migration to deactivate old gracedb processor accounts and add a new EM follow-up account

gracedb/ligoauth/migrations/0005_update_emfollow_accounts.py

+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.5 on 2018-04-24 16:12
+#
+# This migration adds a new "emfollow" user which will be used for
+# EM follow-up activities.  The old EM follow-up accounts will be deactivated
+# and their X509Certs will be deleted.
+
+from __future__ import unicode_literals
+
+from django.db import migrations
+from django.conf import settings
+
+OLD_ACCOUNTS = {
+    'gdb-processor': {
+        'email': 'gdb_processor@gravity.phys.uwm.edu',
+        'last_name': 'GDB Processor',
+        'certs': [
+            '/DC=org/DC=ligo/O=LIGO/OU=Services/CN=gdb_processor/pcdev2.phys.uwm.edu',
+            '/DC=org/DC=ligo/O=LIGO/OU=Services/CN=gdb-processor/marlin.phys.uwm.edu',
+        ],
+    },
+    'gracedb.processor': {
+        'email': 'alexander.urban@ligo.org',
+        'last_name': 'GraceDB Processor',
+        'certs': [
+            '/DC=org/DC=ligo/O=LIGO/OU=Services/CN=gracedb.processor/ldas-grid.ligo.caltech.edu',
+            '/DC=org/DC=ligo/O=LIGO/OU=Services/CN=gracedb.processor/emfollow.ligo.caltech.edu',
+        ],
+    },
+}
+
+NEW_ACCOUNT = {
+    'username': 'emfollow',
+    'last_name': 'LIGO/Virgo EM Follow-Up',
+    'email': 'leo.singer@ligo.org',
+}
+
+NEW_CERTS = [
+    '/DC=org/DC=ligo/O=LIGO/OU=Services/CN=emfollow/emfollow.ligo.caltech.edu'
+]
+
+def deactivate_old_and_add_new_accounts(apps, schema_editor):
+    LocalUser = apps.get_model('ligoauth', 'LocalUser')
+    X509Cert = apps.get_model('ligoauth', 'X509Cert')
+    Group = apps.get_model('auth', 'Group')
+
+    # Mark old users as inactive and delete their certificates
+    for username in OLD_ACCOUNTS.keys():
+        user = LocalUser.objects.get(username=username)
+        for subject in OLD_ACCOUNTS[username]['certs']:
+            cert = user.x509cert_set.get(subject=subject)
+            cert.delete()
+        user.is_active = False
+        user.save()
+
+    # Create new EM follow-up user
+    new_user = LocalUser.objects.create(**NEW_ACCOUNT)
+
+    # Create and add certificate for new account
+    for subject in NEW_CERTS:
+        new_user.x509cert_set.create(subject=subject)
+
+    # Add user to LVC group
+    group = Group.objects.get(name=settings.LVC_GROUP)
+    group.user_set.add(new_user)
+
+def activate_old_and_remove_new_accounts(apps, schema_editor):
+    LocalUser = apps.get_model('ligoauth', 'LocalUser')
+    X509Cert = apps.get_model('ligoauth', 'X509Cert')
+
+    # Activate old accounts and add their X509 certificates
+    for username in OLD_ACCOUNTS.keys():
+        user = LocalUser.objects.get(username=username)
+        for subject in OLD_ACCOUNTS[username]['certs']:
+            cert = user.x509cert_set.create(subject=subject)
+        user.is_active = True
+        user.save()
+
+    # Delete new EM follow-up user and certs
+    new_user = LocalUser.objects.get(username=NEW_ACCOUNT['username'])
+    for subject in NEW_CERTS:
+        cert = new_user.x509cert_set.get(subject=subject)
+        cert.delete()
+    new_user.delete()
+
+    # Create and add certificate for new account
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ligoauth', '0004_update_gstlal_spiir_account'),
+    ]
+
+    operations = [
+        migrations.RunPython(deactivate_old_and_add_new_accounts,
+            activate_old_and_remove_new_accounts),
+    ]

gracedb/migrations/auth/0015_update_emfollow_accounts.py

+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.5 on 2017-11-02 19:26
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+# Gives users table-level permissions which allows the addition and deletion
+# of row-level permissions (again, used for exposing/hiding events).
+
+# List of usernames
+OLD_USER = 'gracedb.processor'
+NEW_USER = 'emfollow'
+
+# List of permission codenames
+PERMS = [
+    'add_groupobjectpermission',
+    'delete_groupobjectpermission',
+]
+
+def add_perms(apps, schema_editor):
+    User = apps.get_model('auth', 'User')
+    Permission = apps.get_model('auth', 'Permission')
+
+    # Get users
+    old_user = User.objects.get(username=OLD_USER)
+    new_user = User.objects.get(username=NEW_USER)
+
+    # Add/remove perms
+    for perm in PERMS:
+        perm = Permission.objects.get(codename=perm)
+        old_user.user_permissions.remove(perm)
+        new_user.user_permissions.add(perm)
+
+
+def remove_perms(apps, schema_editor):
+    User = apps.get_model('auth', 'User')
+    Permission = apps.get_model('auth', 'Permission')
+
+    # Get users
+    old_user = User.objects.get(username=OLD_USER)
+    new_user = User.objects.get(username=NEW_USER)
+
+    # Add/remove perms
+    for perm in PERMS:
+        perm = Permission.objects.get(codename=perm)
+        old_user.user_permissions.add(perm)
+        new_user.user_permissions.remove(perm)
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('auth', '0014_add_user_permissions_on_groupobjectpermissions'),
+        ('ligoauth', '0005_update_emfollow_accounts'),
+    ]
+
+    operations = [
+        migrations.RunPython(add_perms, remove_perms)
+    ]

gracedb/migrations/guardian/0003_update_emfollow_accounts.py

+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.5 on 2018-04-25 01:51
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+OLD_ACCOUNTS = {
+    'gdb-processor': ['CWB', 'Fermi', 'gstlal', 'HardwareInjection', 'SNEWS',
+        'Swift'],
+    'gracedb.processor': ['CWB2G', 'Fermi', 'gstlal', 'SNEWS', 'Swift'],
+}
+
+NEW_ACCOUNT_USERNAME = 'emfollow'
+NEW_ACCOUNT_PIPELINES = list(set([item for items in OLD_ACCOUNTS.values() for
+    item in items]))
+
+
+def update_perms(apps, schema_editor):
+    LocalUser = apps.get_model('ligoauth', 'LocalUser')
+    UserObjectPermission = apps.get_model('guardian', 'UserObjectPermission')
+    Pipeline = apps.get_model('events', 'Pipeline')
+    Permission = apps.get_model('auth', 'Permission')
+    ContentType = apps.get_model('contenttypes', 'ContentType')
+
+    perm = Permission.objects.get(codename='populate_pipeline')
+    ctype = ContentType.objects.get_for_model(Pipeline)
+
+    # Remove UOPs from old accounts which allow pipeline population
+    for username, pipelines in OLD_ACCOUNTS.iteritems():
+        user = LocalUser.objects.get(username=username)
+        for pipeline_name in pipelines:
+            pipeline = Pipeline.objects.get(name=pipeline_name)
+            uop = UserObjectPermission.objects.get(user=user,
+                permission=perm, content_type=ctype, object_pk=pipeline.id)
+            uop.delete()
+
+    # Add these UOPs to new acccount
+    user = LocalUser.objects.get(username=NEW_ACCOUNT_USERNAME)
+    for pipeline_name in NEW_ACCOUNT_PIPELINES:
+        pipeline = Pipeline.objects.get(name=pipeline_name)
+        uop = UserObjectPermission.objects.create(user=user, permission=perm,
+            content_type=ctype, object_pk = pipeline.id)
+
+
+def revert_perms(apps, schema_editor):
+    LocalUser = apps.get_model('ligoauth', 'LocalUser')
+    UserObjectPermission = apps.get_model('guardian', 'UserObjectPermission')
+    Pipeline = apps.get_model('events', 'Pipeline')
+    Permission = apps.get_model('auth', 'Permission')
+    ContentType = apps.get_model('contenttypes', 'ContentType')
+
+    perm = Permission.objects.get(codename='populate_pipeline')
+    ctype = ContentType.objects.get_for_model(Pipeline)
+
+    # Re-add UOPs to old accounts which allow pipeline population
+    for username, pipelines in OLD_ACCOUNTS.iteritems():
+        user = LocalUser.objects.get(username=username)
+        for pipeline_name in pipelines:
+            pipeline = Pipeline.objects.get(name=pipeline_name)
+            uop = UserObjectPermission.objects.create(user=user,
+                permission=perm, content_type=ctype, object_pk = pipeline.id)
+
+    # Remove these UOPs from new acccount
+    user = LocalUser.objects.get(username=NEW_ACCOUNT_USERNAME)
+    for pipeline_name in NEW_ACCOUNT_PIPELINES:
+        pipeline = Pipeline.objects.get(name=pipeline_name)
+        uop = UserObjectPermission.objects.get(user=user, permission=perm,
+            content_type=ctype, object_pk = pipeline.id)
+        uop.delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('guardian', '0002_authorize_users_to_populate_pipelines'),
+        ('ligoauth', '0005_update_emfollow_accounts'),
+    ]
+
+    operations = [
+        migrations.RunPython(update_perms, revert_perms),
+    ]