Skip to content

Commit 820d8ac

Browse files
simonLeary42simonLeary42
committed
modifiers
1 parent ca94443 commit 820d8ac

File tree

16 files changed

+40
-61
lines changed

16 files changed

+40
-61
lines changed

‎defaults/config.ini.default‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,15 +29,15 @@ user_ou = "ou=users,dc=unityhpc,dc=test" ; User organizational unit (may contai
2929
group_ou = "ou=groups,dc=unityhpc,dc=test" ; Group organizational unit
3030
pigroup_ou = "ou=pi_groups,dc=unityhpc,dc=test" ; PI Group organizational unit
3131
orggroup_ou = "ou=org_groups,dc=unityhpc,dc=test" ; ORG group organizational unit
32-
admin_group = "cn=web_admins,dc=unityhpc,dc=test" ; admin dn (members of this group are admins on the web portal)
33-
qualified_user_group = "cn=unityusers,dc=unityhpc,dc=test" ; Qualified user group (in at least one PI group)
34-
locked_user_group = "cn=locked,dc=unityhpc,dc=test" ; locked user group dn
35-
idlelocked_user_group = "cn=idlelocked,dc=unityhpc,dc=test" ; idlelocked user group dn
36-
ghost_user_group = "cn=ghost,dc=unityhpc,dc=test" ; ghost user group dn
3732
def_user_shell = "/bin/bash" ; Default shell for new users
3833
offset_UIDGID = 1000000 ; start point when allocating new UID/GID pairs for a new user
3934
offset_PIGID = 2000000 ; start point when allocating new GID for a new PI group
4035
offset_ORGGID = 3000000 ; start point when allocating new GID for a new org group
36+
user_modifier_groups[admin] = "cn=web_admins,dc=unityhpc,dc=test" ; admin user group dn
37+
user_modifier_groups[ghost] = "cn=ghost,dc=unityhpc,dc=test" ; ghost user group dn
38+
user_modifier_groups[idlelocked] = "cn=idlelocked,dc=unityhpc,dc=test" ; idlelocked user group dn
39+
user_modifier_groups[locked] = "cn=locked,dc=unityhpc,dc=test" ; locked user group dn
40+
user_modifier_groups[qualified] = "cn=unityusers,dc=unityhpc,dc=test" ; qualified user group (in at least one PI group)
4141

4242
[sql]
4343
host = "sql" ; mariadb hostname

‎resources/init.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
$_SESSION["SSO"] = $SSO;
4545

4646
$OPERATOR = new UnityUser($SSO["user"], $LDAP, $SQL, $MAILER, $WEBHOOK);
47-
$_SESSION["is_admin"] = $OPERATOR->isAdmin();
47+
$_SESSION["is_admin"] = $OPERATOR->getModifier("admin");
4848

4949
if (isset($_SESSION["viewUser"]) && $_SESSION["is_admin"]) {
5050
$USER = new UnityUser($_SESSION["viewUser"], $LDAP, $SQL, $MAILER, $WEBHOOK);

‎resources/lib/UnityGroup.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public function approveGroup(?UnityUser $operator = null, bool $send_mail = true
8585
if ($send_mail) {
8686
$this->MAILER->sendMail($this->getOwner()->getMail(), "group_created");
8787
}
88-
$this->getOwner()->setIsQualified(true); // having your own group makes you qualified
88+
$this->getOwner()->setModifier("qualified", true); // having your own group makes you qualified
8989
}
9090

9191
/**
@@ -191,7 +191,7 @@ public function approveUser(UnityUser $new_user, bool $send_mail = true): void
191191
"org" => $new_user->getOrg(),
192192
]);
193193
}
194-
$new_user->setIsQualified(true); // being in a group makes you qualified
194+
$new_user->setModifier("qualified", true); // being in a group makes you qualified
195195
}
196196

197197
public function denyUser(UnityUser $new_user, bool $send_mail = true): void

‎resources/lib/UnityLDAP.php‎

Lines changed: 6 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,7 @@ class UnityLDAP extends LDAPConn
3737
private LDAPEntry $pi_groupOU;
3838
private LDAPEntry $org_groupOU;
3939

