ScoDoc/app/auth/models.py

# -*- coding: UTF-8 -*

"""Users and Roles models for ScoDoc
"""

import base64
from datetime import datetime, timedelta
import os
import re
from time import time
from typing import Optional

import cracklib  # pylint: disable=import-error

from flask import current_app, g
from flask_login import UserMixin, AnonymousUserMixin

from werkzeug.security import generate_password_hash, check_password_hash

import jwt

from app import db, email, log, login
from app.models import Departement
from app.models import SHORT_STR_LEN, USERNAME_STR_LEN
from app.models.config import ScoDocSiteConfig
from app.scodoc.sco_exceptions import ScoValueError
from app.scodoc.sco_permissions import Permission
from app.scodoc.sco_roles_default import SCO_ROLES_DEFAULTS
import app.scodoc.sco_utils as scu
from app.scodoc import sco_etud  # a deplacer dans scu

VALID_LOGIN_EXP = re.compile(r"^[a-zA-Z0-9@\\\-_\.]+$")


def is_valid_password(cleartxt) -> bool:
    """Check password.
    returns True if OK.
    """
    if (
        hasattr(scu.CONFIG, "MIN_PASSWORD_LENGTH")
        and scu.CONFIG.MIN_PASSWORD_LENGTH > 0
        and len(cleartxt) < scu.CONFIG.MIN_PASSWORD_LENGTH
    ):
        return False  # invalid: too short
    try:
        _ = cracklib.FascistCheck(cleartxt)
        return True
    except ValueError:
        return False


def invalid_user_name(user_name: str) -> bool:
    "Check that user_name (aka login) is invalid"
    return (
        (len(user_name) < 2)
        or (len(user_name) >= USERNAME_STR_LEN)
        or not VALID_LOGIN_EXP.match(user_name)
    )


class User(UserMixin, db.Model):
    """ScoDoc users, handled by Flask / SQLAlchemy"""

    id = db.Column(db.Integer, primary_key=True)
    user_name = db.Column(db.String(USERNAME_STR_LEN), index=True, unique=True)
    "le login"
    email = db.Column(db.String(120))
    "email à utiliser par ScoDoc"
    email_institutionnel = db.Column(db.String(120))
    "email dans l'établissement, facultatif"
    nom = db.Column(db.String(USERNAME_STR_LEN))
    prenom = db.Column(db.String(USERNAME_STR_LEN))
    dept = db.Column(db.String(SHORT_STR_LEN), index=True)
    "acronyme du département de l'utilisateur"
    active = db.Column(db.Boolean, default=True, index=True)
    "si faux, compte utilisateur désactivé"
    cas_id = db.Column(db.Text(), index=True, unique=True, nullable=True)
    "uid sur le CAS (id, mail ou autre attribut, selon config.cas_attribute_id)"
    cas_allow_login = db.Column(
        db.Boolean, default=False, server_default="false", nullable=False
    )
    "Peut-on se logguer via le CAS ?"
    cas_allow_scodoc_login = db.Column(
        db.Boolean, default=False, server_default="false", nullable=False
    )
    """Si CAS forcé (cas_force), peut-on se logguer sur ScoDoc directement ?
    (le rôle ScoSuperAdmin peut toujours, mettre à True pour les utilisateur API)
    """
    cas_last_login = db.Column(db.DateTime, nullable=True)
    """date du dernier login via CAS"""

    password_hash = db.Column(db.String(128))
    password_scodoc7 = db.Column(db.String(42))
    last_seen = db.Column(db.DateTime, default=datetime.utcnow)
    date_modif_passwd = db.Column(db.DateTime, default=datetime.utcnow)
    date_created = db.Column(db.DateTime, default=datetime.utcnow)
    date_expiration = db.Column(db.DateTime, default=None)
    passwd_temp = db.Column(db.Boolean, default=False)
    """champ obsolete. Si connexion alors que passwd_temp est vrai,
    efface mot de passe et redirige vers accueil."""
    token = db.Column(db.Text(), index=True, unique=True)
    token_expiration = db.Column(db.DateTime)

    roles = db.relationship("Role", secondary="user_role", viewonly=True)
    Permission = Permission

    _departement = db.relationship(
        "Departement",
        foreign_keys=[Departement.acronym],
        primaryjoin=(dept == Departement.acronym),
        lazy="select",
        passive_deletes="all",
        uselist=False,
    )

    def __init__(self, **kwargs):
        self.roles = []
        self.user_roles = []
        # check login:
        if kwargs.get("user_name") and invalid_user_name(kwargs["user_name"]):
            raise ValueError(f"invalid user_name: {kwargs['user_name']}")
        super(User, self).__init__(**kwargs)
        # Ajoute roles:
        if (
            not self.roles
            and self.email
            and self.email == current_app.config["SCODOC_ADMIN_MAIL"]
        ):
            # super-admin
            admin_role = Role.query.filter_by(name="SuperAdmin").first()
            assert admin_role
            self.add_role(admin_role, None)
            db.session.commit()
        # current_app.logger.info("creating user with roles={}".format(self.roles))

    def __repr__(self):
        return f"""<User {self.user_name} id={self.id} dept={self.dept}{
            ' (inactive)' if not self.active else ''}>"""

    def __str__(self):
        return self.user_name

    def set_password(self, password):
        "Set password"
        current_app.logger.info(f"set_password({self})")
        if password:
            self.password_hash = generate_password_hash(password)
        else:
            self.password_hash = None
        # La création d'un mot de passe efface l'éventuel mot de passe historique
        self.password_scodoc7 = None
        self.passwd_temp = False

    def check_password(self, password: str) -> bool:
        """Check given password vs current one.
        Returns `True` if the password matched, `False` otherwise.
        """
        if not self.active:  # inactived users can't login
            current_app.logger.warning(
                f"auth: login attempt from inactive account {self}"
            )
            return False
        if self.passwd_temp:
            # Anciens comptes ScoDoc 7 non migrés
            # désactive le compte par sécurité.
            current_app.logger.warning(f"auth: desactivating legacy account {self}")
            self.active = False
            self.passwd_temp = True
            db.session.add(self)
            db.session.commit()
            send_notif_desactivation_user(self)
            return False

        # if CAS activated and forced, allow only super-user and users with cas_allow_scodoc_login
        if ScoDocSiteConfig.is_cas_enabled() and ScoDocSiteConfig.get("cas_force"):
            if (not self.is_administrator()) and not self.cas_allow_scodoc_login:
                return False

        if not self.password_hash:  # user without password can't login
            if self.password_scodoc7:
                # Special case: user freshly migrated from ScoDoc7
                return self._migrate_scodoc7_password(password)
            return False

        return check_password_hash(self.password_hash, password)

    def _migrate_scodoc7_password(self, password) -> bool:
        """After migration, rehash password."""
        if scu.check_scodoc7_password(self.password_scodoc7, password):
            current_app.logger.warning(
                f"auth: migrating legacy ScoDoc7 password for {self}"
            )
            self.set_password(password)
            self.password_scodoc7 = None
            db.session.add(self)
            db.session.commit()
            return True
        return False

    def get_reset_password_token(self, expires_in=600):
        "Un token pour réinitialiser son mot de passe"
        return jwt.encode(
            {"reset_password": self.id, "exp": time() + expires_in},
            current_app.config["SECRET_KEY"],
            algorithm="HS256",
        )

    @staticmethod
    def verify_reset_password_token(token):
        "Vérification du token de ré-initialisation du mot de passe"
        try:
            token = jwt.decode(
                token, current_app.config["SECRET_KEY"], algorithms=["HS256"]
            )
        except jwt.exceptions.ExpiredSignatureError:
            log("verify_reset_password_token: token expired")
        except:
            return None
        try:
            user_id = token["reset_password"]
            # double check en principe inutile car déjà fait dans decode()
            expire = float(token["exp"])
            if time() > expire:
                log(f"verify_reset_password_token: token expired for uid={user_id}")
                return None
        except (TypeError, KeyError):
            return None
        return db.session.get(User, user_id)

    def to_dict(self, include_email=True):
        """l'utilisateur comme un dict, avec des champs supplémentaires"""
        data = {
            "date_expiration": self.date_expiration.isoformat() + "Z"
            if self.date_expiration
            else None,
            "date_modif_passwd": self.date_modif_passwd.isoformat() + "Z"
            if self.date_modif_passwd
            else None,
            "date_created": self.date_created.isoformat() + "Z"
            if self.date_created
            else None,
            "dept": self.dept,
            "id": self.id,
            "active": self.active,
            "cas_id": self.cas_id,
            "cas_allow_login": self.cas_allow_login,
            "cas_allow_scodoc_login": self.cas_allow_scodoc_login,
            "cas_last_login": self.cas_last_login.isoformat() + "Z"
            if self.cas_last_login
            else None,
            "status_txt": "actif" if self.active else "fermé",
            "last_seen": self.last_seen.isoformat() + "Z" if self.last_seen else None,
            "nom": (self.nom or ""),  # sco8
            "prenom": (self.prenom or ""),  # sco8
            "roles_string": self.get_roles_string(),  # eg "Ens_RT, Ens_Info"
            "user_name": self.user_name,  # sco8
            # Les champs calculés:
            "nom_fmt": self.get_nom_fmt(),
            "prenom_fmt": self.get_prenom_fmt(),
            "nomprenom": self.get_nomprenom(),
            "prenomnom": self.get_prenomnom(),
            "nomplogin": self.get_nomplogin(),
            "nomcomplet": self.get_nomcomplet(),
        }
        if include_email:
            data["email"] = self.email or ""
            data["email_institutionnel"] = self.email_institutionnel or ""
        return data

    def from_dict(self, data: dict, new_user=False):
        """Set users' attributes from given dict values.
        Roles must be encoded as "roles_string", like "Ens_RT, Secr_CJ"
        """
        for field in [
            "nom",
            "prenom",
            "dept",
            "active",
            "email",
            "email_institutionnel",
            "date_expiration",
            "cas_id",
        ]:
            if field in data:
                setattr(self, field, data[field] or None)
        # required boolean fields
        for field in [
            "cas_allow_login",
            "cas_allow_scodoc_login",
        ]:
            setattr(self, field, scu.to_bool(data.get(field, False)))

        if new_user:
            if "user_name" in data:
                # never change name of existing users
                self.user_name = data["user_name"]
            if "password" in data:
                self.set_password(data["password"])
        if invalid_user_name(self.user_name):
            raise ValueError(f"invalid user_name: {self.user_name}")
        # Roles: roles_string is "Ens_RT, Secr_RT, ..."
        if "roles_string" in data:
            self.user_roles = []
            for r_d in data["roles_string"].split(","):
                if r_d:
                    role, dept = UserRole.role_dept_from_string(r_d)
                    self.add_role(role, dept)

        # Set cas_id using regexp if configured:
        exp = ScoDocSiteConfig.get("cas_uid_from_mail_regexp")
        if exp and self.email_institutionnel:
            cas_id = ScoDocSiteConfig.extract_cas_id(self.email_institutionnel)
            if cas_id is not None:
                self.cas_id = cas_id

    def get_token(self, expires_in=3600):
        "Un jeton pour cet user. Stocké en base, non commité."
        now = datetime.utcnow()
        if self.token and self.token_expiration > now + timedelta(seconds=60):
            return self.token
        self.token = base64.b64encode(os.urandom(24)).decode("utf-8")
        self.token_expiration = now + timedelta(seconds=expires_in)
        db.session.add(self)
        return self.token

    def revoke_token(self):
        "Révoque le jeton de cet utilisateur"
        self.token_expiration = datetime.utcnow() - timedelta(seconds=1)

    @staticmethod
    def check_token(token):
        """Retreive user for given token, check token's validity
        and returns the user object.
        """
        user = User.query.filter_by(token=token).first()
        if user is None or user.token_expiration < datetime.utcnow():
            return None
        return user

    def get_dept_id(self) -> int:
        "returns user's department id, or None"
        if self.dept:
            return self._departement.id
        return None

    def get_emails(self):
        "List mail adresses to contact this user"
        mails = []
        if self.email:
            mails.append(self.email)
        if self.email_institutionnel:
            mails.append(self.email_institutionnel)
        return mails

    # Permissions management:
    def has_permission(self, perm: int, dept: str = False):
        """Check if user has permission `perm` in given `dept` (acronym).
        Similar to Zope ScoDoc7 `has_permission``

        Args:
            perm: integer, one of the value defined in Permission class.
            dept: dept id (eg 'RT'), default to current departement.
        """
        if not self.active:
            return False
        if dept is False:
            dept = g.scodoc_dept
        # les role liés à ce département, et les roles avec dept=None (super-admin)
        roles_in_dept = (
            UserRole.query.filter_by(user_id=self.id)
            .filter((UserRole.dept == dept) | (UserRole.dept == None))
            .all()
        )
        for user_role in roles_in_dept:
            if user_role.role.has_permission(perm):
                return True
        return False

