26/09/23 - 19h

master
cherif 2023-09-26 19:08:51 +02:00
parent a3ca58f209
commit 5b80750454
5 changed files with 5981 additions and 12 deletions

View File

@ -1,10 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="ChangeListManager">
<list default="true" id="c6d0259a-16e1-410d-91a1-830590ee2a08" name="Changes" comment="25/09/2023 - 12h40">
<list default="true" id="c6d0259a-16e1-410d-91a1-830590ee2a08" name="Changes" comment="25/09/2023 - 16h40">
<change afterPath="$PROJECT_DIR$/user_access_right.py" afterDir="false" />
<change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
<change beforePath="$PROJECT_DIR$/Log/log_file.log" beforeDir="false" afterPath="$PROJECT_DIR$/Log/log_file.log" afterDir="false" />
<change beforePath="$PROJECT_DIR$/partner_order.py" beforeDir="false" afterPath="$PROJECT_DIR$/partner_order.py" afterDir="false" />
<change beforePath="$PROJECT_DIR$/main.py" beforeDir="false" afterPath="$PROJECT_DIR$/main.py" afterDir="false" />
<change beforePath="$PROJECT_DIR$/prj_common.py" beforeDir="false" afterPath="$PROJECT_DIR$/prj_common.py" afterDir="false" />
</list>
<option name="SHOW_DIALOG" value="false" />
<option name="HIGHLIGHT_CONFLICTS" value="true" />
@ -68,13 +70,6 @@
<option name="presentableId" value="Default" />
<updated>1680804787304</updated>
</task>
<task id="LOCAL-00062" summary="09/08/2023 - 21h">
<created>1691607124367</created>
<option name="number" value="00062" />
<option name="presentableId" value="LOCAL-00062" />
<option name="project" value="LOCAL" />
<updated>1691607124367</updated>
</task>
<task id="LOCAL-00063" summary="10/08/23 - 16h">
<created>1691675826292</created>
<option name="number" value="00063" />
@ -411,7 +406,14 @@
<option name="project" value="LOCAL" />
<updated>1695638525925</updated>
</task>
<option name="localTasksCounter" value="111" />
<task id="LOCAL-00111" summary="25/09/2023 - 16h40">
<created>1695652896870</created>
<option name="number" value="00111" />
<option name="presentableId" value="LOCAL-00111" />
<option name="project" value="LOCAL" />
<updated>1695652896870</updated>
</task>
<option name="localTasksCounter" value="112" />
<servers />
</component>
<component name="Vcs.Log.Tabs.Properties">
@ -426,7 +428,6 @@
</option>
</component>
<component name="VcsManagerConfiguration">
<MESSAGE value="27/08/23 - 22h" />
<MESSAGE value="28/08/23 - 13h30" />
<MESSAGE value="28/08/23 - 20h30" />
<MESSAGE value="28/08/23 - 19h30" />
@ -451,6 +452,7 @@
<MESSAGE value="22/09/2023 - 12h53" />
<MESSAGE value="22/09/2023 - 18h53" />
<MESSAGE value="25/09/2023 - 12h40" />
<option name="LAST_COMMIT_MESSAGE" value="25/09/2023 - 12h40" />
<MESSAGE value="25/09/2023 - 16h40" />
<option name="LAST_COMMIT_MESSAGE" value="25/09/2023 - 16h40" />
</component>
</project>