40-
public PosixGroup $adminGroup;
41-
public PosixGroup $qualifiedUserGroup;
42-
public PosixGroup $lockedUserGroup;
43-
public PosixGroup $idlelockedUserGroup;
44-
public PosixGroup $ghostUserGroup;
40+
public array $userModifierGroups;
4541

4642
public function __construct()
4743
{
@@ -51,21 +47,10 @@ public function __construct()
5147
$this->groupOU = $this->getEntry(CONFIG["ldap"]["group_ou"]);
5248
$this->pi_groupOU = $this->getEntry(CONFIG["ldap"]["pigroup_ou"]);
5349
$this->org_groupOU = $this->getEntry(CONFIG["ldap"]["orggroup_ou"]);
54-
$this->adminGroup = new PosixGroup(
55-
new LDAPEntry($this->conn, CONFIG["ldap"]["admin_group"]),
56-
);
57-
$this->qualifiedUserGroup = new PosixGroup(
58-
new LDAPEntry($this->conn, CONFIG["ldap"]["qualified_user_group"]),
59-
);
60-
$this->lockedUserGroup = new PosixGroup(
61-
new LDAPEntry($this->conn, CONFIG["ldap"]["locked_user_group"]),
62-
);
63-
$this->idlelockedUserGroup = new PosixGroup(
64-
new LDAPEntry($this->conn, CONFIG["ldap"]["idlelocked_user_group"]),
65-
);
66-
$this->ghostUserGroup = new PosixGroup(
67-
new LDAPEntry($this->conn, CONFIG["ldap"]["ghost_user_group"]),
68-
);
50+
$this->userModifierGroups = [];
51+
foreach (CONFIG["ldap"]["user_modifier_groups"] as $gid => $dn) {
52+
$this->userModifierGroups[$gid] = new PosixGroup(new LDAPEntry($this->conn, $dn));
53+
}
6954
}
7055

7156
public function getUserOU(): LDAPEntry
@@ -199,7 +184,7 @@ public function getQualifiedUsersUIDs(): array
199184
{
200185
// should not use $user_ou->getChildren or $base_ou->getChildren(objectClass=posixAccount)
201186
// qualified users might be outside user ou, and not all users in LDAP tree are qualified users
202-
return $this->qualifiedUserGroup->getMemberUIDs();
187+
return $this->userModifierGroups["qualified"]->getMemberUIDs();
203188
}
204189

205190
public function getQualifiedUsers($UnitySQL, $UnityMailer, $UnityWebhook): array

‎resources/lib/UnityUser.php‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -97,31 +97,33 @@ public function init(
9797
$this->SQL->addLog($this->uid, $_SERVER["REMOTE_ADDR"], "user_added", $this->uid);
9898
}
9999

100-
public function isQualified(): bool
100+
public function getModifier($modifier): bool
101101
{
102-
return $this->LDAP->qualifiedUserGroup->memberUIDExists($this->uid);
102+
return $this->LDAP->userModifierGroups[$modifier]->memberUIDExists($this->uid);
103103
}
104104

105-
public function setIsQualified(bool $newIsQualified, bool $doSendMail = true): void
105+
public function setModifier($modifier, bool $newValue, bool $doSendMail = true): void
106106
{
107-
$oldIsQualified = $this->isQualified();
108-
if ($oldIsQualified == $newIsQualified) {
107+
$oldValue = $this->getModifier($modifier);
108+
if ($oldValue == $newValue) {
109109
return;
110110
}
111-
if ($newIsQualified) {
112-
$this->LDAP->qualifiedUserGroup->addMemberUID($this->uid);
111+
if ($newValue) {
112+
$this->LDAP->userModifierGroups[$modifier]->addMemberUID($this->uid);
113113
if ($doSendMail) {
114-
$this->MAILER->sendMail($this->getMail(), "user_qualified", [
114+
$this->MAILER->sendMail($this->getMail(), "user_modifier_added", [
115115
"user" => $this->uid,
116116
"org" => $this->getOrg(),
117+
"modifier" => $modifier,
117118
]);
118119
}
119120
} else {
120-
$this->LDAP->qualifiedUserGroup->removeMemberUID($this->uid);
121+
$this->LDAP->userModifierGroups[$modifier]->removeMemberUID($this->uid);
121122
if ($doSendMail) {
122-
$this->MAILER->sendMail($this->getMail(), "user_dequalified", [
123+
$this->MAILER->sendMail($this->getMail(), "user_modifier_removed", [
123124
"user" => $this->uid,
124125
"org" => $this->getOrg(),
126+
"modifier" => $modifier,
125127
]);
126128
}
127129
}
@@ -315,14 +317,6 @@ public function getHomeDir(): string
315317
return $this->entry->getAttribute("homedirectory");
316318
}
317319

