midpoint-cli 1.6.0.dev3__py3-none-any.whl

midpoint_cli/prompt/user.py

@@ -0,0 +1,406 @@
+import getpass
+import os
+import sys
+from argparse import ArgumentParser, Namespace, RawTextHelpFormatter
+from typing import Any
+
+from midpoint_cli.client import (
+    MidpointObjectList,
+    MidpointObjectType,
+    MidpointObjectTypes,
+    MidpointOrganization,
+    MidpointRole,
+    MidpointServerError,
+    MidpointShadow,
+    MidpointUser,
+)
+from midpoint_cli.client.objects import MidpointObject
+
+# User command wrapper parser
+from midpoint_cli.prompt.base import PromptBase, add_listing_arguments
+from midpoint_cli.prompt.complete import ROLE, USER, completes
+from midpoint_cli.prompt.console import (
+    create_table,
+    get_console,
+    is_machine_output,
+    print_details,
+    print_error,
+    print_info,
+    print_rows,
+)
+
+user_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user',
+    description='Manage server users.',
+    epilog="""
+Available commands:
+  ls       List all users.
+  search   Search for a user.
+  get      Get user details by OID or name.
+  assign   Assign a role, org, archetype or service to a user.
+  unassign Remove a role, org, archetype or service assignment from a user.
+  enable   Enable users.
+  disable  Disable users.
+  passwd   Set the password of a user.
+""",
+)
+user_parser.add_argument('command', help='User command to execute.')
+user_parser.add_argument('arg', help='Optional command arguments.', nargs='*')
+
+user_ls_parser = add_listing_arguments(
+    ArgumentParser(
+        formatter_class=RawTextHelpFormatter,
+        prog='user ls',
+        description='List users.',
+    ),
+    'users',
+)
+
+# User search parser
+
+user_search_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user search',
+    description='Search for users by substring of their name, full name or email address, ignoring case.\n'
+    'Terms are combined with OR. Prefix a term with + to make it mandatory (AND).',
+)
+user_search_parser.add_argument(
+    'searchquery',
+    help='String fragments to search in user data. Use +term to require a match (AND); plain terms are optional (OR).',
+    nargs='+',
+)
+
+user_get_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user get',
+    description='Search for users by OID.',
+)
+completes(user_get_parser.add_argument('oid', help='An OID or name value.'), USER)
+
+# The assignment target types `user assign/unassign` accept, by option.
+ASSIGNMENT_TARGET_TYPES: dict[str, tuple[MidpointObjectType, str]] = {
+    'role': (MidpointObjectTypes.ROLE.value, 'Role'),
+    'org': (MidpointObjectTypes.ORG.value, 'Org'),
+    'archetype': (MidpointObjectTypes.ARCHETYPE.value, 'Archetype'),
+    'service': (MidpointObjectTypes.SERVICE.value, 'Service'),
+}
+
+
+def _assignment_parser(prog: str, description: str) -> ArgumentParser:
+    parser = ArgumentParser(
+        formatter_class=RawTextHelpFormatter,
+        prog=prog,
+        description=description,
+        epilog='The target is a role unless --org, --archetype or --service says otherwise.',
+    )
+    completes(parser.add_argument('user', help='User OID or name.'), USER)
+    completes(
+        parser.add_argument('target', help='Role (or org, archetype, service) OID or name.'),
+        ROLE,
+    )
+    target_type = parser.add_mutually_exclusive_group()
+    for option in ASSIGNMENT_TARGET_TYPES:
+        article = 'an' if option[0] in 'aeiou' else 'a'
+        target_type.add_argument(
+            f'--{option}',
+            dest='target_type',
+            action='store_const',
+            const=option,
+            help=f'The target is {article} {option}.',
+        )
+    parser.set_defaults(target_type='role')
+    return parser
+
+
+user_assign_parser = _assignment_parser('user assign', 'Assign a role, org, archetype or service to a user.')
+user_unassign_parser = _assignment_parser(
+    'user unassign', 'Remove the assignment of a role, org, archetype or service from a user.'
+)
+
+user_enable_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user enable',
+    description='Enable users: set their administrative status to enabled.',
+)
+completes(user_enable_parser.add_argument('user', help='User OID or name.', nargs='+'), USER)
+
+user_disable_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user disable',
+    description='Disable users: set their administrative status to disabled.',
+)
+completes(user_disable_parser.add_argument('user', help='User OID or name.', nargs='+'), USER)
+
+user_passwd_parser = ArgumentParser(
+    formatter_class=RawTextHelpFormatter,
+    prog='user passwd',
+    description='Set the password of a user.',
+    epilog='On a terminal, the new password is asked twice and not echoed. Otherwise it is read from\n'
+    'the first line of standard input, e.g. printf \'%s\\n\' "$PW" | midpoint-cli user passwd jdoe\n'
+    '(in a command script piped to midpoint-cli, the line after the command).\n'
+    'The password is never printed or logged; the server checks it against its password policy.',
+)
+completes(user_passwd_parser.add_argument('user', help='User OID or name.'), USER)
+user_passwd_parser.add_argument(
+    '--password-env',
+    metavar='VAR',
+    help='Read the new password from the environment variable VAR instead.',
+)
+
+# Each subcommand with its parser; None for those taking no arguments.
+user_subparsers: dict[str, ArgumentParser | None] = {
+    'ls': user_ls_parser,
+    'search': user_search_parser,
+    'get': user_get_parser,
+    'assign': user_assign_parser,
+    'unassign': user_unassign_parser,
+    'enable': user_enable_parser,
+    'disable': user_disable_parser,
+    'passwd': user_passwd_parser,
+}
+
+# The records shown with a user, by key in the machine formats, with their table title and columns.
+USER_SECTION_TITLES = {'Roles': 'Role Assignments', 'Orgs': 'Org Memberships', 'Projections': 'Projections'}
+USER_SECTION_COLUMNS: dict[str, tuple[str, ...]] = {
+    'Roles': ('OID', 'Name', 'Status'),
+    'Orgs': ('OID', 'Name', 'Status'),
+    'Projections': ('Shadow OID', 'Resource', 'Account Name', 'Kind', 'Intent'),
+}
+_SECTION_COLUMN_STYLES = {
+    'OID': 'blue',
+    'Shadow OID': 'blue',
+    'Name': 'bright_cyan',
+    'Resource': 'bright_cyan',
+    'Account Name': 'bright_cyan',
+}
+
+
+def _text(value: object) -> str:
+    return '' if value is None else str(value)
+
+
+def _assignment_row(target: MidpointObject) -> dict[str, str]:
+    """A role or org of a user, as a row of its section."""
+    return {
+        'OID': _text(target.get('OID')),
+        'Name': _text(target.get('DisplayName') or target.get('Name')),
+        'Status': _text(target.get('Status')),
+    }
+
+
+def _projection_row(shadow: MidpointShadow) -> dict[str, str]:
+    """A shadow linked to a user, as a row of the Projections section."""
+    return {
+        'Shadow OID': _text(shadow.get('OID')),
+        'Resource': _text(shadow.get('ResourceName') or shadow.get('ResourceOID')),
+        'Account Name': _text(shadow.get('Name')),
+        'Kind': _text(shadow.get('Kind')),
+        'Intent': _text(shadow.get('Intent')),
+    }
+
+
+def user_details(user: MidpointUser, sections: dict[str, list[dict[str, str]]]) -> dict[str, Any]:
+    """A user as one detail object: its OID, every attribute shown in the table, then its sections.
+
+    An attribute present several times (a multi-valued property) becomes a list of values.
+    """
+    details: dict[str, Any] = {'OID': user.get_oid()}
+    for name, value in user.get_all_attributes():
+        if name not in details:
+            details[name] = value
+        elif isinstance(details[name], list):
+            details[name].append(value)
+        else:
+            details[name] = [details[name], value]
+    details.update(sections)
+    return details
+
+
+class UserClientPrompt(PromptBase):
+    subparsers_user = user_subparsers
+
+    def do_user(self, inp: str) -> None:
+        """Manage users (subcommands: ls, search, get, assign, unassign, enable, disable, passwd)."""
+        self._dispatch_subcommand(
+            inp,
+            user_parser,
+            user_subparsers,
+            {
+                'ls': self._user_ls,
+                'search': self._user_search,
+                'get': self._user_get,
+                'assign': lambda args: self._assignment(True, user_assign_parser.parse_args(args)),
+                'unassign': lambda args: self._assignment(False, user_unassign_parser.parse_args(args)),
+                'enable': lambda args: self._set_enabled(True, user_enable_parser.parse_args(args).user),
+                'disable': lambda args: self._set_enabled(False, user_disable_parser.parse_args(args).user),
+                'passwd': self._user_passwd,
+            },
+        )
+
+    def _user_ls(self, args: list[str]) -> None:
+        ls_ns = user_ls_parser.parse_args(args)
+        self.print_users(self.client.get_users(limit=ls_ns.limit, name_filter=ls_ns.filter))
+
+    def _user_search(self, args: list[str]) -> None:
+        search_ns = user_search_parser.parse_args(args)
+        self.print_users(self.client.search_users(search_ns.searchquery))
+
+    def _user_get(self, args: list[str]) -> None:
+        get_ns = user_get_parser.parse_args(args)
+        user = self.client.get_user(self.client.resolve_oid(MidpointObjectTypes.USER.value, get_ns.oid))
+
+        roles: list[MidpointRole] = []
+        for oid in user.get_role_assignment_oids():
+            try:
+                roles.append(self.client.get_role(oid))
+            except MidpointServerError:
+                roles.append(MidpointRole.error_stub(oid))
+
+        orgs: list[MidpointOrganization] = []
+        for oid in user.get_org_assignment_oids():
+            try:
+                orgs.append(self.client.get_org(oid))
+            except MidpointServerError:
+                orgs.append(MidpointOrganization.error_stub(oid))
+
+        shadows: list[MidpointShadow] = []
+        for oid in user.get_link_ref_oids():
+            try:
+                shadow = self.client.get_shadow(oid)
+                resource_oid = shadow.get('ResourceOID')
+                if resource_oid:
+                    try:
+                        resource = self.client.get_resource(resource_oid)
+                        shadow['ResourceName'] = resource.get('Name') or resource_oid
+                    except MidpointServerError:
+                        shadow['ResourceName'] = resource_oid
+                shadows.append(shadow)
+            except MidpointServerError:
+                shadows.append(MidpointShadow.error_stub(oid))
+
+        self.print_user(user, roles=roles, orgs=orgs, shadows=shadows)
+
+    def _user_passwd(self, args: list[str]) -> None:
+        passwd_ns = user_passwd_parser.parse_args(args)
+        oid = self.client.resolve_oid(MidpointObjectTypes.USER.value, passwd_ns.user)
+        password = self._read_new_password(passwd_ns.password_env)
+        if password is None:
+            return
+        self.client.set_user_password(oid, password)
+        print_info(f'Password of user {passwd_ns.user} changed')
+
+    def _assignment(self, assign: bool, ns: Namespace) -> None:
+        """user assign/unassign: add or remove the assignment of a role, org, archetype or service."""
+        target_type, label = ASSIGNMENT_TARGET_TYPES[ns.target_type]
+        user_obj = self._require_object(MidpointObjectTypes.USER.value, ns.user, 'User')
+        if user_obj is None:
+            return
+        target_obj = self._require_object(target_type, ns.target, label)
+        if target_obj is None:
+            return
+        user_oid = user_obj.get_oid()
+        target_oid = target_obj.get_oid()
+        if user_oid is None or target_oid is None:
+            raise AssertionError
+        if assign:
+            self.client.assign(user_oid, target_type, target_oid)
+            print_info(f"{label} '{target_obj.get_name()}' assigned to '{user_obj.get_name()}'")
+        else:
+            self.client.unassign(user_oid, target_type, target_oid)
+            print_info(f"{label} '{target_obj.get_name()}' unassigned from '{user_obj.get_name()}'")
+
+    def _set_enabled(self, enabled: bool, references: list[str]) -> None:
+        """user enable/disable: set the administrative status of each user, reporting each failure."""
+        for reference in references:
+            user_obj = self._find_reference(MidpointObjectTypes.USER.value, reference, 'User')
+            if user_obj is None:
+                continue
+            user_oid = user_obj.get_oid()
+            if user_oid is None:
+                raise AssertionError
+            try:
+                self.client.set_user_enabled(user_oid, enabled)
+                print_info(f"User '{user_obj.get_name()}' {'enabled' if enabled else 'disabled'}")
+            except MidpointServerError as e:
+                self._fail()
+                print_error(str(e))
+
+    def _read_new_password(self, environment_variable: str | None) -> str | None:
+        """The new password for user passwd, or None after setting the error. It is never echoed."""
+        if environment_variable is not None:
+            password = os.environ.get(environment_variable)
+            if password is None:
+                self._fail(f'Environment variable {environment_variable} is not set; password not changed')
+                return None
+        elif sys.stdin.isatty():
+            password = getpass.getpass('New password: ')
+            if getpass.getpass('Retype new password: ') != password:
+                self._fail('The passwords do not match; password not changed')
+                return None
+        else:
+            line = sys.stdin.readline()
+            if not line:
+                self._fail('No password on standard input; password not changed')
+                return None
+            password = line.rstrip('\r\n')
+        if not password:
+            self._fail('Empty password refused; password not changed')
+            return None
+        return password
+
+    @staticmethod
+    def print_user(
+        user: MidpointUser,
+        roles: list[MidpointRole],
+        orgs: list[MidpointOrganization],
+        shadows: list[MidpointShadow],
+    ) -> None:
+        """Print a single user's details with related records, in the selected output format."""
+        sections = {
+            'Roles': [_assignment_row(role) for role in roles],
+            'Orgs': [_assignment_row(org) for org in orgs],
+            'Projections': [_projection_row(shadow) for shadow in shadows],
+        }
+        if is_machine_output():
+            print_details([user_details(user, sections)], as_list=False)
+            return
+
+        console = get_console()
+        table = create_table(title='User Details')
+        table.add_column('Attribute', style='cyan')
+        table.add_column('Value', style='white')
+
+        for attr in user.get_all_attributes():
+            table.add_row(str(attr[0]), str(attr[1]))
+
+        console.print(table)
+
+        for key, title in USER_SECTION_TITLES.items():
+            section_table = create_table(title=title)
+            columns = USER_SECTION_COLUMNS[key]
+            for column in columns:
+                section_table.add_column(column, style=_SECTION_COLUMN_STYLES.get(column, 'white'))
+            for row in sections[key]:
+                section_table.add_row(*(row[column] for column in columns))
+            if not sections[key]:
+                # '(none)' in the name column.
+                section_table.add_row(*('(none)' if 'Name' in column else '' for column in columns))
+            console.print(section_table)
+
+    @staticmethod
+    def print_users(users: MidpointObjectList) -> None:
+        """Print a list of users in the selected output format."""
+        print_rows(users, title='Server Users', noun='users')
+
+    @staticmethod
+    def help_user() -> None:
+        user_parser.print_help()
+
+    def do_users(self, inp: str) -> None:
+        """Shortcut for 'user ls' — list all users."""
+        self._list_shortcut(inp, 'users', 'user', self.do_user)
+
+    @staticmethod
+    def help_users() -> None:
+        print('List all server users. This is a shortcut for "user ls"')