File diff suppressed because it is too large Load Diff

55
main.py
View File

@ -52,6 +52,7 @@ import ressources_humaines as ressources_humaines
import ressources_materiels as ressources_materiels
import partner_order as partner_order
import partner_document_mgt as partner_document_mgt
import user_access_right as user_access_right
app = Flask(__name__)
cors = CORS(app, resources={r"/foo": {"origins": "*"}})
@ -4699,6 +4700,60 @@ def Get_List_Default_Partner_Document():
return jsonify(status=status, message=retval)
"""
API qui permet de recuperer la liste des modules de
l'application sous forme de matrice de droits d'acces
"""
@app.route('/myclass/api/Get_Matrix_Acces_Right/', methods=['POST','GET'])
@crossdomain(origin='*')
def Get_Matrix_Acces_Right():
# On recupere le corps (payload) de la requete
payload = mycommon.strip_dictionary (request.form.to_dict())
print(" ### Get_Matrix_Acces_Right payload = ",payload)
status, retval = user_access_right.Get_Matrix_Acces_Right(payload)
return jsonify(status=status, message=retval)
"""
API qui permet de recuperer la liste des modules de
l'application sous forme de matrice de droits d'acces, ce pour un profile donne
"""
@app.route('/myclass/api/Get_Matrix_Acces_Right_By_Profil/', methods=['POST','GET'])
@crossdomain(origin='*')
def Get_Matrix_Acces_Right_By_Profil():
# On recupere le corps (payload) de la requete
payload = mycommon.strip_dictionary (request.form.to_dict())
print(" ### Get_Matrix_Acces_Right_By_Profil payload = ",payload)
status, retval = user_access_right.Get_Matrix_Acces_Right_By_Profil(payload)
return jsonify(status=status, message=retval)
"""
Ajout et mise à jour des droits d'acces d'un user (ressource_humaine_id)
"""
@app.route('/myclass/api/Add_Update_User_Access_Right/', methods=['POST','GET'])
@crossdomain(origin='*')
def Add_Update_User_Access_Right():
# On recupere le corps (payload) de la requete
payload = mycommon.strip_dictionary (request.form.to_dict())
print(" ### Add_Update_User_Access_Right payload = ",payload)
status, retval = user_access_right.Add_Update_User_Access_Right(payload)
return jsonify(status=status, message=retval)
"""
Gestion des droits d'acces par user, module et action
"""
@app.route('/myclass/api/Is_User_Has_Right_To_Action/', methods=['POST','GET'])
@crossdomain(origin='*')
def Is_User_Has_Right_To_Action():
# On recupere le corps (payload) de la requete
payload = mycommon.strip_dictionary (request.form.to_dict())
print(" ### Is_User_Has_Right_To_Action payload = ",payload)
status, retval = mycommon.Is_User_Has_Right_To_Action(payload)
return jsonify(status=status, message=retval)
if __name__ == '__main__':

View File

@ -3414,6 +3414,7 @@ def isEmailValide(email):
Cette fonction verifie la validé d'un token et retour :
- Une erreur de connexion ou
- Si tout est ok, le partner associé à ce token
"""
def Check_Connexion_And_Return_Partner_Data(diction):
try:
@ -3466,3 +3467,86 @@ def Clean_For_SQL(sentence):
myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - ERRORRRR AT Line : " + str(exc_tb.tb_lineno))
return ""
"""
Pour controler les acces utilisateur par module,
Cette fonction prends l'
- user_id (id de la collection ressource_humaine
- module_name
- action (read ou write)
et retourne True ou False selon que le user a droit de faire l'action.
La collection de travail est : user_access_right
"""
def Is_User_Has_Right_To_Action(diction):
try:
diction = strip_dictionary(diction)
"""
Verification des input acceptés
"""
field_list = ['token', 'module_name', 'action']
incom_keys = diction.keys()
for val in incom_keys:
if val not in field_list:
myprint(str(
inspect.stack()[0][3]) + " Le champ '" + val + "' n'est pas autorisé")
return False, " Les informations fournies sont incorrectes",
"""
Verification des champs obligatoires
"""
field_list_obligatoire = ['token', 'module_name', 'action']
for val in field_list_obligatoire:
if val not in diction:
myprint(
str(inspect.stack()[0][3]) + " - La valeur '" + val + "' n'est pas presente dans liste ")
return False, " Les informations fournies sont incorrectes",
"""
Verification de l'identité et autorisation de l'entité qui
appelle cette API
"""
token = ""
if ("token" in diction.keys()):
if diction['token']:
token = diction['token']
local_status, my_partner = Check_Connexion_And_Return_Partner_Data(diction)
if (local_status is not True):
return local_status, my_partner
token = ""
if ("action" in diction.keys()):
if ( str(diction['action']).lower().strip() not in ['read', 'write'] ):
myprint(
str(inspect.stack()[0][3]) + " - L'action '" + str(diction['action']).lower().strip() + "' n'est pas valide ")
return False, " Droit d'accès incorrect",
qry_access_right = {}
if( str(diction['action']).lower().strip() == "read" ):
qry_access_right = {'partner_owner_recid':str(my_partner['recid']), 'module':str(diction['module_name']),
'user_id':str(my_partner['ressource_humaine_id']), 'read':True}
elif (str(diction['action']).lower().strip() == "write"):
qry_access_right = {'partner_owner_recid': str(my_partner['recid']), 'module': str(diction['module_name']),
'user_id': str(my_partner['ressource_humaine_id']), 'write': True}
print(" ##### qry_access_right = ", qry_access_right)
is_acces_right_ok = MYSY_GV.dbname['user_access_right'].count_documents(qry_access_right)
if( is_acces_right_ok != 1):
return False, " Droits d'acces insuffisants"
return True, " OK"
except Exception as e:
exc_type, exc_obj, exc_tb = sys.exc_info()
myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno))
return False, " Impossible de verifier les droits d'acces de l'utilisateur "

