mirror of
https://github.com/jumpserver/jumpserver.git
synced 2025-10-22 00:09:14 +00:00
Dev beta (#3048)
* [Update] 统一url地址 * [Update] 修改api * [Update] 使用规范的签名 * [Update] 修改url * [Update] 修改swagger * [Update] 添加serializer class避免报错 * [Update] 修改token * [Update] 支持api key * [Update] 支持生成api key * [Update] 修改api重定向 * [Update] 修改翻译 * [Update] 添加说明文档 * [Update] 修复浏览器关闭后session不失效的问题 * [Update] 修改一些内容 * [Update] 修改 jms脚本 * [Update] 修改重定向 * [Update] 修改搜索trim * [Update] 修改搜索trim * [Update] 添加sys log * [Bugfix] 修改登陆错误 * [Update] 优化User操作private_token的接口 (#3091) * [Update] 优化User操作private_token的接口 * [Update] 优化User操作private_token的接口 2 * [Bugfix] 解决授权了一个节点，当移动节点后，被移动的节点下的资产会放到未分组节点下的问题 * [Update] 升级jquery * [Update] 默认使用page * [Update] 修改使用Orgmodel view set * [Update] 支持 nv的硬盘 https://github.com/jumpserver/jumpserver/issues/1804 * [UPdate] 解决命令执行宽度问题 * [Update] 优化节点 * [Update] 修改nodes过多时创建比较麻烦 * [Update] 修改导入 * [Update] 节点获取更新 * [Update] 修改nodes * [Update] nodes显示full value * [Update] 统一使用nodes select2 函数 * [Update] 修改磁盘大小小数 * [Update] 修改 Node service * [Update] 优化授权节点 * [Update] 修改 node permission * [Update] 修改asset permission * [Stash] * [Update] 修改node assets api * [Update] 修改tree service，支持资产数量 * [Update] 修改暂时完成 * [Update] 修改一些bug
This commit is contained in:
老广
GitHub
@@ -1,245 +1,27 @@
|
||||
# coding: utf-8
|
||||
|
||||
import time
|
||||
import uuid
|
||||
import re
|
||||
from collections import defaultdict
|
||||
import json
|
||||
from hashlib import md5
|
||||
import itertools
|
||||
from functools import reduce
|
||||
|
||||
from django.utils import timezone
|
||||
from django.db.models import Q
|
||||
from django.core.cache import cache
|
||||
from django.conf import settings
|
||||
|
||||
from orgs.utils import set_to_root_org
|
||||
from common.utils import get_logger, timeit
|
||||
from common.tree import TreeNode
|
||||
from assets.utils import NodeUtil
|
||||
from .. import const
|
||||
from ..models import AssetPermission, Action
|
||||
from ..hands import Node, Asset
|
||||
from .stack import PermSystemUserNodeUtil, PermAssetsAmountUtil
|
||||
from assets.utils import TreeService
|
||||
from ..models import AssetPermission
|
||||
from ..hands import Node, Asset, SystemUser
|
||||
|
||||
logger = get_logger(__file__)
|
||||
|
||||
|
||||
__all__ = [
|
||||
'AssetPermissionUtil', 'is_obj_attr_has', 'sort_assets',
|
||||
'ParserNode',
|
||||
'is_obj_attr_has', 'sort_assets',
|
||||
'ParserNode', 'AssetPermissionUtilV2',
|
||||
]
|
||||
|
||||
|
||||
class GenerateTree:
|
||||
def __init__(self):
|
||||
"""
|
||||
nodes = {
|
||||
node.key: {
|
||||
"system_users": {
|
||||
system_user.id: actions,
|
||||
},
|
||||
"assets": set([asset.id,]),
|
||||
},
|
||||
}
|
||||
assets = {
|
||||
asset.id: {
|
||||
system_user.id: actions,
|
||||
},
|
||||
}
|
||||
"""
|
||||
self._node_util = None
|
||||
self.nodes = defaultdict(lambda: {
|
||||
"system_users": defaultdict(int), "assets": set(),
|
||||
"assets_amount": 0, "all_assets": set(),
|
||||
})
|
||||
self.assets = defaultdict(lambda: defaultdict(int))
|
||||
self._root_node = None
|
||||
self._ungroup_node = None
|
||||
self._nodes_with_assets = None
|
||||
self._all_assets_nodes_key = None
|
||||
self._asset_counter = 0
|
||||
self._system_user_counter = 0
|
||||
self._nodes_assets_counter = 0
|
||||
|
||||
@property
|
||||
def node_util(self):
|
||||
if not self._node_util:
|
||||
self._node_util = NodeUtil()
|
||||
return self._node_util
|
||||
|
||||
