bvandeusenandClaude Opus 5.5
2995cfdd68
#5427 "A password reset doesn't end the sessions already signed in with the old password": users.sessions_since (migration 0038) is set on reset; refresh_session_user ends a session whose login_at is earlier. An admin resetting their own password carries on signed in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
424 lines
19 KiB
Python
424 lines
19 KiB
Python
"""Settings › Users (#5336): who has an account, and an admin's changes to one.
|
||
|
||
A local account's role, name and password are set here. An LDAP or single
|
||
sign-on account's role comes from its provider's group mapping at every
|
||
sign-in, so it is shown, not edited. Nobody can disable, demote or delete
|
||
their own account, and the last active admin cannot be demoted or disabled,
|
||
so Steward always keeps someone who can get back in. Every change is audited.
|
||
"""
|
||
from __future__ import annotations
|
||
|
||
import time
|
||
from datetime import datetime, timezone
|
||
|
||
import bcrypt
|
||
from quart import Blueprint, abort, current_app, redirect, render_template, request, session
|
||
from sqlalchemy import func, or_, select
|
||
from sqlalchemy.exc import IntegrityError
|
||
|
||
from steward.auth.middleware import require_role
|
||
from steward.core import invites, mail
|
||
from steward.core.audit import audit_request
|
||
from steward.core.settings import get_all_settings
|
||
from steward.models.alerts import AlertRule, MaintenanceWindow
|
||
from steward.models.ansible import AnsibleRun
|
||
from steward.models.api_tokens import ApiToken
|
||
from steward.models.audit import AuditEvent
|
||
from steward.models.invites import UserInvite
|
||
from steward.models.users import User, UserRole
|
||
|
||
users_bp = Blueprint("users", __name__, url_prefix="/settings/users")
|
||
|
||
SOURCES = {"local": "Steward password", "ldap": "LDAP", "oidc": "Single sign-on"}
|
||
MIN_PASSWORD = 8
|
||
|
||
|
||
def refusal(change: str, target: User, actor_id: str | None, active_admins: int) -> str | None:
|
||
"""Why `change` ("demote", "disable" or "delete") may not be made to
|
||
`target` by the signed-in admin, or None when it may."""
|
||
if target.id == actor_id:
|
||
return {"demote": "You can't lower your own role. Another admin can.",
|
||
"disable": "You can't disable your own account.",
|
||
"delete": "You can't delete your own account."}[change]
|
||
if target.role == UserRole.admin and target.is_active and active_admins <= 1:
|
||
return f"{target.username} is the only active admin. Make someone else an admin first."
|
||
return None
|
||
|
||
|
||
def password_problem(password: str, confirm: str) -> str | None:
|
||
if len(password) < MIN_PASSWORD:
|
||
return f"A password needs at least {MIN_PASSWORD} characters."
|
||
if password != confirm:
|
||
return "The two passwords don't match."
|
||
return None
|
||
|
||
|
||
def _hash(password: str) -> str:
|
||
return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
|
||
|
||
|
||
async def _active_admins(db) -> int:
|
||
return (await db.execute(select(func.count()).select_from(User).where(
|
||
User.role == UserRole.admin, User.is_active.is_(True)))).scalar_one()
|
||
|
||
|
||
async def _last_sign_ins(db) -> dict[str, datetime]:
|
||
"""Each user's newest sign-in, from the audit log (kept as long as it is)."""
|
||
rows = await db.execute(select(AuditEvent.user_id, func.max(AuditEvent.timestamp))
|
||
.where(AuditEvent.action == "auth.login", AuditEvent.user_id.isnot(None))
|
||
.group_by(AuditEvent.user_id))
|
||
return dict(rows.all())
|
||
|
||
|
||
async def _token_counts(db) -> dict[str, int]:
|
||
"""Each user's AI access tokens that still work."""
|
||
now = datetime.now(timezone.utc)
|
||
rows = await db.execute(select(ApiToken.user_id, func.count()).where(
|
||
ApiToken.revoked_at.is_(None),
|
||
or_(ApiToken.expires_at.is_(None), ApiToken.expires_at > now)).group_by(ApiToken.user_id))
|
||
return dict(rows.all())
|
||
|
||
|
||
async def held_by(db, user_id: str) -> list[str]:
|
||
"""What keeps an account from being deleted: records that name who made
|
||
them and must keep naming them, in words ("3 alert rules")."""
|
||
counts = [
|
||
(await db.execute(select(func.count()).where(AlertRule.created_by == user_id))).scalar_one(),
|
||
(await db.execute(select(func.count()).where(MaintenanceWindow.created_by == user_id))).scalar_one(),
|
||
(await db.execute(select(func.count()).where(AnsibleRun.triggered_by == user_id))).scalar_one(),
|
||
]
|
||
words = (("alert rule", "alert rules"), ("maintenance window", "maintenance windows"),
|
||
("playbook run", "playbook runs"))
|
||
return [f"{n} {one if n == 1 else many}" for n, (one, many) in zip(counts, words) if n]
|
||
|
||
|
||
async def _target(db, user_id: str) -> User:
|
||
user = await db.get(User, user_id)
|
||
if user is None:
|
||
abort(404)
|
||
return user
|
||
|
||
|
||
@users_bp.get("/")
|
||
@require_role(UserRole.admin)
|
||
async def users_list():
|
||
async with current_app.db_sessionmaker() as db:
|
||
users = (await db.execute(select(User))).scalars().all()
|
||
last = await _last_sign_ins(db)
|
||
tokens = await _token_counts(db)
|
||
settings = await get_all_settings(db)
|
||
pending = await invites.open_invites(db)
|
||
users = sorted(users, key=lambda u: (not u.is_active, u.username.lower()))
|
||
names = {u.id: u.username for u in users}
|
||
gets = {u.id: [label for kind, label in (("alerts", "alerts"), ("report", "report"))
|
||
if u.is_active and mail.wants(u, kind, settings)] for u in users}
|
||
return await render_template(
|
||
"settings/users.html", users=users, last=last, tokens=tokens, sources=SOURCES,
|
||
gets=gets, reachable={u.id for u in users if mail.is_real_address(u.email)},
|
||
admins=sum(1 for u in users if u.role == UserRole.admin and u.is_active),
|
||
disabled=sum(1 for u in users if not u.is_active),
|
||
invites=[(i, invites.state(i), names.get(i.invited_by, "—")) for i in pending],
|
||
done=_LIST_DONE.get(request.args.get("done", "")))
|
||
|
||
|
||
_LIST_DONE = {"invited": "Invite sent.", "resent": "Invite sent again; the earlier link no longer works.",
|
||
"revoked": "Invite withdrawn; its link no longer works."}
|
||
|
||
|
||
async def _new_page(error: str | None = None, form=None, status: int = 200):
|
||
return await render_template("settings/user_new.html", error=error, form=form or {},
|
||
roles=list(UserRole), min_password=MIN_PASSWORD), status
|
||
|
||
|
||
@users_bp.get("/new")
|
||
@require_role(UserRole.admin)
|
||
async def user_new():
|
||
return await _new_page()
|
||
|
||
|
||
@users_bp.post("/new")
|
||
@require_role(UserRole.admin)
|
||
async def user_create():
|
||
form = await request.form
|
||
username = (form.get("username") or "").strip()
|
||
email = (form.get("email") or "").strip()
|
||
try:
|
||
role = UserRole(form.get("role") or "viewer")
|
||
except ValueError:
|
||
return await _new_page("Pick a role.", form, 400)
|
||
if not username or not email:
|
||
return await _new_page("A username and an email are both needed.", form, 400)
|
||
if len(username) > 64 or len(email) > 255:
|
||
return await _new_page("That username or email is too long.", form, 400)
|
||
problem = password_problem(form.get("password") or "", form.get("confirm") or "")
|
||
if problem:
|
||
return await _new_page(problem, form, 400)
|
||
user = User(username=username, email=email, role=role, auth_source="local",
|
||
password_hash=_hash(form.get("password")))
|
||
try:
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
db.add(user)
|
||
except IntegrityError:
|
||
return await _new_page(f"An account already uses the username {username} or that email.", form, 400)
|
||
await audit_request("user.created", "user", user.id, {"username": username, "role": role.value})
|
||
return redirect(f"/settings/users/{user.id}?done=created")
|
||
|
||
|
||
# ── Invites (milestone 496) ──────────────────────────────────────────────────
|
||
|
||
async def _invite_form(error: str | None = None, form=None, status: int = 200):
|
||
return await render_template("settings/user_invite.html", error=error, form=form or {},
|
||
roles=list(UserRole), days=invites.DAYS,
|
||
default_days=invites.DEFAULT_DAYS,
|
||
mail_ready=bool(current_app.config.get("SMTP", {}).get("host"))), status
|
||
|
||
|
||
async def _deliver(invite: UserInvite, key: str) -> str | None:
|
||
"""Email the invite's link to its address, from the signed-in admin. None
|
||
when it was sent; otherwise why not, and the caller shows the link."""
