152 lines
4.9 KiB
Python
152 lines
4.9 KiB
Python
from pathlib import Path
|
|
from flask import Blueprint, request, session, redirect, flash
|
|
import json, os, re, sqlite3
|
|
from datetime import datetime, timezone
|
|
import auth
|
|
import config_utils
|
|
import sanitize
|
|
|
|
_PAGE = Path(__file__).parent.name
|
|
|
|
bp = Blueprint(_PAGE, __name__)
|
|
|
|
VALID_LEVELS = {'viewer', 'administrator', 'manager'}
|
|
|
|
|
|
def _load_accounts():
|
|
try:
|
|
with open(config_utils.ACCOUNTS_FILE) as f:
|
|
return json.load(f)
|
|
except Exception:
|
|
return {'accounts': []}
|
|
|
|
def _save_accounts(data):
|
|
with open(config_utils.ACCOUNTS_FILE, 'w') as f:
|
|
json.dump(data, f, indent=2)
|
|
|
|
|
|
@bp.route('/action/accountmanage/accounts_add', methods=['POST'])
|
|
@auth.require_level('manager')
|
|
def accounts_add():
|
|
email = sanitize.email(request.form.get('email_address', ''))
|
|
access_level = request.form.get('access_level', '').strip()
|
|
|
|
if not email:
|
|
flash('Email address is required.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
if not re.match(r'^[^@\s]+@[^@\s]+\.[^@\s]+$', email):
|
|
flash('Email address does not appear to be valid.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
if access_level not in VALID_LEVELS:
|
|
flash('Invalid access level.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
data = _load_accounts()
|
|
accounts = data.get('accounts', [])
|
|
|
|
if any(a.get('email_address', '').lower() == email for a in accounts):
|
|
flash('An account with that email address already exists.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
now = datetime.now(tz=timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
|
|
accounts.append({
|
|
'email_address': email,
|
|
'access_level': access_level,
|
|
'account_created_utc': now,
|
|
'account_created_by': session.get('email_address', ''),
|
|
'hashed_password': '',
|
|
'timezone': '',
|
|
})
|
|
data['accounts'] = accounts
|
|
_save_accounts(data)
|
|
|
|
flash(f'Authorization added for {email}. User must complete account setup via the Create Account page.', 'success')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
|
|
@bp.route('/action/accountmanage/accounts_edit', methods=['POST'])
|
|
@auth.require_level('manager')
|
|
def accounts_edit():
|
|
try:
|
|
row_index = int(request.form.get('row_index', ''))
|
|
except (ValueError, TypeError):
|
|
flash('Invalid request.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
access_level = request.form.get('access_level', '').strip()
|
|
if access_level not in VALID_LEVELS:
|
|
flash('Invalid access level.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
data = _load_accounts()
|
|
accounts = data.get('accounts', [])
|
|
|
|
if row_index < 0 or row_index >= len(accounts):
|
|
flash('Account not found.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
target = accounts[row_index]
|
|
if target.get('email_address', '').lower() == session.get('email_address', '').lower():
|
|
flash('You cannot change your own access level.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
accounts[row_index]['access_level'] = access_level
|
|
data['accounts'] = accounts
|
|
_save_accounts(data)
|
|
|
|
flash('Account updated.', 'success')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
|
|
@bp.route('/action/accountmanage/session_invalidate', methods=['POST'])
|
|
@auth.require_level('manager')
|
|
def session_invalidate():
|
|
sid = request.form.get('session_id', '').strip()
|
|
if not sid:
|
|
flash('Invalid request.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
try:
|
|
con = sqlite3.connect(config_utils.SESSIONS_DB, timeout=5)
|
|
con.execute('DELETE FROM sessions WHERE session_id=?', (sid,))
|
|
con.commit()
|
|
con.close()
|
|
flash('Session invalidated.', 'success')
|
|
except Exception:
|
|
flash('Failed to invalidate session.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
|
|
@bp.route('/action/accountmanage/accounts_delete', methods=['POST'])
|
|
@auth.require_level('manager')
|
|
def accounts_delete():
|
|
try:
|
|
row_index = int(request.form.get('row_index', ''))
|
|
except (ValueError, TypeError):
|
|
flash('Invalid request.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
data = _load_accounts()
|
|
accounts = data.get('accounts', [])
|
|
|
|
if row_index < 0 or row_index >= len(accounts):
|
|
flash('Account not found.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
target = accounts[row_index]
|
|
|
|
target_email = target.get('email_address', '').lower()
|
|
current_email = session.get('email_address', '').lower()
|
|
initial_email = os.environ.get('INITIAL_MANAGER_EMAIL', '').strip().lower()
|
|
if target_email == current_email and target_email != initial_email:
|
|
flash('You cannot remove your own account.', 'error')
|
|
return redirect(f'/{_PAGE}')
|
|
|
|
removed_email = target.get('email_address', '')
|
|
accounts.pop(row_index)
|
|
data['accounts'] = accounts
|
|
_save_accounts(data)
|
|
|
|
flash(f'Account for {removed_email} has been removed.', 'success')
|
|
return redirect(f'/{_PAGE}')
|