344
user_access_right.py Normal file
View File

@ -0,0 +1,344 @@
"""
Ce fichier permet de gerer les droits d'acces des utilisateur au systeme
"""
import pymongo
from pymongo import MongoClient
import json
from bson import ObjectId
import re
from datetime import datetime
import prj_common as mycommon
import secrets
import inspect
import sys, os
import csv
import pandas as pd
from pymongo import ReturnDocument
import GlobalVariable as MYSY_GV
from math import isnan
import GlobalVariable as MYSY_GV
import ela_index_bdd_classes as eibdd
import email_mgt as email
import ast
"""
Ajouter & mise jour des acces d'un user
Cette fonction prend :
- token
- user_id (collection employee_id)
- tab_access ==> Tableau des droit d'acces
==> [{module_name: 'val', 'read':val, 'write':val}, {module_name: 'val', 'read':val, 'write':val}, ...]
"""
def Add_Update_User_Access_Right(diction):
try:
diction = mycommon.strip_dictionary(diction)
"""
Verification des input acceptés
"""
field_list = ['token', 'user_id', 'tab_access']
incom_keys = diction.keys()
for val in incom_keys:
if val not in field_list:
mycommon.myprint(str(
inspect.stack()[0][3]) + " Le champ '" + val + "' n'est pas autorisé")
return False, " Les informations fournies sont incorrectes",
"""
Verification des champs obligatoires
"""
field_list_obligatoire = ['token', 'user_id', 'tab_access' ]
for val in field_list_obligatoire:
if val not in diction:
mycommon.myprint(
str(inspect.stack()[0][3]) + " - La valeur '" + val + "' n'est pas presente dans liste ")
return False, " Les informations fournies sont incorrectes",
"""
Verification de l'identité et autorisation de l'entité qui
appelle cette API
"""
token = ""
if ("token" in diction.keys()):
if diction['token']:
token = diction['token']
local_status, my_partner = mycommon.Check_Connexion_And_Return_Partner_Data(diction)
if (local_status is not True):
return local_status, my_partner
# Verification de la validide du user_id
is_user_existe_count = MYSY_GV.dbname['ressource_humaine'].count_documents({'_id':ObjectId(str(diction['user_id'])),
'partner_recid':str(my_partner['recid']),
'valide':'1',
'locked':'0'})
if( is_user_existe_count <= 0 ):
mycommon.myprint(
str(inspect.stack()[0][3]) + " - L'utilisateur est invalide ")
return False, " L'utilisateur est invalide ",
if( is_user_existe_count > 1 ):
mycommon.myprint(
str(inspect.stack()[0][3]) + " - L'identifiant utilisateur correspond à plusieurs personnes")
return False, "L'identifiant utilisateur correspond à plusieurs personnes ",
tab_access_data = diction['tab_access']
tab_access_data = str(tab_access_data).replace("false", '"false"').replace("true", '"true"')
tab_access_data = str(tab_access_data).replace('""false""', '"false"').replace('""true""', '"true"')
tab_access = ast.literal_eval(tab_access_data)
# Process de verification des infos d'acces
for module_access in tab_access:
if( "module_name" in module_access.keys() and "read" in module_access.keys() and "write" in module_access.keys() ):
if( str(module_access['read']).lower().strip() not in ['true', 'false'] or str(module_access['write']).lower().strip() not in ['true', 'false']):
mycommon.myprint(
str(inspect.stack()[0][3]) + " - La matrice des droits est incorrecte (2) - Les champs 'read' et 'write' ne sont pas boolean")
