Radicale: server, auth and rights integration

install/requirements.txt

@@ -49,3 +49,4 @@ git+https://github.com/algoo/tgapp-resetpassword.git@master
 lxml
 python-ldap-test==0.2.0
 who-ldap==3.1.0
+unicode-slugify==0.1.3

tracim/setup.py

@@ -41,6 +41,7 @@ install_requires=[
     "repoze.who",
     "who-ldap==3.1.0",
     "python-ldap-test==0.2.0",
+    "unicode-slugify==0.1.3",
     ]
 
 setup(

tracim/tracim/config/app_cfg.py

@@ -202,6 +202,14 @@ class CFG(object):
             # ContentType.Folder -- Folder is skipped
         ]
 
+        self.RADICALE_SERVER_HOST = '0.0.0.0'
+        self.RADICALE_SERVER_PORT = 5232
+        self.RADICALE_SERVER_SSL = False
+
+        self.RADICALE_CLIENT_HOST = None  # If None, current host will be used
+        self.RADICALE_CLIENT_PORT = 5232
+        self.RADICALE_CLIENT_SSL = False
+
 
     def get_tracker_js_content(self, js_tracker_file_path = None):
         js_tracker_file_path = tg.config.get('js_tracker_path', None)

tracim/tracim/config/middleware.py

@@ -3,7 +3,8 @@
 
 from tracim.config.app_cfg import base_config
 from tracim.config.environment import load_environment
-
+from tracim.lib.daemons import DaemonsManager
+from tracim.lib.daemons import RadicaleDaemon
 
 __all__ = ['make_app']
 
@@ -35,5 +36,7 @@ def make_app(global_conf, full_stack=True, **app_conf):
     app = make_base_app(global_conf, full_stack=True, **app_conf)
     
     # Wrap your base TurboGears 2 application with custom middleware here
-    
+    daemons = DaemonsManager(app)
+    daemons.run(RadicaleDaemon.name, RadicaleDaemon)
+
     return app

tracim/tracim/controllers/admin/workspace.py

@@ -212,13 +212,14 @@ class WorkspaceRestController(TIMRestController, BaseController):
         return DictLikeClass(result = dictified_workspace)
 
     @tg.expose('tracim.templates.workspace.edit')
-    def put(self, id, name, description):
+    def put(self, id, name, description, calendar_enabled):
         user = tmpl_context.current_user
         workspace_api_controller = WorkspaceApi(user)
 
         workspace = workspace_api_controller.get_one(id)
         workspace.label = name
         workspace.description = description
+        workspace.calendar_enabled = calendar_enabled
         workspace_api_controller.save(workspace)
 
         tg.flash(_('{} workspace updated.').format(workspace.label), CST.STATUS_OK)

