nautobot 2.0.0a2__py3-none-any.whl → 2.0.0b1__py3-none-any.whl

nautobot/users/api/serializers.py

@@ -1,50 +1,33 @@
-from django.contrib.auth import get_user_model
+from django.contrib.auth import authenticate, get_user_model
+from django.contrib.auth.hashers import make_password
 from django.contrib.auth.models import Group
 from django.contrib.contenttypes.models import ContentType
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
 
 from nautobot.core.api import (
     ContentTypeField,
-    SerializedPKRelatedField,
     ValidatedModelSerializer,
 )
 from nautobot.users.models import ObjectPermission, Token
 
-# Not all of these variable(s) are not actually used anywhere in this file, but required for the
-# automagically replacing a Serializer with its corresponding NestedSerializer.
-from .nested_serializers import (  # noqa: F401
-    NestedGroupSerializer,
-    NestedObjectPermissionSerializer,
-    NestedTokenSerializer,
-    NestedUserSerializer,
-)
-
 
 class UserSerializer(ValidatedModelSerializer):
-    url = serializers.HyperlinkedIdentityField(view_name="users-api:user-detail")
-    groups = SerializedPKRelatedField(
-        queryset=Group.objects.all(),
-        serializer=NestedGroupSerializer,
-        required=False,
-        many=True,
-    )
-
     class Meta:
         model = get_user_model()
-        fields = (
-            "id",
-            "url",
-            "username",
-            "password",
-            "first_name",
-            "last_name",
-            "email",
-            "is_staff",
-            "is_active",
-            "date_joined",
-            "groups",
-        )
-        extra_kwargs = {"password": {"write_only": True}}
+        exclude = ["user_permissions"]
+        extra_kwargs = {"password": {"write_only": True, "required": False, "allow_null": True}}
+
+    def validate(self, data):
+        """Handle omission of a password by setting it to the unusable None value."""
+        mock_password = False
+        if "password" not in data and not self.partial:
+            data["password"] = make_password(None)
+            mock_password = True
+        validated_data = super().validate(data)
+        if mock_password:
+            validated_data["password"] = None
+        return validated_data
 
     def create(self, validated_data):
         """
@@ -57,6 +40,23 @@ class UserSerializer(ValidatedModelSerializer):
 
         return user
 
+    def update(self, instance, validated_data):
+        """
+        Extract the password from validated data and set it separately to ensure proper hash generation.
+        """
+        update_password = False
+        if "password" in validated_data:
+            update_password = True
+            password = validated_data.pop("password")
+        elif not self.partial:
+            update_password = True
+            password = None
+        super().update(instance, validated_data)
+        if update_password:
+            instance.set_password(password)
+            instance.save()
+        return instance
+
 
 class GroupSerializer(ValidatedModelSerializer):
     url = serializers.HyperlinkedIdentityField(view_name="users-api:group-detail")
@@ -64,52 +64,42 @@ class GroupSerializer(ValidatedModelSerializer):
 
     class Meta:
         model = Group
-        fields = ("id", "url", "name", "user_count")
+        exclude = ["permissions"]
 
 
 class TokenSerializer(ValidatedModelSerializer):
-    url = serializers.HyperlinkedIdentityField(view_name="users-api:token-detail")
     key = serializers.CharField(min_length=40, max_length=40, allow_blank=True, required=False)
 
     class Meta:
         model = Token
-        fields = ("id", "url", "display", "created", "expires", "key", "write_enabled", "description")
+        exclude = ["user"]
 
     def to_internal_value(self, data):
         data = super().to_internal_value(data)
-        if "key" not in data:
+        if "key" not in data and not self.instance:
             data["key"] = Token.generate_key()
         data["user"] = self.context["request"].user
         return data
 
 
 class ObjectPermissionSerializer(ValidatedModelSerializer):
-    url = serializers.HyperlinkedIdentityField(view_name="users-api:objectpermission-detail")
     object_types = ContentTypeField(queryset=ContentType.objects.all(), many=True)
-    groups = SerializedPKRelatedField(
-        queryset=Group.objects.all(),
-        serializer=NestedGroupSerializer,
-        required=False,
-        many=True,
-    )
-    users = SerializedPKRelatedField(
-        queryset=get_user_model().objects.all(),
-        serializer=NestedUserSerializer,
-        required=False,
-        many=True,
-    )
 
     class Meta:
         model = ObjectPermission
-        fields = (
-            "id",
-            "url",
-            "name",
-            "description",
-            "enabled",
-            "object_types",
-            "groups",
-            "users",
-            "actions",
-            "constraints",
+        fields = "__all__"
+
+
+class UserLoginSerializer(serializers.Serializer):
+    username = serializers.CharField()
+    password = serializers.CharField()
+
+    def validate(self, attrs):
+        user = authenticate(
+            self.context["request"],
+            username=attrs["username"],
+            password=attrs["password"],
         )
+        if not user:
+            raise ValidationError("Invalid login credentials.")
+        return {"user": user}

nautobot/users/api/urls.py

@@ -1,4 +1,4 @@
-from nautobot.core.api import OrderedDefaultRouter
+from nautobot.core.api.routers import OrderedDefaultRouter
 from . import views
 
 

nautobot/users/api/views.py

@@ -1,9 +1,12 @@
-from django.contrib.auth import get_user_model
+from django.contrib.auth import get_user_model, login, logout
 from django.contrib.auth.models import Group
 from django.db.models import Count
+from django.views.decorators.csrf import ensure_csrf_cookie
+from django.utils.decorators import method_decorator
 from drf_spectacular.utils import extend_schema, extend_schema_view, OpenApiTypes
 from rest_framework.authentication import BasicAuthentication
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.decorators import action
+from rest_framework.permissions import AllowAny, IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.routers import APIRootView
 from rest_framework.viewsets import ViewSet
@@ -36,6 +39,39 @@ class UserViewSet(ModelViewSet):
     serializer_class = serializers.UserSerializer
     filterset_class = filters.UserFilterSet
 
+    @action(methods=["GET"], detail=False, url_path="my-profile")
+    def my_profile(self, request):
+        serializer = self.serializer_class(instance=request.user, context={"request": request})
+        return Response(serializer.data)
+
+    @method_decorator(ensure_csrf_cookie)
+    @action(methods=["GET"], detail=False, permission_classes=[AllowAny])
+    def session(self, request):
+        from django.conf import settings as django_settings
+        from nautobot.core.settings_funcs import sso_auth_enabled
+        from social_django.context_processors import backends
+        from django.urls import reverse
+
+        serializer = self.serializer_class(instance=request.user, context={"request": request})
+
+        _backends = []
+        sso_enabled = sso_auth_enabled(django_settings.AUTHENTICATION_BACKENDS)
+
+        social_auth_backends = backends(request)["backends"]
+        if sso_enabled:
+            for backend in social_auth_backends["backends"]:
+                _backends.append(reverse("social:begin", kwargs={"backend": backend}))
+
+        resp = {
+            "user": serializer.data,
+            "logged_in": request.user.is_authenticated,
+            "sso_enabled": sso_enabled,
+            "sso_user": (len(social_auth_backends["associated"]) > 0),
+            "backends": _backends,
+        }
+
+        return Response(resp)
+
 
 @extend_schema_view(
     bulk_destroy=extend_schema(request=BulkOperationIntegerIDSerializer(many=True)),
@@ -63,6 +99,21 @@ class TokenViewSet(ModelViewSet):
         classes = super().authentication_classes
         return classes + [BasicAuthentication]
 
+    # TODO(timizuo): Move authenticate and logout to its own view;
+    #  as it is not proper to be on this.
+    @action(methods=["POST"], detail=False, permission_classes=[AllowAny])
+    def authenticate(self, request):
+        serializer = serializers.UserLoginSerializer(data=request.data, context=self.get_serializer_context())
+        serializer.is_valid(raise_exception=True)
+        user = serializer.validated_data["user"]
+        login(request, user=user)
+        return Response(status=200)
+
+    @action(methods=["GET"], detail=False)
+    def logout(self, request):
+        logout(request)
+        return Response(status=200)
+
     def get_queryset(self):
         """
         Limit users to their own Tokens.

nautobot/users/migrations/0001_initial.py

@@ -14,7 +14,6 @@ import nautobot.core.models.fields
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [

nautobot/users/migrations/0002_token_ordering_by_created.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("users", "0001_initial"),
     ]

nautobot/users/migrations/0003_alter_user_options.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("users", "0002_token_ordering_by_created"),
     ]

nautobot/users/migrations/0004_alter_user_managers.py

@@ -5,7 +5,6 @@ import nautobot.users.models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("users", "0003_alter_user_options"),
     ]

nautobot/users/tests/test_api.py

@@ -1,16 +1,17 @@
 import base64
+from unittest import skip
 from django.contrib.auth import get_user_model
 from django.contrib.auth.models import Group
 from django.contrib.contenttypes.models import ContentType
 from django.urls import reverse
+from django.utils.timezone import now
+from rest_framework import HTTP_HEADER_ENCODING, status
 
-from nautobot.core.testing import APIViewTestCases, APITestCase
+from nautobot.core.testing import APIViewTestCases, APITestCase, get_deletable_objects
 from nautobot.core.utils.data import deepmerge
 from nautobot.users.filters import GroupFilterSet
 from nautobot.users.models import ObjectPermission, Token
 
-from rest_framework import HTTP_HEADER_ENCODING
-
 
 # Use the proper swappable User model
 User = get_user_model()
@@ -18,7 +19,6 @@ User = get_user_model()
 
 class AppTest(APITestCase):
     def test_root(self):
-
         url = reverse("users-api:api-root")
         response = self.client.get(f"{url}?format=api", **self.header)
 
@@ -27,35 +27,107 @@ class AppTest(APITestCase):
 
 class UserTest(APIViewTestCases.APIViewTestCase):
     model = User
-    brief_fields = ["display", "id", "url", "username"]
     validation_excluded_fields = ["password"]
     create_data = [
         {
-            "username": "User_4",
+            "username": "user_4",
             "password": "password4",
+            "is_superuser": True,
+            "is_staff": True,
+            "is_active": False,
+            "first_name": "Fourth",
+            "last_name": "User",
+            "email": "fourth.user@example.com",
+            "config_data": {
+                "tables": {
+                    "CircuitTable": {
+                        "columns": ["cid", "provider", "status", "tags"],
+                    },
+                },
+            },
+            "date_joined": now(),
         },
         {
-            "username": "User_5",
+            "username": "user_5",
             "password": "password5",
         },
         {
-            "username": "User_6",
-            "password": "password6",
+            "username": "user_6",
         },
     ]
 
     @classmethod
     def setUpTestData(cls):
+        user1 = User.objects.create(username="User_1")
+        user1.set_password(None)
+        user1.save()
+        user2 = User.objects.create(username="User_2")
+        user2.set_password(None)
+        user2.save()
+        user3 = User.objects.create(username="User_3")
+        user3.set_password(None)
+        user3.save()
+        group = Group.objects.create(name="Group 22")
+        cls.update_data = {
+            "username": "user_22",
+            "password": "password22",
+            "is_staff": False,
+            "is_superuser": False,
+            "is_active": True,
+            "groups": [group.pk],
+            "config_data": {
+                "tables": {
+                    "ProviderTable": {
+                        "columns": ["name", "asn", "tags"],
+                    },
+                },
+            },
+        }
 
