authentik.core.api.used_by

  1"""used_by mixin"""
  2
  3from enum import Enum
  4from inspect import getmembers
  5
  6from django.db.models.base import Model
  7from django.db.models.deletion import SET_DEFAULT, SET_NULL
  8from django.db.models.manager import Manager
  9from drf_spectacular.utils import extend_schema
 10from guardian.shortcuts import get_objects_for_user
 11from rest_framework.decorators import action
 12from rest_framework.fields import CharField, ChoiceField
 13from rest_framework.request import Request
 14from rest_framework.response import Response
 15
 16from authentik.core.api.utils import PassiveSerializer
 17from authentik.rbac.filters import ObjectFilter
 18
 19
 20class DeleteAction(Enum):
 21    """Which action a delete will have on a used object"""
 22
 23    CASCADE = "cascade"
 24    CASCADE_MANY = "cascade_many"
 25    SET_NULL = "set_null"
 26    SET_DEFAULT = "set_default"
 27    LEFT_DANGLING = "left_dangling"
 28
 29
 30class UsedBySerializer(PassiveSerializer):
 31    """A list of all objects referencing the queried object"""
 32
 33    app = CharField()
 34    model_name = CharField()
 35    pk = CharField()
 36    name = CharField()
 37    action = ChoiceField(choices=[(x.value, x.name) for x in DeleteAction])
 38
 39
 40def get_delete_action(manager: Manager) -> str:
 41    """Get the delete action from the Foreign key, falls back to cascade"""
 42    if hasattr(manager, "field"):
 43        if manager.field.remote_field.on_delete.__name__ == SET_NULL.__name__:
 44            return DeleteAction.SET_NULL.value
 45        if manager.field.remote_field.on_delete.__name__ == SET_DEFAULT.__name__:
 46            return DeleteAction.SET_DEFAULT.value
 47    if hasattr(manager, "source_field"):
 48        return DeleteAction.CASCADE_MANY.value
 49    return DeleteAction.CASCADE.value
 50
 51
 52class UsedByMixin:
 53    """Mixin to add a used_by endpoint to return a list of all objects using this object"""
 54
 55    @extend_schema(
 56        responses={200: UsedBySerializer(many=True)},
 57    )
 58    @action(detail=True, pagination_class=None, filter_backends=[ObjectFilter])
 59    def used_by(self, request: Request, *args, **kwargs) -> Response:
 60        """Get a list of all objects that use this object"""
 61        model: Model = self.get_object()
 62        used_by = []
 63        shadows = []
 64        for attr_name, manager in getmembers(model, lambda x: isinstance(x, Manager)):
 65            if attr_name == "objects":  # pragma: no cover
 66                continue
 67            manager: Manager
 68            if manager.model._meta.abstract:
 69                continue
 70            app = manager.model._meta.app_label
 71            model_name = manager.model._meta.model_name
 72            delete_action = get_delete_action(manager)
 73
 74            # To make sure we only apply shadows when there are any objects,
 75            # but so we only apply them once, have a simple flag for the first object
 76            first_object = True
 77
 78            # TODO: This will only return the used-by references that the user can see
 79            # Either we have to leak model information here to not make the list
 80            # useless if the user doesn't have all permissions, or we need to double
 81            # query and check if there is a difference between modes the user can see
 82            # and can't see and add a warning
 83            for obj in get_objects_for_user(
 84                request.user, f"{app}.view_{model_name}", manager.all()
 85            ).all():
 86                # Only merge shadows on first object
 87                if first_object:
 88                    shadows += getattr(manager.model._meta, "authentik_used_by_shadows", [])
 89                first_object = False
 90                serializer = UsedBySerializer(
 91                    data={
 92                        "app": app,
 93                        "model_name": model_name,
 94                        "pk": str(obj.pk),
 95                        "name": str(obj),
 96                        "action": delete_action,
 97                    }
 98                )
 99                serializer.is_valid()
100                used_by.append(serializer.data)
101        # Check the shadows map and remove anything that should be shadowed
102        for idx, user in enumerate(used_by):
103            full_model_name = f"{user['app']}.{user['model_name']}"
104            if full_model_name in shadows:
105                del used_by[idx]
106        return Response(used_by)