new release: 0.7.13-beta

add New fields for
 - assertion_valid_not_before
 - assertion_valid_not_on_or_after
 - session_valid_not_on_or_after
allow flexible time durations for these fields
fall back to Provider's ACS if none is specified in AuthNRequest

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.6.7-beta
+current_version = 0.7.13-beta
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
@@ -15,13 +15,11 @@ values =
 	beta
 	stable
 
-[bumpversion:file:helm/passbook/values.yaml]
+[bumpversion:file:helm/values.yaml]
 
-[bumpversion:file:helm/passbook/Chart.yaml]
+[bumpversion:file:helm/Chart.yaml]
 
-[bumpversion:file:.gitlab-ci.yml]
+[bumpversion:file:.github/workflows/release.yml]
 
 [bumpversion:file:passbook/__init__.py]
 
-[bumpversion:file:docker/nginx.conf]
-

.coveragerc

@@ -21,6 +21,7 @@ exclude_lines =
     def __str__
     def __repr__
     if self\.debug
+    if TYPE_CHECKING
 
     # Don't complain if tests don't hit defensive assertion code:
     raise AssertionError

.github/workflows/ci.yml

@@ -0,0 +1,147 @@
+name: passbook-ci
+on:
+  - push
+env:
+  POSTGRES_DB: passbook
+  POSTGRES_USER: passbook
+  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+
+jobs:
+  # Linting
+  pylint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Lint with pylint
+        run: pipenv run pylint passbook
+  black:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Lint with black
+        run: pipenv run black --check passbook
+  prospector:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Lint with prospector
+        run: pipenv run prospector
+  bandit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Lint with bandit
+        run: pipenv run bandit -r passbook
+  # Actual CI tests
+  migrations:
+    needs:
+      - pylint
+      - black
+      - prospector
+    services:
+      postgres:
+        image: postgres:latest
+        env:
+          POSTGRES_DB: passbook
+          POSTGRES_USER: passbook
+          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+        ports:
+          - 5432:5432
+      redis:
+        image: redis:latest
+        ports:
+          - 6379:6379
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Run migrations
+        run: pipenv run ./manage.py migrate
+  coverage:
+    needs:
+      - pylint
+      - black
+      - prospector
+    services:
+      postgres:
+        image: postgres:latest
+        env:
+          POSTGRES_DB: passbook
+          POSTGRES_USER: passbook
+          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+        ports:
+          - 5432:5432
+      redis:
+        image: redis:latest
+        ports:
+          - 6379:6379
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-python@v1
+        with:
+          python-version: '3.8'
+      - uses: actions/cache@v1
+        with:
+          path: ~/.local/share/virtualenvs/
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('Pipfile.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-pipenv-
+      - name: Install dependencies
+        run: pip install -U pip pipenv && pipenv install --dev
+      - name: Run coverage
+        run: pipenv run ./scripts/coverage.sh

.github/workflows/release.yml

@@ -0,0 +1,89 @@
+name: passbook-release
+on:
+  release
+
+jobs:
+  # Build
+  build-server:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: docker build
+          --no-cache
+          -t beryju/passbook:0.7.13-beta
+          -t beryju/passbook:latest
+          -f Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/passbook:0.7.13-beta
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/passbook:latest
+  build-gatekeeper:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: |
+          cd gatekeeper
+          docker build \
+          --no-cache \
+          -t beryju/passbook-gatekeeper:0.7.13-beta \
+          -t beryju/passbook-gatekeeper:latest \
+          -f Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/passbook-gatekeeper:0.7.13-beta
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/passbook-gatekeeper:latest
+  build-static:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:latest
+        env:
+          POSTGRES_DB: passbook
+          POSTGRES_USER: passbook
+          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+      redis:
+        image: redis:latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: docker build
+          --no-cache
+          --network=$(docker network ls | grep github | awk '{print $1}')
+          -t beryju/passbook-static:0.7.13-beta
+          -t beryju/passbook-static:latest
+          -f static.Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/passbook-static:0.7.13-beta
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/passbook-static:latest
+  test-release:
+    needs:
+      - build-server
+      - build-static
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Run test suite in final docker images
+        run: |
+          export PASSBOOK_DOMAIN=localhost
+          docker-compose pull
+          docker-compose up --no-start
+          docker-compose start postgresql redis
+          docker-compose run -u root server bash -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test"

.github/workflows/tag.yml

@@ -0,0 +1,60 @@
+on:
+  push:
+    tags:
+    - 'version/*'
+
+name: passbook-version-tag
+
+jobs:
+  build:
+    name: Create Release from Tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Pre-release test
+        run: |
+          export PASSBOOK_DOMAIN=localhost
+          docker-compose pull
+          docker build \
+            --no-cache \
+            -t beryju/passbook:latest \
+            -f Dockerfile .
+          docker-compose up --no-start
+          docker-compose start postgresql redis
+          docker-compose run -u root server bash -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test"
+      - name: Install Helm
+        run: |
+          apt update && apt install -y curl
+          curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+      - name: Helm package
+        run: |
+          helm dependency update helm/
+          helm package helm/
+          mv passbook-*.tgz passbook-chart.tgz
+      - name: Extract verison number
+        id: get_version
+        uses: actions/github-script@0.2.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
+      - name: Create Release
+        id: create_release
+        uses: actions/create-release@v1.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: Release ${{ steps.get_version.outputs.result }}
+          draft: false
+          prerelease: false
+      - name: Upload packaged Helm Chart
+        id: upload-release-asset
+        uses: actions/upload-release-asset@v1.0.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: ./passbook-chart.tgz
+          asset_name: passbook-chart.tgz
+          asset_content_type: application/gzip

.gitignore

@@ -63,6 +63,7 @@ coverage.xml
 *.cover
 .hypothesis/
 .pytest_cache/
+unittest.xml
 
 # Translations
 *.mo
@@ -184,7 +185,6 @@ dmypy.json
 [Ii]nclude
 [Ll]ib64
 [Ll]ocal
-[Ss]cripts
 pyvenv.cfg
 pip-selfcheck.json
 
@@ -192,3 +192,7 @@ pip-selfcheck.json
 /static/
 local.env.yml
 .vscode/
+
+### Helm ###
+# Chart dependencies
+**/charts/*.tgz

.gitlab-ci.yml

@@ -1,135 +0,0 @@
-# Global Variables
-stages:
-  - build-base-image
-  - build-dev-image
-  - test
-  - build
-  - package
-image: docker.beryju.org/passbook/dev:latest
-
-variables:
-  POSTGRES_DB: passbook
-  POSTGRES_USER: passbook
-  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-
-before_script:
-  - pip install pipenv
-  # Ensure all dependencies are installed, even those not included in passbook/dev
-  # According to pipenv docs, -d outputs all packages, however it actually does not
-  - pipenv lock -r > requirements-all.txt
-  - pipenv lock -rd >> requirements-all.txt
-  - pip install -r requirements-all.txt
-
-create-base-image:
-  image:
-    name: gcr.io/kaniko-project/executor:debug
-    entrypoint: [""]
-  before_script:
-    - echo "{\"auths\":{\"docker.beryju.org\":{\"auth\":\"$DOCKER_AUTH\"}}}" > /kaniko/.docker/config.json
-  script:
-    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/base.Dockerfile --destination docker.beryju.org/passbook/base:latest
-  stage: build-base-image
-  only:
-    refs:
-      - tags
-      - /^version/.*$/
-
-build-dev-image:
-  image:
-    name: gcr.io/kaniko-project/executor:debug
-    entrypoint: [""]
-  before_script:
-    - echo "{\"auths\":{\"docker.beryju.org\":{\"auth\":\"$DOCKER_AUTH\"}}}" > /kaniko/.docker/config.json
-  script:
-    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/dev.Dockerfile --destination docker.beryju.org/passbook/dev:latest
-  stage: build-dev-image
-  only:
-    refs:
-      - tags
-      - /^version/.*$/
-
-
-isort:
-  script:
-    - isort -c -sg env
-  stage: test
-  services:
-  - postgres:latest
-  - redis:latest
-migrations:
-  script:
-    - python manage.py migrate
-  stage: test
-  services:
-  - postgres:latest
-  - redis:latest
-# prospector:
-#   script:
-#     - prospector
-#   stage: test
-#   services:
-#   - postgres:latest
-#   - redis:latest
-pylint:
-  script:
-    - pylint passbook
-  stage: test
-  services:
-  - postgres:latest
-  - redis:latest
-coverage:
-  script:
-    - coverage run manage.py test
-    - coverage report
-    - coverage html
-  stage: test
-  services:
-  - postgres:latest
-  - redis:latest
-
-build-passbook-server:
-  stage: build
-  image:
-    name: gcr.io/kaniko-project/executor:debug
-    entrypoint: [""]
-  before_script:
-    - echo "{\"auths\":{\"docker.beryju.org\":{\"auth\":\"$DOCKER_AUTH\"}}}" > /kaniko/.docker/config.json
-  script:
-    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination docker.beryju.org/passbook/server:latest --destination docker.beryju.org/passbook/server:0.6.7-beta
-  only:
-    - tags
-    - /^version/.*$/
-build-passbook-static:
-  stage: build
-  image:
-    name: gcr.io/kaniko-project/executor:debug
-    entrypoint: [""]
-  before_script:
-    - echo "{\"auths\":{\"docker.beryju.org\":{\"auth\":\"$DOCKER_AUTH\"}}}" > /kaniko/.docker/config.json
-  script:
-    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/static.Dockerfile --destination docker.beryju.org/passbook/static:latest --destination docker.beryju.org/passbook/static:0.6.7-beta
-  only:
-    - tags
-    - /^version/.*$/
-  # running collectstatic fully initialises django, hence we need that databases
-  services:
-    - postgres:latest
-    - redis:latest
-
-package-helm:
-  image: debian:stretch-slim
-  stage: package
-  before_script:
-    - apt update && apt install -y curl
-    - curl https://raw.githubusercontent.com/helm/helm/master/scripts/get | bash
-  script:
-    - helm init --client-only
-    - helm dependency update helm/passbook
-    - helm package helm/passbook
-  artifacts:
-    paths:
-      - passbook-*.tgz
-    expire_in: 1 week
-  only:
-    - tags
-    - /^version/.*$/

.pylintrc

@@ -1,6 +1,6 @@
 [MASTER]
 
-disable=redefined-outer-name,arguments-differ,no-self-use,cyclic-import,fixme,locally-disabled,unpacking-non-sequence,too-many-ancestors,too-many-branches,too-few-public-methods
+disable=redefined-outer-name,arguments-differ,no-self-use,cyclic-import,fixme,locally-disabled,unpacking-non-sequence,too-many-ancestors,too-many-branches,too-few-public-methods,import-outside-toplevel,bad-continuation
 load-plugins=pylint_django,pylint.extensions.bad_builtin
 extension-pkg-whitelist=lxml
 const-rgx=[a-zA-Z0-9_]{1,40}$

Dockerfile

@@ -1,4 +1,26 @@
-FROM docker.beryju.org/passbook/base:latest
+FROM python:3.8-slim-buster as locker
+
+COPY ./Pipfile /app/
+COPY ./Pipfile.lock /app/
+
+WORKDIR /app/
+
+RUN pip install pipenv && \
+    pipenv lock -r > requirements.txt && \
+    pipenv lock -rd > requirements-dev.txt
+
+FROM python:3.8-slim-buster
+
+COPY --from=locker /app/requirements.txt /app/
+COPY --from=locker /app/requirements-dev.txt /app/
+
+WORKDIR /app/
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends postgresql-client-11 && \
+    rm -rf /var/lib/apt/ && \
+    pip install -r requirements.txt  --no-cache-dir && \
+    adduser --system --no-create-home --uid 1000 --group --home /app passbook
 
 COPY ./passbook/ /app/passbook
 COPY ./manage.py /app/

Pipfile

@@ -4,51 +4,58 @@ url = "https://pypi.org/simple"
 verify_ssl = true
 
 [packages]
+boto3 = "*"
 celery = "*"
-cherrypy = "*"
 defusedxml = "*"
 django = "*"
-kombu = "==4.5.0"
 django-cors-middleware = "*"
-django-filters = "*"
-django-ipware = "*"
+django-dbbackup = "*"
+django-filter = "*"
+django-guardian = "*"
 django-model-utils = "*"
 django-oauth-toolkit = "*"
 django-oidc-provider = "*"
 django-otp = "*"
+django-prometheus = "*"
 django-recaptcha = "*"
 django-redis = "*"
 django-rest-framework = "*"
+django-storages = "*"
+djangorestframework-guardian = "*"
 drf-yasg = "*"
+kombu = "*"
 ldap3 = "*"
 lxml = "*"
-markdown = "*"
 oauthlib = "*"
 packaging = "*"
 psycopg2-binary = "*"
 pycryptodome = "*"
+pyuwsgi = "*"
 pyyaml = "*"
 qrcode = "*"
 requests-oauthlib = "*"
 sentry-sdk = "*"
 service_identity = "*"
 signxml = "*"
-urllib3 = {extras = ["secure"],version = "*"}
 structlog = "*"
-pyuwsgi = "*"
+swagger-spec-validator = "*"
+urllib3 = {extras = ["secure"],version = "*"}
 
 [requires]
-python_version = "3.7"
+python_version = "3.8"
 
 [dev-packages]
-coverage = "*"
-isort = "*"
-pylint = "==2.3.1"
-pylint-django = "*"
-prospector = "*"
-django-debug-toolbar = "*"
-bumpversion = "*"
-unittest-xml-reporting = "*"
 autopep8 = "*"
 bandit = "*"
+bumpversion = "*"
 colorama = "*"
+coverage = "*"
+django-debug-toolbar = "*"
+prospector = "*"
+pylint = "*"
+pylint-django = "*"
+unittest-xml-reporting = "*"
+black = "*"
+
+[pipenv]
+allow_prereleases = true