318-
/**
319-
* Checks if the current account is an admin
320-
*/
321-
public function isAdmin(): bool
322-
{
323-
return $this->LDAP->adminGroup->memberUIDExists($this->uid);
324-
}
325-
326320
/**
327321
* Checks if current user is a PI
328322
*/

‎test/functional/PIBecomeApproveTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public function testApprovePI()
6464

6565
$this->assertRequestedPIGroup(false);
6666
$this->assertTrue($pi_group->exists());
67-
$this->assertTrue($USER->isQualified());
67+
$this->assertTrue($USER->getModifier("qualified"));
6868

6969
// $third_request_failed = false;
7070
// try {

‎test/functional/PiMemberApproveTest.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ public function testApproveMemberByPI()
107107
$this->assertTrue(!$pi_group->requestExists($USER));
108108
$this->assertRequestedMembership(false, $gid);
109109
$this->assertTrue($pi_group->memberUIDExists($USER->uid));
110-
$this->assertTrue($USER->isQualified());
110+
$this->assertTrue($USER->getModifier("qualified"));
111111

112112
// $third_request_failed = false;
113113
// try {
@@ -167,7 +167,7 @@ public function testApproveMemberByAdmin()
167167
$this->assertTrue(!$pi_group->requestExists($USER));
168168
$this->assertRequestedMembership(false, $gid);
169169
$this->assertTrue($pi_group->memberUIDExists($USER->uid));
170-
$this->assertTrue($USER->isQualified());
170+
$this->assertTrue($USER->getModifier("qualified"));
171171

172172
// $third_request_failed = false;
173173
// try {

‎test/functional/ViewAsUserTest.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ public function _testViewAsUser(array $beforeUser, array $afterUser)
1010
switchUser(...$afterUser);
1111
$afterUid = $USER->uid;
1212
switchUser(...$beforeUser);
13-
// $this->assertTrue($USER->isAdmin());
13+
// $this->assertTrue($USER->getModifier("admin"));
1414
$beforeUid = $USER->uid;
1515
// $this->assertNotEquals($afterUid, $beforeUid);
1616
http_post(__DIR__ . "/../../webroot/admin/user-mgmt.php", [
@@ -57,7 +57,7 @@ public function testNonAdminViewAsAdmin()
5757
global $USER;
5858
switchUser(...getAdminUser());
5959
$adminUid = $USER->uid;
60-
$this->assertTrue($USER->isAdmin());
60+
$this->assertTrue($USER->getModifier("admin"));
6161
switchUser(...getNormalUser());
6262
http_post(__DIR__ . "/../../webroot/admin/user-mgmt.php", [
6363
"form_type" => "viewAsUser",

‎test/phpunit-bootstrap.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,8 +186,8 @@ function ensureUserDoesNotExist()
186186
$USER->getGroupEntry()->delete();
187187
ensure(!$USER->getGroupEntry()->exists());
188188
}
189-
$USER->setIsQualified(false);
190-
ensure(!$LDAP->qualifiedUserGroup->memberUIDExists($USER->uid));
189+
$USER->setModifier("qualified", false);
190+
ensure(!$LDAP->userModifierGroups["qualified"]->memberUIDExists($USER->uid));
191191
}
192192

193193
function ensureOrgGroupDoesNotExist()

‎webroot/admin/ajax/get_group_members.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
use UnityWebPortal\lib\UnityGroup;
66
use UnityWebPortal\lib\UnityHTTPD;
77

8-
if (!$USER->isAdmin()) {
8+
if (!$USER->getModifier("admin")) {
99
UnityHTTPD::forbidden("not an admin");
1010
}
1111

0 commit comments

Comments
 (0)