feat: Update v2.28.13

fix: 修复 LDAP 导入用户时指定其他组织，还会导入到 Default 组织的问题

.dockerignore

@@ -7,4 +7,5 @@ django.db
 celerybeat.pid
 ### Vagrant ###
 .vagrant/
-apps/xpack/.git
+apps/xpack/.git
+

.gitattributes

@@ -1,3 +1,4 @@
 *.mmdb filter=lfs diff=lfs merge=lfs -text
 *.mo filter=lfs diff=lfs merge=lfs -text
 *.ipdb filter=lfs diff=lfs merge=lfs -text
+

.github/release-config.yml

@@ -41,4 +41,5 @@ version-resolver:
   default: patch
 template: |
   ## 版本变化  What’s Changed
-  $CHANGES
+  $CHANGES
+

.gitignore

@@ -41,3 +41,4 @@ release/*
 releashe
 /apps/script.py
 data/*
+

CODE_OF_CONDUCT.md

@@ -126,3 +126,4 @@ enforcement ladder](https://github.com/mozilla/diversity).
 For answers to common questions about this code of conduct, see the FAQ at
 https://www.contributor-covenant.org/faq. Translations are available at
 https://www.contributor-covenant.org/translations.
+

CONTRIBUTING.md

@@ -23,3 +23,4 @@ When reporting issues, always include:
 
 Because the issues are open to the public, when submitting files, be sure to remove any sensitive information, e.g. user name, password, IP address, and company name. You can
 replace those parts with "REDACTED" or other strings like "****".
+

Dockerfile

@@ -1,52 +1,66 @@
+FROM python:3.8-slim as stage-build
+ARG TARGETARCH
+
+ARG VERSION
+ENV VERSION=$VERSION
+
+WORKDIR /opt/jumpserver
+ADD . .
+RUN cd utils && bash -ixeu build.sh
+
 FROM python:3.8-slim
+ARG TARGETARCH
 MAINTAINER JumpServer Team <ibuler@qq.com>
 
 ARG BUILD_DEPENDENCIES="              \
-    g++                               \
-    make                              \
-    pkg-config"
+        g++                           \
+        make                          \
+        pkg-config"
 
 ARG DEPENDENCIES="                    \
-    default-libmysqlclient-dev        \
-    freetds-dev                       \
-    libpq-dev                         \
-    libffi-dev                        \
-    libldap2-dev                      \
-    libsasl2-dev                      \
-    libxml2-dev                       \
-    libxmlsec1-dev                    \
-    libxmlsec1-openssl                \
-    libaio-dev                        \
-    sshpass"
+        default-libmysqlclient-dev    \
+        freetds-dev                   \
+        libpq-dev                     \
+        libffi-dev                    \
+        libjpeg-dev                   \
+        libldap2-dev                  \
+        libsasl2-dev                  \
+        libxml2-dev                   \
+        libxmlsec1-dev                \
+        libxmlsec1-openssl            \
+        libaio-dev                    \
+        openssh-client                \
+        sshpass"
 
 ARG TOOLS="                           \
-    curl                              \
-    default-mysql-client              \
-    iproute2                          \
-    iputils-ping                      \
-    locales                           \
-    procps                            \
-    redis-tools                       \
-    telnet                            \
-    vim                               \
-    unzip                             \
-    wget"
+        ca-certificates               \
+        curl                          \
+        default-mysql-client          \
+        iputils-ping                  \
+        locales                       \
+        procps                        \
+        redis-tools                   \
+        telnet                        \
+        vim                           \
+        unzip                         \
+        wget"
 
-RUN sed -i 's@http://.*.debian.org@http://mirrors.ustc.edu.cn@g' /etc/apt/sources.list \
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=core \
+    sed -i 's@http://.*.debian.org@http://mirrors.ustc.edu.cn@g' /etc/apt/sources.list \
+    && rm -f /etc/apt/apt.conf.d/docker-clean \
+    && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
     && apt-get update \
     && apt-get -y install --no-install-recommends ${BUILD_DEPENDENCIES} \
     && apt-get -y install --no-install-recommends ${DEPENDENCIES} \
     && apt-get -y install --no-install-recommends ${TOOLS} \
-    && localedef -c -f UTF-8 -i zh_CN zh_CN.UTF-8 \
-    && cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
     && mkdir -p /root/.ssh/ \
     && echo "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null" > /root/.ssh/config \
     && sed -i "s@# alias l@alias l@g" ~/.bashrc \
     && echo "set mouse-=a" > ~/.vimrc \
     && echo "no" | dpkg-reconfigure dash \
+    && echo "zh_CN.UTF-8" | dpkg-reconfigure locales \
     && rm -rf /var/lib/apt/lists/*
 
-ARG TARGETARCH
 ARG ORACLE_LIB_MAJOR=19
 ARG ORACLE_LIB_MINOR=10
 ENV ORACLE_FILE="instantclient-basiclite-linux.${TARGETARCH:-amd64}-${ORACLE_LIB_MAJOR}.${ORACLE_LIB_MINOR}.0.0.0dbru.zip"
@@ -67,21 +81,18 @@ ARG PIP_MIRROR=https://pypi.douban.com/simple
 ENV PIP_MIRROR=$PIP_MIRROR
 ARG PIP_JMS_MIRROR=https://pypi.douban.com/simple
 ENV PIP_JMS_MIRROR=$PIP_JMS_MIRROR
-# 因为以 jms 或者 jumpserver 开头的 mirror 上可能没有
-RUN pip install --upgrade pip==20.2.4 setuptools==49.6.0 wheel==0.34.2 -i ${PIP_MIRROR} \
-    && pip install --no-cache-dir $(grep -E 'jms|jumpserver' requirements/requirements.txt) -i ${PIP_JMS_MIRROR} \
-    && pip install --no-cache-dir -r requirements/requirements.txt -i ${PIP_MIRROR} \
-    && rm -rf ~/.cache/pip
 
-ARG VERSION
-ENV VERSION=$VERSION
+RUN --mount=type=cache,target=/root/.cache/pip \
+    set -ex \
+    && pip config set global.index-url ${PIP_MIRROR} \
+    && pip install --upgrade pip \
+    && pip install --upgrade setuptools wheel \
+    && pip install $(grep -E 'jms|jumpserver' requirements/requirements.txt) -i ${PIP_JMS_MIRROR} \
+    && pip install -r requirements/requirements.txt
 
-ADD . .
-RUN cd utils \
-    && bash -ixeu build.sh \
-    && mv ../release/jumpserver /opt/jumpserver \
-    && rm -rf /tmp/build \
-    && echo > /opt/jumpserver/config.yml
+COPY --from=stage-build /opt/jumpserver/release/jumpserver /opt/jumpserver
+RUN echo > /opt/jumpserver/config.yml \
+    && rm -rf /tmp/build
 
 WORKDIR /opt/jumpserver
 VOLUME /opt/jumpserver/data

Dockerfile.loong64

@@ -0,0 +1,95 @@
+FROM python:3.8-slim as stage-build
+ARG TARGETARCH
+
+ARG VERSION
+ENV VERSION=$VERSION
+
+WORKDIR /opt/jumpserver
+ADD . .
+RUN cd utils && bash -ixeu build.sh
+
+FROM python:3.8-slim
+ARG TARGETARCH
+MAINTAINER JumpServer Team <ibuler@qq.com>
+
+ARG BUILD_DEPENDENCIES="              \
+        g++                           \
+        make                          \
+        pkg-config"
+
+ARG DEPENDENCIES="                    \
+        default-libmysqlclient-dev    \
+        freetds-dev                   \
+        libpq-dev                     \
+        libffi-dev                    \
+        libjpeg-dev                   \
+        libldap2-dev                  \
+        libsasl2-dev                  \
+        libxml2-dev                   \
+        libxmlsec1-dev                \
+        libxmlsec1-openssl            \
+        libaio-dev                    \
+        openssh-client                \
+        sshpass"
+
+ARG TOOLS="                           \
+        ca-certificates               \
+        curl                          \
+        default-mysql-client          \
+        iputils-ping                  \
+        locales                       \
+        procps                        \
+        redis-tools                   \
+        telnet                        \
+        vim                           \
+        unzip                         \
+        wget"
+
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=core \
+    set -ex \
+    && ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime \
+    && apt-get update \
+    && apt-get -y install --no-install-recommends ${BUILD_DEPENDENCIES} \
+    && apt-get -y install --no-install-recommends ${DEPENDENCIES} \
+    && apt-get -y install --no-install-recommends ${TOOLS} \
+    && mkdir -p /root/.ssh/ \
+    && echo "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null" > /root/.ssh/config \
+    && sed -i "s@# alias l@alias l@g" ~/.bashrc \
+    && echo "set mouse-=a" > ~/.vimrc \
+    && echo "no" | dpkg-reconfigure dash \
+    && echo "zh_CN.UTF-8" | dpkg-reconfigure locales \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /tmp/build
+COPY ./requirements ./requirements
+
+ARG PIP_MIRROR=https://pypi.douban.com/simple
+ENV PIP_MIRROR=$PIP_MIRROR
+ARG PIP_JMS_MIRROR=https://pypi.douban.com/simple
+ENV PIP_JMS_MIRROR=$PIP_JMS_MIRROR
+
+RUN --mount=type=cache,target=/root/.cache/pip \
+    set -ex \
+    && pip config set global.index-url ${PIP_MIRROR} \
+    && pip install --upgrade pip \
+    && pip install --upgrade setuptools wheel \
+    && pip install https://download.jumpserver.org/pypi/simple/cryptography/cryptography-36.0.1-cp38-cp38-linux_loongarch64.whl \
+    && pip install https://download.jumpserver.org/pypi/simple/greenlet/greenlet-1.1.2-cp38-cp38-linux_loongarch64.whl \
+    && pip install $(grep 'PyNaCl' requirements/requirements.txt) \
+    && GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=true pip install grpcio \
+    && pip install $(grep -E 'jms|jumpserver' requirements/requirements.txt) -i ${PIP_JMS_MIRROR} \
+    && pip install -r requirements/requirements.txt
+
+COPY --from=stage-build /opt/jumpserver/release/jumpserver /opt/jumpserver
+RUN echo > /opt/jumpserver/config.yml \
+    && rm -rf /tmp/build
+
+WORKDIR /opt/jumpserver
+VOLUME /opt/jumpserver/data
+VOLUME /opt/jumpserver/logs
+
+ENV LANG=zh_CN.UTF-8
+
+EXPOSE 8070
+EXPOSE 8080
+ENTRYPOINT ["./entrypoint.sh"]

GITSHA

@@ -0,0 +1 @@
+6e2e92be5ed7056a9cec96dfe21707e317093bce

LICENSE

@@ -671,4 +671,5 @@ into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<https://www.gnu.org/licenses/why-not-lgpl.html>.
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
+

README.md

@@ -22,9 +22,7 @@ JumpServer 使用 Python 开发，配备了业界领先的 Web Terminal 方案
 
 JumpServer 采纳分布式架构，支持多机房跨区域部署，支持横向扩展，无资产数量及并发限制。
 
-改变世界，从一点点开始 ...
 
-> 如需进一步了解 JumpServer 开源项目，推荐阅读 [JumpServer 的初心和使命](https://mp.weixin.qq.com/s/S6q_2rP_9MwaVwyqLQnXzA)
 
 ### 特色优势
 
@@ -102,7 +100,7 @@ JumpServer 采纳分布式架构，支持多机房跨区域部署，支持横向
 - [沐瞳游戏：通过JumpServer管控多项目分布式资产](https://blog.fit2cloud.com/?p=3213)
 - [携程：JumpServer 堡垒机部署与运营实战](https://blog.fit2cloud.com/?p=851)
 - [大智慧：JumpServer 堡垒机让“大智慧”的混合 IT 运维更智慧](https://blog.fit2cloud.com/?p=882)
-- [小红书：的JumpServer堡垒机大规模资产跨版本迁移之路](https://blog.fit2cloud.com/?p=516)
+- [小红书：JumpServer 堡垒机大规模资产跨版本迁移之路](https://blog.fit2cloud.com/?p=516)
 - [中手游：JumpServer堡垒机助力中手游提升多云环境下安全运维能力](https://blog.fit2cloud.com/?p=732)
 - [中通快递：JumpServer主机安全运维实践](https://blog.fit2cloud.com/?p=708)
 - [东方明珠：JumpServer高效管控异构化、分布式云端资产](https://blog.fit2cloud.com/?p=687)

README_EN.md

@@ -92,4 +92,3 @@ Licensed under The GNU General Public License version 3 (GPLv3)  (the "License")
 https://www.gnu.org/licenses/gpl-3.0.htmll
 
 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
-

SECURITY.md

@@ -18,3 +18,4 @@ All security bugs should be reported to the contact as below:
 - ibuler@fit2cloud.com
 - support@fit2cloud.com
 - 400-052-0755
+

Vagrantfile

@@ -1,56 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-Vagrant.configure("2") do |config|
-  # The most common configuration options are documented and commented below.
-  # For a complete reference, please see the online documentation at
-  # https://docs.vagrantup.com.
-
-  # Every Vagrant development environment requires a box. You can search for
-  # boxes at https://vagrantcloud.com/search.
-  config.vm.box_check_update = false
-  config.vm.box = "centos/7"
-  config.vm.hostname = "jumpserver"
-  config.vm.network "private_network", ip: "172.17.8.101"
-  config.vm.provider "virtualbox" do |vb|
-    vb.memory = "4096"
-    vb.cpus = 2
-    vb.name = "jumpserver"
-  end
-
-  config.vm.synced_folder ".", "/vagrant", type: "rsync",
-    rsync__verbose: true,
-    rsync__exclude: ['.git*', 'node_modules*','*.log','*.box','Vagrantfile']
-
-  config.vm.provision "shell", inline: <<-SHELL
-## 设置yum的阿里云源
-sudo curl -o /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
-sudo sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
-sudo curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
-sudo yum makecache
-
-## 安装依赖包
-sudo yum install -y python36 python36-devel python36-pip \
-		 libtiff-devel libjpeg-devel libzip-devel freetype-devel \
-     lcms2-devel libwebp-devel tcl-devel tk-devel sshpass \
-     openldap-devel mariadb-devel mysql-devel libffi-devel \
-     openssh-clients telnet openldap-clients gcc
-
-## 配置pip阿里云源
-mkdir /home/vagrant/.pip
-cat << EOF | sudo tee -a /home/vagrant/.pip/pip.conf
-[global]
-timeout = 6000
-index-url = https://mirrors.aliyun.com/pypi/simple/
-
-[install]
-use-mirrors = true
-mirrors = https://mirrors.aliyun.com/pypi/simple/
-trusted-host=mirrors.aliyun.com
-EOF
-
-python3.6 -m venv /home/vagrant/venv
-source /home/vagrant/venv/bin/activate
-echo 'source /home/vagrant/venv/bin/activate' >> /home/vagrant/.bash_profile
-  SHELL
-end

apps/acls/serializers/login_acl.py

@@ -1,4 +1,4 @@
-from django.utils.translation import ugettext as _
+from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 from common.drf.serializers import BulkModelSerializer
 from common.drf.serializers import MethodSerializer

apps/applications/api/application.py

@@ -4,6 +4,7 @@ from orgs.mixins.api import OrgBulkModelViewSet
 from rest_framework.decorators import action
 from rest_framework.response import Response
 
+
 from common.tree import TreeNodeSerializer
 from common.mixins.api import SuggestionMixin
 from .. import serializers

apps/applications/apps.py

@@ -7,3 +7,7 @@ from django.apps import AppConfig
 class ApplicationsConfig(AppConfig):
     name = 'applications'
     verbose_name = _('Applications')
+
+    def ready(self):
+        from . import signal_handlers
+        super().ready()

apps/applications/const.py

@@ -27,6 +27,7 @@ class AppType(models.TextChoices):
     sqlserver = 'sqlserver', 'SQLServer'
     redis = 'redis', 'Redis'
     mongodb = 'mongodb', 'MongoDB'
+    clickhouse = 'clickhouse', 'ClickHouse'
 
     # remote-app category
     chrome = 'chrome', 'Chrome'
@@ -42,7 +43,7 @@ class AppType(models.TextChoices):
         return {
             AppCategory.db: [
                 cls.mysql, cls.mariadb, cls.oracle, cls.pgsql,
-                cls.sqlserver, cls.redis, cls.mongodb
+                cls.sqlserver, cls.redis, cls.mongodb, cls.clickhouse
             ],
             AppCategory.remote_app: [
                 cls.chrome, cls.mysql_workbench,
@@ -82,10 +83,4 @@ class AppType(models.TextChoices):
 
         if AppCategory.is_xpack(category):
             return True
-        return tp in ['oracle', 'postgresql', 'sqlserver']
-
-
-class OracleVersion(models.TextChoices):
-    version_11g = '11g', '11g'
-    version_12c = '12c', '12c'
-    version_other = 'other', _('Other')
+        return tp in ['oracle', 'postgresql', 'sqlserver', 'clickhouse']

apps/applications/migrations/0024_alter_application_type.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.14 on 2022-11-04 07:06
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('applications', '0023_auto_20220715_1556'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='application',
+            name='type',
+            field=models.CharField(choices=[('mysql', 'MySQL'), ('mariadb', 'MariaDB'), ('oracle', 'Oracle'), ('postgresql', 'PostgreSQL'), ('sqlserver', 'SQLServer'), ('redis', 'Redis'), ('mongodb', 'MongoDB'), ('clickhouse', 'ClickHouse'), ('chrome', 'Chrome'), ('mysql_workbench', 'MySQL Workbench'), ('vmware_client', 'vSphere Client'), ('custom', 'Custom'), ('k8s', 'Kubernetes')], max_length=16, verbose_name='Type'),
+        ),
+    ]

apps/applications/models/application.py

@@ -10,9 +10,7 @@ from common.mixins import CommonModelMixin
 from common.tree import TreeNode
 from common.utils import is_uuid
 from assets.models import Asset, SystemUser
-from ..const import OracleVersion
 
