root/management/bs-admin/trunk/beaversource.py

# vim:set ts=4 sw=4 sts=4 expandtab:

import os, shutil, stat, sys, tempfile
import psycopg2, ConfigParser
from datetime import datetime
import trac.db_default as tracdefaultdata
import trac.db.postgres_backend as tracpg

class BeaverSourceModule(object):
    def run_command(self, cmd):
        #print self.__str__() + ": " + cmd
        pipe = os.popen(cmd)
        data = pipe.read()
        pipe.close()
        return data

    def backup_filename(self, filename):
        suffix = datetime.now().strftime('%Y%m%d-%H%M%S')
        return filename + '.' + suffix


class Project(BeaverSourceModule):
    basepath = '/data'
    repository_base = basepath + os.path.sep + 'svn'

    def __init__(self, name, description='', access='public', creation_date=None ):
        self.name = name
        self.description = description
        self.access = access
        self.creation_date = creation_date

        self.repository = Repository(self.repository_base + os.path.sep + name)

    def __str__(self):
        return self.name

    def save(self):
        pass

    def exists(self):
        if self.repository.exists():
            return True
        #if self.trac.exists():
        #    return True
        return False

class Repository(BeaverSourceModule):

    # variables and maps for hook management:
    hook_arg_map = {
            'post-commit' : {
                'hook_args' : { 'REPOS' : '$1', 'REV' : '$2' },
                'script_args' : '--repository "$REPOS" --revision "$REV"',
                },
            'post-lock' : {
                'hook_args' : { 'REPOS' : '$1', 'USER' : '$2' },
                'script_args' : '--repository "$REPOS" --user "$USER"',
                },
            'post-revprop-change' : {
                'hook_args' : { 'REPOS' : '$1', 'REV': '$2', 'USER' : '$3', 'PROPNAME' : '$4', 'ACTION' : '$5' },
                'script_args' : '--repository "$REPOS" --revision "$REV" --user "$USER" --propname "$PROPNAME" --action "$ACTION"',
                },
            'post-unlock' : {
                'hook_args' : { 'REPOS' : '$1', 'USER' : '$2' },
                'script_args' : '--repository "$REPOS" --user "$USER"',
                },
            'pre-commit' : {
                'hook_args' : { 'REPOS' : '$1', 'TXN' : '$2' },
                'script_args' : '--repository "$REPOS" --transaction "$TXN"',
                },
            'pre-lock' : {
                'hook_args' : { 'REPOS' : '$1', 'PATH' : '$2', 'USER' : '$3' },
                'script_args' : '--repository "$REPOS" --path "$PATH" --user "$USER"',
                },
            'pre-revprop-change' : {
                'hook_args' : { 'REPOS' : '$1', 'REV' : '$2', 'USER' : '$3', 'PROPNAME' : '$4', 'ACTION' : '$4' },
                'script_args' : '--repository "$REPOS" --revision "$REV" --user "$USER" --propname "$PROPNAME" --action "$ACTION"',
                },
            'pre-unlock' : {
                'hook_args' : { 'REPOS' : '$1', 'PATH' : '$2', 'USER' : '$3' },
                'script_args' : '--repository "$REPOS" --path "$PATH" --user "$USER"',
                },
            'start-commit' : {
                'hook_args' : { 'REPOS' : '$1', 'USER' : '$2' },
                'script_args' : '--repository "$REPOS" --user "$USER"',
                },
            }

    def __init__(self, path):
        self.path = path

    def exists(self):
        return os.path.exists(self.path)

    def create(self, debug=False):
        opts = ' --fs-type fsfs' # leading space!
        self.run_command("/usr/bin/svnadmin create " + self.path + opts)
        self.run_command('/bin/setfacl -R -m d:u:apache:rwX,u:apache:rwX,d:g:beaversource:rwX,g:beaversource:rwX %s' % self.path)

    def populate(self, datafile):
        if not self.exists():
            return False

        self.run_command("/usr/bin/svnadmin load %s < %s" % (self.path, datafile))

    def setup_hook(self, hook_name):
        # hooks dir must also exist
        hooks_dir = self.path + os.sep + 'hooks'
        if not os.path.exists(hooks_dir):
            return False

        hook_script = hooks_dir + os.sep + hook_name

        if not os.path.exists(hook_script):
            #shutil.copy(hook_script + '.tmpl', hook_script)
            script = [ '#!/bin/sh\n' ]
            for (key,val) in self.hook_arg_map[hook_name]['hook_args'].items():
                script.append("%s=%s\n" % (key, val))

            hook_script_file = open(hook_script, 'w')
            hook_script_file.writelines(script)
            hook_script_file.close()

        # check permissions on the hook script:
        if not os.access(hook_script, os.X_OK):
            os.chmod(hook_script, stat.S_IRWXU | stat.S_IRWXG | stat.S_IROTH | stat.S_IXOTH)

        return True

    def rename(self, newpath):
        if not self.exists():
            return False

        if os.path.exists(newpath):
            return False
        os.rename(self.path, newpath)
        if os.path.exists(newpath):
            self.path = newpath
            return True
        else:
            return False

    def add_hook(self, hook_name, script, extra_opts = None):
        hooks_dir = self.path + os.sep + 'hooks'
        hook_filename = hooks_dir + os.sep + hook_name

        if not self.exists():
            return False

        self.setup_hook(hook_name)
        # now append our new command to the hook script:

        if extra_opts:
            options = '%s %s' % (self.hook_arg_map[hook_name]['script_args'], extra_opts)
        else:
            options = self.hook_arg_map[hook_name]['script_args']

        hook_file = open(hook_filename, 'a')
        hook_file.writelines( '/usr/bin/python %s %s || exit 1\n' % ( script, options ) )
        hook_file.close()

class TracDB(BeaverSourceModule):

    privs = ['SELECT', 'UPDATE', 'INSERT', 'DELETE']
    sequences = [ 'report_id_seq', 'ticket_id_seq' ]
    views = ['attachment', 'component', 'enum', 'milestone', 'node_change',
            'permission', 'report', 'revision', 'session', 'session_attribute',
            'system', 'ticket', 'ticket_change', 'ticket_custom', 'version',
            'wiki']
    tables = [ 'master_' + view for view in views ]
    # it's really a table, but everything must be difficult:
    views.append('auth_cookie')

    def __init__(self, host, db, admin, admin_pass, project_user, project_pass):
        self.host = host
        self.db = db
        self.admin = admin
        self.admin_pw = admin_pass
        self.project_user = project_user
        self.project_pass = project_pass
        self.connection = None

    def connect(self):
        if self.connection and not self.connection.closed:
            return self.connection
        self.connection = psycopg2.connect("host='%s' dbname='%s' user='%s' password='%s'" \
                % ( self.host, self.db, self.admin, self.admin_pw ) )
        return self.connection

    def exists(self):
        # @todo some postgres trickery here
        cur = self.connect().cursor()
        cur.execute("SELECT rolname FROM pg_roles WHERE rolname = '%s'" % self.project_user)
        if cur.rowcount:
            return True
        else:
            return False

    def create(self):
        if self.exists():
            return False

        # cannot create users inside a transaction,
        # so set isolation to 0 and then restore it when done
        conn = self.connect()
        old_isolation_level = conn.isolation_level
        conn.set_isolation_level(0)
        cur = conn.cursor()
        create_role_stmt = "CREATE ROLE %s IN ROLE bsc_users LOGIN PASSWORD '%s'" % ( self.project_user, self.project_pass)
        cur.execute(create_role_stmt)

        #grants
        priv_str = ', '.join(self.privs)
        for view in self.views:
            view_grant_stmt = "GRANT %s ON %s to %s" % (priv_str, view, self.project_user)
            cur.execute(view_grant_stmt)
        for seq in self.sequences:
            seq_grant_stmt = "GRANT %s ON %s to %s" % (priv_str, seq, self.project_user)
            cur.execute(seq_grant_stmt)

        conn.set_isolation_level(old_isolation_level)
        return self.exists()

    def destroy(self):
        if not self.exists():
            return False

        conn = self.connect()
        old_isolation_level = conn.isolation_level
        conn.set_isolation_level(0)
        cur = conn.cursor()

        # clean up data:
        for table in self.tables:
            data_delete_stmt = "DELETE FROM %s WHERE dbuser = '%s'" % (table, self.project_user)
            #print >> sys.stdder, data_delete_stmt + "\n"; sys.stderr.flush()
            cur.execute(data_delete_stmt)

        revoke_all_stmt = "REVOKE ALL ON DATABASE %s FROM %s CASCADE" % (self.db, self.project_user)
        cur.execute(revoke_all_stmt)

        for view in self.views:
            view_revoke_stmt = "REVOKE ALL ON TABLE %s FROM %s" % (view, self.project_user)
            cur.execute(view_revoke_stmt)

        for seq in self.sequences:
            seq_revoke_stmt = "REVOKE ALL ON TABLE %s FROM %s" % (seq, self.project_user)
            cur.execute(seq_revoke_stmt)

        drop_role_stmt = "DROP ROLE %s" % self.project_user
        cur.execute(drop_role_stmt)
        conn.set_isolation_level(old_isolation_level)
        return not self.exists()

    def rename(self, newname, newpass=None):
        if not self.exists():
            return 0
        # how to rename:
        # have to juggle self.project_user a bit
        olduser = self.project_user
        oldpass = self.project_pass
        if newpass:
            oldpass = self.project_pass
        else:
            newpass = self.project_pass

        conn = self.connect()
        old_isolation_level = conn.isolation_level
        conn.set_isolation_level(0)
        cur = conn.cursor()

        # first create a role
        self.project_user = newname
        self.project_pass = newpass
        self.create()

        # then update all the tables
        for table in self.tables:
            data_update_stmt = "UPDATE %s SET dbuser = '%s' WHERE dbuser = '%s'" % (table, self.project_user, olduser)
            cur.execute(data_update_stmt)

        # then remove the old
        self.project_user = olduser
        self.project_pass = oldpass
        self.destroy()

        # and juggle back to new info:
        self.project_user = newname
        self.project_pass = newpass

class TracInstall(BeaverSourceModule):
    def __init__(self, name, path, repository, visibility='A', license='Other', licensefile=''):
        self.name = name
        self.path = path
        self.repository = repository
        self.visibility=visibility
        self.license = license
        self.licensefile = licensefile

        self.config_filename = self.path + os.sep + 'conf' + os.sep + 'trac.ini'

        if self.exists():
            self.read_config()

    def exists(self):
        return os.path.exists(self.path)

    def create(self):
        if self.exists():
            return False

        self.run_command("/usr/bin/trac-admin %s initenv '%s' %s %s %s %s"
                % ( self.path, self.name, 'sqlite:db/trac.db', 'svn', self.repository.path, '/usr/share/trac/templates') )
        if self.exists():
            self.run_command('/bin/setfacl -R -m d:u:apache:rwX,u:apache:rwX,d:g:beaversource:rwX,g:beaversource:rwX %s' % self.path)
            self.read_config()
            return True

    def write_config(self, backup=True):
        if not self.exists():
            return False

        if not self.config:
            return False

        if backup:
            shutil.copy(self.config_filename, self.backup_filename(self.config_filename))

        conf = open(self.config_filename, 'w')
        self.config.write( conf )
        conf.close()

    def read_config(self):
        if not self.exists():
            return False


        if not os.path.exists(self.config_filename):
            return False

        self.config = ConfigParser.ConfigParser()
        self.config.read(self.config_filename)

    # ripped from Trac's env.py file:
    def init_db(self, database, db_user, db_pass, db_host):

        # create a new connection using trac's libraries
        # so we can 'seamlessly' populate the initial data
        db = tracpg.PostgreSQLConnection(database, db_user, db_pass, db_host)
        cursor = db.cnx.cursor()
        for table, cols, vals in tracdefaultdata.get_data(db):
            cursor.executemany("INSERT INTO %s (%s) VALUES (%s)" %
                    (table, ','.join(cols), ','.join(['%s' for c in cols])), vals)
            db.cnx.commit()

    def populate_wiki(self, wikidir):
        if not self.exists():
            return False

        return self.run_command('/usr/bin/trac-admin %s wiki load %s' % (self.path, wikidir) )

    def add_plugin(self, pluginfile):
        if not self.exists():
            return False

        if not os.path.exists(pluginfile):
            return False

        shutil.copy(pluginfile, self.path + os.sep + 'plugins')

    def add_user(self, username, permission = 'TRAC_ADMIN'):
        if not self.exists():
            return False

        return self.run_command('/usr/bin/trac-admin %s permission add %s %s' % (self.path, username, permission))

    def rename(self, newname, options):
        newpath = options.trac_base_path + os.sep + newname
        if os.path.exists(newpath):
            return False

        os.rename(self.path, newpath)
        if os.path.exists(newpath):
            self.path = newpath
            self.config_filename = self.path + os.sep + 'conf' + os.sep + 'trac.ini'
            return True
        else:
            return False


    def postprocess(self):
        """Postprocess makes modifications to the newly created trac instance to put it in line with the visibility and license options selected on the request form.
        It basically just makes calls to trac-admin, doing what an admin could easily also do on the command line.  Three things are taken care of in this method:
        1) Permissions are adjusted to match visibility.
        2) The text of the selected license are added to the wiki under the page name 'License'.
        3) A custom copy of the WikiStart (main) page is created that adds the project name, description, svn info, and link to the 'License' page.
        Note: This doesn't do any of the visibility or license stuff related to SVN, that is handled through the cron job (visibility via an authz file) and through use of the --svn_initial_data parameter which will add the license to the svn as its initial data.
        """
        view_permission_list = ('BROWSER_VIEW', 'CHANGESET_VIEW', 'CONFIG_VIEW', 'FILE_VIEW', 'LOG_VIEW', 'MILESTONE_VIEW', 'REPORT_SQL_VIEW', 'REPORT_VIEW', 'ROADMAP_VIEW', 'SEARCH_VIEW', 'TICKET_APPEND', 'TICKET_CREATE', 'TICKET_VIEW', 'TICKET_MODIFY', 'TIMELINE_VIEW', 'WIKI_CREATE', 'WIKI_MODIFY', 'WIKI_VIEW')
        edit_permission_list = ('TICKET_APPEND', 'TICKET_CREATE', 'TICKET_MODIFY', 'WIKI_CREATE', 'WIKI_MODIFY')
        #other_permissions = ('MILESTONE_ADMIN', 'MILESTONE_CREATE', 'MILESTONE_DELETE', 'MILESTONE_MODIFY', 'REPORT_ADMIN', 'REPORT_CREATE', 'REPORT_DELETE', 'REPORT_MODIFY',  'ROADMAP_ADMIN', 'TICKET_ADMIN', 'TICKET_CHGPROP', 'TRAC_ADMIN', 'WIKI_ADMIN', 'WIKI_DELETE')

        ### set trac visibility permissions using trac-admin, svn permissions will be autogenerated at the next cron
        #Publicly visible projects start with all view and edit permissions, we want to restrict that to prevent spam, removing all the view permissions
        if(self.visibility=='A'):
            for permission in edit_permission_list:
                self.run_command('/usr/bin/trac-admin %s permission remove anonymous %s' % (self.path, permission))
                #since authenticated inherits anonymous,we have to give it the permissions we take from anonymous
                self.run_command('/usr/bin/trac-admin %s permission add authenticated %s' % (self.path, permission))

        #OSU/VPN visible projects require a person to login to see or edit anything
        if(self.visibility=='O'):
            for permission in view_permission_list:
                self.run_command('/usr/bin/trac-admin %s permission remove anonymous %s' % (self.path, permission))
                #since authenticated inherits anonymous,we have to give it the permissions we take from anonymous
                self.run_command('/usr/bin/trac-admin %s permission add authenticated %s' % (self.path, permission))

        #Members-only remove all permissions and only the TRAC_ADMINs will be able to see or edit the project
        if(self.visibility=='M'):
            for permission in view_permission_list:
                self.run_command('/usr/bin/trac-admin %s permission remove anonymous %s' % (self.path, permission))


        #add license to wiki using trac-admin wiki import License [file] 
        license_file = "/data/master-trac/initial-data/" + self.licensefile
        self.run_command('/usr/bin/trac-admin %s wiki import License %s ' % (self.path, license_file + ".wiki"))

        ###overwrite main wikipage
        #produce the new wikipage
        fd, filename = tempfile.mkstemp(suffix='.wiki')
        f = os.fdopen(fd, 'wb')

        f.write("""
= Welcome to """ + self.config.get('project', 'name') + """ =

""" + self.config.get('project', 'descr') + """

This project is licensed under the [wiki:License """ + self.license + """]


To checkout the SVN tree for this project, use the following command:

{{{
svn co --username <onid username> https://code.oregonstate.edu/svn/"""+ self.name +"""
}}}
SVN will them prompt you for your ONID password.  other useful SVN commands are:

{{{
svn up
}}}
to update your local copy

{{{
svn ci
}}}
to checkin new changes


Enjoy! [[BR]]
''The """ + self.name + """ Team''

== Starting Points ==

 * TracGuide --  Built-in Documentation
 * [http://trac.edgewall.org/ The Trac project] -- Trac Open Source Project
 * [http://trac.edgewall.org/wiki/TracFaq Trac FAQ] -- Frequently Asked Questions
 * TracSupport --  Trac Support

For a complete list of local wiki pages, see TitleIndex.

        """)
        f.close()
        #call trac-admin to replace the old wikipage
        self.run_command('/usr/bin/trac-admin %s wiki remove WikiStart' % (self.path))
        self.run_command('/usr/bin/trac-admin %s wiki import WikiStart %s ' % (self.path, filename))
        os.remove(filename)