Feature add tc

.stylelintrc.json

@@ -7,6 +7,9 @@
     "color-hex-case": "upper",
     "color-hex-length": "long",
     "indentation": [4],
-    "no-descending-specificity": null
+    "no-descending-specificity": null,
+    "property-no-vendor-prefix": null,
+    "shorthand-property-no-redundant-values": null,
+    "value-no-vendor-prefix": null
   }
 }

CHANGES.rst

@@ -7,7 +7,21 @@ Changes
 `Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
 ------------------------------------------------------------------------------------
 
-* Nothing new for the moment.
+Features / Changes
+~~~~~~~~~~~~~~~~~~~~~
+* Add new `Terms and conditions` field for ``Group`` creation. When a request is made to assign a ``User`` to a
+  ``Group`` with terms and conditions, an email is now sent to the ``User`` with the terms and conditions. The ``User``
+  is assigned to the ``Group`` when receiving the ``User``'s approval of terms and conditions, and another email is
+  then sent to notify the ``User`` of the successful operation.
+* Changed ``/groups/{group_name}/users``, ``/users/current/groups`` and ``/users/{user_name}/groups`` endpoints with
+  new query parameter `status` to either get active, pending or all ``Users`` or ``Groups``. This new parameter is
+  useful to display any pending ``Users``/``Groups`` on the UI.
+* Added new field `has_pending_group` in the user info returned by ``/users/{user_name}`` endpoint, indicating if
+  the user has any pending group.
+
+Bug Fixes
+~~~~~~~~~~~~~~~~~~~~~
+* Fix HTTP ``Internal Server Error [500]`` on the page to edit a ``Group`` when deleting the last ``User`` of a ``Group``.
 
 `3.16.1 <https://github.com/Ouranosinc/Magpie/tree/3.16.1>`_ (2021-10-18)
 ------------------------------------------------------------------------------------

config/magpie.ini

@@ -61,6 +61,10 @@ magpie.user_registration_notify_enabled = false
 magpie.user_registration_notify_email_recipient =
 magpie.user_registration_notify_email_template =
 
+# --- user assignment to groups with t&c ---
+magpie.group_terms_submission_email_template =
+magpie.group_terms_approved_email_template =
+
 # smtp server configuration
 magpie.smtp_user = Magpie
 magpie.smtp_from =

docs/_static/custom.css

@@ -20,7 +20,7 @@ code.docutils.literal:not(.xref) {
 
     /* overrides and additions */
     background-color: #DBDBDD;  /* slightly darker than original to make more obvious */
-    padding: 0.1em 0.1em;       /* pad so that background color encapsulate letters going 'lower' (eg: g, j, y) */
+    padding: 0.1em;             /* pad so that background color encapsulate letters going 'lower' (eg: g, j, y) */
     white-space: nowrap;        /* don't allow breaking on non-word items such as dot in value */
 }
 

docs/configuration.rst

@@ -1259,6 +1259,44 @@ approval procedures.
 
     The default template provides details about available template arguments.
 
+.. _config_user_group_assignment:
+
+User-Group Assignment Configuration
+-----------------------------------
+
+.. versionadded:: 3.17
+
+Following are the full description of all configuration parameters employed by the :term:`User`-:term:`Group` assignment
+procedures, in the case of a :term:`Group` that requires terms and conditions validation by the :term:`User`.
+
+.. envvar:: MAGPIE_GROUP_TERMS_SUBMISSION_EMAIL_TEMPLATE
+
+    (Default: |email_uga_submission_mako|_)
+
+    .. versionadded:: 3.17
+
+    Path to a `Mako Template`_ file providing custom email format to send notification email to the :term:`User`
+    following submission of the :term:`User` assignment to a :term:`Group` that requires accepting terms and conditions.
+
+    When overridden with a custom email format, the contents should provide sufficient details indicating to the
+    :term:`User` that they must accept the :term:`Group`'s terms and conditions to join it, and that confirmation is
+    accomplished by visiting the link contained in that email. The confirmation URL would validate that the :term:`User`
+    accepts the terms and conditions, and would proceed with the assignment of the :term:`User` to the :term:`Group`.
+    The contents of the email should also include the terms and conditions of the :term:`Group`.
+
+    The default template provides details about available template arguments.
+
+.. envvar:: MAGPIE_GROUP_TERMS_APPROVED_EMAIL_TEMPLATE
+
+    (Default: |email_uga_approved_mako|_)
+
+    .. versionadded:: 3.17
+
+    Path to a `Mako Template`_ file providing custom email format to send an email to the :term:`User` related to a
+    :term:`User`-:term:`Group` assignment to notify them that the terms and conditions were accepted, and that their
+    account is now a member of the requested :term:`Group`.
+
+    The default template provides details about available template arguments.
 
 .. _config_webhook:
 

docs/glossary.rst

@@ -92,7 +92,10 @@ Glossary
     Group
         Entity on which :term:`Permission` over a :term:`Service` or :term:`Resource` can be applied. Any :term:`User`
         can be set as a member of any number of :term:`Group`, making it inherit all applicable set of
-        :term:`Permission`.
+        :term:`Permission`. A :term:`Group` can optionally have terms and conditions, which the :term:`User` has to
+        accept before being assigned to the :term:`Group`. In this case, an email is sent to the :term:`User` upon
+        request to ask for confirmation. The terms and conditions can only be defined upon the :term:`Group` creation
+        and can never be modified afterwards.
 
     Immediate Permissions
         Describes a :term:`Permission` that originates directly and only from a :term:`Service`.

docs/references.rst

@@ -44,16 +44,20 @@
 .. _constants.py: https://github.com/Ouranosinc/Magpie/tree/master/magpie/constants.py
 .. _Dockerfile: https://github.com/Ouranosinc/Magpie/tree/master/Dockerfile
 .. _docker-compose.yml.example: https://github.com/Ouranosinc/Magpie/tree/master/docker-compose.yml.example
-.. |email_ur_submission_mako| replace:: ``magpie/api/template/email_user_registration_submission.mako``
-.. _email_ur_submission_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/template/email_user_registration_submission.mako
-.. |email_ur_approval_mako| replace:: ``magpie/api/template/email_user_registration_approval.mako``
-.. _email_ur_approval_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/template/email_user_registration_approval.mako
-.. |email_ur_approved_mako| replace:: ``magpie/api/template/email_user_registration_approved.mako``
-.. _email_ur_approved_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/template/email_user_registration_approved.mako
-.. |email_ur_declined_mako| replace:: ``magpie/api/template/email_user_registration_declined.mako``
-.. _email_ur_declined_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/template/email_user_registration_declined.mako
-.. |email_ur_notify_mako| replace:: ``magpie/api/template/email_user_registration_notify.mako``
-.. _email_ur_notify_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/template/email_user_registration_notify.mako
+.. |email_ur_submission_mako| replace:: ``magpie/api/templates/email_user_registration_submission.mako``
+.. _email_ur_submission_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_user_registration_submission.mako
+.. |email_ur_approval_mako| replace:: ``magpie/api/templates/email_user_registration_approval.mako``
+.. _email_ur_approval_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_user_registration_approval.mako
+.. |email_ur_approved_mako| replace:: ``magpie/api/templates/email_user_registration_approved.mako``
+.. _email_ur_approved_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_user_registration_approved.mako
+.. |email_ur_declined_mako| replace:: ``magpie/api/templates/email_user_registration_declined.mako``
+.. _email_ur_declined_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_user_registration_declined.mako
+.. |email_ur_notify_mako| replace:: ``magpie/api/templates/email_user_registration_notify.mako``
+.. _email_ur_notify_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_user_registration_notify.mako
+.. |email_uga_submission_mako| replace:: ``magpie/api/templates/email_group_terms_submission.mako``
+.. _email_uga_submission_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_group_terms_submission.mako
+.. |email_uga_approved_mako| replace:: ``magpie/api/templates/email_group_terms_approved.mako``
+.. _email_uga_approved_mako: https://github.com/Ouranosinc/Magpie/blob/master/magpie/api/templates/email_group_terms_approved.mako
 .. _magpie-cron: https://github.com/Ouranosinc/Magpie/tree/master/magpie-cron
 .. _magpie.env.example: https://github.com/Ouranosinc/Magpie/tree/master/env/magpie.env.example
 .. _magpie.ini: https://github.com/Ouranosinc/Magpie/tree/master/config/magpie.ini

magpie/alembic/versions/2021-06-09_cb92ff1f81bb_add_group_terms.py

@@ -0,0 +1,24 @@
+"""
+add group terms
+
+Revision ID: cb92ff1f81bb
+Revises: 35e98bdc8aed
+Create Date: 2021-06-09 14:18:32.777082
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "cb92ff1f81bb"
+down_revision = "35e98bdc8aed"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column("groups", sa.Column("terms", sa.UnicodeText(), nullable=True))
+
+
+def downgrade():
+    op.drop_column("groups", "terms")

magpie/api/management/group/group_formats.py

@@ -43,6 +43,7 @@ def fmt_grp():
         if public_info:
             return info
         info["discoverable"] = group.discoverable
+        info["terms"] = group.terms
         info["priority"] = "max" if group.priority == math.inf else int(group.priority)
         info["member_count"] = group.get_member_count(db_session)
         info["user_names"] = [usr.user_name for usr in group.users]

magpie/api/management/group/group_utils.py

@@ -75,8 +75,8 @@ def get_group_resources(group, db_session, service_types=None):
     return json_response
 
 
-def create_group(group_name, description, discoverable, db_session):
-    # type: (Str, Str, bool, Session) -> HTTPException
+def create_group(group_name, description, discoverable, terms, db_session):
+    # type: (Str, Str, bool, Str, Session) -> HTTPException
     """
     Creates a group if it is permitted and not conflicting.
 
@@ -85,6 +85,7 @@ def create_group(group_name, description, discoverable, db_session):
     """
     description = str(description) if description else None
     discoverable = asbool(discoverable)
+    terms = str(terms) if terms else None
     group_content_error = {
         "group_name": str(group_name),
         "description": description,
@@ -103,7 +104,10 @@ def create_group(group_name, description, discoverable, db_session):
                     http_error=HTTPConflict, content=group_content_error,
                     msg_on_fail=s.Groups_POST_ConflictResponseSchema.description)
     new_group = ax.evaluate_call(
-        lambda: models.Group(group_name=group_name, description=description, discoverable=discoverable),  # noqa
+        lambda: models.Group(group_name=group_name,
+                             description=description,
+                             discoverable=discoverable,
+                             terms=terms),  # noqa
         fallback=lambda: db_session.rollback(), http_error=HTTPForbidden, content=group_content_error,
         msg_on_fail=s.Groups_POST_ForbiddenCreateResponseSchema.description)
     ax.evaluate_call(lambda: db_session.add(new_group), fallback=lambda: db_session.rollback(),

magpie/api/management/group/group_views.py

@@ -10,6 +10,7 @@
 from magpie.api.management.group import group_utils as gu
 from magpie.api.management.service import service_utils as su
 from magpie.constants import get_constant
+from magpie.models import TemporaryToken, TokenOperation, UserGroupStatus
 
 
 @s.GroupsAPI.get(tags=[s.GroupsTag], response_schemas=s.Groups_GET_responses)
@@ -30,9 +31,10 @@ def create_group_view(request):
     Create a group.
     """
     group_name = ar.get_value_multiformat_body_checked(request, "group_name")
-    group_desc = ar.get_multiformat_body(request, "description", default="")
+    group_desc = ar.get_multiformat_body(request, "description", default=None)
     group_disc = asbool(ar.get_multiformat_body(request, "discoverable", default=False))
-    return gu.create_group(group_name, group_desc, group_disc, request.db)
+    group_terms = ar.get_multiformat_body(request, "terms", default=None)
+    return gu.create_group(group_name, group_desc, group_disc, group_terms, request.db)
 
