Added skeleton role manager

app/classes/shared/models.py

@@ -33,6 +33,7 @@ class Users(BaseModel):
     user_id = AutoField()
     created = DateTimeField(default=datetime.datetime.now)
     last_login = DateTimeField(default=datetime.datetime.now)
+    last_update = DateTimeField(default=datetime.datetime.now)
     last_ip = CharField(default="")
     username = CharField(default="", unique=True, index=True)
     password = CharField(default="")
@@ -47,6 +48,7 @@ class Users(BaseModel):
 class Roles(BaseModel):
     role_id = AutoField()
     created = DateTimeField(default=datetime.datetime.now)
+    last_update = DateTimeField(default=datetime.datetime.now)
     role_name = CharField(default="", unique=True, index=True)
 
     class Meta:
@@ -365,6 +367,7 @@ class db_shortcuts:
                     up_data['password'] = helper.encode_pass(user_data['password'])
             elif base_data[key] != user_data[key]:
                 up_data[key] = user_data[key]
+        up_data['last_update'] = helper.get_time_as_string()
         logger.debug("user: {} +role:{} -role:{} +server:{} -server{}".format(user_data, added_roles, removed_roles, added_servers, removed_servers))
         with database.atomic():
             for role in added_roles:
@@ -379,8 +382,6 @@ class db_shortcuts:
             if up_data:
                 Users.update(up_data).where(Users.user_id == user_id).execute()
 
-
-
     @staticmethod
     def add_user(username, password=None, api_token=None, enabled=True, superuser=False):
         if password is not None:
@@ -397,7 +398,8 @@ class db_shortcuts:
             Users.password: pw_enc,
             Users.api_token: api_token,
             Users.enabled: enabled,
-            Users.superuser: superuser
+            Users.superuser: superuser,
+            Users.created: helper.get_time_as_string()
         }).execute()
         return user_id
 
@@ -414,14 +416,70 @@ class db_shortcuts:
 
     @staticmethod
     def get_roleid_by_name(role_name):
+        try:
             return (Roles.get(Roles.role_name == role_name)).role_id
+        except DoesNotExist:
+            return None
 
     @staticmethod
     def get_role(role_id):
-        query = model_to_dict(Roles.get(Roles.role_id == role_id))
+        role = model_to_dict(Roles.get(Roles.role_id == role_id))
-        Roles['roles_flat'] = []
+
-        Roles['allowed_servers_flat'] = []
+        if role:
-        return query
+            servers_query = Role_Servers.select().join(Servers, JOIN.INNER).where(Role_Servers.role_id == role_id)
+            # TODO: this query needs to be narrower
+            servers = set()
+            for s in servers_query:
+                servers.add(s.server_id.server_id)
+            role['servers'] = servers
+            logger.debug("role: ({}) {}".format(role_id, role))
+            return role
+        else:
+            logger.debug("role: ({}) {}".format(role_id, {}))
+            return {}
+
+    @staticmethod
+    def update_role(role_id, role_data={}):
+        base_data = db_helper.get_role(role_id)
+        up_data = {}
+        added_servers = set()
+        removed_servers = set()
+        for key in role_data:
+            if key == "role_id":
+                continue
+            elif key == "servers":
+                added_servers = role_data['servers'].difference(base_data['servers'])
+                removed_servers = base_data['servers'].difference(role_data['servers'])
+            elif base_data[key] != role_data[key]:
+                up_data[key] = role_data[key]
+        up_data['last_update'] = helper.get_time_as_string()
+        logger.debug("role: {} +server:{} -server{}".format(role_data, added_servers, removed_servers))
+        with database.atomic():
+            for server in added_servers:
+                Role_Servers.get_or_create(role_id=role_id, server_id=server)
+                # TODO: This is horribly inefficient and we should be using bulk queries but im going for functionality at this point
+            Role_Servers.delete().where(Role_Servers.role_id == role_id).where(Role_Servers.server_id.in_(removed_servers)).execute()
+            if up_data:
+                Roles.update(up_data).where(Roles.role_id == role_id).execute()
+
+    @staticmethod
+    def add_role(role_name):
+        role_id = Roles.insert({
+            Roles.role_name: role_name.lower(),
+            Roles.created: helper.get_time_as_string()
+        }).execute()
+        return role_id
+
+    @staticmethod
+    def remove_role(role_id):
+        role = Roles.get(Roles.role_id == role_id)
+        return role.delete_instance()
+
+    @staticmethod
+    def role_id_exists(role_id):
+        if not db_shortcuts.get_role(role_id):
+            return False
+        return True
 