-        User.objects.create(username="User_1")
-        User.objects.create(username="User_2")
-        User.objects.create(username="User_3")
+    def get_deletable_object(self):
+        """Get an instance that can be deleted, being sure not to delete the test user!"""
+        return User.objects.create(username="User_100")
+
+    def test_create_object(self):
+        """Add validation of the password on the created users."""
+        self.maxDiff = None
+        super().test_create_object()
+        for entry in self.create_data:
+            user = User.objects.get(username=entry["username"])
+            if "password" in entry:
+                self.assertTrue(user.check_password(entry["password"]))
+            else:
+                self.assertFalse(user.has_usable_password())
+
+    def test_recreate_object_csv(self):
+        """Add validation that the recreated user has no password."""
+        super().test_recreate_object_csv()
+        user = User.objects.get(username="User_100")
+        self.assertFalse(user.has_usable_password())
+
+    def test_update_object(self):
+        """Add validation that a partial update can change the password if requested."""
+        user = self._get_queryset().first()
+        super().test_update_object()
+        user.refresh_from_db()
+        self.assertTrue(user.check_password(self.update_data["password"]))
+        # Make sure the password *isn't* changed if we make a PATCH without a specified password
+        response = self.client.patch(self._get_detail_url(user), {}, format="json", **self.header)
+        self.assertHttpStatus(response, status.HTTP_200_OK)
+        self.assertNotIn("password", response.json())
+        user.refresh_from_db()
+        self.assertTrue(user.check_password(self.update_data["password"]))
+
+    def test_get_put_round_trip(self):
+        """Add validation that the password is cleared by a PUT with no specified password."""
+        super().test_get_put_round_trip()
+        user = self._get_queryset().first()
+        self.assertFalse(user.has_usable_password())
 
 
 class GroupTest(APIViewTestCases.APIViewTestCase):
     model = Group
     filterset = GroupFilterSet
-    brief_fields = ["display", "id", "name", "url"]
     create_data = [
         {
             "name": "Group 4",
@@ -78,7 +150,6 @@ class GroupTest(APIViewTestCases.APIViewTestCase):
 
     @classmethod
     def setUpTestData(cls):
-
         Group.objects.create(name="Group 1")
         Group.objects.create(name="Group 2")
         Group.objects.create(name="Group 3")
@@ -86,7 +157,6 @@ class GroupTest(APIViewTestCases.APIViewTestCase):
 
 class TokenTest(APIViewTestCases.APIViewTestCase):
     model = Token
-    brief_fields = ["display", "id", "key", "url", "write_enabled"]
     bulk_update_data = {
         "description": "New description",
     }
@@ -128,9 +198,16 @@ class TokenTest(APIViewTestCases.APIViewTestCase):
             },
         ]
 
+    def get_deletable_object(self):
+        """Get an instance that can be deleted, being sure not to delete the test token!"""
+        instance = get_deletable_objects(self.model, self._get_queryset().exclude(pk=self.token.pk)).first()
+        if instance is None:
+            self.fail("Couldn't find a single deletable object!")
+        return instance
+
     def _create_basic_authentication_header(self, username, password):
         """
-        Given username, password create a valid Basic authenticaition header string.
+        Given username, password create a valid Basic authentication header string.
 
         Same procedure used to test DRF.
         """
@@ -270,21 +347,9 @@ class TokenTest(APIViewTestCases.APIViewTestCase):
 
 class ObjectPermissionTest(APIViewTestCases.APIViewTestCase):
     model = ObjectPermission
-    brief_fields = [
-        "actions",
-        "display",
-        "enabled",
-        "groups",
-        "id",
-        "name",
-        "object_types",
-        "url",
-        "users",
-    ]
 
     @classmethod
     def setUpTestData(cls):
-
         groups = (
             Group.objects.create(name="Group 1"),
             Group.objects.create(name="Group 2"),
@@ -340,6 +405,22 @@ class ObjectPermissionTest(APIViewTestCases.APIViewTestCase):
             "description": "New description",
         }
 
+    def get_deletable_object(self):
+        return ObjectPermission.objects.create(
+            name="Permission 100",
+            actions=["view", "add", "change", "delete"],
+            constraints={"name": "TEST100"},
+        )
+
+    # TODO: Unskip after resolving #2908, #2909
+    @skip("DRF's built-in OrderingFilter triggering natural key attribute error in our base")
+    def test_list_objects_ascending_ordered(self):
+        pass
+
+    @skip("DRF's built-in OrderingFilter triggering natural key attribute error in our base")
+    def test_list_objects_descending_ordered(self):
+        pass
+
 
 class UserConfigTest(APITestCase):
     def test_get(self):

nautobot/users/tests/test_filters.py

@@ -43,7 +43,6 @@ class UserTestCase(FilterTestCases.FilterTestCase):
 
     @classmethod
     def setUpTestData(cls):
-
         groups = (
             Group.objects.create(name="Group 1"),
             Group.objects.create(name="Group 2"),
@@ -133,7 +132,6 @@ class GroupTestCase(FilterTestCases.FilterTestCase):
 
     @classmethod
     def setUpTestData(cls):
-
         Group.objects.create(name="Group 1")
         Group.objects.create(name="Group 2")
         Group.objects.create(name="Group 3")
@@ -163,7 +161,6 @@ class ObjectPermissionTestCase(FilterTestCases.FilterTestCase):
 
     @classmethod
     def setUpTestData(cls):
-
         groups = (
             Group.objects.create(name="Group 1"),
             Group.objects.create(name="Group 2"),
@@ -221,7 +218,6 @@ class TokenTestCase(FilterTestCases.FilterTestCase):
 
     @classmethod
     def setUpTestData(cls):
-
         users = (
             User(username="User1"),
             User(username="User2"),

nautobot/users/tests/test_models.py

@@ -8,7 +8,6 @@ User = get_user_model()
 
 class UserConfigTest(TestCase):
     def setUp(self):
-
         user = User.objects.create_user(username="testuser")
         user.config_data = {
             "a": True,

nautobot/users/views.py

@@ -120,7 +120,6 @@ class ProfileView(LoginRequiredMixin, View):
     template_name = "users/profile.html"
 
     def get(self, request):
-
         return render(
             request,
             self.template_name,
@@ -135,7 +134,6 @@ class UserConfigView(LoginRequiredMixin, View):
     template_name = "users/preferences.html"
 
     def get(self, request):
-
         return render(
             request,
             self.template_name,
@@ -220,7 +218,6 @@ class ChangePasswordView(LoginRequiredMixin, View):
 
 class TokenListView(LoginRequiredMixin, View):
     def get(self, request):
-
         tokens = Token.objects.filter(user=request.user)
 
         return render(
@@ -236,7 +233,6 @@ class TokenListView(LoginRequiredMixin, View):
 
 class TokenEditView(LoginRequiredMixin, View):
     def get(self, request, pk=None):
-
         if pk is not None:
             if not request.user.has_perm("users.change_token"):
                 return HttpResponseForbidden()
@@ -261,7 +257,6 @@ class TokenEditView(LoginRequiredMixin, View):
         )
 
     def post(self, request, pk=None):
-
         if pk is not None:
             token = get_object_or_404(Token.objects.filter(user=request.user), pk=pk)
             form = TokenForm(request.POST, instance=token)
@@ -297,7 +292,6 @@ class TokenEditView(LoginRequiredMixin, View):
 
 class TokenDeleteView(LoginRequiredMixin, View):
     def get(self, request, pk):
-
         token = get_object_or_404(Token.objects.filter(user=request.user), pk=pk)
         initial_data = {
             "return_url": reverse("user:token_list"),
@@ -316,7 +310,6 @@ class TokenDeleteView(LoginRequiredMixin, View):
         )
 
     def post(self, request, pk):
-
         token = get_object_or_404(Token.objects.filter(user=request.user), pk=pk)
         form = ConfirmationForm(request.POST)
         if form.is_valid():