src/backend/accounts.py

   1 #!/usr/bin/python
   2 # encoding: utf-8
   3
   4 import asyncio
   5 import base64
   6 import datetime
   7 import hashlib
   8 import hmac
   9 import iso3166
  10 import json
  11 import kerberos
  12 import ldap
  13 import ldap.modlist
  14 import logging
  15 import os
  16 import phonenumbers
  17 import re
  18 import socket
  19 import sys
  20 import time
  21 import tornado.httpclient
  22 import urllib.parse
  23 import urllib.request
  24 import zxcvbn
  25
  26 from . import countries
  27 from . import util
  28 from .decorators import *
  29 from .misc import Object
  30
  31 # Set the client keytab name
  32 os.environ["KRB5_CLIENT_KTNAME"] = "/etc/ipfire.org/ldap.keytab"
  33
  34 FQDN = socket.gethostname()
  35
  36 class LDAPObject(Object):
  37         def init(self, dn, attrs=None):
  38                 self.dn = dn
  39
  40                 self.attributes = attrs or {}
  41
  42         def __eq__(self, other):
  43                 if isinstance(other, self.__class__):
  44                         return self.dn == other.dn
  45
  46                 return NotImplemented
  47
  48         @property
  49         def ldap(self):
  50                 return self.accounts.ldap
  51
  52         def _exists(self, key):
  53                 try:
  54                         self.attributes[key]
  55                 except KeyError:
  56                         return False
  57
  58                 return True
  59
  60         def _get(self, key):
  61                 for value in self.attributes.get(key, []):
  62                         yield value
  63
  64         def _get_bytes(self, key, default=None):
  65                 for value in self._get(key):
  66                         return value
  67
  68                 return default
  69
  70         def _get_strings(self, key):
  71                 for value in self._get(key):
  72                         yield value.decode()
  73
  74         def _get_string(self, key, default=None):
  75                 for value in self._get_strings(key):
  76                         return value
  77
  78                 return default
  79
  80         def _get_phone_numbers(self, key):
  81                 for value in self._get_strings(key):
  82                         yield phonenumbers.parse(value, None)
  83
  84         def _get_timestamp(self, key):
  85                 value = self._get_string(key)
  86
  87                 # Parse the timestamp value and returns a datetime object
  88                 if value:
  89                         return datetime.datetime.strptime(value, "%Y%m%d%H%M%SZ")
  90
  91         def _modify(self, modlist):
  92                 logging.debug("Modifying %s: %s" % (self.dn, modlist))
  93
  94                 # Authenticate before performing any write operations
  95                 self.accounts._authenticate()
  96
  97                 # Run modify operation
  98                 self.ldap.modify_s(self.dn, modlist)
  99
 100         def _set(self, key, values):
 101                 current = self._get(key)
 102
 103                 # Don't do anything if nothing has changed
 104                 if list(current) == values:
 105                         return
 106
 107                 # Remove all old values and add all new ones
 108                 modlist = []
 109
 110                 if self._exists(key):
 111                         modlist.append((ldap.MOD_DELETE, key, None))
 112
 113                 # Add new values
 114                 if values:
 115                         modlist.append((ldap.MOD_ADD, key, values))
 116
 117                 # Run modify operation
 118                 self._modify(modlist)
 119
 120                 # Update cache
 121                 self.attributes.update({ key : values })
 122
 123         def _set_bytes(self, key, values):
 124                 return self._set(key, values)
 125
 126         def _set_strings(self, key, values):
 127                 return self._set(key, [e.encode() for e in values if e])
 128
 129         def _set_string(self, key, value):
 130                 return self._set_strings(key, [value,])
 131
 132         def _add(self, key, values):
 133                 modlist = [
 134                         (ldap.MOD_ADD, key, values),
 135                 ]
 136
 137                 self._modify(modlist)
 138
 139         def _add_strings(self, key, values):
 140                 return self._add(key, [e.encode() for e in values])
 141
 142         def _add_string(self, key, value):
 143                 return self._add_strings(key, [value,])
 144
 145         def _delete(self, key, values):
 146                 modlist = [
 147                         (ldap.MOD_DELETE, key, values),
 148                 ]
 149
 150                 self._modify(modlist)
 151
 152         def _delete_strings(self, key, values):
 153                 return self._delete(key, [e.encode() for e in values])
 154
 155         def _delete_string(self, key, value):
 156                 return self._delete_strings(key, [value,])
 157
 158         def _delete_dn(self, dn):
 159                 logging.debug("Deleting %s" % dn)
 160
 161                 # Authenticate before performing any delete operations
 162                 self.accounts._authenticate()
 163
 164                 # Run delete operation
 165                 self.ldap.delete_s(dn)
 166
 167         @property
 168         def objectclasses(self):
 169                 return self._get_strings("objectClass")
 170
 171         @staticmethod
 172         def _parse_date(s):
 173                 return datetime.datetime.strptime(s.decode(), "%Y%m%d%H%M%SZ")
 174
 175
 176 class Accounts(Object):
 177         def init(self):
 178                 self.search_base = self.settings.get("ldap_search_base")
 179
 180         def __len__(self):
 181                 return self._count("(objectClass=person)")
 182
 183         def __iter__(self):
 184                 accounts = self._search("(objectClass=person)")
 185
 186                 return iter(sorted(accounts))
 187
 188         @lazy_property
 189         def ldap(self):
 190                 # Connect to LDAP server
 191                 ldap_uri = self.settings.get("ldap_uri")
 192
 193                 logging.debug("Connecting to LDAP server: %s" % ldap_uri)
 194
 195                 # Connect to the LDAP server
 196                 connection = ldap.ldapobject.ReconnectLDAPObject(ldap_uri,
 197                         trace_level=2 if self.backend.debug else 0,
 198                         retry_max=sys.maxsize, retry_delay=3)
 199
 200                 # Set maximum timeout for operations
 201                 connection.set_option(ldap.OPT_TIMEOUT, 10)
 202
 203                 return connection
 204
 205         def _authenticate(self):
 206                 # Authenticate against LDAP server using Kerberos
 207                 self.ldap.sasl_gssapi_bind_s()
 208
 209         async def test_ldap(self):
 210                 logging.info("Testing LDAP connection...")