|
||
from steward.core.formatting import zone
|
||
from steward.core.settings import public_base_url
|
||
cfg = current_app.config.get("SMTP", {})
|
||
if not cfg.get("host"):
|
||
return "No mail server is set (Settings › Notifications), so nothing was sent."
|
||
url = invites.link(public_base_url(request), key)
|
||
subject, text, html = mail.invite_email(session.get("username", "An admin"), invite.role.value,
|
||
invite.expires_at, url, zone(session.get("tz")))
|
||
try:
|
||
await mail.send(cfg, [mail.message(cfg, invite.email, subject, text, html)])
|
||
except Exception as exc:
|
||
current_app.logger.warning("Invite email to %s failed: %s", invite.email, exc)
|
||
return f"Sending to {invite.email} failed ({exc})."
|
||
return None
|
||
|
||
|
||
async def _link_page(invite: UserInvite, key: str, why: str):
|
||
"""The link shown once, to pass on by hand, when mail didn't take it."""
|
||
from steward.core.settings import public_base_url
|
||
return await render_template("settings/user_invite_link.html", invite=invite, why=why,
|
||
url=invites.link(public_base_url(request), key))
|
||
|
||
|
||
@users_bp.get("/invite")
|
||
@require_role(UserRole.admin)
|
||
async def user_invite():
|
||
return await _invite_form()
|
||
|
||
|
||
@users_bp.post("/invite")
|
||
@require_role(UserRole.admin)
|
||
async def user_invite_send():
|
||
form = await request.form
|
||
email = (form.get("email") or "").strip()
|
||
try:
|
||
role = UserRole(form.get("role") or "viewer")
|
||
days = int(form.get("days") or invites.DEFAULT_DAYS)
|
||
except ValueError:
|
||
return await _invite_form("Pick a role and how long the link works.", form, 400)
|
||
if days not in invites.DAYS:
|
||
return await _invite_form("Pick how long the link works.", form, 400)
|
||
if not mail.is_real_address(email) or len(email) > 255:
|
||
return await _invite_form("Enter an email address mail can reach.", form, 400)
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
holder = (await db.execute(select(User.username).where(User.email == email))).scalar()
|
||
if holder is None:
|
||
invite, key = await invites.create(db, email, role, days, session.get("user_id"))
|
||
if holder is not None:
|
||
return await _invite_form(f"{holder} already has an account with that address.", form, 400)
|
||
await audit_request("user.invited", "invite", str(invite.id),
|
||
{"name": email, "role": role.value, "days": days})
|
||
why = await _deliver(invite, key)
|
||
if why:
|
||
return await _link_page(invite, key, why)
|
||
return redirect("/settings/users/?done=invited")
|
||
|
||
|
||
async def _open_invite(db, invite_id: int) -> UserInvite:
|
||
invite = await db.get(UserInvite, invite_id)
|
||
if invite is None or invites.state(invite) in ("used", "revoked"):
|
||
abort(404)
|
||
return invite
|
||
|
||
|
||
@users_bp.post("/invites/<int:invite_id>/resend")
|
||
@require_role(UserRole.admin)
|
||
async def user_invite_resend(invite_id: int):
|
||
"""A new link with a new expiry; the old link stops working."""
