Skip to content

Commit 0d8a076

Browse files
simonLeary42simonLeary42
committed
disband, reinstate PI groups
1 parent e26b74d commit 0d8a076

20 files changed

+676
-74
lines changed

‎LDAP.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ Terminology:
44
- **native user**: a user created by this account portal
55
- **non-native user**: inverse of native
66
- users created for administrative purposes should not be mixed with native users in the LDAP OUs given in `config.ini` or else this account portal may get confused
7+
- **disabled group**: a PI group that was disabled by its owner or had its owner disabled
8+
- memberuid attribute should be empty

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,14 @@ rm "$prod" && ln -s "$old" "$prod"
123123

124124
### Version-specific update instructions:
125125

126+
### 1.6 -> 1.7
127+
128+
- a new LDAP schema needs to be added:
129+
```shell
130+
scp tools/docker-dev/identity/unity-cluster-schema.ldif root@your-ldap-server:/root/unity-cluster-schema.ldif
131+
ssh root@your-ldap-server ldapadd -Y EXTERNAL -H ldapi:/// -f /root/unity-cluster-schema.ldif
132+
```
133+
126134
### 1.5 -> 1.6
127135

128136
- the `[site]getting_started_url` option should be defined

‎resources/lib/UnityGroup.php‎

Lines changed: 89 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public function __toString(): string
4040
public function requestGroup(?bool $send_mail_to_admins = null, bool $send_mail = true): void
4141
{
4242
$send_mail_to_admins ??= CONFIG["mail"]["send_pimesg_to_admins"];
43-
if ($this->exists()) {
43+
if ($this->exists() && !$this->getIsDisabled()) {
4444
return;
4545
}
4646
if ($this->SQL->accDeletionRequestExists($this->getOwner()->uid)) {
@@ -63,18 +63,64 @@ public function requestGroup(?bool $send_mail_to_admins = null, bool $send_mail
6363
}
6464
}
6565

66+
public function disable(bool $send_mail = true): void
67+
{
68+
$this->SQL->addLog("disable_pi_group", $this->gid);
69+
$memberuids = $this->getMemberUIDs();
70+
if ($send_mail) {
71+
$member_attributes = $this->LDAP->getUsersAttributes($memberuids, ["mail"]);
72+
$member_mails = array_map(fn($x) => $x["mail"][0], $member_attributes);
73+
$this->MAILER->sendMail($member_mails, "group_disabled", [
74+
"group_name" => $this->gid,
75+
]);
76+
}
77+
$this->setIsDisabled(true);
78+
if (count($memberuids) > 0) {
79+
$this->entry->setAttribute("memberuid", []);
80+
}
81+
// TODO optimmize
82+
// UnityUser::__construct() makes one LDAP query for each user
83+
// updateIsQualified() makes one LDAP query for each member
84+
// if user is no longer in any PI group, disqualify them
85+
// FIXME uncomment
86+
// foreach ($memberuids as $uid) {
87+
// $user = new UnityUser($uid, $this->LDAP, $this->SQL, $this->MAILER, $this->WEBHOOK);
88+
// $user->updateIsQualified($send_mail);
89+
// }
90+
}
91+
92+
private function reenable(bool $send_mail = true)
93+
{
94+
$this->SQL->addLog("reenabled_pi_group", $this->gid);
95+
if ($send_mail) {
96+
$this->MAILER->sendMail($this->getOwner()->getMail(), "group_reenabled", [
97+
"group_name" => $this->gid,
98+
]);
99+
}
100+
$this->setIsDisabled(false);
101+
$owner_uid = $this->getOwner()->uid;
102+
if (!$this->memberUIDExists($owner_uid)) {
103+
$this->addMemberUID($owner_uid);
104+
}
105+
// FIXME uncomment
106+
// $this->getOwner()->updateIsQualified($send_mail);
107+
}
108+
66109
/**
67110
* This method will create the group (this is what is executed when an admin approved the group)
68111
*/
69112
public function approveGroup(bool $send_mail = true): void
70113
{
71114
$uid = $this->getOwner()->uid;
72115
$request = $this->SQL->getRequest($uid, UnitySQL::REQUEST_BECOME_PI);
73-
if ($this->exists()) {
74-
return;
75-
}
76116
\ensure($this->getOwner()->exists());
77-
$this->init();
117+
if (!$this->entry->exists()) {
118+
$this->init();
119+
} elseif ($this->getIsDisabled()) {
120+
$this->reenable();
121+
} else {
122+
throw new Exception("cannot approve group that already exists and is not disabled");
123+
}
78124
$this->SQL->removeRequest($this->getOwner()->uid, UnitySQL::REQUEST_BECOME_PI);
79125
$this->SQL->addLog("approved_group", $this->getOwner()->uid);
80126
if ($send_mail) {
@@ -126,42 +172,6 @@ public function cancelGroupJoinRequest(UnityUser $user, bool $send_mail = true):
126172
}
127173
}
128174

129-
// /**
130-
// * This method will delete the group, either by admin action or PI action
131-
// */
132-
// public function removeGroup($send_mail = true)
133-
// {
134-
// // remove any pending requests
135-
// // this will silently fail if the request doesn't exist (which is what we want)
136-
// $this->SQL->removeRequests($this->gid);
137-
138-
// // we don't need to do anything extra if the group is already deleted
139-
// if (!$this->exists()) {
140-
// return;
141-
// }
142-
143-
// // first, we must record the users in the group currently
144-
// $users = $this->getGroupMembers();
145-
146-
// // now we delete the ldap entry
147-
// $this->entry->ensureExists();
148-
// $this->entry->delete();
149-
150-
// // Logs the change
151-
// $this->SQL->addLog("removed_group", $this->gid);
152-
153-
// // send email to every user of the now deleted PI group
154-
// if ($send_mail) {
155-
// foreach ($users as $user) {
156-
// $this->MAILER->sendMail(
157-
// $user->getMail(),
158-
// "group_disband",
159-
// array("group_name" => $this->gid)
160-
// );
161-
// }
162-
// }
163-
// }
164-
165175
/**
166176
* This method is executed when a user is approved to join the group
167177
* (either by admin or the group owner)
@@ -226,7 +236,7 @@ public function removeUser(UnityUser $new_user, bool $send_mail = true): void
226236
return;
227237
}
228238
if ($new_user->uid == $this->getOwner()->uid) {
229-
throw new Exception("Cannot delete group owner from group. Disband group instead");
239+
throw new Exception("Cannot delete group owner from group. Disable group instead");
230240
}
231241
$this->removeMemberUID($new_user->uid);
232242
$this->SQL->addLog(
@@ -328,7 +338,7 @@ private function init(): void
328338
\ensure(!$this->entry->exists());
329339
$nextGID = $this->LDAP->getNextPIGIDNumber();
330340
$this->entry->create([
331-
"objectclass" => UnityLDAP::POSIX_GROUP_CLASS,
341+
"objectclass" => ["unityClusterPIGroup", "posixGroup", "top"],
332342
"gidnumber" => strval($nextGID),
333343
"memberuid" => [$owner->uid],
334344
]);
@@ -383,4 +393,40 @@ public function getGroupMembersAttributes(array $attributes, array $default_valu
383393
$default_values,
384394
);
385395
}
396+
397+
public function getIsDisabled(): bool
398+
{
399+
$value = $this->entry->getAttribute("isDisabled");
400+
switch (count($value)) {
401+
case 0:
402+
return false;
403+
case 1:
404+
switch ($value[0]) {
405+
case "TRUE":
406+
return true;
407+
case "FALSE":
408+
return false;
409+
default:
410+
throw new \RuntimeException(
411+
sprintf(
412+
"unexpected value for isDisabled: '%s'. expected 'TRUE' or 'FALSE'",
413+
$value[0],
414+
),
415+
);
416+
}
417+
default:
418+
throw new \RuntimeException(
419+
sprintf(
420+
"expected value of length 0 or 1, found value %s of length %s",
421+
jsonEncode($value),
422+
count($value),
423+
),
424+
);
425+
}
426+
}
427+
428+
public function setIsDisabled(bool $new_value): void
429+
{
430+
$this->entry->setAttribute("isDisabled", $new_value ? "TRUE" : "FALSE");
431+
}
386432
}

‎resources/lib/UnityLDAP.php‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ class UnityLDAP extends LDAPConn
3030
"ldapPublicKey",
3131
];
3232

33-
public const array POSIX_GROUP_CLASS = ["posixGroup", "top"];
33+
// isDisabled unset or set to "FALSE"
34+
private static string $NON_DEFUNCT_FILTER = "(|(!(isDisabled=*))(isDisabled=FALSE))";
3435

3536
private string $custom_mappings_path =
3637
__DIR__ . "/../../" . CONFIG["ldap"]["custom_user_mappings_dir"];
@@ -182,7 +183,7 @@ public function getAllNativeUsersAttributes(
182183
);
183184
}
184185

185-
public function getAllPIGroups(
186+
public function getAllNonDisabledPIGroups(
186187
UnitySQL $UnitySQL,
187188
UnityMailer $UnityMailer,
188189
UnityWebhook $UnityWebhook,
@@ -191,6 +192,7 @@ public function getAllPIGroups(
191192
$pi_groups_attributes = $this->pi_groupOU->getChildrenArrayStrict(
192193
attributes: ["cn"],
193194
recursive: false,
195+
filter: self::$NON_DEFUNCT_FILTER,
194196
);
195197
foreach ($pi_groups_attributes as $attributes) {
196198
array_push(
@@ -201,33 +203,39 @@ public function getAllPIGroups(
201203
return $out;
202204
}
203205

204-
public function getAllPIGroupsAttributes(array $attributes, array $default_values = []): array
205-
{
206+
public function getAllNonDisabledPIGroupsAttributes(
207+
array $attributes,
208+
array $default_values = [],
209+
): array {
206210
return $this->pi_groupOU->getChildrenArrayStrict(
207211
$attributes,
208212
false, // non-recursive
209-
"objectClass=posixGroup",
213+
self::$NON_DEFUNCT_FILTER,
210214
$default_values,
211215
);
212216
}
213217

214-
public function getPIGroupGIDsWithMemberUID(string $uid): array
218+
public function getNonDisabledPIGroupGIDsWithMemberUID(string $uid): array
215219
{
216220
return array_map(
217221
fn($x) => $x["cn"][0],
218222
$this->pi_groupOU->getChildrenArrayStrict(
219223
["cn"],
220224
false,
221-
"(memberuid=" . ldap_escape($uid, "", LDAP_ESCAPE_FILTER) . ")",
225+
sprintf(
226+
"(&(memberuid=%s)%s)",
227+
ldap_escape($uid, "", LDAP_ESCAPE_FILTER),
228+
self::$NON_DEFUNCT_FILTER,
229+
),
222230
),
223231
);
224232
}
225233

226-
public function getAllPIGroupOwnerUIDs(): array
234+
public function getAllNonDisabledPIGroupOwnerUIDs(): array
227235
{
228236
return array_map(
229237
fn($x) => UnityGroup::GID2OwnerUID($x["cn"][0]),
230-
$this->pi_groupOU->getChildrenArrayStrict(["cn"]),
238+
$this->getAllNonDisabledPIGroupsAttributes(["cn"]),
231239
);
232240
}
233241

@@ -238,7 +246,7 @@ public function getUID2PIGIDs(): array
238246
{
239247
$uid2pigids = [];
240248
// for each PI group, append that GID to the member list for each of its member UIDs
241-
$pi_groups_attributes = $this->getAllPIGroupsAttributes(
249+
$pi_groups_attributes = $this->getAllNonDisabledPIGroupsAttributes(
242250
["cn", "memberuid"],
243251
default_values: ["memberuid" => []],
244252
);

‎resources/lib/UnityOrg.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public function init(): void
3737
\ensure(!$this->entry->exists());
3838
$nextGID = $this->LDAP->getNextOrgGIDNumber();
3939
$this->entry->create([
40-
"objectclass" => UnityLDAP::POSIX_GROUP_CLASS,
40+
"objectclass" => ["posixGroup", "top"],
4141
"gidnumber" => strval($nextGID),
4242
]);
4343
}

‎resources/lib/UnityUser.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public function init(
6060
$id = $this->LDAP->getNextUIDGIDNumber($this->uid);
6161
\ensure(!$ldapGroupEntry->exists());
6262
$ldapGroupEntry->create([
63-
"objectclass" => UnityLDAP::POSIX_GROUP_CLASS,
63+
"objectclass" => ["posixGroup", "top"],
6464
"gidnumber" => strval($id),
6565
]);
6666
\ensure(!$this->entry->exists());
@@ -344,7 +344,7 @@ public function getHomeDir(): string
344344
*/
345345
public function isPI(): bool
346346
{
347-
return $this->getPIGroup()->exists();
347+
return $this->getPIGroup()->exists() && !$this->getPIGroup()->getIsDisabled();
348348
}
349349

350350
public function getPIGroup(): UnityGroup
@@ -374,7 +374,7 @@ public function getOrgGroup(): UnityOrg
374374
*/
375375
public function getPIGroupGIDs(): array
376376
{
377-
return $this->LDAP->getPIGroupGIDsWithMemberUID($this->uid);
377+
return $this->LDAP->getNonDisabledPIGroupGIDsWithMemberUID($this->uid);
378378
}
379379

380380
/**

resources/mail/group_disband.php renamed to resources/mail/group_disabled.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
<?php
22

3-
// This template is sent to all users of a group when that group is disbanded (deleted)
4-
$this->Subject = "PI Group Disbanded"; ?>
3+
// This template is sent to all users of a group when that group is disabled
4+
$this->Subject = "PI Group Disabled"; ?>
55

66
<p>Hello,</p>
77

8-
<p>Your PI group, <?php echo $data["group_name"]; ?>, has been disbanded on the UnityHPC Platform.
8+
<p>Your PI group, <?php echo $data["group_name"]; ?>, has been disabled on the UnityHPC Platform.
99
Any jobs associated with this PI account have been killed.</p>
1010

1111
<p>If you believe this to be a mistake, please reply to this email</p>

‎resources/mail/group_reenabled.php‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?php
2+
3+
// This template is sent to the group owner when that group is re-enabled
4+
$this->Subject = "PI Group Re-Enabled"; ?>
5+
6+
<p>Hello,</p>
7+
8+
<p>
9+
Your PI group, <?php echo $data["group_name"]; ?>, has been reenabled on the UnityHPC Platform.
10+
</p>
11+
12+
<p>If you believe this to be a mistake, please reply to this email</p>

‎resources/mail/user_flag_removed.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<?php use UnityWebPortal\lib\UserFlag; ?>
22
<?php switch ($data["flag"]):
33
case UserFlag::QUALIFIED: ?>
4-
<?php $this->Subject = "User Deactivated"; ?>
4+
<?php $this->Subject = "User Disabled"; ?>
55
<p>Hello,</p>
6-
<p>Your account on the UnityHPC Platform has been deactivated.</p>
6+
<p>Your account on the UnityHPC Platform has been disabled.</p>
77
<p>If you believe this to be a mistake, please reply to this email as soon as possible.</p>
88
<?php break; ?>
99

‎test/functional/PIBecomeApproveTest.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,4 +74,27 @@ public function testApprovePI()
7474
ensurePIGroupDoesNotExist($pi_group->gid);
7575
}
7676
}
77+
78+
public function testReenableGroup()
79+
{
80+
global $USER, $SSO, $LDAP, $SQL, $MAILER, $WEBHOOK;
81+
$this->switchUser("ResurrectedOwnerOfDisabledPIGroup");
82+
$this->assertFalse($USER->isPI());
83+
$user = $USER;
84+
$pi_group = $USER->getPIGroup();
85+
$approve_uid = $USER->uid;
86+
try {
87+
$this->requestGroupCreation();
88+
$this->assertRequestedPIGroup(true);
89+
$this->switchUser("Admin");
90+
$this->approveGroup($approve_uid);
91+
$this->assertTrue($user->isPI());
92+
} finally {
93+
if ($pi_group->memberUIDExists($approve_uid)) {
94+
$pi_group->removeMemberUID($approve_uid);
95+
$pi_group->setIsDisabled(true);
96+
assert(!$user->isPI());
97+
}
98+
}
99+
}
77100
}

0 commit comments

Comments
 (0)