-
-
Notifications
You must be signed in to change notification settings - Fork 988
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
311 changed files
with
5,998 additions
and
20,484 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,35 +1,14 @@ | ||
| """admin signals""" | ||
|
|
||
| from django.dispatch import receiver | ||
| from packaging.version import parse | ||
| from prometheus_client import Gauge | ||
|
|
||
| from authentik import get_full_version | ||
| from authentik.admin.apps import GAUGE_WORKERS | ||
| from authentik.root.celery import CELERY_APP | ||
| from authentik.root.monitoring import monitoring_set | ||
|
|
||
| GAUGE_WORKERS = Gauge( | ||
| "authentik_admin_workers", | ||
| "Currently connected workers, their versions and if they are the same version as authentik", | ||
| ["version", "version_matched"], | ||
| ) | ||
|
|
||
|
|
||
| _version = parse(get_full_version()) | ||
|
|
||
|
|
||
| @receiver(monitoring_set) | ||
| def monitoring_set_workers(sender, **kwargs): | ||
| """Set worker gauge""" | ||
| raw: list[dict[str, dict]] = CELERY_APP.control.ping(timeout=0.5) | ||
| worker_version_count = {} | ||
| for worker in raw: | ||
| key = list(worker.keys())[0] | ||
| version = worker[key].get("version") | ||
| version_matching = False | ||
| if version: | ||
| version_matching = parse(version) == _version | ||
| worker_version_count.setdefault(version, {"count": 0, "matching": version_matching}) | ||
| worker_version_count[version]["count"] += 1 | ||
| for version, stats in worker_version_count.items(): | ||
| GAUGE_WORKERS.labels(version, stats["matching"]).set(stats["count"]) | ||
| count = len(CELERY_APP.control.ping(timeout=0.5)) | ||
| GAUGE_WORKERS.set(count) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| """API Authorization""" | ||
|
|
||
| from django.conf import settings | ||
| from django.db.models import Model | ||
| from django.db.models.query import QuerySet | ||
| from django_filters.rest_framework import DjangoFilterBackend | ||
| from rest_framework.authentication import get_authorization_header | ||
| from rest_framework.filters import BaseFilterBackend | ||
| from rest_framework.permissions import BasePermission | ||
| from rest_framework.request import Request | ||
|
|
||
| from authentik.api.authentication import validate_auth | ||
| from authentik.rbac.filters import ObjectFilter | ||
|
|
||
|
|
||
| class OwnerFilter(BaseFilterBackend): | ||
| """Filter objects by their owner""" | ||
|
|
||
| owner_key = "user" | ||
|
|
||
| def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet: | ||
| if request.user.is_superuser: | ||
| return queryset | ||
| return queryset.filter(**{self.owner_key: request.user}) | ||
|
|
||
|
|
||
| class SecretKeyFilter(DjangoFilterBackend): | ||
| """Allow access to all objects when authenticated with secret key as token. | ||
| Replaces both DjangoFilterBackend and ObjectFilter""" | ||
|
|
||
| def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet: | ||
| auth_header = get_authorization_header(request) | ||
| token = validate_auth(auth_header) | ||
| if token and token == settings.SECRET_KEY: | ||
| return queryset | ||
| queryset = ObjectFilter().filter_queryset(request, queryset, view) | ||
| return super().filter_queryset(request, queryset, view) | ||
|
|
||
|
|
||
| class OwnerPermissions(BasePermission): | ||
| """Authorize requests by an object's owner matching the requesting user""" | ||
|
|
||
| owner_key = "user" | ||
|
|
||
| def has_permission(self, request: Request, view) -> bool: | ||
| """If the user is authenticated, we allow all requests here. For listing, the | ||
| object-level permissions are done by the filter backend""" | ||
| return request.user.is_authenticated | ||
|
|
||
| def has_object_permission(self, request: Request, view, obj: Model) -> bool: | ||
| """Check if the object's owner matches the currently logged in user""" | ||
| if not hasattr(obj, self.owner_key): | ||
| return False | ||
| owner = getattr(obj, self.owner_key) | ||
| if owner != request.user: | ||
| return False | ||
| return True | ||
|
|
||
|
|
||
| class OwnerSuperuserPermissions(OwnerPermissions): | ||
| """Similar to OwnerPermissions, except always allow access for superusers""" | ||
|
|
||
| def has_object_permission(self, request: Request, view, obj: Model) -> bool: | ||
| if request.user.is_superuser: | ||
| return True | ||
| return super().has_object_permission(request, view, obj) |
Oops, something went wrong.