@staticmethod
|
||||
def key_sort(key):
|
||||
key_list = [int(i) for i in key.split(':')]
|
||||
return len(key_list), key_list
|
||||
|
||||
@property
|
||||
def root_key(self):
|
||||
if self._root_node:
|
||||
return self._root_node
|
||||
all_keys = self.nodes.keys()
|
||||
# 如果没有授权节点，就放到默认的根节点下
|
||||
if not all_keys:
|
||||
return None
|
||||
root_key = min(all_keys, key=self.key_sort)
|
||||
self._root_key = root_key
|
||||
return root_key
|
||||
|
||||
@property
|
||||
def all_assets_nodes_keys(self):
|
||||
if not self._all_assets_nodes_key:
|
||||
self._all_assets_nodes_key = Asset.get_all_nodes_keys()
|
||||
return self._all_assets_nodes_key
|
||||
|
||||
@property
|
||||
def ungrouped_key(self):
|
||||
if self._ungroup_node:
|
||||
return self._ungroup_node
|
||||
if self.root_key:
|
||||
node_key = "{}:{}".format(self.root_key, '-1')
|
||||
else:
|
||||
node_key = '1:-1'
|
||||
self._ungroup_node = node_key
|
||||
return node_key
|
||||
|
||||
@timeit
|
||||
def add_assets_without_system_users(self, assets_ids):
|
||||
for asset_id in assets_ids:
|
||||
self.add_asset(asset_id, {})
|
||||
|
||||
@timeit
|
||||
def add_assets(self, assets_ids_with_system_users):
|
||||
for asset_id, system_users_ids in assets_ids_with_system_users.items():
|
||||
self.add_asset(asset_id, system_users_ids)
|
||||
|
||||
# @timeit
|
||||
def add_asset(self, asset_id, system_users_ids=None):
|
||||
"""
|
||||
:param asset_id:
|
||||
:param system_users_ids: {system_user.id: actions, }
|
||||
:return:
|
||||
"""
|
||||
if not system_users_ids:
|
||||
system_users_ids = defaultdict(int)
|
||||
|
||||
# 获取已有资产的系统用户和actions，并更新到最新系统用户信息中
|
||||
old_system_users_ids = self.assets[asset_id]
|
||||
for system_user_id, action in old_system_users_ids.items():
|
||||
system_users_ids[system_user_id] |= action
|
||||
|
||||
asset_nodes_keys = self.all_assets_nodes_keys.get(asset_id, [])
|
||||
# {asset.id: [node.key, ], }
|
||||
# 获取用户在的节点
|
||||
in_nodes = set(self.nodes.keys()) & set(asset_nodes_keys)
|
||||
if not in_nodes:
|
||||
self.nodes[self.ungrouped_key]["assets"].add(asset_id)
|
||||
self.assets[asset_id] = system_users_ids
|
||||
return
|
||||
|
||||
# 遍历用户应该在的节点
|
||||
for key in in_nodes:
|
||||
# 把自己加入到树上的节点中
|
||||
self.nodes[key]["assets"].add(asset_id)
|
||||
# 获取自己所在节点的系统用户，并添加进去
|
||||
node_system_users_ids = self.nodes[key]["system_users"]
|
||||
for system_user_id, action in node_system_users_ids.items():
|
||||
system_users_ids[system_user_id] |= action
|
||||
self.assets[asset_id] = system_users_ids
|
||||
|
||||
def add_node(self, node_key, system_users_ids=None):
|
||||
"""
|
||||
:param node_key: node.key
|
||||
:param system_users_ids: {system_user.id: actions,}
|
||||
:return:
|
||||
"""
|
||||
if not system_users_ids:
|
||||
system_users_ids = defaultdict(int)
|
||||
self.nodes[node_key]["system_users"] = system_users_ids
|
||||
|
||||
# 添加树节点
|
||||
@timeit
|
||||
def add_nodes(self, nodes_keys_with_system_users_ids):
|
||||
"""
|
||||
:param nodes_keys_with_system_users_ids:
|
||||
{node.key: {system_user.id: actions,}, }
|
||||
:return:
|
||||
"""
|
||||
util = PermSystemUserNodeUtil()
|
||||
family = util.get_nodes_family_and_system_users(nodes_keys_with_system_users_ids)
|
||||
for key, system_users in family.items():
|
||||
self.add_node(key, system_users)
|
||||
|
||||
def get_assets(self):
|
||||
"""
|
||||
:return:
|
||||
[
|
||||
{"id": asset.id, "system_users": {system_user.id: actions, }},