tracim/tracim/lib/calendar.py

@@ -0,0 +1,90 @@
+import re
+
+from tracim.lib.exceptions import UnknownCalendarType
+from tracim.lib.exceptions import NotFound
+from tracim.lib.user import UserApi
+from tracim.lib.workspace import WorkspaceApi
+from tracim.model import User
+from tracim.model.organizational import Calendar
+from tracim.model.organizational import UserCalendar
+from tracim.model.organizational import WorkspaceCalendar
+
+CALENDAR_USER_PATH_RE = 'user\/([0-9]+)--([a-z-]*).ics'
+CALENDAR_WORKSPACE_PATH_RE = 'workspace\/([0-9]+)--([a-z0-9-]*).ics'
+
+CALENDAR_TYPE_USER = 'USER'
+CALENDAR_TYPE_WORKSPACE = 'WORKSPACE'
+
+
+class CalendarManager(object):
+    def __init__(self, user: User):
+        self._user = user
+
+    def get_type_for_path(self, path: str) -> str:
+        """
+        Return calendar type for given path. Raise
+        tracim.lib.exceptions.UnknownCalendarType if unknown type.
+        :param path: path representation like user/42--foo.ics
+        :return: Type of calendar, can be one of CALENDAR_TYPE_USER,
+        CALENDAR_TYPE_WORKSPACE
+        """
+        if re.match(CALENDAR_USER_PATH_RE, path):
+            return CALENDAR_TYPE_USER
+
+        if re.match(CALENDAR_WORKSPACE_PATH_RE, path):
+            return CALENDAR_TYPE_WORKSPACE
+
+        raise UnknownCalendarType(
+            'No match for calendar path "{0}"'.format(path)
+        )
+
+    def get_id_for_path(self, path: str, type: str) -> int:
+        """
+        Return related calendar id for given path. Raise
+        tracim.lib.exceptions.UnknownCalendarType if unknown type.
+        :param path: path representation like user/42--foo.ics
+        :param type: Type of calendar, can be one of CALENDAR_TYPE_USER,
+        CALENDAR_TYPE_WORKSPACE
+        :return: ID of related calendar object. For UserCalendar it will be
+        user id, for WorkspaceCalendar it will be Workspace id.
+        """
+        if type == CALENDAR_TYPE_USER:
+            return re.search(CALENDAR_USER_PATH_RE, path).group(1)
+        elif type == CALENDAR_TYPE_WORKSPACE:
+            return re.search(CALENDAR_WORKSPACE_PATH_RE, path).group(1)
+        raise UnknownCalendarType('Type "{0}" is not implemented'.format(type))
+
+    def find_calendar_with_path(self, path: str) -> Calendar:
+        """
+        Return calendar for given path. Raise tracim.lib.exceptions.NotFound if
+        calendar cannot be found.
+        :param path: path representation like user/42--foo.ics
+        :return: Calendar corresponding to path
+        """
+        try:
+            type = self.get_type_for_path(path)
+            id = self.get_id_for_path(path, type)
+        except UnknownCalendarType as exc:
+            raise NotFound(str(exc))
+
+        return self.get_calendar(type, id, path)
+
+    def get_calendar(self, type: str, id: str, path: str) -> Calendar:
+        """
+        Return tracim.model.organizational.Calendar instance for given
+        parameters.
+        :param type: Type of calendar, can be one of CALENDAR_TYPE_USER,
+        CALENDAR_TYPE_WORKSPACE
+        :param id: related calendar object id
+        :param path: path representation like user/42--foo.ics
+        :return: a calendar.
+        """
+        if type == CALENDAR_TYPE_USER:
+            user = UserApi(self._user).get_one_by_id(id)
+            return UserCalendar(user, path=path)
+
+        if type == CALENDAR_TYPE_WORKSPACE:
+            workspace = WorkspaceApi(self._user).get_one(id)
+            return WorkspaceCalendar(workspace, path=path)
+
+        raise UnknownCalendarType('Type "{0}" is not implemented'.format(type))

tracim/tracim/lib/daemons.py

@@ -0,0 +1,104 @@
+import threading
+from wsgiref.simple_server import make_server
+
+import signal
+from radicale import Application as RadicaleApplication
+from radicale import HTTPServer as RadicaleHTTPServer
+from radicale import HTTPSServer as RadicaleHTTPSServer
+from radicale import RequestHandler as RadicaleRequestHandler
+from radicale import config as radicale_config
+from tg import TGApp
+
+from tracim.lib.exceptions import AlreadyRunningDaemon
+
+
+class DaemonsManager(object):
+    def __init__(self, app: TGApp):
+        self._app = app
+        self._daemons = {}
+
+    def run(self, name: str, daemon_class: object, **kwargs) -> None:
+        """
+        Start a daemon with given daemon class.
+        :param name: Name of runned daemon. It's not possible to start two
+        daemon with same name. In the opposite case, raise
+        tracim.lib.exceptions.AlreadyRunningDaemon
+        :param daemon_class: Daemon class to use for daemon instance.
+        :param kwargs: Other kwargs will be given to daemon class
+        instantiation.
+        """
+        if name in self._daemons:
+            raise AlreadyRunningDaemon(
+                'Daemon with name "{0}" already running'.format(name)
+            )
+
+        kwargs['app'] = self._app
+        shutdown_program = threading.Event()
+        # SIGTERM and SIGINT (aka KeyboardInterrupt) should just mark this for
+        # shutdown
+        signal.signal(signal.SIGTERM, lambda *_: shutdown_program.set())
+        signal.signal(signal.SIGINT, lambda *_: shutdown_program.set())
+
+        try:
+            threading.Thread(target=daemon_class.start, kwargs=kwargs).start()
+            self._daemons[name] = daemon_class
+        finally:
+            shutdown_program.set()
+
+
+class Daemon(object):
+    _name = NotImplemented
+
+    def __init__(self, app: TGApp):
+        self._app = app
+
+    @classmethod
+    def start(cls, **kwargs):
+        return cls(**kwargs)
+
+    @classmethod
+    def kill(cls):
+        raise NotImplementedError()
+
+    @property
+    def name(self):
+        return self._name
+
+
+class RadicaleDaemon(Daemon):
+    _name = 'tracim-radicale-server'
+
+    @classmethod
+    def kill(cls):
+        pass  # TODO
+
+    def __init__(self, app: TGApp):
+        """
+        To see origin radical server start method, refer to
+        radicale.__main__.run
+        """
+        super().__init__(app)
+        self._prepare_config()
+        server = self._get_server()
+        server.serve_forever()
+
+    def _prepare_config(self):
+        tracim_auth = 'tracim.lib.radicale.auth'
+        tracim_rights = 'tracim.lib.radicale.rights'
+
+        radicale_config.set('auth', 'type', 'custom')
+        radicale_config.set('auth', 'custom_handler', tracim_auth)
+
+        radicale_config.set('rights', 'type', 'custom')
+        radicale_config.set('rights', 'custom_handler', tracim_rights)
+
+    def _get_server(self):
+        from tracim.config.app_cfg import CFG
+        cfg = CFG.get_instance()
+        return make_server(
+            cfg.RADICALE_SERVER_HOST,
+            cfg.RADICALE_SERVER_PORT,
+            RadicaleApplication(),
+            RadicaleHTTPServer if cfg.RADICALE_SERVER_SSL else RadicaleHTTPSServer,
+            RadicaleRequestHandler
+        )

