Merge branch 'openid-connect' into 'main'

Openid connect

See merge request bde/nk20!293

README.md

@@ -58,7 +58,13 @@ Bien que cela permette de créer une instance sur toutes les distributions,
     (env)$ ./manage.py createsuperuser  # Création d'un⋅e utilisateur⋅rice initial
     ```
 
-6.  Enjoy :
+6. (Optionnel) **Création d'une clé privée OpenID Connect**
+
+Pour activer le support d'OpenID Connect, il faut générer une clé privée, par
+exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et renseigner son
+emplacement dans `OIDC_RSA_PRIVATE_KEY` (par défaut `/var/secrets/oidc.key`).
+
+7.  Enjoy :
 
     ```bash
     (env)$ ./manage.py runserver 0.0.0.0:8000
@@ -228,6 +234,12 @@ Sinon vous pouvez suivre les étapes décrites ci-dessous.
         (env)$ ./manage.py check # pas de bêtise qui traine
         (env)$ ./manage.py migrate
 
+7. **Création d'une clé privée OpenID Connect**
+
+Pour activer le support d'OpenID Connect, il faut générer une clé privée, par
+exemple avec openssl (`openssl genrsa -out oidc.key 4096`), et renseigner son
+emplacement dans `OIDC_RSA_PRIVATE_KEY` (par défaut `/var/secrets/oidc.key`).
+
 7.  *Enjoy \o/*
 
 ### Installation avec Docker

apps/permission/fixtures/initial.json

@@ -324,7 +324,7 @@
             "mask": 2,
             "field": "",
             "permanent": false,
-            "description": "Créer une transaction de ou vers la note d'un club tant que la source reste au dessus de -20 €"
+            "description": "Créer une transaction de ou vers la note d'un club"
         }
     },
     {
@@ -3815,7 +3815,7 @@
             "mask": 2,
             "field": "",
             "permanent": false,
-            "description": "Créer une transaction vers la note d'un club tant que la source reste au dessus de -20 €"
+            "description": "Créer une transaction vers la note d'un club"
         }
     },
     {
@@ -4186,86 +4186,6 @@
             "description": "Voir la note d'un club enfant"
         }
     },
-    {
-        "model": "permission.permission",
-        "pk": 266,
-        "fields": {
-            "model": [
-                "note",
-                "transaction"
-            ],
-            "query": "[\"OR\", {\"source_alias\": \"Carte bancaire\"}, {\"source_alias\": \"Espèces\"}, {\"source_alias\": \"Chèque\"}, {\"source_alias\": \"Virement bancaire\"}]",
-            "type": "view",
-            "mask": 2,
-            "field": "",
-            "permanent": false,
-            "description": "Voir les transactions de rechargement"
-        }
-    },
-    {
-        "model": "permission.permission",
-        "pk": 267,
-        "fields": {
-            "model": [
-                "note",
-                "transaction"
-            ],
-            "query": "[\"OR\", {\"source_alias\": \"Carte bancaire\"}, {\"source_alias\": \"Espèces\"}, {\"source_alias\": \"Chèque\"}, {\"source_alias\": \"Virement bancaire\"}]",
-            "type": "change",
-            "mask": 2,
-            "field": "valid",
-            "permanent": false,
-            "description": "Mettre à jour le statut de validation d'une transaction de rechargement"
-        }
-    },
-    {
-        "model": "permission.permission",
-        "pk": 268,
-        "fields": {
-            "model": [
-                "note",
-                "transaction"
-            ],
-            "query": "[\"OR\", {\"source_alias\": \"Carte bancaire\"}, {\"source_alias\": \"Espèces\"}, {\"source_alias\": \"Chèque\"}, {\"source_alias\": \"Virement bancaire\"}]",
-            "type": "change",
-            "mask": 2,
-            "field": "invalidity_reason",
-            "permanent": false,
-            "description": "Modifier la raison d'invalidité d'une transaction de rechargement"
-        }
-    },
-    {
-        "model": "permission.permission",
-        "pk": 269,
-        "fields": {
-            "model": [
-                "note",
-                "transaction"
-            ],
-            "query": "[\"OR\", {\"source_alias\": \"Carte bancaire\"}, {\"source_alias\": \"Espèces\"}, {\"source_alias\": \"Chèque\"}, {\"source_alias\": \"Virement bancaire\"}]",
-            "type": "add",
-            "mask": 2,
-            "field": "",
-            "permanent": false,
-            "description": "Créer une transaction de rechargement"
-        }
-    },
-    {
-        "model": "permission.permission",
-        "pk": 270,
-        "fields": {
-            "model": [
-                "note",
-                "transaction"
-            ],
-            "query": "[\"AND\", [\"OR\", {\"source\": [\"club\", \"note\"]}, {\"destination\": [\"club\", \"note\"]}], [\"OR\", {\"source__balance__gte\": {\"F\": [\"SUB\", [\"MUL\", [\"F\", \"amount\"], [\"F\", \"quantity\"]], 5000]}}, {\"valid\": false}]]",
-            "type": "add",
-            "mask": 2,
-            "field": "",
-            "permanent": false,
-            "description": "Créer une transaction de ou vers la note d'un club tant que la source reste au dessus de -50 €"
-        }
-    },
     {
         "model": "permission.role",
         "pk": 1,