-from ..utils import KubernetesTree
 from .. import const
 
 
@@ -175,6 +173,7 @@ class ApplicationTreeNodeMixin:
         return pid
 
     def as_tree_node(self, pid, k8s_as_tree=False):
+        from ..utils import KubernetesTree
         if self.type == const.AppType.k8s and k8s_as_tree:
             node = KubernetesTree(pid).as_tree_node(self)
         else:
@@ -304,15 +303,6 @@ class Application(CommonModelMixin, OrgModelMixin, ApplicationTreeNodeMixin):
             target_ip = self.attrs.get('host')
         return target_ip
 
-    def get_target_protocol_for_oracle(self):
-        """ Oracle 类型需要单独处理，因为要携带版本号 """
-        if not self.is_type(self.APP_TYPE.oracle):
-            return
-        version = self.attrs.get('version', OracleVersion.version_12c)
-        if version == OracleVersion.version_other:
-            return
-        return 'oracle_%s' % version
-
 
 class ApplicationUser(SystemUser):
     class Meta:

apps/applications/serializers/application.py

@@ -16,7 +16,7 @@ from .. import const
 
 __all__ = [
     'AppSerializer', 'MiniAppSerializer', 'AppSerializerMixin',
-    'AppAccountSerializer', 'AppAccountSecretSerializer'
+    'AppAccountSerializer', 'AppAccountSecretSerializer', 'AppAccountBackUpSerializer'
 ]
 
 
@@ -32,21 +32,23 @@ class AppSerializerMixin(serializers.Serializer):
         return instance
 
     def get_attrs_serializer(self):
-        default_serializer = serializers.Serializer(read_only=True)
         instance = self.app
-        if instance:
-            _type = instance.type
-            _category = instance.category
-        else:
-            _type = self.context['request'].query_params.get('type')
-            _category = self.context['request'].query_params.get('category')
-        if _type:
-            if isinstance(self, AppAccountSecretSerializer):
-                serializer_class = type_secret_serializer_classes_mapping.get(_type)
+        tp = getattr(self, 'tp', None)
+        default_serializer = serializers.Serializer(read_only=True)
+        if not tp:
+            if instance:
+                tp = instance.type
+                category = instance.category
             else:
-                serializer_class = type_serializer_classes_mapping.get(_type)
-        elif _category:
-            serializer_class = category_serializer_classes_mapping.get(_category)
+                tp = self.context['request'].query_params.get('type')
+                category = self.context['request'].query_params.get('category')
+        if tp:
+            if isinstance(self, AppAccountBackUpSerializer):
+                serializer_class = type_secret_serializer_classes_mapping.get(tp)
+            else:
+                serializer_class = type_serializer_classes_mapping.get(tp)
+        elif category:
+            serializer_class = category_serializer_classes_mapping.get(category)
         else:
             serializer_class = default_serializer
 
@@ -154,11 +156,6 @@ class AppAccountSerializer(AppSerializerMixin, AuthSerializerMixin, BulkOrgResou
 
 class AppAccountSecretSerializer(SecretReadableMixin, AppAccountSerializer):
     class Meta(AppAccountSerializer.Meta):
-        fields_backup = [
-            'id', 'app_display', 'attrs', 'username', 'password', 'private_key',
-            'public_key', 'date_created', 'date_updated', 'version'
-        ]
-
         extra_kwargs = {
             'password': {'write_only': False},
             'private_key': {'write_only': False},
@@ -166,3 +163,22 @@ class AppAccountSecretSerializer(SecretReadableMixin, AppAccountSerializer):
             'app_display': {'label': _('Application display')},
             'systemuser_display': {'label': _('System User')}
         }
+
+
+class AppAccountBackUpSerializer(AppAccountSecretSerializer):
+    class Meta(AppAccountSecretSerializer.Meta):
+        fields = [
+            'id', 'app_display', 'attrs', 'username', 'password', 'private_key',
+            'public_key', 'date_created', 'date_updated', 'version'
+        ]
+
+    def __init__(self, *args, **kwargs):
+        self.tp = kwargs.pop('tp', None)
+        super().__init__(*args, **kwargs)
+
+    @classmethod
+    def setup_eager_loading(cls, queryset):
+        return queryset
+
+    def to_representation(self, instance):
+        return super(AppAccountSerializer, self).to_representation(instance)

apps/applications/serializers/attrs/application_category/db.py

@@ -13,3 +13,14 @@ class DBSerializer(serializers.Serializer):
     database = serializers.CharField(
         max_length=128, required=True, allow_null=True, label=_('Database')
     )
+    use_ssl = serializers.BooleanField(default=False, label=_('Use SSL'))
+    ca_cert = serializers.CharField(
+        required=False, allow_null=True, label=_('CA certificate')
+    )
+    client_cert = serializers.CharField(
+        required=False, allow_null=True, label=_('Client certificate file')
+    )
+    cert_key = serializers.CharField(
+        required=False, allow_null=True, label=_('Certificate key file')
+    )
+    allow_invalid_cert = serializers.BooleanField(default=False, label=_('Allow invalid cert'))

apps/applications/serializers/attrs/application_type/__init__.py

@@ -6,6 +6,7 @@ from .pgsql import *
 from .sqlserver import *
 from .redis import *
 from .mongodb import *
+from .clickhouse import *
 
 from .chrome import *
 from .mysql_workbench import *

apps/applications/serializers/attrs/application_type/chrome.py

@@ -23,7 +23,7 @@ class ChromeSerializer(RemoteAppSerializer):
     )
     chrome_password = EncryptedField(
         max_length=128, allow_blank=True, required=False,
-        label=_('Chrome password'), allow_null=True
+        label=_('Chrome password'), allow_null=True, encrypted_key='chrome_password'
     )
 
 

apps/applications/serializers/attrs/application_type/clickhouse.py

@@ -0,0 +1,16 @@
+from rest_framework import serializers
+from django.utils.translation import ugettext_lazy as _
+
+from ..application_category import DBSerializer
+
+__all__ = ['ClickHouseSerializer']
+
+
+class ClickHouseSerializer(DBSerializer):
+    port = serializers.IntegerField(
+        default=9000, label=_('Port'), allow_null=True,
+        help_text=_(
+            'Typically, the port is 9000，'
+            'the HTTP interface and the native interface use different ports'
+        ),
+    )

apps/applications/serializers/attrs/application_type/oracle.py

@@ -2,15 +2,9 @@ from rest_framework import serializers
 from django.utils.translation import ugettext_lazy as _
 
 from ..application_category import DBSerializer
-from applications.const import OracleVersion
 
 __all__ = ['OracleSerializer']
 
 
 class OracleSerializer(DBSerializer):
-    version = serializers.ChoiceField(
-        choices=OracleVersion.choices, default=OracleVersion.version_12c,
-        allow_null=True, label=_('Version'),
-        help_text=_('Magnus currently supports only 11g and 12c connections')
-    )
     port = serializers.IntegerField(default=1521, label=_('Port'), allow_null=True)

apps/applications/serializers/attrs/attrs.py

@@ -31,6 +31,7 @@ type_serializer_classes_mapping = {
     const.AppType.sqlserver.value: application_type.SQLServerSerializer,
     const.AppType.redis.value: application_type.RedisSerializer,
     const.AppType.mongodb.value: application_type.MongoDBSerializer,
+    const.AppType.clickhouse.value: application_type.ClickHouseSerializer,
     # cloud
     const.AppType.k8s.value: application_type.K8SSerializer
 }

apps/applications/signal_handlers.py

@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+#

apps/applications/utils/kubernetes_util.py

@@ -1,18 +1,14 @@
 # -*- coding: utf-8 -*-
-from urllib3.exceptions import MaxRetryError
 from urllib.parse import urlencode
 
+from kubernetes import client
 from kubernetes.client import api_client
 from kubernetes.client.api import core_v1_api
-from kubernetes import client
-from kubernetes.client.exceptions import ApiException
-
 from rest_framework.generics import get_object_or_404
 
-from common.utils import get_logger
-from common.tree import TreeNode
 from assets.models import SystemUser
-
+from common.tree import TreeNode
+from common.utils import get_logger
 from .. import const
 
 logger = get_logger(__file__)
@@ -23,7 +19,8 @@ class KubernetesClient:
         self.url = url
         self.token = token
 
-    def get_api(self):
+    @property
+    def api(self):
         configuration = client.Configuration()
         configuration.host = self.url
         configuration.verify_ssl = False
@@ -32,63 +29,46 @@ class KubernetesClient:
         api = core_v1_api.CoreV1Api(c)
         return api
 
-    def get_namespace_list(self):
-        api = self.get_api()
-        namespace_list = []
-        for ns in api.list_namespace().items:
-            namespace_list.append(ns.metadata.name)
-        return namespace_list
+    def get_namespaces(self):
+        namespaces = []
+        resp = self.api.list_namespace()
+        for ns in resp.items:
+            namespaces.append(ns.metadata.name)
+        return namespaces
 
-    def get_services(self):
-        api = self.get_api()
-        ret = api.list_service_for_all_namespaces(watch=False)
-        for i in ret.items:
-            print("%s \t%s \t%s \t%s \t%s \n" % (
-                i.kind, i.metadata.namespace, i.metadata.name, i.spec.cluster_ip, i.spec.ports))
+    def get_pods(self, namespace):
+        pods = []
+        resp = self.api.list_namespaced_pod(namespace)
+        for pd in resp.items:
+            pods.append(pd.metadata.name)
+        return pods
 
-    def get_pod_info(self, namespace, pod):
-        api = self.get_api()
-        resp = api.read_namespaced_pod(namespace=namespace, name=pod)
-        return resp
+    def get_containers(self, namespace, pod_name):
+        containers = []
+        resp = self.api.read_namespaced_pod(pod_name, namespace)
+        for container in resp.spec.containers:
+            containers.append(container.name)
+        return containers
 
-    def get_pod_logs(self, namespace, pod):
-        api = self.get_api()
-        log_content = api.read_namespaced_pod_log(pod, namespace, pretty=True, tail_lines=200)
-        return log_content
+    @classmethod
+    def run(cls, asset, secret, tp='namespace'):
+        k8s_url = f'{asset.address}'
+        k8s = cls(k8s_url, secret)
+        func_name = f'get_{tp}s'
+        if hasattr(k8s, func_name):
+            return getattr(k8s, func_name)()
+        return []
 
-    def get_pods(self):
-        api = self.get_api()
-        try:
-            ret = api.list_pod_for_all_namespaces(watch=False, _request_timeout=(3, 3))
-        except MaxRetryError:
-            logger.warning('Kubernetes connection timed out')
-            return
-        except ApiException as e:
-            if e.status == 401:
-                logger.warning('Kubernetes User not authenticated')
-            else:
-                logger.warning(e)
-            return
-        data = {}
-        for i in ret.items:
-            namespace = i.metadata.namespace
-            pod_info = {
-                'pod_name': i.metadata.name,
-                'containers': [j.name for j in i.spec.containers]
-            }
-            if namespace in data:
-                data[namespace].append(pod_info)
-            else:
-                data[namespace] = [pod_info, ]
-        return data
-
-    @staticmethod
-    def get_kubernetes_data(app_id, system_user_id):
+    @classmethod
+    def get_kubernetes_data(cls, app_id, system_user_id, tp, *args):
         from ..models import Application
         app = get_object_or_404(Application, id=app_id)
         system_user = get_object_or_404(SystemUser, id=system_user_id)
-        k8s = KubernetesClient(app.attrs['cluster'], system_user.token)
-        return k8s.get_pods()
+        k8s = cls(app.attrs['cluster'], system_user.token)
+        func_name = f'get_{tp}s'
+        if hasattr(k8s, func_name):
+            return getattr(k8s, func_name)(*args)
+        return []
 
 
 class KubernetesTree:
@@ -118,11 +98,10 @@ class KubernetesTree:
         )
         return node
 
-    def as_namespace_pod_tree_node(self, name, meta, type, counts=0, is_container=False):
+    def as_namespace_pod_tree_node(self, name, meta, type, is_container=False):
         from ..models import ApplicationTreeNodeMixin
         i = ApplicationTreeNodeMixin.create_tree_id(self.tree_id, type, name)
         meta.update({type: name})
-        name = name if is_container else f'{name}({counts})'
         node = self.create_tree_node(
             i, self.tree_id, name, type, meta, icon='cloud', is_container=is_container
         )
@@ -157,30 +136,30 @@ class KubernetesTree:
         system_user_id = parent_info.get('system_user_id')
 
         tree_nodes = []
-        data = KubernetesClient.get_kubernetes_data(app_id, system_user_id)
-        if not data:
-            return tree_nodes
-
         if pod_name:
-            for container in next(
-                    filter(
-                        lambda x: x['pod_name'] == pod_name, data[namespace]
-                    )
-            )['containers']:
+            tp = 'container'
+            containers = KubernetesClient.get_kubernetes_data(
+                app_id, system_user_id, tp, namespace, pod_name
+            )
+            for container in containers:
                 container_node = self.as_namespace_pod_tree_node(
-                    container, parent_info, 'container', is_container=True
+                    container, parent_info, tp, is_container=True
                 )
                 tree_nodes.append(container_node)
         elif namespace:
-            for pod in data[namespace]:
-                pod_nodes = self.as_namespace_pod_tree_node(
-                    pod['pod_name'], parent_info, 'pod', len(pod['containers'])
+            tp = 'pod'
+            pods = KubernetesClient.get_kubernetes_data(app_id, system_user_id, tp, namespace)
+            for pod in pods:
+                pod_node = self.as_namespace_pod_tree_node(
+                    pod, parent_info, tp
                 )
-                tree_nodes.append(pod_nodes)
+                tree_nodes.append(pod_node)
         elif system_user_id:
-            for namespace, pods in data.items():
+            tp = 'namespace'
+            namespaces = KubernetesClient.get_kubernetes_data(app_id, system_user_id, tp)
+            for namespace in namespaces:
                 namespace_node = self.as_namespace_pod_tree_node(
-                    namespace, parent_info, 'namespace', len(pods)
+                    namespace, parent_info, tp
                 )
                 tree_nodes.append(namespace_node)
         return tree_nodes

apps/assets/api/system_user.py

@@ -208,7 +208,7 @@ class SystemUserTaskApi(generics.CreateAPIView):
 
 class SystemUserCommandFilterRuleListApi(generics.ListAPIView):
     rbac_perms = {
-        'list': 'assets.view_commandfilterule'
+        'list': 'assets.view_commandfilterule',
     }
 
     def get_serializer_class(self):
@@ -223,12 +223,14 @@ class SystemUserCommandFilterRuleListApi(generics.ListAPIView):
         if not system_user:
             system_user_id = self.request.query_params.get('system_user_id')
         asset_id = self.request.query_params.get('asset_id')
+        node_id = self.request.query_params.get('node_id')
         application_id = self.request.query_params.get('application_id')
         rules = CommandFilterRule.get_queryset(
             user_id=user_id,
             user_group_id=user_group_id,
             system_user_id=system_user_id,
             asset_id=asset_id,
+            node_id=node_id,
             application_id=application_id
         )
         return rules

apps/assets/migrations/0022_auto_20181012_1717.py

@@ -21,8 +21,8 @@ class Migration(migrations.Migration):
                 ('name', models.CharField(max_length=64, verbose_name='Name')),
                 ('is_active', models.BooleanField(default=True, verbose_name='Is active')),
                 ('comment', models.TextField(blank=True, default='', verbose_name='Comment')),
-                ('date_created', models.DateTimeField(auto_now_add=True)),
-                ('date_updated', models.DateTimeField(auto_now=True)),
+                ('date_created', models.DateTimeField(auto_now_add=True, verbose_name='Date created')),
+                ('date_updated', models.DateTimeField(auto_now=True, verbose_name='Date updated')),
                 ('created_by', models.CharField(blank=True, default='', max_length=128, verbose_name='Created by')),
             ],
             options={

apps/assets/migrations/0084_auto_20220112_1959.py

@@ -20,7 +20,7 @@ class Migration(migrations.Migration):
             fields=[
                 ('org_id', models.CharField(blank=True, db_index=True, default='', max_length=36, verbose_name='Organization')),
                 ('name', models.CharField(max_length=128, verbose_name='Name')),
-                ('is_periodic', models.BooleanField(default=False)),
+                ('is_periodic', models.BooleanField(default=False, verbose_name='Periodic perform')),
                 ('interval', models.IntegerField(blank=True, default=24, null=True, verbose_name='Cycle perform')),
                 ('crontab', models.CharField(blank=True, max_length=128, null=True, verbose_name='Regularly perform')),
                 ('created_by', models.CharField(blank=True, max_length=32, null=True, verbose_name='Created by')),

apps/assets/migrations/0092_commandfilter_nodes.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.15 on 2022-10-09 09:55
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('assets', '0091_auto_20220629_1826'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='commandfilter',
+            name='nodes',
+            field=models.ManyToManyField(blank=True, related_name='cmd_filters', to='assets.Node', verbose_name='Nodes'),
+        ),
+    ]

apps/assets/migrations/0093_alter_systemuser_protocol.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.14 on 2022-11-04 07:06
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('assets', '0092_commandfilter_nodes'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='systemuser',
+            name='protocol',
+            field=models.CharField(choices=[('ssh', 'SSH'), ('rdp', 'RDP'), ('telnet', 'Telnet'), ('vnc', 'VNC'), ('mysql', 'MySQL'), ('oracle', 'Oracle'), ('mariadb', 'MariaDB'), ('postgresql', 'PostgreSQL'), ('sqlserver', 'SQLServer'), ('redis', 'Redis'), ('mongodb', 'MongoDB'), ('clickhouse', 'ClickHouse'), ('k8s', 'K8S')], default='ssh', max_length=16, verbose_name='Protocol'),
+        ),
+    ]

apps/assets/models/asset.py

@@ -116,9 +116,9 @@ class NodesRelationMixin:
         nodes = []
         for node in self.get_nodes():
             _nodes = node.get_ancestors(with_self=True)
-            nodes.append(_nodes)
+            nodes.extend(list(_nodes))
         if flat:
-            nodes = list(reduce(lambda x, y: set(x) | set(y), nodes))
+            nodes = list(set([node.id for node in nodes]))
         return nodes
 
 

apps/assets/models/base.py

@@ -1,28 +1,27 @@
 # -*- coding: utf-8 -*-
 #
-import io
 import os
 import uuid
 from hashlib import md5
 
 import sshpubkeys
+from django.conf import settings
 from django.core.cache import cache
 from django.db import models
+from django.db.models import QuerySet
 from django.utils import timezone
 from django.utils.translation import ugettext_lazy as _
-from django.conf import settings
-from django.db.models import QuerySet
 
-from common.utils import random_string, signer
+from common.db import fields
+from common.utils import random_string
 from common.utils import (
     ssh_key_string_to_obj, ssh_key_gen, get_logger, lazyproperty
 )
-from common.utils.encode import ssh_pubkey_gen
-from common.validators import alphanumeric
-from common.db import fields
+from common.utils.encode import (
+    parse_ssh_public_key_str, parse_ssh_private_key_str
+)
 from orgs.mixins.models import OrgModelMixin
 
-
 logger = get_logger(__file__)
 
 
@@ -64,16 +63,16 @@ class AuthMixin:
 
     @property
     def ssh_key_fingerprint(self):
+        public_key = None
         if self.public_key:
             public_key = self.public_key
         elif self.private_key:
             try:
-                public_key = ssh_pubkey_gen(private_key=self.private_key, password=self.password)
+                public_key = parse_ssh_public_key_str(self.private_key, password=self.password)
             except IOError as e:
                 return str(e)
-        else:
+        if not public_key:
             return ''
-
         public_key_obj = sshpubkeys.SSHKey(public_key)
         fingerprint = public_key_obj.hash_md5()
         return fingerprint
@@ -88,24 +87,27 @@ class AuthMixin:
 
     @property
     def private_key_file(self):
-        if not self.private_key_obj:
+        if not self.private_key:
+            return None
+        private_key_str = parse_ssh_private_key_str(self.private_key,
+                                                    password=self.password)
+        if not private_key_str:
             return None
         project_dir = settings.PROJECT_DIR
         tmp_dir = os.path.join(project_dir, 'tmp')
         key_name = '.' + md5(self.private_key.encode('utf-8')).hexdigest()
         key_path = os.path.join(tmp_dir, key_name)
         if not os.path.exists(key_path):
-            self.private_key_obj.write_private_key_file(key_path)
+            with open(key_path, 'w') as f:
+                f.write(private_key_str)
             os.chmod(key_path, 0o400)
         return key_path
 
     def get_private_key(self):
-        if not self.private_key_obj:
+        if not self.private_key:
             return None
-        string_io = io.StringIO()
-        self.private_key_obj.write_private_key(string_io)
-        private_key = string_io.getvalue()
-        return private_key
+        return parse_ssh_private_key_str(self.private_key,
+                                         password=self.password)
 
     @property
     def public_key_obj(self):
@@ -234,4 +236,3 @@ class BaseUser(OrgModelMixin, AuthMixin):
 
     class Meta:
         abstract = True
-

apps/assets/models/cmd_filter.py

@@ -10,7 +10,7 @@ from django.utils.translation import ugettext_lazy as _
 
 from users.models import User, UserGroup
 from applications.models import Application
-from ..models import SystemUser, Asset
+from ..models import SystemUser, Asset, Node
 
 from common.utils import lazyproperty, get_logger, get_object_or_none
 from orgs.mixins.models import OrgModelMixin
@@ -33,6 +33,10 @@ class CommandFilter(OrgModelMixin):
         'users.UserGroup', related_name='cmd_filters', blank=True,
         verbose_name=_("User group"),
     )
+    nodes = models.ManyToManyField(
+        'assets.Node', related_name='cmd_filters', blank=True,
+        verbose_name=_("Nodes")
+    )
     assets = models.ManyToManyField(
         'assets.Asset', related_name='cmd_filters', blank=True,
         verbose_name=_("Asset")
@@ -46,8 +50,8 @@ class CommandFilter(OrgModelMixin):
     )
     is_active = models.BooleanField(default=True, verbose_name=_('Is active'))
     comment = models.TextField(blank=True, default='', verbose_name=_("Comment"))
-    date_created = models.DateTimeField(auto_now_add=True)
-    date_updated = models.DateTimeField(auto_now=True)
+    date_created = models.DateTimeField(auto_now_add=True, verbose_name=_('Date created'))
+    date_updated = models.DateTimeField(auto_now=True, verbose_name=_('Date updated'))
     created_by = models.CharField(
         max_length=128, blank=True, default='', verbose_name=_('Created by')
     )
@@ -189,7 +193,8 @@ class CommandFilterRule(OrgModelMixin):
 
     @classmethod
     def get_queryset(cls, user_id=None, user_group_id=None, system_user_id=None,
-                     asset_id=None, application_id=None, org_id=None):
+                     asset_id=None, node_id=None, application_id=None, org_id=None):
+        # user & user_group
         user_groups = []
         user = get_object_or_none(User, pk=user_id)
         if user:
@@ -198,8 +203,18 @@ class CommandFilterRule(OrgModelMixin):
         if user_group:
             org_id = user_group.org_id
             user_groups.append(user_group)
-        system_user = get_object_or_none(SystemUser, pk=system_user_id)
+
+        # asset & node
+        nodes = []
         asset = get_object_or_none(Asset, pk=asset_id)
+        if asset:
+            nodes.extend(asset.get_all_nodes())
+        node = get_object_or_none(Node, pk=node_id)
+        if node:
+            org_id = node.org_id
+            nodes.extend(list(node.get_ancestors(with_self=True)))
+
+        system_user = get_object_or_none(SystemUser, pk=system_user_id)
         application = get_object_or_none(Application, pk=application_id)
         q = Q()
         if user:
@@ -212,6 +227,8 @@ class CommandFilterRule(OrgModelMixin):
         if asset:
             org_id = asset.org_id
             q |= Q(assets=asset)
+        if nodes:
+            q |= Q(nodes__in=set(nodes))
         if application:
             org_id = application.org_id
             q |= Q(applications=application)

apps/assets/models/user.py

@@ -34,6 +34,7 @@ class ProtocolMixin:
         sqlserver = 'sqlserver', 'SQLServer'
         redis = 'redis', 'Redis'
         mongodb = 'mongodb', 'MongoDB'
+        clickhouse = 'clickhouse', 'ClickHouse'
         k8s = 'k8s', 'K8S'
 
     SUPPORT_PUSH_PROTOCOLS = [Protocol.ssh, Protocol.rdp]
@@ -46,7 +47,7 @@ class ProtocolMixin:
     ]
     APPLICATION_CATEGORY_DB_PROTOCOLS = [
         Protocol.mysql, Protocol.mariadb, Protocol.oracle,
-        Protocol.postgresql, Protocol.sqlserver,
+        Protocol.postgresql, Protocol.sqlserver, Protocol.clickhouse,
         Protocol.redis, Protocol.mongodb
     ]
     APPLICATION_CATEGORY_CLOUD_PROTOCOLS = [

apps/assets/notifications.py

@@ -20,6 +20,6 @@ class AccountBackupExecutionTaskMsg(object):
                  "please go to personal information -> file encryption password to set the encryption password").format(name)
 
     def publish(self, attachment_list=None):
-        send_mail_attachment_async.delay(
+        send_mail_attachment_async(
             self.subject, self.message, [self.user.email], attachment_list
         )

apps/assets/serializers/account.py

@@ -76,10 +76,6 @@ class AccountSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
 
 class AccountSecretSerializer(SecretReadableMixin, AccountSerializer):
     class Meta(AccountSerializer.Meta):
-        fields_backup = [
-            'hostname', 'ip', 'platform', 'protocols', 'username', 'password',
-            'private_key', 'public_key', 'date_created', 'date_updated', 'version'
-        ]
         extra_kwargs = {
             'password': {'write_only': False},
             'private_key': {'write_only': False},
@@ -88,6 +84,22 @@ class AccountSecretSerializer(SecretReadableMixin, AccountSerializer):
         }
 
 
+class AccountBackUpSerializer(AccountSecretSerializer):
+    class Meta(AccountSecretSerializer.Meta):
+        fields = [
+            'id', 'hostname', 'ip', 'username', 'password',
+            'private_key', 'public_key', 'date_created',
+            'date_updated', 'version'
+        ]
+
+    @classmethod
+    def setup_eager_loading(cls, queryset):
+        return queryset
+
+    def to_representation(self, instance):
+        return super(AccountSerializer, self).to_representation(instance)
+
+
 class AccountTaskSerializer(serializers.Serializer):
     ACTION_CHOICES = (
         ('test', 'test'),

apps/assets/serializers/base.py

@@ -1,24 +1,24 @@
 # -*- coding: utf-8 -*-
 #
-from io import StringIO
 
 from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
-from common.utils import ssh_pubkey_gen, ssh_private_key_gen, validate_ssh_private_key
-from common.drf.fields import EncryptedField
 from assets.models import Type
+from common.drf.fields import EncryptedField
+from common.utils import validate_ssh_private_key, parse_ssh_private_key_str, parse_ssh_public_key_str
 from .utils import validate_password_for_ansible
 
 
 class AuthSerializer(serializers.ModelSerializer):
     password = EncryptedField(required=False, allow_blank=True, allow_null=True, max_length=1024, label=_('Password'))
-    private_key = EncryptedField(required=False, allow_blank=True, allow_null=True, max_length=16384, label=_('Private key'))
+    private_key = EncryptedField(required=False, allow_blank=True, allow_null=True, max_length=16384,
+                                 label=_('Private key'))
 
     def gen_keys(self, private_key=None, password=None):
         if private_key is None:
             return None, None
-        public_key = ssh_pubkey_gen(private_key=private_key, password=password)
+        public_key = parse_ssh_public_key_str(text=private_key, password=password)
         return private_key, public_key
 
     def save(self, **kwargs):
@@ -57,10 +57,7 @@ class AuthSerializerMixin(serializers.ModelSerializer):
         if not valid:
             raise serializers.ValidationError(_("private key invalid or passphrase error"))
 
-        private_key = ssh_private_key_gen(private_key, password=passphrase)
-        string_io = StringIO()
-        private_key.write_private_key(string_io)
-        private_key = string_io.getvalue()
+        private_key = parse_ssh_private_key_str(private_key, password=passphrase)
         return private_key
 
     def validate_public_key(self, public_key):

apps/assets/serializers/cmd_filter.py

@@ -21,7 +21,7 @@ class CommandFilterSerializer(BulkOrgResourceModelSerializer):
             'comment', 'created_by',
         ]
         fields_fk = ['rules']
-        fields_m2m = ['users', 'user_groups', 'system_users', 'assets', 'applications']
+        fields_m2m = ['users', 'user_groups', 'system_users', 'nodes', 'assets', 'applications']
         fields = fields_small + fields_fk + fields_m2m
         extra_kwargs = {
             'rules': {'read_only': True},

apps/assets/serializers/system_user.py

@@ -1,16 +1,16 @@
-from rest_framework import serializers
-from django.utils.translation import ugettext_lazy as _
 from django.db.models import Count
+from django.utils.translation import ugettext_lazy as _
+from rest_framework import serializers
 
-from common.mixins.serializers import BulkSerializerMixin
-from common.utils import ssh_pubkey_gen
 from common.drf.fields import EncryptedField
 from common.drf.serializers import SecretReadableMixin
+from common.mixins.serializers import BulkSerializerMixin
+from common.utils import parse_ssh_public_key_str
 from common.validators import alphanumeric_re, alphanumeric_cn_re, alphanumeric_win_re
 from orgs.mixins.serializers import BulkOrgResourceModelSerializer
-from ..models import SystemUser, Asset
-from .utils import validate_password_for_ansible
 from .base import AuthSerializerMixin
+from .utils import validate_password_for_ansible
+from ..models import SystemUser, Asset
 
 __all__ = [
     'SystemUserSerializer', 'MiniSystemUserSerializer',
@@ -36,9 +36,6 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
     token = EncryptedField(
         label=_('Token'), required=False, write_only=True, style={'base_template': 'textarea.html'}
     )
-    applications_amount = serializers.IntegerField(
-        source='apps_amount', read_only=True, label=_('Apps amount')
-    )
 
     class Meta:
         model = SystemUser
@@ -53,7 +50,7 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
             'su_enabled', 'su_from',
             'date_created', 'date_updated', 'comment', 'created_by',
         ]
-        fields_m2m = ['cmd_filters', 'assets_amount', 'applications_amount', 'nodes']
+        fields_m2m = ['cmd_filters', 'nodes']
         fields = fields_small + fields_m2m
         extra_kwargs = {
             'cmd_filters': {"required": False, 'label': _('Command filter')},
@@ -214,7 +211,7 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
         elif attrs.get('private_key'):
             private_key = attrs['private_key']
             password = attrs.get('password')
-            public_key = ssh_pubkey_gen(private_key, password=password, username=username)
+            public_key = parse_ssh_public_key_str(private_key, password=password)
             attrs['public_key'] = public_key
         return attrs
 
@@ -241,7 +238,6 @@ class SystemUserSerializer(AuthSerializerMixin, BulkOrgResourceModelSerializer):
     def setup_eager_loading(cls, queryset):
         """ Perform necessary eager loading of data. """
         queryset = queryset \
-            .annotate(assets_amount=Count("assets")) \
             .prefetch_related('nodes', 'cmd_filters')
         return queryset
 

apps/assets/serializers/utils.py

@@ -1,6 +1,8 @@
 from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
+from common.utils import validate_ssh_private_key, parse_ssh_private_key_str
+
 
 def validate_password_for_ansible(password):
     """ 校验 Ansible 不支持的特殊字符 """
@@ -15,3 +17,9 @@ def validate_password_for_ansible(password):
     if '"' in password:
         raise serializers.ValidationError(_('Password can not contains `"` '))
 
+
+def validate_ssh_key(ssh_key, passphrase=None):
+    valid = validate_ssh_private_key(ssh_key, password=passphrase)
+    if not valid:
+        raise serializers.ValidationError(_("private key invalid or passphrase error"))
+    return parse_ssh_private_key_str(ssh_key, passphrase)

apps/assets/signal_handlers/node_assets_mapping.py

@@ -1,7 +1,5 @@
 # -*- coding: utf-8 -*-
 #
-import os
-import threading
 
 from django.db.models.signals import (
     m2m_changed, post_save, post_delete
@@ -9,15 +7,15 @@ from django.db.models.signals import (
 from django.dispatch import receiver
 from django.utils.functional import LazyObject
 
-from common.signals import django_ready
-from common.utils.connection import RedisPubSub
-from common.utils import get_logger
 from assets.models import Asset, Node
+from common.signals import django_ready
+from common.utils import get_logger
+from common.utils.connection import RedisPubSub
 from orgs.models import Organization
 
-
 logger = get_logger(__file__)
 
+
 # clear node assets mapping for memory
 # ------------------------------------
 
@@ -78,9 +76,4 @@ def subscribe_node_assets_mapping_expire(sender, **kwargs):
         Node.expire_node_all_asset_ids_mapping_from_memory(org_id)
         Node.expire_node_all_asset_ids_mapping_from_memory(root_org_id)
 
-    def keep_subscribe_node_assets_relation():
-        node_assets_mapping_for_memory_pub_sub.subscribe(handle_node_relation_change)
-
-    t = threading.Thread(target=keep_subscribe_node_assets_relation)
-    t.daemon = True
-    t.start()
+    node_assets_mapping_for_memory_pub_sub.subscribe(handle_node_relation_change)

apps/assets/task_handlers/backup/handlers.py

@@ -4,15 +4,16 @@ from openpyxl import Workbook
 from collections import defaultdict, OrderedDict
 
 from django.conf import settings
+from django.db.models import F
 from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
-from assets.models import AuthBook
-from assets.serializers import AccountSecretSerializer
+from assets.models import AuthBook, SystemUser, Asset
+from assets.serializers import AccountBackUpSerializer
 from assets.notifications import AccountBackupExecutionTaskMsg
-from applications.models import Account
+from applications.models import Account, Application
 from applications.const import AppType
-from applications.serializers import AppAccountSecretSerializer
+from applications.serializers import AppAccountBackUpSerializer
 from users.models import User
 from common.utils import get_logger
 from common.utils.timezone import local_now_display
@@ -38,7 +39,7 @@ class BaseAccountHandler:
     @classmethod
     def get_header_fields(cls, serializer: serializers.Serializer):
         try:
-            backup_fields = getattr(serializer, 'Meta').fields_backup
+            backup_fields = getattr(serializer, 'Meta').fields
         except AttributeError:
             backup_fields = serializer.fields.keys()
         header_fields = {}
@@ -51,17 +52,41 @@ class BaseAccountHandler:
                 header_fields[field] = str(v.label)
         return header_fields
 
+    @staticmethod
+    def load_auth(tp, value, system_user):
+        if value:
+            return value
+        if system_user:
+            return getattr(system_user, tp, '')
+        return ''
+
     @classmethod
-    def create_row(cls, account, serializer_cls, header_fields=None):
-        serializer = serializer_cls(account)
-        if not header_fields:
-            header_fields = cls.get_header_fields(serializer)
-        data = cls.unpack_data(serializer.data)
+    def replace_auth(cls, account, system_user_dict):
+        system_user = system_user_dict.get(account.systemuser_id)
+        account.username = cls.load_auth('username', account.username, system_user)
+        account.password = cls.load_auth('password', account.password, system_user)
+        account.private_key = cls.load_auth('private_key', account.private_key, system_user)
+        account.public_key = cls.load_auth('public_key', account.public_key, system_user)
+        return account
+
+    @classmethod
+    def create_row(cls, data, header_fields):
+        data = cls.unpack_data(data)
         row_dict = {}
         for field, header_name in header_fields.items():
-            row_dict[header_name] = str(data[field])
+            row_dict[header_name] = str(data.get(field, field))
         return row_dict
 
+    @classmethod
+    def add_rows(cls, data, header_fields, sheet):
+        data_map = defaultdict(list)
+        for i in data:
+            row = cls.create_row(i, header_fields)
+            if sheet not in data_map:
+                data_map[sheet].append(list(row.keys()))
+            data_map[sheet].append(list(row.values()))
+        return data_map
+
 
 class AssetAccountHandler(BaseAccountHandler):
     @staticmethod
@@ -72,22 +97,27 @@ class AssetAccountHandler(BaseAccountHandler):
         return filename
 
     @classmethod
-    def create_data_map(cls):
-        data_map = defaultdict(list)
+    def replace_account_info(cls, account, asset_dict, system_user_dict):
+        asset = asset_dict.get(account.asset_id)
+        account.ip = asset.ip if asset else ''
+        account.hostname = asset.hostname if asset else ''
+        account = cls.replace_auth(account, system_user_dict)
+        return account
+
+    @classmethod
+    def create_data_map(cls, system_user_dict):
         sheet_name = AuthBook._meta.verbose_name
+        assets = Asset.objects.only('id', 'hostname', 'ip')
+        asset_dict = {asset.id: asset for asset in assets}
+        accounts = AuthBook.objects.all()
+        if not accounts.exists():
+            return
 
-        accounts = AuthBook.get_queryset().select_related('systemuser')
-        if not accounts.first():
-            return data_map
-
-        header_fields = cls.get_header_fields(AccountSecretSerializer(accounts.first()))
+        header_fields = cls.get_header_fields(AccountBackUpSerializer(accounts.first()))
         for account in accounts:
-            account.load_auth()
-            row = cls.create_row(account, AccountSecretSerializer, header_fields)
-            if sheet_name not in data_map:
-                data_map[sheet_name].append(list(row.keys()))
-            data_map[sheet_name].append(list(row.values()))
-
+            cls.replace_account_info(account, asset_dict, system_user_dict)
+        data = AccountBackUpSerializer(accounts, many=True).data
+        data_map = cls.add_rows(data, header_fields, sheet_name)
         logger.info('\n\033[33m- 共收集 {} 条资产账号\033[0m'.format(accounts.count()))
         return data_map
 
@@ -101,18 +131,36 @@ class AppAccountHandler(BaseAccountHandler):
         return filename
 
     @classmethod
-    def create_data_map(cls):
-        data_map = defaultdict(list)
-        accounts = Account.get_queryset().select_related('systemuser')
-        for account in accounts:
-            account.load_auth()
-            app_type = account.type
+    def replace_account_info(cls, account, app_dict, system_user_dict):
+        app = app_dict.get(account.app_id)
+        account.type = app.type if app else ''
+        account.app_display = app.name if app else ''
+        account.category = app.category if app else ''
+        account = cls.replace_auth(account, system_user_dict)
+        return account
+
+    @classmethod
+    def create_data_map(cls, system_user_dict):
+        apps = Application.objects.only('id', 'type', 'name', 'category')
+        app_dict = {app.id: app for app in apps}
+        qs = Account.objects.all().annotate(app_type=F('app__type'))
+        if not qs.exists():
+            return
+
+        account_type_map = defaultdict(list)
+        for i in qs:
+            account_type_map[i.app_type].append(i)
+        data_map = {}
+        for app_type, accounts in account_type_map.items():
             sheet_name = AppType.get_label(app_type)
-            row = cls.create_row(account, AppAccountSecretSerializer)
-            if sheet_name not in data_map:
-                data_map[sheet_name].append(list(row.keys()))
-            data_map[sheet_name].append(list(row.values()))
-        logger.info('\n\033[33m- 共收集{}条应用账号\033[0m'.format(accounts.count()))
+            header_fields = cls.get_header_fields(AppAccountBackUpSerializer(tp=app_type))
+            if not accounts:
+                continue
+            for account in accounts:
+                cls.replace_account_info(account, app_dict, system_user_dict)
+            data = AppAccountBackUpSerializer(accounts, many=True, tp=app_type).data
+            data_map.update(cls.add_rows(data, header_fields, sheet_name))
+        logger.info('\n\033[33m- 共收集{}条应用账号\033[0m'.format(qs.count()))
         return data_map
 
 
@@ -137,12 +185,16 @@ class AccountBackupHandler:
         # Print task start date
         time_start = time.time()
         files = []
+        system_user_qs = SystemUser.objects.only(
+            'id', 'username', 'password', 'private_key', 'public_key'
+        )
+        system_user_dict = {i.id: i for i in system_user_qs}
         for account_type in self.execution.types:
             handler = handler_map.get(account_type)
             if not handler:
                 continue
 
-            data_map = handler.create_data_map()
+            data_map = handler.create_data_map(system_user_dict)
             if not data_map:
                 continue
 

apps/audits/api.py

@@ -1,21 +1,29 @@
 # -*- coding: utf-8 -*-
 #
-from rest_framework.mixins import ListModelMixin, CreateModelMixin
+from importlib import import_module
+
+from rest_framework.mixins import ListModelMixin, CreateModelMixin, RetrieveModelMixin
 from django.db.models import F, Value
 from django.db.models.functions import Concat
+from django.conf import settings
 from rest_framework.permissions import IsAuthenticated
 from rest_framework import generics
 
 from common.drf.api import JMSReadOnlyModelViewSet
+from common.plugins.es import QuerySet as ESQuerySet
 from common.drf.filters import DatetimeRangeFilter
 from common.api import CommonGenericViewSet
 from orgs.mixins.api import OrgGenericViewSet, OrgBulkModelViewSet, OrgRelationMixin
 from orgs.utils import current_org
 from ops.models import CommandExecution
 from . import filters
+from .backends import TYPE_ENGINE_MAPPING
 from .models import FTPLog, UserLoginLog, OperateLog, PasswordChangeLog
 from .serializers import FTPLogSerializer, UserLoginLogSerializer, CommandExecutionSerializer
-from .serializers import OperateLogSerializer, PasswordChangeLogSerializer, CommandExecutionHostsRelationSerializer
+from .serializers import (
+    OperateLogSerializer, OperateLogActionDetailSerializer,
+    PasswordChangeLogSerializer, CommandExecutionHostsRelationSerializer
+)
 
 
 class FTPLogViewSet(CreateModelMixin,
@@ -68,7 +76,7 @@ class MyLoginLogAPIView(UserLoginCommonMixin, generics.ListAPIView):
         return qs
 
 
-class OperateLogViewSet(ListModelMixin, OrgGenericViewSet):
+class OperateLogViewSet(RetrieveModelMixin, ListModelMixin, OrgGenericViewSet):
     model = OperateLog
     serializer_class = OperateLogSerializer
     extra_filter_backends = [DatetimeRangeFilter]
@@ -79,6 +87,22 @@ class OperateLogViewSet(ListModelMixin, OrgGenericViewSet):
     search_fields = ['resource']
     ordering = ['-datetime']
 
+    def get_serializer_class(self):
+        if self.request.query_params.get('type') == 'action_detail':
+            return OperateLogActionDetailSerializer
+        return super().get_serializer_class()
+
+    def get_queryset(self):
+        qs = OperateLog.objects.all()
+        es_config = settings.OPERATE_LOG_ELASTICSEARCH_CONFIG
+        if es_config:
+            engine_mod = import_module(TYPE_ENGINE_MAPPING['es'])
+            store = engine_mod.OperateLogStore(es_config)
+            if store.ping(timeout=2):
+                qs = ESQuerySet(store)
+                qs.model = OperateLog
+        return qs
+
 
 class PasswordChangeLogViewSet(ListModelMixin, CommonGenericViewSet):
     queryset = PasswordChangeLog.objects.all()

apps/audits/backends/__init__.py

@@ -0,0 +1,18 @@
+from importlib import import_module
+
+from django.conf import settings
+
+
+TYPE_ENGINE_MAPPING = {
+    'db': 'audits.backends.db',
+    'es': 'audits.backends.es',
+}
+
+
+def get_operate_log_storage(default=False):
+    engine_mod = import_module(TYPE_ENGINE_MAPPING['db'])
+    es_config = settings.OPERATE_LOG_ELASTICSEARCH_CONFIG
+    if not default and es_config:
+        engine_mod = import_module(TYPE_ENGINE_MAPPING['es'])
+    storage = engine_mod.OperateLogStore(es_config)
+    return storage

apps/audits/backends/db.py

@@ -0,0 +1,38 @@
+# ~*~ coding: utf-8 ~*~
+from django.utils.translation import ugettext_lazy as _
+
+from audits.models import OperateLog
+
+
+class OperateLogStore(object):
+    def __init__(self, config):
+        self.model = OperateLog
+        self.max_length = 1024
+        self.max_length_tip_msg = _(
+            'The text content is too long. Use Elasticsearch to store operation logs'
+        )
+
+    @staticmethod
+    def ping(timeout=None):
+        return True
+
+    def save(self, **kwargs):
+        log_id = kwargs.get('id', '')
+        before = kwargs.get('before') or {}
+        after = kwargs.get('after') or {}
+        if len(str(before)) > self.max_length:
+            before = {_('Tips'): self.max_length_tip_msg}
+        if len(str(after)) > self.max_length:
+            after = {_('Tips'): self.max_length_tip_msg}
+
+        op_log = self.model.objects.filter(pk=log_id).first()
+        if op_log is not None:
+            raw_after = op_log.after or {}
+            raw_before = op_log.before or {}
+            raw_before.update(before)
+            raw_after.update(after)
+            op_log.before = raw_before
+            op_log.after = raw_after
+            op_log.save()
+        else:
+            self.model.objects.create(**kwargs)

apps/audits/backends/es.py

@@ -0,0 +1,85 @@
+# -*- coding: utf-8 -*-
+#
+import uuid
+
+from common.utils.timezone import local_now_display
+from common.utils import get_logger
+from common.utils.encode import Singleton
+from common.plugins.es import ES
+
+
+logger = get_logger(__file__)
+
+
+class OperateLogStore(ES, metaclass=Singleton):
+    def __init__(self, config):
+        properties = {
+            "id": {
+                "type": "keyword"
+            },
+            "user": {
+                "type": "keyword"
+            },
+            "action": {
+                "type": "keyword"
+            },
+            "resource_type": {
+                "type": "keyword"
+            },
+            "org_id": {
+                "type": "keyword"
+            },
+            "datetime": {
+                "type": "date",
+                "format": "yyyy-MM-dd HH:mm:ss"
+            }
+        }
+        exact_fields = {}
+        match_fields = {
+            'id', 'user', 'action', 'resource_type',
+            'resource', 'remote_addr', 'org_id'
+        }
+        keyword_fields = {
+            'id', 'user', 'action', 'resource_type', 'org_id'
+        }
+        if not config.get('INDEX'):
+            config['INDEX'] = 'jumpserver_operate_log'
+        super().__init__(config, properties, keyword_fields, exact_fields, match_fields)
+        self.pre_use_check()
+
+    @staticmethod
+    def make_data(data):
+        op_id = data.get('id', str(uuid.uuid4()))
+        datetime_param = data.get('datetime', local_now_display())
+        data = {
+            'id': op_id, 'user': data['user'], 'action': data['action'],
+            'resource_type': data['resource_type'], 'resource': data['resource'],
+            'remote_addr': data['remote_addr'], 'datetime': datetime_param,
+            'before': data['before'], 'after': data['after'], 'org_id': data['org_id']
+        }
+        return data
+
+    def save(self, **kwargs):
+        log_id = kwargs.get('id', '')
+        before = kwargs.get('before') or {}
+        after = kwargs.get('after') or {}
+
+        op_log = self.get({'id': log_id})
+        if op_log is not None:
+            data = {'doc': {}}
+            raw_after = op_log.get('after') or {}
+            raw_before = op_log.get('before') or {}
+            raw_before.update(before)
+            raw_after.update(after)
+            data['doc']['before'] = raw_before
+            data['doc']['after'] = raw_after
+            self.es.update(
+                index=self.index, doc_type=self.doc_type,
+                id=op_log.get('es_id'), body=data, refresh=True
+            )
+        else:
+            data = self.make_data(kwargs)
+            self.es.index(
+                index=self.index, doc_type=self.doc_type, body=data,
+                refresh=True
+            )

apps/audits/const.py

@@ -7,19 +7,30 @@ DEFAULT_CITY = _("Unknown")
 MODELS_NEED_RECORD = (
     # users
     'User', 'UserGroup',
+    # authentication
+    'AccessKey', 'TempToken',
     # acls
     'LoginACL', 'LoginAssetACL', 'LoginConfirmSetting',
     # assets
     'Asset', 'Node', 'AdminUser', 'SystemUser', 'Domain', 'Gateway', 'CommandFilterRule',
-    'CommandFilter', 'Platform', 'AuthBook',
+    'CommandFilter', 'Platform', 'Label',
     # applications
     'Application',
+    # account
+    'AuthBook',
     # orgs
     'Organization',
     # settings
     'Setting',
     # perms
     'AssetPermission', 'ApplicationPermission',
+    # notifications
+    'SystemMsgSubscription', 'UserMsgSubscription',
+    # Terminal
+    'Terminal', 'Endpoint', 'EndpointRule', 'CommandStorage', 'ReplayStorage',
+    # rbac
+    'Role', 'SystemRole', 'OrgRole', 'RoleBinding', 'OrgRoleBinding', 'SystemRoleBinding',
     # xpack
-    'License', 'Account', 'SyncInstanceTask', 'ChangeAuthPlan', 'GatherUserTask',
+    'License', 'Account', 'SyncInstanceTask', 'ChangeAuthPlan', 'ApplicationChangeAuthPlan',
+    'GatherUserTask', 'Interface',
 )

apps/audits/handler.py

@@ -0,0 +1,191 @@
+from datetime import datetime
+
+from django.db import transaction
+from django.core.cache import cache
+from django.utils.translation import ugettext_lazy as _
+
+from common.utils import get_request_ip, get_logger
+from common.utils.timezone import as_current_tz
+from common.utils.encode import Singleton
+from common.local import encrypted_field_set
+from settings.serializers import SettingsSerializer
+from jumpserver.utils import current_request
+from audits.models import OperateLog
+from orgs.utils import get_current_org_id
+
+from .backends import get_operate_log_storage
+
+
+logger = get_logger(__name__)
+
+
+class ModelClient:
+    @staticmethod
+    def save(**kwargs):
+        log_id = kwargs.get('id', '')
+        op_log = OperateLog.objects.filter(pk=log_id).first()
+        if op_log is not None:
+            raw_after = op_log.after or {}
+            raw_before = op_log.before or {}
+            cur_before = kwargs.get('before') or {}
+            cur_after = kwargs.get('after') or {}
+            raw_before.update(cur_before)
+            raw_after.update(cur_after)
+            op_log.before = raw_before
+            op_log.after = raw_after
+            op_log.save()
+        else:
+            OperateLog.objects.create(**kwargs)
+
+
+class OperatorLogHandler(metaclass=Singleton):
+    CACHE_KEY = 'OPERATOR_LOG_CACHE_KEY'
+
+    def __init__(self):
+        self.log_client = self.get_storage_client()
+
+    @staticmethod
+    def get_storage_client():
+        client = get_operate_log_storage()
+        return client
+
+    @staticmethod
+    def _consistent_type_to_str(value1, value2):
+        if isinstance(value1, datetime):
+            value1 = as_current_tz(value1).strftime('%Y-%m-%d %H:%M:%S')
+        if isinstance(value2, datetime):
+            value2 = as_current_tz(value2).strftime('%Y-%m-%d %H:%M:%S')
+        return value1, value2
+
+    def _look_for_two_dict_change(self, left_dict, right_dict):
+        # 以右边的字典为基础
+        before, after = {}, {}
+        for key, value in right_dict.items():
+            pre_value = left_dict.get(key, '')
+            pre_value, value = self._consistent_type_to_str(pre_value, value)
+            if sorted(str(value)) == sorted(str(pre_value)):
+                continue
+            if pre_value:
+                before[key] = pre_value
+            if value:
+                after[key] = value
+        return before, after
+
+    def cache_instance_before_data(self, instance_dict):
+        instance_id = instance_dict.get('id')
+        if instance_id is None:
+            return
+
+        key = '%s_%s' % (self.CACHE_KEY, instance_id)
+        cache.set(key, instance_dict, 3 * 60)
+
+    def get_instance_dict_from_cache(self, instance_id):
+        if instance_id is None:
+            return None
+
+        key = '%s_%s' % (self.CACHE_KEY, instance_id)
+        cache_instance = cache.get(key, {})
+        log_id = cache_instance.get('operate_log_id')
+        return log_id, cache_instance
+
+    def get_instance_current_with_cache_diff(self, current_instance):
+        log_id, before, after = None, None, None
+        instance_id = current_instance.get('id')
+        if instance_id is None:
+            return log_id, before, after
+
+        log_id, cache_instance = self.get_instance_dict_from_cache(instance_id)
+        if not cache_instance:
+            return log_id, before, after
+
+        before, after = self._look_for_two_dict_change(
+            cache_instance, current_instance
+        )
+        return log_id, before, after
+
+    @staticmethod
+    def get_resource_display_from_setting(resource):
+        resource_display = None
+        setting_serializer = SettingsSerializer()
+        label = setting_serializer.get_field_label(resource)
+        if label is not None:
+            resource_display = label
+        return resource_display
+
+    def get_resource_display(self, resource):
+        resource_display = str(resource)
+        return_value = self.get_resource_display_from_setting(resource_display)
+        if return_value is not None:
+            resource_display = return_value
+        return resource_display
+
+    @staticmethod
+    def serialized_value(value: (list, tuple)):
+        if len(value) == 0:
+            return ''
+        if isinstance(value[0], str):
+            return ','.join(value)
+        return ','.join([i['value'] for i in value if i.get('value')])
+
+    def __data_processing(self, dict_item, loop=True):
+        encrypt_value = '******'
+        for key, value in dict_item.items():
+            if isinstance(value, bool):
+                value = _('Yes') if value else _('No')
+            elif isinstance(value, (list, tuple)):
+                value = self.serialized_value(value)
+            elif isinstance(value, dict) and loop:
+                self.__data_processing(value, loop=False)
+            if key in encrypted_field_set:
+                value = encrypt_value
+            dict_item[key] = value
+        return dict_item
+
+    def data_processing(self, before, after):
+        if before:
+            before = self.__data_processing(before)
+        if after:
+            after = self.__data_processing(after)
+        return before, after
+
+    def create_or_update_operate_log(
+            self, action, resource_type, resource=None,
+            force=False, log_id=None, before=None, after=None
+    ):
+        user = current_request.user if current_request else None
+        if not user or not user.is_authenticated:
+            return
+
+        remote_addr = get_request_ip(current_request)
+        resource_display = self.get_resource_display(resource)
+        before, after = self.data_processing(before, after)
+        if not force and not any([before, after]):
+            # 前后都没变化，没必要生成日志，除非手动强制保存
+            return
+
+        data = {
+            'id': log_id, "user": str(user), 'action': action,
+            'resource_type': str(resource_type), 'resource': resource_display,
+            'remote_addr': remote_addr, 'before': before, 'after': after,
+            'org_id': get_current_org_id(),
+        }
+        with transaction.atomic():
+            if self.log_client.ping(timeout=1):
+                client = self.log_client
+            else:
+                logger.info('Switch default operate log storage save.')
+                client = get_operate_log_storage(default=True)
+
+            try:
+                client.save(**data)
+            except Exception as e:
+                error_msg = 'An error occurred saving OperateLog.' \
+                            'Error: %s, Data: %s' % (e, data)
+                logger.error(error_msg)
+
+
+op_handler = OperatorLogHandler()
+create_or_update_operate_log = op_handler.create_or_update_operate_log
+cache_instance_before_data = op_handler.cache_instance_before_data
+get_instance_current_with_cache_diff = op_handler.get_instance_current_with_cache_diff
+get_instance_dict_from_cache = op_handler.get_instance_dict_from_cache

apps/audits/migrations/0015_auto_20221011_1745.py

@@ -0,0 +1,24 @@
+# Generated by Django 3.2.14 on 2022-10-11 09:45
+
+import common.db.encoder
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('audits', '0014_auto_20220505_1902'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='operatelog',
+            name='after',
+            field=models.JSONField(default=dict, encoder=common.db.encoder.ModelJSONFieldEncoder, null=True),
+        ),
+        migrations.AddField(
+            model_name='operatelog',
+            name='before',
+            field=models.JSONField(default=dict, encoder=common.db.encoder.ModelJSONFieldEncoder, null=True),
+        ),
+    ]

apps/audits/models.py

@@ -4,8 +4,9 @@ from django.db import models
 from django.db.models import Q
 from django.utils.translation import gettext, ugettext_lazy as _
 from django.utils import timezone
-from common.utils import lazyproperty
 
+from common.utils import lazyproperty
+from common.db.encoder import ModelJSONFieldEncoder
 from orgs.mixins.models import OrgModelMixin, Organization
 from orgs.utils import current_org
 
@@ -65,6 +66,8 @@ class OperateLog(OrgModelMixin):
     resource = models.CharField(max_length=128, verbose_name=_("Resource"))
     remote_addr = models.CharField(max_length=128, verbose_name=_("Remote addr"), blank=True, null=True)
     datetime = models.DateTimeField(auto_now=True, verbose_name=_('Datetime'), db_index=True)
+    before = models.JSONField(default=dict, encoder=ModelJSONFieldEncoder, null=True)
+    after = models.JSONField(default=dict, encoder=ModelJSONFieldEncoder, null=True)
 
     def __str__(self):
         return "<{}> {} <{}>".format(self.user, self.action, self.resource)
@@ -78,6 +81,21 @@ class OperateLog(OrgModelMixin):
             self.org_id = Organization.ROOT_ID
         return super(OperateLog, self).save(*args, **kwargs)
 
+    @classmethod
+    def from_dict(cls, d):
+        self = cls()
+        for k, v in d.items():
+            setattr(self, k, v)
+        return self
+
+    @classmethod
+    def from_multi_dict(cls, l):
+        operate_logs = []
+        for d in l:
+            operate_log = cls.from_dict(d)
+            operate_logs.append(operate_log)
+        return operate_logs
+
     class Meta:
         verbose_name = _("Operate log")
 

apps/audits/serializers.py

@@ -47,6 +47,12 @@ class UserLoginLogSerializer(serializers.ModelSerializer):
         }
 
 
+class OperateLogActionDetailSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = models.OperateLog
+        fields = ('before', 'after')
+
+
 class OperateLogSerializer(serializers.ModelSerializer):
     action_display = serializers.CharField(source='get_action_display', label=_('Action'))
 

apps/audits/signal_handlers.py

@@ -1,9 +1,9 @@
 # -*- coding: utf-8 -*-
 #
-import time
+import uuid
 
 from django.db.models.signals import (
-    post_save, m2m_changed, pre_delete
+    post_save, m2m_changed, pre_delete, pre_save
 )
 from django.dispatch import receiver
 from django.conf import settings
@@ -16,24 +16,32 @@ from django.utils import translation
 from rest_framework.renderers import JSONRenderer
 from rest_framework.request import Request
 
-from assets.models import Asset, SystemUser
+from users.models import User
+from assets.models import Asset, SystemUser, CommandFilter
+from terminal.models import Session, Command
+from perms.models import AssetPermission, ApplicationPermission
+from rbac.models import Role
+
+from audits.utils import model_to_dict_for_operate_log as model_to_dict
+from audits.handler import (
+    get_instance_current_with_cache_diff, cache_instance_before_data,
+    create_or_update_operate_log, get_instance_dict_from_cache
+)
 from authentication.signals import post_auth_failed, post_auth_success
 from authentication.utils import check_different_city_login_if_need
 from jumpserver.utils import current_request
-from users.models import User
 from users.signals import post_user_change_password
-from terminal.models import Session, Command
-from .utils import write_login_log, create_operate_log
+from .utils import write_login_log
 from . import models, serializers
 from .models import OperateLog
-from orgs.utils import current_org
-from perms.models import AssetPermission, ApplicationPermission
+from .const import MODELS_NEED_RECORD
 from terminal.backends.command.serializers import SessionCommandSerializer
 from terminal.serializers import SessionSerializer
-from common.const.signals import POST_ADD, POST_REMOVE, POST_CLEAR
+from common.const.signals import POST_ADD, POST_REMOVE, POST_CLEAR, SKIP_SIGNAL
 from common.utils import get_request_ip, get_logger, get_syslogger
 from common.utils.encode import data_to_json
 
+
 logger = get_logger(__name__)
 sys_logger = get_syslogger(__name__)
 json_render = JSONRenderer()
@@ -62,70 +70,6 @@ class AuthBackendLabelMapping(LazyObject):
 
 AUTH_BACKEND_LABEL_MAPPING = AuthBackendLabelMapping()
 
-
-M2M_NEED_RECORD = {
-    User.groups.through._meta.object_name: (
-        _('User and Group'),
-        _('{User} JOINED {UserGroup}'),
-        _('{User} LEFT {UserGroup}')
-    ),
-    SystemUser.assets.through._meta.object_name: (
-        _('Asset and SystemUser'),
-        _('{Asset} ADD {SystemUser}'),
-        _('{Asset} REMOVE {SystemUser}')
-    ),
-    Asset.nodes.through._meta.object_name: (
-        _('Node and Asset'),
-        _('{Node} ADD {Asset}'),
-        _('{Node} REMOVE {Asset}')
-    ),
-    AssetPermission.users.through._meta.object_name: (
-        _('User asset permissions'),
-        _('{AssetPermission} ADD {User}'),
-        _('{AssetPermission} REMOVE {User}'),
-    ),
-    AssetPermission.user_groups.through._meta.object_name: (
-        _('User group asset permissions'),
-        _('{AssetPermission} ADD {UserGroup}'),
-        _('{AssetPermission} REMOVE {UserGroup}'),
-    ),
-    AssetPermission.assets.through._meta.object_name: (
-        _('Asset permission'),
-        _('{AssetPermission} ADD {Asset}'),
-        _('{AssetPermission} REMOVE {Asset}'),
-    ),
-    AssetPermission.nodes.through._meta.object_name: (
-        _('Node permission'),
-        _('{AssetPermission} ADD {Node}'),
-        _('{AssetPermission} REMOVE {Node}'),
-    ),
-    AssetPermission.system_users.through._meta.object_name: (
-        _('Asset permission and SystemUser'),
-        _('{AssetPermission} ADD {SystemUser}'),
-        _('{AssetPermission} REMOVE {SystemUser}'),
-    ),
-    ApplicationPermission.users.through._meta.object_name: (
-        _('User application permissions'),
-        _('{ApplicationPermission} ADD {User}'),
-        _('{ApplicationPermission} REMOVE {User}'),
-    ),
-    ApplicationPermission.user_groups.through._meta.object_name: (
-        _('User group application permissions'),
-        _('{ApplicationPermission} ADD {UserGroup}'),
-        _('{ApplicationPermission} REMOVE {UserGroup}'),
-    ),
-    ApplicationPermission.applications.through._meta.object_name: (
-        _('Application permission'),
-        _('{ApplicationPermission} ADD {Application}'),
-        _('{ApplicationPermission} REMOVE {Application}'),
-    ),
-    ApplicationPermission.system_users.through._meta.object_name: (
-        _('Application permission and SystemUser'),
-        _('{ApplicationPermission} ADD {SystemUser}'),
-        _('{ApplicationPermission} REMOVE {SystemUser}'),
-    ),
-}
-
 M2M_ACTION = {
     POST_ADD: OperateLog.ACTION_CREATE,
     POST_REMOVE: OperateLog.ACTION_DELETE,
@@ -137,60 +81,115 @@ M2M_ACTION = {
 def on_m2m_changed(sender, action, instance, reverse, model, pk_set, **kwargs):
     if action not in M2M_ACTION:
         return
-
-    user = current_request.user if current_request else None
-    if not user or not user.is_authenticated:
+    if not instance:
         return
 
-    sender_name = sender._meta.object_name
-    if sender_name in M2M_NEED_RECORD:
-        org_id = current_org.id
-        remote_addr = get_request_ip(current_request)
-        user = str(user)
-        resource_type, resource_tmpl_add, resource_tmpl_remove = M2M_NEED_RECORD[sender_name]
-        action = M2M_ACTION[action]
-        if action == OperateLog.ACTION_CREATE:
-            resource_tmpl = resource_tmpl_add
-        elif action == OperateLog.ACTION_DELETE:
-            resource_tmpl = resource_tmpl_remove
+    resource_type = instance._meta.verbose_name
+    current_instance = model_to_dict(instance, include_model_fields=False)
 
-        to_create = []
-        objs = model.objects.filter(pk__in=pk_set)
+    instance_id = current_instance.get('id')
+    log_id, before_instance = get_instance_dict_from_cache(instance_id)
 
-        instance_name = instance._meta.object_name
-        instance_value = str(instance)
+    field_name = str(model._meta.verbose_name)
+    objs = model.objects.filter(pk__in=pk_set)
+    objs_display = [str(o) for o in objs]
+    action = M2M_ACTION[action]
+    changed_field = current_instance.get(field_name, [])
 
-        model_name = model._meta.object_name
+    after, before, before_value = None, None, None
+    if action == OperateLog.ACTION_CREATE:
+        before_value = list(set(changed_field) - set(objs_display))
+    elif action == OperateLog.ACTION_DELETE:
+        before_value = list(
+            set(changed_field).symmetric_difference(set(objs_display))
+        )
 
-        for obj in objs:
-            resource = resource_tmpl.format(**{
-                instance_name: instance_value,
-                model_name: str(obj)
-            })[:128]  # `resource` 字段只有 128 个字符长 😔
+    if changed_field:
+        after = {field_name: changed_field}
+    if before_value:
+        before = {field_name: before_value}
 
-            to_create.append(OperateLog(
-                user=user, action=action, resource_type=resource_type,
-                resource=resource, remote_addr=remote_addr, org_id=org_id
-            ))
-        OperateLog.objects.bulk_create(to_create)
+    if sorted(str(before)) == sorted(str(after)):
+        return
+
+    create_or_update_operate_log(
+        OperateLog.ACTION_UPDATE, resource_type,
+        resource=instance, log_id=log_id, before=before, after=after
+    )
+
+
+def signal_of_operate_log_whether_continue(sender, instance, created, update_fields=None):
+    condition = True
+    if not instance:
+        condition = False
+    if instance and getattr(instance, SKIP_SIGNAL, False):
+        condition = False
+    # 终端模型的 create 事件由系统产生，不记录
+    if instance._meta.object_name == 'Terminal' and created:
+        condition = False
+    # last_login 改变是最后登录日期, 每次登录都会改变
+    if instance._meta.object_name == 'User' and \
+            update_fields and 'last_login' in update_fields:
+        condition = False
+    # 不在记录白名单中，跳过
+    if sender._meta.object_name not in MODELS_NEED_RECORD:
+        condition = False
+    return condition
+
+
+@receiver(pre_save)
+def on_object_pre_create_or_update(sender, instance=None, raw=False, using=None, update_fields=None, **kwargs):
+    ok = signal_of_operate_log_whether_continue(
+        sender, instance, False, update_fields
+    )
+    if not ok:
+        return
+    instance_before_data = {'id': instance.id}
+    raw_instance = type(instance).objects.filter(pk=instance.id).first()
+    if raw_instance:
+        instance_before_data = model_to_dict(raw_instance)
+    operate_log_id = str(uuid.uuid4())
+    instance_before_data['operate_log_id'] = operate_log_id
+    setattr(instance, 'operate_log_id', operate_log_id)
+    cache_instance_before_data(instance_before_data)
 
 
 @receiver(post_save)
 def on_object_created_or_update(sender, instance=None, created=False, update_fields=None, **kwargs):
-    # last_login 改变是最后登录日期, 每次登录都会改变
-    if instance._meta.object_name == 'User' and \
-            update_fields and 'last_login' in update_fields:
+    ok = signal_of_operate_log_whether_continue(
+        sender, instance, created, update_fields
+    )
+    if not ok:
         return
+
+    log_id, before, after = None, None, None
     if created:
         action = models.OperateLog.ACTION_CREATE
+        after = model_to_dict(instance)
+        log_id = getattr(instance, 'operate_log_id', None)
     else:
         action = models.OperateLog.ACTION_UPDATE
-    create_operate_log(action, sender, instance)
+        current_instance = model_to_dict(instance)
+        log_id, before, after = get_instance_current_with_cache_diff(current_instance)
+
+    resource_type = sender._meta.verbose_name
+    create_or_update_operate_log(
+        action, resource_type, resource=instance,
+        log_id=log_id, before=before, after=after
+    )
 
 
 @receiver(pre_delete)
 def on_object_delete(sender, instance=None, **kwargs):
-    create_operate_log(models.OperateLog.ACTION_DELETE, sender, instance)
+    ok = signal_of_operate_log_whether_continue(sender, instance, False)
+    if not ok:
+        return
+
+    resource_type = sender._meta.verbose_name
+    create_or_update_operate_log(
+        models.OperateLog.ACTION_DELETE, resource_type,
+        resource=instance, before=model_to_dict(instance)
+    )
 
 
 @receiver(post_user_change_password, sender=User)

apps/audits/utils.py

@@ -1,14 +1,16 @@
 import csv
 import codecs
 
-from django.http import HttpResponse
-from django.db import transaction
-from django.utils import translation
+from itertools import chain
+from datetime import datetime
 
-from audits.models import OperateLog
-from common.utils import validate_ip, get_ip_city, get_request_ip, get_logger
-from jumpserver.utils import current_request
-from .const import DEFAULT_CITY, MODELS_NEED_RECORD
+from django.http import HttpResponse
+from django.db import models
+
+from settings.serializers import SettingsSerializer
+from common.utils.timezone import as_current_tz
+from common.utils import validate_ip, get_ip_city, get_logger
+from .const import DEFAULT_CITY
 
 
 logger = get_logger(__name__)
@@ -46,23 +48,59 @@ def write_login_log(*args, **kwargs):
     UserLoginLog.objects.create(**kwargs)
 
