Merge branch 'master' into better-emails

endpoints/api/build.py

@@ -1,9 +1,9 @@
 import logging
 import json
 
-from flask import request
+from flask import request, redirect
 
-from app import app, userfiles as user_files, build_logs
+from app import app, userfiles as user_files, build_logs, log_archive
 from endpoints.api import (RepositoryParamResource, parse_args, query_param, nickname, resource,
                            require_repo_read, require_repo_write, validate_json_request,
                            ApiResource, internal_only, format_date, api, Unauthorized, NotFound)
@@ -80,7 +80,7 @@ def build_status_view(build_obj, can_write=False):
   }
 
   if can_write:
-    resp['archive_url'] = user_files.get_file_url(build_obj.resource_key)
+    resp['archive_url'] = user_files.get_file_url(build_obj.resource_key, requires_cors=True)
 
   return resp
 
@@ -215,6 +215,10 @@ class RepositoryBuildLogs(RepositoryParamResource):
 
     build = model.get_repository_build(namespace, repository, build_uuid)
 
+    # If the logs have been archived, just redirect to the completed archive
+    if build.logs_archived:
+      return redirect(log_archive.get_file_url(build.uuid))
+
     start = int(request.args.get('start', 0))
 
     try:
@@ -257,7 +261,7 @@ class FileDropResource(ApiResource):
   def post(self):
     """ Request a URL to which a file may be uploaded. """
     mime_type = request.get_json()['mimeType']
-    (url, file_id) = user_files.prepare_for_drop(mime_type)
+    (url, file_id) = user_files.prepare_for_drop(mime_type, requires_cors=True)
     return {
       'url': url,
       'file_id': str(file_id),

endpoints/api/team.py

@@ -1,12 +1,48 @@
 from flask import request
 
 from endpoints.api import (resource, nickname, ApiResource, validate_json_request, request_error,
-                           log_action, Unauthorized, NotFound, internal_only, require_scope)
+                           log_action, Unauthorized, NotFound, internal_only, require_scope,
+                           query_param, truthy_bool, parse_args, require_user_admin)
 from auth.permissions import AdministerOrganizationPermission, ViewTeamPermission
 from auth.auth_context import get_authenticated_user
 from auth import scopes
 from data import model
+from util.useremails import send_org_invite_email
+from util.gravatar import compute_hash
 
+def try_accept_invite(code, user):
+  (team, inviter) = model.confirm_team_invite(code, user)
+
+  model.delete_matching_notifications(user, 'org_team_invite', code=code)
+
+  orgname = team.organization.username
+  log_action('org_team_member_invite_accepted', orgname, {
+    'member': user.username,
+    'team': team.name,
+    'inviter': inviter.username
+  })
+
+  return team
+
+
+def handle_addinvite_team(inviter, team, user=None, email=None):
+  invite = model.add_or_invite_to_team(inviter, team, user, email)
+  if not invite:
+    # User was added to the team directly.
+    return
+
+  orgname = team.organization.username
+  if user:
+    model.create_notification('org_team_invite', user, metadata = {
+      'code': invite.invite_token,
+      'inviter': inviter.username,
+      'org': orgname,
+      'team': team.name
+    })
+
+  send_org_invite_email(user.username if user else email, user.email if user else email,
+                        orgname, team.name, inviter.username, invite.invite_token)
+  return invite
 
 def team_view(orgname, team):
   view_permission = ViewTeamPermission(orgname, team.name)
@@ -19,14 +55,28 @@ def team_view(orgname, team):
     'role': role
   }
 
-def member_view(member):
+def member_view(member, invited=False):
   return {
     'name': member.username,
     'kind': 'user',
     'is_robot': member.robot,
+    'gravatar': compute_hash(member.email) if not member.robot else None,
+    'invited': invited,
   }
 
 
+def invite_view(invite):
+  if invite.user:
+    return member_view(invite.user, invited=True)
+  else:
+    return {
+      'email': invite.email,
+      'kind': 'invite',
+      'gravatar': compute_hash(invite.email),
+      'invited': True
+    }
+
+
 @resource('/v1/organization/<orgname>/team/<teamname>')
 @internal_only
 class OrganizationTeam(ApiResource):
@@ -114,8 +164,10 @@ class OrganizationTeam(ApiResource):
 @internal_only
 class TeamMemberList(ApiResource):
   """ Resource for managing the list of members for a team. """
+  @parse_args
+  @query_param('includePending', 'Whether to include pending members', type=truthy_bool, default=False)
   @nickname('getOrganizationTeamMembers')
-  def get(self, orgname, teamname):
+  def get(self, args, orgname, teamname):
     """ Retrieve the list of members for the specified team. """
     view_permission = ViewTeamPermission(orgname, teamname)
     edit_permission = AdministerOrganizationPermission(orgname)
@@ -128,11 +180,18 @@ class TeamMemberList(ApiResource):
         raise NotFound()
         
       members = model.get_organization_team_members(team.id)
-      return {
-        'members': {m.username : member_view(m) for m in members},
+      invites = []
+
+      if args['includePending'] and edit_permission.can():
+        invites = model.get_organization_team_member_invites(team.id)
+
+      data = {
+        'members': [member_view(m) for m in members] + [invite_view(i) for i in invites],
         'can_edit': edit_permission.can()
       }
 
+      return data
+
     raise Unauthorized()
 
 
@@ -142,7 +201,7 @@ class TeamMember(ApiResource):
   @require_scope(scopes.ORG_ADMIN)
   @nickname('updateOrganizationTeamMember')
   def put(self, orgname, teamname, membername):
-    """ Add a member to an existing team. """
+    """ Adds or invites a member to an existing team. """
     permission = AdministerOrganizationPermission(orgname)
     if permission.can():
       team = None
@@ -159,23 +218,149 @@ class TeamMember(ApiResource):
       if not user:
         raise request_error(message='Unknown user')
         
-      # Add the user to the team.
-      model.add_user_to_team(user, team)
-      log_action('org_add_team_member', orgname, {'member': membername, 'team': teamname})
-      return member_view(user)
+      # Add or invite the user to the team.
+      inviter = get_authenticated_user()
+      invite = handle_addinvite_team(inviter, team, user=user)
+      if not invite:
+        log_action('org_add_team_member', orgname, {'member': membername, 'team': teamname})
+        return member_view(user, invited=False)
+    
+      # User was invited.
+      log_action('org_invite_team_member', orgname, {
+        'user': membername,
+        'member': membername,
+        'team': teamname
+      })
+      return member_view(user, invited=True)
 
     raise Unauthorized()
 
   @require_scope(scopes.ORG_ADMIN)
   @nickname('deleteOrganizationTeamMember')
   def delete(self, orgname, teamname, membername):
-    """ Delete an existing member of a team. """
+    """ Delete a member of a team. If the user is merely invited to join
+        the team, then the invite is removed instead.
+    """
     permission = AdministerOrganizationPermission(orgname)
     if permission.can():
       # Remote the user from the team.
       invoking_user = get_authenticated_user().username
+
+      # Find the team.
+      try:
+        team = model.get_organization_team(orgname, teamname)
+      except model.InvalidTeamException:
+        raise NotFound()
+     
+      # Find the member.
+      member = model.get_user(membername)
+      if not member:
+        raise NotFound()
+
+      # First attempt to delete an invite for the user to this team. If none found,
+      # then we try to remove the user directly.
+      if model.delete_team_user_invite(team, member):
+        log_action('org_delete_team_member_invite', orgname, {
+          'user': membername,
+          'team': teamname,
+          'member': membername
+        })
+        return 'Deleted', 204
+
       model.remove_user_from_team(orgname, teamname, membername, invoking_user)
       log_action('org_remove_team_member', orgname, {'member': membername, 'team': teamname})
       return 'Deleted', 204
 
     raise Unauthorized()
+
+
+@resource('/v1/organization/<orgname>/team/<teamname>/invite/<email>')
+class InviteTeamMember(ApiResource):
+  """ Resource for inviting a team member via email address. """
+  @require_scope(scopes.ORG_ADMIN)
+  @nickname('inviteTeamMemberEmail')
+  def put(self, orgname, teamname, email):
+    """ Invites an email address to an existing team. """
+    permission = AdministerOrganizationPermission(orgname)
+    if permission.can():
+      team = None
+
+      # Find the team.
+      try:
+        team = model.get_organization_team(orgname, teamname)
+      except model.InvalidTeamException:
+        raise NotFound()
+     
+      # Invite the email to the team.
+      inviter = get_authenticated_user()
+      invite = handle_addinvite_team(inviter, team, email=email)
+      log_action('org_invite_team_member', orgname, {
+        'email': email,
+        'team': teamname,
+        'member': email
+      })
+      return invite_view(invite)
+
+    raise Unauthorized()
+
+  @require_scope(scopes.ORG_ADMIN)
+  @nickname('deleteTeamMemberEmailInvite')
+  def delete(self, orgname, teamname, email):
+    """ Delete an invite of an email address to join a team. """
+    permission = AdministerOrganizationPermission(orgname)
+    if permission.can():
+      team = None
+
+      # Find the team.
+      try:
+        team = model.get_organization_team(orgname, teamname)
+      except model.InvalidTeamException:
+        raise NotFound()
+     
+      # Delete the invite.
+      model.delete_team_email_invite(team, email)
+      log_action('org_delete_team_member_invite', orgname, {
+        'email': email,
+        'team': teamname,
+        'member': email
+      })
+      return 'Deleted', 204
+
+    raise Unauthorized()
+
+
+@resource('/v1/teaminvite/<code>')
+@internal_only
+class TeamMemberInvite(ApiResource):
+  """ Resource for managing invites to jon a team. """
+  @require_user_admin
+  @nickname('acceptOrganizationTeamInvite')
+  def put(self, code):
+    """ Accepts an invite to join a team in an organization. """
+    # Accept the invite for the current user.
+    team = try_accept_invite(code, get_authenticated_user())
+    if not team:
+      raise NotFound()      
+
+    orgname = team.organization.username
+    return {
+      'org': orgname,
+      'team': team.name
+    }
+
+  @nickname('declineOrganizationTeamInvite')
+  @require_user_admin
+  def delete(self, code):
+    """ Delete an existing member of a team. """
+    (team, inviter) = model.delete_team_invite(code, get_authenticated_user())
+
+    model.delete_matching_notifications(get_authenticated_user(), 'org_team_invite', code=code)
+
+    orgname = team.organization.username
+    log_action('org_team_member_invite_declined', orgname, {
+        'member': get_authenticated_user().username,
+        'team': team.name,
+        'inviter': inviter.username
+    })
+
+    return 'Deleted', 204

endpoints/api/user.py

@@ -12,6 +12,8 @@ from endpoints.api import (ApiResource, nickname, resource, validate_json_reques
                            license_error,  require_fresh_login)
 from endpoints.api.subscribe import subscribe
 from endpoints.common import common_login
+from endpoints.api.team import try_accept_invite
+
 from data import model
 from data.billing import get_plan
 from auth.permissions import (AdministerOrganizationPermission, CreateRepositoryPermission,
@@ -20,6 +22,7 @@ from auth.auth_context import get_authenticated_user
 from auth import scopes
 from util.gravatar import compute_hash
 from util.useremails import (send_confirmation_email, send_recovery_email, send_change_email, send_password_changed)
+from util.names import parse_single_urn
 
 import features
 
@@ -188,11 +191,15 @@ class User(ApiResource):
     return user_view(user)
 
   @nickname('createNewUser')
+  @parse_args
+  @query_param('inviteCode', 'Invitation code given for creating the user.', type=str,
+               default='')
   @internal_only
   @validate_json_request('NewUser')
-  def post(self):
+  def post(self, args):
     """ Create a new user. """
     user_data = request.get_json()
+    invite_code = args['inviteCode']
 
     existing_user = model.get_user(user_data['username'])
     if existing_user:
@@ -203,6 +210,17 @@ class User(ApiResource):
                                    user_data['email'])
       code = model.create_confirm_email_code(new_user)
       send_confirmation_email(new_user.username, new_user.email, code.code)
+
+      # Handle any invite codes.
+      parsed_invite = parse_single_urn(invite_code)
+      if parsed_invite is not None:
+        if parsed_invite[0] == 'teaminvite':
+          # Add the user to the team.
+          try:
+            try_accept_invite(invite_code, new_user)
+          except model.DataModelException:
+            pass
+
       return 'Created', 201
     except model.TooManyUsersException as ex:
       raise license_error(exception=ex)
@@ -409,6 +427,19 @@ class Signout(ApiResource):
     return {'success': True}
 
 
+
+@resource('/v1/detachexternal/<servicename>')
+@internal_only
+class DetachExternal(ApiResource):
+  """ Resource for detaching an external login. """
+  @require_user_admin
+  @nickname('detachExternalLogin')
+  def post(self, servicename):
+    """ Request that the current user be detached from the external login service. """
+    model.detach_external_login(get_authenticated_user(), servicename)
+    return {'success': True}
+
+
 @resource("/v1/recovery")
 @internal_only
 class Recovery(ApiResource):