WP-409: Set members to superuser via TAS

server/portal/apps/auth/views.py

@@ -17,7 +17,7 @@
     new_user_setup_check
 )
 from portal.apps.search.tasks import index_allocations
-
+from portal.apps.users.utils import check_user_groups
 
 logger = logging.getLogger(__name__)
 METRICS = logging.getLogger(f'metrics.{__name__}')
@@ -77,6 +77,20 @@ def launch_setup_checks(user):
                     "allocation information) for %s", user.username)
         index_allocations.apply_async(args=[user.username])
 
+    portal_roles = settings.PORTAL_ELEVATED_ROLES
+    for role, groups_and_users in portal_roles.items():
+        if role == "is_staff" and not user.is_staff:
+            if str(user.username) in groups_and_users["usernames"] or check_user_groups(user, groups_and_users["groups"]):
+                user.is_staff = True
+                user.save()
+                logger.info(f"user {user.username} is set to staff")
+
+        elif role == "is_superuser" and not user.is_superuser:
+            if str(user.username) in groups_and_users["usernames"] or check_user_groups(user, groups_and_users["groups"]):
+                user.is_superuser = True
+                user.save()
+                logger.info(f"user {user.username} is set to superuser")
+
 
 def tapis_oauth_callback(request):
     """Tapis OAuth callback handler.

server/portal/apps/users/unit_test.py

@@ -42,6 +42,7 @@ def setUp(self):
         token.user = user
         token.save()
         user.is_staff = False
+        user.is_superuser = False
         user.save()
 
     def test_auth_view(self):

server/portal/apps/users/utils.py

@@ -259,3 +259,10 @@ def remove_user(project_id, user_id):
     if resp['status'] != 'success':
         raise ApiException("Failed to delete user: '{}'".format(resp['message']))
     return resp['result']
+
+
+def check_user_groups(username, groups):
+    return any(
+        user['username'] == str(username)
+        for group in groups for user in get_project_users_from_name(group)
+    )

server/portal/apps/users/views.py

@@ -38,7 +38,7 @@ def get(self, request):
                 "oauth": {
                     "expires_in": u.tapis_oauth.expires_in,
                 },
-                "isStaff": u.is_staff
+                "isStaff": u.is_staff,
             }
 
             return JsonResponse(out)
@@ -143,6 +143,7 @@ def get(self, request, project_id):
         : rtype: dict
         """
         usernames = get_project_users_from_id(project_id)
+
         return JsonResponse({'response': usernames}, safe=False)
 
 

server/portal/settings/settings.py

@@ -717,6 +717,8 @@
 RECAPTCHA_SECRET_KEY = getattr(settings_secret, '_RECAPTCHA_SECRET_KEY', None)
 RECAPTCHA_SITE_KEY = getattr(settings_secret, '_RECAPTCHA_SITE_KEY', None)
 
+PORTAL_ELEVATED_ROLES = getattr(settings_custom, '_PORTAL_ELEVATED_ROLES', {})
+
 """
 SETTINGS: LOCAL OVERRIDES
 """

server/portal/settings/settings_custom.example.py

@@ -261,3 +261,14 @@
     },
     "jobsv2Title": "Historic Jobs"
 }
+
+_PORTAL_ELEVATED_ROLES = {
+  "is_staff": {
+    "groups": [],
+    "usernames": []
+  },
+  "is_superuser": {
+    "groups": [],
+    "usernames": []
+  }
+}

server/portal/settings/settings_default.py

@@ -246,3 +246,14 @@
     "ticketAttachmentMaxSize": 3145728,
     "jobsv2Title": "Historic Jobs"
 }
+
+_PORTAL_ELEVATED_ROLES = {
+  "is_staff": {
+    "groups": ["TACC-ACI"],
+    "usernames": []
+  },
+  "is_superuser": {
+    "groups": ["TACC-ACI"],
+    "usernames": []
+  }
+}

server/portal/settings/unit_test_settings.py

@@ -524,3 +524,14 @@
 WORKBENCH_SETTINGS = {
     "debug": False
 }
+
+PORTAL_ELEVATED_ROLES = {
+  "is_staff": {
+    "groups": [],
+    "usernames": []
+  },
+  "is_superuser": {
+    "groups": [],
+    "usernames": []
+  }
+}