README.md

@@ -1,9 +1,13 @@
 # passbook
 
+![](https://github.com/BeryJu/passbook/workflows/passbook-ci/badge.svg)
+
 ## Quick instance
 
 ```
 export PASSBOOK_DOMAIN=domain.tld
+# Optionally enable Error-reporting
+# export PASSBOOK_ERROR_REPORTING=true
 docker-compose pull
 docker-compose up -d
 docker-compose exec server ./manage.py migrate

base.Dockerfile

@@ -1,20 +0,0 @@
-FROM python:3.7-slim-buster as locker
-
-COPY ./Pipfile /app/
-COPY ./Pipfile.lock /app/
-
-WORKDIR /app/
-
-RUN pip install pipenv && \
-    pipenv lock -r > requirements.txt && \
-    pipenv lock -rd > requirements-dev.txt
-
-FROM python:3.7-slim-buster
-
-COPY --from=locker /app/requirements.txt /app/
-COPY --from=locker /app/requirements-dev.txt /app/
-
-WORKDIR /app/
-
-RUN pip install -r requirements.txt  --no-cache-dir && \
-    adduser --system --no-create-home --uid 1000 --group --home /app passbook

dev.Dockerfile

@@ -1,3 +0,0 @@
-FROM docker.beryju.org/passbook/base:latest
-
-RUN pip install -r /app/requirements-dev.txt  --no-cache-dir

docker-compose.yml

@@ -21,15 +21,14 @@ services:
     labels:
       - traefik.enable=false
   server:
-    build:
-      context: .
-    image: docker.beryju.org/passbook/server:${SERVER_TAG:-latest}
+    image: beryju/passbook:${SERVER_TAG:-latest}
     command:
       - uwsgi
       - uwsgi.ini
     environment:
       - PASSBOOK_DOMAIN=${PASSBOOK_DOMAIN}
       - PASSBOOK_REDIS__HOST=redis
+      - PASSBOOK_ERROR_REPORTING=${PASSBOOK_ERROR_REPORTING:-false}
       - PASSBOOK_POSTGRESQL__HOST=postgresql
       - PASSBOOK_POSTGRESQL__PASSWORD=${PG_PASS:-thisisnotagoodpassword}
     ports:
@@ -41,7 +40,7 @@ services:
       - traefik.docker.network=internal
       - traefik.frontend.rule=PathPrefix:/
   worker:
-    image: docker.beryju.org/passbook/server:${SERVER_TAG:-latest}
+    image: beryju/passbook:${SERVER_TAG:-latest}
     command:
       - celery
       - worker
@@ -57,18 +56,16 @@ services:
     environment:
       - PASSBOOK_DOMAIN=${PASSBOOK_DOMAIN}
       - PASSBOOK_REDIS__HOST=redis
+      - PASSBOOK_ERROR_REPORTING=${PASSBOOK_ERROR_REPORTING:-false}
       - PASSBOOK_POSTGRESQL__HOST=postgresql
       - PASSBOOK_POSTGRESQL__PASSWORD=${PG_PASS:-thisisnotagoodpassword}
   static:
-    build:
-      context: .
-      dockerfile: static.Dockerfile
-    image: docker.beryju.org/passbook/static:latest
+    image: beryju/passbook-static:latest
     networks:
       - internal
     labels:
       - traefik.frontend.rule=PathPrefix:/static, /robots.txt
-      - traefik.port=80
+      - traefik.port=8080
       - traefik.docker.network=internal
   traefik:
     image: traefik:1.7

docker/nginx.conf

@@ -1,66 +0,0 @@
-user  nginx;
-worker_processes  1;
-
-error_log  stderr warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  1024;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format json_combined escape=json
-        '{'
-            '"time_local":"$time_local",'
-            '"remote_addr":"$remote_addr",'
-            '"remote_user":"$remote_user",'
-            '"request":"$request",'
-            '"status": "$status",'
-            '"body_bytes_sent":"$body_bytes_sent",'
-            '"request_time":"$request_time",'
-            '"http_referrer":"$http_referer",'
-            '"http_user_agent":"$http_user_agent"'
-        '}';
-
-    access_log /dev/stdout json_combined;
-
-    sendfile        on;
-    tcp_nopush     on;
-
-    keepalive_timeout  65;
-
-    server {
-
-        server_name _;
-
-        gzip on;
-        gzip_types application/javascript image/* text/css;
-        gunzip on;
-        add_header X-passbook-Version 0.6.7-beta;
-        add_header Vary X-passbook-Version;
-        root /data/;
-
-        location /_/healthz {
-            return 204;
-        }
-        location ~* \.(jpg|jpeg|png|gif|ico)$ {
-            expires 30d;
-        }
-        location ~* \.(css|js)$ {
-            expires 7d;
-        }
-
-    }
-
-    server {
-
-        listen 8080;
-
-        location = /stub_status {
-            stub_status;
-        }
-    }
-}

docker/uwsgi.ini

@@ -1,6 +1,5 @@
 [uwsgi]
 http = 0.0.0.0:8000
-chdir = /app
 wsgi-file = passbook/root/wsgi.py
 processes = 2
 master = true
@@ -8,3 +7,4 @@ threads = 2
 enable-threads = true
 uid = passbook
 gid = passbook
+disable-logging=True

docs/Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.8-slim-buster as builder
+
+WORKDIR /mkdocs
+
+RUN pip install mkdocs mkdocs-material
+
+COPY docs/ docs
+COPY mkdocs.yml .
+
+RUN mkdocs build
+
+FROM nginx
+
+COPY --from=builder /mkdocs/site /usr/share/nginx/html

docs/factors.md

@@ -0,0 +1,23 @@
+# Factors
+
+A factor represents a single authenticating factor for a user. Common examples of this would be a password or an OTP. These factors can be combined in any order, and can be dynamically enabled using policies.
+
+## Password Factor
+
+This is the standard Password Factor. It allows you to select which Backend the password is checked with. here you can also specify which Policies are used to check the password. You can also specify which Factors a User has to pass to recover their account.
+
+## Dummy Factor
+
+This factor waits a random amount of time. Mostly used for debugging.
+
+## E-Mail Factor
+
+This factor is mostly for recovery, and used in conjunction with the Password Factor.
+
+## OTP Factor
+
+This is your typical One-Time Password implementation, compatible with Authy and Google Authenticator. You can enfore this Factor so that every user has to configure it, or leave it optional.
+
+## Captcha Factor
+
+While this factor doesn't really authenticate a user, it is part of the Authentication Flow. passbook uses Google's reCaptcha implementation.

docs/images/logo.svg

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<!-- Generator: Adobe Illustrator 19.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 512 512" style="enable-background:new 0 0 512 512;" xml:space="preserve">
+<path style="fill:#57565C;" d="M407,512H105C47.103,512,0,464.897,0,407V105C0,47.103,47.103,0,105,0h302
+	c57.897,0,105,47.103,105,105v302C512,464.897,464.897,512,407,512z"/>
+<path style="fill:#3E3D42;" d="M407,0H256v512h151c57.897,0,105-47.103,105-105V105C512,47.103,464.897,0,407,0z"/>
+<rect x="91" y="141" style="fill:#00C3FF;" width="330" height="44"/>
+<rect x="256" y="141" style="fill:#00AAF0;" width="165" height="44"/>
+<rect x="91" y="176" style="fill:#FFDC40;" width="330" height="44"/>
+<rect x="256" y="176" style="fill:#FFAB15;" width="165" height="44"/>
+<rect x="91" y="206" style="fill:#87E694;" width="330" height="44"/>
+<rect x="256" y="206" style="fill:#66CC70;" width="165" height="44"/>
+<path style="fill:#F2F2F2;" d="M421,381c0,8.284-6.716,15-15,15H106c-8.284,0-15-6.716-15-15v-85h89.997
+	c9.31,0,17.688,4.938,21.868,12.888C213.277,328.695,233.638,341,256,341s42.723-12.305,53.135-32.111
+	c4.18-7.95,12.559-12.889,21.868-12.889H421V381z"/>
+<path style="fill:#FF6849;" d="M421,266h-89.997c-20.487,0-39.041,11.085-48.423,28.929C277.369,304.842,267.185,311,256,311
+	s-21.369-6.158-26.58-16.071C220.038,277.085,201.484,266,180.997,266H91v-30h330V266z"/>
+<path style="fill:#F2F2F2;" d="M421,146H91v-15c0-8.284,6.716-15,15-15h300c8.284,0,15,6.716,15,15V146z"/>
+<path style="fill:#E5E5E5;" d="M331.003,296c-9.31,0-17.688,4.938-21.868,12.889C298.723,328.695,278.362,341,256,341v55h150
+	c8.284,0,15-6.716,15-15v-85H331.003z"/>
+<path style="fill:#FD4B2D;" d="M256,236v75c11.185,0,21.369-6.158,26.58-16.071C291.962,277.085,310.516,266,331.003,266H421v-30
+	H256z"/>
+<path style="fill:#E5E5E5;" d="M406,116H256v30h165v-15C421,122.716,414.284,116,406,116z"/>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+<g>
+</g>
+</svg>

docs/index.md

@@ -0,0 +1,31 @@
+# Welcome
+
+Welcome to the passbook Documentation. passbook is an open-source Identity Provider and Usermanagement software. It can be used as a central directory for users or customers and it can integrate with your existing Directory.
+
+passbook can also be used as part of an Application to facilitate User Enrollment, Password recovery and Social Login.
+
+passbook uses the following Terminology:
+
+### Policy
+
+A Policy is at a base level a yes/no gate. It will either evaluate to True or False depending on the Policy Kind and settings. For example, a "Group Membership Policy" evaluates to True if the User is member of the specified Group and False if not. This can be used to conditionally apply Factors and grant/deny access.
+
+### Provider
+
+A Provider is a way for other Applications to authenticate against passbook. Common Providers are OpenID Connect (OIDC) and SAML.
+
+### Source
+
+Sources are ways to get users into passbook. This might be an LDAP Connection to import Users from Active Directory, or an OAuth2 Connection to allow Social Logins.
+
+### Application
+
+An application links together Policies with a Provider, allowing you to control access. It also holds Information like UI Name, Icon and more.
+
+### Factors
+
+Factors represent Authentication Factors, like a Password or OTP. These Factors can be dynamically enabled using policies. This allows you to, for example, force users from a certain IP ranges to complete a Captcha to authenticate.
+
+### Property Mappings
+
+Property Mappings allow you to make Information available for external Applications. For example, if you want to login to AWS with passbook, you'd use Property Mappings to set the User's Roles based on their Groups.

docs/installation/docker-compose.md

@@ -0,0 +1,26 @@
+# docker-compose
+
+This installation Method is for test-setups and small-scale productive setups.
+
+## Prerequisites
+
+-   docker
+-   docker-compose
+
+## Install
+
+Download the latest `docker-compose.yml` from [here](https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml). Place it in a directory of your choice.
+
+passbook needs to know it's primary URL to create links in E-Mails and set cookies, so you have to run the following command:
+
+```
+export PASSBOOK_DOMAIN=domain.tld # this can be any domain or IP, it just needs to point to passbook.
+```
+
+The compose file references the current latest version, which can be overridden with the `SERVER_TAG` Environment variable.
+
+If you plan to use this setup for production, it is also advised to change the PostgreSQL Password by setting `PG_PASS` to a password of your choice.
+
+Now you can pull the Docker images needed by running `docker-compose pull`. After this has finished, run `docker-compose up -d` to start passbook.
+
+passbook will then be reachable on Port 80. You can optionally configure the packaged traefik to use Let's Encrypt for TLS Encryption.

docs/installation/install.md

@@ -0,0 +1,6 @@
+# Installation
+
+There are two supported ways to install passbook:
+
+-   [docker-compose](docker-compose.md) for test- or small productive setups
+-   [Kubernetes](./kubernetes.md) for larger Productive setups

docs/installation/kubernetes.md

@@ -0,0 +1,3 @@
+# Kubernetes
+
+For a mid to high-load Installation, Kubernetes is recommended. passbook is installed using a helm-chart.

docs/integrations/services/gitlab/index.md

@@ -0,0 +1,59 @@
+# GitLab Integration
+
+## What is GitLab
+
+From https://about.gitlab.com/what-is-gitlab/
+
+```
+GitLab is a complete DevOps platform, delivered as a single application. This makes GitLab unique and makes Concurrent DevOps possible, unlocking your organization from the constraints of a pieced together toolchain. Join us for a live Q&A to learn how GitLab can give you unmatched visibility and higher levels of efficiency in a single application across the DevOps lifecycle.
+```
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `gitlab.company` is the FQDN of the GitLab Install
+-   `passbook.company` is the FQDN of the passbook Install
+
+Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+
+-   ACS URL: `https://gitlab.company/users/auth/saml/callback`
+-   Audience: `https://gitlab.company`
+-   Issuer: `https://gitlab.company`
+
+You can of course use a custom Signing Certificate, and adjust the Assertion Length. To get the value for `idp_cert_fingerprint`, you can use a tool like [this](https://www.samltool.com/fingerprint.php).
+
+## GitLab Configuration
+
+Paste the following block in your `gitlab.rb` file, after replacing the placeholder values from above. The file is located in `/etc/gitlab`.
+
+```ruby
+gitlab_rails['omniauth_enabled'] = true
+gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
+gitlab_rails['omniauth_sync_email_from_provider'] = 'saml'
+gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
+gitlab_rails['omniauth_sync_profile_attributes'] = ['email']
+gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'saml'
+gitlab_rails['omniauth_block_auto_created_users'] = false
+gitlab_rails['omniauth_auto_link_saml_user'] = true
+gitlab_rails['omniauth_providers'] = [
+  {
+    name: 'saml',
+    args: {
+      assertion_consumer_service_url: 'https://gitlab.company/users/auth/saml/callback',
+      idp_cert_fingerprint: '4E:1E:CD:67:4A:67:5A:E9:6A:D0:3C:E6:DD:7A:F2:44:2E:76:00:6A',
+      idp_sso_target_url: 'https://passbook.company/application/saml/<passbook application slug>/login/',
+      issuer: 'https://gitlab.company',
+      name_identifier_format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+      attribute_statements: {
+        email: ['urn:oid:1.3.6.1.4.1.5923.1.1.1.6'],
+        first_name: ['urn:oid:2.5.4.3'],
+        nickname: ['urn:oid:2.16.840.1.113730.3.1.241']
+      }
+    },
+    label: 'passbook'
+  }
+]
+```
+
+Afterwards, either run `gitlab-ctl reconfigure` if you're running GitLab Omnibus, or restart the container if you're using the container.

docs/integrations/services/harbor/index.md

@@ -0,0 +1,28 @@
+# Harbor Integration
+
+## What is Harbor
+
+From https://goharbor.io
+
+```
+Harbor is an open source container image registry that secures images with role-based access control, scans images for vulnerabilities, and signs images as trusted. A CNCF Incubating project, Harbor delivers compliance, performance, and interoperability to help you consistently and securely manage images across cloud native compute platforms like Kubernetes and Docker.
+```
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `harbor.company` is the FQDN of the Harbor Install
+-   `passbook.company` is the FQDN of the passbook Install
+
+Create an application in passbook. Create an OpenID Provider with the following Parameters:
+
+-   Client Type: `Confidential`
+-   Response types: `code (Authorization Code Flow)`
+-   JWT Algorithm: `RS256`
+-   Redirect URIs: `https://harbor.company/c/oidc/callback`
+-   Scopes: `openid`
+
+## Harbor
+
+![](./harbor.png)

docs/integrations/services/rancher/index.md

@@ -0,0 +1,29 @@
+# Rancher Integration
+
+## What is Rancher
+
+From https://rancher.com/products/rancher
+
+```
+An Enterprise Platform for Managing Kubernetes Everywhere
+Rancher is a platform built to address the needs of the DevOps teams deploying applications with Kubernetes, and the IT staff responsible for delivering an enterprise-critical service.
+```
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `rancher.company` is the FQDN of the Rancher Install
+-   `passbook.company` is the FQDN of the passbook Install
+
+Create an application in passbook and note the slug, as this will be used later. Create a SAML Provider with the following Parameters:
+
+-   ACS URL: `https://rancher.company/v1-saml/adfs/saml/acs`
+-   Audience: `https://rancher.company/v1-saml/adfs/saml/metadata`
+-   Issuer: `passbook`
+
+You can of course use a custom Signing Certificate, and adjust the Assertion Length.
+
+## Rancher
+
+![](./rancher.png)

docs/integrations/services/sentry/index.md

@@ -0,0 +1,42 @@
+# Sentry Integration
+
+## What is Sentry
+
+From https://sentry.io
+
+```
+Sentry provides self-hosted and cloud-based error monitoring that helps all software
+teams discover, triage, and prioritize errors in real-time.
+
+One million developers at over fifty thousand companies already ship
+better software faster with Sentry. Won’t you join them?
+```
+
+## Preparation
+
+The following placeholders will be used:
+
+-   `sentry.company` is the FQDN of the Sentry Install
+-   `passbook.company` is the FQDN of the passbook Install
+
+Create an application in passbook. Create an OpenID Provider with the following Parameters:
+
+-   Client Type: `Confidential`
+-   Response types: `code (Authorization Code Flow)`
+-   JWT Algorithm: `RS256`
+-   Redirect URIs: `https://sentry.company/auth/sso/`
+-   Scopes: `openid email`
+
+## Sentry
+
+**This guide assumes you've installed Sentry using [getsentry/onpremise](https://github.com/getsentry/onpremise)**
+
+- Add `sentry-auth-oidc` to `onpremise/sentry/requirements.txt` (Create the file if it doesn't exist yet)
+- Add the following block to your `onpremise/sentry/sentry.conf.py`:
+```
+OIDC_ISSUER = "passbook"
+OIDC_CLIENT_ID = "<Client ID from passbook>"
+OIDC_CLIENT_SECRET = "<Client Secret from passbook>"
+OIDC_SCOPE = "openid email"
+OIDC_DOMAIN = "https://passbook.company/application/oidc/"
+```

docs/k8s/deployment.yml

@@ -0,0 +1,33 @@
+---
+apiVersion: apps/v1beta2
+kind: Deployment
+metadata:
+  name: passbook-docs
+  namespace: prod-passbook-docs
+  labels:
+    app.kubernetes.io/name: passbook-docs
+    app.kubernetes.io/managed-by: passbook-docs
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: passbook-docs
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: passbook-docs
+    spec:
+      containers:
+        - name: passbook-docs
+          image: "beryju/passbook-docs:latest"
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 10m
+              memory: 20Mi
+            requests:
+              cpu: 10m
+              memory: 20Mi

docs/k8s/ingress.yml

@@ -0,0 +1,21 @@
+---
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  labels:
+    app.kubernetes.io/name: passbook-docs
+  name: passbook-docs
+  namespace: prod-passbook-docs
+spec:
+  rules:
+    - host: docs.passbook.beryju.org
+      http:
+        paths:
+          - backend:
+              serviceName: passbook-docs-http
+              servicePort: http
+            path: /
+  tls:
+    - hosts:
+        - docs.passbook.beryju.org
+      secretName: passbook-docs-acme

docs/k8s/service.yml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: passbook-docs-http
+  namespace: prod-passbook-docs
+  labels:
+    app.kubernetes.io/name: passbook-docs
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: passbook-docs

docs/policies.md

@@ -0,0 +1,68 @@
+# Policies
+
+## Kinds
+
+There are two different Kind of policies, a Standard Policy and a Password Policy. Normal Policies just evaluate to True or False, and can be used everywhere. Password Policies apply when a Password is set (during User enrollment, Recovery or anywhere else). These policies can be used to apply Password Rules like length, etc. The can also be used to expire passwords after a certain amount of time.
+
+## Standard Policies
+
+---
+
+### Group-Membership Policy
+
+This policy evaluates to True if the current user is a Member of the selected group.
+
+### Reputation Policy
+
+passbook keeps track of failed login attempts by Source IP and Attempted Username. These values are saved as scores. Each failed login decreases the Score for the Client IP as well as the targeted Username by one.
+
+This policy can be used to for example prompt Clients with a low score to pass a Captcha before they can continue.
+
+### Field matcher Policy
+
+This policy allows you to evaluate arbitrary comparisons against the User instance. Currently supported fields are:
+
+-   Username
+-   E-Mail
+-   Name
+-   Is_active
+-   Date joined
+
+Any of the following operations are supported:
+
+-   Starts with
+-   Ends with
+-   Contains
+-   Regexp (standard Python engine)
+-   Exact
+
+### SSO Policy
+
+This policy evaluates to True if the current Authentication Flow has been initiated through an external Source, like OAuth and SAML.
+
+### Webhook Policy
+
+This policy allows you to send an arbitrary HTTP Request to any URL. You can then use JSONPath to extract the result you need.
+
+## Password Policies
+
+---
+
+### Password Policy
+
+This Policy allows you to specify Password rules, like Length and required Characters.
+The following rules can be set:
+
+-   Minimum amount of Uppercase Characters
+-   Minimum amount of Lowercase Characters
+-   Minimum amount of Symbols Characters
+-   Minimum Length
+-   Symbol charset (define which characters are counted as symbols)
+
+### Have I Been Pwned Policy
+
+This Policy checks the hashed Password against the [Have I Been Pwned](https://haveibeenpwned.com/) API. This only sends the first 5 characters of the hashed password. The remaining comparison is done within passbook.
+
+### Password-Expiry Policy
+
+This policy can enforce regular password rotation by expiring set Passwords after a finite amount of time. This forces users to set a new password.

docs/property-mappings.md

@@ -0,0 +1,21 @@
+# Property Mappings
+
+Property Mappings allow you to pass information to external Applications. For example, pass the current user's Groups as a SAML Parameter. Property Mappings are also used to map Source fields to passbook fields, for example when using LDAP.
+
+## SAML Property Mapping
+
+SAML Property Mappings allow you embed Information into the SAML AuthN Request. THis Information can then be used by the Application to assign permissions for example.
+
+You can find examples [here](integrations/)
+
+## LDAP Property Mapping
+
+LDAP Property Mappings are used when you define a LDAP Source. These Mappings define which LDAP Property maps to which passbook Property. By default, these mappings are created:
+
+-   Autogenerated LDAP Mapping: givenName -> first_name
+-   Autogenerated LDAP Mapping: mail -> email
+-   Autogenerated LDAP Mapping: name -> name
+-   Autogenerated LDAP Mapping: sAMAccountName -> username
+-   Autogenerated LDAP Mapping: sn -> last_name
+
+These are configured for the most common LDAP Setups.

docs/providers.md

@@ -0,0 +1,23 @@
+# Providers
+
+Providers allow external Applications to authenticate against passbook and use its User Information.
+
+## OpenID Provider
+
+This provider uses the commonly used OpenID Connect variation of OAuth2.
+
+## OAuth2 Provider
+
+This provider is slightly different than the OpenID Provider. While it uses the same basic OAuth2 Protocol, it provides a GitHub-compatible Endpoint. This allows you to integrate Applications, which don't support Custom OpenID Providers.
+The API exposes Username, E-Mail, Name and Groups in a GitHub-compatible format.
+
+## SAML Provider
+
+This provider allows you to integrate Enterprise Software using the SAML2 Protocol. It supports signed Requests. This Provider also has [Property Mappings](property-mappings.md#saml-property-mapping), which allows you to expose Vendor-specific Fields.
+Default fields are:
+
+-   `eduPersonPrincipalName`: User's E-Mail
+-   `cn`: User's Full Name
+-   `mail`: User's E-Mail
+-   `displayName`: User's Username
+-   `uid`: User Unique Identifier

docs/sources.md

@@ -0,0 +1,39 @@
+# Sources
+
+Sources allow you to connect passbook to an existing User directory. They can also be used for Social-Login, using external Providers like Facebook, Twitter, etc.
+
+## Generic OAuth Source
+
+**All Integration-specific Sources are documented in the Integrations Section**
+
+This source allows users to enroll themselves with an External OAuth-based Identity Provider. The Generic Provider expects the Endpoint to return OpenID-Connect compatible Information. Vendor specific Implementations have their own OAuth Source.
+
+-   Policies: Allow/Forbid Users from linking their Accounts with this Provider
+-   Request Token URL: This field is used for OAuth v1 Implementations and will be provided by the Provider.
+-   Authorization URL: This value will be provided by the Provider.
+-   Access Token URL: This value will be provided by the Provider.
+-   Profile URL: This URL is called by passbook to retrieve User information upon successful authentication.
+-   Consumer key/Consumer secret: These values will be provided by the Provider.
+
+## SAML Source
+
+This source allows passbook to act as a SAML Service Provider. Just like the SAML Provider, it supports signed Requests. Vendor specific documentation can be found in the Integrations Section
+
+## LDAP Source
+
+This source allows you to import Users and Groups from an LDAP Server
+
+-   Server URI: URI to your LDAP Server/Domain Controller
+-   Bind CN: CN to bind as, this can also be a UPN in the format of `user@domain.tld`
+-   Bind password: Password used during the bind process
+-   Enable Start TLS: Enables StartTLS functionality. To use SSL instead, use port `636`
+-   Base DN: Base DN used for all LDAP queries
+-   Addition User DN: Prepended to Base DN for User-queries.
+-   Addition Group DN: Prepended to Base DN for Group-queries.
+-   User object filter: Consider Objects matching this filter to be Users.
+-   Group object filter: Consider Objects matching this filter to be Groups.
+-   User group membership field: Field which contains Groups of user.
+-   Object uniqueness field: Field which contains a unique Identifier.
+-   Sync groups: Enable/disable Group synchronization. Groups are synced in the background every 5 minutes.
+-   Sync parent group: Optionally set this Group as parent Group for all synced Groups (allows you to, for example, import AD Groups under a root `imported-from-ad` group.)
+-   Property mappings: Define which LDAP Properties map to which passbook Properties. The default set of Property Mappings is generated for Active Directory. See also [LDAP Property Mappings](property-mappings.md#ldap-property-mapping)

gatekeeper/Dockerfile

@@ -0,0 +1,8 @@
+FROM quay.io/pusher/oauth2_proxy
+
+COPY templates /templates
+
+ENV OAUTH2_PROXY_EMAIL_DOMAINS=*
+ENV OAUTH2_PROXY_PROVIDER=oidc
+ENV OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR=/templates
+ENV OAUTH2_PROXY_HTTP_ADDRESS=:4180

gatekeeper/templates/error.html

@@ -0,0 +1,18 @@
+{{define "error.html"}}
+<!DOCTYPE html>
+<html lang="en" charset="utf-8">
+
+<head>
+    <title>{{.Title}}</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+</head>
+
+<body>
+    <h2>{{.Title}}</h2>
+    <p>{{.Message}}</p>
+    <hr>
+    <p><a href="{{.ProxyPrefix}}/sign_in">Sign In</a></p>
+</body>
+
+</html>
+{{end}}

gatekeeper/templates/sign_in.html

@@ -0,0 +1,119 @@
+{{define "sign_in.html"}}
+<!DOCTYPE html>
+<html lang="en" charset="utf-8">
+<head>
+    <title>Sign In with passbook</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
+    <style>
+        body {
+            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+            font-size: 14px;
+            line-height: 1.42857143;
+            color: #333;
+            background: #f0f0f0;
+        }
+
+        .signin {
+            display: block;
+            margin: 20px auto;
+            max-width: 400px;
+            background: #fff;
+            border: 1px solid #ccc;
+            border-radius: 10px;
+            padding: 20px;
+        }
+
+        .center {
+            text-align: center;
+        }
+
+        .btn {
+            color: #fff;
+            background-color: #428bca;
+            border: 1px solid #357ebd;
+            -webkit-border-radius: 4;
+            -moz-border-radius: 4;
+            border-radius: 4px;
+            font-size: 14px;
+            padding: 6px 12px;
+            text-decoration: none;
+            cursor: pointer;
+        }
+
+        .btn:hover {
+            background-color: #3071a9;
+            border-color: #285e8e;
+            text-decoration: none;
+        }
+
+        label {
+            display: inline-block;
+            max-width: 100%;
+            margin-bottom: 5px;
+            font-weight: 700;
+        }
+
+        input {
+            display: block;
+            width: 100%;
+            height: 34px;
+            padding: 6px 12px;
+            font-size: 14px;
+            line-height: 1.42857143;
+            color: #555;
+            background-color: #fff;
+            background-image: none;
+            border: 1px solid #ccc;
+            border-radius: 4px;
+            -webkit-box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
+            box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
+            -webkit-transition: border-color ease-in-out .15s, -webkit-box-shadow ease-in-out .15s;
+            -o-transition: border-color ease-in-out .15s, box-shadow ease-in-out .15s;
+            transition: border-color ease-in-out .15s, box-shadow ease-in-out .15s;
+            margin: 0;
+            box-sizing: border-box;
+        }
+
+        footer {
+            display: block;
+            font-size: 10px;
+            color: #aaa;
+            text-align: center;
+            margin-bottom: 10px;
+        }
+
+        footer a {
+            display: inline-block;
+            height: 25px;
+            line-height: 25px;
+            color: #aaa;
+            text-decoration: underline;
+        }
+
+        footer a:hover {
+            color: #aaa;
+        }
+    </style>
+</head>
+
+<body>
+    <div class="signin center">
+        <form method="GET" action="{{.ProxyPrefix}}/start">
+            <input type="hidden" name="rd" value="{{.Redirect}}">
+            <button type="submit" class="btn">Sign in with passbook</button><br />
+        </form>
+    </div>
+    <script>
+        if (window.location.hash) {
+            (function () {
+                var inputs = document.getElementsByName('rd');
+                for (var i = 0; i < inputs.length; i++) {
+                    inputs[i].value += window.location.hash;
+                }
+            })();
+        }
+    </script>
+</body>
+
+</html>
+{{end}}

helm/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: postgresql
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 4.2.2
+  version: 6.5.8
 - name: redis
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 9.2.1
-digest: sha256:8782e974a1094eaeecf1d68f093ca4fb84977217b2bd38b09790a05ec289aec2
-generated: "2019-10-02T21:03:25.90491153Z"
+  version: 9.5.1
+digest: sha256:f18b5dc8d0be13d584407405c60d10b6b84d25f7fa8aaa3dd0e5385c38f5c516
+generated: "2019-12-14T13:33:48.4341939Z"

helm/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-appVersion: "0.6.7-beta"
+appVersion: "0.7.13-beta"
 description: A Helm chart for passbook.
 name: passbook
-version: "0.6.7-beta"
+version: "0.7.13-beta"
 icon: https://git.beryju.org/uploads/-/system/project/avatar/108/logo.png

helm/requirements.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: postgresql
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 6.3.10
+  version: 6.5.8
 - name: redis
   repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 9.2.1
-digest: sha256:bdde250e1401dccdd5161e39c807f9e88b05e3e8e72e74df767a1bbb5fc39a4a
-generated: "2019-10-01T10:46:06.542706+02:00"
+  version: 9.5.1
+digest: sha256:476834fb82f66bc7242c4a5e7343d0a859d8307cb301256beb0eb749983014e4
+generated: "2019-11-07T10:21:30.902415+01:00"

helm/requirements.yaml

@@ -1,7 +1,7 @@
 dependencies:
 - name: postgresql
-  version: 4.2.2
+  version: 6.5.8
   repository: https://kubernetes-charts.storage.googleapis.com/
 - name: redis
-  version: 9.2.1
+  version: 9.5.1
   repository: https://kubernetes-charts.storage.googleapis.com/

helm/templates/configmap.yaml

@@ -12,5 +12,5 @@ data:
       host: "{{ .Release.Name }}-redis-master"
       cache_db: 0
       message_queue_db: 1
-    error_report_enabled: {{ .Values.config.error_reporting }}
-    domain: ".{{ .Values.ingress.hosts[0] }}"
+    error_reporting: {{ .Values.config.error_reporting }}
+    domain: ".{{ index .Values.ingress.hosts 0 }}"

helm/templates/prom-rules.yaml

@@ -0,0 +1,121 @@
+{{- if .Values.monitoring.enabled -}}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ include "passbook.fullname" . }}-static-rules
+  labels:
+    app.kubernetes.io/name: {{ include "passbook.name" . }}
+    helm.sh/chart: {{ include "passbook.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+  groups:
+  - name: Aggregate request counters
+    rules:
+      - record: job:django_http_requests_before_middlewares_total:sum_rate30s
+        expr: sum(rate(django_http_requests_before_middlewares_total[30s])) by (job)
+      - record: job:django_http_requests_unknown_latency_total:sum_rate30s
+        expr: sum(rate(django_http_requests_unknown_latency_total[30s])) by (job)
+      - record: job:django_http_ajax_requests_total:sum_rate30s
+        expr: sum(rate(django_http_ajax_requests_total[30s])) by (job)
+      - record: job:django_http_responses_before_middlewares_total:sum_rate30s
+        expr: sum(rate(django_http_responses_before_middlewares_total[30s])) by (job)
+      - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
+        expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s])) by (job)
+      - record: job:django_http_requests_body_total_bytes:sum_rate30s
+        expr: sum(rate(django_http_requests_body_total_bytes[30s])) by (job)
+      - record: job:django_http_responses_streaming_total:sum_rate30s
+        expr: sum(rate(django_http_responses_streaming_total[30s])) by (job)
+      - record: job:django_http_responses_body_total_bytes:sum_rate30s
+        expr: sum(rate(django_http_responses_body_total_bytes[30s])) by (job)
+      - record: job:django_http_requests_total:sum_rate30s
+        expr: sum(rate(django_http_requests_total_by_method[30s])) by (job)
+      - record: job:django_http_requests_total_by_method:sum_rate30s
+        expr: sum(rate(django_http_requests_total_by_method[30s])) by (job,method)
+      - record: job:django_http_requests_total_by_transport:sum_rate30s
+        expr: sum(rate(django_http_requests_total_by_transport[30s])) by (job,transport)
+      - record: job:django_http_requests_total_by_view:sum_rate30s
+        expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view)
+      - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
+        expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view,transport,method)
+      - record: job:django_http_responses_total_by_templatename:sum_rate30s
+        expr: sum(rate(django_http_responses_total_by_templatename[30s])) by (job,templatename)
+      - record: job:django_http_responses_total_by_status:sum_rate30s
+        expr: sum(rate(django_http_responses_total_by_status[30s])) by (job,status)
+      - record: job:django_http_responses_total_by_status_name_method:sum_rate30s
+        expr: sum(rate(django_http_responses_total_by_status_name_method[30s])) by (job,status,name,method)
+      - record: job:django_http_responses_total_by_charset:sum_rate30s
+        expr: sum(rate(django_http_responses_total_by_charset[30s])) by (job,charset)
+      - record: job:django_http_exceptions_total_by_type:sum_rate30s
+        expr: sum(rate(django_http_exceptions_total_by_type[30s])) by (job,type)
+      - record: job:django_http_exceptions_total_by_view:sum_rate30s
+        expr: sum(rate(django_http_exceptions_total_by_view[30s])) by (job,view)
+  - name: Aggregate latency histograms
+    rules:
+      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+        expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "50"
+      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+        expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "95"
+      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+        expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "99"
+      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
+        expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "99.9"
+      - record: job:django_http_requests_latency_seconds:quantile_rate30s
+        expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "50"
+      - record: job:django_http_requests_latency_seconds:quantile_rate30s
+        expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "95"
+      - record: job:django_http_requests_latency_seconds:quantile_rate30s
+        expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "99"
+      - record: job:django_http_requests_latency_seconds:quantile_rate30s
+        expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
+        labels:
+          quantile: "99.9"
+  - name: Aggregate model operations
+    rules:
+      - record: job:django_model_inserts_total:sum_rate1m
+        expr: sum(rate(django_model_inserts_total[1m])) by (job, model)
+      - record: job:django_model_updates_total:sum_rate1m
+        expr: sum(rate(django_model_updates_total[1m])) by (job, model)
+      - record: job:django_model_deletes_total:sum_rate1m
+        expr: sum(rate(django_model_deletes_total[1m])) by (job, model)
+  - name: Aggregate database operations
+    rules:
+      - record: job:django_db_new_connections_total:sum_rate30s
+        expr: sum(rate(django_db_new_connections_total[30s])) by (alias, vendor)
+      - record: job:django_db_new_connection_errors_total:sum_rate30s
+        expr: sum(rate(django_db_new_connection_errors_total[30s])) by (alias, vendor)
+      - record: job:django_db_execute_total:sum_rate30s
+        expr: sum(rate(django_db_execute_total[30s])) by (alias, vendor)
+      - record: job:django_db_execute_many_total:sum_rate30s
+        expr: sum(rate(django_db_execute_many_total[30s])) by (alias, vendor)
+      - record: job:django_db_errors_total:sum_rate30s
+        expr: sum(rate(django_db_errors_total[30s])) by (alias, vendor, type)
+  - name: Aggregate migrations
+    rules:
+      - record: job:django_migrations_applied_total:max
+        expr: max(django_migrations_applied_total) by (job, connection)
+      - record: job:django_migrations_unapplied_total:max
+        expr: max(django_migrations_unapplied_total) by (job, connection)
+  - name: Alerts
+    rules:
+      - alert: UnappliedMigrations
+        expr: job:django_migrations_unapplied_total:max > 0
+        for: 1m
+        labels:
+          severity: testing
+{{- end }}

helm/templates/secret.yaml

@@ -4,6 +4,7 @@ type: Opaque
 metadata:
   name: {{ include "passbook.fullname" . }}-secret-key
 data:
+  monitoring_username: bW9uaXRvcg== # monitor in base64
   {{- if .Values.config.secret_key }}
   secret_key: {{ .Values.config.secret_key | b64enc | quote }}
   {{- else }}

helm/templates/static-deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "passbook.fullname" . }}-static
@@ -18,30 +18,26 @@ spec:
         app.kubernetes.io/name: {{ include "passbook.name" . }}
         app.kubernetes.io/instance: {{ .Release.Name }}
         k8s.passbook.io/component: static
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: '9113'
-        field.cattle.io/workloadMetrics: '[{"path":"/metrics","port":9113,"schema":"HTTP"}]'
     spec:
       containers:
         - name: {{ .Chart.Name }}-static
-          image: "docker.beryju.org/passbook/static:{{ .Values.image.tag }}"
+          image: "beryju/passbook-static:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
-              containerPort: 80
+              containerPort: 8080
               protocol: TCP
           livenessProbe:
             initialDelaySeconds: 10
             timeoutSeconds: 5
             httpGet:
-              path: /_/healthz
+              path: /-/ping
               port: http
           readinessProbe:
             initialDelaySeconds: 10
             timeoutSeconds: 5
             httpGet:
-              path: /_/healthz
+              path: /-/ping
               port: http
           resources:
             requests:
@@ -50,6 +46,3 @@ spec:
             limits:
               cpu: 20m
               memory: 20M
-        - name: {{ .Chart.Name }}-static-prometheus
-          image: nginx/nginx-prometheus-exporter:0.4.1
-          imagePullPolicy: IfNotPresent

helm/templates/static-service.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   type: ClusterIP
   ports:
-    - port: 80
+    - port: 8080
       targetPort: http
       protocol: TCP
       name: http

helm/templates/static-sm.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.monitoring.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ include "passbook.name" . }}
+    helm.sh/chart: {{ include "passbook.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  name: {{ include "passbook.fullname" . }}-static-monitoring
+spec:
+  endpoints:
+  - port: http
+  selector:
+    matchLabels:
+      k8s.passbook.io/component: static
+{{- end }}

helm/templates/web-deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "passbook.fullname" . }}-web
@@ -26,7 +26,7 @@ spec:
             name: {{ include "passbook.fullname" . }}-config
       initContainers:
         - name: passbook-database-migrations
-          image: "docker.beryju.org/passbook/server:{{ .Values.image.tag }}"
+          image: "beryju/passbook:{{ .Values.image.tag }}"
           command:
             - ./manage.py
           args:
@@ -56,7 +56,7 @@ spec:
                   key: postgresql-password
       containers:
         - name: {{ .Chart.Name }}
-          image: "docker.beryju.org/passbook/server:{{ .Values.image.tag }}"
+          image: "beryju/passbook:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
           command:
             - uwsgi

helm/templates/web-service.yaml

@@ -4,13 +4,14 @@ metadata:
   name: {{ include "passbook.fullname" . }}-web
   labels:
     app.kubernetes.io/name: {{ include "passbook.name" . }}
-    helm.sh/chart: {{ include "passbook.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "passbook.chart" . }}
+    k8s.passbook.io/component: web
 spec:
-  type: {{ .Values.service.type }}
+  type: ClusterIP
   ports:
-    - port: {{ .Values.service.port }}
+    - port: 80
       targetPort: http
       protocol: TCP
       name: http

helm/templates/web-sm.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.monitoring.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ include "passbook.name" . }}
+    helm.sh/chart: {{ include "passbook.chart" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+  name: {{ include "passbook.fullname" . }}-web-monitoring
+spec:
+  endpoints:
+  - basicAuth:
+      password:
+        name: {{ include "passbook.fullname" . }}-secret-key
+        key: secret_key
+      username:
+        name: {{ include "passbook.fullname" . }}-secret-key
+        key: monitoring_username
+    port: http
+    path: /metrics/
+    interval: 10s
+  selector:
+    matchLabels:
+      k8s.passbook.io/component: web
+{{- end }}

helm/templates/worker-deployment.yaml

@@ -1,4 +1,4 @@
-apiVersion: apps/v1beta2
+apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "passbook.fullname" . }}-worker
@@ -26,7 +26,7 @@ spec:
             name: {{ include "passbook.fullname" . }}-config
       containers:
         - name: {{ .Chart.Name }}
-          image: "docker.beryju.org/passbook/server:{{ .Values.image.tag }}"
+          image: "beryju/passbook:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
           command:
             - celery

helm/values.yaml

@@ -2,7 +2,7 @@
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 image:
-  tag: 0.6.7-beta
+  tag: 0.7.13-beta
 
 nameOverride: ""
 
@@ -10,23 +10,14 @@ config:
   # Optionally specify fixed secret_key, otherwise generated automatically
   # secret_key: _k*@6h2u2@q-dku57hhgzb7tnx*ba9wodcb^s9g0j59@=y(@_o
   # Enable error reporting
-  error_reporting: true
+  error_reporting: false
   email:
     host: localhost
 
-postgresql:
-  postgresqlDatabase: passbook
-
-redis:
-  cluster:
-    enabled: false
-  master:
-    persistence:
-      enabled: false
-
-service:
-  type: ClusterIP
-  port: 80
+# This Helm chart ships with built-in Prometheus ServiceMonitors and Rules.
+# This requires the CoreOS Prometheus Operator.
+monitoring:
+  enabled: false
 
 ingress:
   enabled: false
@@ -40,3 +31,14 @@ ingress:
   #  - secretName: chart-example-tls
   #    hosts:
   #      - passbook.k8s.local
+
+# These settings configure the packaged PostgreSQL and Redis chart.
+postgresql:
+  postgresqlDatabase: passbook
+
+redis:
+  cluster:
+    enabled: false
+  master:
+    persistence:
+      enabled: false

mkdocs.yml

@@ -0,0 +1,31 @@
+site_name: passbook Docs
+site_url: https://beryju.github.io/passbook
+copyright: "Copyright © 2019 - 2020 BeryJu.org"
+
+nav:
+  - Home: index.md
+  - Installation:
+      - Installation: installation/install.md
+      - docker-compose: installation/docker-compose.md
+      - Kubernetes: installation/kubernetes.md
+  - Sources: sources.md
+  - Providers: providers.md
+  - Property Mappings: property-mappings.md
+  - Factors: factors.md
+  - Policies: policies.md
+  - Integrations:
+      - as Provider:
+          - GitLab: integrations/services/gitlab/index.md
+          - Rancher: integrations/services/rancher/index.md
+          - Harbor: integrations/services/harbor/index.md
+          - Sentry: integrations/services/sentry/index.md
+
+repo_name: "BeryJu.org/passbook"
+repo_url: https://github.com/BeryJu/passbook
+theme:
+  name: "material"
+  logo: "images/logo.svg"
+
+markdown_extensions:
+  - toc:
+      permalink: "¶"

passbook/__init__.py

@@ -1,2 +1,2 @@
 """passbook"""
-__version__ = '0.6.7-beta'
+__version__ = "0.7.13-beta"

passbook/admin/api/urls.py

@@ -1,6 +0,0 @@
-"""Versioned Admin API Urls"""
-from django.conf.urls import include, url
-
-urlpatterns = [
-    url(r'^v1/', include('passbook.admin.api.v1.urls', namespace='v1')),
-]

passbook/admin/api/v1/groups.py

@@ -1,36 +0,0 @@
-"""passbook admin gorup API"""
-from rest_framework.permissions import IsAdminUser
-from rest_framework.serializers import ModelSerializer, Serializer
-from rest_framework.viewsets import ModelViewSet
-
-from passbook.core.models import Group
-
-
-class RecursiveField(Serializer):
-    """Recursive field for manytomanyfield"""
-
-    def to_representation(self, value):
-        serializer = self.parent.parent.__class__(value, context=self.context)
-        return serializer.data
-
-    def create(self):
-        raise NotImplementedError()
-
-    def update(self):
-        raise NotImplementedError()
-
-class GroupSerializer(ModelSerializer):
-    """Group Serializer"""
-
-    children = RecursiveField(many=True)
-
-    class Meta:
-        model = Group
-        fields = '__all__'
-
-class GroupViewSet(ModelViewSet):
-    """Group Viewset"""
-
-    permission_classes = [IsAdminUser]
-    serializer_class = GroupSerializer
-    queryset = Group.objects.filter(parent__isnull=True)

passbook/admin/api/v1/urls.py

@@ -1,33 +0,0 @@
-"""passbook admin API URLs"""
-from django.urls import path
-from drf_yasg import openapi
-from drf_yasg.views import get_schema_view
-from rest_framework import permissions
-from rest_framework.routers import DefaultRouter
-
-from passbook.admin.api.v1.applications import ApplicationViewSet
-from passbook.admin.api.v1.groups import GroupViewSet
-from passbook.admin.api.v1.users import UserViewSet
-
-router = DefaultRouter()
-router.register('applications', ApplicationViewSet)
-router.register('groups', GroupViewSet)
-router.register('users', UserViewSet)
-
-SchemaView = get_schema_view(
-    openapi.Info(
-        title="passbook Administration API",
-        default_version='v1',
-        description="Internal passbook API for Administration Interface",
-        contact=openapi.Contact(email="contact@snippets.local"),
-        license=openapi.License(name="MIT License"),
-    ),
-    public=True,
-    permission_classes=(permissions.IsAdminUser,),
-)
-
-urlpatterns = router.urls + [
-    path('swagger.yml', SchemaView.without_ui(cache_timeout=0), name='schema-json'),
-    path('swagger/', SchemaView.with_ui('swagger', cache_timeout=0), name='schema-swagger-ui'),
-]
-app_name = 'passbook.admin'

passbook/admin/apps.py

@@ -5,7 +5,7 @@ from django.apps import AppConfig
 class PassbookAdminConfig(AppConfig):
     """passbook admin app config"""
 
-    name = 'passbook.admin'
-    label = 'passbook_admin'
-    mountpoint = 'administration/'
-    verbose_name = 'passbook Admin'
+    name = "passbook.admin"
+    label = "passbook_admin"
+    mountpoint = "administration/"
+    verbose_name = "passbook Admin"

passbook/admin/fields.py

@@ -16,7 +16,7 @@ class YAMLField(forms.CharField):
     """Django's JSON Field converted to YAML"""
 
     default_error_messages = {
-        'invalid': _("'%(value)s' value must be valid YAML."),
+        "invalid": _("'%(value)s' value must be valid YAML."),
     }
     widget = forms.Textarea
 
@@ -31,9 +31,7 @@ class YAMLField(forms.CharField):
             converted = yaml.safe_load(value)
         except yaml.YAMLError:
             raise forms.ValidationError(
-                self.error_messages['invalid'],
-                code='invalid',
-                params={'value': value},
+                self.error_messages["invalid"], code="invalid", params={"value": value},
             )
         if isinstance(converted, str):
             return YAMLString(converted)

passbook/admin/forms/base.py

@@ -1,4 +1,4 @@
-"""p2 form helpers"""
+"""passbook form helpers"""
 from django import forms
 
 from passbook.admin.fields import YAMLField
@@ -9,29 +9,32 @@ class TagModelForm(forms.ModelForm):
 
     def __init__(self, *args, **kwargs):
         # Check if we have an instance, load tags otherwise use an empty dict
-        instance = kwargs.get('instance', None)
+        instance = kwargs.get("instance", None)
         tags = instance.tags if instance else {}
         # Make sure all predefined tags exist in tags, and set default if they don't
-        predefined_tags = self._meta.model().get_predefined_tags()  # pylint: disable=no-member
+        predefined_tags = (
+            self._meta.model().get_predefined_tags()  # pylint: disable=no-member
+        )
         for key, value in predefined_tags.items():
             if key not in tags:
                 tags[key] = value
         # Format JSON
-        kwargs['initial']['tags'] = tags
+        kwargs["initial"]["tags"] = tags
         super().__init__(*args, **kwargs)
 
     def clean_tags(self):
         """Make sure all required tags are set"""
-        if hasattr(self.instance, 'get_required_keys') and hasattr(self.instance, 'tags'):
+        if hasattr(self.instance, "get_required_keys") and hasattr(
+            self.instance, "tags"
+        ):
             for key in self.instance.get_required_keys():
-                if key not in self.cleaned_data.get('tags'):
+                if key not in self.cleaned_data.get("tags"):
                     raise forms.ValidationError("Tag %s missing." % key)
-        return self.cleaned_data.get('tags')
+        return self.cleaned_data.get("tags")
+
 
 # pylint: disable=too-few-public-methods
 class TagModelFormMeta:
     """Base Meta class that uses the YAMLField"""
 
-    field_classes = {
-        'tags': YAMLField
-    }
+    field_classes = {"tags": YAMLField}

passbook/admin/forms/source.py

@@ -1,6 +1,7 @@
 """passbook core source form fields"""
 # from django import forms
 
-SOURCE_FORM_FIELDS = ['name', 'slug', 'enabled', 'policies']
+SOURCE_FORM_FIELDS = ["name", "slug", "enabled", "policies"]
+SOURCE_SERIALIZER_FIELDS = ["pk", "name", "slug", "enabled", "policies"]
 
 # class SourceForm(forms.Form)

passbook/admin/forms/users.py

@@ -12,10 +12,10 @@ class UserForm(forms.ModelForm):
     class Meta:
 
         model = User
-        fields = ['username', 'name', 'email', 'is_staff', 'is_active', 'attributes']
+        fields = ["username", "name", "email", "is_staff", "is_active", "attributes"]
         widgets = {
-            'name': forms.TextInput,
+            "name": forms.TextInput,
         }
         field_classes = {
-            'attributes': YAMLField,
+            "attributes": YAMLField,
         }

passbook/admin/middleware.py

@@ -11,15 +11,16 @@ def impersonate(get_response):
 
         # User is superuser and has __impersonate ID set
         if request.user.is_superuser and "__impersonate" in request.GET:
-            request.session['impersonate_id'] = request.GET["__impersonate"]
+            request.session["impersonate_id"] = request.GET["__impersonate"]
         # user wants to stop impersonation
-        elif "__unimpersonate" in request.GET and 'impersonate_id' in request.session:
-            del request.session['impersonate_id']
+        elif "__unimpersonate" in request.GET and "impersonate_id" in request.session:
+            del request.session["impersonate_id"]
 
         # Actually impersonate user
-        if request.user.is_superuser and 'impersonate_id' in request.session:
-            request.user = User.objects.get(pk=request.session['impersonate_id'])
+        if request.user.is_superuser and "impersonate_id" in request.session:
+            request.user = User.objects.get(pk=request.session["impersonate_id"])
 
         response = get_response(request)
         return response
+
     return middleware

passbook/admin/settings.py

@@ -1,5 +1,5 @@
 """passbook admin settings"""
 
 MIDDLEWARE = [
-    'passbook.admin.middleware.impersonate',
+    "passbook.admin.middleware.impersonate",
 ]

passbook/admin/templates/administration/application/list.html

@@ -41,5 +41,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/factor/list.html

@@ -58,5 +58,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/group/list.html

@@ -41,5 +41,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/invitation/list.html

@@ -39,5 +39,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/policy/list.html

@@ -58,5 +58,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/property_mapping/list.html

@@ -48,5 +48,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/provider/list.html

@@ -66,5 +66,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/source/list.html

@@ -52,5 +52,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templates/administration/user/list.html

@@ -42,5 +42,6 @@
             {% endfor %}
         </tbody>
     </table>
+    {% include 'partials/pagination.html' %}
 </div>
 {% endblock %}

passbook/admin/templatetags/admin_reflection.py

@@ -10,10 +10,11 @@ from passbook.lib.utils.template import render_to_string
 register = template.Library()
 LOGGER = get_logger()
 
+
 @register.simple_tag()
 def get_links(model_instance):
     """Find all link_ methods on an object instance, run them and return as dict"""
-    prefix = 'link_'
+    prefix = "link_"
     links = {}
 
     if not isinstance(model_instance, Model):
@@ -21,9 +22,11 @@ def get_links(model_instance):
         return links
 
     try:
-        for name, method in inspect.getmembers(model_instance, predicate=inspect.ismethod):
+        for name, method in inspect.getmembers(
+            model_instance, predicate=inspect.ismethod
+        ):
             if name.startswith(prefix):
-                human_name = name.replace(prefix, '').replace('_', ' ').capitalize()
+                human_name = name.replace(prefix, "").replace("_", " ").capitalize()
                 link = method()
                 if link:
                     links[human_name] = link
@@ -36,7 +39,7 @@ def get_links(model_instance):
 @register.simple_tag(takes_context=True)
 def get_htmls(context, model_instance):
     """Find all html_ methods on an object instance, run them and return as dict"""
-    prefix = 'html_'
+    prefix = "html_"
     htmls = []
 
     if not isinstance(model_instance, Model):
@@ -44,9 +47,11 @@ def get_htmls(context, model_instance):
         return htmls
 
     try:
-        for name, method in inspect.getmembers(model_instance, predicate=inspect.ismethod):
+        for name, method in inspect.getmembers(
+            model_instance, predicate=inspect.ismethod
+        ):
             if name.startswith(prefix):
-                template, _context = method(context.get('request'))
+                template, _context = method(context.get("request"))
                 htmls.append(render_to_string(template, _context))
     except NotImplementedError:
         pass

passbook/admin/urls.py

@@ -1,84 +1,157 @@
 """passbook URL Configuration"""
-from django.urls import include, path
+from django.urls import path
 
-from passbook.admin.views import (applications, audit, debug, factors, groups,
-                                  invitations, overview, policy,
-                                  property_mapping, providers, sources, users)
+from passbook.admin.views import (
+    applications,
+    audit,
+    debug,
+    factors,
+    groups,
+    invitations,
+    overview,
+    policy,
+    property_mapping,
+    providers,
+    sources,
+    users,
+)
 
 urlpatterns = [
-    path('', overview.AdministrationOverviewView.as_view(), name='overview'),
+    path("", overview.AdministrationOverviewView.as_view(), name="overview"),
     # Applications
-    path('applications/', applications.ApplicationListView.as_view(),
-         name='applications'),
-    path('applications/create/', applications.ApplicationCreateView.as_view(),
-         name='application-create'),
-    path('applications/<uuid:pk>/update/',
-         applications.ApplicationUpdateView.as_view(), name='application-update'),
-    path('applications/<uuid:pk>/delete/',
-         applications.ApplicationDeleteView.as_view(), name='application-delete'),
+    path(
+        "applications/", applications.ApplicationListView.as_view(), name="applications"
+    ),
+    path(
+        "applications/create/",
+        applications.ApplicationCreateView.as_view(),
+        name="application-create",
+    ),
+    path(
+        "applications/<uuid:pk>/update/",
+        applications.ApplicationUpdateView.as_view(),
+        name="application-update",
+    ),
+    path(
+        "applications/<uuid:pk>/delete/",
+        applications.ApplicationDeleteView.as_view(),
+        name="application-delete",
+    ),
     # Sources
-    path('sources/', sources.SourceListView.as_view(), name='sources'),
-    path('sources/create/', sources.SourceCreateView.as_view(), name='source-create'),
-    path('sources/<uuid:pk>/update/', sources.SourceUpdateView.as_view(), name='source-update'),
-    path('sources/<uuid:pk>/delete/', sources.SourceDeleteView.as_view(), name='source-delete'),
+    path("sources/", sources.SourceListView.as_view(), name="sources"),
+    path("sources/create/", sources.SourceCreateView.as_view(), name="source-create"),
+    path(
+        "sources/<uuid:pk>/update/",
+        sources.SourceUpdateView.as_view(),
+        name="source-update",
+    ),
+    path(
+        "sources/<uuid:pk>/delete/",
+        sources.SourceDeleteView.as_view(),
+        name="source-delete",
+    ),
     # Policies
-    path('policies/', policy.PolicyListView.as_view(), name='policies'),
-    path('policies/create/', policy.PolicyCreateView.as_view(), name='policy-create'),
-    path('policies/<uuid:pk>/update/', policy.PolicyUpdateView.as_view(), name='policy-update'),
-    path('policies/<uuid:pk>/delete/', policy.PolicyDeleteView.as_view(), name='policy-delete'),
-    path('policies/<uuid:pk>/test/', policy.PolicyTestView.as_view(), name='policy-test'),
+    path("policies/", policy.PolicyListView.as_view(), name="policies"),
+    path("policies/create/", policy.PolicyCreateView.as_view(), name="policy-create"),
+    path(
+        "policies/<uuid:pk>/update/",
+        policy.PolicyUpdateView.as_view(),
+        name="policy-update",
+    ),
+    path(
+        "policies/<uuid:pk>/delete/",
+        policy.PolicyDeleteView.as_view(),
+        name="policy-delete",
+    ),
+    path(
+        "policies/<uuid:pk>/test/", policy.PolicyTestView.as_view(), name="policy-test"
+    ),
     # Providers
-    path('providers/', providers.ProviderListView.as_view(), name='providers'),
-    path('providers/create/',
-         providers.ProviderCreateView.as_view(), name='provider-create'),
-    path('providers/<int:pk>/update/',
-         providers.ProviderUpdateView.as_view(), name='provider-update'),
-    path('providers/<int:pk>/delete/',
-         providers.ProviderDeleteView.as_view(), name='provider-delete'),
+    path("providers/", providers.ProviderListView.as_view(), name="providers"),
+    path(
+        "providers/create/",
+        providers.ProviderCreateView.as_view(),
+        name="provider-create",
+    ),
+    path(
+        "providers/<int:pk>/update/",
+        providers.ProviderUpdateView.as_view(),
+        name="provider-update",
+    ),
+    path(
+        "providers/<int:pk>/delete/",
+        providers.ProviderDeleteView.as_view(),
+        name="provider-delete",
+    ),
     # Factors
-    path('factors/', factors.FactorListView.as_view(), name='factors'),
-    path('factors/create/',
-         factors.FactorCreateView.as_view(), name='factor-create'),
-    path('factors/<uuid:pk>/update/',
-         factors.FactorUpdateView.as_view(), name='factor-update'),
-    path('factors/<uuid:pk>/delete/',
-         factors.FactorDeleteView.as_view(), name='factor-delete'),
+    path("factors/", factors.FactorListView.as_view(), name="factors"),