|
||||
]
|
||||
"""
|
||||
assets = []
|
||||
for asset_id, system_users in self.assets.items():
|
||||
assets.append({"id": asset_id, "system_users": system_users})
|
||||
return assets
|
||||
|
||||
def set_ungrouped_assets_nodes_if_need(self):
|
||||
if settings.PERM_SINGLE_ASSET_TO_UNGROUP_NODE:
|
||||
return
|
||||
ungrouped_assets_ids = self.nodes[self.ungrouped_key]["assets"]
|
||||
for asset_id in ungrouped_assets_ids:
|
||||
in_nodes = self.all_assets_nodes_keys.get(asset_id, [])
|
||||
for node_key in in_nodes:
|
||||
parents_keys = self.node_util.get_nodes_parents_keys_by_key(node_key, with_self=False)
|
||||
for parent_key in parents_keys:
|
||||
n = self.nodes[parent_key]
|
||||
self.nodes[node_key]["assets"].add(asset_id)
|
||||
self.nodes.pop(self.ungrouped_key, None)
|
||||
|
||||
@timeit
|
||||
def get_nodes_with_assets(self):
|
||||
"""
|
||||
:return:
|
||||
[
|
||||
{
|
||||
'key': node.key,
|
||||
'assets_amount': 10
|
||||
'assets': {
|
||||
asset.id: {
|
||||
system_user.id: actions,
|
||||
},
|
||||
},
|
||||
},
|
||||
]
|
||||
"""
|
||||
if self._nodes_with_assets:
|
||||
return self._nodes_with_assets
|
||||
self.set_ungrouped_assets_nodes_if_need()
|
||||
util = PermAssetsAmountUtil()
|
||||
nodes_with_assets_amount = util.compute_nodes_assets_amount(self.nodes)
|
||||
nodes = []
|
||||
for key, values in nodes_with_assets_amount.items():
|
||||
assets = {asset_id: self.assets.get(asset_id) for asset_id in values["assets"]}
|
||||
all_assets = {asset_id: self.assets.get(asset_id) for asset_id in values["all_assets"]}
|
||||
nodes.append({
|
||||
"key": key, "assets": assets, "all_assets": all_assets,
|
||||
"assets_amount": values["assets_amount"]
|
||||
})
|
||||
# 如果返回空节点，页面构造授权资产树报错
|
||||
if not nodes:
|
||||
nodes.append({
|
||||
"key": const.EMPTY_NODE_KEY, "assets": {}, "assets_amount": 0,
|
||||
"all_assets": {},
|
||||
})
|
||||
nodes.sort(key=lambda n: self.key_sort(n["key"]))
|
||||
self._nodes_with_assets = nodes
|
||||
return nodes
|
||||
|
||||
def get_nodes(self):
|
||||
self.set_ungrouped_assets_nodes_if_need()
|
||||
nodes = list(self.nodes.keys())
|
||||
if not nodes:
|
||||
nodes.append(const.EMPTY_NODE_KEY)
|
||||
return list(nodes)
|
||||
|
||||
|
||||
def get_user_permissions(user, include_group=True):
|
||||
if include_group:
|
||||
groups = user.groups.all()
|
||||
@@ -274,170 +56,7 @@ def get_system_user_permissions(system_user):
|
||||
)
|
||||
|
||||
|
||||
class AssetPermissionCacheMixin:
|
||||
CACHE_KEY_PREFIX = '_ASSET_PERM_CACHE_V2_'
|
||||
CACHE_META_KEY_PREFIX = '_ASSET_PERM_META_KEY_V2_'
|
||||
CACHE_TIME = settings.ASSETS_PERM_CACHE_TIME
|
||||
CACHE_POLICY_MAP = (('0', 'never'), ('1', 'using'), ('2', 'refresh'))
|
||||
cache_policy = '1'
|
||||
obj_id = ''
|
||||
_filter_id = None
|
||||
|
||||
@classmethod
|
||||
def is_not_using_cache(cls, cache_policy):
|
||||
return cls.CACHE_TIME == 0 or cache_policy in cls.CACHE_POLICY_MAP[0]
|
||||
|
||||
@classmethod
|
||||
def is_using_cache(cls, cache_policy):
|
||||
return cls.CACHE_TIME != 0 and cache_policy in cls.CACHE_POLICY_MAP[1]
|
||||
|
||||
@classmethod
|
||||
def is_refresh_cache(cls, cache_policy):
|
||||
return cache_policy in cls.CACHE_POLICY_MAP[2]
|
||||
|
||||
def _is_not_using_cache(self):
|
||||
return self.is_not_using_cache(self.cache_policy)
|
||||
|
||||
def _is_using_cache(self):
|
||||
return self.is_using_cache(self.cache_policy)
|
||||
|
||||
def _is_refresh_cache(self):
|
||||
return self.is_refresh_cache(self.cache_policy)
|
||||
|
||||
#@timeit
|
||||
def get_cache_key(self, resource):
|
||||
cache_key = self.CACHE_KEY_PREFIX + '{obj_id}_{filter_id}_{resource}'
|
||||
return cache_key.format(
|
||||
obj_id=self.obj_id, filter_id=self._filter_id,
|
||||
resource=resource
|
||||
)
|
||||
|
||||
@property
|
||||
def node_asset_key(self):
|
||||
return self.get_cache_key('NODES_WITH_ASSETS')
|
||||
|
||||
@property
|
||||
def node_key(self):
|
||||
return self.get_cache_key('NODES')
|
||||
|
||||
@property
|
||||
def asset_key(self):
|
||||
key = self.get_cache_key('ASSETS')
|
||||
return key
|
||||
|
||||
@property
|
||||
def system_key(self):
|
||||
return self.get_cache_key('SYSTEM_USER')
|
||||
|
||||
def get_resource_from_cache(self, resource):
|
||||
logger.debug("Try get resource from cache")
|
||||
key_map = {
|
||||
"assets": self.asset_key,
|
||||
"nodes": self.node_key,
|
||||
"nodes_with_assets": self.node_asset_key,
|
||||
"system_users": self.system_key
|
||||
}
|
||||
key = key_map.get(resource)
|
||||
if not key:
|
||||
raise ValueError("Not a valid resource: {}".format(resource))
|
||||
cached = cache.get(key)
|
||||
if not cached:
|
||||
logger.debug("Not found resource cache, update it")
|
||||
self.update_cache()
|
||||
cached = cache.get(key)
|
||||
return cached
|
||||
|
||||
def get_resource(self, resource):
|
||||
if self._is_using_cache():
|
||||
logger.debug("Using cache to get resource")
|
||||
return self.get_resource_from_cache(resource)
|
||||
elif self._is_refresh_cache():
|
||||
logger.debug("Need refresh cache")
|
||||
self.expire_cache()
|
||||
data = self.get_resource_from_cache(resource)
|
||||
return data
|
||||
else:
|
||||
logger.debug("Not using cache get source")
|
||||
return self.get_resource_without_cache(resource)
|
||||
|
||||
def get_resource_without_cache(self, resource):
|
||||
attr = 'get_{}_without_cache'.format(resource)
|
||||
return getattr(self, attr)()
|
||||
|
||||
def get_nodes_with_assets(self):
|
||||
return self.get_resource("nodes_with_assets")
|
||||
|
||||
def get_assets(self):
|
||||
return self.get_resource("assets")
|
||||
|
||||
def get_nodes(self):
|
||||
return self.get_resource("nodes")
|
||||
|
||||
def get_system_users(self):
|
||||
return self.get_resource("system_users")
|
||||
|
||||
def get_meta_cache_key(self):
|
||||
cache_key = self.CACHE_META_KEY_PREFIX + '{obj_id}_{filter_id}'
|
||||
key = cache_key.format(
|
||||
obj_id=self.obj_id, filter_id=self._filter_id
|
||||
)
|
||||
return key
|
||||
|
||||
@property
|
||||
def cache_meta(self):
|
||||
key = self.get_meta_cache_key()
|
||||
meta = cache.get(key) or {}
|
||||
# print("Meta key: {}".format(key))
|
||||
# print("Meta id: {}".format(meta["id"]))
|
||||
return meta
|
||||
|
||||
def update_cache(self):
|
||||
assets = self.get_resource_without_cache("assets")
|
||||
nodes_with_assets = self.get_resource_without_cache("nodes_with_assets")
|
||||
system_users = self.get_resource_without_cache("system_users")
|
||||
nodes = self.get_resource_without_cache("nodes")
|
||||
cache.set(self.asset_key, assets, self.CACHE_TIME)
|
||||
cache.set(self.node_asset_key, nodes_with_assets, self.CACHE_TIME)
|
||||
cache.set(self.system_key, system_users, self.CACHE_TIME)
|
||||
cache.set(self.node_key, nodes, self.CACHE_TIME)
|
||||
self.set_meta_to_cache()
|
||||
|
||||
def set_meta_to_cache(self):
|
||||
key = self.get_meta_cache_key()
|
||||
meta = {
|
||||
'id': str(uuid.uuid4()),
|
||||
'datetime': timezone.now(),
|
||||
'object': str(self.object)
|
||||
}
|
||||
# print("Set meta key: {}".format(key))
|
||||
# print("set meta to cache: {}".format(meta["id"]))
|
||||
cache.set(key, meta, self.CACHE_TIME)
|
||||
|
||||
def expire_cache_meta(self):
|
||||
cache_key = self.CACHE_META_KEY_PREFIX + '{obj_id}_*'
|
||||
key = cache_key.format(obj_id=self.obj_id)
|
||||
cache.delete_pattern(key)
|
||||
|
||||
def expire_cache(self):
|
||||
"""
|
||||
因为 获取用户的节点，资产，系统用户等都能会缓存，这里会清理所有与该对象有关的
|
||||
缓存，以免造成不统一的情况
|
||||
:return:
|
||||
"""
|
||||
cache_key = self.CACHE_KEY_PREFIX + '{obj_id}_*'
|
||||
key = cache_key.format(obj_id='*')
|
||||
cache.delete_pattern(key)
|
||||
self.expire_cache_meta()
|
||||
|
||||
@classmethod
|
||||
def expire_all_cache(cls):
|
||||
key = cls.CACHE_KEY_PREFIX + '*'
|
||||
cache.delete_pattern(key)
|
||||
meta_key = cls.CACHE_META_KEY_PREFIX + '*'
|
||||
cache.delete_pattern(meta_key)
|
||||
|
||||
|
||||
class AssetPermissionUtil(AssetPermissionCacheMixin):
|
||||
class AssetPermissionUtilV2:
|
||||
get_permissions_map = {
|
||||
"User": get_user_permissions,
|
||||
"UserGroup": get_user_group_permissions,
|
||||
@@ -457,15 +76,13 @@ class AssetPermissionUtil(AssetPermissionCacheMixin):
|
||||
self._permissions_id = None # 标记_permission的唯一值
|
||||
self._assets = None
|
||||
self._filter_id = 'None' # 当通过filter更改 permission是标记
|
||||
self.cache_policy = cache_policy
|
||||
self.tree = GenerateTree()
|
||||
self.change_org_if_need()
|
||||
self.nodes = None
|
||||
self._nodes = None
|
||||
self._assets_direct = None
|
||||
self._nodes_direct = None
|
||||
self.node_util = NodeUtil()
|
||||
self.tree._node_util = self.node_util
|
||||
self._user_tree = None
|
||||
self.full_tree = Node.tree()
|
||||
|
||||
@staticmethod
|
||||
def change_org_if_need():
|
||||
@@ -483,49 +100,11 @@ class AssetPermissionUtil(AssetPermissionCacheMixin):
|
||||
|
||||
@timeit
|
||||
def filter_permissions(self, **filters):
|
||||
filters_json = json.dumps(filters, sort_keys=True)
|
||||
self._permissions = self.permissions.filter(**filters)
|
||||
self._filter_id = md5(filters_json.encode()).hexdigest()
|
||||
|
||||
@timeit
|
||||
def get_nodes_direct(self):
|
||||
"""
|
||||
返回直接授权的节点，
|
||||
并将节点添加到tree.nodes中，并将节点下的资产添加到tree.assets中
|
||||
:return:
|
||||
{node.key: {system_user.id: actions,}, }
|
||||
"""
|
||||
if self._nodes_direct:
|
||||
return self._nodes_direct
|
||||
nodes_keys = defaultdict(lambda: defaultdict(int))
|
||||
for perm in self.permissions:
|
||||
actions = [perm.actions]
|
||||
system_users_ids = [s.id for s in perm.system_users.all()]
|
||||
_nodes_keys = [n.key for n in perm.nodes.all()]
|
||||
iterable = itertools.product(_nodes_keys, system_users_ids, actions)
|
||||
for node_key, sys_id, action in iterable:
|
||||
nodes_keys[node_key][sys_id] |= action
|
||||
|
||||
self.tree.add_nodes(nodes_keys)
|
||||
|
||||
all_nodes_keys = set()
|
||||
for key in nodes_keys:
|
||||
children_keys = self.node_util.get_all_children_keys_by_key(key)
|
||||
all_nodes_keys.update(set(children_keys))
|
||||
|
||||
if all_nodes_keys:
|
||||
assets_ids = Asset.objects.filter(
|
||||
nodes__key__in=all_nodes_keys
|
||||
).valid().values_list("id", flat=True).distinct()
|
||||
else:
|
||||
assets_ids = []
|
||||
self.tree.add_assets_without_system_users(assets_ids)
|
||||
self._nodes_direct = nodes_keys
|
||||
return nodes_keys
|
||||
|
||||
def get_nodes_without_cache(self):
|
||||
self.get_assets_without_cache()
|
||||
return self.tree.get_nodes()
|
||||
@property
|
||||
def user_tree(self):
|
||||
return self.get_user_tree()
|
||||
|
||||
@timeit
|
||||
def get_assets_direct(self):
|
||||
@@ -535,48 +114,209 @@ class AssetPermissionUtil(AssetPermissionCacheMixin):
|
||||
:return:
|
||||
{asset.id: {system_user.id: actions, }, }
|
||||
"""
|
||||
if self._assets_direct:
|
||||
return self._assets_direct
|
||||
assets_ids = defaultdict(lambda: defaultdict(int))
|
||||
for perm in self.permissions:
|
||||
actions = [perm.actions]
|
||||
_assets_ids = perm.assets.valid().values_list("id", flat=True)
|
||||
system_users_ids = perm.system_users.values_list("id", flat=True)
|
||||
iterable = itertools.product(_assets_ids, system_users_ids, actions)
|
||||
for asset_id, sys_id, action in iterable:
|
||||
assets_ids[asset_id][sys_id] |= action
|
||||
self.tree.add_assets(assets_ids)
|
||||
self._assets_direct = assets_ids
|
||||
return assets_ids
|
||||
assets_ids = self.permissions.values_list('assets', flat=True)
|
||||
return Asset.objects.filter(id__in=assets_ids)
|
||||
|
||||
@timeit
|
||||
def get_assets_without_cache(self):
|
||||
def get_nodes_direct(self):
|
||||
"""
|
||||
返回直接授权的节点，
|
||||
并将节点添加到tree.nodes中，并将节点下的资产添加到tree.assets中
|
||||
:return:
|
||||
[
|
||||
{"id": asset.id, "system_users": {system_user.id: actions, }},
|
||||
]
|
||||
{node.key: {system_user.id: actions,}, }
|
||||
"""
|
||||
if self._assets:
|
||||
return self._assets
|
||||
self.get_nodes_direct()
|
||||
self.get_assets_direct()
|
||||
assets = self.tree.get_assets()
|
||||
self._assets = assets
|
||||
return assets
|
||||
nodes_ids = self.permissions.values_list('nodes', flat=True)
|
||||
return Node.objects.filter(id__in=nodes_ids)
|
||||
|
||||
@timeit
|
||||
def get_nodes_with_assets_without_cache(self):
|
||||
self.get_assets_without_cache()
|
||||
nodes_assets = self.tree.get_nodes_with_assets()
|
||||
return nodes_assets
|
||||
def add_direct_nodes_to_user_tree(self, user_tree):
|
||||
nodes_direct_keys = self.permissions \
|
||||
.exclude(nodes__isnull=True) \
|
||||
.values_list('nodes__key', flat=True) \
|
||||
.distinct()
|
||||
nodes_direct_keys = list(nodes_direct_keys)
|
||||
# 排序，保证从上层节点开始加
|
||||
nodes_direct_keys.sort(key=lambda x: len(x))
|
||||
for key in nodes_direct_keys:
|
||||
# 如果树上已经有这个节点，代表子树已经存在
|
||||
if user_tree.contains(key):
|
||||
continue
|
||||
# 找到这个节点的父节点，如果父节点不在树上，则挂到ROOT上
|
||||
parent = self.full_tree.parent(key)
|
||||
if not user_tree.contains(parent.identifier):
|
||||
parent = user_tree.root_node()
|
||||
subtree = self.full_tree.subtree(key)
|
||||
user_tree.paste(parent.identifier, subtree, deep=True)
|
||||
|
||||
def get_system_users_without_cache(self):
|
||||
system_users = set()
|
||||
permissions = self.permissions.prefetch_related('system_users')
|
||||
for perm in permissions:
|
||||
system_users.update(perm.system_users.all())
|
||||
return system_users
|
||||
for node in user_tree.all_nodes_itr():
|
||||
assets = list(self.full_tree.assets(node.identifier))
|
||||
user_tree.set_assets(node.identifier, assets)
|
||||
|
||||
@timeit
|
||||
def add_single_assets_node_to_user_tree(self, user_tree):
|
||||
# 添加单独授权资产的节点
|
||||
nodes_single_assets = defaultdict(set)
|
||||
queryset = self.permissions.exclude(assets__isnull=True) \
|
||||
.values_list('assets', 'assets__nodes__key') \
|
||||
.distinct()
|
||||
|
||||
for item in queryset:
|
||||
nodes_single_assets[item[1]].add(item[0])
|
||||
# Todo: 游离资产
|
||||
nodes_single_assets.pop(None, None)
|
||||
|
||||
for key in tuple(nodes_single_assets.keys()):
|
||||
if user_tree.contains(key):
|
||||
nodes_single_assets.pop(key)
|
||||
|
||||
# 获取单独授权资产，并没有在授权的节点上
|
||||
for key, assets in nodes_single_assets.items():
|
||||
node = self.full_tree.get_node(key, deep=True)
|
||||
parent_id = self.full_tree.parent(key).identifier
|
||||
parent = user_tree.get_node(parent_id)
|
||||
if not parent:
|
||||
parent = user_tree.root_node()
|
||||
user_tree.add_node(node, parent)
|
||||
user_tree.set_assets(node.identifier, assets)
|
||||
|
||||
@timeit
|
||||
def parse_user_tree_to_full_tree(self, user_tree):
|
||||
# 开始修正user_tree，保证父节点都在树上
|
||||
root_children = user_tree.children('')
|
||||
for child in root_children:
|
||||
if child.identifier.isdigit():
|
||||
continue
|
||||
ancestors = self.full_tree.ancestors(
|
||||
child.identifier, with_self=False, deep=True
|
||||
)
|
||||
if not ancestors:
|
||||
continue
|
||||
parent_id = ancestors[0].identifier
|
||||
user_tree.safe_add_ancestors(ancestors)
|
||||
user_tree.move_node(child.identifier, parent_id)
|
||||
|
||||
@timeit
|
||||
def get_user_tree(self):
|
||||
if self._user_tree:
|
||||
return self._user_tree
|
||||
user_tree = TreeService()
|
||||
full_tree_root = self.full_tree.root_node()
|
||||
user_tree.create_node(
|
||||
tag=full_tree_root.tag,
|
||||
identifier=full_tree_root.identifier
|
||||
)
|
||||
self.add_direct_nodes_to_user_tree(user_tree)
|
||||
self.add_single_assets_node_to_user_tree(user_tree)
|
||||
self.parse_user_tree_to_full_tree(user_tree)
|
||||
self._user_tree = user_tree
|
||||
return user_tree
|
||||
|
||||
# Todo: 是否可以获取多个资产的系统用户
|
||||
def get_asset_system_users_with_actions(self, asset):
|
||||
nodes = asset.get_nodes()
|
||||
nodes_keys_related = set()
|
||||
for node in nodes:
|
||||
ancestor_keys = node.get_ancestor_keys(with_self=True)
|
||||
nodes_keys_related.update(set(ancestor_keys))
|
||||
pattern = []
|
||||
for key in nodes_keys_related:
|
||||
pattern.append(r'^{0}$|^{0}:'.format(key))
|
||||
pattern = '|'.join(list(pattern))
|
||||
kwargs = {"assets": asset}
|
||||
|
||||
if pattern:
|
||||
kwargs["nodes__key__regex"] = pattern
|
||||
|
||||
queryset = self.permissions
|
||||
if len(kwargs) == 1:
|
||||
queryset = queryset.filter(**kwargs)
|
||||
elif len(kwargs) > 1:
|
||||
kwargs = [{k: v} for k, v in kwargs.items()]
|
||||
args = [Q(**kw) for kw in kwargs]
|
||||
args = reduce(lambda x, y: x | y, args)
|
||||
queryset = queryset.filter(args)
|
||||
else:
|
||||
queryset = queryset.none()
|
||||
queryset = queryset.distinct().prefetch_related('system_users')
|
||||
system_users_actions = defaultdict(int)
|
||||
for perm in queryset:
|
||||
system_users = perm.system_users.all()
|
||||
if not system_users or not perm.actions:
|
||||
continue
|
||||
for s in system_users:
|
||||
if not asset.has_protocol(s.protocol):
|
||||
continue
|
||||
system_users_actions[s] |= perm.actions
|
||||
return system_users_actions
|
||||
|
||||
def get_permissions_nodes_and_assets(self):
|
||||
permissions = self.permissions.values_list('assets', 'nodes__key').distinct()
|
||||
nodes_keys = set()
|
||||
assets_ids = set()
|
||||
for asset_id, node_key in permissions:
|
||||
if asset_id:
|
||||
assets_ids.add(asset_id)
|
||||
if node_key:
|
||||
nodes_keys.add(node_key)
|
||||
nodes_keys = self.clean_nodes_keys(nodes_keys)
|
||||
return nodes_keys, assets_ids
|
||||
|
||||
@staticmethod
|
||||
def filter_assets_by_or_kwargs(kwargs):
|
||||
if len(kwargs) == 1:
|
||||
queryset = Asset.objects.filter(**kwargs)
|
||||
elif len(kwargs) > 1:
|
||||
kwargs = [{k: v} for k, v in kwargs.items()]
|
||||
args = [Q(**kw) for kw in kwargs]
|
||||
args = reduce(lambda x, y: x | y, args)
|
||||
queryset = Asset.objects.filter(args)
|
||||
else:
|
||||
queryset = Asset.objects.none()
|
||||
return queryset
|
||||
|
||||
@timeit
|
||||
def get_assets(self):
|
||||
nodes_keys, assets_ids = self.get_permissions_nodes_and_assets()
|
||||
pattern = set()
|
||||
for key in nodes_keys:
|
||||
pattern.add(r'^{0}$|^{0}:'.format(key))
|
||||
pattern = '|'.join(list(pattern))
|
||||
kwargs = {}
|
||||
if assets_ids:
|
||||
kwargs["id__in"] = assets_ids
|
||||
if pattern:
|
||||
kwargs["nodes__key__regex"] = pattern
|
||||
queryset = self.filter_assets_by_or_kwargs(kwargs)
|
||||
return queryset.valid().distinct()
|
||||
|
||||
def get_nodes_assets(self, node, deep=False):
|
||||
if deep:
|
||||
assets_ids = self.user_tree.all_assets(node.key)
|
||||
else:
|
||||
assets_ids = self.user_tree.assets(node.key)
|
||||
queryset = Asset.objects.filter(id__in=assets_ids)
|
||||
return queryset.valid().distinct()
|
||||
|
||||
@staticmethod
|
||||
def clean_nodes_keys(nodes_keys):
|
||||
nodes_keys = sorted(list(nodes_keys), key=lambda x: (len(x), x))
|
||||
nodes_keys_clean = []
|
||||
for key in nodes_keys[::-1]:
|
||||
found = False
|
||||
for k in nodes_keys:
|
||||
if key.startswith(k + ':'):
|
||||
found = True
|
||||
break
|
||||
if not found:
|
||||
nodes_keys_clean.append(key)
|
||||
return nodes_keys_clean
|
||||
|
||||
def get_nodes(self):
|
||||
return [n.identifier for n in self.user_tree.all_nodes_itr()]
|
||||
|
||||
def get_system_users(self):
|
||||
system_users_id = self.permissions.values_list('system_users', flat=True).distinct()
|
||||
return SystemUser.objects.filter(id__in=system_users_id)
|
||||
|
||||
|
||||
def is_obj_attr_has(obj, val, attrs=("hostname", "ip", "comment")):
|
||||
@@ -610,6 +350,7 @@ class ParserNode:
|
||||
@staticmethod
|
||||
def parse_node_to_tree_node(node):
|
||||
name = '{} ({})'.format(node.value, node.assets_amount)
|
||||
# name = node.value
|
||||
data = {
|
||||
'id': node.key,
|
||||
'name': name,
|
||||
@@ -630,23 +371,12 @@ class ParserNode:
|
||||
return tree_node
|
||||
|
||||
@staticmethod
|
||||
def parse_asset_to_tree_node(node, asset, system_users):
|
||||
def parse_asset_to_tree_node(node, asset):
|
||||
icon_skin = 'file'
|
||||
if asset.platform.lower() == 'windows':
|
||||
icon_skin = 'windows'
|
||||
elif asset.platform.lower() == 'linux':
|
||||
icon_skin = 'linux'
|
||||
_system_users = []
|
||||
for system_user in system_users:
|
||||
_system_users.append({
|
||||
'id': system_user.id,
|
||||
'name': system_user.name,
|
||||
'username': system_user.username,
|
||||
'protocol': system_user.protocol,
|
||||
'priority': system_user.priority,
|
||||
'login_mode': system_user.login_mode,
|
||||
'actions': [Action.value_to_choices(system_user.actions)],
|
||||
})
|
||||
data = {
|
||||
'id': str(asset.id),
|
||||
'name': asset.hostname,
|
||||
@@ -656,7 +386,6 @@ class ParserNode:
|
||||
'open': False,
|
||||
'iconSkin': icon_skin,
|
||||
'meta': {
|
||||
'system_users': _system_users,
|
||||
'type': 'asset',
|
||||
'asset': {
|
||||
'id': asset.id,
|
||||
|
||||
Reference in New Issue
Block a user