<commit_before>"""Add a generic admin policy for all admin read actions

Revision ID: <KEY>
Revises: 849170064430
Create Date: 2019-07-04 22:37:53.594962

"""

# revision identifiers, used by Alembic.
revision = '<KEY>'
down_revision = '849170064430'

from alembic import op
import sqlalchemy as sa

from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy import orm
from sqlalchemy.schema import Sequence
from privacyidea.lib.policy import SCOPE, ACTION

Base = declarative_base()

# dashes are not allowed, when creating policies in the WebUI
# or via the library. So we are sure, that in normal operation
# this policy can never be created.
POLICYNAME = u"pi-update-policy-3d7f8b29cbb1"


class Policy(Base):
    """
    The policy table contains policy definitions which control
    the behaviour during
     * enrollment
     * authentication
     * authorization
     * administration
     * user actions
    """
    __tablename__ = "policy"
    __table_args__ = {'mysql_row_format': 'DYNAMIC'}
    id = sa.Column(sa.Integer, Sequence("policy_seq"), primary_key=True)
    active = sa.Column(sa.Boolean, default=True)
    check_all_resolvers = sa.Column(sa.Boolean, default=False)
    name = sa.Column(sa.Unicode(64), unique=True, nullable=False)
    scope = sa.Column(sa.Unicode(32), nullable=False)
    action = sa.Column(sa.Unicode(2000), default=u"")
    realm = sa.Column(sa.Unicode(256), default=u"")
    adminrealm = sa.Column(sa.Unicode(256), default=u"")
    resolver = sa.Column(sa.Unicode(256), default=u"")
    user = sa.Column(sa.Unicode(256), default=u"")
    client = sa.Column(sa.Unicode(256), default=u"")
    time = sa.Column(sa.Unicode(64), default=u"")
    # If there are multiple matching policies, choose the one
    # with the lowest priority number. We choose 1 to be the default priotity.
    priority = sa.Column(sa.Integer, default=1, nullable=False)


def upgrade():
    """
    During upgrade we check, if admin policies exist.
    If so, we add a generic policy for all admins, that allows to
    read all configuration, which mimicks the previous behaviour
    :return:
    """
    actions = u",".join([ACTION.PERIODICTASKREAD, ACTION.MACHINERESOLVERREAD,
                         ACTION.PRIVACYIDEASERVERREAD, ACTION.RADIUSSERVERREAD,
                         ACTION.SMTPSERVERREAD, ACTION.EVENTHANDLINGREAD,
                         ACTION.POLICYREAD, ACTION.RESOLVERREAD,
                         ACTION.CACONNECTORREAD, ACTION.SMSGATEWAYREAD,
                         ACTION.STATISTICSREAD, ACTION.SYSTEMREAD])

    bind = op.get_bind()
    session = orm.Session(bind=bind)
    if session.query(Policy).filter(Policy.scope == u"{0!s}".format(SCOPE.ADMIN),
                                    Policy.active.is_(True)).all():

        # add policy
        tokenlist_pol = Policy(name=POLICYNAME, scope=u"{0!s}".format(SCOPE.ADMIN),
                               action=actions)
        session.add(tokenlist_pol)
        print("Added '{0!s}' action for admin policies.".format(actions))
    else:
        print("No admin policy active. No need to create '{0!s}' action.".format(actions))

    session.commit()


def downgrade():
    # Delete the policy, if it still exists
    bind = op.get_bind()
    session = orm.Session(bind=bind)
    session.query(Policy).filter(Policy.name == u"{0!s}".format(POLICYNAME)).delete()
    session.commit()
<commit_msg>Linearize migration scripts<commit_after>"""Add a generic admin policy for all admin read actions

Revision ID: 3d7f8b29cbb1
Revises: dceb6cd3c41e
Create Date: 2019-07-04 22:37:53.594962

"""

# revision identifiers, used by Alembic.
revision = '<KEY>'
down_revision = '<KEY>'

from alembic import op
import sqlalchemy as sa

from sqlalchemy.ext.declarative import declarative_base
from sqlalchemy import orm
from sqlalchemy.schema import Sequence
from privacyidea.lib.policy import SCOPE, ACTION

Base = declarative_base()

# dashes are not allowed, when creating policies in the WebUI
# or via the library. So we are sure, that in normal operation
# this policy can never be created.
POLICYNAME = u"pi-update-policy-3d7f8b29cbb1"


class Policy(Base):
    """
    The policy table contains policy definitions which control
    the behaviour during
     * enrollment
     * authentication
     * authorization
     * administration
     * user actions
    """
    __tablename__ = "policy"
    __table_args__ = {'mysql_row_format': 'DYNAMIC'}
    id = sa.Column(sa.Integer, Sequence("policy_seq"), primary_key=True)
    active = sa.Column(sa.Boolean, default=True)
    check_all_resolvers = sa.Column(sa.Boolean, default=False)
    name = sa.Column(sa.Unicode(64), unique=True, nullable=False)
    scope = sa.Column(sa.Unicode(32), nullable=False)
    action = sa.Column(sa.Unicode(2000), default=u"")
    realm = sa.Column(sa.Unicode(256), default=u"")
    adminrealm = sa.Column(sa.Unicode(256), default=u"")
    resolver = sa.Column(sa.Unicode(256), default=u"")
    user = sa.Column(sa.Unicode(256), default=u"")
    client = sa.Column(sa.Unicode(256), default=u"")
    time = sa.Column(sa.Unicode(64), default=u"")
    # If there are multiple matching policies, choose the one
    # with the lowest priority number. We choose 1 to be the default priotity.
    priority = sa.Column(sa.Integer, default=1, nullable=False)


def upgrade():
    """
    During upgrade we check, if admin policies exist.
    If so, we add a generic policy for all admins, that allows to
    read all configuration, which mimicks the previous behaviour
    :return:
    """
    actions = u",".join([ACTION.PERIODICTASKREAD, ACTION.MACHINERESOLVERREAD,
                         ACTION.PRIVACYIDEASERVERREAD, ACTION.RADIUSSERVERREAD,
                         ACTION.SMTPSERVERREAD, ACTION.EVENTHANDLINGREAD,
                         ACTION.POLICYREAD, ACTION.RESOLVERREAD,
                         ACTION.CACONNECTORREAD, ACTION.SMSGATEWAYREAD,
                         ACTION.STATISTICSREAD, ACTION.SYSTEMREAD])

    bind = op.get_bind()
    session = orm.Session(bind=bind)
    if session.query(Policy).filter(Policy.scope == u"{0!s}".format(SCOPE.ADMIN),
                                    Policy.active.is_(True)).all():

        # add policy
        tokenlist_pol = Policy(name=POLICYNAME, scope=u"{0!s}".format(SCOPE.ADMIN),
                               action=actions)
        session.add(tokenlist_pol)
        print("Added '{0!s}' action for admin policies.".format(actions))
    else:
        print("No admin policy active. No need to create '{0!s}' action.".format(actions))

    session.commit()


def downgrade():
    # Delete the policy, if it still exists
    bind = op.get_bind()
    session = orm.Session(bind=bind)
    session.query(Policy).filter(Policy.name == u"{0!s}".format(POLICYNAME)).delete()
    session.commit()

{'fraction_non_alphanumeric': 0.1132903981264637, 'fraction_numerical': 0.021955503512880562, 'mean_word_length': 3.1588557516737676, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5611985', 'n_tokens_mistral': 2211, 'n_tokens_neox': 2100, 'n_words': 536}