+    path("factors/create/", factors.FactorCreateView.as_view(), name="factor-create"),
+    path(
+        "factors/<uuid:pk>/update/",
+        factors.FactorUpdateView.as_view(),
+        name="factor-update",
+    ),
+    path(
+        "factors/<uuid:pk>/delete/",
+        factors.FactorDeleteView.as_view(),
+        name="factor-delete",
+    ),
     # Factors
-    path('property-mappings/', property_mapping.PropertyMappingListView.as_view(),
-         name='property-mappings'),
-    path('property-mappings/create/',
-         property_mapping.PropertyMappingCreateView.as_view(), name='property-mapping-create'),
-    path('property-mappings/<uuid:pk>/update/',
-         property_mapping.PropertyMappingUpdateView.as_view(), name='property-mapping-update'),
-    path('property-mappings/<uuid:pk>/delete/',
-         property_mapping.PropertyMappingDeleteView.as_view(), name='property-mapping-delete'),
+    path(
+        "property-mappings/",
+        property_mapping.PropertyMappingListView.as_view(),
+        name="property-mappings",
+    ),
+    path(
+        "property-mappings/create/",
+        property_mapping.PropertyMappingCreateView.as_view(),
+        name="property-mapping-create",
+    ),
+    path(
+        "property-mappings/<uuid:pk>/update/",
+        property_mapping.PropertyMappingUpdateView.as_view(),
+        name="property-mapping-update",
+    ),
+    path(
+        "property-mappings/<uuid:pk>/delete/",
+        property_mapping.PropertyMappingDeleteView.as_view(),
+        name="property-mapping-delete",
+    ),
     # Invitations
-    path('invitations/', invitations.InvitationListView.as_view(), name='invitations'),
-    path('invitations/create/',
-         invitations.InvitationCreateView.as_view(), name='invitation-create'),
-    path('invitations/<uuid:pk>/delete/',
-         invitations.InvitationDeleteView.as_view(), name='invitation-delete'),
+    path("invitations/", invitations.InvitationListView.as_view(), name="invitations"),
+    path(
+        "invitations/create/",
+        invitations.InvitationCreateView.as_view(),
+        name="invitation-create",
+    ),
+    path(
+        "invitations/<uuid:pk>/delete/",
+        invitations.InvitationDeleteView.as_view(),
+        name="invitation-delete",
+    ),
     # Users
-    path('users/', users.UserListView.as_view(),
-         name='users'),
-    path('users/create/', users.UserCreateView.as_view(), name='user-create'),
-    path('users/<int:pk>/update/',
-         users.UserUpdateView.as_view(), name='user-update'),
-    path('users/<int:pk>/delete/',
-         users.UserDeleteView.as_view(), name='user-delete'),
-    path('users/<int:pk>/reset/',
-         users.UserPasswordResetView.as_view(), name='user-password-reset'),
+    path("users/", users.UserListView.as_view(), name="users"),
+    path("users/create/", users.UserCreateView.as_view(), name="user-create"),
+    path("users/<int:pk>/update/", users.UserUpdateView.as_view(), name="user-update"),
+    path("users/<int:pk>/delete/", users.UserDeleteView.as_view(), name="user-delete"),
+    path(
+        "users/<int:pk>/reset/",
+        users.UserPasswordResetView.as_view(),
+        name="user-password-reset",
+    ),
     # Groups
-    path('group/', groups.GroupListView.as_view(), name='group'),
-    path('group/create/', groups.GroupCreateView.as_view(), name='group-create'),
-    path('group/<uuid:pk>/update/', groups.GroupUpdateView.as_view(), name='group-update'),
-    path('group/<uuid:pk>/delete/', groups.GroupDeleteView.as_view(), name='group-delete'),
+    path("group/", groups.GroupListView.as_view(), name="group"),
+    path("group/create/", groups.GroupCreateView.as_view(), name="group-create"),
+    path(
+        "group/<uuid:pk>/update/", groups.GroupUpdateView.as_view(), name="group-update"
+    ),
+    path(
+        "group/<uuid:pk>/delete/", groups.GroupDeleteView.as_view(), name="group-delete"
+    ),
     # Audit Log
-    path('audit/', audit.AuditEntryListView.as_view(), name='audit-log'),
+    path("audit/", audit.EventListView.as_view(), name="audit-log"),
     # Groups
-    path('groups/', groups.GroupListView.as_view(), name='groups'),
-    # API
-    path('api/', include('passbook.admin.api.urls')),
+    path("groups/", groups.GroupListView.as_view(), name="groups"),
     # Debug
-    path('debug/request/', debug.DebugRequestView.as_view(), name='debug-request'),
+    path("debug/request/", debug.DebugRequestView.as_view(), name="debug-request"),
 ]

passbook/admin/views/applications.py

@@ -1,59 +1,79 @@
 """passbook Application administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.forms.applications import ApplicationForm
 from passbook.core.models import Application
+from passbook.lib.views import CreateAssignPermView
 
 
-class ApplicationListView(AdminRequiredMixin, ListView):
+class ApplicationListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all applications"""
 
     model = Application
-    ordering = 'name'
-    template_name = 'administration/application/list.html'
+    permission_required = "passbook_core.view_application"
+    ordering = "name"
+    paginate_by = 40
+    template_name = "administration/application/list.html"
 
     def get_queryset(self):
         return super().get_queryset().select_subclasses()
 
 
-class ApplicationCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class ApplicationCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Application"""
 
+    model = Application
     form_class = ApplicationForm
+    permission_required = "passbook_core.add_application"
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:applications')
-    success_message = _('Successfully created Application')
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:applications")
+    success_message = _("Successfully created Application")
 
     def get_context_data(self, **kwargs):
-        kwargs['type'] = 'Application'
+        kwargs["type"] = "Application"
         return super().get_context_data(**kwargs)
 
 
-class ApplicationUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class ApplicationUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update application"""
 
     model = Application
     form_class = ApplicationForm
+    permission_required = "passbook_core.change_application"
 
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:applications')
-    success_message = _('Successfully updated Application')
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:applications")
+    success_message = _("Successfully updated Application")
 
 
-class ApplicationDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class ApplicationDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete application"""
 
     model = Application
+    permission_required = "passbook_core.delete_application"
 
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:applications')
-    success_message = _('Successfully deleted Application')
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:applications")
+    success_message = _("Successfully deleted Application")
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/audit.py

@@ -1,16 +1,18 @@
-"""passbook AuditEntry administration"""
+"""passbook Event administration"""
 from django.views.generic import ListView
+from guardian.mixins import PermissionListMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
-from passbook.audit.models import AuditEntry
+from passbook.audit.models import Event
 
 
-class AuditEntryListView(AdminRequiredMixin, ListView):
+class EventListView(PermissionListMixin, ListView):
     """Show list of all invitations"""
 
-    model = AuditEntry
-    template_name = 'administration/audit/list.html'
+    model = Event
+    template_name = "administration/audit/list.html"
+    permission_required = "passbook_audit.view_event"
+    ordering = "-created"
     paginate_by = 10
 
     def get_queryset(self):
-        return AuditEntry.objects.all().order_by('-created')
+        return Event.objects.all().order_by("-created")

passbook/admin/views/debug.py

@@ -1,17 +1,15 @@
 """passbook administration debug views"""
-
+from django.contrib.auth.mixins import LoginRequiredMixin
 from django.views.generic import TemplateView
 
-from passbook.admin.mixins import AdminRequiredMixin
 
-
-class DebugRequestView(AdminRequiredMixin, TemplateView):
+class DebugRequestView(LoginRequiredMixin, TemplateView):
     """Show debug info about request"""
 
-    template_name = 'administration/debug/request.html'
+    template_name = "administration/debug/request.html"
 
     def get_context_data(self, **kwargs):
-        kwargs['request_dict'] = {}
+        kwargs["request_dict"] = {}
         for key in dir(self.request):
-            kwargs['request_dict'][key] = getattr(self.request, key)
+            kwargs["request_dict"][key] = getattr(self.request, key)
         return super().get_context_data(**kwargs)

passbook/admin/views/factors.py

@@ -1,64 +1,87 @@
 """passbook Factor administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import Factor
 from passbook.lib.utils.reflection import path_to_class
+from passbook.lib.views import CreateAssignPermView
 
 
 def all_subclasses(cls):
     """Recursively return all subclassess of cls"""
     return set(cls.__subclasses__()).union(
-        [s for c in cls.__subclasses__() for s in all_subclasses(c)])
+        [s for c in cls.__subclasses__() for s in all_subclasses(c)]
+    )
 
-class FactorListView(AdminRequiredMixin, ListView):
+
+class FactorListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all factors"""
 
     model = Factor
-    template_name = 'administration/factor/list.html'
-    ordering = 'order'
+    template_name = "administration/factor/list.html"
+    permission_required = "passbook_core.view_factor"
+    ordering = "order"
+    paginate_by = 40
 
     def get_context_data(self, **kwargs):
-        kwargs['types'] = {
-            x.__name__: x._meta.verbose_name for x in all_subclasses(Factor)}
+        kwargs["types"] = {
+            x.__name__: x._meta.verbose_name for x in all_subclasses(Factor)
+        }
         return super().get_context_data(**kwargs)
 
     def get_queryset(self):
         return super().get_queryset().select_subclasses()
 
-class FactorCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+
+class FactorCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Factor"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:factors')
-    success_message = _('Successfully created Factor')
+    model = Factor
+    template_name = "generic/create.html"
+    permission_required = "passbook_core.add_factor"
+
+    success_url = reverse_lazy("passbook_admin:factors")
+    success_message = _("Successfully created Factor")
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
-        factor_type = self.request.GET.get('type')
+        factor_type = self.request.GET.get("type")
         model = next(x for x in all_subclasses(Factor) if x.__name__ == factor_type)
-        kwargs['type'] = model._meta.verbose_name
+        kwargs["type"] = model._meta.verbose_name
         return kwargs
 
     def get_form_class(self):
-        factor_type = self.request.GET.get('type')
+        factor_type = self.request.GET.get("type")
         model = next(x for x in all_subclasses(Factor) if x.__name__ == factor_type)
         if not model:
             raise Http404
         return path_to_class(model.form)
 
-class FactorUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+
+class FactorUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update factor"""
 
     model = Factor
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:factors')
-    success_message = _('Successfully updated Factor')
+    permission_required = "passbook_core.update_application"
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:factors")
+    success_message = _("Successfully updated Factor")
 
     def get_form_class(self):
         form_class_path = self.get_object().form
@@ -66,18 +89,26 @@ class FactorUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
         return form_class
 
     def get_object(self, queryset=None):
-        return Factor.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Factor.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
-class FactorDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+
+class FactorDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete factor"""
 
     model = Factor
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:factors')
-    success_message = _('Successfully deleted Factor')
+    template_name = "generic/delete.html"
+    permission_required = "passbook_core.delete_factor"
+    success_url = reverse_lazy("passbook_admin:factors")
+    success_message = _("Successfully deleted Factor")
 
     def get_object(self, queryset=None):
-        return Factor.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Factor.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/groups.py

@@ -1,56 +1,73 @@
 """passbook Group administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.forms.groups import GroupForm
 from passbook.core.models import Group
+from passbook.lib.views import CreateAssignPermView
 
 
-class GroupListView(AdminRequiredMixin, ListView):
+class GroupListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all groups"""
 
     model = Group
-    ordering = 'name'
-    template_name = 'administration/group/list.html'
+    permission_required = "passbook_core.view_group"
+    ordering = "name"
+    paginate_by = 40
+    template_name = "administration/group/list.html"
 
 
-class GroupCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class GroupCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Group"""
 
+    model = Group
     form_class = GroupForm
+    permission_required = "passbook_core.add_group"
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:groups')
-    success_message = _('Successfully created Group')
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:groups")
+    success_message = _("Successfully created Group")
 
     def get_context_data(self, **kwargs):
-        kwargs['type'] = 'Group'
+        kwargs["type"] = "Group"
         return super().get_context_data(**kwargs)
 
 
-class GroupUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class GroupUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update group"""
 
     model = Group
     form_class = GroupForm
+    permission_required = "passbook_core.change_group"
 
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:groups')
-    success_message = _('Successfully updated Group')
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:groups")
+    success_message = _("Successfully updated Group")
 
 
-class GroupDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class GroupDeleteView(SuccessMessageMixin, LoginRequiredMixin, DeleteView):
     """Delete group"""
 
     model = Group
 
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:groups')
-    success_message = _('Successfully deleted Group')
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:groups")
+    success_message = _("Successfully deleted Group")
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/invitations.py

@@ -1,53 +1,69 @@