    # Role management
    def add_role(self, role: "Role", dept: str):
        """Add a role to this user.
        :param role: Role to add.
        """
        if not isinstance(role, Role):
            raise ScoValueError("add_role: rôle invalide")
        user_role = UserRole(user=self, role=role, dept=dept)
        db.session.add(user_role)
        self.user_roles.append(user_role)

    def add_roles(self, roles: "list[Role]", dept: str):
        """Add roles to this user.
        :param roles: Roles to add.
        """
        for role in roles:
            self.add_role(role, dept)

    def set_roles(self, roles, dept):
        "set roles in the given dept"
        self.user_roles = [
            UserRole(user=self, role=r, dept=dept) for r in roles if isinstance(r, Role)
        ]

    def get_roles(self):
        "iterator on my roles"
        for role in self.roles:
            yield role

    def get_roles_string(self):
        """string repr. of user's roles (with depts)
        e.g. "Ens_RT, Ens_Info, Secr_CJ"
        """
        return ", ".join(
            f"{r.role.name or ''}_{r.dept or ''}"
            for r in self.user_roles
            if r is not None
        )

    def get_depts_with_permission(self, permission: int) -> list[str]:
        """Liste des acronymes de département dans lesquels cet utilisateur
        possède la permission indiquée.
        L'"acronyme" None signifie "tous les départements".
        Si plusieurs permissions (plusieurs bits) sont indiquées, c'est un "ou":
        les départements dans lesquels l'utilisateur a l'une des permissions.
        """
        return [
            user_role.dept
            for user_role in UserRole.query.filter_by(user=self)
            .join(Role)
            .filter(Role.permissions.op("&")(permission) != 0)
        ]

    def is_administrator(self):
        "True if i'm an active SuperAdmin"
        return self.active and self.has_permission(Permission.ScoSuperAdmin, dept=None)

    # Some useful strings:
    def get_nomplogin(self):
        """nomplogin est le nom en majuscules suivi du prénom et du login
        e.g. Dupont Pierre (dupont)
        """
        nom = sco_etud.format_nom(self.nom) if self.nom else self.user_name.upper()
        return f"{nom} {sco_etud.format_prenom(self.prenom)} ({self.user_name})"

    @staticmethod
    def get_user_id_from_nomplogin(nomplogin: str) -> Optional[int]:
        """Returns id from the string "Dupont Pierre (dupont)"
        or None if user does not exist
        """
        match = re.match(r".*\((.*)\)", nomplogin.strip())
        if match:
            user_name = match.group(1)
            u = User.query.filter_by(user_name=user_name).first()
            if u:
                return u.id
        return None

    def get_nom_fmt(self):
        """Nom formaté: "Martin" """
        if self.nom:
            return sco_etud.format_nom(self.nom, uppercase=False)
        else:
            return self.user_name

    def get_prenom_fmt(self):
        """Prénom formaté (minuscule capitalisées)"""
        return sco_etud.format_prenom(self.prenom)

    def get_nomprenom(self):
        """Nom capitalisé suivi de l'initiale du prénom:
        Viennet E.
        """
        prenom_abbrv = scu.abbrev_prenom(sco_etud.format_prenom(self.prenom))
        return (self.get_nom_fmt() + " " + prenom_abbrv).strip()

    def get_prenomnom(self):
        """L'initiale du prénom suivie du nom: "J.-C. Dupont" """
        prenom_abbrv = scu.abbrev_prenom(sco_etud.format_prenom(self.prenom))
        return (prenom_abbrv + " " + self.get_nom_fmt()).strip()

    def get_nomcomplet(self):
        "Prénom et nom complets"
        return sco_etud.format_prenom(self.prenom) + " " + self.get_nom_fmt()

    # nomnoacc était le nom en minuscules sans accents (inutile)


class AnonymousUser(AnonymousUserMixin):
    "Notre utilisateur anonyme"

    def has_permission(self, perm, dept=None):
        return False

    def is_administrator(self):
        return False


login.anonymous_user = AnonymousUser


class Role(db.Model):
    """Roles for ScoDoc"""

    id = db.Column(db.Integer, primary_key=True)
    name = db.Column(db.String(64), unique=True, nullable=False, index=True)
    default = db.Column(db.Boolean, default=False, index=True)
    permissions = db.Column(db.BigInteger)  # 64 bits
    users = db.relationship("User", secondary="user_role", viewonly=True)

    def __init__(self, **kwargs):
        super(Role, self).__init__(**kwargs)
        if self.permissions is None:
            self.permissions = 0

    def __repr__(self):
        return "<Role {} perm={:0{w}b}>".format(
            self.name,
            self.permissions & ((1 << Permission.NBITS) - 1),
            w=Permission.NBITS,
        )

    def __str__(self):
        return f"{self.name}: perm={', '.join(Permission.permissions_names(self.permissions))}"

    def to_dict(self) -> dict:
        "As dict. Convert permissions to names."
        return {
            "id": self.id,
            "role_name": self.name,  # pour être cohérent avec partion_name, etc.
            "permissions": Permission.permissions_names(self.permissions),
        }