 
 @s.GroupAPI.get(schema=s.Group_GET_RequestSchema, tags=[s.GroupsTag], response_schemas=s.Group_GET_responses)
@@ -116,12 +118,34 @@ def delete_group_view(request):
 @view_config(route_name=s.GroupUsersAPI.name, request_method="GET")
 def get_group_users_view(request):
     """
-    List all user from a group.
+    List all users from a group.
+    Users can be filtered by status depending of input arguments.
     """
     group = ar.get_group_matchdict_checked(request)
-    user_names = ax.evaluate_call(lambda: [user.user_name for user in group.users],
-                                  http_error=HTTPForbidden,
-                                  msg_on_fail=s.GroupUsers_GET_ForbiddenResponseSchema.description)
+    status = ar.get_query_param(request, "status", default=UserGroupStatus.ACTIVE.value)
+    ax.verify_param(status, is_in=True, param_compare=UserGroupStatus.values(), param_name="status",
+                    msg_on_fail=s.UserGroup_Check_Status_BadRequestResponseSchema.description,
+                    http_error=HTTPBadRequest)
+    status = UserGroupStatus.get(status)
+
+    user_names = set()
+    member_user_names = ax.evaluate_call(lambda: set(user.user_name for user in group.users),
+                                         http_error=HTTPForbidden,
+                                         msg_on_fail=s.GroupUsers_GET_ForbiddenResponseSchema.description)
+    if status in [UserGroupStatus.ACTIVE, UserGroupStatus.ALL]:
+        user_names = user_names.union(member_user_names)
+    if status in [UserGroupStatus.PENDING, UserGroupStatus.ALL]:
+        # Find all temporary tokens with requested group id that have a pending accept terms request
+        tmp_tokens = request.db.query(TemporaryToken).filter(TemporaryToken.group_id == group.id)
+        tmp_tokens = tmp_tokens.filter(TemporaryToken.operation == TokenOperation.GROUP_ACCEPT_TERMS)
+
+        # Find and return all user names associated with the discovered tokens
+        pending_user_names = set(tmp_token.user.user_name for tmp_token in tmp_tokens)
+
+        # Remove any user already belonging to the group, in case any tokens are irrelevant.
+        # Should not happen since related tokens are deleted upon T&C acceptation.
+        pending_user_names = pending_user_names - member_user_names
+        user_names = user_names.union(pending_user_names)
     return ax.valid_http(http_success=HTTPOk, detail=s.GroupUsers_GET_OkResponseSchema.description,
                          content={"user_names": sorted(user_names)})
 

magpie/api/management/register/register_utils.py

@@ -65,7 +65,7 @@ def handle_temporary_token(tmp_token, request):
                         http_error=HTTPInternalServerError, msg_on_fail="Invalid token.")
         ax.verify_param(tmp_token.user, not_none=True,
                         http_error=HTTPInternalServerError, msg_on_fail="Invalid token.")
-        uu.assign_user_group(tmp_token.user, tmp_token.group, request.db)
+        response = uu.handle_user_group_terms_confirmation(tmp_token, request)
 
     elif tmp_token.operation == TokenOperation.USER_PASSWORD_RESET:
         ax.verify_param(tmp_token.user, not_none=True,

magpie/api/management/register/register_views.py

@@ -122,6 +122,10 @@ def join_discoverable_group_view(request):
     user = ar.get_logged_user(request)
     group = ru.get_discoverable_group_by_name(group.group_name, db_session=request.db)
 
+    if group.terms:
+        # If group requires terms acceptation, send T&C email and await confirmation before adding the user to the group
+        return uu.send_group_terms_email(user, group, request.db)
+
     ax.verify_param(user.id, param_compare=[usr.id for usr in group.users], not_in=True, with_param=False,
                     http_error=HTTPConflict, content={"user_name": user.user_name, "group_name": group.group_name},
                     msg_on_fail=s.RegisterGroup_POST_ConflictResponseSchema.description)

magpie/api/management/user/user_formats.py

@@ -4,7 +4,7 @@
 
 from magpie.api.exception import evaluate_call
 from magpie.constants import get_constant
-from magpie.models import UserStatuses
+from magpie.models import UserGroupStatus, UserStatuses
 
 if TYPE_CHECKING:
     from typing import List
@@ -42,6 +42,10 @@ def fmt_usr():
         if not basic_info:
             grp_names = group_names if group_names else [grp.group_name for grp in user.groups]
             user_info["group_names"] = list(sorted(grp_names))
+
+            # indicate if user has any pending T&C groups
+            user_info["has_pending_group"] = bool(user.get_groups_by_status(UserGroupStatus.PENDING))
+
         # special users not meant to be used as valid "accounts" marked as without an ID
         if user.user_name != get_constant("MAGPIE_ANONYMOUS_USER") and status != UserStatuses.Pending:
             user_info["user{}id".format(sep)] = int(user.id)