     @staticmethod
     def get_unactioned_commands():

app/classes/web/panel_handler.py

@@ -120,6 +120,7 @@ class PanelHandler(BaseHandler):
 
         elif page == 'panel_config':
             page_data['users'] = db_helper.get_all_users()
+            page_data['roles'] = db_helper.get_all_roles()
             exec_user = db_helper.get_user(user_data['user_id'])
             for user in page_data['users']:
                 if user.user_id != exec_user['user_id']:
@@ -137,22 +138,36 @@ class PanelHandler(BaseHandler):
             page_data['user']['created'] = "N/A"
             page_data['user']['last_login'] = "N/A"
             page_data['user']['last_ip'] = "N/A"
+            page_data['role']['last_update'] = "N/A"
             page_data['user']['roles'] = set()
             page_data['user']['servers'] = set()
 
+            exec_user = db_helper.get_user(user_data['user_id'])
+
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+
             page_data['roles_all'] = db_helper.get_all_roles()
             page_data['servers_all'] = controller.list_defined_servers()
             template = "panel/panel_edit_user.html"
 
         elif page == "edit_user":
             page_data['new_user'] = False
-            uid = self.get_argument('id', None)
+            user_id = self.get_argument('id', None)
-            page_data['user'] = db_helper.get_user(uid)
+            page_data['user'] = db_helper.get_user(user_id)
             page_data['roles_all'] = db_helper.get_all_roles()
             page_data['servers_all'] = controller.list_defined_servers()
 
             exec_user = db_helper.get_user(user_data['user_id'])
 
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+            elif user_id is None:
+                self.redirect("/panel/error?error=Invalid User ID")
+                return False
+
             if exec_user['user_id'] != page_data['user']['user_id']:
                 page_data['user']['api_token'] = "********"
             template = "panel/panel_edit_user.html"
@@ -187,6 +202,68 @@ class PanelHandler(BaseHandler):
                                        source_ip=self.get_remote_ip())
             self.redirect("/panel/panel_config")
 
+        elif page == "add_role":
+            page_data['new_role'] = True
+            page_data['role'] = {}
+            page_data['role']['role_name'] = ""
+            page_data['role']['role_id'] = -1
+            page_data['role']['created'] = "N/A"
+            page_data['role']['last_update'] = "N/A"
+            page_data['role']['servers'] = set()
+
+            exec_user = db_helper.get_user(user_data['user_id'])
+
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+
+            page_data['servers_all'] = controller.list_defined_servers()
+            template = "panel/panel_edit_role.html"
+
+        elif page == "edit_role":
+            page_data['new_role'] = False
+            role_id = self.get_argument('id', None)
+            page_data['role'] = db_helper.get_role(role_id)
+            page_data['servers_all'] = controller.list_defined_servers()
+
+            exec_user = db_helper.get_user(user_data['user_id'])
+
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+            elif role_id is None:
+                self.redirect("/panel/error?error=Invalid Role ID")
+                return False
+
+            template = "panel/panel_edit_role.html"
+
+        elif page == "remove_role":
+            role_id = bleach.clean(self.get_argument('id', None))
+
+            user_data = json.loads(self.get_secure_cookie("user_data"))
+            exec_user = db_helper.get_user(user_data['user_id'])
+
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+            elif role_id is None:
+                self.redirect("/panel/error?error=Invalid Role ID")
+                return False
+            else:
+                # does this user id exist?
+                target_role = db_helper.get_user(role_id)
+                if not target_role:
+                    self.redirect("/panel/error?error=Invalid Role ID")
+                    return False
+
+            db_helper.remove_role(role_id)
+
+            db_helper.add_to_audit_log(exec_user['user_id'],
+                                       "Removed role {} (RID:{})".format(target_role['role_name'], role_id),
+                                       server_id=0,
+                                       source_ip=self.get_remote_ip())
+            self.redirect("/panel/panel_config")
+
         elif page == "activity_logs":
             page_data['audit_logs'] = db_helper.get_actity_log()
 
