feat(passport): add change user confirm

duanhongyi · duanhongyi · commit 2aa12d4842fd · 2021-12-16T10:04:57.000+08:00
diff --git a/charts/passport/templates/_helpers.tpl b/charts/passport/templates/_helpers.tpl
@@ -13,6 +13,7 @@ rbac.authorization.k8s.io/v1
 
 {{/* Generate passport deployment envs */}}
 {{- define "passport.envs" }}
+{{ $redisNodeCount := .Values.redis.replicas | int }}
 env:
 - name: "TZ"
   value: {{ .Values.time_zone | default "UTC" | quote }}
@@ -22,6 +23,11 @@ env:
 {{- else }}
   value: http://drycc.{{ .Values.global.platform_domain }}
 {{- end }}
+- name: DRYCC_SECRET_KEY
+  valueFrom:
+    secretKeyRef:
+      name: passport-creds
+      key: django-secret-key
 - name: SOCIAL_AUTH_DRYCC_CONTROLLER_KEY
   valueFrom:
     secretKeyRef:
@@ -87,6 +93,21 @@ env:
 - name: DRYCC_DATABASE_URL
   value: "postgres://$(DRYCC_DATABASE_USER):$(DRYCC_DATABASE_PASSWORD)@$(DRYCC_DATABASE_SERVICE_HOST):$(DRYCC_DATABASE_SERVICE_PORT)/$(DRYCC_DATABASE_NAME)"
 {{- end }}
+{{- if eq .Values.global.redis_location "on-cluster"}}
+- name: DRYCC_REDIS_ADDRS
+  value: "{{range $i := until $redisNodeCount}}drycc-redis-{{$i}}.drycc-redis.{{$.Release.Namespace}}.svc.{{$.Values.global.cluster_domain}}:6379{{if lt (add 1 $i) $redisNodeCount}},{{end}}{{end}}"
+{{- else if eq .Values.global.redis_location "off-cluster" }}
+- name: DRYCC_REDIS_ADDRS
+  valueFrom:
+    secretKeyRef:
+      name: redis-creds
+      key: addrs
+{{- end }}
+- name: DRYCC_REDIS_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: redis-creds
+      key: password
 {{- range $key, $value := .Values.environment }}
 - name: {{ $key }}
   value: {{ $value | quote }}
diff --git a/rootfs/Dockerfile b/rootfs/Dockerfile
@@ -19,6 +19,7 @@ RUN apk add --update --virtual .build-deps \
     openssl-dev \
     cargo \
     rust \
+  && ln /usr/lib/libldap.so /usr/lib/libldap_r.so \
   && python3 -m venv /app/.venv \
   && source /app/.venv/bin/activate \
   && pip3 install --disable-pip-version-check --no-cache-dir -r /app/requirements.txt \
diff --git a/rootfs/Dockerfile.test b/rootfs/Dockerfile.test
@@ -17,6 +17,7 @@ RUN echo https://dl-cdn.alpinelinux.org/alpine/edge/testing >>/etc/apk/repositor
     openssl-dev \
     cargo \
     rust \
+  && ln /usr/lib/libldap.so /usr/lib/libldap_r.so \
   && python3 -m venv /app/.venv \
   && source /app/.venv/bin/activate \
   && pip3 install --disable-pip-version-check --no-cache-dir -r /app/requirements.txt \
diff --git a/rootfs/api/serializers.py b/rootfs/api/serializers.py
@@ -3,15 +3,13 @@
 """
 import logging
 
-from django.conf import settings
 from django.contrib.admin.models import LogEntry
 from django.contrib.auth.forms import UserCreationForm
 from django.contrib.auth.models import User
 from oauth2_provider.models import Grant, AccessToken
 from oauth2_provider.oauth2_validators import OAuth2Validator
 from rest_framework import serializers
 
-from api.exceptions import DryccException
 from api.utils import timestamp2datetime
 
 logger = logging.getLogger(__name__)
@@ -24,28 +22,12 @@ class Meta(UserCreationForm.Meta):
 
 
 class UserSerializer(serializers.ModelSerializer):
-    username = serializers.CharField(max_length=150, required=False)
-    email = serializers.CharField(max_length=254, required=False)
-
     class Meta:
         model = User
-        fields = ('id', 'username', 'email', "first_name", "last_name",
-                  "is_staff", "is_active", "is_superuser")
-
-    def update(self, instance, validated_data):
-        if settings.LDAP_ENDPOINT:
-            raise DryccException(
-                "You cannot change user info when ldap is enabled.")
-        if validated_data.get('username'):
-            qs = User.objects.filter(username=validated_data.get('username')).\
-                exclude(username=instance.username)
-            if qs:
-                raise DryccException("new username already exists.")
-            instance.username = validated_data.get('username')
-        if validated_data.get('email'):
-            instance.email = validated_data.get('email')
-        instance.save()
-        return instance
+        fields = ('id', 'username', 'email', 'first_name', 'last_name',
+                  'is_staff', 'is_active', 'is_superuser')
+        read_only_fields = ('id', 'username', 'is_staff', 'is_active',
+                            'is_superuser')
 
 
 class UserEmailSerializer(serializers.ModelSerializer):
diff --git a/rootfs/api/settings/production.py b/rootfs/api/settings/production.py
@@ -21,10 +21,10 @@
 # https://docs.djangoproject.com/en/2.2/ref/settings/#debug-propagate-exceptions
 DEBUG_PROPAGATE_EXCEPTIONS = True
 # Enable Django admin
-ADMIN_ENABLED = bool(os.environ.get('ADMIN_ENABLED', False))
+ADMIN_ENABLED = os.environ.get('ADMIN_ENABLED', 'false') != 'false'
 # Enable Registration
 # If this function is enabled, please set Django email related parameters
-REGISTRATION_ENABLED = bool(os.environ.get('REGISTRATION_ENABLED', False))
+REGISTRATION_ENABLED = os.environ.get('REGISTRATION_ENABLED', 'false') != 'false'
 # Silence two security messages around SSL as router takes care of them
 # https://docs.djangoproject.com/en/2.2/ref/checks/#security
 SILENCED_SYSTEM_CHECKS = [
@@ -267,6 +267,8 @@
 STATIC_ROOT = os.path.abspath(os.path.join(BASE_DIR, '..', 'web', 'dist', 'assets'))
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
 
+# Avatar URL
+AVATAR_URL = "https://cravatar.cn/avatar/"
 # see: https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html?highlight=oidc.key#creating-rsa-private-key  # noqa
 with open('/var/run/secrets/drycc/passport/oidc-rsa-private-key') as f:
     OIDC_RSA_PRIVATE_KEY = f.read()
@@ -295,6 +297,22 @@
     'rest_framework.authentication.BasicAuthentication',
 )
 
+# Redis Configuration
+DRYCC_REDIS_ADDRS = os.environ.get('DRYCC_REDIS_ADDRS', '127.0.0.1:6379').split(",")
+DRYCC_REDIS_PASSWORD = os.environ.get('DRYCC_REDIS_PASSWORD', '')
+
+# Cache Configuration
+CACHES = {
+    "default": {
+        "BACKEND": "django_redis.cache.RedisCache",
+        "LOCATION": ['redis://:{}@{}'.format(DRYCC_REDIS_PASSWORD, DRYCC_REDIS_ADDR) \
+                     for DRYCC_REDIS_ADDR in DRYCC_REDIS_ADDRS],  # noqa
+        "OPTIONS": {
+            "CLIENT_CLASS": "django_redis.client.ShardClient",
+        }
+    }
+}
+
 # LDAP settings taken from environment variables.
 LDAP_ENDPOINT = os.environ.get('LDAP_ENDPOINT', '')
 LDAP_BIND_DN = os.environ.get('LDAP_BIND_DN', '')
@@ -354,5 +372,5 @@
 DEFAULT_FROM_EMAIL = os.environ.get('DEFAULT_FROM_EMAIL', '')
 EMAIL_HOST_USER = os.environ.get('EMAIL_HOST_USER', '')
 EMAIL_HOST_PASSWORD = os.environ.get('EMAIL_HOST_PASSWORD', '')
-EMAIL_USE_TLS = os.environ.get('EMAIL_USE_TLS', True)
-EMAIL_USE_SSL = os.environ.get('EMAIL_USE_SSL', True)
+EMAIL_USE_TLS = os.environ.get('EMAIL_USE_TLS', 'false').lower() != 'false'
+EMAIL_USE_SSL = os.environ.get('EMAIL_USE_SSL', 'false').lower() != 'false'
diff --git a/rootfs/api/templates/user/account_update_done.html b/rootfs/api/templates/user/account_update_done.html
@@ -0,0 +1,6 @@
+{% extends 'user/message.html' %}
+{% block title %}Account update successful{% endblock %}
+{% block message %}
+Your account has been update successfully.
+Please go to the <a href="/">main</a> page.
+{% endblock %}
diff --git a/rootfs/api/templates/user/account_update_email.html b/rootfs/api/templates/user/account_update_email.html
@@ -0,0 +1,7 @@
+{% autoescape off %}
+Hi {{ user.username }},
+
+Please click on the link below to confirm your update:
+
+{{ domain }}{% url 'user_update_account' uidb64=uid token=token%}
+{% endautoescape %}
diff --git a/rootfs/api/templates/user/account_update_fail.html b/rootfs/api/templates/user/account_update_fail.html
@@ -0,0 +1,6 @@
+{% extends 'user/message.html' %}
+{% block title %}Account update fail{% endblock %}
+{% block message %}
+The confirmation link was invalid, possibly it has already been expired.
+Please go to the <a href="/">main</a> page.
+{% endblock %}
diff --git a/rootfs/api/urls.py b/rootfs/api/urls.py
@@ -3,23 +3,25 @@
 from rest_framework.routers import DefaultRouter
 
 from api import views
-from api.views import RegistrationView, ActivateAccount, RegistrationDoneView, \
-    ActivateAccountDoneView, ActivateAccountFailView, LoginDoneView
 
 router = DefaultRouter(trailing_slash=False)
 
 urlpatterns = [
     re_path(r'^', include(router.urls)),
     re_path(r'^info/?$',
             views.UserDetailView.as_view({'get': 'retrieve', 'put': 'update'})),
-    re_path(r'registration/?$', RegistrationView.as_view(), name='registration'),
+    re_path(r'update/(?P<uidb64>.+)/(?P<token>.+)/?$',
+            views.UpdateAccount.as_view(), name='user_update_account'),
+    re_path(r'^avatar/(?P<username>[-_\w]+)/?$',
+        views.UserAvatarViewSet.as_view({'get': 'avatar'})),
+    re_path(r'registration/?$', views.RegistrationView.as_view(), name='registration'),
     re_path(r'activate/(?P<uidb64>.+)/(?P<token>.+)/?$',
-            ActivateAccount.as_view(), name='user_activate_account'),
-    re_path(r'registration/done/?$', RegistrationDoneView.as_view(),
+            views.ActivateAccount.as_view(), name='user_activate_account'),
+    re_path(r'registration/done/?$', views.RegistrationDoneView.as_view(),
             name='user_registration_done'),
-    re_path(r'activate/done/?$', ActivateAccountDoneView.as_view(),
+    re_path(r'activate/done/?$', views.ActivateAccountDoneView.as_view(),
             name='user_activate_account_done'),
-    re_path(r'activate/fail/?$', ActivateAccountFailView.as_view(),
+    re_path(r'activate/fail/?$', views.ActivateAccountFailView.as_view(),
             name='user_activate_account_done'),
     re_path(r'password_reset/?$', views.UserPasswordResetView.as_view(),
             name='user_password_reset'),
@@ -33,7 +35,7 @@
             views.UserPasswordResetCompleteView.as_view(),
             name='user_password_reset_complete'),
     re_path(r'login/?$', views.UserLoginView.as_view(), name='user_login'),
-    re_path(r'login/done/?$', LoginDoneView.as_view(), name='login_done'),
+    re_path(r'login/done/?$', views.LoginDoneView.as_view(), name='login_done'),
     re_path(r'logout/?$', views.UserLogoutView.as_view(), name='user_logout'),
 
     re_path(r'tokens/?$',
diff --git a/rootfs/api/utils.py b/rootfs/api/utils.py
@@ -35,12 +35,12 @@ def __decorator(request, *args, **kwargs):
 class TokenGenerator(PasswordResetTokenGenerator):
     def _make_hash_value(self, user, timestamp):
         return (
-                six.text_type(user.pk) + six.text_type(timestamp) +
-                six.text_type(user.is_active)
+            six.text_type(user.pk) + six.text_type(timestamp) +
+            six.text_type(user.is_active)
         )
 
 
-account_activation_token = TokenGenerator()
+token_generator = TokenGenerator()
 
 
 def get_local_host(request):
diff --git a/rootfs/api/views.py b/rootfs/api/views.py
@@ -1,14 +1,17 @@
 import logging
-
+import hashlib
 from django.conf import settings
+from django.core.cache import cache
+from django.utils.decorators import method_decorator
+from django.views.decorators.cache import cache_page
 from django.contrib import messages, auth
 from django.contrib.auth import login
 from django.contrib.auth.models import User
 from django.contrib.auth import views
 from django.db.models import Q
 from django.shortcuts import redirect, get_object_or_404, render
 from django.template.loader import render_to_string
-from django.http import HttpResponse
+from django.http import HttpResponse, HttpResponseRedirect
 from django.utils.encoding import force_bytes, force_text
 from django.utils.http import urlsafe_base64_encode, urlsafe_base64_decode
 from django.views.generic import View
@@ -24,7 +27,7 @@
 from api import serializers
 from api.exceptions import ServiceUnavailable, DryccException
 from api.serializers import RegistrationForm
-from api.utils import account_activation_token, get_local_host
+from api.utils import token_generator, get_local_host
 from api.viewset import NormalUserViewSet
 
 logger = logging.getLogger(__name__)
@@ -87,7 +90,7 @@ def post(self, request, *args, **kwargs):
                     'user': user,
                     'domain': domain,
                     'uid': urlsafe_base64_encode(force_bytes(user.pk)),
-                    'token': account_activation_token.make_token(user),
+                    'token': token_generator.make_token(user),
                 })
             user.email_user(mail_subject, message)
             messages.success(request, (
@@ -110,13 +113,12 @@ def get(self, request, uidb64, token, *args, **kwargs):
             user = User.objects.get(pk=uid)
         except (TypeError, ValueError, OverflowError, User.DoesNotExist):
             user = None
-        if user is not None and account_activation_token.check_token(
+        if user is not None and token_generator.check_token(
                 user, token):
             user.is_active = True
             user.is_staff = True
             user.save()
-            login(request, user,
-                  backend='django.contrib.auth.backends.ModelBackend')
+            login(request, user, backend='django.contrib.auth.backends.ModelBackend')
             messages.success(request, 'Your account have been confirmed.')
             return redirect('/user/activate/done/')
         else:
@@ -151,14 +153,60 @@ def get_object(self):
         return self.request.user
 
     def update(self, request, *args, **kwargs):
-        user = serializers.UserSerializer(data=request.data,
+        user_serializer = self.serializer_class(data=request.data,
                                           instance=request.user,
                                           partial=True)
-        if user.is_valid():
-            user.save()
+        if user_serializer.is_valid():
+            if settings.EMAIL_HOST:
+                user = self.get_object()
+                mail_subject = 'Update your account.'
+                uid = urlsafe_base64_encode(force_bytes(user.pk))
+                token = token_generator.make_token(user)
+                message = render_to_string(
+                    'user/account_update_email.html', {
+                        'uid': uid,
+                        'user': user,
+                        'token': token,
+                        'domain': get_local_host(request)
+                    })
+                cache_key = "user:serializer:%s" % user.pk
+                cache.set(cache_key, request.data, 60 * 30)
+                user.email_user(mail_subject, message)
+            else:
+                user_serializer.save()
         return Response(status=status.HTTP_204_NO_CONTENT)
 
 
+class UpdateAccount(View):
+
+    def get(self, request, uidb64, token, *args, **kwargs):
+        user = get_object_or_404(User, pk=force_text(urlsafe_base64_decode(uidb64)))
+        if user is not None and token_generator.check_token(user, token):
+            cache_key = "user:serializer:%s" % user.pk
+            data = cache.get(cache_key, None)
+            if data:
+                user_serializer = serializers.UserSerializer(
+                    data=data, instance=user, partial=True)
+                if user_serializer.is_valid():
+                    user_serializer.save()
+                    login(request, user, backend='django.contrib.auth.backends.ModelBackend')
+                    cache.delete(cache_key)
+                    return render(request, template_name='user/account_update_done.html')
+        return render(request, template_name='user/account_update_fail.html')
+
+
+class UserAvatarViewSet(NormalUserViewSet):
+
+    @method_decorator(cache_page(60 * 5))
+    def avatar(self, request, *args, **kwargs):
+        user = User.objects.filter(username=kwargs["username"]).first()
+        size = request.GET.get("s", "80")
+        md5 = hashlib.md5()
+        if user:
+            md5.update(user.email.encode("utf8"))
+        return HttpResponseRedirect(settings.AVATAR_URL + md5.hexdigest() + "?s=" + size)  
+
+
 class UserEmailView(NormalUserViewSet):
     serializer_class = serializers.UserEmailSerializer
     required_scopes = ['openid']
diff --git a/rootfs/web/index.html b/rootfs/web/index.html
@@ -5,7 +5,7 @@
   <link rel='stylesheet' href='./src/assets/bashboard.css'>
   <link rel='stylesheet' href='./src/assets/style/purple3.min.css'>
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Vite App</title>
+  <title>Drycc Passport</title>
 </head>
 <style>
   body{
diff --git a/rootfs/web/src/assets/home.css b/rootfs/web/src/assets/home.css
@@ -117,8 +117,9 @@
 
 .glostick__property__name span {
     position: absolute;
-    left: 52px;
-    top: 1px;
+    left: 60px;
+    top: 6px;
+    font-weight: bold;
     line-height: 48px;
 }
 
@@ -419,7 +420,7 @@
     }
 
     .glostick__property__name span {
-        left: 45px;
+        left: 60px;
     }
 
     .glostick__menu {
diff --git a/rootfs/web/src/components/UserMenu.vue b/rootfs/web/src/components/UserMenu.vue
diff --git a/rootfs/web/src/services/user.js b/rootfs/web/src/services/user.js
diff --git a/rootfs/web/src/utils/axios.js b/rootfs/web/src/utils/axios.js
diff --git a/rootfs/web/src/views/AccountSetting.js b/rootfs/web/src/views/AccountSetting.js
diff --git a/rootfs/web/src/views/AccountSetting.vue b/rootfs/web/src/views/AccountSetting.vue