return False, "La matrice des droits est incorrecte (2).Les champs 'read' et 'write' ne sont pas boolean",
if( MYSY_GV.dbname['application_modules'].count_documents({'module_name':module_access['module_name']}) != 1 ):
mycommon.myprint( str(inspect.stack()[0][3]) + " - Module "+str(module_access['module_name'])+" metier inconnue ")
return False, "Module "+str(module_access['module_name'])+" metier inconnue ",
else:
mycommon.myprint(
str(inspect.stack()[0][3]) + " - La matrice des droits est incorrecte")
return False, "La matrice des droits est incorrecte ",
#print(" ## ACCESS DATA ==> Mise à jour ", module_access)
# Process de mise à jour
for module_access in tab_access:
my_data = {}
my_data['locked'] = '0'
my_data['valide'] = '1'
my_data['date_update'] = str(datetime.now())
my_data['module'] = module_access['module_name']
if( str(module_access['read']).lower().strip() == "true"):
my_data['read'] = True
else:
my_data['read'] = False
if (str(module_access['write']).lower().strip() == "true"):
my_data['write'] = True
else:
my_data['write'] = False
my_data['partner_owner_recid'] = str(my_partner['recid'])
my_data['user_id'] = str(diction['user_id'])
result = MYSY_GV.dbname['user_access_right'].find_one_and_update(
{'module_name':module_access['module_name'], 'user_id':str(diction['user_id'])},
{"$set": my_data},
upsert=True,
return_document=ReturnDocument.AFTER
)
if (result is None or "_id" not in result.keys()):
mycommon.myprint(
" Impossible mettre à jour les droits d'acces du user_id" + str(diction['user_id']))
return False, " Impossible mettre à jour les droits d'acces "
return True, " Les droits d'accès ont été correctement mis à jour"
except Exception as e:
exc_type, exc_obj, exc_tb = sys.exc_info()
mycommon.myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno))
return False, " Impossible d'ajouter la ressource "
"""
Recuperation de la matrice de droit d'un user (ressource_humaine_id)
"""
def Get_Matrix_Acces_Right(diction):
try:
diction = mycommon.strip_dictionary(diction)
"""
Verification des input acceptés
"""
field_list = ['token', 'user_id']
incom_keys = diction.keys()
for val in incom_keys:
if val not in field_list:
mycommon.myprint(str(
inspect.stack()[0][3]) + " Le champ '" + val + "' n'est pas autorisé")
return False, " Les informations fournies sont incorrectes",
"""
Verification des champs obligatoires
"""
field_list_obligatoire = ['token', 'user_id' ]
for val in field_list_obligatoire:
if val not in diction:
mycommon.myprint(
str(inspect.stack()[0][3]) + " - La valeur '" + val + "' n'est pas presente dans liste ")
return False, " Les informations fournies sont incorrectes",
"""
Verification de l'identité et autorisation de l'entité qui
appelle cette API
"""
token = ""
if ("token" in diction.keys()):
if diction['token']:
token = diction['token']
local_status, my_partner = mycommon.Check_Connexion_And_Return_Partner_Data(diction)
if (local_status is not True):
return local_status, my_partner
RetObject = []
val_tmp = 1
for retval in MYSY_GV.dbname['application_modules'].find({'valide':'1', 'locked':'0'}):
user = retval
user['id'] = str(val_tmp)
user['read'] = False
user['write'] = False
# Pour le module en question, on va aller recuperer les eventuels droits de l'utilisateur
user_acces_right_qry = {'valide':'1', 'locked':'0', 'user_id':str(diction['user_id']),
'partner_owner_recid':str(my_partner['recid']),
'module':str(retval['module_name'])}
#print(" ### user_acces_right_qry = ", user_acces_right_qry)
user_acces_right = MYSY_GV.dbname['user_access_right'].find_one(user_acces_right_qry)
if( user_acces_right is not None ):
if( 'read' in user_acces_right.keys()):
user['read'] = user_acces_right['read']
else:
user['read'] = False
if ('write' in user_acces_right.keys()):
user['write'] = user_acces_right['write']
else:
user['write'] = False
#print(" ### user_acces_right - user = ", user)
val_tmp = val_tmp + 1
RetObject.append(mycommon.JSONEncoder().encode(user))
return True, RetObject
except Exception as e:
exc_type, exc_obj, exc_tb = sys.exc_info()
mycommon.myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno))
return False, " Impossible de récupérer la matrice des droits "
"""
Recuperation de la matrice des acces associé à un profil utilisateur (ex : enseignant, directeur, etc
"""
def Get_Matrix_Acces_Right_By_Profil(diction):
try:
diction = mycommon.strip_dictionary(diction)
"""
Verification des input acceptés
"""
field_list = ['token', 'profile_name']
incom_keys = diction.keys()
for val in incom_keys:
if val not in field_list:
mycommon.myprint(str(
inspect.stack()[0][3]) + " Le champ '" + val + "' n'est pas autorisé")
return False, " Les informations fournies sont incorrectes",
"""
Verification des champs obligatoires
"""
field_list_obligatoire = ['token', 'profile_name']
for val in field_list_obligatoire:
if val not in diction:
mycommon.myprint(
str(inspect.stack()[0][3]) + " - La valeur '" + val + "' n'est pas presente dans liste ")
return False, " Les informations fournies sont incorrectes",
"""
Verification de l'identité et autorisation de l'entité qui
appelle cette API
"""
token = ""
if ("token" in diction.keys()):
if diction['token']:
token = diction['token']
local_status, my_partner = mycommon.Check_Connexion_And_Return_Partner_Data(diction)
if (local_status is not True):
return local_status, my_partner
RetObject = []
val_tmp = 1
for retval in MYSY_GV.dbname['application_modules'].find({'valide': '1', 'locked': '0'}):
user = retval
user['id'] = str(val_tmp)
user['read'] = False
user['write'] = False
# Pour le module en question, on va aller recuperer les eventuels droits de l'utilisateur
user_acces_right_qry = {'valide': '1', 'locked': '0', 'profile_name': str(diction['profile_name']),
'partner_owner_recid': str(my_partner['recid']),
'module': str(retval['module_name'])}
# print(" ### user_acces_right_qry = ", user_acces_right_qry)
user_acces_right = MYSY_GV.dbname['user_access_right'].find_one(user_acces_right_qry)
if (user_acces_right is not None):
if ('read' in user_acces_right.keys()):
user['read'] = user_acces_right['read']
else:
user['read'] = False
if ('write' in user_acces_right.keys()):
user['write'] = user_acces_right['write']
else:
user['write'] = False
# print(" ### user_acces_right - user = ", user)
val_tmp = val_tmp + 1
RetObject.append(mycommon.JSONEncoder().encode(user))
print(" RetObject = ", RetObject)
return True, RetObject
except Exception as e:
exc_type, exc_obj, exc_tb = sys.exc_info()
mycommon.myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno))
return False, " Impossible de récupérer la matrice des droits "