 """passbook Invitation administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import HttpResponseRedirect
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView
+from django.views.generic import DeleteView, ListView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.forms.invitations import InvitationForm
 from passbook.core.models import Invitation
 from passbook.core.signals import invitation_created
+from passbook.lib.views import CreateAssignPermView
 
 
-class InvitationListView(AdminRequiredMixin, ListView):
+class InvitationListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all invitations"""
 
     model = Invitation
-    template_name = 'administration/invitation/list.html'
+    permission_required = "passbook_core.view_invitation"
+    template_name = "administration/invitation/list.html"
 
 
-class InvitationCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class InvitationCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Invitation"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:invitations')
-    success_message = _('Successfully created Invitation')
+    model = Invitation
     form_class = InvitationForm
+    permission_required = "passbook_core.add_invitation"
+
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:invitations")
+    success_message = _("Successfully created Invitation")
 
     def get_context_data(self, **kwargs):
-        kwargs['type'] = 'Invitation'
+        kwargs["type"] = "Invitation"
         return super().get_context_data(**kwargs)
 
     def form_valid(self, form):
         obj = form.save(commit=False)
         obj.created_by = self.request.user
         obj.save()
-        invitation_created.send(
-            sender=self,
-            request=self.request,
-            invitation=obj)
+        invitation_created.send(sender=self, request=self.request, invitation=obj)
         return HttpResponseRedirect(self.success_url)
 
-class InvitationDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+
+class InvitationDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete invitation"""
 
     model = Invitation
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:invitations')
-    success_message = _('Successfully deleted Invitation')
+    permission_required = "passbook_core.delete_invitation"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:invitations")
+    success_message = _("Successfully deleted Invitation")
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/overview.py

@@ -5,34 +5,45 @@ from django.views.generic import TemplateView
 
 from passbook import __version__
 from passbook.admin.mixins import AdminRequiredMixin
-from passbook.core.models import (Application, Factor, Invitation, Policy,
-                                  Provider, Source, User)
+from passbook.core.models import (
+    Application,
+    Factor,
+    Invitation,
+    Policy,
+    Provider,
+    Source,
+    User,
+)
 from passbook.root.celery import CELERY_APP
 
 
 class AdministrationOverviewView(AdminRequiredMixin, TemplateView):
     """Overview View"""
 
-    template_name = 'administration/overview.html'
+    template_name = "administration/overview.html"
 
     def post(self, *args, **kwargs):
         """Handle post (clear cache from modal)"""
-        if 'clear' in self.request.POST:
+        if "clear" in self.request.POST:
             cache.clear()
-            return redirect(reverse('passbook_core:auth-login'))
+            return redirect(reverse("passbook_core:auth-login"))
         return self.get(*args, **kwargs)
 
     def get_context_data(self, **kwargs):
-        kwargs['application_count'] = len(Application.objects.all())
-        kwargs['policy_count'] = len(Policy.objects.all())
-        kwargs['user_count'] = len(User.objects.all())
-        kwargs['provider_count'] = len(Provider.objects.all())
-        kwargs['source_count'] = len(Source.objects.all())
-        kwargs['factor_count'] = len(Factor.objects.all())
-        kwargs['invitation_count'] = len(Invitation.objects.all())
-        kwargs['version'] = __version__
-        kwargs['worker_count'] = len(CELERY_APP.control.ping(timeout=0.5))
-        kwargs['providers_without_application'] = Provider.objects.filter(application=None)
-        kwargs['policies_without_attachment'] = len(Policy.objects.filter(policymodel__isnull=True))
-        kwargs['cached_policies'] = len(cache.keys('policy_*'))
+        kwargs["application_count"] = len(Application.objects.all())
+        kwargs["policy_count"] = len(Policy.objects.all())
+        kwargs["user_count"] = len(User.objects.all())
+        kwargs["provider_count"] = len(Provider.objects.all())
+        kwargs["source_count"] = len(Source.objects.all())
+        kwargs["factor_count"] = len(Factor.objects.all())
+        kwargs["invitation_count"] = len(Invitation.objects.all())
+        kwargs["version"] = __version__
+        kwargs["worker_count"] = len(CELERY_APP.control.ping(timeout=0.5))
+        kwargs["providers_without_application"] = Provider.objects.filter(
+            application=None
+        )
+        kwargs["policies_without_attachment"] = len(
+            Policy.objects.filter(policymodel__isnull=True)
+        )
+        kwargs["cached_policies"] = len(cache.keys("policy_*"))
         return super().get_context_data(**kwargs)

passbook/admin/views/policy.py

@@ -1,58 +1,76 @@
 """passbook Policy administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import (CreateView, DeleteView, FormView, ListView,
-                                  UpdateView)
+from django.views.generic import DeleteView, FormView, ListView, UpdateView
 from django.views.generic.detail import DetailView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from passbook.admin.forms.policies import PolicyTestForm
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import Policy
 from passbook.lib.utils.reflection import path_to_class
+from passbook.lib.views import CreateAssignPermView
 from passbook.policies.engine import PolicyEngine
 
 
-class PolicyListView(AdminRequiredMixin, ListView):
+class PolicyListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all policies"""
 
     model = Policy
-    template_name = 'administration/policy/list.html'
+    permission_required = "passbook_core.view_policy"
+
+    template_name = "administration/policy/list.html"
 
     def get_context_data(self, **kwargs):
-        kwargs['types'] = {
-            x.__name__: x._meta.verbose_name for x in Policy.__subclasses__()}
+        kwargs["types"] = {
+            x.__name__: x._meta.verbose_name for x in Policy.__subclasses__()
+        }
         return super().get_context_data(**kwargs)
 
     def get_queryset(self):
-        return super().get_queryset().order_by('order').select_subclasses()
+        return super().get_queryset().order_by("order").select_subclasses()
 
 
-class PolicyCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class PolicyCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Policy"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:policies')
-    success_message = _('Successfully created Policy')
+    model = Policy
+    permission_required = "passbook_core.add_policy"
+
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:policies")
+    success_message = _("Successfully created Policy")
 
     def get_form_class(self):
-        policy_type = self.request.GET.get('type')
-        model = next(x for x in Policy.__subclasses__()
-                     if x.__name__ == policy_type)
+        policy_type = self.request.GET.get("type")
+        model = next(x for x in Policy.__subclasses__() if x.__name__ == policy_type)
         if not model:
             raise Http404
         return path_to_class(model.form)
 
 
-class PolicyUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class PolicyUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update policy"""
 
     model = Policy
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:policies')
-    success_message = _('Successfully updated Policy')
+    permission_required = "passbook_core.change_policy"
+
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:policies")
+    success_message = _("Successfully updated Policy")
 
     def get_form_class(self):
         form_class_path = self.get_object().form
@@ -60,38 +78,49 @@ class PolicyUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
         return form_class
 
     def get_object(self, queryset=None):
-        return Policy.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
 
-class PolicyDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class PolicyDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete policy"""
 
     model = Policy
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:policies')
-    success_message = _('Successfully deleted Policy')
+    permission_required = "passbook_core.delete_policy"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:policies")
+    success_message = _("Successfully deleted Policy")
 
     def get_object(self, queryset=None):
-        return Policy.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)
         return super().delete(request, *args, **kwargs)
 
 
-class PolicyTestView(AdminRequiredMixin, DetailView, FormView):
+class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, FormView):
     """View to test policy(s)"""
 
     model = Policy
     form_class = PolicyTestForm
-    template_name = 'administration/policy/test.html'
+    permission_required = "passbook_core.view_policy"
+    template_name = "administration/policy/test.html"
     object = None
 
     def get_object(self, queryset=None):
-        return Policy.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
     def get_context_data(self, **kwargs):
-        kwargs['policy'] = self.get_object()
+        kwargs["policy"] = self.get_object()
         return super().get_context_data(**kwargs)
 
     def post(self, *args, **kwargs):
@@ -100,12 +129,13 @@ class PolicyTestView(AdminRequiredMixin, DetailView, FormView):
 
     def form_valid(self, form):
         policy = self.get_object()
-        user = form.cleaned_data.get('user')
-        policy_engine = PolicyEngine([policy])
-        policy_engine.for_user(user).with_request(self.request).build()
+        user = form.cleaned_data.get("user")
+        policy_engine = PolicyEngine([policy], user, self.request)
+        policy_engine.use_cache = False
+        policy_engine.build()
         result = policy_engine.passing
         if result:
-            messages.success(self.request, _('User successfully passed policy.'))
+            messages.success(self.request, _("User successfully passed policy."))
         else:
             messages.error(self.request, _("User didn't pass policy."))
         return self.render_to_response(self.get_context_data(form=form, result=result))

passbook/admin/views/property_mapping.py

@@ -1,69 +1,96 @@
 """passbook PropertyMapping administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import PropertyMapping
 from passbook.lib.utils.reflection import path_to_class
+from passbook.lib.views import CreateAssignPermView
 
 
 def all_subclasses(cls):
     """Recursively return all subclassess of cls"""
     return set(cls.__subclasses__()).union(
-        [s for c in cls.__subclasses__() for s in all_subclasses(c)])
+        [s for c in cls.__subclasses__() for s in all_subclasses(c)]
+    )
 
 
-class PropertyMappingListView(AdminRequiredMixin, ListView):
+class PropertyMappingListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all property_mappings"""
 
     model = PropertyMapping
-    template_name = 'administration/property_mapping/list.html'
-    ordering = 'name'
+    permission_required = "passbook_core.view_propertymapping"
+    template_name = "administration/property_mapping/list.html"
+    ordering = "name"
+    paginate_by = 40
 
     def get_context_data(self, **kwargs):
-        kwargs['types'] = {
-            x.__name__: x._meta.verbose_name for x in all_subclasses(PropertyMapping)}
+        kwargs["types"] = {
+            x.__name__: x._meta.verbose_name for x in all_subclasses(PropertyMapping)
+        }
         return super().get_context_data(**kwargs)
 
     def get_queryset(self):
         return super().get_queryset().select_subclasses()
 
 
-class PropertyMappingCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class PropertyMappingCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new PropertyMapping"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:property-mappings')
-    success_message = _('Successfully created Property Mapping')
+    model = PropertyMapping
+    permission_required = "passbook_core.add_propertymapping"
+
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:property-mappings")
+    success_message = _("Successfully created Property Mapping")
 
     def get_context_data(self, **kwargs):
         kwargs = super().get_context_data(**kwargs)
-        property_mapping_type = self.request.GET.get('type')
-        model = next(x for x in all_subclasses(PropertyMapping)
-                     if x.__name__ == property_mapping_type)
-        kwargs['type'] = model._meta.verbose_name
+        property_mapping_type = self.request.GET.get("type")
+        model = next(
+            x
+            for x in all_subclasses(PropertyMapping)
+            if x.__name__ == property_mapping_type
+        )
+        kwargs["type"] = model._meta.verbose_name
         return kwargs
 
     def get_form_class(self):
-        property_mapping_type = self.request.GET.get('type')
-        model = next(x for x in all_subclasses(PropertyMapping)
-                     if x.__name__ == property_mapping_type)
+        property_mapping_type = self.request.GET.get("type")
+        model = next(
+            x
+            for x in all_subclasses(PropertyMapping)
+            if x.__name__ == property_mapping_type
+        )
         if not model:
             raise Http404
         return path_to_class(model.form)
 
 
-class PropertyMappingUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class PropertyMappingUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update property_mapping"""
 
     model = PropertyMapping
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:property-mappings')
-    success_message = _('Successfully updated Property Mapping')
+    permission_required = "passbook_core.change_propertymapping"
+
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:property-mappings")
+    success_message = _("Successfully updated Property Mapping")
 
     def get_form_class(self):
         form_class_path = self.get_object().form
@@ -71,19 +98,31 @@ class PropertyMappingUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateV
         return form_class
 
     def get_object(self, queryset=None):
-        return PropertyMapping.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
 
 
-class PropertyMappingDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class PropertyMappingDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete property_mapping"""
 
     model = PropertyMapping
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:property-mappings')
-    success_message = _('Successfully deleted Property Mapping')
+    permission_required = "passbook_core.delete_propertymapping"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:property-mappings")
+    success_message = _("Successfully deleted Property Mapping")
 
     def get_object(self, queryset=None):
-        return PropertyMapping.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/providers.py

@@ -1,54 +1,74 @@
 """passbook Provider administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import Provider
 from passbook.lib.utils.reflection import path_to_class
+from passbook.lib.views import CreateAssignPermView
 
 
-class ProviderListView(AdminRequiredMixin, ListView):
+class ProviderListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all providers"""
 
     model = Provider
-    template_name = 'administration/provider/list.html'
+    permission_required = "passbook_core.add_provider"
+    template_name = "administration/provider/list.html"
 
     def get_context_data(self, **kwargs):
-        kwargs['types'] = {
-            x.__name__: x._meta.verbose_name for x in Provider.__subclasses__()}
+        kwargs["types"] = {
+            x.__name__: x._meta.verbose_name for x in Provider.__subclasses__()
+        }
         return super().get_context_data(**kwargs)
 
     def get_queryset(self):
         return super().get_queryset().select_subclasses()
 
 
-class ProviderCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class ProviderCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Provider"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:providers')
-    success_message = _('Successfully created Provider')
+    model = Provider
+    permission_required = "passbook_core.add_provider"
+
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:providers")
+    success_message = _("Successfully created Provider")
 
     def get_form_class(self):
-        provider_type = self.request.GET.get('type')
-        model = next(x for x in Provider.__subclasses__()
-                     if x.__name__ == provider_type)
+        provider_type = self.request.GET.get("type")
+        model = next(
+            x for x in Provider.__subclasses__() if x.__name__ == provider_type
+        )
         if not model:
             raise Http404
         return path_to_class(model.form)
 
 
-class ProviderUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class ProviderUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update provider"""
 
     model = Provider
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:providers')
-    success_message = _('Successfully updated Provider')
+    permission_required = "passbook_core.change_provider"
+
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:providers")
+    success_message = _("Successfully updated Provider")
 
     def get_form_class(self):
         form_class_path = self.get_object().form
@@ -56,19 +76,31 @@ class ProviderUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
         return form_class
 
     def get_object(self, queryset=None):
-        return Provider.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Provider.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
 
 
-class ProviderDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class ProviderDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete provider"""
 
     model = Provider
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:providers')
-    success_message = _('Successfully deleted Provider')
+    permission_required = "passbook_core.delete_provider"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:providers")
+    success_message = _("Successfully deleted Provider")
 
     def get_object(self, queryset=None):
-        return Provider.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Provider.objects.filter(pk=self.kwargs.get("pk"))
+            .select_subclasses()
+            .first()
+        )
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/sources.py

@@ -1,58 +1,81 @@
 """passbook Source administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
 from django.http import Http404
 from django.urls import reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import Source
 from passbook.lib.utils.reflection import path_to_class
+from passbook.lib.views import CreateAssignPermView
 
 
 def all_subclasses(cls):
     """Recursively return all subclassess of cls"""
     return set(cls.__subclasses__()).union(
-        [s for c in cls.__subclasses__() for s in all_subclasses(c)])
+        [s for c in cls.__subclasses__() for s in all_subclasses(c)]
+    )
 
-class SourceListView(AdminRequiredMixin, ListView):
+
+class SourceListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all sources"""
 
     model = Source
-    template_name = 'administration/source/list.html'
+    permission_required = "passbook_core.view_source"
+    ordering = "name"
+    paginate_by = 40
+    template_name = "administration/source/list.html"
 
     def get_context_data(self, **kwargs):
-        kwargs['types'] = {
-            x.__name__: x._meta.verbose_name for x in all_subclasses(Source)}
+        kwargs["types"] = {
+            x.__name__: x._meta.verbose_name for x in all_subclasses(Source)
+        }
         return super().get_context_data(**kwargs)
 
     def get_queryset(self):
         return super().get_queryset().select_subclasses()
 
 
-class SourceCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class SourceCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create new Source"""
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:sources')
-    success_message = _('Successfully created Source')
+    model = Source
+    permission_required = "passbook_core.add_source"
+
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:sources")
+    success_message = _("Successfully created Source")
 
     def get_form_class(self):
-        source_type = self.request.GET.get('type')
+        source_type = self.request.GET.get("type")
         model = next(x for x in all_subclasses(Source) if x.__name__ == source_type)
         if not model:
             raise Http404
         return path_to_class(model.form)
 
 
-class SourceUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class SourceUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update source"""
 
     model = Source
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:sources')
-    success_message = _('Successfully updated Source')
+    permission_required = "passbook_core.change_source"
+
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:sources")
+    success_message = _("Successfully updated Source")
 
     def get_form_class(self):
         form_class_path = self.get_object().form
@@ -60,19 +83,27 @@ class SourceUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
         return form_class
 
     def get_object(self, queryset=None):
-        return Source.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Source.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
 
-class SourceDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class SourceDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete source"""
 
     model = Source
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:sources')
-    success_message = _('Successfully deleted Source')
+    permission_required = "passbook_core.delete_source"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:sources")
+    success_message = _("Successfully deleted Source")
 
     def get_object(self, queryset=None):
-        return Source.objects.filter(pk=self.kwargs.get('pk')).select_subclasses().first()
+        return (
+            Source.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
+        )
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)

passbook/admin/views/users.py

@@ -1,68 +1,95 @@
 """passbook User administration"""
 from django.contrib import messages
+from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.mixins import (
+    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
+)
 from django.contrib.messages.views import SuccessMessageMixin
-from django.shortcuts import get_object_or_404, redirect
+from django.shortcuts import redirect
 from django.urls import reverse, reverse_lazy
 from django.utils.translation import ugettext as _
-from django.views import View
-from django.views.generic import CreateView, DeleteView, ListView, UpdateView
+from django.views.generic import DeleteView, DetailView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from passbook.admin.forms.users import UserForm
-from passbook.admin.mixins import AdminRequiredMixin
 from passbook.core.models import Nonce, User
+from passbook.lib.views import CreateAssignPermView
 
 
-class UserListView(AdminRequiredMixin, ListView):
+class UserListView(LoginRequiredMixin, PermissionListMixin, ListView):
     """Show list of all users"""
 
     model = User
-    template_name = 'administration/user/list.html'
+    permission_required = "passbook_core.view_user"
+    ordering = "username"
+    paginate_by = 40
+    template_name = "administration/user/list.html"
 
 
-class UserCreateView(SuccessMessageMixin, AdminRequiredMixin, CreateView):
+class UserCreateView(
+    SuccessMessageMixin,
+    LoginRequiredMixin,
+    DjangoPermissionRequiredMixin,
+    CreateAssignPermView,
+):
     """Create user"""
 
     model = User
     form_class = UserForm
+    permission_required = "passbook_core.add_user"
 
-    template_name = 'generic/create.html'
-    success_url = reverse_lazy('passbook_admin:users')
-    success_message = _('Successfully created User')
+    template_name = "generic/create.html"
+    success_url = reverse_lazy("passbook_admin:users")
+    success_message = _("Successfully created User")
 
 
-class UserUpdateView(SuccessMessageMixin, AdminRequiredMixin, UpdateView):
+class UserUpdateView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
+):
     """Update user"""
 
     model = User
     form_class = UserForm
+    permission_required = "passbook_core.change_user"
 
-    template_name = 'generic/update.html'
-    success_url = reverse_lazy('passbook_admin:users')
-    success_message = _('Successfully updated User')
+    # By default the object's name is user which is used by other checks
+    context_object_name = "object"
+    template_name = "generic/update.html"
+    success_url = reverse_lazy("passbook_admin:users")
+    success_message = _("Successfully updated User")
 
 
-class UserDeleteView(SuccessMessageMixin, AdminRequiredMixin, DeleteView):
+class UserDeleteView(
+    SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, DeleteView
+):
     """Delete user"""
 
     model = User
-    template_name = 'generic/delete.html'
-    success_url = reverse_lazy('passbook_admin:users')
-    success_message = _('Successfully deleted User')
+    permission_required = "passbook_core.delete_user"
+
+    template_name = "generic/delete.html"
+    success_url = reverse_lazy("passbook_admin:users")
+    success_message = _("Successfully deleted User")
 
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)
         return super().delete(request, *args, **kwargs)
 
 
-class UserPasswordResetView(AdminRequiredMixin, View):
+class UserPasswordResetView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
     """Get Password reset link for user"""
 
-    # pylint: disable=invalid-name
-    def get(self, request, pk):
+    model = User
+    permission_required = "passbook_core.reset_user_password"
+
+    def get(self, request, *args, **kwargs):
         """Create nonce for user and return link"""
-        user = get_object_or_404(User, pk=pk)
-        nonce = Nonce.objects.create(user=user)
-        link = request.build_absolute_uri(reverse(
-            'passbook_core:auth-password-reset', kwargs={'nonce': nonce.uuid}))
-        messages.success(request, _('Password reset link: <pre>%(link)s</pre>' % {'link': link}))
-        return redirect('passbook_admin:users')
+        super().get(request, *args, **kwargs)
+        nonce = Nonce.objects.create(user=self.object)
+        link = request.build_absolute_uri(
+            reverse("passbook_core:auth-password-reset", kwargs={"nonce": nonce.uuid})
+        )
+        messages.success(
+            request, _("Password reset link: <pre>%(link)s</pre>" % {"link": link})
+        )
+        return redirect("passbook_admin:users")

passbook/api/apps.py

@@ -6,7 +6,7 @@ from django.apps import AppConfig
 class PassbookAPIConfig(AppConfig):
     """passbook API Config"""
 
-    name = 'passbook.api'
-    label = 'passbook_api'
-    mountpoint = 'api/'
-    verbose_name = 'passbook API'
+    name = "passbook.api"
+    label = "passbook_api"
+    mountpoint = "api/"
+    verbose_name = "passbook API"

passbook/api/permissions.py

@@ -0,0 +1,31 @@
+"""permission classes for django restframework"""
+from rest_framework.permissions import BasePermission, DjangoObjectPermissions
+
+from passbook.core.models import PolicyModel
+from passbook.policies.engine import PolicyEngine
+
+
+class CustomObjectPermissions(DjangoObjectPermissions):
+    """Similar to `DjangoObjectPermissions`, but adding 'view' permissions."""
+
+    perms_map = {
+        "GET": ["%(app_label)s.view_%(model_name)s"],
+        "OPTIONS": ["%(app_label)s.view_%(model_name)s"],
+        "HEAD": ["%(app_label)s.view_%(model_name)s"],
+        "POST": ["%(app_label)s.add_%(model_name)s"],
+        "PUT": ["%(app_label)s.change_%(model_name)s"],
+        "PATCH": ["%(app_label)s.change_%(model_name)s"],
+        "DELETE": ["%(app_label)s.delete_%(model_name)s"],
+    }
+
+
+class PolicyPermissions(BasePermission):
+    """Permission checker based on PolicyEngine"""
+
+    policy_engine: PolicyEngine
+
+    def has_object_permission(self, request, view, obj: PolicyModel) -> bool:
+        # if not obj.po
+        self.policy_engine = PolicyEngine(obj.policies, request.user, request)
+        self.policy_engine.request.obj = obj
+        return self.policy_engine.build().passing

passbook/api/urls.py

@@ -2,7 +2,9 @@
 from django.urls import include, path
 
 from passbook.api.v1.urls import urlpatterns as v1_urls
+from passbook.api.v2.urls import urlpatterns as v2_urls
 
 urlpatterns = [
-    path('v1/', include(v1_urls))
+    path("v1/", include(v1_urls)),
+    path("v2/", include(v2_urls)),
 ]

passbook/api/v1/openid.py

@@ -7,16 +7,16 @@ from oauth2_provider.views.mixins import ScopedResourceMixin
 class OpenIDUserInfoView(ScopedResourceMixin, View):
     """Passbook v1 OpenID API"""
 
-    required_scopes = ['openid:userinfo']
+    required_scopes = ["openid:userinfo"]
 
-    def get(self, request, *args, **kwargs):
+    def get(self, request, *_, **__):
         """Passbook v1 OpenID API"""
         payload = {
-            'sub': request.user.uuid.int,
-            'name': request.user.get_full_name(),
-            'given_name': request.user.name,
-            'family_name': '',
-            'preferred_username': request.user.username,
-            'email': request.user.email,
+            "sub": request.user.uuid.int,
+            "name": request.user.get_full_name(),
+            "given_name": request.user.name,
+            "family_name": "",
+            "preferred_username": request.user.username,
+            "email": request.user.email,
         }
         return JsonResponse(payload)