <EOL> return build <EOL> def build_access_required ( function_or_param_name ) : <EOL> """<STR_LIT>""" <EOL> def get_wrapper ( param_name , f ) : <EOL> @ functools . wraps ( f ) <EOL> def wrapped ( * args , ** kwargs ) : <EOL> g . build = can_user_access_build ( param_name ) <EOL> if not utils . is_production ( ) : <EOL> time . sleep ( <NUM_LIT:0.5> ) <EOL> return f ( * args , ** kwargs ) <EOL> return wrapped <EOL> if isinstance ( function_or_param_name , basestring ) : <EOL> return lambda f : get_wrapper ( function_or_param_name , f ) <EOL> else : <EOL> return get_wrapper ( '<STR_LIT:id>' , function_or_param_name ) <EOL> def _get_api_key_ops ( ) : <EOL> """<STR_LIT>""" <EOL> auth_header = request . authorization <EOL> if not auth_header : <EOL> logging . debug ( '<STR_LIT>' ) <EOL> abort ( flask . Response ( <EOL> '<STR_LIT>' , <NUM_LIT> , <EOL> { '<STR_LIT>' : '<STR_LIT>' } ) ) <EOL> return operations . ApiKeyOps ( auth_header . username , auth_header . password ) <EOL> def current_api_key ( ) : <EOL> """<STR_LIT>""" <EOL> if app . config . get ( '<STR_LIT>' ) : <EOL> return models . ApiKey ( <EOL> id = '<STR_LIT>' , <EOL> secret = '<STR_LIT>' , <EOL> superuser = True ) <EOL> ops = _get_api_key_ops ( ) <EOL> api_key = ops . get ( ) <EOL> logging . debug ( '<STR_LIT>' , api_key . id ) <EOL> return api_key <EOL> def can_api_key_access_build ( param_name ) : <EOL> """<STR_LIT>""" <EOL> build_id = ( <EOL> request . args . get ( param_name , type = int ) or <EOL> request . form . get ( param_name , type = int ) ) <EOL> utils . jsonify_assert ( build_id , '<STR_LIT>' ) <EOL> if app . config . get ( '<STR_LIT>' ) : <EOL> api_key = models . ApiKey ( <EOL> id = '<STR_LIT>' , <EOL> secret = '<STR_LIT>' , <EOL> superuser = True ) <EOL> build = models . Build . query . get ( build_id ) <EOL> utils . jsonify_assert ( build is not None , '<STR_LIT>' , <NUM_LIT> ) <EOL> else : <EOL> ops = _get_api_key_ops ( ) <EOL> api_key , build = ops . can_access_build ( build_id ) <EOL> return api_key , build <EOL> def build_api_access_required ( f ) : <EOL> """<STR_LIT>""" <EOL> @ functools . wraps ( f ) <EOL> def wrapped ( * args , ** kwargs ) : <EOL> g . api_key , g . build = can_api_key_access_build ( '<STR_LIT>' ) <EOL> return f ( * args , ** kwargs ) <EOL> return wrapped <EOL> def superuser_api_key_required ( f ) : <EOL> """<STR_LIT>""" <EOL> @ functools . wraps ( f ) <EOL> def wrapped ( * args , ** kwargs ) : <EOL> api_key = current_api_key ( ) <EOL> g . api_key = api_key <EOL> utils . jsonify_assert ( <EOL> api_key . superuser , <EOL> '<STR_LIT>' % api_key . id , <EOL> <NUM_LIT> ) <EOL> return f ( * args , ** kwargs ) <EOL> return wrapped <EOL> @ app . route ( '<STR_LIT>' , methods = [ '<STR_LIT:GET>' , '<STR_LIT:POST>' ] ) <EOL> @ fresh_login_required <EOL> @ build_access_required ( '<STR_LIT>' ) <EOL> def manage_api_keys ( ) : <EOL> """<STR_LIT>""" <EOL> build = g . build <EOL> create_form = forms . CreateApiKeyForm ( ) <EOL> if create_form . validate_on_submit ( ) : <EOL> api_key = models . ApiKey ( ) <EOL> create_form . populate_obj ( api_key ) <EOL> api_key . id = utils . human_uuid ( ) <EOL> api_key . secret = utils . password_uuid ( ) <EOL> save_admin_log ( build , created_api_key = True , message = api_key . id ) <EOL> db . session . add ( api_key ) <EOL> db . session . commit ( ) <EOL> logging . info ( '<STR_LIT>' , <EOL> api_key . id , build . id ) <EOL> return redirect ( url_for ( '<STR_LIT>' , build_id = build . id ) ) <EOL> create_form . build_id . data = build . id <EOL> api_key_query = ( <EOL> models . ApiKey . query <EOL> . filter_by ( build_id = build . id ) <EOL> . order_by ( models . ApiKey . created . desc ( ) ) <EOL> . limit ( <NUM_LIT:1000> ) ) <EOL> revoke_form_list = [ ] <EOL> for api_key in api_key_query : <EOL> form = forms . RevokeApiKeyForm ( ) <EOL> form . id . data = api_key . id <EOL> form . build_id . data = build . id <EOL> form . revoke . data = True <EOL> revoke_form_list . append ( ( api_key , form ) ) <EOL> return render_template ( <EOL> '<STR_LIT>' , <EOL> build = build , <EOL> create_form = create_form , <EOL> revoke_form_list = revoke_form_list ) <EOL> @ app . route ( '<STR_LIT>' , methods = [ '<STR_LIT:POST>' ] ) <EOL> @ fresh_login_required <EOL> @ build_access_required ( '<STR_LIT>' ) <EOL> def revoke_api_key ( ) : <EOL> """<STR_LIT>""" <EOL> build = g . build <EOL> form = forms . RevokeApiKeyForm ( ) <EOL> if form . validate_on_submit ( ) : <EOL> api_key = models . ApiKey . query . get ( form . id . data ) <EOL> if api_key . build_id != build . id : <EOL> logging . debug ( '<STR_LIT>' , <EOL> api_key . id ) <EOL> abort ( <NUM_LIT> ) <EOL> api_key . active = False <EOL> save_admin_log ( build , revoked_api_key = True , message = api_key . id ) <EOL> db . session . add ( api_key ) <EOL> db . session . commit ( ) <EOL> ops = operations . ApiKeyOps ( api_key . id , api_key . secret ) <EOL> ops . evict ( ) <EOL> return redirect ( url_for ( '<STR_LIT>' , build_id = build . id ) ) <EOL> def claim_invitations ( user ) : <EOL> """<STR_LIT>""" <EOL> invitation_user_id = '<STR_LIT>' % ( <EOL> models . User . EMAIL_INVITATION , user . email_address ) <EOL> invitation_user = models . User . query . get ( invitation_user_id ) <EOL> if invitation_user : <EOL> invited_build_list = list ( invitation_user . builds ) <EOL> if not invited_build_list : <EOL> return <EOL> db . session . add ( user ) <EOL> logging . debug ( '<STR_LIT>' , <EOL> len ( invited_build_list ) , invitation_user_id , user ) <EOL> for build in invited_build_list : <EOL> build . owners . remove ( invitation_user ) <EOL> if not build . is_owned_by ( user . id ) : <EOL> build . owners . append ( user ) <EOL> logging . debug ( '<STR_LIT>' , build . id ) <EOL> save_admin_log ( build , invite_accepted = True ) <EOL> else : <EOL> logging . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' , user . id , build . id ) <EOL> db . session . add ( build ) <EOL> db . session . delete ( invitation_user ) <EOL> db . session . commit ( ) <EOL> db . session . add ( current_user ) <EOL> @ app . route ( '<STR_LIT>' , methods = [ '<STR_LIT:GET>' , '<STR_LIT:POST>' ] ) <EOL> @ fresh_login_required <EOL> @ build_access_required ( '<STR_LIT>' ) <EOL> def manage_admins ( ) : <EOL> """<STR_LIT>""" <EOL> build = g . build <EOL> db . session . add ( build ) <EOL> db . session . refresh ( build ) <EOL> add_form = forms . AddAdminForm ( ) <EOL> if add_form . validate_on_submit ( ) : <EOL> invitation_user_id = '<STR_LIT>' % ( <EOL> models . User . EMAIL_INVITATION , add_form . email_address . data ) <EOL> invitation_user = models . User . query . get ( invitation_user_id ) <EOL> if not invitation_user : <EOL> invitation_user = models . User ( <EOL> id = invitation_user_id , <EOL> email_address = add_form . email_address . data ) <EOL> db . session . add ( invitation_user ) <EOL> db . session . add ( build ) <EOL> db . session . add ( invitation_user ) <EOL> db . session . refresh ( build , lockmode = '<STR_LIT>' ) <EOL> build . owners . append ( invitation_user ) <EOL> save_admin_log ( build , invited_new_admin = True , <EOL> message = invitation_user . email_address ) <EOL> db . session . commit ( ) <EOL> logging . info ( '<STR_LIT>' , <EOL> invitation_user . id , build . id ) <EOL> return redirect ( url_for ( '<STR_LIT>' , build_id = build . id ) ) <EOL> add_form . build_id . data = build . id <EOL> revoke_form_list = [ ] <EOL> for user in build . owners : <EOL> form = forms . RemoveAdminForm ( ) <EOL> form . user_id . data = user . id <EOL> form . build_id . data = build . id <EOL> form . revoke . data = True <EOL> revoke_form_list . append ( ( user , form ) ) <EOL> return render_template ( <EOL> '<STR_LIT>' , <EOL> build = build , <EOL> add_form = add_form , <EOL> revoke_form_list = revoke_form_list ) <EOL> @ app . route ( '<STR_LIT>' , methods = [ '<STR_LIT:POST>' ] ) <EOL> @ fresh_login_required <EOL> @ build_access_required ( '<STR_LIT>' ) <EOL> def revoke_admin ( ) : <EOL> """<STR_LIT>""" <EOL> build = g . build <EOL> form = forms . RemoveAdminForm ( ) <EOL> if form . validate_on_submit ( ) : <EOL> user = models . User . query . get ( form . user_id . data ) <EOL> if not user : <EOL> logging . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' , form . user_id . data , build . id ) <EOL> abort ( <NUM_LIT> ) <EOL> if user == current_user : <EOL> logging . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' , user . id , build . id ) <EOL> abort ( <NUM_LIT> ) <EOL> db . session . add ( build ) <EOL> db . session . add ( user ) <EOL> db . session . refresh ( build , lockmode = '<STR_LIT>' ) <EOL> db . session . refresh ( user , lockmode = '<STR_LIT>' ) <EOL> user_is_owner = build . owners . filter_by ( id = user . id ) <EOL> if not user_is_owner : <EOL> logging . debug ( '<STR_LIT>' <EOL> '<STR_LIT>' , user . id , build . id ) <EOL> abort ( <NUM_LIT> ) <EOL> build . owners . remove ( user ) <EOL> save_admin_log ( build , revoked_admin = True , message = user . email_address ) <EOL> db . session . commit ( ) <EOL> operations . UserOps ( user . get_id ( ) ) . evict ( ) <EOL> return redirect ( url_for ( '<STR_LIT>' , build_id = build . id ) ) <EOL> def save_admin_log ( build , ** kwargs ) : <EOL> """<STR_LIT>""" <EOL> message = kwargs . pop ( '<STR_LIT:message>' , None ) <EOL> release = kwargs . pop ( '<STR_LIT>' , None ) <EOL> run = kwargs . pop ( '<STR_LIT>' , None ) <EOL> if not len ( kwargs ) == <NUM_LIT:1> : <EOL> raise TypeError ( '<STR_LIT>' ) <EOL> log_enum = kwargs . keys ( ) [ <NUM_LIT:0> ] <EOL> log_type = getattr ( models . AdminLog , log_enum . upper ( ) , None ) <EOL> if not log_type : <EOL> raise TypeError ( '<STR_LIT>' % log_enum ) <EOL> if current_user . is_anonymous ( ) : <EOL> user_id = None <EOL> else : <EOL> user_id = current_user . get_id ( ) <EOL> log = models . AdminLog ( <EOL> build_id = build . id , <EOL> log_type = log_type , <EOL> message = message , <EOL> user_id = user_id ) <EOL> if release : <EOL> log . release_id = release . id <EOL> if run : <EOL> log . run_id = run . id <EOL> log . release_id = run . release_id <EOL> db . session . add ( log ) <EOL> @ app . route ( '<STR_LIT>' ) <EOL> @ fresh_login_required <EOL> @ build_access_required ( '<STR_LIT>' ) <EOL> def view_admin_log ( ) : <EOL> """<STR_LIT>""" <EOL> build = g . build <EOL> log_list = ( <EOL> models . AdminLog . query <EOL> . filter_by ( build_id = build . id ) <EOL> . order_by ( models . AdminLog . created . desc ( ) ) <EOL> . all ( ) ) <EOL> return render_template ( <EOL> '<STR_LIT>' , <EOL> build = build , <EOL> log_list = log_list ) </s>
