OwlCyberSecurity - MANAGER
Edit File: delegates.pyc
� �t�ac @ s6 d Z d d l m Z m Z d d l m Z m Z m Z m Z d d l m Z d d l m Z d d l m Z d d l m Z m Z m Z d d l m Z m Z d d l m Z m Z e � Z d e f d � � YZ d e f d � � YZ d � Z d � Z d e f d � � YZ d e f d � � YZ e � Z! d S( s Delegate assignments i����( t Namest NamedConstant( t inlineCallbackst returnValuet succeedt DeferredList( t config( t Memcacher( t Logger( t RecordTypet FieldNamet NotAllowedError( t DirectoryServicet DirectoryRecord( t MatchExpressiont MatchTypeR c B sV e Z d Z e � Z d e _ e � Z d e _ e � Z d e _ e � Z d e _ RS( sJ Constants for read-only delegates and read-write delegate groups u read-delegate-groupu write-delegate-groupu read-delegator-groupu write-delegator-group( t __name__t __module__t __doc__R t readDelegateGroupt descriptiont writeDelegateGroupt readDelegatorGroupt writeDelegatorGroup( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR * s R c B sS e Z e e d � � Z e e d � � Z d � Z e d � � Z e d � � Z RS( c # sp � j j d � \ } } � j j j | � V� t � � � f d � � } � j j j d | � V} t | � d S( s1 If this is a readDelegateGroup or writeDelegateGroup, the result will consist of the UIDs who are delegates *of* this record. If this is a readDelegatorGroup or writeDelegatorGroup, the results will consist of the UIDs who have delegated *to* this record. u #c 3 s� � j t j t j f k rL � j t j k } t j | � | d � �V} n( � j t j k } t j | � | � V} t | � d S( Nt expanded( t recordTypeR R R t Delegatest _delegatesOfUIDsR t _delegatedToUIDsR ( t txnt readWritet delegateUIDs( R t parentRecordt self( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _membersJ s s DirectoryRecord.membersN( t uidt splitt servicet _masterDirectoryt recordWithUIDR t _storet inTransactionR ( R! R t parentUIDt _ignore_proxyTypeR" R ( ( R R R! s& /opt/cpanel-ccs/txdav/who/delegates.pyt _membersUIDs> s c c s� | j j d � \ } } | j d | � V} g } xO | D]G } | | k r8 | j j j | � V} | d k r | j | � q q8 q8 Wt | � d S( s8 If this is a readDelegateGroup or writeDelegateGroup, the members will consist of the records who are delegates *of* this record. If this is a readDelegatorGroup or writeDelegatorGroup, the members will consist of the records who have delegated *to* this record. u #R N( R# R$ R, R% R& R' t Nonet appendR ( R! R R* R+ R t recordsR# t record( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt members] s c C s | j d t � S( NR ( R1 t True( R! ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt expandedMembersr s c # s� | j t j t j f k r* t d � � n | j j d � \ } } | j t j k � t j d d | d � rr d n d d g � D] } | j ^ q �| j j j | � V� � � � f d � } | j j j d | � Vd S( s� Replace the members of this group with the new members. @param memberRecords: The new members of the group @type memberRecords: iterable of L{iDirectoryRecord}s s Setting members not supportedu #s2 Setting delegate assignments for {u} ({rw}) to {m}t ut rwt writet readt mc s t j | � � � � S( N( R t setDelegates( R ( t delegatort memberRecordsR ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _setMembers� s s DirectoryRecord.setMembersN( R R R R R R# R$ t logt infoR% R& R' R( R) ( R! R; R* R+ t rR< ( ( R: R; R s& /opt/cpanel-ccs/txdav/who/delegates.pyt setMembersu s c c s' | j d t � V} t | | k � d S( s� Is the supplied UID an expanded member of this proxy group. @param uid: UID to test @type uid: L{str} @return: result @rtype: L{bool} R N( R, R2 R ( R! R# R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt containsUID� s ( R R R t FalseR, R1 R3 R@ RA ( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR < s !c C s8 i d t j 6d t j 6d t j 6d t j 6j | d � S( Ns calendar-proxy-reads calendar-proxy-writes calendar-proxy-read-fors calendar-proxy-write-for( R R R R R t getR- ( R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt recordTypeToProxyType� s c C s8 i t j d 6t j d 6t j d 6t j d 6j | d � S( Ns calendar-proxy-reads calendar-proxy-writes calendar-proxy-read-fors calendar-proxy-write-for( R R R R R RC R- ( t proxyType( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt proxyTypeToRecordType� s R c B sY e Z d Z e Z d � Z d � Z d d � Z d d � Z e d d d d d � � Z RS( s$ Delegate directory service c C s& t j | | � | | _ d | _ d S( N( t BaseDirectoryServicet __init__R( R- R& ( R! t realmNamet store( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRH � s c C s | | _ d S( N( R& ( R! t masterDirectory( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt setMasterDirectory� s c C sN | d t | � } t | i | t j 6| t j 6| f t j 6� } t | � S( Nt #( RD R R R# R t shortNamesR ( R! R t shortNamet timeoutSecondsR# R0 ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt recordWithShortName� s c C sc d | k r t d � S| j d � \ } } t | � } | d k rM t d � S| j | | d | �S( NRM RP ( R R- R$ RF RQ ( R! R# RP RE R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR' � s c c s� t | t � r} | j t j k r} | j t j k r} d | j k r} | j | j d | �V} | d k rz t | f � qz q} n t d � d S( sY It's only ever appropriate to look up delegate group record by shortName or uid. When wrapped by an aggregate directory, looking up by shortName will already go directly to recordWithShortName. However when looking up by UID, it won't. Inspect the expression to see if it's one we can handle. RM RP N( ( t isinstanceR t fieldNameR R# t matchTypeR t equalst fieldValueR' R- R ( R! t expressiont recordTypesR/ t limitResultsRP R0 ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt recordsFromExpression� s N( R R R R R RH RL R- RQ R' R RZ ( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR � s t CachingDelegatesc B s� e Z d Z d Z d e f d � � YZ d � Z e d � � Z e d � � Z e d � � Z e d � � Z e e d � � Z e d � � Z e e d � � Z e e d � � Z d � Z e d � Z e d � � Z e d � � Z e d � � Z RS( sT Manages access to the store's delegates API, including caching of results. t DelegatesMemcacherc B s� e Z d � Z d � Z d � Z d � Z d � Z d � Z e d � � Z e d � � Z e d � � Z e d � � Z e d � � Z RS( c C s# t t j | � j | d t �d S( Nt key_normalization( t superR[ R\ RH R2 ( R! t namespace( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRH � s c C s7 d j | | r d n d | j d � | r0 d n d � S( Ns {}{}:{}#{}s -expandedt s utf-8R6 R7 ( t formatt encode( R! t keynameR# R R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _key s c C s | j d | | | � S( NR1 ( Rd ( R! R# R R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _membersKey s c C s | j d | | t � S( Nt memberships( Rd RB ( R! R# R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _membershipsKey s c C s1 | j | j | | | � d j | � j d � � S( Nt ,s utf-8( t setRe t joinRb ( R! R# R R1 R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR@ s c C s. | j | j | | � d j | � j d � � S( NRh s utf-8( Ri Rg Rj Rb ( R! R# R Rf ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt setMemberships s c C s= | r" t | j d � j d � � S| d k r2 d St � Sd S( Ns utf-8Rh ( Ri t decodeR$ R- ( t value( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt _value_decode s c c s6 | j | j | | | � � V} t | j | � � d S( N( RC Re R Rn ( R! R# R R Rm ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt getMembers% s c c s3 | j | j | | � � V} t | j | � � d S( N( RC Rg R Rn ( R! R# R Rm ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt getMemberships* s c c s> | j | j | | t � � V| j | j | | t � � Vd S( sD Delete both the regular and expanded keys. N( t deleteRe RB R2 ( R! R# R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt deleteMember/ s c c s | j | j | | � � Vd S( sD Delete both the regular and expanded keys. N( Rq Rg ( R! R# R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt deleteMembership7 s ( R R RH Rd Re Rg R@ Rk t staticmethodRn R Ro Rp Rr Rs ( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR\ � s c C s t j d � | _ d S( Nt DelegatesDB( R[ R\ t _memcacher( R! ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRH > s c c s� | j | | | � V} | j � r� x5 t | � t | � D] } | j | | | | � Vq9 WxO t | � t | � D] } | j | | | | � Vqq Wn | j | | | | � Vd S( s& Sets the full set of delegates for a delegator. We need to take multiple pods into account by re-directing this request to the cross-pod conduit if the delegator is not local to this pod. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param delegates: the delegates directory records @type delegates: L{list}} of L{IDirectoryRecord} @param readWrite: if True, read and write access is granted; read-only access otherwise N( t delegatesOft thisServerRi t removeDelegatet addDelegatet _podSetDelegates( R! R R: t delegatesR t existingDelegatest delegate( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR9 A s c c sO | j | j k r t d � n | j | | | d t �V} | j t j k r} | j | j � V} | j | j | j | � Vn | j | j | j | � V| j d k r� | j j d j | j � � V| j j d j | j � � Vn | j j | j | � V| j | | | d t �V} x2 t | � t | � D] } | j j | | � Vq-Wd S( s� Adds "delegate" as a delegate of "delegator". The type of access is specified by the "readWrite" parameter. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param delegate: the delegate's directory record @type delegate: L{IDirectoryRecord} @param readWrite: if True, read and write access is granted; read-only access otherwise R s /principals/__uids__/{}/N( R# R R- R R2 R t BaseRecordTypet groupt groupByUIDt addDelegateGroupt groupIDRz t cacheNotifiert changedRa Rv Rr Ri Rs ( R! R R: R~ R t existingDelegateUIDsR� t newDelegateUIDsR# ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRz \ s c c sO | j | j k r t d � n | j | | | d t �V} | j t j k r} | j | j � V} | j | j | j | � Vn | j | j | j | � V| j d k r� | j j d j | j � � V| j j d j | j � � Vn | j j | j | � V| j | | | d t �V} x2 t | � t | � D] } | j j | | � Vq-Wd S( s� Removes "delegate" as a delegate of "delegator". The type of access is specified by the "readWrite" parameter. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param delegate: the delegate's directory record @type delegate: L{IDirectoryRecord} @param readWrite: if True, read and write access is revoked; read-only access otherwise R s /principals/__uids__/{}/N( R# R R- R R2 R R R� R� t removeDelegateGroupR� Ry R� R� Ra Rv Rr Ri Rs ( R! R R: R~ R R� R� R� R# ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRy � s c c s� t � } x. t t f D] } | j | j | | � V� q Wx6 | D]. } | j j | t � V| j j | t � VqA Wx: | | BD]. } | j j | t � V| j j | t � Vq~ Wd S( s� A group has changed. We need to see which delegators might be using this group and invalidate caches. @param groupID: group id of group that changed @type groupID: L{str} @param addedUIDs: set of new member UIDs added to the group @type addedUIDs: L{set} of L{str} @param removedUIDs: set of old member UIDs removed from the group @type removedUIDs: L{set} of L{str} N( Ri R2 RB t updatet delegatorsToGroupRv Rr Rs ( R! R R� t addedUIDst removedUIDst delegatorsR R: R~ ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt groupChanged� s c c s� | j | | | | � V} g } | j } xL | D]D } | | j k r/ | j | � V} | d k rs | j | � qs q/ q/ Wt | � d S( s� Return the records of the delegates of "delegator". The type of access is specified by the "readWrite" parameter. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param readWrite: if True, read and write access delegates are returned; read-only access otherwise @return: the set of directory records @rtype: a Deferred which fires a set of L{IDirectoryRecord} N( R R% R# R' R- R. R ( R! R R: R R R R/ t directoryR# R0 ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyRw � s c c s� | j | | | � V} g } | j } xL | D]D } | | j k r, | j | � V} | d k rp | j | � qp q, q, Wt | � d S( s� Return the records of those who have delegated to "delegate". The type of access is specified by the "readWrite" parameter. @param delegate: the delegate's directory record @type delegate: L{IDirectoryRecord} @param readWrite: if True, read and write access delegators are returned; read-only access otherwise @return: the set of directory records @rtype: a Deferred which fires a set of L{IDirectoryRecord} N( R R% R# R' R- R. R ( R! R R~ R t delegatorUIDsR/ R� R# R0 ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt delegatedTo� s c c s� | j j | j | | � V} | d k rW t j d d | j d | d | �t | � n t j d d | j d | d | �| j � r� | j | j | d | �V} | j j | j | | | � Vn | j | | | d | �V} t | � d S( sp Return the UIDs of the delegates of "delegator". The type of access is specified by the "readWrite" parameter. We need to take multiple pods into account by re-directing this request to the cross-pod conduit if the delegator is not local to this pod. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param readWrite: if True, read and write access delegates are returned; read-only access otherwise @return: the set of directory record uids @rtype: a Deferred which fires a set of L{str} sR _delegatesOfUIDs cached for: {uid} and read-write = {rw} and expanded = {expanded}R# R5 R sK _delegatesOfUIDs for: {uid} and read-write = {rw} and expanded = {expanded}N( Rv Ro R# R- R= t debugR Rx R| R@ t _podDelegates( R! R R: R R R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR � s " " c c s� | j j | j | � V} | d k rN t j d d | j d | �t | � n t j d d | j d | �| j | j | � V} | r� t j j r� | j | j | | | � V� n | j j | j | | � Vt | � d S( s8 Return the UIDs