apps/wrapped/management/commands/generate_wrapped.py

@@ -38,7 +38,7 @@ class Command(BaseCommand):
             required=False,
             help="""User will have their(s) wrapped generated,
             all = all users
-            adh = all users who have a valid cd memberships to BDE during the BDE considered
+            adh = all users who have a valid memberships to BDE during the BDE considered
             supersuser = all superusers
             custom user1,user2,... = a list of username,
             custom_id id1,id2,... = a list of user id""",
@@ -70,7 +70,15 @@ class Command(BaseCommand):
             dest='create',
         )
 
-    def handle(self, *args, **options): # NOQA
+    def handle(self, *args, **options):
+        # useful string for output
+        red = '\033[31;1m'
+        yellow = '\033[33;1m'
+        green = '\033[32;1m'
+        abort = red + 'ABORT'
+        warning = yellow + 'WARNING'
+        success = green + 'SUCCESS'
+
         # Traitement des paramètres
         verb = options['verbosity']
         bde = []
@@ -81,11 +89,11 @@ class Command(BaseCommand):
         if options['bde_id']:
             if bde:
                 if verb >= 1:
-                    self.stdout.write(self.style.WARNING(
-                        "WARNING\nYou already defined bde with their name !"))
+                    print(warning)
+                    print(yellow + 'You already defined bde with their name !')
                 if verb >= 0:
-                    self.stdout.write(self.style.ERROR("ABORT"))
-                exit(1)
+                    print(abort)
+                return
             bde_id = options['bde_id'].split(',')
             bde = [Bde.objects.get(pk=i) for i in bde_id]
 
@@ -105,11 +113,11 @@ class Command(BaseCommand):
                 user = ['custom_id', [User.objects.get(pk=u) for u in user_id]]
             else:
                 if verb >= 1:
-                    self.sdtout.write(self.style.WARNING(
-                        "WARNING\nYou user option is not recognized"))
+                    print(warning)
+                    print(yellow + 'You user option is not recognized')
                 if verb >= 0:
-                    self.stdout.write(self.style.ERROR("ABORT"))
-                exit(1)
+                    print(abort)
+                return
 
         club = []
         if options['club']:
@@ -125,11 +133,11 @@ class Command(BaseCommand):
                 club = ['custom_id', [Club.objects.get(pk=c) for c in club_id]]
             else:
                 if verb >= 1:
-                    self.stdout.write(self.style.WARNING(
-                        "WARNING\nYou club option is not recognized"))
+                    print(warning)
+                    print(yellow + 'You club option is not recognized')
                 if verb >= 0:
-                    self.stdout.write(self.style.ERROR("ABORT"))
-                exit(1)
+                    print(abort)
+                return
 
         change = options['change']
         create = options['create']
@@ -137,75 +145,72 @@ class Command(BaseCommand):
         # check if parameters are sufficient for generate wrapped with the desired option
         if not bde:
             if verb >= 1:
-                self.stdout.write(self.style.WARNING(
-                    "WARNING\nYou have not selectionned a BDE !"))
+                print(warning)
+                print(yellow + 'You have not selectionned a BDE !')
             if verb >= 0:
-                self.stdout.write(self.style.ERROR("ABORT"))
-            exit(1)
+                print(abort)
+            return
         if not (user or club):
             if verb >= 1:
-                self.stdout.write(self.style.WARNING(
-                    "WARNING\nNo club or user selected !"))
+                print(warning)
+                print(yellow + 'No club or user selected !')
             if verb >= 0:
-                self.stdout.write(self.style.ERROR("ABORT"))
-            exit(1)
+                print(abort)
+            return
 