    def add_permission(self, perm: int):
        "Add permission to role"
        self.permissions |= perm

    def remove_permission(self, perm: int):
        "Remove permission from role"
        self.permissions = self.permissions & ~perm

    def reset_permissions(self):
        "Remove all permissions from role"
        self.permissions = 0

    def get_named_permissions(self) -> list[str]:
        "List of the names of the permissions associated to this rôle"
        return Permission.permissions_names(self.permissions)

    def set_named_permissions(self, permission_names: list[str]):
        """Set permissions, given as a list of permissions names.
        Raises ScoValueError if invalid permission."""
        self.permissions = 0
        for permission_name in permission_names:
            permission = Permission.get_by_name(permission_name)
            if permission is None:
                raise ScoValueError("set_named_permissions: invalid permission name")
            self.permissions |= permission

    def has_permission(self, perm: int) -> bool:
        "True if role as this permission"
        return self.permissions & perm == perm

    @staticmethod
    def reset_standard_roles_permissions(reset_permissions=True):
        """Create default roles if missing, then, if reset_permissions,
        reset their permissions to default values.
        """
        default_role = "Observateur"
        for role_name, permissions in SCO_ROLES_DEFAULTS.items():
            role = Role.query.filter_by(name=role_name).first()
            if role is None:
                role = Role(name=role_name)
                role.default = role.name == default_role
                db.session.add(role)
            if reset_permissions:
                role.reset_permissions()
                for perm in permissions:
                    role.add_permission(perm)
                db.session.add(role)

        db.session.commit()

    @staticmethod
    def ensure_standard_roles():
        """Create default roles if missing"""
        Role.reset_standard_roles_permissions(reset_permissions=False)

    @staticmethod
    def get_named_role(name):
        """Returns existing role with given name, or None."""
        return Role.query.filter_by(name=name).first()


class UserRole(db.Model):
    """Associate user to role, in a dept.
    If dept is None, the role applies to all departments (eg super admin).
    """

    id = db.Column(db.Integer, primary_key=True)
    user_id = db.Column(db.Integer, db.ForeignKey("user.id"))
    role_id = db.Column(db.Integer, db.ForeignKey("role.id"))
    dept = db.Column(db.String(64))  # dept acronym ou NULL
    user = db.relationship(
        User, backref=db.backref("user_roles", cascade="all, delete-orphan")
    )
    role = db.relationship(
        Role, backref=db.backref("user_roles", cascade="all, delete-orphan")
    )

    def __repr__(self):
        return f"<UserRole u={self.user} r={self.role} dept={self.dept}>"

    @staticmethod
    def role_dept_from_string(role_dept: str):
        """Return tuple (role, dept) from the string
        role_dept, of the forme "Role_Dept".
        role is a Role instance, dept is a string, or None.
        """
        fields = role_dept.strip().split("_", 1)
        # maxsplit=1, le dept peut contenir un "_"
        if len(fields) != 2:
            current_app.logger.warning(
                f"auth: role_dept_from_string:  Invalid role_dept '{role_dept}'"
            )
            raise ScoValueError("Invalid role_dept")
        role_name, dept = fields
        dept = dept.strip() if dept else ""
        if dept == "":
            dept = None

        role = Role.query.filter_by(name=role_name).first()
        if role is None:
            raise ScoValueError(f"role {role_name} does not exists")
        return (role, dept)


def get_super_admin():
    """L'utilisateur admin (ou le premier, s'il y en a plusieurs).
    Utilisé par les tests unitaires et le script de migration.
    """
    admin_role = Role.query.filter_by(name="SuperAdmin").first()
    assert admin_role
    admin_user = (
        User.query.join(UserRole)
        .filter((UserRole.user_id == User.id) & (UserRole.role_id == admin_role.id))
        .first()
    )
    assert admin_user
    return admin_user


def send_notif_desactivation_user(user: User):
    """Envoi un message mail de notification à l'admin et à l'adresse du compte désactivé"""
    recipients = user.get_emails() + [current_app.config.get("SCODOC_ADMIN_MAIL")]
    txt = [
        f"""Le compte ScoDoc '{user.user_name}' associé à votre adresse <{user.email}>""",
        """a été désactivé par le système car son mot de passe n'était pas valide.\n""",
        """Contactez votre responsable pour le ré-activer.\n""",
        """Ceci est un message automatique, ne pas répondre.""",
    ]
    txt = "\n".join(txt)
    email.send_email(
        f"ScoDoc: désactivation automatique du compte {user.user_name}",
        email.get_from_addr(),
        recipients,
        txt,
    )
    return txt