quay/util/config/validator.py

import logging

from auth.auth_context import get_authenticated_user
from data.users import LDAP_CERT_FILENAME

from util.config.validators.validate_database import DatabaseValidator
from util.config.validators.validate_redis import RedisValidator
from util.config.validators.validate_storage import StorageValidator
from util.config.validators.validate_email import EmailValidator
from util.config.validators.validate_ldap import LDAPValidator
from util.config.validators.validate_keystone import KeystoneValidator
from util.config.validators.validate_jwt import JWTAuthValidator
from util.config.validators.validate_secscan import SecurityScannerValidator
from util.config.validators.validate_signer import SignerValidator
from util.config.validators.validate_torrent import BittorrentValidator
from util.config.validators.validate_ssl import SSLValidator, SSL_FILENAMES
from util.config.validators.validate_google_login import GoogleLoginValidator
from util.config.validators.validate_bitbucket_trigger import BitbucketTriggerValidator
from util.config.validators.validate_gitlab_trigger import GitLabTriggerValidator
from util.config.validators.validate_github import GitHubLoginValidator, GitHubTriggerValidator
from util.config.validators.validate_oidc import OIDCLoginValidator
from util.config.validators.validate_timemachine import TimeMachineValidator
from util.config.validators.validate_access import AccessSettingsValidator
from util.config.validators.validate_actionlog_archiving import ActionLogArchivingValidator
from util.config.validators.validate_apptokenauth import AppTokenAuthValidator

logger = logging.getLogger(__name__)

class ConfigValidationException(Exception):
  """ Exception raised when the configuration fails to validate for a known reason. """
  pass

# Note: Only add files required for HTTPS to the SSL_FILESNAMES list.
DB_SSL_FILENAMES = ['database.pem']
JWT_FILENAMES = ['jwt-authn.cert']
ACI_CERT_FILENAMES = ['signing-public.gpg', 'signing-private.gpg']
LDAP_FILENAMES = [LDAP_CERT_FILENAME]
CONFIG_FILENAMES = (SSL_FILENAMES + DB_SSL_FILENAMES + JWT_FILENAMES + ACI_CERT_FILENAMES +
                    LDAP_FILENAMES)
CONFIG_FILE_SUFFIXES = ['-cloudfront-signing-key.pem']
EXTRA_CA_DIRECTORY = 'extra_ca_certs'

VALIDATORS = {
  DatabaseValidator.name: DatabaseValidator.validate,
  RedisValidator.name: RedisValidator.validate,
  StorageValidator.name: StorageValidator.validate,
  EmailValidator.name: EmailValidator.validate,
  GitHubLoginValidator.name: GitHubLoginValidator.validate,
  GitHubTriggerValidator.name: GitHubTriggerValidator.validate,
  GitLabTriggerValidator.name: GitLabTriggerValidator.validate,
  BitbucketTriggerValidator.name: BitbucketTriggerValidator.validate,
  GoogleLoginValidator.name: GoogleLoginValidator.validate,
  SSLValidator.name: SSLValidator.validate,
  LDAPValidator.name: LDAPValidator.validate,
  JWTAuthValidator.name: JWTAuthValidator.validate,
  KeystoneValidator.name: KeystoneValidator.validate,
  SignerValidator.name: SignerValidator.validate,
  SecurityScannerValidator.name: SecurityScannerValidator.validate,
  BittorrentValidator.name: BittorrentValidator.validate,
  OIDCLoginValidator.name: OIDCLoginValidator.validate,
  TimeMachineValidator.name: TimeMachineValidator.validate,
  AccessSettingsValidator.name: AccessSettingsValidator.validate,
  ActionLogArchivingValidator.name: ActionLogArchivingValidator.validate,
  AppTokenAuthValidator.name: AppTokenAuthValidator.validate,
}

def validate_service_for_config(service, config, password=None):
  """ Attempts to validate the configuration for the given service. """
  if not service in VALIDATORS:
    return {
      'status': False
    }

  try:
    VALIDATORS[service](config, get_authenticated_user(), password)
    return {
      'status': True
    }
  except Exception as ex:
    logger.exception('Validation exception')
    return {
      'status': False,
      'reason': str(ex)
    }


def is_valid_config_upload_filename(filename):
  """ Returns true if and only if the given filename is one which is supported for upload
      from the configuration UI tool.
  """
  if filename in CONFIG_FILENAMES:
    return True

  return any([filename.endswith(suffix) for suffix in CONFIG_FILE_SUFFIXES])