         if verb >= 3:
-            self.stdout.write("Options:")
+            print('\033[1mOptions:\033[m')
             bde_str = ''
             for b in bde:
-                bde_str += str(b) + '\n'
-            self.stdout.write("BDE: " + bde_str)
+                bde_str += str(b)
+            print('BDE: ' + bde_str)
             if user:
-                self.stdout.write('User: ' + user[0])
+                print('User: ' + user[0])
             if club:
-                self.stdout.write('Club: ' + club[0])
-            self.stdout.write('change: ' + str(change))
-            self.stdout.write('create: ' + str(create) + '\n')
+                print('Club: ' + club[0])
+            print('change: ' + str(change))
+            print('create: ' + str(create))
+            print('')
         if not (change or create):
             if verb >= 1:
-                self.stdout.write(self.style.WARNING(
-                    "WARNING\nchange and create is set to false, none wrapped will be created"))
+                print(warning)
+                print(yellow + 'change and create is set to false, none wrapped will be created')
             if verb >= 0:
-                self.stdout.write(self.style.ERROR("ABORT"))
-            exit(1)
+                print(abort)
+            return
         if verb >= 1 and change:
-            self.stdout.write(self.style.WARNING(
-                "WARNING\nchange is set to true, some wrapped may be replaced !"))
+            print(warning)
+            print(yellow + 'change is set to true, some wrapped may be replaced !')
         if verb >= 1 and not create:
-            self.stdout.write(self.style.WARNING(
-                "WARNING\ncreate is set to false, wrapped will not be created !"))
+            print(warning)
+            print(yellow + 'create is set to false, wrapped will not be created !')
         if verb >= 3 or change or not create:
             a = str(input('\033[mContinue ? (y/n) ')).lower()
             if a in ['n', 'no', 'non', '0']:
                 if verb >= 0:
-                    self.stdout.write(self.style.ERROR("ABORT"))
-                exit(1)
+                    print(abort)
+                return
 
         note = self.convert_to_note(change, create, bde=bde, user=user, club=club, verb=verb)
         if verb >= 1:
-            self.stdout.write(self.style.SUCCESS(
-                "User and/or Club given has successfully convert in their note"))
-
+            print("\033[32mUser and/or Club given has successfully convert in their note\033[m")
         global_data = self.global_data(bde, verb=verb)
         if verb >= 1:
-            self.stdout.write(self.style.SUCCESS(
-                "Global data has been successfully generated"))
+            print("\033[32mGlobal data has been successfully generated\033[m")
 
         unique_data = self.unique_data(bde, note, global_data=global_data, verb=verb)
         if verb >= 1:
-            self.stdout.write(self.style.SUCCESS(
-                "Unique data has been successfully generated"))
+            print("\033[32mUnique data has been successfully generated\033[m")
 
         self.make_wrapped(unique_data, note, bde, change, create, verb=verb)
         if verb >= 1:
-            self.stdout.write(self.style.SUCCESS(
-                "The wrapped has been generated !"))
+            print(green + "The wrapped has been generated !")
         if verb >= 0:
-            self.stdout.write(self.style.SUCCESS("SUCCESS"))
-        exit(0)
+            print(success)
 
-    def convert_to_note(self, change, create, bde=None, user=None, club=None, verb=1): # NOQA
+        return
+
+    def convert_to_note(self, change, create, bde=None, user=None, club=None, verb=1):
         notes = []
         for b in bde:
             note_for_bde = Note.objects.filter(pk__lte=-1)
@@ -248,17 +253,17 @@ class Command(BaseCommand):
             note_for_bde = self.filter_note(b, note_for_bde, change, create, verb=verb)
             notes.append(note_for_bde)
             if verb >= 2:
-                self.stdout.write(f"{len(note_for_bde)} note selectionned for bde {b.name}")
+                print("\033[m{nb} note selectionned for bde {bde}".format(nb=len(note_for_bde), bde=b.name))
         return notes
 