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
invite = await _open_invite(db, invite_id)
|
||
key = invites.renew(invite)
|
||
await audit_request("user.invite_resent", "invite", str(invite.id), {"name": invite.email})
|
||
why = await _deliver(invite, key)
|
||
if why:
|
||
return await _link_page(invite, key, why)
|
||
return redirect("/settings/users/?done=resent")
|
||
|
||
|
||
@users_bp.post("/invites/<int:invite_id>/revoke")
|
||
@require_role(UserRole.admin)
|
||
async def user_invite_revoke(invite_id: int):
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
invite = await _open_invite(db, invite_id)
|
||
invite.revoked_at = datetime.now(timezone.utc)
|
||
await audit_request("user.invite_revoked", "invite", str(invite.id), {"name": invite.email})
|
||
return redirect("/settings/users/?done=revoked")
|
||
|
||
|
||
_DONE = {"created": "Account added.", "saved": "Saved.", "role": "Role changed.",
|
||
"password": "Password set. Anywhere they were signed in, they are signed out.",
|
||
"disabled": "Account disabled. They are signed out at their next click.",
|
||
"enabled": "Account enabled."}
|
||
|
||
|
||
async def _user_page(user_id: str, error: str | None = None, status: int = 200):
|
||
async with current_app.db_sessionmaker() as db:
|
||
user = await _target(db, user_id)
|
||
admins = await _active_admins(db)
|
||
last = (await _last_sign_ins(db)).get(user.id)
|
||
tokens = (await _token_counts(db)).get(user.id, 0)
|
||
holds = await held_by(db, user.id)
|
||
defaults = mail.role_defaults(user, await get_all_settings(db))
|
||
me = session.get("user_id")
|
||
return await render_template(
|
||
"settings/user.html", user=user, last_sign_in=last, tokens=tokens, holds=holds,
|
||
defaults=defaults, reachable=mail.is_real_address(user.email),
|
||
source=SOURCES.get(user.auth_source, user.auth_source), roles=list(UserRole),
|
||
min_password=MIN_PASSWORD, error=error, done=_DONE.get(request.args.get("done", "")),
|
||
demote_refused=refusal("demote", user, me, admins),
|
||
disable_refused=refusal("disable", user, me, admins) if user.is_active else None,
|
||
delete_refused=refusal("delete", user, me, admins)), status
|
||
|
||
|
||
@users_bp.get("/<user_id>")
|
||
@require_role(UserRole.admin)
|
||
async def user_detail(user_id: str):
|
||
return await _user_page(user_id)
|
||
|
||
|
||
@users_bp.post("/<user_id>")
|
||
@require_role(UserRole.admin)
|
||
async def user_save(user_id: str):
|
||
"""The page's one form, for any account: its username and email, and
|
||
whether it is emailed alerts and the weekly report (milestone 495). The
|
||
address may be a provider's placeholder, so it isn't held to mail's test
|
||
here; the account just gets no email until it is real."""
|
||
form = await request.form
|
||
username = (form.get("username") or "").strip()
|
||
email = (form.get("email") or "").strip()
|
||
if not username or not email or len(username) > 64 or len(email) > 255:
|
||
return await _user_page(user_id, "A username (up to 64 characters) and an email are both needed.", 400)
|
||
switches = {k: v for k, v in form.items() if k != "email"}
|
||
try:
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
user = await _target(db, user_id)
|
||
emailed, error = mail.apply_email_form(user, switches)
|
||
if error:
|
||
raise ValueError(error)
|
||
before = {"username": user.username, "email": user.email}
|
||
user.username, user.email = username, email
|
||
except ValueError as exc:
|
||
return await _user_page(user_id, str(exc), 400)
|
||
except IntegrityError:
|
||
return await _user_page(user_id, f"Another account already uses the username {username} or that email.", 400)
|
||
after = {"username": username, "email": email}
|
||
if after != before:
|
||
await audit_request("user.renamed", "user", user_id,
|
||
{k: v for k, v in after.items() if before[k] != v}
|
||
| {f"old_{k}": before[k] for k in after if before[k] != after[k]})
|
||
if user_id == session.get("user_id"):
|
||
session["username"] = username
|
||
if emailed:
|
||
await audit_request("user.email_settings", "user", user_id, {"username": username} | emailed)
|
||
return redirect(f"/settings/users/{user_id}?done=saved")
|
||
|
||
|
||
@users_bp.post("/<user_id>/role")
|
||
@require_role(UserRole.admin)
|
||
async def user_role(user_id: str):
|
||
try:
|
||
role = UserRole((await request.form).get("role") or "")
|
||
except ValueError:
|
||
return await _user_page(user_id, "Pick a role.", 400)
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
user = await _target(db, user_id)
|
||
if user.auth_source != "local":
|
||
error = f"{SOURCES[user.auth_source]} sets this account's role at each sign-in."
|
||
elif role != UserRole.admin and user.role == UserRole.admin:
|
||
error = refusal("demote", user, session.get("user_id"), await _active_admins(db))
|
||
else:
|
||
error = None
|
||
if error is None:
|
||
before, user.role = user.role, role
|
||
if error:
|
||
return await _user_page(user_id, error, 400)
|
||
if before != role:
|
||
await audit_request("user.role_changed", "user", user_id,
|
||
{"username": user.username, "from": before.value, "to": role.value})
|
||
return redirect(f"/settings/users/{user_id}?done=role")
|
||
|
||
|
||
@users_bp.post("/<user_id>/password")
|
||
@require_role(UserRole.admin)
|
||
async def user_password(user_id: str):
|
||
form = await request.form
|
||
problem = password_problem(form.get("password") or "", form.get("confirm") or "")
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
user = await _target(db, user_id)
|
||
if user.auth_source != "local":
|
||
problem = f"This account signs in with {SOURCES[user.auth_source]}; it has no Steward password."
|
||
if problem is None:
|
||
user.password_hash = _hash(form.get("password"))
|
||
# Every browser signed in with the old password is signed out (#5427).
|
||
user.sessions_since = datetime.now(timezone.utc)
|
||
if problem:
|
||
return await _user_page(user_id, problem, 400)
|
||
if user_id == session.get("user_id"):
|
||
session["login_at"] = time.time() # this session carries on under the new password
|
||
await audit_request("user.password_reset", "user", user_id, {"username": user.username})
|
||
return redirect(f"/settings/users/{user_id}?done=password")
|
||
|
||
|
||
@users_bp.post("/<user_id>/active")
|
||
@require_role(UserRole.admin)
|
||
async def user_active(user_id: str):
|
||
"""Disable an active account, or enable a disabled one. A disabled user is
|
||
signed out at their next request and their AI tokens stop working."""
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
user = await _target(db, user_id)
|
||
error = (refusal("disable", user, session.get("user_id"), await _active_admins(db))
|
||
if user.is_active else None)
|
||
if error is None:
|
||
user.is_active = not user.is_active
|
||
if error:
|
||
return await _user_page(user_id, error, 400)
|
||
action = "enabled" if user.is_active else "disabled"
|
||
await audit_request(f"user.{action}", "user", user_id, {"username": user.username})
|
||
return redirect(f"/settings/users/{user_id}?done={action}")
|
||
|
||
|
||
@users_bp.post("/<user_id>/delete")
|
||
@require_role(UserRole.admin)
|
||
async def user_delete(user_id: str):
|
||
async with current_app.db_sessionmaker() as db:
|
||
async with db.begin():
|
||
user = await _target(db, user_id)
|
||
error = refusal("delete", user, session.get("user_id"), await _active_admins(db))
|
||
holds = await held_by(db, user_id)
|
||
if error is None and holds:
|
||
error = (f"{user.username} made {', '.join(holds)}, and Steward keeps who did. "
|
||
"Disable the account instead.")
|
||
if error is None:
|
||
await db.delete(user)
|
||
if error:
|
||
return await _user_page(user_id, error, 400)
|
||
await audit_request("user.deleted", "user", user_id, {"username": user.username})
|
||
return redirect("/settings/users/")
|