From 02a5830dc89ee777c3a82c151b52641be72923f0 Mon Sep 17 00:00:00 2001 From: Ryan Lerch Date: Jul 27 2023 05:15:52 +0000 Subject: Add config option to restrict creating by OIDC groups This adds a new config option for the OIDC login option that allows us to restict who can create new projects and groups based on if they are a member of a specific group, and then total number of groups. THis allows us to basically restrict the creation of new projects and pagure groups based on FPCA+1. Signed-off-by: Ryan Lerch --- diff --git a/doc/configuration.rst b/doc/configuration.rst index 181b077..e74d6a7 100644 --- a/doc/configuration.rst +++ b/doc/configuration.rst @@ -1266,6 +1266,25 @@ the corresponding ACL. Defaults to: ``True`` +RESTRICT_CREATE_BY_OIDC_GROUP +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This configuration key, when defined, only allows users that are a member of the group defined +the ability to create new projects and groups. + +Defaults to: ``None`` + + +RESTRICT_CREATE_BY_OIDC_GROUP_COUNT +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This configuration key, when defined, only allows users that are a member of the group defined +by RESTRICT_CREATE_BY_OIDC_GROUP and a member of at least the number of groups defined by this +key the ability to create new projects. + +Defaults to: 0 + + ENABLE_DEL_PROJECTS ~~~~~~~~~~~~~~~~~~~ diff --git a/pagure/api/__init__.py b/pagure/api/__init__.py index f6e51b8..7d4cb14 100644 --- a/pagure/api/__init__.py +++ b/pagure/api/__init__.py @@ -112,6 +112,9 @@ class APIERROR(enum.Enum): ENEWPROJECTDISABLED = ( "Creating project have been disabled for this instance" ) + ENEWPROJECTFORBIDDEN = ( + "You are not allowed to create new projects on this instance" + ) ETIMESTAMP = "Invalid timestamp format" EDATETIME = "Invalid datetime format" EINVALIDISSUEFIELD = "Invalid custom field submitted" diff --git a/pagure/api/project.py b/pagure/api/project.py index f156938..6201daf 100644 --- a/pagure/api/project.py +++ b/pagure/api/project.py @@ -1451,6 +1451,11 @@ def api_new_project(): 404, error_code=APIERROR.ENEWPROJECTDISABLED ) + if pagure_config["PAGURE_AUTH"] == 'oidc' and flask.g.fas_user.can_create is False: + raise pagure.exceptions.APIError( + 403, error_code=APIERROR.ENEWPROJECTFORBIDDEN + ) + namespaces = pagure_config["ALLOWED_PREFIX"][:] if user: namespaces.extend([grp for grp in user.groups]) diff --git a/pagure/default_config.py b/pagure/default_config.py index d8a7ee0..d6cb960 100644 --- a/pagure/default_config.py +++ b/pagure/default_config.py @@ -62,6 +62,13 @@ ENABLE_DOCS = True # Enables / Disables creating projects on this pagure instance ENABLE_NEW_PROJECTS = True +# When using OIDC auth, users must be in this OIDC group to create new projects +RESTRICT_CREATE_BY_OIDC_GROUP = None + +# When using OIDC auth, users must be a member of RESTRICT_NEW_PROJECTS_BY_OIDC_GROUP and in total +# this many groups to create new projects +RESTRICT_CREATE_BY_OIDC_GROUP_COUNT = 0 + # Enables / Disables deleting projects on this pagure instance ENABLE_DEL_PROJECTS = True diff --git a/pagure/templates/master.html b/pagure/templates/master.html index 70524b6..4e2bc55 100644 --- a/pagure/templates/master.html +++ b/pagure/templates/master.html @@ -39,6 +39,8 @@ {% if (config.get('ENABLE_NEW_PROJECTS', True) and config.get('ENABLE_UI_NEW_PROJECTS', True)) or config.get('ENABLE_GROUP_MNGT', False) %} + {#can_create is only defined if using OIDC so assume we cancreate #} + {% if (g.fas_user.can_create is not defined) or (g.fas_user.can_create is true)%}
    • {% endif %} + {% endif %}