-    def global_data(self, bde, verb=1): # NOQA
+    def global_data(self, bde, verb=1):
         data = {}
         for b in bde:
             if b.name == 'Rave Part[list]':
                 if verb >= 2:
-                    self.stdout.write("Begin to make global data")
+                    print("Begin to make global data")
                 if verb >= 3:
-                    self.stdout.write("nb_transaction")
+                    print('nb_transaction')
                 # nb total de transactions
                 data['nb_transaction'] = Transaction.objects.filter(
                     created_at__gte=b.date_start,
@@ -266,7 +271,7 @@ class Command(BaseCommand):
                     valid=True).count()
 
                 if verb >= 3:
-                    self.stdout.write("nb_vieux_con")
+                    print('nb_vieux_con')
                 # nb total de vielleux con·ne·s derrière le bar
                 button_id = [2884, 2585]
                 transactions = Transaction.objects.filter(
@@ -281,7 +286,7 @@ class Command(BaseCommand):
                 data['nb_vieux_con'] = q
 
                 if verb >= 3:
-                    self.stdout.write("nb_soiree")
+                    print('nb_soiree')
                 # nb total de soirée
                 a_type_id = [1, 2, 4, 5, 7, 10]
                 data['nb_soiree'] = Activity.objects.filter(
@@ -291,7 +296,7 @@ class Command(BaseCommand):
                     activity_type__pk__in=a_type_id).count()
 
                 if verb >= 3:
-                    self.stdout.write('pots, nb_entree_pot')
+                    print('pots, nb_entree_pot')
                 # nb d'entrée totale aux pots
                 pot_id = [1, 4, 10]
                 pots = Activity.objects.filter(
@@ -305,7 +310,7 @@ class Command(BaseCommand):
                     data['nb_entree_pot'] += Entry.objects.filter(activity=pot).count()
 
                 if verb >= 3:
-                    self.stdout.write('top3_buttons')
+                    print('top3_buttons')
                 # top 3 des boutons les plus cliqués
                 transactions = Transaction.objects.filter(
                     created_at__gte=b.date_start,
@@ -324,7 +329,7 @@ class Command(BaseCommand):
                 data['top3_buttons'] = list(sorted(d.items(), key=lambda item: item[1], reverse=True))[:3]
 
                 if verb >= 3:
-                    self.stdout.write('class_conso_all')
+                    print('class_conso_all')
                 # le classement des plus gros consommateurs (BDE + club)
                 transactions = Transaction.objects.filter(
                     created_at__gte=b.date_start,
@@ -343,7 +348,7 @@ class Command(BaseCommand):
                 data['class_conso_all'] = dict(sorted(d.items(), key=lambda item: item[1], reverse=True))
 
                 if verb >= 3:
-                    self.stdout.write('class_conso_bde')
+                    print('class_conso_bde')
                 # le classement des plus gros consommateurs BDE
                 transactions = Transaction.objects.filter(
                     created_at__gte=b.date_start,
@@ -363,10 +368,11 @@ class Command(BaseCommand):
 
             else:
                 # make your wrapped or reuse previous wrapped
-                raise NotImplementedError(f"The BDE: {b.name} has not personalized wrapped, make it !")
+                raise NotImplementedError("The BDE: {bde_name} has not personalized wrapped, make it !"
+                                          .format(bde_name=b.name))
         return data
 
-    def unique_data(self, bde, note, global_data=None, verb=1): # NOQA
+    def unique_data(self, bde, note, global_data=None, verb=1):
         data = []
         for i in range(len(bde)):
             data_bde = []
@@ -374,7 +380,8 @@ class Command(BaseCommand):
                 if verb >= 3:
                     total = len(note[i])
                     current = 0
-                    self.stdout.write(f"Make {total} data for wrapped sponsored by {bde[i].name}")
+                    print('Make {nb} data for wrapped sponsored by {bde}'
+                          .format(nb=total, bde=bde[i].name))
                 for n in note[i]:
                     d = {}
                     if 'user' in n.__dir__():
@@ -535,11 +542,12 @@ class Command(BaseCommand):
                     data_bde.append(json.dumps(d))
                     if verb >= 3:
                         current += 1
-                        self.stdout.write("\033[2K" + f"({current}/{total})" + "\033[1A")
+                        print('\033[2K' + '({c}/{t})'.format(c=current, t=total) + '\033[1A')
 
             else:
                 # make your wrapped or reuse previous wrapped
-                raise NotImplementedError(f"The BDE: {bde[i].name} has not personalized wrapped, make it !")
+                raise NotImplementedError("The BDE: {bde_name} has not personalized wrapped, make it !"
+                                          .format(bde_name=bde[i].name))
             data.append(data_bde)
         return data
 
@@ -549,7 +557,7 @@ class Command(BaseCommand):
             total = 0
             for n in note:
                 total += len(n)
-            self.stdout.write(f"Make {total} wrapped")
+            print('\033[mMake {nb} wrapped'.format(nb=total))
         for i in range(len(bde)):
             for j in range(len(note[i])):
                 if create and not Wrapped.objects.filter(bde=bde[i], note=note[i][j]):
@@ -564,7 +572,7 @@ class Command(BaseCommand):
                     w.save()
                 if verb >= 3:
                     current += 1
-                    self.stdout.write("\033[2K" + f"({current}/{total})" + "\033[1A")
+                    print('\033[2K' + '({c}/{t})'.format(c=current, t=total) + '\033[1A')
         return
 
     def filter_note(self, bde, note, change, create, verb=1):

apps/wrapped/tests/test_wrapped.py

@@ -1,91 +0,0 @@
-# Copyright (C) 2018-2025 by BDE ENS Paris-Saclay
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-from datetime import timedelta
-
-from api.tests import TestAPI
-from django.contrib.auth.models import User
-from django.test import TestCase
-from django.urls import reverse
-from django.utils import timezone
-
-from ..api.views import WrappedViewSet, BdeViewSet
-from ..models import Bde, Wrapped
-
-
-class TestWrapped(TestCase):
-    """
-    Test activities
-    """
-    fixtures = ('initial',)
-
-    def setUp(self):
-        self.user = User.objects.create_superuser(
-            username="admintoto",
-            password="tototototo",
-            email="toto@example.com"
-        )
-        self.client.force_login(self.user)
-
-        sess = self.client.session
-        sess["permission_mask"] = 42
-        sess.save()
-
-        self.bde = Bde.objects.create(
-            name="The best BDE",
-            date_start=timezone.now() - timedelta(days=365),
-            date_end=timezone.now(),
-        )
-
-        self.wrapped = Wrapped.objects.create(
-            generated=True,
-            public=False,
-            bde=self.bde,
-            note=self.user.note,
-            data_json="{}",
-        )
-
-    def test_wrapped_list(self):
-        """
-        Display the list of all wrapped
-        """
-        response = self.client.get(reverse("wrapped:wrapped_list"))
-        self.assertEqual(response.status_code, 200)
-
-    def test_wrapped_detail(self):
-        """
-        Display the detail of an wrapped
-        """
-        response = self.client.get(reverse("wrapped:wrapped_detail", args=(self.wrapped.pk,)))
-        self.assertEqual(response.status_code, 200)
-
-
-class TestWrappedAPI(TestAPI):
-    def setUp(self) -> None:
-        super().setUp()
-
-        self.bde = Bde.objects.create(
-            name="The best BDE",
-            date_start=timezone.now() - timedelta(days=365),
-            date_end=timezone.now(),
-        )
-
-        self.wrapped = Wrapped.objects.create(
-            generated=True,
-            public=False,
-            bde=self.bde,
-            note=self.user.note,
-            data_json="{}",
-        )
-
-    def test_bde_api(self):
-        """
-        Load Bde API page and test all filters and permissions
-        """
-        self.check_viewset(BdeViewSet, "/api/wrapped/bde/")
-
-    def test_wrapped_api(self):
-        """
-        Load Wrapped API page and test all filters and permissions
-        """
-        self.check_viewset(WrappedViewSet, "/api/wrapped/wrapped/")

note_kfet/settings/base.py

@@ -268,6 +268,10 @@ OAUTH2_PROVIDER = {
     'OAUTH2_VALIDATOR_CLASS': "permission.scopes.PermissionOAuth2Validator",
     'REFRESH_TOKEN_EXPIRE_SECONDS': timedelta(days=14),
     'PKCE_REQUIRED': False, # PKCE (fix a breaking change of django-oauth-toolkit 2.0.0)
+    'OIDC_ENABLED': True,
+    'OIDC_RSA_PRIVATE_KEY':
+        os.getenv('OIDC_RSA_PRIVATE_KEY', '/var/secrets/oidc.key'),
+    'SCOPES': { 'openid': "OpenID Connect scope" },
 }
 
 # Take control on how widget templates are sourced