@@ -286,14 +363,14 @@ class PanelHandler(BaseHandler):
                 return False
 
             roles = set()
-            for server in db_helper.get_all_roles():
+            for role in db_helper.get_all_roles():
                 argument = int(float(
                     bleach.clean(
-                        self.get_argument('role_{}_membership'.format(role['role_id']), '0')
+                        self.get_argument('role_{}_membership'.format(role.role_id), '0')
                     )
                 ))
                 if argument:
-                    servers.add(role['role_id'])
+                    roles.add(role.role_id)
 
             servers = set()
             for server in controller.list_defined_servers():
@@ -347,10 +424,10 @@ class PanelHandler(BaseHandler):
                 return False
 
             roles = set()
-            for server in db_helper.get_all_roles():
+            for role in db_helper.get_all_roles():
                 argument = int(float(
                     bleach.clean(
-                        self.get_argument('role_{}_membership'.format(role['role_id']), '0')
+                        self.get_argument('role_{}_membership'.format(role.role_id), '0')
                     )
                 ))
                 if argument:
@@ -378,3 +455,88 @@ class PanelHandler(BaseHandler):
                                        server_id=0,
                                        source_ip=self.get_remote_ip())
             self.redirect("/panel/panel_config")
+
+        elif page == "edit_role":
+            role_id = bleach.clean(self.get_argument('id', None))
+            role_name = bleach.clean(self.get_argument('role_name', None))
+
+            user_data = json.loads(self.get_secure_cookie("user_data"))
+            exec_user = db_helper.get_user(user_data['user_id'])
+
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+            elif role_name is None or role_name == "":
+                self.redirect("/panel/error?error=Invalid username")
+                return False
+            elif role_id is None:
+                self.redirect("/panel/error?error=Invalid Role ID")
+                return False
+            else:
+                # does this user id exist?
+                if not db_helper.role_id_exists(role_id):
+                    self.redirect("/panel/error?error=Invalid Role ID")
+                    return False
+
+            servers = set()
+            for server in controller.list_defined_servers():
+                argument = int(float(
+                    bleach.clean(
+                        self.get_argument('server_{}_access'.format(server['server_id']), '0')
+                    )
+                ))
+                if argument:
+                    servers.add(server['server_id'])
+
+            role_data = {
+                "role_name": role_name,
+                "servers": servers
+            }
+            db_helper.update_role(role_id, role_data=role_data)
+
+            db_helper.add_to_audit_log(exec_user['user_id'],
+                                       "Edited role {} (RID:{}) with servers {}".format(role_name, role_id, servers),
+                                       server_id=0,
+                                       source_ip=self.get_remote_ip())
+            self.redirect("/panel/panel_config")
+
+
+        elif page == "add_role":
+            role_name = bleach.clean(self.get_argument('role_name', None))
+
+            user_data = json.loads(self.get_secure_cookie("user_data"))
+            exec_user = db_helper.get_user(user_data['user_id'])
+            if not exec_user['superuser']:
+                self.redirect("/panel/error?error=Unauthorized access: not superuser")
+                return False
+            elif role_name is None or role_name == "":
+                self.redirect("/panel/error?error=Invalid role name")
+                return False
+            else:
+                # does this user id exist?
+                if db_helper.get_roleid_by_name(role_name) is not None:
+                    self.redirect("/panel/error?error=Role exists")
+                    return False
+
+            servers = set()
+            for server in controller.list_defined_servers():
+                argument = int(float(
+                    bleach.clean(
+                        self.get_argument('server_{}_access'.format(server['server_id']), '0')
+                    )
+                ))
+                if argument:
+                    servers.add(server['server_id'])
+
+            role_id = db_helper.add_role(role_name)
+            db_helper.update_role(role_id, {"servers": servers})
+
+            db_helper.add_to_audit_log(exec_user['user_id'],
+                                       "Added role {} (RID:{})".format(role_name, role_id),
+                                       server_id=0,
+                                       source_ip=self.get_remote_ip())
+            db_helper.add_to_audit_log(exec_user['user_id'],
+                                       "Edited role {} (RID:{}) with servers {}".format(role_name, role_id, servers),
+                                       server_id=0,
+                                       source_ip=self.get_remote_ip())
+            self.redirect("/panel/panel_config")

app/frontend/templates/panel/panel_config.html

@@ -77,7 +77,43 @@
                 </div>
               </div>
             </div>
+          </div>
+          <div class="row">
+            <div class="col-md-12 col-lg-12 grid-margin stretch-card">
+              <div class="card">
+                <div class="card-header header-sm d-flex justify-content-between align-items-center">
+                  <h4 class="card-title"><i class="fas fa-server"></i> Roles</h4>
+                  <div class="d-md-none">
+                    <small>Can't see everything on mobile?<br /> Try scrolling the table sideways.</small>
+                  </div>
+                  <div><a class="nav-link" href="/panel/add_role"><i class="fas fa-plus-circle"></i> &nbsp; Add New Role</a></div>
+                </div>
+                <div class="card-body">
+                  <div class="table-responsive">
+                    <table class="table">
+                      <thead>
+                        <tr class="rounded">
+                          <th>Role</th>
+                          <th>Allowed Servers</th>
+                          <th>Edit</th>
+                        </tr>
+                      </thead>
+                      <tbody>
+                      {% for role in data['roles'] %}
+                        <tr>
+                          <td>{{ role.role_name }}</td>
+                          <td>{{ [] }}</td>
+                          <td><a href="/panel/edit_role?id={{role.role_id}}"><i class="fas fa-pencil-alt"></i></a></td>
+                        </tr>
+                      {% end %}
 
+                      </tbody>
+                    </table>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
         </div>
       </div>
     </div>