 
-def create_operate_log(action, sender, resource):
-    user = current_request.user if current_request else None
-    if not user or not user.is_authenticated:
-        return
-    model_name = sender._meta.object_name
-    if model_name not in MODELS_NEED_RECORD:
-        return
-    with translation.override('en'):
-        resource_type = sender._meta.verbose_name
-    remote_addr = get_request_ip(current_request)
+def get_resource_display(resource):
+    resource_display = str(resource)
+    setting_serializer = SettingsSerializer()
+    label = setting_serializer.get_field_label(resource_display)
+    if label is not None:
+        resource_display = label
+    return resource_display
 
-    data = {
-        "user": str(user), 'action': action, 'resource_type': resource_type,
-        'resource': str(resource), 'remote_addr': remote_addr,
-    }
-    with transaction.atomic():
-        try:
-            OperateLog.objects.create(**data)
-        except Exception as e:
-            logger.error("Create operate log error: {}".format(e))
+
+def model_to_dict_for_operate_log(
+        instance, include_model_fields=True, include_related_fields=True
+):
+    model_need_continue_fields = ['date_updated']
+    m2m_need_continue_fields = ['history_passwords']
+    opts = instance._meta
+    data = {}
+    for f in chain(opts.concrete_fields, opts.private_fields):
+        if isinstance(f, (models.FileField, models.ImageField)):
+            continue
+
+        if getattr(f, 'attname', None) in model_need_continue_fields:
+            continue
+
+        value = getattr(instance, f.name) or getattr(instance, f.attname)
+        if not isinstance(value, bool) and not value:
+            continue
+
+        if getattr(f, 'primary_key', False):
+            f.verbose_name = 'id'
+        elif isinstance(value, list):
+            value = [str(v) for v in value]
+        elif isinstance(value, datetime):
+            value = as_current_tz(value).strftime('%Y-%m-%d %H:%M:%S')
+
+        if include_model_fields or getattr(f, 'primary_key', False):
+            data[str(f.verbose_name)] = value
+
+    if include_related_fields:
+        for f in chain(opts.many_to_many, opts.related_objects):
+            value = []
+            if instance.pk is not None:
+                related_name = getattr(f, 'attname', '') or getattr(f, 'related_name', '')
+                if not related_name or related_name in m2m_need_continue_fields:
+                    continue
+                try:
+                    value = [str(i) for i in getattr(instance, related_name).all()]
+                except:
+                    pass
+            if not value:
+                continue
+            try:
+                field_key = getattr(f, 'verbose_name', None) or f.related_model._meta.verbose_name
+                data[str(field_key)] = value
+            except:
+                pass
+    return data

apps/authentication/api/connection_token.py

@@ -62,12 +62,15 @@ class ConnectionTokenMixin:
 
     def get_smart_endpoint(self, protocol, asset=None, application=None):
         if asset:
+            target_instance = asset
             target_ip = asset.get_target_ip()
         elif application:
+            target_instance = application
             target_ip = application.get_target_ip()
         else:
+            target_instance = None
             target_ip = ''
-        endpoint = EndpointRule.match_endpoint(target_ip, protocol, self.request)
+        endpoint = EndpointRule.match_endpoint(target_instance, target_ip, protocol, self.request)
         return endpoint
 
     @staticmethod
@@ -85,7 +88,7 @@ class ConnectionTokenMixin:
             filename, ssh_token = self.get_ssh_token(token)
         else:
             raise ValueError('Protocol not support: {}'.format(protocol))
-
+        filename = urllib.parse.unquote(filename)
         return {
             "filename": filename,
             "protocol": protocol,

apps/authentication/api/login_confirm.py

@@ -20,6 +20,7 @@ class TicketStatusApi(mixins.AuthMixin, APIView):
         try:
             self.check_user_login_confirm()
             self.request.session['auth_third_party_done'] = 1
+            self.request.session.pop('auth_third_party_required', '')
             return Response({"msg": "ok"})
         except errors.LoginConfirmOtherError as e:
             reason = e.msg

apps/authentication/api/password.py

@@ -1,13 +1,71 @@
 from rest_framework.generics import CreateAPIView
 from rest_framework.response import Response
+from rest_framework.permissions import AllowAny
+from django.utils.translation import ugettext as _
+from django.template.loader import render_to_string
+from django.core.cache import cache
+from django.shortcuts import reverse
 
-from authentication.serializers import PasswordVerifySerializer
+from common.utils.verify_code import SendAndVerifyCodeUtil
 from common.permissions import IsValidUser
+from common.utils.random import random_string
+from common.utils import get_object_or_none
+from authentication.serializers import (
+    PasswordVerifySerializer, ResetPasswordCodeSerializer
+)
+from settings.utils import get_login_title
+from users.models import User
 from authentication.mixins import authenticate
 from authentication.errors import PasswordInvalid
 from authentication.mixins import AuthMixin
 
 
+class UserResetPasswordSendCodeApi(CreateAPIView):
+    permission_classes = (AllowAny,)
+    serializer_class = ResetPasswordCodeSerializer
+
+    @staticmethod
+    def is_valid_user(**kwargs):
+        user = get_object_or_none(User, **kwargs)
+        if not user:
+            err_msg = _('User does not exist: {}').format(_("No user matched"))
+            return None, err_msg
+        if not user.is_local:
+            err_msg = _(
+                'The user is from {}, please go to the corresponding system to change the password'
+            ).format(user.get_source_display())
+            return None, err_msg
+        return user, None
+
+    def create(self, request, *args, **kwargs):
+        token = request.GET.get('token')
+        userinfo = cache.get(token)
+        if not userinfo:
+            return reverse('authentication:forgot-previewing')
+
+        serializer = self.get_serializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        username = userinfo.get('username')
+        form_type = serializer.validated_data['form_type']
+        code = random_string(6, lower=False, upper=False)
+        other_args = {}
+
+        target = serializer.validated_data[form_type]
+        query_key = 'phone' if form_type == 'sms' else form_type
+        user, err = self.is_valid_user(username=username, **{query_key: target})
+        if not user:
+            return Response({'error': err}, status=400)
+
+        subject = '%s: %s' % (get_login_title(), _('Forgot password'))
+        context = {
+            'user': user, 'title': subject, 'code': code,
+        }
+        message = render_to_string('authentication/_msg_reset_password_code.html', context)
+        other_args['subject'], other_args['message'] = subject, message
+        SendAndVerifyCodeUtil(target, code, backend=form_type, **other_args).gen_and_send_async()
+        return Response({'data': 'ok'}, status=200)
+
+
 class UserPasswordVerifyApi(AuthMixin, CreateAPIView):
     permission_classes = (IsValidUser,)
     serializer_class = PasswordVerifySerializer

apps/authentication/backends/custom.py

@@ -0,0 +1,61 @@
+from django.conf import settings
+from django.utils.module_loading import import_string
+from common.utils import get_logger
+from django.contrib.auth import get_user_model
+from authentication.signals import user_auth_failed, user_auth_success
+
+from .base import JMSModelBackend
+
+logger = get_logger(__file__)
+
+custom_authenticate_method = None
+
+if settings.AUTH_CUSTOM:
+    """ 保证自定义认证方法在服务运行时不能被更改，只在第一次调用时加载一次 """
+    try:
+        custom_auth_method_path = 'data.auth.main.authenticate'
+        custom_authenticate_method = import_string(custom_auth_method_path)
+    except Exception as e:
+        logger.warning('Import custom auth method failed: {}, Maybe not enabled'.format(e))
+
+
+class CustomAuthBackend(JMSModelBackend):
+
+    def is_enabled(self):
+        return settings.AUTH_CUSTOM and callable(custom_authenticate_method)
+
+    @staticmethod
+    def get_or_create_user_from_userinfo(userinfo: dict):
+        username = userinfo['username']
+        attrs = ['name', 'username', 'email', 'is_active']
+        defaults = {attr: userinfo[attr] for attr in attrs}
+        user, created = get_user_model().objects.get_or_create(
+            username=username, defaults=defaults
+        )
+        return user, created
+
+    def authenticate(self, request, username=None, password=None, **kwargs):
+        try:
+            userinfo: dict = custom_authenticate_method(
+                username=username, password=password, **kwargs
+            )
+            user, created = self.get_or_create_user_from_userinfo(userinfo)
+        except Exception as e:
+            logger.error('Custom authenticate error: {}'.format(e))
+            return None
+
+        if self.user_can_authenticate(user):
+            logger.info(f'Custom authenticate success: {user.username}')
+            user_auth_success.send(
+                sender=self.__class__, request=request, user=user,
+                backend=settings.AUTH_BACKEND_CUSTOM
+            )
+            return user
+        else:
+            logger.info(f'Custom authenticate failed: {user.username}')
+            user_auth_failed.send(
+                sender=self.__class__, request=request, username=user.username,
+                reason=_('User invalid, disabled or expired'),
+                backend=settings.AUTH_BACKEND_CUSTOM
+            )
+            return None

apps/authentication/backends/oauth2/backends.py

@@ -2,6 +2,7 @@
 #
 import requests
 
+from django.utils.translation import gettext_lazy as _
 from django.contrib.auth import get_user_model
 from django.utils.http import urlencode
 from django.conf import settings
@@ -10,11 +11,11 @@ from django.urls import reverse
 from common.utils import get_logger
 from users.utils import construct_user_email
 from authentication.utils import build_absolute_uri
+from authentication.signals import user_auth_failed, user_auth_success
 from common.exceptions import JMSException
 
 from .signals import (
-    oauth2_create_or_update_user, oauth2_user_login_failed,
-    oauth2_user_login_success
+    oauth2_create_or_update_user
 )
 from ..base import JMSModelBackend
 
@@ -90,8 +91,12 @@ class OAuth2Backend(JMSModelBackend):
                 request, path=reverse(settings.AUTH_OAUTH2_AUTH_LOGIN_CALLBACK_URL_NAME)
             )
         }
-        access_token_url = '{url}?{query}'.format(
-            url=settings.AUTH_OAUTH2_ACCESS_TOKEN_ENDPOINT, query=urlencode(query_dict)
+        if '?' in settings.AUTH_OAUTH2_ACCESS_TOKEN_ENDPOINT:
+            separator = '&'
+        else:
+            separator = '?'
+        access_token_url = '{url}{separator}{query}'.format(
+            url=settings.AUTH_OAUTH2_ACCESS_TOKEN_ENDPOINT, separator=separator, query=urlencode(query_dict)
         )
         token_method = settings.AUTH_OAUTH2_ACCESS_TOKEN_METHOD.lower()
         requests_func = getattr(requests, token_method, requests.get)
@@ -114,12 +119,16 @@ class OAuth2Backend(JMSModelBackend):
 
         headers = {
             'Accept': 'application/json',
-            'Authorization': 'token {}'.format(response_data.get('access_token', ''))
+            'Authorization': 'Bearer {}'.format(response_data.get('access_token', ''))
         }
 
         logger.debug(log_prompt.format('Get userinfo endpoint'))
-        userinfo_url = '{url}?{query}'.format(
-            url=settings.AUTH_OAUTH2_PROVIDER_USERINFO_ENDPOINT,
+        if '?' in settings.AUTH_OAUTH2_PROVIDER_USERINFO_ENDPOINT:
+            separator = '&'
+        else:
+            separator = '?'
+        userinfo_url = '{url}{separator}{query}'.format(
+            url=settings.AUTH_OAUTH2_PROVIDER_USERINFO_ENDPOINT, separator=separator,
             query=urlencode(query_dict)
         )
         userinfo_response = requests.get(userinfo_url, headers=headers)
@@ -145,13 +154,17 @@ class OAuth2Backend(JMSModelBackend):
         if self.user_can_authenticate(user):
             logger.debug(log_prompt.format('OAuth2 user login success'))
             logger.debug(log_prompt.format('Send signal => oauth2 user login success'))
-            oauth2_user_login_success.send(sender=self.__class__, request=request, user=user)
+            user_auth_success.send(
+                sender=self.__class__, request=request, user=user,
+                backend=settings.AUTH_BACKEND_OAUTH2
+            )
             return user
         else:
             logger.debug(log_prompt.format('OAuth2 user login failed'))
             logger.debug(log_prompt.format('Send signal => oauth2 user login failed'))
-            oauth2_user_login_failed.send(
+            user_auth_failed.send(
                 sender=self.__class__, request=request, username=user.username,
-                reason=_('User invalid, disabled or expired')
+                reason=_('User invalid, disabled or expired'),
+                backend=settings.AUTH_BACKEND_OAUTH2
             )
             return None

apps/authentication/backends/oauth2/signals.py

@@ -4,6 +4,4 @@ from django.dispatch import Signal
 oauth2_create_or_update_user = Signal(
     providing_args=['request', 'user', 'created', 'name', 'username', 'email']
 )
-oauth2_user_login_success = Signal(providing_args=['request', 'user'])
-oauth2_user_login_failed = Signal(providing_args=['request', 'username', 'reason'])
 

apps/authentication/backends/oauth2/urls.py

@@ -7,5 +7,6 @@ from . import views
 
 urlpatterns = [
     path('login/', views.OAuth2AuthRequestView.as_view(), name='login'),
-    path('callback/', views.OAuth2AuthCallbackView.as_view(), name='login-callback')
+    path('callback/', views.OAuth2AuthCallbackView.as_view(), name='login-callback'),
+    path('logout/', views.OAuth2EndSessionView.as_view(), name='logout')
 ]

apps/authentication/backends/oauth2/views.py

@@ -1,6 +1,6 @@
 from django.views import View
 from django.conf import settings
-from django.contrib.auth import login
+from django.contrib import auth
 from django.http import HttpResponseRedirect
 from django.urls import reverse
 from django.utils.http import urlencode
@@ -26,8 +26,13 @@ class OAuth2AuthRequestView(View):
             )
         }
 
-        redirect_url = '{url}?{query}'.format(
+        if '?' in settings.AUTH_OAUTH2_PROVIDER_AUTHORIZATION_ENDPOINT:
+            separator = '&'
+        else:
+            separator = '?'
+        redirect_url = '{url}{separator}{query}'.format(
             url=settings.AUTH_OAUTH2_PROVIDER_AUTHORIZATION_ENDPOINT,
+            separator=separator,
             query=urlencode(query_dict)
         )
         logger.debug(log_prompt.format('Redirect login url'))
@@ -48,11 +53,43 @@ class OAuth2AuthCallbackView(View):
             user = authenticate(code=callback_params['code'], request=request)
             if user and user.is_valid:
                 logger.debug(log_prompt.format('Login: {}'.format(user)))
-                login(self.request, user)
+                auth.login(self.request, user)
                 logger.debug(log_prompt.format('Redirect'))
                 return HttpResponseRedirect(
                     settings.AUTH_OAUTH2_AUTHENTICATION_REDIRECT_URI
                 )
 
         logger.debug(log_prompt.format('Redirect'))
-        return HttpResponseRedirect(settings.AUTH_OAUTH2_AUTHENTICATION_FAILURE_REDIRECT_URI)
+        # OAuth2 服务端认证成功, 但是用户被禁用了, 这时候需要调用服务端的logout
+        redirect_url = settings.AUTH_OAUTH2_PROVIDER_END_SESSION_ENDPOINT
+        return HttpResponseRedirect(redirect_url)
+
+
+class OAuth2EndSessionView(View):
+    http_method_names = ['get', 'post', ]
+
+    def get(self, request):
+        """ Processes GET requests. """
+        log_prompt = "Process GET requests [OAuth2EndSessionView]: {}"
+        logger.debug(log_prompt.format('Start'))
+        return self.post(request)
+
+    def post(self, request):
+        """ Processes POST requests. """
+        log_prompt = "Process POST requests [OAuth2EndSessionView]: {}"
+        logger.debug(log_prompt.format('Start'))
+
+        logout_url = settings.LOGOUT_REDIRECT_URL or '/'
+
+        # Log out the current user.
+        if request.user.is_authenticated:
+            logger.debug(log_prompt.format('Log out the current user: {}'.format(request.user)))
+            auth.logout(request)
+
+            if settings.AUTH_OAUTH2_LOGOUT_COMPLETELY:
+                logger.debug(log_prompt.format('Log out OAUTH2 platform user session synchronously'))
+                next_url = settings.AUTH_OAUTH2_PROVIDER_END_SESSION_ENDPOINT
+                return HttpResponseRedirect(next_url)
+
+        logger.debug(log_prompt.format('Redirect'))
+        return HttpResponseRedirect(logout_url)

apps/authentication/backends/oidc/backends.py

@@ -26,8 +26,9 @@ from ..base import JMSBaseAuthBackend
 from .utils import validate_and_return_id_token
 from .decorator import ssl_verification
 from .signals import (
-    openid_create_or_update_user, openid_user_login_failed, openid_user_login_success
+    openid_create_or_update_user
 )
+from authentication.signals import user_auth_success, user_auth_failed
 
 logger = get_logger(__file__)
 
@@ -87,7 +88,7 @@ class OIDCAuthCodeBackend(OIDCBaseBackend):
     """
 
     @ssl_verification
-    def authenticate(self, request, nonce=None, **kwargs):
+    def authenticate(self, request, nonce=None, code_verifier=None, **kwargs):
         """ Authenticates users in case of the OpenID Connect Authorization code flow. """
         log_prompt = "Process authenticate [OIDCAuthCodeBackend]: {}"
         logger.debug(log_prompt.format('start'))
@@ -133,6 +134,8 @@ class OIDCAuthCodeBackend(OIDCBaseBackend):
                 request, path=reverse(settings.AUTH_OPENID_AUTH_LOGIN_CALLBACK_URL_NAME)
             )
         }
+        if settings.AUTH_OPENID_PKCE and code_verifier:
+            token_payload['code_verifier'] = code_verifier
         if settings.AUTH_OPENID_CLIENT_AUTH_METHOD == 'client_secret_post':
             token_payload.update({
                 'client_id': settings.AUTH_OPENID_CLIENT_ID,
@@ -213,14 +216,18 @@ class OIDCAuthCodeBackend(OIDCBaseBackend):
         if self.user_can_authenticate(user):
             logger.debug(log_prompt.format('OpenID user login success'))
             logger.debug(log_prompt.format('Send signal => openid user login success'))
-            openid_user_login_success.send(sender=self.__class__, request=request, user=user)
+            user_auth_success.send(
+                sender=self.__class__, request=request, user=user,
+                backend=settings.AUTH_BACKEND_OIDC_CODE
+            )
             return user
         else:
             logger.debug(log_prompt.format('OpenID user login failed'))
             logger.debug(log_prompt.format('Send signal => openid user login failed'))
-            openid_user_login_failed.send(
+            user_auth_failed.send(
                 sender=self.__class__, request=request, username=user.username,
-                reason="User is invalid"
+                reason="User is invalid", backend=settings.AUTH_BACKEND_OIDC_CODE
+
             )
             return None
 
@@ -271,8 +278,9 @@ class OIDCAuthPasswordBackend(OIDCBaseBackend):
                     "content is: {}, error is: {}".format(token_response.content, str(e))
             logger.debug(log_prompt.format(error))
             logger.debug(log_prompt.format('Send signal => openid user login failed'))
-            openid_user_login_failed.send(
-                sender=self.__class__, request=request, username=username, reason=error
+            user_auth_failed.send(
+                sender=self.__class__, request=request, username=username, reason=error,
+                backend=settings.AUTH_BACKEND_OIDC_PASSWORD
             )
             return
 
@@ -299,8 +307,9 @@ class OIDCAuthPasswordBackend(OIDCBaseBackend):
                     "content is: {}, error is: {}".format(claims_response.content, str(e))
             logger.debug(log_prompt.format(error))
             logger.debug(log_prompt.format('Send signal => openid user login failed'))
-            openid_user_login_failed.send(
-                sender=self.__class__, request=request, username=username, reason=error
+            user_auth_failed.send(
+                sender=self.__class__, request=request, username=username, reason=error,
+                backend=settings.AUTH_BACKEND_OIDC_PASSWORD
             )
             return
 
@@ -312,13 +321,16 @@ class OIDCAuthPasswordBackend(OIDCBaseBackend):
         if self.user_can_authenticate(user):
             logger.debug(log_prompt.format('OpenID user login success'))
             logger.debug(log_prompt.format('Send signal => openid user login success'))
-            openid_user_login_success.send(
-                sender=self.__class__, request=request, user=user
+            user_auth_success.send(
+                sender=self.__class__, request=request, user=user,
+                backend=settings.AUTH_BACKEND_OIDC_PASSWORD
             )
             return user
         else:
             logger.debug(log_prompt.format('OpenID user login failed'))
             logger.debug(log_prompt.format('Send signal => openid user login failed'))
-            openid_user_login_failed.send(
-                sender=self.__class__, request=request, username=username, reason="User is invalid"
+            user_auth_failed.send(
+                sender=self.__class__, request=request, username=username, reason="User is invalid",
+                backend=settings.AUTH_BACKEND_OIDC_PASSWORD
             )
+            return None

apps/authentication/backends/oidc/signals.py

@@ -13,6 +13,4 @@ from django.dispatch import Signal
 openid_create_or_update_user = Signal(
     providing_args=['request', 'user', 'created', 'name', 'username', 'email']
 )
-openid_user_login_success = Signal(providing_args=['request', 'user'])
-openid_user_login_failed = Signal(providing_args=['request', 'username', 'reason'])
 

apps/authentication/backends/oidc/views.py

@@ -9,7 +9,10 @@
 
 """
 
+import base64
+import hashlib
 import time
+import secrets
 
 from django.conf import settings
 from django.contrib import auth
@@ -38,6 +41,19 @@ class OIDCAuthRequestView(View):
 
     http_method_names = ['get', ]
 
+    @staticmethod
+    def gen_code_verifier(length=128):
+        # length range 43 ~ 128
+        return secrets.token_urlsafe(length-32)
+
+    @staticmethod
+    def gen_code_challenge(code_verifier, code_challenge_method):
+        if code_challenge_method == 'plain':
+            return code_verifier
+        h = hashlib.sha256(code_verifier.encode('ascii')).digest()
+        b = base64.urlsafe_b64encode(h)
+        return b.decode('ascii')[:-1]
+
     def get(self, request):
         """ Processes GET requests. """
 
@@ -56,6 +72,16 @@ class OIDCAuthRequestView(View):
             )
         })
 
+        if settings.AUTH_OPENID_PKCE:
+            code_verifier = self.gen_code_verifier()
+            code_challenge_method = settings.AUTH_OPENID_CODE_CHALLENGE_METHOD or 'S256'
+            code_challenge = self.gen_code_challenge(code_verifier, code_challenge_method)
+            authentication_request_params.update({
+                'code_challenge_method': code_challenge_method,
+                'code_challenge': code_challenge
+            })
+            request.session['oidc_auth_code_verifier'] = code_verifier
+
         # States should be used! They are recommended in order to maintain state between the
         # authentication request and the callback.
         if settings.AUTH_OPENID_USE_STATE:
@@ -138,8 +164,9 @@ class OIDCAuthCallbackView(View):
 
             # Authenticates the end-user.
             next_url = request.session.get('oidc_auth_next_url', None)
+            code_verifier = request.session.get('oidc_auth_code_verifier', None)
             logger.debug(log_prompt.format('Process authenticate'))
-            user = auth.authenticate(nonce=nonce, request=request)
+            user = auth.authenticate(nonce=nonce, request=request, code_verifier=code_verifier)
             if user and user.is_valid:
                 logger.debug(log_prompt.format('Login: {}'.format(user)))
                 auth.login(self.request, user)

apps/authentication/backends/saml2/backends.py

@@ -7,9 +7,9 @@ from django.db import transaction
 from common.utils import get_logger
 from authentication.errors import reason_choices, reason_user_invalid
 from .signals import (
-    saml2_user_authenticated, saml2_user_authentication_failed,
     saml2_create_or_update_user
 )
+from authentication.signals import user_auth_failed, user_auth_success
 from ..base import JMSModelBackend
 
 __all__ = ['SAML2Backend']
@@ -55,14 +55,16 @@ class SAML2Backend(JMSModelBackend):
 
         if self.user_can_authenticate(user):
             logger.debug(log_prompt.format('SAML2 user login success'))
-            saml2_user_authenticated.send(
-                sender=self, request=request, user=user, created=created
+            user_auth_success.send(
+                sender=self.__class__, request=request, user=user, created=created,
+                backend=settings.AUTH_BACKEND_SAML2
             )
             return user
         else:
             logger.debug(log_prompt.format('SAML2 user login failed'))
-            saml2_user_authentication_failed.send(
-                sender=self, request=request, username=username,
-                reason=reason_choices.get(reason_user_invalid)
+            user_auth_failed.send(
+                sender=self.__class__, request=request, username=username,
+                reason=reason_choices.get(reason_user_invalid),
+                backend=settings.AUTH_BACKEND_SAML2
             )
             return None

apps/authentication/backends/saml2/signals.py

@@ -2,5 +2,3 @@ from django.dispatch import Signal
 
 
 saml2_create_or_update_user = Signal(providing_args=('user', 'created', 'request', 'attrs'))
-saml2_user_authenticated = Signal(providing_args=('user', 'created', 'request'))
-saml2_user_authentication_failed = Signal(providing_args=('request', 'username', 'reason'))

apps/authentication/backends/saml2/views.py

@@ -3,7 +3,7 @@ import copy
 from urllib import parse
 
 from django.views import View
-from django.contrib import auth as auth
+from django.contrib import auth
 from django.urls import reverse
 from django.conf import settings
 from django.views.decorators.csrf import csrf_exempt
@@ -271,7 +271,10 @@ class Saml2AuthCallbackView(View, PrepareRequestMixin):
             auth.login(self.request, user)
 
         logger.debug(log_prompt.format('Redirect'))
-        next_url = saml_instance.redirect_to(post_data.get('RelayState', '/'))
+        redir = post_data.get('RelayState')
+        if not redir or len(redir) == 0:
+          redir = "/"
+        next_url = saml_instance.redirect_to(redir)
         return HttpResponseRedirect(next_url)
 
     @csrf_exempt

apps/authentication/const.py

@@ -2,7 +2,7 @@ from django.db.models import TextChoices
 
 from authentication.confirm import CONFIRM_BACKENDS
 from .confirm import ConfirmMFA, ConfirmPassword, ConfirmReLogin
-from .mfa import MFAOtp, MFASms, MFARadius
+from .mfa import MFAOtp, MFASms, MFARadius, MFACustom
 
 RSA_PRIVATE_KEY = 'rsa_private_key'
 RSA_PUBLIC_KEY = 'rsa_public_key'
@@ -35,3 +35,4 @@ class MFAType(TextChoices):
     OTP = MFAOtp.name, MFAOtp.display_name
     SMS = MFASms.name, MFASms.display_name
     Radius = MFARadius.name, MFARadius.display_name
+    Custom = MFACustom.name, MFACustom.display_name

apps/authentication/forms.py

@@ -62,7 +62,7 @@ class CustomCaptchaTextInput(CaptchaTextInput):
 
 
 class CaptchaMixin(forms.Form):
-    captcha = CaptchaField(widget=CustomCaptchaTextInput)
+    captcha = CaptchaField(widget=CustomCaptchaTextInput, label=_('Captcha'))
 
 
 class ChallengeMixin(forms.Form):

apps/authentication/mfa/__init__.py

@@ -1,5 +1,4 @@
 from .otp import MFAOtp, otp_failed_msg
 from .sms import MFASms
 from .radius import MFARadius
-
-MFA_BACKENDS = [MFAOtp, MFASms, MFARadius]
+from .custom import MFACustom

apps/authentication/mfa/custom.py

@@ -0,0 +1,59 @@
+from django.conf import settings
+from django.utils.module_loading import import_string
+from django.utils.translation import ugettext_lazy as _
+
+from common.utils import get_logger
+from .base import BaseMFA
+
+logger = get_logger(__file__)
+
+mfa_custom_method = None
+
+if settings.MFA_CUSTOM:
+    """ 保证自定义认证方法在服务运行时不能被更改，只在第一次调用时加载一次 """
+    try:
+        mfa_custom_method_path = 'data.mfa.main.check_code'
+        mfa_custom_method = import_string(mfa_custom_method_path)
+    except Exception as e:
+        logger.warning('Import custom auth method failed: {}, Maybe not enabled'.format(e))
+
+custom_failed_msg = _("MFA Custom code invalid")
+
+
+class MFACustom(BaseMFA):
+    name = 'mfa_custom'
+    display_name = 'Custom'
+    placeholder = _("MFA custom verification code")
+
+    def check_code(self, code):
+        assert self.is_authenticated()
+        ok = False
+        try:
+            ok = mfa_custom_method(user=self.user, code=code)
+        except Exception as exc:
+            logger.error('Custom authenticate error: {}'.format(exc))
+        msg = '' if ok else custom_failed_msg
+        return ok, msg
+
+    def is_active(self):
+        return True
+
+    @staticmethod
+    def global_enabled():
+        return settings.MFA_CUSTOM and callable(mfa_custom_method)
+
+    def get_enable_url(self) -> str:
+        return ''
+
+    def can_disable(self):
+        return False
+
+    def disable(self):
+        return ''
+
+    @staticmethod
+    def help_text_of_disable():
+        return _("MFA custom global enabled, cannot disable")
+
+    def get_disable_url(self) -> str:
+        return ''

apps/authentication/mfa/sms.py

@@ -2,7 +2,7 @@ from django.utils.translation import ugettext_lazy as _
 from django.conf import settings
 
 from .base import BaseMFA
-from common.sdk.sms import SendAndVerifySMSUtil
+from common.utils.verify_code import SendAndVerifyCodeUtil
 
 sms_failed_msg = _("SMS verify code invalid")
 
@@ -15,7 +15,7 @@ class MFASms(BaseMFA):
     def __init__(self, user):
         super().__init__(user)
         phone = user.phone if self.is_authenticated() else ''
-        self.sms = SendAndVerifySMSUtil(phone)
+        self.sms = SendAndVerifyCodeUtil(phone, backend=self.name)
 
     def check_code(self, code):
         assert self.is_authenticated()
@@ -37,7 +37,7 @@ class MFASms(BaseMFA):
         return True
 
     def send_challenge(self):
-        self.sms.gen_and_send()
+        self.sms.gen_and_send_async()
 
     @staticmethod
     def global_enabled():

apps/authentication/middleware.py

@@ -61,6 +61,18 @@ class ThirdPartyLoginMiddleware(mixins.AuthMixin):
             return response
         if not request.session.get('auth_third_party_required'):
             return response
+
+        white_urls = [
+            'jsi18n/', '/static/',
+            'login/guard', 'login/wait-confirm',
+            'login-confirm-ticket/status',
+            'settings/public/open',
+            'core/auth/login', 'core/auth/logout'
+        ]
+        for url in white_urls:
+            if request.path.find(url) > -1:
+                return response
+
         ip = get_request_ip(request)
         try:
             self.request = request
@@ -88,7 +100,6 @@ class ThirdPartyLoginMiddleware(mixins.AuthMixin):
                 guard_url = "%s?%s" % (guard_url, args)
             response = redirect(guard_url)
         finally:
-            request.session.pop('auth_third_party_required', '')
             return response
 
 

apps/authentication/migrations/0001_initial.py

@@ -1,5 +1,6 @@
 # Generated by Django 2.1.7 on 2019-02-28 08:07
 
+import common.db.models
 from django.conf import settings
 from django.db import migrations, models
 import django.db.models.deletion
@@ -27,7 +28,7 @@ class Migration(migrations.Migration):
                  models.UUIDField(default=uuid.uuid4, editable=False,
                                   verbose_name='AccessKeySecret')),
                 ('user', models.ForeignKey(
-                    on_delete=django.db.models.deletion.CASCADE,
+                    on_delete=common.db.models.CASCADE_SIGNAL_SKIP,
                     related_name='access_keys',
                     to=settings.AUTH_USER_MODEL, verbose_name='User')),
             ],

apps/authentication/migrations/0002_auto_20190729_1423.py

@@ -15,7 +15,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='accesskey',
             name='date_created',
-            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2019, 7, 29, 6, 23, 54, 115123, tzinfo=utc)),
+            field=models.DateTimeField(auto_now_add=True, default=datetime.datetime(2019, 7, 29, 6, 23, 54, 115123, tzinfo=utc), verbose_name='Date created'),
             preserve_default=False,
         ),
         migrations.AddField(

apps/authentication/migrations/0006_auto_20211227_1059.py

@@ -1,8 +1,8 @@
 # Generated by Django 3.1.13 on 2021-12-27 02:59
 
+import common.db.models
 from django.conf import settings
 from django.db import migrations, models
-import django.db.models.deletion
 
 
 class Migration(migrations.Migration):
@@ -16,6 +16,6 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name='ssotoken',
             name='user',
-            field=models.ForeignKey(db_constraint=False, on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL, verbose_name='User'),
+            field=models.ForeignKey(db_constraint=False, on_delete=common.db.models.CASCADE_SIGNAL_SKIP, to=settings.AUTH_USER_MODEL, verbose_name='User'),
         ),
     ]

apps/authentication/mixins.py

@@ -225,6 +225,7 @@ class MFAMixin:
         self.request.session['auth_mfa_time'] = time.time()
         self.request.session['auth_mfa_required'] = 0
         self.request.session['auth_mfa_type'] = mfa_type
+        MFABlockUtils(self.request.user.username, self.get_request_ip()).clean_failed_count()
 
     def clean_mfa_mark(self):
         keys = ['auth_mfa', 'auth_mfa_time', 'auth_mfa_required', 'auth_mfa_type']
@@ -369,7 +370,7 @@ class AuthACLMixin:
     def check_user_login_confirm(self):
         ticket = self.get_ticket()
         if not ticket:
-            raise errors.LoginConfirmOtherError('', "Not found")
+            raise errors.LoginConfirmOtherError('', "Not found", '')
         elif ticket.is_state(ticket.State.approved):
             self.request.session["auth_confirm_required"] = ''
             return
@@ -512,4 +513,20 @@ class AuthMixin(CommonMixin, AuthPreCheckMixin, AuthACLMixin, MFAMixin, AuthPost
         args = self.request.META.get('QUERY_STRING', '')
         if args:
             guard_url = "%s?%s" % (guard_url, args)
-        return redirect(guard_url)
+        response = redirect(guard_url)
+        self.set_browser_default_language_if_need(response)
+        return response
+
+    def set_browser_default_language_if_need(self, response):
+        # en, ja, zh-CN,zh;q=0.9
+        browser_lang = self.request.headers.get('Accept-Language', '')
+        # 浏览器首选语言
+        if browser_lang.startswith('en'):
+            browser_lang = 'en'
+        elif browser_lang.startswith('ja'):
+            browser_lang = 'ja'
+        else:
+            browser_lang = 'zh'
+        request_lang = self.request.LANGUAGE_CODE
+        lang = request_lang or browser_lang
+        response.set_cookie(settings.LANGUAGE_COOKIE_NAME, lang)

apps/authentication/models.py

@@ -16,10 +16,10 @@ class AccessKey(models.Model):
                           default=uuid.uuid4, editable=False)
     secret = models.UUIDField(verbose_name='AccessKeySecret',
                               default=uuid.uuid4, editable=False)
-    user = models.ForeignKey(settings.AUTH_USER_MODEL, verbose_name='User',
-                             on_delete=models.CASCADE, related_name='access_keys')
+    user = models.ForeignKey(settings.AUTH_USER_MODEL, verbose_name=_('User'),
+                             on_delete=models.CASCADE_SIGNAL_SKIP, related_name='access_keys')
     is_active = models.BooleanField(default=True, verbose_name=_('Active'))
-    date_created = models.DateTimeField(auto_now_add=True)
+    date_created = models.DateTimeField(auto_now_add=True, verbose_name=_('Date created'))
 
     def get_id(self):
         return str(self.id)
@@ -51,7 +51,7 @@ class SSOToken(models.JMSBaseModel):
     """
     authkey = models.UUIDField(primary_key=True, default=uuid.uuid4, verbose_name=_('Token'))
     expired = models.BooleanField(default=False, verbose_name=_('Expired'))
-    user = models.ForeignKey('users.User', on_delete=models.CASCADE, verbose_name=_('User'), db_constraint=False)
+    user = models.ForeignKey('users.User', on_delete=models.CASCADE_SIGNAL_SKIP, verbose_name=_('User'), db_constraint=False)
 
     class Meta:
         verbose_name = _('SSO token')

apps/authentication/serializers/password_mfa.py

@@ -1,15 +1,38 @@
 # -*- coding: utf-8 -*-
 #
+from django.utils.translation import ugettext_lazy as _
 from rest_framework import serializers
 
 from common.drf.fields import EncryptedField
 
 __all__ = [
     'MFAChallengeSerializer', 'MFASelectTypeSerializer',
-    'PasswordVerifySerializer',
+    'PasswordVerifySerializer', 'ResetPasswordCodeSerializer',
 ]
 
 
+class ResetPasswordCodeSerializer(serializers.Serializer):
+    form_type = serializers.ChoiceField(
+        choices=[('sms', _('SMS')), ('email', _('Email'))], default='email'
+    )
+    email = serializers.CharField(allow_blank=True)
+    sms = serializers.CharField(allow_blank=True)
+
+    def create(self, attrs):
+        error = []
+        validate_backends = {
+            'email': _('Email'), 'sms': _('SMS')
+        }
+        form_type = attrs.get('form_type', 'email')
+        validate_backend_input = attrs.get(form_type)
+        if not validate_backend_input:
+            error.append(_('The {} cannot be empty').format(
+                validate_backends.get(validate_backend_input))
+            )
+        if error:
+            raise serializers.ValidationError(error)
+
+
 class PasswordVerifySerializer(serializers.Serializer):
     password = EncryptedField()
 

apps/authentication/signal_handlers.py

@@ -7,16 +7,7 @@ from django.dispatch import receiver
 from django_cas_ng.signals import cas_user_authenticated
 
 from apps.jumpserver.settings.auth import AUTHENTICATION_BACKENDS_THIRD_PARTY
-from authentication.backends.oidc.signals import (
-    openid_user_login_failed, openid_user_login_success
-)
-from authentication.backends.saml2.signals import (
-    saml2_user_authenticated, saml2_user_authentication_failed
-)
-from authentication.backends.oauth2.signals import (
-    oauth2_user_login_failed, oauth2_user_login_success
-)
-from .signals import post_auth_success, post_auth_failed
+from .signals import post_auth_success, post_auth_failed, user_auth_failed, user_auth_success
 
 
 @receiver(user_logged_in)
@@ -29,7 +20,8 @@ def on_user_auth_login_success(sender, user, request, **kwargs):
             and user.mfa_enabled \
             and not request.session.get('auth_mfa'):
         request.session['auth_mfa_required'] = 1
-    if not request.session.get("auth_third_party_done") and request.session.get('auth_backend') in AUTHENTICATION_BACKENDS_THIRD_PARTY:
+    if not request.session.get("auth_third_party_done") and \
+            request.session.get('auth_backend') in AUTHENTICATION_BACKENDS_THIRD_PARTY:
         request.session['auth_third_party_required'] = 1
     # 单点登录，超过了自动退出
     if settings.USER_LOGIN_SINGLE_MACHINE_ENABLED:
@@ -44,43 +36,19 @@ def on_user_auth_login_success(sender, user, request, **kwargs):
     request.session['auth_session_expiration_required'] = 1
 
 
-@receiver(openid_user_login_success)
-def on_oidc_user_login_success(sender, request, user, create=False, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_OIDC_CODE
-    post_auth_success.send(sender, user=user, request=request)
-
-
-@receiver(openid_user_login_failed)
-def on_oidc_user_login_failed(sender, username, request, reason, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_OIDC_CODE
-    post_auth_failed.send(sender, username=username, request=request, reason=reason)
-
-
 @receiver(cas_user_authenticated)
 def on_cas_user_login_success(sender, request, user, **kwargs):
     request.session['auth_backend'] = settings.AUTH_BACKEND_CAS
     post_auth_success.send(sender, user=user, request=request)
 
 
-@receiver(saml2_user_authenticated)
-def on_saml2_user_login_success(sender, request, user, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_SAML2
+@receiver(user_auth_success)
+def on_user_login_success(sender, request, user, backend, create=False, **kwargs):
+    request.session['auth_backend'] = backend
     post_auth_success.send(sender, user=user, request=request)
 
 
-@receiver(saml2_user_authentication_failed)
-def on_saml2_user_login_failed(sender, request, username, reason, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_SAML2
-    post_auth_failed.send(sender, username=username, request=request, reason=reason)
-
-
-@receiver(oauth2_user_login_success)
-def on_oauth2_user_login_success(sender, request, user, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_OAUTH2
-    post_auth_success.send(sender, user=user, request=request)
-
-
-@receiver(oauth2_user_login_failed)
-def on_oauth2_user_login_failed(sender, username, request, reason, **kwargs):
-    request.session['auth_backend'] = settings.AUTH_BACKEND_OAUTH2
+@receiver(user_auth_failed)
+def on_user_login_failed(sender, username, request, reason, backend, **kwargs):
+    request.session['auth_backend'] = backend
     post_auth_failed.send(sender, username=username, request=request, reason=reason)

apps/authentication/signals.py

@@ -3,3 +3,7 @@ from django.dispatch import Signal
 
 post_auth_success = Signal(providing_args=('user', 'request'))
 post_auth_failed = Signal(providing_args=('username', 'request', 'reason'))
+
+
+user_auth_success = Signal(providing_args=('user', 'request', 'backend', 'create'))
+user_auth_failed = Signal(providing_args=('username', 'request', 'reason', 'backend'))

apps/authentication/templates/authentication/_msg_reset_password_code.html

@@ -0,0 +1,21 @@
+{% load i18n %}
+
+<div style="width: 100%; text-align: center">
+    <table style="margin: 0 auto; border: 1px solid #ccc; border-collapse: collapse; width: 60%">
+        <tr style="background-color: #1ab394; color: white">
+            <th style="height: 80px;">{{ title }}</th>
+        </tr>
+        <tr style="border: 1px solid #eee;">
+            <td style="height: 50px;">{% trans 'Hello' %} {{ user.name }},</td>
+        </tr>
+        <tr style="border: 1px solid #eee">
+            <td style="height: 50px;">{% trans 'Verify code' %}: <span style="font-weight: bold;">{{ code }}</span></td>
+        </tr>
+        <tr style="border: 1px solid #eee;">
+            <td style="height: 30px;"> {% trans 'Copy the verification code to the Reset Password page to reset the password.' %} </td>
+        </tr>
+        <tr style="border: 1px solid #eee">
+            <td style="height: 30px;">{% trans 'The validity period of the verification code is one minute' %}</td>
+        </tr>
+    </table>
+</div>

apps/authentication/templates/authentication/login_wait_confirm.html

@@ -79,6 +79,9 @@ function doRequestAuth() {
      requestApi({
         url: url,
         method: "GET",
+        headers: {
+            "X-JMS-LOGIN-TYPE": "W"
+        },
         success: function (data) {
             if (!data.error && data.msg === 'ok') {
                 window.onbeforeunload = function(){};
@@ -98,9 +101,6 @@ function doRequestAuth() {
         },
         error: function (text, data) {
         },
-        beforeSend: function(request) {
-            request.setRequestHeader("X-JMS-LOGIN-TYPE", "W");
-        },
         flash_message: false, // 是否显示flash消息
     })
 }

apps/authentication/urls/api_urls.py

@@ -32,7 +32,8 @@ urlpatterns = [
     path('mfa/verify/', api.MFAChallengeVerifyApi.as_view(), name='mfa-verify'),
     path('mfa/challenge/', api.MFAChallengeVerifyApi.as_view(), name='mfa-challenge'),
     path('mfa/select/', api.MFASendCodeApi.as_view(), name='mfa-select'),
-    path('mfa/send-code/', api.MFASendCodeApi.as_view(), name='mfa-send-codej'),
+    path('mfa/send-code/', api.MFASendCodeApi.as_view(), name='mfa-send-code'),
+    path('password/reset-code/', api.UserResetPasswordSendCodeApi.as_view(), name='reset-password-code'),
     path('password/verify/', api.UserPasswordVerifyApi.as_view(), name='user-password-verify'),
     path('login-confirm-ticket/status/', api.TicketStatusApi.as_view(), name='login-confirm-ticket-status'),
 ]

apps/authentication/urls/view_urls.py

@@ -18,6 +18,7 @@ urlpatterns = [
     path('logout/', views.UserLogoutView.as_view(), name='logout'),
 
     # 原来在users中的
+    path('password/forget/previewing/', users_view.UserForgotPasswordPreviewingView.as_view(), name='forgot-previewing'),
     path('password/forgot/', users_view.UserForgotPasswordView.as_view(), name='forgot-password'),
     path('password/reset/', users_view.UserResetPasswordView.as_view(), name='reset-password'),
     path('password/verify/', users_view.UserVerifyPasswordView.as_view(), name='user-verify-password'),

apps/authentication/views/feishu.py

@@ -60,7 +60,7 @@ class FeiShuQRMixin(UserConfirmRequiredExceptionMixin, PermissionsMixin, View):
             'state': state,
             'redirect_uri': redirect_uri,
         }
-        url = URL.AUTHEN + '?' + urlencode(params)
+        url = URL().authen + '?' + urlencode(params)
         return url
 
     @staticmethod

apps/authentication/views/login.py

@@ -115,7 +115,7 @@ class UserLoginContextMixin:
 
     @staticmethod
     def get_forgot_password_url():
-        forgot_password_url = reverse('authentication:forgot-password')
+        forgot_password_url = reverse('authentication:forgot-previewing')
         forgot_password_url = settings.FORGOT_PASSWORD_URL or forgot_password_url
         return forgot_password_url
 
@@ -330,6 +330,8 @@ class UserLogoutView(TemplateView):
             return settings.CAS_LOGOUT_URL_NAME
         elif 'saml2' in backend:
             return settings.SAML2_LOGOUT_URL_NAME
+        elif 'oauth2' in backend:
+            return settings.AUTH_OAUTH2_LOGOUT_URL_NAME
         return None
 
     def get(self, request, *args, **kwargs):

apps/authentication/views/mfa.py

@@ -32,11 +32,14 @@ class UserLoginMFAView(mixins.AuthMixin, FormView):
         return super().get(*args, **kwargs)
 
     def form_valid(self, form):
+        from users.utils import MFABlockUtils
         code = form.cleaned_data.get('code')
         mfa_type = form.cleaned_data.get('mfa_type')
 
         try:
             self._do_check_user_mfa(code, mfa_type)
+            user, ip = self.get_user_from_session(), self.get_request_ip()
+            MFABlockUtils(user.username, ip).clean_failed_count()
             return redirect_to_guard_view('mfa_ok')
         except (errors.MFAFailedError, errors.BlockMFAError) as e:
             form.add_error('code', e.msg)

apps/common/const/__init__.py

@@ -10,5 +10,5 @@ celery_task_pre_key = "CELERY_"
 KEY_CACHE_RESOURCE_IDS = "RESOURCE_IDS_{}"
 
 # AD User AccountDisable
-# https://blog.csdn.net/bytxl/article/details/17763975
+# https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
 LDAP_AD_ACCOUNT_DISABLE = 2

apps/common/const/signals.py

@@ -15,3 +15,5 @@ POST_CLEAR = 'post_clear'
 
 POST_PREFIX = 'post'
 PRE_PREFIX = 'pre'
+
+SKIP_SIGNAL = 'skip_signal'

apps/common/db/fields.py

@@ -6,6 +6,7 @@ from django.utils.translation import ugettext_lazy as _
 from django.utils.encoding import force_text
 from django.core.validators import MinValueValidator, MaxValueValidator
 from common.utils import signer, crypto
+from common.local import add_encrypted_field_set
 
 
 __all__ = [
@@ -149,6 +150,10 @@ class EncryptMixin:
 class EncryptTextField(EncryptMixin, models.TextField):
     description = _("Encrypt field using Secret Key")
 
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        add_encrypted_field_set(self.verbose_name)
+
 
 class EncryptCharField(EncryptMixin, models.CharField):
     @staticmethod
@@ -163,6 +168,7 @@ class EncryptCharField(EncryptMixin, models.CharField):
     def __init__(self, *args, **kwargs):
         self.change_max_length(kwargs)
         super().__init__(*args, **kwargs)
+        add_encrypted_field_set(self.verbose_name)
 
     def deconstruct(self):
         name, path, args, kwargs = super().deconstruct()
@@ -174,11 +180,15 @@ class EncryptCharField(EncryptMixin, models.CharField):
 
 
 class EncryptJsonDictTextField(EncryptMixin, JsonDictTextField):
-    pass
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        add_encrypted_field_set(self.verbose_name)
 
 
 class EncryptJsonDictCharField(EncryptMixin, JsonDictCharField):
-    pass
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        add_encrypted_field_set(self.verbose_name)
 
 
 class PortField(models.IntegerField):

apps/common/db/models.py

@@ -19,6 +19,8 @@ from django.db.models import QuerySet
 from django.db.models.functions import Concat
 from django.utils.translation import ugettext_lazy as _
 
+from ..const.signals import SKIP_SIGNAL
+
 
 class Choice(str):
     def __new__(cls, value, label=''):  # `deepcopy` 的时候不会传 `label`
@@ -124,6 +126,9 @@ class JMSModel(JMSBaseModel):
     class Meta:
         abstract = True
 
+    def __str__(self):
+        return str(self.id)
+
 
 def concated_display(name1, name2):
     return Concat(F(name1), Value('('), F(name2), Value(')'))
@@ -238,3 +243,14 @@ class MultiTableChildQueryset(QuerySet):
             self._batched_insert(objs, self.model._meta.local_fields, batch_size)
 
         return objs
+
+
+def CASCADE_SIGNAL_SKIP(collector, field, sub_objs, using):
+    # 级联删除时，操作日志标记不保存，以免用户混淆
+    try:
+        for obj in sub_objs:
+            setattr(obj, SKIP_SIGNAL, True)
+    except:
+        pass
+
+    CASCADE(collector, field, sub_objs, using)

apps/common/drf/fields.py

@@ -4,6 +4,7 @@
 from rest_framework import serializers
 
 from common.utils import decrypt_password
+from common.local import add_encrypted_field_set
 
 __all__ = [
     'ReadableHiddenField', 'EncryptedField'
@@ -31,7 +32,9 @@ class EncryptedField(serializers.CharField):
         if write_only is None:
             write_only = True
         kwargs['write_only'] = write_only
+        encrypted_key = kwargs.pop('encrypted_key', None)
         super().__init__(**kwargs)
+        add_encrypted_field_set(encrypted_key or self.label)
 
     def to_internal_value(self, value):
         value = super().to_internal_value(value)

apps/common/local.py

@@ -1,7 +1,13 @@
 from werkzeug.local import Local
 
 thread_local = Local()
+encrypted_field_set = {'password'}
 
 
 def _find(attr):
     return getattr(thread_local, attr, None)
+
+
+def add_encrypted_field_set(label):
+    if label:
+        encrypted_field_set.add(str(label))

apps/common/management/commands/services/services/celery_base.py

@@ -30,7 +30,9 @@ class CeleryBaseService(BaseService):
             '-l', 'INFO',
             '-c', str(self.num),
             '-Q', self.queue,
-            '-n', f'{self.queue}@{server_hostname}'
+            '--heartbeat-interval', '10',
+            '-n', f'{self.queue}@{server_hostname}',
+            '--without-mingle',
         ]
         return cmd
 

apps/common/management/commands/services/services/flower.py

@@ -9,6 +9,10 @@ class FlowerService(BaseService):
     def __init__(self, **kwargs):
         super().__init__(**kwargs)
 
+    @property
+    def db_file(self):
+        return os.path.join(BASE_DIR, 'data', 'flower')
+
     @property
     def cmd(self):
         print("\n- Start Flower as Task Monitor")
@@ -19,11 +23,13 @@ class FlowerService(BaseService):
             'celery',
             '-A', 'ops',
             'flower',
-            '-l', 'INFO',
+            '-logging=info',
+            '-db={}'.format(self.db_file),
             '--url_prefix=/core/flower',
             '--auto_refresh=False',
             '--max_tasks=1000',
-            '--tasks_columns=uuid,name,args,state,received,started,runtime,worker'
+            '--persistent=True',
+            '--state_save_interval=600000'
         ]
         return cmd