sessions: Drop impersonation feature

It was nice, but hopefully won't be needed any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/src/buildservice/sessions.py b/src/buildservice/sessions.py
index 0b87ae69f62af72f5172da18e9018cbd69fecd5b..b3a1a136b26f8120372d8a271cc1032908b91aa8 100644 (file)
--- a/src/buildservice/sessions.py
+++ b/src/buildservice/sessions.py
@@ -68,11 +68,6 @@ class Session(base.DataObject):
        def user(self):
                return self.backend.users.get_by_id(self.data.user_id)
 
-       @lazy_property
-       def impersonated_user(self):
-               if self.data.impersonated_user_id:
-                       return self.backend.users.get_by_id(self.data.impersonated_user_id)
-
        @property
        def created_at(self):
                return self.data.created_at
@@ -88,15 +83,3 @@ class Session(base.DataObject):
        @property
        def user_agent(self):
                return self.data.user_agent
-
-       def start_impersonation(self, user):
-               if not self.user.is_admin():
-                       raise RuntimeError("Only admins can impersonate other users")
-
-               if self.user == user:
-                       raise RuntimeError("You cannot impersonate yourself")
-
-               self._set_attribute("impersonated_user_id", user.id)
-
-       def stop_impersonation(self):
-               self._set_attribute("impersonated_user_id", None)

diff --git a/src/database.sql b/src/database.sql
index 7e60f3df59a63b8a98603a31e6e2717e4889e5a0..565d294dbfa609940f0d3a32eca4241060c94c87 100644 (file)
--- a/src/database.sql
+++ b/src/database.sql
@@ -1187,10 +1187,8 @@ CREATE TABLE public.sessions (
     created_at timestamp without time zone DEFAULT now() NOT NULL,
     valid_until timestamp without time zone DEFAULT (now() + '7 days'::interval) NOT NULL,
     user_id integer NOT NULL,
-    impersonated_user_id integer,
     address inet,
-    user_agent text,
-    CONSTRAINT sessions_impersonation_check CHECK (((impersonated_user_id IS NULL) OR (user_id <> impersonated_user_id)))
+    user_agent text
 );
 
 
@@ -2617,14 +2615,6 @@ ALTER TABLE ONLY public.repositories
     ADD CONSTRAINT repositories_parent_id FOREIGN KEY (parent_id) REFERENCES public.repositories(id);
 
 
---
--- Name: sessions sessions_impersonated_user_id; Type: FK CONSTRAINT; Schema: public; Owner: pakfire
---
-
-ALTER TABLE ONLY public.sessions
-    ADD CONSTRAINT sessions_impersonated_user_id FOREIGN KEY (impersonated_user_id) REFERENCES public.users(id);
-
-
 --
 -- Name: sessions sessions_user_id; Type: FK CONSTRAINT; Schema: public; Owner: pakfire
 --

diff --git a/src/web/__init__.py b/src/web/__init__.py
index 5219c492efa8b5161996394dc6da643257fa7fbf..b34874e797d2fb8f91f4cd91e910dbe057d93ae2 100644 (file)
--- a/src/web/__init__.py
+++ b/src/web/__init__.py
@@ -123,7 +123,6 @@ class Application(tornado.web.Application):
                                repos.EditHandler),
                        (r"/users/(?P<user_slug>\w+)/repos/(?P<repo_slug>[A-Za-z0-9\-]+)/mirrorlist",
                                repos.MirrorlistHandler),
-                       (r"/user/(\w+)/impersonate", users.UserImpersonateHandler),
                        (r"/user/(\w+)/delete", users.UserDeleteHandler),
                        (r"/user/(\w+)/edit", users.UserEditHandler),
                        (r"/profile/builds", users.UsersBuildsHandler),

diff --git a/src/web/auth.py b/src/web/auth.py
index 6ba06c27b7694acc6db52c2cfd82b3dc5b0bda7a..4b6245bf03cc9fca57961331b1820016f04ae20c 100644 (file)
--- a/src/web/auth.py
+++ b/src/web/auth.py
@@ -44,16 +44,11 @@ class LogoutHandler(base.BaseHandler):
        def get(self):
                # Destroy the user's session.
                with self.db.transaction():
-                       # If impersonating, we will just stop the impersonation
-                       if self.session.impersonated_user:
-                               self.session.stop_impersonation()
+                       # Destroy the session
+                       self.session.destroy()
 
-                       # Otherwise we destroy the session
-                       else:
-                               self.session.destroy()
-
-                               # Remove the session cookie
-                               self.clear_cookie("session_id")
+               # Remove the session cookie
+               self.clear_cookie("session_id")
 
                # Redirect the user to the front page.
                self.redirect("/")

diff --git a/src/web/base.py b/src/web/base.py
index 859b9c9a1b668828c00f065e296b548709cc6fa4..91fd7f5500a87f145ed212220757ca186bf2fe55 100644 (file)
--- a/src/web/base.py
+++ b/src/web/base.py
@@ -31,7 +31,7 @@ class BaseHandler(tornado.web.RequestHandler):
 
        def get_current_user(self):
                if self.session:
-                       return self.session.impersonated_user or self.session.user
+                       return self.session.user
 
        def get_user_locale(self):
                # Get the locale from the user settings

diff --git a/src/web/users.py b/src/web/users.py
index f2b20cbf19716d5b5f880bde93f43cc441bdac67..bf576c62e8cf27d889dbed80ed9f5496fe54ed43 100644 (file)
--- a/src/web/users.py
+++ b/src/web/users.py
@@ -14,37 +14,6 @@ class ShowHandler(base.BaseHandler):
                self.render("users/show.html", user=user)
 
 
-class UserImpersonateHandler(base.BaseHandler):
-       @tornado.web.authenticated
-       def get(self, username):
-               # You must be an admin to do this.
-               if not self.current_user.is_admin():
-                       raise tornado.web.HTTPError(403, "You are not allowed to do this")
-
-               user = self.backend.users.get_by_name(username)
-               if not user:
-                       raise tornado.web.HTTPError(404, "User not found: %s" % username)
-
-               self.render("user-impersonation.html", user=user)
-
-       @tornado.web.authenticated
-       def post(self, username):
-               # You must be an admin to do this.
-               if not self.current_user.is_admin():
-                       raise tornado.web.HTTPError(403, "You are not allowed to do this")
-
-               user = self.backend.users.get_by_name(username)
-               if not user:
-                       raise tornado.web.HTTPError(404, "User not found: %s" % username)
-
-               # Start impersonation
-               with self.db.transaction():
-                       self.session.start_impersonation(user)
-
-               # Redirect to start page.
-               self.redirect("/")
-
-
 class UserActionHandler(base.BaseHandler):
        def get_user(self, name):
                user = self.backend.users.get_by_name(name)