app/frontend/templates/panel/panel_edit_role.html

@@ -0,0 +1,159 @@
+{% extends ../base.html %}
+
+{% block meta %}
+<!--  <meta http-equiv="refresh" content="60">-->
+{% end %}
+
+{% block title %}Crafty Controller - Edit Role{% end %}
+
+{% block content %}
+
+<div class="content-wrapper">
+
+    <!-- Page Title Header Starts-->
+  <div class="row page-title-header">
+    <div class="col-12">
+      <div class="page-header">
+        {% if data['new_role'] %}
+          <h4 class="page-title">
+            New Role
+              <br />
+              <small>RID: N/A</small>
+          </h4>
+        {% else %}
+          <h4 class="page-title">
+            Edit Role - {{ data['role']['role_name'] }}
+              <br />
+              <small>RID: {{ data['role']['role_id'] }}</small>
+          </h4>
+        {% end %}
+      </div>
+    </div>
+
+  </div>
+  <!-- Page Title Header Ends-->
+
+  <div class="row">
+
+    <div class="col-sm-12 grid-margin">
+      <div class="card">
+        <div class="card-body  pt-0">
+            <ul class="nav nav-tabs col-md-12 tab-simple-styled " role="tablist">
+              <li class="nav-item">
+                <a class="nav-link active" href="/panel/edit_role?id={{ data['role']['role_name'] }}&subpage=config" role="tab" aria-selected="true">
+                  <i class="fas fa-cogs"></i>Config</a>
+              </li>
+              <li class="nav-item">
+                <a class="nav-link" href="/panel/edit_role?id={{ data['role']['role_name'] }}&subpage=other" role="tab" aria-selected="false">
+                  <i class="fas fa-folder-tree"></i>Other</a>
+              </li>
+            </ul>
+
+            <div class="row">
+                <div class="col-md-6 col-sm-12">
+                  {% if data['new_role'] %}
+                    <form class="forms-sample" method="post" action="/panel/add_role">
+                  {% else %}
+                    <form class="forms-sample" method="post" action="/panel/edit_role">
+                  {% end %}
+                      {% raw xsrf_form_html() %}
+                      <input type="hidden" name="id" value="{{ data['role']['role_id'] }}">
+                      <input type="hidden" name="subpage" value="config">
+
+                      <div class="form-group">
+                        <label for="role_name">Role Name <small class="text-muted ml-1"> - What you wish to call this role</small> </label>
+                        <input type="text" class="form-control" name="role_name" id="role_name" value="{{ data['role']['role_name']  }}" placeholder="Role Name" >
+                      </div>
+
+                      <div class="form-group">
+                        <label for="server_membership">Servers <small class="text-muted ml-1"> - servers this role is allowed to access </small> </label>
+                        <div class="table-responsive">
+                          <table class="table">
+                            <thead>
+                              <tr class="rounded">
+                                <th>Server Name</th>
+                                <th>Access?</th>
+                              </tr>
+                            </thead>
+                            <tbody>
+                            {% for server in data['servers_all'] %}
+                              <tr>
+                                <td>{{ server['server_name'] }}</td>
+                                <td>
+                                  {% if server['server_id'] in data['role']['servers'] %}
+                                    <input type="checkbox" class="form-check-input" id="server_{{ server['server_id'] }}_access" name="server_{{ server['server_id'] }}_access" checked="" value="1">
+                                  {% else %}
+                                    <input type="checkbox" class="form-check-input" id="server_{{ server['server_id'] }}_access" name="server_{{ server['server_id'] }}_access" value="1">
+                                  {% end %}
+                                </td>
+                              </tr>
+                            {% end %}
+
+                            </tbody>
+                          </table>
+                        </div>
+                      </div>
+
+                      <button type="submit" class="btn btn-success mr-2">Save</button>
+                      <button type="reset" class="btn btn-light">Cancel</button>
+                    </form>
+                </div>
+
+                <div class="col-md-6 col-sm-12">
+                    <div class="card">
+                      <div class="card-body">
+                        <h4 class="card-title">Role Config Area</h4>
+                        <p class="card-description"> Here is where you can change the configuration of your role</p>
+                        <blockquote class="blockquote">
+                          <p class="mb-0">
+                              Created: {{ str(data['role']['created']) }}
+                              <br />
+                              Last updated: {{ str(data['role']['last_update']) }}
+                              <br />
+                          </p>
+                        </blockquote>
+                      </div>
+                    </div>
+                    <div class="text-center">
+                        {% if data['new_role'] %}
+                            <a class="btn btn-sm btn-danger disabled">Delete Role</a><br />
+                            <small>You cannot delete something that does not yet exist</small>
+                        {% else %}
+                            <a href="/panel/remove_role?id={{ data['role']['role_id'] }}" class="btn btn-sm btn-danger">Delete Role</a>
+                        {% end %}
+
+                    </div>
+                </div>
+            </div>
+
+        </div>
+      </div>
+    </div>
+  </div>
+
+
+
+</div>
+<!-- content-wrapper ends -->
+
+{% end %}
+
+{% block js %}
+<script>
+
+
+    //used to get cookies from browser - this is part of tornados xsrf protection - it's for extra security
+    function getCookie(name) {
+        var r = document.cookie.match("\\b" + name + "=([^;]*)\\b");
+        return r ? r[1] : undefined;
+    }
+
+    $( document ).ready(function() {
+        console.log( "ready!" );
+
+    });
+
+
+</script>
+
+{% end %}

app/frontend/templates/panel/panel_edit_user.html

@@ -90,10 +90,10 @@
                               <tr>
                                 <td>{{ role.role_name }}</td>
                                 <td>
-                                  {% if role['role_id'] in data['user']['roles'] %}
+                                  {% if role.role_id in data['user']['roles'] %}
-                                    <input type="checkbox" class="form-check-input" id="role_{{ role['role_id'] }}_access" name="role_{{ role['role_id'] }}_access" checked="" value="1">
+                                    <input type="checkbox" class="form-check-input" id="role_{{ role.role_id }}_membership" name="role_{{ role.role_id }}_membership" checked="" value="1">
                                   {% else %}
-                                    <input type="checkbox" class="form-check-input" id="role_{{ role['role_id'] }}_access" name="role_{{ role['role_id'] }}_access" value="1">
+                                    <input type="checkbox" class="form-check-input" id="role_{{ role.role_id }}_membership" name="role_{{ role.role_id }}_membership" value="1">
                                   {% end %}
 
                                 </td>
@@ -177,6 +177,8 @@
                               <br />
                               Last login: {{ str(data['user']['last_login']) }}
                               <br />
+                              Last update: {{ str(data['user']['last_update']) }}
+                              <br />
                               Last IP: {{ data['user']['last_ip'] }}
                               <br />
                               API Key: {{ data['user']['api_token'] }}