 211
 212                 self._authenticate()
 213
 214                 logging.info("Successfully authenticated as %s" % self.ldap.whoami_s())
 215
 216         def _query(self, query, attrlist=None, limit=0, search_base=None):
 217                 logging.debug("Performing LDAP query (%s): %s" \
 218                         % (search_base or self.search_base, query))
 219
 220                 t = time.time()
 221
 222                 # Ask for up to 512 results being returned at a time
 223                 page_control = ldap.controls.SimplePagedResultsControl(True, size=512, cookie="")
 224
 225                 results = []
 226                 pages = 0
 227
 228                 # Perform the search
 229                 while True:
 230                         response = self.ldap.search_ext(search_base or self.search_base,
 231                                 ldap.SCOPE_SUBTREE, query, attrlist=attrlist, sizelimit=limit,
 232                                 serverctrls=[page_control],
 233                         )
 234
 235                         # Fetch all results
 236                         type, data, rmsgid, serverctrls = self.ldap.result3(response)
 237
 238                         # Append to local copy
 239                         results += data
 240                         pages += 1
 241
 242                         controls = [c for c in serverctrls
 243                                 if c.controlType == ldap.controls.SimplePagedResultsControl.controlType]
 244
 245                         if not controls:
 246                                 break
 247
 248                         # Set the cookie for more results
 249                         page_control.cookie = controls[0].cookie
 250
 251                         # There are no more results
 252                         if not page_control.cookie:
 253                                 break
 254
 255                 # Log time it took to perform the query
 256                 logging.debug("Query took %.2fms (%s page(s))" % ((time.time() - t) * 1000.0, pages))
 257
 258                 return results
 259
 260         def _count(self, query):
 261                 res = self._query(query, attrlist=["dn"])
 262
 263                 return len(res)
 264
 265         def _search(self, query, attrlist=None, limit=0):
 266                 accounts = []
 267                 for dn, attrs in self._query(query, attrlist=["dn"], limit=limit):
 268                         account = self.get_by_dn(dn)
 269                         accounts.append(account)
 270
 271                 return accounts
 272
 273         def _get_attrs(self, dn):
 274                 """
 275                         Fetches all attributes for the given distinguished name
 276                 """
 277                 results = self._query("(objectClass=*)", search_base=dn, limit=1,
 278                         attrlist=("*", "createTimestamp", "modifyTimestamp"))
 279
 280                 for dn, attrs in results:
 281                         return attrs
 282
 283         def get_by_dn(self, dn):
 284                 attrs = self._get_attrs(dn)
 285
 286                 return Account(self.backend, dn, attrs)
 287
 288         @staticmethod
 289         def _format_date(t):
 290                 return t.strftime("%Y%m%d%H%M%SZ")
 291
 292         def get_recently_registered(self, limit=None):
 293                 # Check the last two weeks
 294                 t = datetime.datetime.utcnow() - datetime.timedelta(days=14)
 295
 296                 # Fetch all accounts created after t
 297                 accounts = self.get_created_after(t)
 298
 299                 # Order by creation date and put latest first
 300                 accounts.sort(key=lambda a: a.created_at, reverse=True)
 301
 302                 # Cap at the limit
 303                 if accounts and limit:
 304                         accounts = accounts[:limit]
 305
 306                 return accounts
 307
 308         def get_created_after(self, ts):
 309                 return self._search("(&(objectClass=person)(createTimestamp>=%s))" % self._format_date(ts))
 310
 311         def count_created_after(self, ts):
 312                 return self._count("(&(objectClass=person)(createTimestamp>=%s))" % self._format_date(ts))
 313
 314         def search(self, query):
 315                 # Try finding an exact match
 316                 account = self._search_one(
 317                         "(&"
 318                                 "(objectClass=person)"
 319                                 "(|"
 320                                         "(uid=%s)"
 321                                         "(mail=%s)"
 322                                         "(mailAlternateAddress=%s)"
 323                                 ")"
 324                         ")" % (query, query, query))
 325                 if account:
 326                         return [account]
 327
 328                 # Otherwise search for a substring match
 329                 accounts = self._search(
 330                         "(&"
 331                                 "(objectClass=person)"
 332                                 "(|"
 333                                         "(cn=*%s*)"
 334                                         "(uid=*%s*)"
 335                                         "(displayName=*%s*)"
 336                                         "(mail=*%s*)"
 337                                 ")"
 338                         ")" % (query, query, query, query))
 339
 340                 return sorted(accounts)
 341
 342         def _search_one(self, query):
 343                 results = self._search(query, limit=1)
 344
 345                 for result in results:
 346                         return result
 347
 348         def uid_is_valid(self, uid):
 349                 # https://unix.stackexchange.com/questions/157426/what-is-the-regex-to-validate-linux-users
 350                 m = re.match(r"^[a-z_][a-z0-9_-]{3,31}$", uid)
 351                 if m:
 352                         return True
 353
 354                 return False
 355
 356         def uid_exists(self, uid):
 357                 if self.get_by_uid(uid):
 358                         return True
 359
 360                 res = self.db.get("SELECT 1 FROM account_activations \
 361                         WHERE uid = %s AND expires_at > NOW()", uid)
 362
 363                 if res:
 364                         return True
 365
 366                 # Account with uid does not exist, yet
 367                 return False
 368
 369         def mail_is_valid(self, mail):
 370                 username, delim, domain = mail.partition("@")
 371
 372                 # There must be an @ and a domain part
 373                 if not domain:
 374                         return False
 375
 376                 # The domain cannot end on a dot
 377                 if domain.endswith("."):
 378                         return False
 379
 380                 # The domain should at least have one dot to fully qualified
 381                 if not "." in domain:
 382                         return False
 383
 384                 # Looks like a valid email address
 385                 return True
 386
 387         def mail_is_blacklisted(self, mail):
 388                 username, delim, domain = mail.partition("@")
 389
 390                 if domain:
 391                         return self.domain_is_blacklisted(domain)
 392
 393         def domain_is_blacklisted(self, domain):
 394                 res = self.db.get("SELECT TRUE AS found FROM blacklisted_domains \
 395                         WHERE domain = %s OR %s LIKE '%%.' || domain", domain, domain)
 396
 397                 if res and res.found:
 398                         return True
 399
 400                 return False
 401
 402         def get_by_uid(self, uid):
 403                 return self._search_one("(&(objectClass=person)(uid=%s))" % uid)
 404
 405         def get_by_mail(self, mail):
 406                 return self._search_one("(&(objectClass=inetOrgPerson)(mail=%s))" % mail)
 407
 408         def find_account(self, s):
 409                 account = self.get_by_uid(s)
 410                 if account:
 411                         return account
 412
 413                 return self.get_by_mail(s)
 414
 415         def get_by_sip_id(self, sip_id):
 416                 if not sip_id:
 417                         return
 418
 419                 return self._search_one(
 420                         "(|(&(objectClass=sipUser)(sipAuthenticationUser=%s))(&(objectClass=sipRoutingObject)(sipLocalAddress=%s)))" \
 421                         % (sip_id, sip_id))
 422
 423         def get_by_phone_number(self, number):
 424                 if not number:
 425                         return
 426
 427                 return self._search_one(
 428                         "(&(objectClass=inetOrgPerson)(|(sipAuthenticationUser=%s)(telephoneNumber=%s)(homePhone=%s)(mobile=%s)))" \
 429                         % (number, number, number, number))
 430
 431         @property
 432         def pending_registrations(self):
 433                 res = self.db.get("SELECT COUNT(*) AS c FROM account_activations")
 434
 435                 return res.c or 0
 436
 437         def auth(self, username, password):
 438                 # Find account
 439                 account = self.backend.accounts.find_account(username)
 440
 441                 # Check credentials
 442                 if account and account.check_password(password):
 443                         return account
 444
 445         # Join
 446
 447         def join(self, uid, email, first_name, last_name, country_code=None):
 448                 # Convert all uids to lowercase
 449                 uid = uid.lower()
 450
 451                 # Check if UID is valid
 452                 if not self.uid_is_valid(uid):
 453                         raise ValueError("UID is invalid: %s" % uid)
 454
 455                 # Check if UID is unique
 456                 if self.uid_exists(uid):
 457                         raise ValueError("UID exists: %s" % uid)
 458
 459                 # Check if the email address is valid
 460                 if not self.mail_is_valid(email):
 461                         raise ValueError("Email is invalid: %s" % email)
 462
 463                 # Check if the email address is blacklisted
 464                 if self.mail_is_blacklisted(email):
 465                         raise ValueError("Email is blacklisted: %s" % email)
 466
 467                 # Generate a random activation code
 468                 activation_code = util.random_string(36)
 469
 470                 # Create an entry in our database until the user
 471                 # has activated the account
 472                 self.db.execute("INSERT INTO account_activations(uid, activation_code, \
 473                         email, first_name, last_name, country_code) VALUES(%s, %s, %s, %s, %s, %s)",
 474                         uid, activation_code, email, first_name, last_name, country_code)
 475
 476                 # Send an account activation email
 477                 self.backend.messages.send_template("auth/messages/join",
 478                         priority=100, uid=uid, activation_code=activation_code, email=email,
 479                         first_name=first_name, last_name=last_name)
 480
 481         def activate(self, uid, activation_code):
 482                 res = self.db.get("DELETE FROM account_activations \
 483                         WHERE uid = %s AND activation_code = %s AND expires_at > NOW() \
 484                         RETURNING *", uid, activation_code)
 485
 486                 # Return nothing when account was not found
 487                 if not res:
 488                         return
 489
 490                 # Return the account if it has already been created
 491                 account = self.get_by_uid(uid)
 492                 if account:
 493                         return account
 494
 495                 # Create a new account on the LDAP database
 496                 account = self.create(uid, res.email,
 497                         first_name=res.first_name, last_name=res.last_name,
 498                         country_code=res.country_code)
 499
 500                 # Non-EU users do not need to consent to promo emails
 501                 if account.country_code and not account.country_code in countries.EU_COUNTRIES:
 502                         account.consents_to_promotional_emails = True
 503
 504                 # Send email about account registration
 505                 self.backend.messages.send_template("people/messages/new-account",
 506                         account=account)
 507
 508                 # Launch drip campaigns
 509                 for campaign in ("signup", "christmas"):
 510                         self.backend.campaigns.launch(campaign, account)
 511
 512                 return account
 513
 514         def create(self, uid, email, first_name, last_name, country_code=None):
 515                 cn = "%s %s" % (first_name, last_name)
 516
 517                 # Account Parameters
 518                 account = {
 519                         "objectClass"  : [b"top", b"person", b"inetOrgPerson"],
 520                         "mail"         : email.encode(),
 521
 522                         # Name
 523                         "cn"           : cn.encode(),
 524                         "sn"           : last_name.encode(),
 525                         "givenName"    : first_name.encode(),
 526                 }
 527
 528                 logging.info("Creating new account: %s: %s" % (uid, account))
 529
 530                 # Create DN
 531                 dn = "uid=%s,ou=People,dc=ipfire,dc=org" % uid
 532
 533                 # Create account on LDAP
 534                 self.accounts._authenticate()
 535                 self.ldap.add_s(dn, ldap.modlist.addModlist(account))
 536
 537                 # Fetch the account
 538                 account = self.get_by_dn(dn)
 539
 540                 # Optionally set country code
 541                 if country_code:
 542                         account.country_code = country_code
 543
 544                 # Return account
 545                 return account
 546
 547         # Session stuff
 548
 549         def create_session(self, account, host):
 550                 session_id = util.random_string(64)
 551
 552                 res = self.db.get("INSERT INTO sessions(host, uid, session_id) VALUES(%s, %s, %s) \
 553                         RETURNING session_id, time_expires", host, account.uid, session_id)
 554
 555                 # Session could not be created
 556                 if not res:
 557                         return None, None
 558
 559                 logging.info("Created session %s for %s which expires %s" \
 560                         % (res.session_id, account, res.time_expires))
 561                 return res.session_id, res.time_expires
 562
 563         def destroy_session(self, session_id, host):
 564                 logging.info("Destroying session %s" % session_id)
 565
 566                 self.db.execute("DELETE FROM sessions \
 567                         WHERE session_id = %s AND host = %s", session_id, host)
 568
 569         def get_by_session(self, session_id, host):
 570                 logging.debug("Looking up session %s" % session_id)
 571
 572                 res = self.db.get("SELECT uid FROM sessions WHERE session_id = %s \
 573                         AND host = %s AND NOW() BETWEEN time_created AND time_expires",
 574                         session_id, host)
 575
 576                 # Session does not exist or has expired
 577                 if not res:
 578                         return
 579
 580                 # Update the session expiration time
 581                 self.db.execute("UPDATE sessions SET time_expires = NOW() + INTERVAL '14 days' \
 582                         WHERE session_id = %s AND host = %s", session_id, host)
 583
 584                 return self.get_by_uid(res.uid)
 585
 586         def cleanup(self):
 587                 # Cleanup expired sessions
 588                 self.db.execute("DELETE FROM sessions WHERE time_expires <= NOW()")
 589
 590                 # Cleanup expired account activations
 591                 self.db.execute("DELETE FROM account_activations WHERE expires_at <= NOW()")
 592
 593                 # Cleanup expired account password resets
 594                 self.db.execute("DELETE FROM account_password_resets WHERE expires_at <= NOW()")
 595
 596         async def _delete(self, *args, **kwargs):
 597                 """
 598                         Deletes given users
 599                 """
 600                 # Who is deleting?
 601                 who = self.get_by_uid("ms")
 602
 603                 for uid in args:
 604                         account = self.get_by_uid(uid)
 605
 606                         # Delete the account
 607                         with self.db.transaction():
 608                                 await account.delete(who)
 609
 610         # Discourse
 611
 612         def decode_discourse_payload(self, payload, signature):
 613                 # Check signature
 614                 calculated_signature = self.sign_discourse_payload(payload)
 615
 616                 if not hmac.compare_digest(signature, calculated_signature):
 617                         raise ValueError("Invalid signature: %s" % signature)
 618
 619                 # Decode the query string
 620                 qs = base64.b64decode(payload).decode()
 621
 622                 # Parse the query string
 623                 data = {}
 624                 for key, val in urllib.parse.parse_qsl(qs):
 625                         data[key] = val
 626
 627                 return data
 628
 629         def encode_discourse_payload(self, **args):
 630                 # Encode the arguments into an URL-formatted string
 631                 qs = urllib.parse.urlencode(args).encode()
 632
 633                 # Encode into base64
 634                 return base64.b64encode(qs).decode()
 635
 636         def sign_discourse_payload(self, payload, secret=None):
 637                 if secret is None:
 638                         secret = self.settings.get("discourse_sso_secret")
 639
 640                 # Calculate a HMAC using SHA256
 641                 h = hmac.new(secret.encode(),
 642                         msg=payload.encode(), digestmod="sha256")
 643
 644                 return h.hexdigest()
 645
 646         @property
 647         def countries(self):
 648                 ret = {}
 649
 650                 for country in iso3166.countries:
 651                         count = self._count("(&(objectClass=person)(c=%s))" % country.alpha2)
 652
 653                         if count:
 654                                 ret[country] = count
 655
 656                 return ret
 657
 658         async def get_all_emails(self):
 659                 # Returns all email addresses
 660                 for dn, attrs in self._query("(objectClass=person)", attrlist=("mail",)):
 661                         mails = attrs.get("mail", None)
 662                         if not mails:
 663                                 continue
 664
 665                         for mail in mails:
 666                                 print(mail.decode())
 667
 668
 669 class Account(LDAPObject):
 670         def __str__(self):
 671                 if self.nickname:
 672                         return self.nickname
 673
 674                 return self.name
 675
 676         def __repr__(self):
 677                 return "<%s %s>" % (self.__class__.__name__, self.dn)
 678
 679         def __lt__(self, other):
 680                 if isinstance(other, self.__class__):
 681                         return self.name < other.name
 682
 683                 return NotImplemented
 684
 685         @property
 686         def kerberos_principal_dn(self):
 687                 return "krbPrincipalName=%s@IPFIRE.ORG,cn=IPFIRE.ORG,cn=krb5,dc=ipfire,dc=org" % self.uid
 688
 689         @lazy_property
 690         def kerberos_attributes(self):
 691                 res = self.backend.accounts._query(
 692                         "(&(objectClass=krbPrincipal)(krbPrincipalName=%s@IPFIRE.ORG))" % self.uid,
 693                         attrlist=[
 694                                 "krbLastSuccessfulAuth",
 695                                 "krbLastPasswordChange",
 696                                 "krbLastFailedAuth",
 697                                 "krbLoginFailedCount",
 698                         ],
 699                         limit=1,
 700                         search_base="cn=krb5,%s" % self.backend.accounts.search_base)
 701
 702                 for dn, attrs in res:
 703                         return { key : attrs[key][0] for key in attrs }
 704
 705                 return {}
 706
 707         @property
 708         def last_successful_authentication(self):
 709                 try:
 710                         s = self.kerberos_attributes["krbLastSuccessfulAuth"]
 711                 except KeyError:
 712                         return None
 713
 714                 return self._parse_date(s)
 715
 716         @property
 717         def last_failed_authentication(self):
 718                 try:
 719                         s = self.kerberos_attributes["krbLastFailedAuth"]
 720                 except KeyError:
 721                         return None
 722
 723                 return self._parse_date(s)
 724
 725         @property
 726         def failed_login_count(self):
 727                 try:
 728                         count = self.kerberos_attributes["krbLoginFailedCount"].decode()
 729                 except KeyError:
 730                         return 0
 731
 732                 try:
 733                         return int(count)
 734                 except ValueError:
 735                         return 0
 736
 737         def passwd(self, password):
 738                 """
 739                         Sets a new password
 740                 """
 741                 # The new password must have a score of 3 or better
 742                 quality = self.check_password_quality(password)
 743                 if quality["score"] < 3:
 744                         raise ValueError("Password too weak")
 745
 746                 self.accounts._authenticate()
 747                 self.ldap.passwd_s(self.dn, None, password)
 748
 749         def check_password(self, password):
 750                 """
 751                         Bind to the server with given credentials and return
 752                         true if password is corrent and false if not.
 753
 754                         Raises exceptions from the server on any other errors.
 755                 """
 756                 if not password:
 757                         return
 758
 759                 logging.debug("Checking credentials for %s" % self.dn)
 760
 761                 # Check the credentials against the Kerberos database
 762                 try:
 763                         kerberos.checkPassword(self.uid, password, "host/%s" % FQDN, "IPFIRE.ORG")
 764
 765                 # Catch any authentication errors
 766                 except kerberos.BasicAuthError as e:
 767                         logging.debug("Could not authenticate %s: %s" % (self.uid, e))
 768
 769                         return False
 770
 771                 # Otherwise return True
 772                 else:
 773                         logging.info("Successfully authenticated %s" % self)
 774
 775                         return True
 776
 777         def check_password_quality(self, password):
 778                 """
 779                         Passwords are passed through zxcvbn to make sure
 780                         that they are strong enough.
 781                 """
 782                 return zxcvbn.zxcvbn(password, user_inputs=(
 783                         self.first_name, self.last_name,
 784                 ))
 785
 786         def request_password_reset(self, address=None):
 787                 reset_code = util.random_string(64)
 788
 789                 self.db.execute("INSERT INTO account_password_resets(uid, reset_code, address) \
 790                         VALUES(%s, %s, %s)", self.uid, reset_code, address)
 791
 792                 # Send a password reset email
 793                 self.backend.messages.send_template("auth/messages/password-reset",
 794                         priority=100, account=self, reset_code=reset_code)
 795
 796         def reset_password(self, reset_code, new_password):
 797                 # Delete the reset token
 798                 res = self.db.query("DELETE FROM account_password_resets \
 799                         WHERE uid = %s AND reset_code = %s AND expires_at >= NOW() \
 800                         RETURNING *", self.uid, reset_code)
 801
 802                 # The reset code was invalid
 803                 if not res:
 804                         raise ValueError("Invalid password reset token for %s: %s" % (self, reset_code))
 805
 806                 # Perform password change
 807                 return self.passwd(new_password)
 808
 809         def is_admin(self):
 810                 return self.is_member_of_group("sudo")
 811
 812         def is_staff(self):
 813                 return self.is_member_of_group("staff")
 814
 815         def is_moderator(self):
 816                 return self.is_member_of_group("moderators")
 817
 818         def has_shell(self):
 819                 return "posixAccount" in self.classes
 820
 821         def has_mail(self):
 822                 return "postfixMailUser" in self.classes
 823
 824         def has_sip(self):
 825                 return "sipUser" in self.classes or "sipRoutingObject" in self.classes
 826
 827         def is_blog_author(self):
 828                 return self.is_member_of_group("blog-authors")
 829
 830         def is_lwl(self):
 831                 return self.is_member_of_group("lwl-staff")
 832
 833         def can_be_managed_by(self, account):
 834                 """
 835                         Returns True if account is allowed to manage this account
 836                 """
 837                 # Admins can manage all accounts
 838                 if account.is_admin():
 839                         return True
 840
 841                 # Users can manage themselves
 842                 return self == account
 843
 844         @property
 845         def classes(self):
 846                 return self._get_strings("objectClass")
 847
 848         @property
 849         def uid(self):
 850                 return self._get_string("uid")
 851
 852         @property
 853         def name(self):
 854                 return self._get_string("cn")
 855
 856         # Delete
 857
 858         async def delete(self, user):
 859                 """
 860                         Deletes this user
 861                 """
 862                 # Check if this user can be deleted
 863                 if not self.can_be_deleted_by(user):
 864                         raise RuntimeError("Cannot delete user %s" % self)
 865
 866                 logging.info("Deleting user %s" % self)
 867
 868                 async with asyncio.TaskGroup() as tasks:
 869                         t = datetime.datetime.now()
 870
 871                         # Disable this account on Bugzilla
 872                         tasks.create_task(
 873                                 self._disable_on_bugzilla("Deleted by %s, %s" % (user, t)),
 874                         )
 875
 876                         # XXX Delete on Discourse
 877
 878                 # Delete on LDAP
 879                 self._delete()
 880
 881         def can_be_deleted_by(self, user):
 882                 """
 883                         Return True if the user can be deleted by user
 884                 """
 885                 # Check permissions
 886                 if not self.can_be_managed_by(user):
 887                         return False
 888
 889                 # Cannot delete shell users
 890                 if self.has_shell():
 891                         return False
 892
 893                 # Looks okay
 894                 return True
 895
 896         def _delete(self):
 897                 """
 898                         Deletes this object from LDAP
 899                 """
 900                 # Delete the Kerberos Principal
 901                 self._delete_dn(self.kerberos_principal_dn)
 902
 903                 # Delete this object
 904                 self._delete_dn(self.dn)
 905
 906         # Nickname
 907
 908         def get_nickname(self):
 909                 return self._get_string("displayName")
 910
 911         def set_nickname(self, nickname):
 912                 self._set_string("displayName", nickname)
 913
 914         nickname = property(get_nickname, set_nickname)
 915
 916         # First Name
 917
 918         def get_first_name(self):
 919                 return self._get_string("givenName")
 920
 921         def set_first_name(self, first_name):
 922                 self._set_string("givenName", first_name)
 923
 924                 # Update Common Name
 925                 self._set_string("cn", "%s %s" % (first_name, self.last_name))
 926
 927         first_name = property(get_first_name, set_first_name)
 928
 929         # Last Name
 930
 931         def get_last_name(self):
 932                 return self._get_string("sn")
 933
 934         def set_last_name(self, last_name):
 935                 self._set_string("sn", last_name)
 936
 937                 # Update Common Name
 938                 self._set_string("cn", "%s %s" % (self.first_name, last_name))
 939
 940         last_name = property(get_last_name, set_last_name)
 941
 942         @lazy_property
 943         def groups(self):
 944                 return self.backend.groups._get_groups("(| \
 945                         (&(objectClass=groupOfNames)(member=%s)) \
 946                         (&(objectClass=posixGroup)(memberUid=%s)) \
 947                 )" % (self.dn, self.uid))
 948
 949         def is_member_of_group(self, gid):
 950                 """
 951                         Returns True if this account is a member of this group
 952                 """
 953                 return gid in (g.gid for g in self.groups)
 954
 955         # Created/Modified at
 956
 957         @property
 958         def created_at(self):
 959                 return self._get_timestamp("createTimestamp")
 960
 961         @property
 962         def modified_at(self):
 963                 return self._get_timestamp("modifyTimestamp")
 964
 965         # Address
 966
 967         @property
 968         def address(self):
 969                 address = []
 970
 971                 if self.street:
 972                         address += self.street.splitlines()
 973
 974                 if self.postal_code and self.city:
 975                         if self.country_code in ("AT", "DE"):
 976                                 address.append("%s %s" % (self.postal_code, self.city))
 977                         else:
 978                                 address.append("%s, %s" % (self.city, self.postal_code))
 979                 else:
 980                         address.append(self.city or self.postal_code)
 981
 982                 if self.country_name:
 983                         address.append(self.country_name)
 984
 985                 return [line for line in address if line]
 986
 987         def get_street(self):
 988                 return self._get_string("street") or self._get_string("homePostalAddress")
 989
 990         def set_street(self, street):
 991                 self._set_string("street", street)
 992
 993         street = property(get_street, set_street)
 994
 995         def get_city(self):
 996                 return self._get_string("l") or ""
 997
 998         def set_city(self, city):
 999                 self._set_string("l", city)
1000
1001         city = property(get_city, set_city)
1002
1003         def get_postal_code(self):
1004                 return self._get_string("postalCode") or ""
1005
1006         def set_postal_code(self, postal_code):
1007                 self._set_string("postalCode", postal_code)
1008
1009         postal_code = property(get_postal_code, set_postal_code)
1010
1011         def get_state(self):
1012                 return self._get_string("st")
1013
1014         def set_state(self, state):
1015                 self._set_string("st", state)
1016
1017         state = property(get_state, set_state)
1018
1019         def get_country_code(self):
1020                 return self._get_string("c")
1021
1022         def set_country_code(self, country_code):
1023                 self._set_string("c", country_code)
1024
1025         country_code = property(get_country_code, set_country_code)
1026
1027         @property
1028         def country_name(self):
1029                 if self.country_code:
1030                         return self.backend.get_country_name(self.country_code)
1031
1032         @property
1033         def initials(self):
1034                 initials = []
1035
1036                 # If a nickname is set, only use the nickname
1037                 if self.nickname:
1038                         for m in re.findall(r"(\w+)", self.nickname):
1039                                 initials.append(m[0])
1040
1041                 # Otherwise use the first and last name
1042                 else:
1043                         if self.first_name:
1044                                 initials.append(self.first_name[0])
1045
1046                         if self.last_name:
1047                                 initials.append(self.last_name[0])
1048
1049                 # Truncate to two initials
1050                 initials = initials[:2]
1051
1052                 return [i.upper() for i in initials]
1053
1054         # Email
1055
1056         @property
1057         def email(self):
1058                 return self._get_string("mail")
1059
1060         @property
1061         def email_to(self):
1062                 return "%s <%s>" % (self, self.email)
1063
1064         @lazy_property
1065         def alternate_email_addresses(self):
1066                 addresses = self._get_strings("mailAlternateAddress")
1067
1068                 return sorted(addresses)
1069
1070         # Mail Routing Address
1071
1072         def get_mail_routing_address(self):
1073                 return self._get_string("mailRoutingAddress", None)
1074
1075         def set_mail_routing_address(self, address):
1076                 self._set_string("mailRoutingAddress", address or None)
1077
1078         mail_routing_address = property(get_mail_routing_address, set_mail_routing_address)
1079
1080         @property
1081         def sip_id(self):
1082                 if "sipUser" in self.classes:
1083                         return self._get_string("sipAuthenticationUser")
1084
1085                 if "sipRoutingObject" in self.classes:
1086                         return self._get_string("sipLocalAddress")
1087
1088         @property
1089         def sip_password(self):
1090                 return self._get_string("sipPassword")
1091
1092         @staticmethod
1093         def _generate_sip_password():
1094                 return util.random_string(8)
1095
1096         @property
1097         def sip_url(self):
1098                 return "%s@ipfire.org" % self.sip_id
1099
1100         def uses_sip_forwarding(self):
1101                 if self.sip_routing_address:
1102                         return True
1103
1104                 return False
1105
1106         # SIP Routing
1107
1108         def get_sip_routing_address(self):
1109                 if "sipRoutingObject" in self.classes:
1110                         return self._get_string("sipRoutingAddress")
1111
1112         def set_sip_routing_address(self, address):
1113                 if not address:
1114                         address = None
1115
1116                 # Don't do anything if nothing has changed
1117                 if self.get_sip_routing_address() == address:
1118                         return
1119
1120                 if address:
1121                         # This is no longer a SIP user any more
1122                         try:
1123                                 self._modify([
1124                                         (ldap.MOD_DELETE, "objectClass", b"sipUser"),
1125                                         (ldap.MOD_DELETE, "sipAuthenticationUser", None),
1126                                         (ldap.MOD_DELETE, "sipPassword", None),
1127                                 ])
1128                         except ldap.NO_SUCH_ATTRIBUTE:
1129                                 pass
1130
1131                         # Set new routing object
1132                         try:
1133                                 self._modify([
1134                                         (ldap.MOD_ADD, "objectClass", b"sipRoutingObject"),
1135                                         (ldap.MOD_ADD, "sipLocalAddress", self.sip_id.encode()),
1136                                         (ldap.MOD_ADD, "sipRoutingAddress", address.encode()),
1137                                 ])
1138
1139                         # If this is a change, we cannot add this again
1140                         except ldap.TYPE_OR_VALUE_EXISTS:
1141                                 self._set_string("sipRoutingAddress", address)
1142                 else:
1143                         try:
1144                                 self._modify([
1145                                         (ldap.MOD_DELETE, "objectClass", b"sipRoutingObject"),
1146                                         (ldap.MOD_DELETE, "sipLocalAddress", None),
1147                                         (ldap.MOD_DELETE, "sipRoutingAddress", None),
1148                                 ])
1149                         except ldap.NO_SUCH_ATTRIBUTE:
1150                                 pass
1151
1152                         self._modify([
1153                                 (ldap.MOD_ADD, "objectClass", b"sipUser"),
1154                                 (ldap.MOD_ADD, "sipAuthenticationUser", self.sip_id.encode()),
1155                                 (ldap.MOD_ADD, "sipPassword", self._generate_sip_password().encode()),
1156                         ])
1157
1158                 # XXX Cache is invalid here
1159
1160         sip_routing_address = property(get_sip_routing_address, set_sip_routing_address)
1161
1162         # SIP Registrations
1163
1164         async def get_sip_registrations(self):
1165                 if not self.has_sip():
1166                         return []
1167
1168                 return await self.backend.asterisk.get_registrations(self.sip_id)
1169
1170         # SIP Channels
1171
1172         async def get_sip_channels(self):
1173                 if not self.has_sip():
1174                         return []
1175
1176                 return await self.backend.asterisk.get_sip_channels(self.sip_id)
1177
1178         # Phone Numbers
1179
1180         @lazy_property
1181         def phone_number(self):
1182                 """
1183                         Returns the IPFire phone number
1184                 """
1185                 if self.sip_id:
1186                         return phonenumbers.parse("+4923636035%s" % self.sip_id)
1187
1188         @lazy_property
1189         def fax_number(self):
1190                 if self.sip_id:
1191                         return phonenumbers.parse("+49236360359%s" % self.sip_id)
1192
1193         def get_phone_numbers(self):
1194                 ret = []
1195
1196                 for field in ("telephoneNumber", "homePhone", "mobile"):
1197                         for number in self._get_phone_numbers(field):
1198                                 ret.append(number)
1199
1200                 return ret
1201
1202         def set_phone_numbers(self, phone_numbers):
1203                 # Sort phone numbers by landline and mobile
1204                 _landline_numbers = []
1205                 _mobile_numbers = []
1206
1207                 for number in phone_numbers:
1208                         try:
1209                                 number = phonenumbers.parse(number, None)
1210                         except phonenumbers.phonenumberutil.NumberParseException:
1211                                 continue
1212
1213                         # Convert to string (in E.164 format)
1214                         s = phonenumbers.format_number(number, phonenumbers.PhoneNumberFormat.E164)
1215
1216                         # Separate mobile numbers
1217                         if phonenumbers.number_type(number) == phonenumbers.PhoneNumberType.MOBILE:
1218                                 _mobile_numbers.append(s)
1219                         else:
1220                                 _landline_numbers.append(s)
1221
1222                 # Save
1223                 self._set_strings("telephoneNumber", _landline_numbers)
1224                 self._set_strings("mobile", _mobile_numbers)
1225
1226         phone_numbers = property(get_phone_numbers, set_phone_numbers)
1227
1228         @property
1229         def _all_telephone_numbers(self):
1230                 ret = [ self.sip_id, ]
1231
1232                 if self.phone_number:
1233                         s = phonenumbers.format_number(self.phone_number, phonenumbers.PhoneNumberFormat.E164)
1234                         ret.append(s)
1235
1236                 for number in self.phone_numbers:
1237                         s = phonenumbers.format_number(number, phonenumbers.PhoneNumberFormat.E164)
1238                         ret.append(s)
1239
1240                 return ret
1241
1242         # Description
1243
1244         def get_description(self):
1245                 return self._get_string("description")
1246
1247         def set_description(self, description):
1248                 self._set_string("description", description)
1249
1250         description = property(get_description, set_description)
1251
1252         # Avatar
1253
1254         @lazy_property
1255         def avatar_hash(self):
1256                 # Fetch the timestamp (or fall back to the last LDAP change)
1257                 t = self._fetch_avatar_timestamp() or self.modified_at
1258
1259                 # Create the payload
1260                 payload = "%s-%s" % (self.uid, t)
1261
1262                 # Compute a hash over the payload
1263                 h = hashlib.new("blake2b", payload.encode())
1264
1265                 return h.hexdigest()[:7]
1266
1267         def avatar_url(self, size=None, absolute=False):
1268                 # This cannot be async because we are calling it from the template engine
1269                 url = "/users/%s.jpg?h=%s" % (self.uid, self.avatar_hash)
1270
1271                 # Return an absolute URL
1272                 if absolute:
1273                         url = urllib.parse.urljoin("https://www.ipfire.org", url)
1274
1275                 if size:
1276                         url += "&size=%s" % size
1277
1278                 return url
1279
1280         async def get_avatar(self, size=None):
1281                 # Check the PostgreSQL database
1282                 photo = self._fetch_avatar()
1283
1284                 # Fall back to LDAP
1285                 if not photo:
1286                         photo = self._get_bytes("jpegPhoto")
1287
1288                 # Exit if no avatar is available
1289                 if not photo:
1290                         return
1291
1292                 # Return the raw image if no size was requested
1293                 if size is None:
1294                         return photo
1295
1296                 # Compose the cache key
1297                 key = "accounts:%s:avatar:%s:%s" % (self.uid, self.avatar_hash, size)
1298
1299                 # Try to retrieve something from the cache
1300                 avatar = await self.backend.cache.get(key)
1301                 if avatar:
1302                         return avatar
1303
1304                 # Generate a new thumbnail
1305                 avatar = util.generate_thumbnail(photo, size, square=True)
1306
1307                 # Save to cache for 24h
1308                 await self.backend.cache.set(key, avatar, 86400)
1309
1310                 return avatar
1311
1312         def _fetch_avatar(self):
1313                 """
1314                         Fetches the original avatar blob as being uploaded by the user
1315                 """
1316                 res = self.db.get("""
1317                         SELECT
1318                                 blob
1319                         FROM
1320                                 account_avatars
1321                         WHERE
1322                                 uid = %s
1323                         AND
1324                                 deleted_at IS NULL
1325                         """, self.uid,
1326                 )
1327
1328                 if res:
1329                         return res.blob
1330
1331         def _fetch_avatar_timestamp(self):
1332                 res = self.db.get("""
1333                         SELECT
1334                                 created_at
1335                         FROM
1336                                 account_avatars
1337                         WHERE
1338                                 uid = %s
1339                         AND
1340                                 deleted_at IS NULL
1341                         """, self.uid,
1342                 )
1343
1344                 if res:
1345                         return res.created_at
1346
1347         async def upload_avatar(self, avatar):
1348                 # Remove all previous avatars
1349                 self.db.execute("""
1350                         UPDATE
1351                                 account_avatars
1352                         SET
1353                                 deleted_at = CURRENT_TIMESTAMP
1354                         WHERE
1355                                 uid = %s
1356                         AND
1357                                 deleted_at IS NULL
1358                         """, self.uid,
1359                 )
1360
1361                 # Store the new avatar in the database
1362                 self.db.execute("""
1363                         INSERT INTO
1364                                 account_avatars
1365                         (
1366                                 uid,
1367                                 blob
1368                         )
1369                         VALUES
1370                         (
1371                                 %s, %s
1372                         )
1373                         """, self.uid, avatar,
1374                 )
1375
1376                 # Remove anything in the LDAP database
1377                 photo = self._get_bytes("jpegPhoto")
1378                 if photo:
1379                         self._delete("jpegPhoto", [photo])
1380
1381         # Consent to promotional emails
1382
1383         def get_consents_to_promotional_emails(self):
1384                 return self.is_member_of_group("promotional-consent")
1385
1386         def set_contents_to_promotional_emails(self, value):
1387                 group = self.backend.groups.get_by_gid("promotional-consent")
1388                 assert group, "Could not find group: promotional-consent"
1389
1390                 if value is True:
1391                         group.add_member(self)
1392                 else:
1393                         group.del_member(self)
1394
1395         consents_to_promotional_emails = property(
1396                 get_consents_to_promotional_emails,
1397                 set_contents_to_promotional_emails,
1398         )
1399
1400         # Bugzilla
1401
1402         async def _disable_on_bugzilla(self, text=None):
1403                 """
1404                         Disables the user on Bugzilla
1405                 """
1406                 user = await self.backend.bugzilla.get_user(self.email)
1407
1408                 # Do nothing if the user does not exist
1409                 if not user:
1410                         return
1411
1412                 # Disable the user
1413                 await user.disable(text)
1414
1415         # Mailman
1416
1417         async def get_lists(self):
1418                 return await self.backend.lists.get_subscribed_lists(self)
1419
1420
1421 class Groups(Object):
1422         hidden_groups = (
1423                 "cn=LDAP Read Only,ou=Group,dc=ipfire,dc=org",
1424                 "cn=LDAP Read Write,ou=Group,dc=ipfire,dc=org",
1425
1426                 # Everyone is a member of people
1427                 "cn=people,ou=Group,dc=ipfire,dc=org",
1428         )
1429
1430         @property
1431         def search_base(self):
1432                 return "ou=Group,%s" % self.backend.accounts.search_base
1433
1434         def _query(self, *args, **kwargs):
1435                 kwargs.update({
1436                         "search_base" : self.backend.groups.search_base,
1437                 })
1438
1439                 return self.backend.accounts._query(*args, **kwargs)
1440
1441         def __iter__(self):
1442                 groups = self.get_all()
1443
1444                 return iter(groups)
1445
1446         def _get_groups(self, query, **kwargs):
1447                 res = self._query(query, **kwargs)
1448
1449                 groups = []
1450                 for dn, attrs in res:
1451                         # Skip any hidden groups
1452                         if dn in self.hidden_groups:
1453                                 continue
1454
1455                         g = Group(self.backend, dn, attrs)
1456                         groups.append(g)
1457
1458                 return sorted(groups)
1459
1460         def _get_group(self, query, **kwargs):
1461                 kwargs.update({
1462                         "limit" : 1,
1463                 })
1464
1465                 groups = self._get_groups(query, **kwargs)
1466                 if groups:
1467                         return groups[0]
1468
1469         def get_all(self):
1470                 return self._get_groups(
1471                         "(|(objectClass=posixGroup)(objectClass=groupOfNames))",
1472                 )
1473
1474         def get_by_gid(self, gid):
1475                 return self._get_group(
1476                         "(&(|(objectClass=posixGroup)(objectClass=groupOfNames))(cn=%s))" % gid,
1477                 )
1478
1479
1480 class Group(LDAPObject):
1481         def __repr__(self):
1482                 if self.description:
1483                         return "<%s %s (%s)>" % (
1484                                 self.__class__.__name__,
1485                                 self.gid,
1486                                 self.description,
1487                         )
1488
1489                 return "<%s %s>" % (self.__class__.__name__, self.gid)
1490
1491         def __str__(self):
1492                 return self.description or self.gid
1493
1494         def __lt__(self, other):
1495                 if isinstance(other, self.__class__):
1496                         return (self.description or self.gid) < (other.description or other.gid)
1497
1498                 return NotImplemented
1499
1500         def __bool__(self):
1501                 return True
1502
1503         def __len__(self):
1504                 """
1505                         Returns the number of members in this group
1506                 """
1507                 l = 0
1508
1509                 for attr in ("member", "memberUid"):
1510                         a = self.attributes.get(attr, None)
1511                         if a:
1512                                 l += len(a)
1513
1514                 return l
1515
1516         def __iter__(self):
1517                 return iter(self.members)
1518
1519         @property
1520         def gid(self):
1521                 return self._get_string("cn")
1522
1523         @property
1524         def description(self):
1525                 return self._get_string("description")
1526
1527         @property
1528         def email(self):
1529                 return self._get_string("mail")
1530
1531         @lazy_property
1532         def members(self):
1533                 members = []
1534
1535                 # Get all members by DN
1536                 for dn in self._get_strings("member"):
1537                         member = self.backend.accounts.get_by_dn(dn)
1538                         if member:
1539                                 members.append(member)
1540
1541                 # Get all members by UID
1542                 for uid in self._get_strings("memberUid"):
1543                         member = self.backend.accounts.get_by_uid(uid)
1544                         if member:
1545                                 members.append(member)
1546
1547                 return sorted(members)
1548
1549         def add_member(self, account):
1550                 """
1551                         Adds a member to this group
1552                 """
1553                 # Do nothing if this user is already in the group
1554                 if account.is_member_of_group(self.gid):
1555                         return
1556
1557                 if "posixGroup" in self.objectclasses:
1558                         self._add_string("memberUid", account.uid)
1559                 else:
1560                         self._add_string("member", account.dn)
1561
1562                 # Append to cached list of members
1563                 self.members.append(account)
1564                 self.members.sort()
1565
1566         def del_member(self, account):
1567                 """
1568                         Removes a member from a group
1569                 """
1570                 # Do nothing if this user is not in the group
1571                 if not account.is_member_of_group(self.gid):
1572                         return
1573
1574                 if "posixGroup" in self.objectclasses:
1575                         self._delete_string("memberUid", account.uid)
1576                 else:
1577                         self._delete_string("member", account.dn)
1578
1579
1580 if __name__ == "__main__":
1581         a = Accounts()
1582
1583         print(a.list())