of those who have delegated to "delegate". The type of access is specified by the "readWrite" parameter. We need to take multiple pods into account by re-directing this request to the cross-pod conduit if the delegate is not local to this pod. @param delegate: the delegate's directory record @type delegate: L{IDirectoryRecord} @param readWrite: if True, read and write access delegators are returned; read-only access otherwise @param onlyThisServer: used when doing the query as part of a cross-pod request since that should only returns results for this server @type onlyThisServer: L{bool} @return: the set of directory record uids @rtype: a Deferred which fires a set of L{str} s8 _delegatedToUIDs cached for: {uid} and read-write = {rw}R# R5 s1 _delegatedToUIDs for: {uid} and read-write = {rw}N( Rv Rp R# R- R= R� R R� R t Serverst EnabledR� t _podDelegatorsRk ( R! R R~ R t onlyThisServerR� ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR s c C s< | j � j r t d � S| j � j j | | | | � Sd S( s& Sets the full set of delegates for a delegator. We need to take multiple pods into account by re-directing this request to the cross-pod conduit if the delegator is not local to this pod. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param delegates: the delegates directory records @type delegates: L{list}} of L{IDirectoryRecord} @param readWrite: if True, read and write access is granted; read-only access otherwise N( t servert v5R R- RJ t conduitt send_set_delegates( R! R R: R| R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR{ > s c C sa t j d d | j d | d | �| j � j r> t t � � S| j � j j | | | | � Sd S( s� Do a cross-pod request to get the delegates for this delegator. @param delegator: the delegator's directory record @type delegator: L{IDirectoryRecord} @param readWrite: if True, read and write access delegates are returned; read-only access otherwise @return: the set of directory record uids @rtype: a Deferred which fires a set of L{str} sH _podDelegates for: {uid} and read-write = {rw} and expanded = {expanded}R# R5 R N( R= R� R# R� R� R Ri RJ R� t send_get_delegates( R! R R: R R ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR� Q s " c c s� t j d d | j d | �| j � j � j d t � } t | � d k r� t g | j � j � j � D]' } | j � j j | | | | � ^ qh d t �V} n g } t � } x2 | D]* } | r� | d r� | j | d � q� q� Wt | � d S( s� Do a cross-pod request to get the delegators for this delegate. We need to iterate over all other pod servers to get results from each one. @param delegate: the delegate's directory record @type delegate: L{IDirectoryRecord} @param readWrite: if True, read and write access delegates are returned; read-only access otherwise @return: the set of directory record uids @rtype: a Deferred which fires a set of L{str} s/ _podDelegators for: {uid} and read-write = {rw}R# R5 t filter_v5i t consumeErrorsi N( R= R� R# t directoryServicet serversDBt allServersExceptThisR2 t lenR RJ R� t send_get_delegatorsRi R� R ( R! R R~ R t otherServersR� t resultsR� t result( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR� c s C c c s� | j j | t � V| j j | t � V| rE | j | | t � Vn | rb | j | | t � Vn | r | j | | t � Vn | r� | j | | t � Vn d S( sU Invalidate the relevant memcache entries containing delegation info N( Rv Rr RB R2 t deleteMembershipForGroup( R! R t delegatorUIDt readDelegateUIDt writeDelegateUIDt previousReadDelegateUIDt previousWriteDelegateUID( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt invalidateExternalAssignment� s c c s� | r� t j d d | d | �| j j | | � V| j | d t �V} | d k r� | j | j � V} x> | D]3 } t j d d | d | �| j j | | � Vqo Wq� n d S( NsM Invalidating memcached delegate membership for group {group}, r/w={readWrite}R� R t createsK Invalidating memcached delegate membership for user {user}, r/w={readWrite}t user( R= R� Rv Rs R� RB R- t groupMemberUIDsR� ( R! R t groupUIDR R� t uidsR# ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR� � s N( R R R R- R� R R\ RH R R9 Rz Ry R� RB Rw R� R R R{ R� R� R� R� ( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyR[ � s( A '' "$ N(" R t twisted.python.constantsR R t twisted.internet.deferR R R R t twistedcaldav.configR t twistedcaldav.memcacherR t twext.python.logR t twext.who.idirectoryR R R R t twext.who.directoryR RG R t BaseDirectoryRecordt twext.who.expressionR R R= RD RF t objectR[ R ( ( ( s& /opt/cpanel-ccs/txdav/who/delegates.pyt <module> s" " i ?� �