tracim/tracim/lib/exceptions.py

@@ -0,0 +1,22 @@
+class TracimException(Exception):
+    pass
+
+
+class DaemonException(TracimException):
+    pass
+
+
+class AlreadyRunningDaemon(DaemonException):
+    pass
+
+
+class CalendarException(TracimException):
+    pass
+
+
+class UnknownCalendarType(CalendarException):
+    pass
+
+
+class NotFound(TracimException):
+    pass

tracim/tracim/lib/helpers.py

@@ -6,6 +6,7 @@
 
 import datetime
 
+import slugify
 from babel.dates import format_date, format_time
 from markupsafe import Markup
 
@@ -216,3 +217,7 @@ def is_user_externalized_field(field_name):
     if not tg.config.get('auth_instance').is_internal:
         return field_name in tg.config.get('auth_instance').managed_fields
     return False
+
+
+def slug(string):
+    return slugify.slugify(string, only_ascii=True)

tracim/tracim/lib/radicale/auth.py

@@ -0,0 +1,13 @@
+from tg import config
+
+
+def is_authenticated(user, password):
+    """
+    :param user: user email
+    :param password: user password
+    :return: True if auth success, False if not
+    """
+    return bool(config.get('sa_auth').authmetadata.authenticate({}, {
+        'login': user,
+        'password': password
+    }))

tracim/tracim/lib/radicale/rights.py

@@ -0,0 +1,25 @@
+from tracim.lib.calendar import CalendarManager
+from tracim.lib.exceptions import NotFound
+from tracim.lib.user import UserApi
+from tracim.model.organizational import CALENDAR_PERMISSION_READ
+
+
+def authorized(user, collection, permission):
+    """
+    :param user: radicale given user id, should be email
+    :param collection: Calendar representation
+    :param permission: 'r' or 'w'
+    :return: True if user can access calendar with asked permission
+    """
+    if not user:
+        return False
+    current_user = UserApi(None).get_one_by_email(user)
+    manager = CalendarManager(current_user)
+    try:
+        calendar = manager.find_calendar_with_path(collection.path)
+    except NotFound:
+        return False
+
+    if permission == CALENDAR_PERMISSION_READ:
+        return calendar.user_can_read(current_user)
+    return calendar.user_can_write(current_user)

tracim/tracim/lib/radicale/storage.py

@@ -0,0 +1,6 @@
+from radicale.storage.filesystem import Collection as BaseCollection
+
+
+class Collection(BaseCollection):
+    def __init__(self, path, principal=False):
+        super().__init__(path, principal)

tracim/tracim/lib/user.py

@@ -27,6 +27,9 @@ class UserApi(object):
     def get_one_by_email(self, email: str):
         return self._base_query().filter(User.email==email).one()
 
+    def get_one_by_id(self, id: int) -> User:
+        return self._base_query().filter(User.user_id==id).one()
+
     def update(self, user: User, name: str=None, email: str=None, do_save=True):
         if name is not None:
             user.display_name = name

tracim/tracim/lib/utils.py

@@ -41,3 +41,8 @@ def replace_reset_password_templates(engines):
         pass
     except KeyError:
         pass
+
+
+@property
+def NotImplemented():
+    raise NotImplementedError()

tracim/tracim/model/auth.py

@@ -11,6 +11,7 @@ though.
 import os
 from datetime import datetime
 from hashlib import sha256
+from slugify import slugify
 from sqlalchemy.ext.hybrid import hybrid_property
 from tg.i18n import lazy_ugettext as l_
 
@@ -26,6 +27,8 @@ from sqlalchemy.types import Integer
 from sqlalchemy.types import DateTime
 from sqlalchemy.types import Boolean
 from sqlalchemy.orm import relation, relationship, synonym
+from tg import request
+from tg import config
 
 from tracim.model import DeclarativeBase, metadata, DBSession
 
@@ -147,6 +150,21 @@ class User(DeclarativeBase):
             profile_id = max(group.group_id for group in self.groups)
         return Profile(profile_id)
 
+    @property
+    def calendar_url(self) -> str:
+        # TODO - 20160531 - Bastien: Cyclic import if import in top of file
+        from tracim.config.app_cfg import CFG
+        cfg = CFG.get_instance()
+        return '{proto}://{domain}:{port}/user/{id}--{slug_name}.ics'.format(
+            proto='https' if cfg.RADICALE_CLIENT_SSL else 'http',
+            domain=cfg.RADICALE_CLIENT_HOST or request.domain,
+            port=cfg.RADICALE_CLIENT_PORT,
+            id=self.user_id,
+            slug_name=slugify(self.get_display_name(
+                remove_email_part=True
+            ), only_ascii=True)
+        )
+
     @classmethod
     def by_email_address(cls, email):
         """Return the user object whose email address is ``email``."""
@@ -206,10 +224,18 @@ class User(DeclarativeBase):
         hash.update((password + self.password[:64]).encode('utf-8'))
         return self.password[64:] == hash.hexdigest()
 
-    def get_display_name(self):
+    def get_display_name(self, remove_email_part=False):
+        """
+        :param remove_email_part: If True and display name based on email,
+         remove @xxx.xxx part of email in returned value
+        :return: display name based on user name or email.
+        """
         if self.display_name!=None and self.display_name!='':
             return self.display_name
         else:
+            if remove_email_part:
+                at_pos = self.email.index('@')
+                return self.email[0:at_pos]
             return self.email
 
     def get_role(self, workspace: 'Workspace') -> int:

tracim/tracim/model/data.py

@@ -7,10 +7,10 @@ from datetime import datetime
 import tg
 from babel.dates import format_timedelta
 from bs4 import BeautifulSoup
+from slugify import slugify
 from sqlalchemy import Column, inspect, Index
 from sqlalchemy import ForeignKey
 from sqlalchemy import Sequence
-from sqlalchemy import func
 from sqlalchemy.ext.associationproxy import association_proxy
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import backref
@@ -51,6 +51,7 @@ class Workspace(DeclarativeBase):
 
     label   = Column(Unicode(1024), unique=False, nullable=False, default='')
     description = Column(Text(), unique=False, nullable=False, default='')
+    calendar_enabled = Column(Boolean, unique=False, nullable=False, default=False)
 
     #  Default value datetime.utcnow, see: http://stackoverflow.com/a/13370382/801924 (or http://pastebin.com/VLyWktUn)
     created = Column(DateTime, unique=False, nullable=False, default=datetime.utcnow)
@@ -66,6 +67,19 @@ class Workspace(DeclarativeBase):
         # Return a list of unique revisions parent content
         return list(set([revision.node for revision in self.revisions]))
 
+    @property
+    def calendar_url(self) -> str:
+        # TODO - 20160531 - Bastien: Cyclic import if import in top of file
+        from tracim.config.app_cfg import CFG
+        cfg = CFG.get_instance()
+        return '{proto}://{domain}:{port}/workspace/{id}--{slug}.ics'.format(
+            proto='https' if cfg.RADICALE_CLIENT_SSL else 'http',
+            domain=cfg.RADICALE_CLIENT_HOST or tg.request.domain,
+            port=cfg.RADICALE_CLIENT_PORT,
+            id=self.workspace_id,
+            slug=slugify(self.label)
+        )
+
     def get_user_role(self, user: User) -> int:
         for role in user.roles:
             if role.workspace.workspace_id==self.workspace_id:

tracim/tracim/model/organizational.py

@@ -0,0 +1,49 @@
+from tracim.model import User
+from tracim.model.data import UserRoleInWorkspace
+
+
+CALENDAR_PERMISSION_READ = 'r'
+CALENDAR_PERMISSION_WRITE = 'w'
+
+
+class Calendar(object):
+    def __init__(self, related_object, path):
+        self._related_object = related_object
+        self._path = path
+
+    def user_can_read(self, user: User) -> bool:
+        raise NotImplementedError()
+
+    def user_can_write(self, user: User) -> bool:
+        raise NotImplementedError()
+
+
+class UserCalendar(Calendar):
+    def user_can_write(self, user: User) -> bool:
+        return self._related_object.user_id == user.user_id
+
+    def user_can_read(self, user: User) -> bool:
+        return self._related_object.user_id == user.user_id
+
+
+class WorkspaceCalendar(Calendar):
+    _workspace_rights = {
+        UserRoleInWorkspace.NOT_APPLICABLE:
+            [],
+        UserRoleInWorkspace.READER:
+            [CALENDAR_PERMISSION_READ],
+        UserRoleInWorkspace.CONTRIBUTOR:
+            [CALENDAR_PERMISSION_READ, CALENDAR_PERMISSION_WRITE],
+        UserRoleInWorkspace.CONTENT_MANAGER:
+            [CALENDAR_PERMISSION_READ, CALENDAR_PERMISSION_WRITE],
+        UserRoleInWorkspace.WORKSPACE_MANAGER:
+            [CALENDAR_PERMISSION_READ, CALENDAR_PERMISSION_WRITE],
+    }
+
+    def user_can_write(self, user: User) -> bool:
+        role = user.get_role(self._related_object)
+        return CALENDAR_PERMISSION_WRITE in self._workspace_rights[role]
+
+    def user_can_read(self, user: User) -> bool:
+        role = user.get_role(self._related_object)
+        return CALENDAR_PERMISSION_READ in self._workspace_rights[role]

tracim/tracim/model/serializers.py

@@ -876,6 +876,7 @@ def serialize_user_for_user(user: User, context: Context):
     result['roles'] = context.toDict(user.roles)
     result['enabled'] = user.is_active
     result['profile'] = user.profile
+    result['calendar_url'] = user.calendar_url
 
     return result
 
@@ -979,6 +980,8 @@ def serialize_workspace_complete(workspace: pmd.Workspace, context: Context):
     result['members'] = context.toDict(workspace.roles)
     result['member_nb'] = len(workspace.roles)
     result['allowed_content_types'] = context.toDict(workspace.get_allowed_content_types())
+    result['calendar_enabled'] = workspace.calendar_enabled
+    result['calendar_url'] = workspace.calendar_url
 
     return result
 

tracim/tracim/templates/user_workspace_forms.mak

@@ -110,6 +110,11 @@
                 % endif
                 <input name="email" type="text" class="form-control" id="email" placeholder="${_('Name')}" value="${user.email}" ${'readonly="readonly"' if h.is_user_externalized_field('email') else '' | n}>
             </div>
+            <div class="form-group">
+                <label for="calendar">${_('Personal calendar')}</label>
+                <span class="info readonly">${_('This calendar URL will work with CalDav compatibles clients')}</span>
+                <input id="calendar" type="text" class="form-control"  disabled="disabled" value="${user.calendar_url}" />
+            </div>
         </div>
         <div class="modal-footer">
             <span class="pull-right t-modal-form-submit-button">

tracim/tracim/templates/workspace/edit.mak

@@ -17,6 +17,14 @@
             <label for="workspaceDescription">${_('Description')}</label>
             <textarea name="description" class="form-control" id="workspaceDescription" placeholder="${_('You may add a description of the workspace')}">${result.workspace.description}</textarea>
         </div>
+        <div class="form-group">
+            <label for="workspaceCalendarEnabled">${_('Calendar enabled')}</label>
+            <input id="workspaceCalendarEnabled" name="calendar_enabled" class="form-control" type="checkbox" ${'checked' if result.workspace.calendar_enabled else ''} />
+        </div>
+        <div class="form-group calendar-url">
+            <label for="workspaceCalendarUrl">${_('Calendar URL')}</label>
+            <input id="workspaceCalendarUrl" type="text" class="form-control"  disabled="disabled" value="${result.workspace.calendar_url}" />
+        </div>
     </div>
     <div class="modal-footer">
         <span class="pull-right" style="margin-top: 0.5em;">

tracim/tracim/templates/workspace/getone.mak

@@ -59,6 +59,11 @@
         % else:
             <p class="t-less-visible">${_('No description available')}</p>
         % endif
+        % if result.workspace.calendar_enabled:
+            <p>
+                ${_('Calendar URL')}: ${result.workspace.calendar_url}
+            </p>
+        % endif
 
         <% member_nb = len(result.workspace.members) %>
         % if member_nb<=0: