12148326999

Committed 03 Dec 2024 09:21PM UTC coverage: 78.074% (+0.04%) from 78.037%

Build # 12148326999

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #1642 from pbiering/storage-cache-separation

Storage cache separation

Run Details

1702 of 2298 branches covered (74.06%)

Branch coverage included in aggregate %.

16 of 16 new or added lines in 6 files covered. (100.0%)

1 existing line in 1 file now uncovered.

3867 of 4835 relevant lines covered (79.98%)

15.42 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

79.71

/radicale/rights/from_file.py

# This file is part of Radicale - CalDAV and CardDAV server
# Copyright © 2012-2017 Guillaume Ayoub
# Copyright © 2017-2021 Unrud <unrud@outlook.com>
# Copyright © 2024-2024 Peter Bieringer <pb@bieringer.de>
#
# This library is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Radicale.  If not, see <http://www.gnu.org/licenses/>.

"""
Rights backend based on a regex-based file whose name is specified in the
config (section "rights", key "file").

The login is matched against the "user" key, and the collection path
is matched against the "collection" key. In the "collection" regex you can use
`{user}` and get groups from the "user" regex with `{0}`, `{1}`, etc.
In consequence of the parameter substitution you have to write `{{` and `}}`
if you want to use regular curly braces in the "user" and "collection" regexes.

For example, for the "user" key, ".+" means "authenticated user" and ".*"
means "anybody" (including anonymous users).

Section names are only used for naming the rule.

Leading or ending slashes are trimmed from collection's path.

"""

import configparser
import re

from radicale import config, pathutils, rights
from radicale.log import logger


class Rights(rights.BaseRights):

    _filename: str

    def __init__(self, configuration: config.Configuration) -> None:
        super().__init__(configuration)
        self._filename = configuration.get("rights", "file")
        self._log_rights_rule_doesnt_match_on_debug = configuration.get("logging", "rights_rule_doesnt_match_on_debug")
        self._rights_config = configparser.ConfigParser()
        try:
            with open(self._filename, "r") as f:
                self._rights_config.read_file(f)
            logger.debug("Read rights file")
        except Exception as e:
            raise RuntimeError("Failed to load rights file %r: %s" %
                               (self._filename, e)) from e

    def authorization(self, user: str, path: str) -> str:
        user = user or ""
        sane_path = pathutils.strip_path(path)
        # Prevent "regex injection"
        escaped_user = re.escape(user)
        if not self._log_rights_rule_doesnt_match_on_debug:
            logger.debug("logging of rules which doesn't match suppressed by config/option [logging] rights_rule_doesnt_match_on_debug")
        for section in self._rights_config.sections():
            group_match = None
            user_match = None
            try:
                user_pattern = self._rights_config.get(section, "user", fallback="")
                collection_pattern = self._rights_config.get(section, "collection")
                allowed_groups = self._rights_config.get(section, "groups", fallback="").split(",")
                try:
                    group_match = len(self._user_groups.intersection(allowed_groups)) > 0
                except Exception:
                    pass
                # Use empty format() for harmonized handling of curly braces
                if user_pattern != "":
                    user_match = re.fullmatch(user_pattern.format(), user)
                user_collection_match = user_match and re.fullmatch(
                    collection_pattern.format(
                        *(re.escape(s) for s in user_match.groups()),
                        user=escaped_user), sane_path)
                group_collection_match = re.fullmatch(collection_pattern.format(user=escaped_user), sane_path)
            except Exception as e:
                raise RuntimeError("Error in section %r of rights file %r: "
                                   "%s" % (section, self._filename, e)) from e
            if user_match and user_collection_match:
                permission = self._rights_config.get(section, "permissions")
                logger.debug("Rule %r:%r matches %r:%r from section %r permission %r",
                             user, sane_path, user_pattern,
                             collection_pattern, section, permission)
                return permission
            if group_match and group_collection_match:
                permission = self._rights_config.get(section, "permissions")
                logger.debug("Rule %r:%r matches %r:%r from section %r permission %r by group membership",
                             user, sane_path, user_pattern,
                             collection_pattern, section, permission)
                return permission
            if self._log_rights_rule_doesnt_match_on_debug:
                logger.debug("Rule %r:%r doesn't match %r:%r from section %r",
                             user, sane_path, user_pattern, collection_pattern,
                             section)
        logger.debug("Rights: %r:%r doesn't match any section", user, sane_path)
        return ""

1	# This file is part of Radicale - CalDAV and CardDAV server
2	# Copyright © 2012-2017 Guillaume Ayoub
3	# Copyright © 2017-2021 Unrud <unrud@outlook.com>
4	# Copyright © 2024-2024 Peter Bieringer <pb@bieringer.de>
5	#
6	# This library is free software: you can redistribute it and/or modify
7	# it under the terms of the GNU General Public License as published by
8	# the Free Software Foundation, either version 3 of the License, or
9	# (at your option) any later version.
10	#
11	# This library is distributed in the hope that it will be useful,
12	# but WITHOUT ANY WARRANTY; without even the implied warranty of
13	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	# GNU General Public License for more details.
15	#
16	# You should have received a copy of the GNU General Public License
17	# along with Radicale. If not, see <http://www.gnu.org/licenses/>.
18
19	"""	3✔
20	Rights backend based on a regex-based file whose name is specified in the
21	config (section "rights", key "file").
22
23	The login is matched against the "user" key, and the collection path
24	is matched against the "collection" key. In the "collection" regex you can use
25	`{user}` and get groups from the "user" regex with `{0}`, `{1}`, etc.
26	In consequence of the parameter substitution you have to write `{{` and `}}`
27	if you want to use regular curly braces in the "user" and "collection" regexes.
28
29	For example, for the "user" key, ".+" means "authenticated user" and ".*"
30	means "anybody" (including anonymous users).
31
32	Section names are only used for naming the rule.
33
34	Leading or ending slashes are trimmed from collection's path.
35
36	"""
37
38	import configparser	20✔
39	import re	20✔
40
41	from radicale import config, pathutils, rights	20✔
42	from radicale.log import logger	20✔
43
44
45	class Rights(rights.BaseRights):	20✔
46
47	_filename: str	20✔
48
49	def __init__(self, configuration: config.Configuration) -> None:	20✔
50	super().__init__(configuration)	20✔
51	self._filename = configuration.get("rights", "file")	20✔
52	self._log_rights_rule_doesnt_match_on_debug = configuration.get("logging", "rights_rule_doesnt_match_on_debug")	20✔
53	self._rights_config = configparser.ConfigParser()	20✔
54	try:	20✔
55	with open(self._filename, "r") as f:	20✔
56	self._rights_config.read_file(f)	20✔
57	logger.debug("Read rights file")	20✔
58	except Exception as e:	×
59	raise RuntimeError("Failed to load rights file %r: %s" %	×
60	(self._filename, e)) from e
61
62	def authorization(self, user: str, path: str) -> str:	20✔
63	user = user or ""	20✔
64	sane_path = pathutils.strip_path(path)	20✔
65	# Prevent "regex injection"
66	escaped_user = re.escape(user)	20✔
67	if not self._log_rights_rule_doesnt_match_on_debug:	20!
68	logger.debug("logging of rules which doesn't match suppressed by config/option [logging] rights_rule_doesnt_match_on_debug")	20✔
69	for section in self._rights_config.sections():	20✔
70	group_match = None	20✔
71	user_match = None	20✔
72	try:	20✔
73	user_pattern = self._rights_config.get(section, "user", fallback="")	20✔
74	collection_pattern = self._rights_config.get(section, "collection")	20✔
75	allowed_groups = self._rights_config.get(section, "groups", fallback="").split(",")	20✔
76	try:	20✔
77	group_match = len(self._user_groups.intersection(allowed_groups)) > 0	20✔
78	except Exception:	×
79	pass	×
80	# Use empty format() for harmonized handling of curly braces
81	if user_pattern != "":	20!
82	user_match = re.fullmatch(user_pattern.format(), user)	20✔
83	user_collection_match = user_match and re.fullmatch(	20✔
84	collection_pattern.format(
85	*(re.escape(s) for s in user_match.groups()),
86	user=escaped_user), sane_path)
87	group_collection_match = re.fullmatch(collection_pattern.format(user=escaped_user), sane_path)	20✔
88	except Exception as e:	×
89	raise RuntimeError("Error in section %r of rights file %r: "	×
90	"%s" % (section, self._filename, e)) from e
91	if user_match and user_collection_match:	20✔
92	permission = self._rights_config.get(section, "permissions")	20✔
93	logger.debug("Rule %r:%r matches %r:%r from section %r permission %r",	20✔
94	user, sane_path, user_pattern,
95	collection_pattern, section, permission)
96	return permission	20✔
97	if group_match and group_collection_match:	20!
98	permission = self._rights_config.get(section, "permissions")	×
99	logger.debug("Rule %r:%r matches %r:%r from section %r permission %r by group membership",	×
100	user, sane_path, user_pattern,
101	collection_pattern, section, permission)
102	return permission	×
103	if self._log_rights_rule_doesnt_match_on_debug:	20!
UNCOV 104	logger.debug("Rule %r:%r doesn't match %r:%r from section %r",	×
105	user, sane_path, user_pattern, collection_pattern,
106	section)
107	logger.debug("Rights: %r:%r doesn't match any section", user, sane_path)	20✔
108	return ""	20✔

Kozea / Radicale / 12148326999

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous