Allow superusers to disable user accounts

data/model/legacy.py

@@ -67,6 +67,7 @@ class InvalidRobotException(DataModelException):
 class InvalidTeamException(DataModelException):
   pass
 
+
 class InvalidTeamMemberException(DataModelException):
   pass
 
@@ -259,16 +260,35 @@ def lookup_robot(robot_username):
   return found[0]
 
 def verify_robot(robot_username, password):
-  joined = User.select().join(FederatedLogin).join(LoginService)
-  found = list(joined.where(FederatedLogin.service_ident == password,
-                            LoginService.name == 'quayrobot',
-                            User.username == robot_username))
-  if not found:
+  result = parse_robot_username(robot_username)
+  if result is None:
+    raise InvalidRobotException('%s is an invalid robot name' % robot_username)
+
+  # Find the matching robot.
+  query = (User.select()
+               .join(FederatedLogin)
+               .join(LoginService)
+               .where(FederatedLogin.service_ident == password,
+                      LoginService.name == 'quayrobot',
+                      User.username == robot_username))
+
+  try:
+    robot = query.get()
+  except User.DoesNotExist:
     msg = ('Could not find robot with username: %s and supplied password.' %
            robot_username)
     raise InvalidRobotException(msg)
 
-  return found[0]
+  # Find the owner user and ensure it is not disabled.
+  try:
+    owner = User.get(User.username == result[0])
+  except User.DoesNotExist:
+    raise InvalidRobotException('Robot %s owner does not exist' % robot_username)
+
+  if not owner.enabled:
+    raise InvalidRobotException('This user has been disabled. Please contact your administrator.')
+
+  return robot
 
 def regenerate_robot_token(robot_shortname, parent):
   robot_username = format_robot_username(parent.username, robot_shortname)