79 lines
2.3 KiB
Python
79 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
from django.db.models import Q
|
|
from django.utils import timezone
|
|
|
|
from apps.access.models import AccessRequest
|
|
|
|
|
|
def _active_access_requests(user, server, now):
|
|
return AccessRequest.objects.filter(
|
|
requester=user,
|
|
server=server,
|
|
status=AccessRequest.Status.APPROVED,
|
|
).filter(Q(expires_at__isnull=True) | Q(expires_at__gt=now))
|
|
|
|
|
|
def _is_admin_override(user) -> bool:
|
|
if not user or not getattr(user, "is_authenticated", False):
|
|
return False
|
|
return user.is_superuser or user.has_perm("servers.change_server")
|
|
|
|
|
|
def _has_manual_view_access(user, server, now) -> bool:
|
|
if not user.has_perm("servers.view_server", server):
|
|
return False
|
|
# If a user has active access requests on this server, scope flags govern
|
|
# capability checks. Otherwise, object/global server grants continue to work.
|
|
return not _active_access_requests(user, server, now).exists()
|
|
|
|
|
|
def user_has_any_access(user, server, now=None) -> bool:
|
|
if now is None:
|
|
now = timezone.now()
|
|
if _is_admin_override(user) or _has_manual_view_access(user, server, now):
|
|
return True
|
|
return (
|
|
_active_access_requests(user, server, now)
|
|
.filter(Q(request_shell=True) | Q(request_logs=True) | Q(request_users=True))
|
|
.exists()
|
|
)
|
|
|
|
|
|
def user_can_shell(user, server, now=None) -> bool:
|
|
if now is None:
|
|
now = timezone.now()
|
|
if user.has_perm("servers.shell_server", server):
|
|
return True
|
|
if _is_admin_override(user):
|
|
return True
|
|
return (
|
|
_active_access_requests(user, server, now)
|
|
.filter(request_shell=True)
|
|
.exists()
|
|
)
|
|
|
|
|
|
def user_can_logs(user, server, now=None) -> bool:
|
|
if now is None:
|
|
now = timezone.now()
|
|
if _is_admin_override(user) or _has_manual_view_access(user, server, now):
|
|
return True
|
|
return (
|
|
_active_access_requests(user, server, now)
|
|
.filter(request_logs=True)
|
|
.exists()
|
|
)
|
|
|
|
|
|
def user_can_users(user, server, now=None) -> bool:
|
|
if now is None:
|
|
now = timezone.now()
|
|
if _is_admin_override(user) or _has_manual_view_access(user, server, now):
|
|
return True
|
|
return (
|
|
_active_access_requests(user, server, now)
|
|
.filter(request_users=True)
|
|
.exists()
|
|
)
|