FitTrackee/fittrackee/users/users.py

699 lines
21 KiB
Python
Raw Normal View History

import os
import shutil
2021-01-02 19:28:03 +01:00
from typing import Any, Dict, Tuple, Union
from flask import Blueprint, current_app, request, send_file
from sqlalchemy import asc, desc, exc
2021-01-20 16:47:00 +01:00
from fittrackee import db, limiter
from fittrackee.emails.tasks import (
email_updated_to_new_address,
password_change_email,
reset_password_email,
)
2022-02-16 12:55:55 +01:00
from fittrackee.files import get_absolute_file_path
from fittrackee.oauth2.server import require_auth
2021-01-01 16:39:25 +01:00
from fittrackee.responses import (
ForbiddenErrorResponse,
2021-01-02 19:28:03 +01:00
HttpResponse,
2021-01-01 16:39:25 +01:00
InvalidPayloadErrorResponse,
NotFoundErrorResponse,
UserNotFoundErrorResponse,
handle_error_and_return_response,
)
from fittrackee.utils import get_readable_duration
from fittrackee.workouts.models import Record, Workout, WorkoutSegment
2017-12-16 21:00:46 +01:00
from .exceptions import InvalidEmailException, UserNotFoundException
from .models import User, UserDataExport, UserSportPreference
from .utils.admin import UserManagerService
from .utils.language import get_language
2017-12-16 21:00:46 +01:00
users_blueprint = Blueprint('users', __name__)
USER_PER_PAGE = 10
2017-12-16 21:00:46 +01:00
@users_blueprint.route('/users', methods=['GET'])
2022-06-15 19:16:14 +02:00
@require_auth(scopes=['users:read'], as_admin=True)
def get_users(auth_user: User) -> Dict:
"""
Get all users (regardless their account status), if authenticated user
has admin rights.
It returns user preferences only for authenticated user.
**Scope**: ``users:read``
**Example request**:
2023-06-18 20:45:39 +02:00
- without parameters:
.. sourcecode:: http
2020-05-03 11:30:40 +02:00
GET /api/users HTTP/1.1
Content-Type: application/json
2023-06-18 20:45:39 +02:00
- with some query parameters:
.. sourcecode:: http
GET /api/users?order_by=workouts_count&par_page=5 HTTP/1.1
Content-Type: application/json
**Example response**:
.. sourcecode:: http
HTTP/1.1 200 OK
Content-Type: application/json
{
"data": {
"users": [
{
"admin": true,
"bio": null,
"birth_date": null,
"created_at": "Sun, 14 Jul 2019 14:09:58 GMT",
"email": "admin@example.com",
"first_name": null,
2022-03-19 22:02:06 +01:00
"is_admin": true,
"imperial_units": false,
2019-12-29 12:50:32 +01:00
"language": "en",
"last_name": null,
"location": null,
"nb_sports": 3,
"nb_workouts": 6,
"picture": false,
2021-09-21 18:10:27 +02:00
"records": [
{
"id": 9,
"record_type": "AS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 10,
"record_type": "FD",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2022-07-27 11:10:29 +02:00
{
"id": 13,
"record_type": "HA",
"sport_id": 1,
"user": "Sam",
"value": 43.97,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2021-09-21 18:10:27 +02:00
{
"id": 11,
"record_type": "LD",
"sport_id": 1,
"user": "admin",
"value": "1:01:00",
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 12,
"record_type": "MS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
}
],
"sports_list": [
1,
4,
6
],
"timezone": "Europe/Paris",
"total_distance": 67.895,
"total_duration": "6:50:27",
"username": "admin",
"weekm": false
},
{
"admin": false,
"bio": null,
"birth_date": null,
"created_at": "Sat, 20 Jul 2019 11:27:03 GMT",
"email": "sam@example.com",
"first_name": null,
2022-03-19 22:02:06 +01:00
"is_admin": false,
2019-12-29 12:50:32 +01:00
"language": "fr",
"last_name": null,
"location": null,
"nb_sports": 0,
"nb_workouts": 0,
"picture": false,
2021-09-21 18:10:27 +02:00
"records": [],
"sports_list": [],
"timezone": "Europe/Paris",
"total_distance": 0,
"total_duration": "0:00:00",
"username": "sam"
}
]
},
"status": "success"
}
:query integer page: page if using pagination (default: 1)
:query integer per_page: number of users per page (default: 10, max: 50)
:query string q: query on user name
:query string order: sorting order: ``asc``, ``desc`` (default: ``asc``)
:query string order_by: sorting criteria: ``username``, ``created_at``,
``workouts_count``, ``admin``, ``is_active``
(default: ``username``)
:reqheader Authorization: OAuth 2.0 Bearer Token
2023-06-18 20:45:39 +02:00
:statuscode 200: ``success``
:statuscode 401:
2023-06-18 20:45:39 +02:00
- ``provide a valid auth token``
- ``signature expired, please log in again``
- ``invalid token, please log in again``
"""
params = request.args.copy()
2021-05-22 17:14:24 +02:00
page = int(params.get('page', 1))
per_page = int(params.get('per_page', USER_PER_PAGE))
if per_page > 50:
per_page = 50
user_column = getattr(User, params.get('order_by', 'username'))
order = params.get('order', 'asc')
query = params.get('q')
users_pagination = (
User.query.filter(
User.username.ilike('%' + query + '%') if query else True,
)
.order_by(asc(user_column) if order == 'asc' else desc(user_column))
2022-11-26 12:54:56 +01:00
.paginate(page=page, per_page=per_page, error_out=False)
)
users = users_pagination.items
2021-01-01 16:39:25 +01:00
return {
2017-12-16 21:00:46 +01:00
'status': 'success',
'data': {'users': [user.serialize(auth_user) for user in users]},
'pagination': {
'has_next': users_pagination.has_next,
'has_prev': users_pagination.has_prev,
'page': users_pagination.page,
'pages': users_pagination.pages,
'total': users_pagination.total,
},
2017-12-16 21:00:46 +01:00
}
@users_blueprint.route('/users/<user_name>', methods=['GET'])
2022-06-15 19:16:14 +02:00
@require_auth(scopes=['users:read'])
2021-01-02 19:28:03 +01:00
def get_single_user(
auth_user: User, user_name: str
2021-01-02 19:28:03 +01:00
) -> Union[Dict, HttpResponse]:
"""
Get single user details. Only user with admin rights can get other users
details.
It returns user preferences only for authenticated user.
**Scope**: ``users:read``
**Example request**:
.. sourcecode:: http
2020-02-08 14:49:37 +01:00
GET /api/users/admin HTTP/1.1
Content-Type: application/json
**Example response**:
.. sourcecode:: http
HTTP/1.1 200 OK
Content-Type: application/json
{
"data": [
{
"admin": true,
"bio": null,
"birth_date": null,
"created_at": "Sun, 14 Jul 2019 14:09:58 GMT",
"email": "admin@example.com",
"first_name": null,
"imperial_units": false,
2022-03-19 22:02:06 +01:00
"is_admin": true,
"language": "en",
"last_name": null,
"location": null,
"nb_sports": 3,
"nb_workouts": 6,
"picture": false,
2021-09-21 18:10:27 +02:00
"records": [
{
"id": 9,
"record_type": "AS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 10,
"record_type": "FD",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2022-07-27 11:10:29 +02:00
{
"id": 13,
"record_type": "HA",
"sport_id": 1,
"user": "Sam",
"value": 43.97,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2021-09-21 18:10:27 +02:00
{
"id": 11,
"record_type": "LD",
"sport_id": 1,
"user": "admin",
"value": "1:01:00",
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 12,
"record_type": "MS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
}
],
"sports_list": [
1,
4,
6
],
"timezone": "Europe/Paris",
"total_distance": 67.895,
"total_duration": "6:50:27",
"username": "admin"
}
],
"status": "success"
}
:param integer user_name: user name
:reqheader Authorization: OAuth 2.0 Bearer Token
2023-06-18 20:45:39 +02:00
:statuscode 200: ``success``
:statuscode 401:
2023-06-18 20:45:39 +02:00
- ``provide a valid auth token``
- ``signature expired, please log in again``
- ``invalid token, please log in again``
:statuscode 404:
2023-06-18 20:45:39 +02:00
- ``user does not exist``
"""
if user_name != auth_user.username and not auth_user.admin:
return ForbiddenErrorResponse()
2017-12-16 21:00:46 +01:00
try:
user = User.query.filter_by(username=user_name).first()
2021-01-01 16:39:25 +01:00
if user:
return {
'status': 'success',
'data': {'users': [user.serialize(auth_user)]},
}
2017-12-16 21:00:46 +01:00
except ValueError:
2021-01-01 16:39:25 +01:00
pass
return UserNotFoundErrorResponse()
2017-12-16 21:00:46 +01:00
2020-02-08 14:49:37 +01:00
@users_blueprint.route('/users/<user_name>/picture', methods=['GET'])
@limiter.exempt
2021-01-02 19:28:03 +01:00
def get_picture(user_name: str) -> Any:
2020-09-16 11:09:32 +02:00
"""get user picture
**Example request**:
.. sourcecode:: http
2020-02-08 14:49:37 +01:00
GET /api/users/admin/picture HTTP/1.1
Content-Type: application/json
**Example response**:
.. sourcecode:: http
HTTP/1.1 200 OK
Content-Type: image/jpeg
2020-02-08 14:49:37 +01:00
:param integer user_name: user name
2023-06-18 20:45:39 +02:00
:statuscode 200: ``success``
:statuscode 404:
2023-06-18 20:45:39 +02:00
- ``user does not exist``
- ``No picture.``
"""
2018-01-01 21:54:03 +01:00
try:
2020-02-08 14:49:37 +01:00
user = User.query.filter_by(username=user_name).first()
2018-01-01 21:54:03 +01:00
if not user:
2021-01-01 16:39:25 +01:00
return UserNotFoundErrorResponse()
if user.picture is not None:
picture_path = get_absolute_file_path(user.picture)
return send_file(picture_path)
2022-05-28 20:01:14 +02:00
except Exception: # nosec
2021-01-01 16:39:25 +01:00
pass
return NotFoundErrorResponse('No picture.')
2018-01-01 21:54:03 +01:00
@users_blueprint.route('/users/<user_name>', methods=['PATCH'])
2022-06-15 19:16:14 +02:00
@require_auth(scopes=['users:write'], as_admin=True)
def update_user(auth_user: User, user_name: str) -> Union[Dict, HttpResponse]:
"""
Update user account.
- add/remove admin rights (regardless user account status)
- reset password (and send email to update user password,
if sending enabled)
- update user email (and send email to new user email, if sending enabled)
- activate account for an inactive user
Only user with admin rights can modify another user.
**Scope**: ``users:write``
**Example request**:
.. sourcecode:: http
PATCH /api/users/<user_name> HTTP/1.1
Content-Type: application/json
**Example response**:
.. sourcecode:: http
HTTP/1.1 200 OK
Content-Type: application/json
{
"data": [
{
"admin": true,
"bio": null,
"birth_date": null,
"created_at": "Sun, 14 Jul 2019 14:09:58 GMT",
"email": "admin@example.com",
"first_name": null,
"imperial_units": false,
2022-03-19 22:02:06 +01:00
"is_active": true,
"language": "en",
"last_name": null,
"location": null,
"nb_workouts": 6,
"nb_sports": 3,
"picture": false,
2021-09-21 18:10:27 +02:00
"records": [
{
"id": 9,
"record_type": "AS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 10,
"record_type": "FD",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2022-07-27 11:10:29 +02:00
{
"id": 13,
"record_type": "HA",
"sport_id": 1,
"user": "Sam",
"value": 43.97,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
2021-09-21 18:10:27 +02:00
{
"id": 11,
"record_type": "LD",
"sport_id": 1,
"user": "admin",
"value": "1:01:00",
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
},
{
"id": 12,
"record_type": "MS",
"sport_id": 1,
"user": "admin",
"value": 18,
"workout_date": "Sun, 07 Jul 2019 08:00:00 GMT",
"workout_id": "hvYBqYBRa7wwXpaStWR4V2"
}
],
"sports_list": [
1,
4,
6
],
"timezone": "Europe/Paris",
"total_distance": 67.895,
"total_duration": "6:50:27",
"username": "admin"
}
],
"status": "success"
}
:param string user_name: user name
:<json boolean activate: activate user account
:<json boolean admin: does the user have administrator rights
:<json boolean new_email: new user email
:<json boolean reset_password: reset user password
:reqheader Authorization: OAuth 2.0 Bearer Token
2023-06-18 20:45:39 +02:00
:statuscode 200: ``success``
:statuscode 400:
2023-06-18 20:45:39 +02:00
- ``invalid payload``
- ``valid email must be provided``
2023-08-06 23:31:42 +02:00
- ``new email must be different than current email``
:statuscode 401:
2023-06-18 20:45:39 +02:00
- ``provide a valid auth token``
- ``signature expired, please log in again``
- ``invalid token, please log in again``
:statuscode 403: ``you do not have permissions``
:statuscode 404: ``user does not exist``
:statuscode 500: ``error, please try again or contact the administrator``
"""
user_data = request.get_json()
if not user_data:
2021-01-01 16:39:25 +01:00
return InvalidPayloadErrorResponse()
try:
reset_password = user_data.get('reset_password', False)
new_email = user_data.get('new_email')
user_manager_service = UserManagerService(username=user_name)
user, _, _ = user_manager_service.update(
is_admin=user_data.get('admin'),
activate=user_data.get('activate', False),
reset_password=reset_password,
new_email=new_email,
with_confirmation=current_app.config['CAN_SEND_EMAILS'],
)
if current_app.config['CAN_SEND_EMAILS']:
user_language = get_language(user.language)
ui_url = current_app.config['UI_URL']
if reset_password:
user_data = {
'language': user_language,
'email': user.email,
}
password_change_email.send(
user_data,
{
'username': user.username,
'fittrackee_url': ui_url,
},
)
password_reset_token = user.encode_password_reset_token(
user.id
)
reset_password_email.send(
user_data,
{
'expiration_delay': get_readable_duration(
current_app.config[
'PASSWORD_TOKEN_EXPIRATION_SECONDS'
],
user_language,
),
'username': user.username,
'password_reset_url': (
f'{ui_url}/password-reset?'
f'token={password_reset_token}'
),
'fittrackee_url': ui_url,
},
)
if new_email:
user_data = {
'language': user_language,
'email': user.email_to_confirm,
}
email_data = {
'username': user.username,
'fittrackee_url': ui_url,
'email_confirmation_url': (
f'{ui_url}/email-update'
f'?token={user.confirmation_token}'
),
}
email_updated_to_new_address.send(user_data, email_data)
2021-01-01 16:39:25 +01:00
return {
'status': 'success',
'data': {'users': [user.serialize(auth_user)]},
}
except UserNotFoundException:
return UserNotFoundErrorResponse()
except InvalidEmailException as e:
return InvalidPayloadErrorResponse(str(e))
2021-01-01 16:39:25 +01:00
except exc.StatementError as e:
return handle_error_and_return_response(e, db=db)
@users_blueprint.route('/users/<user_name>', methods=['DELETE'])
2022-06-15 19:16:14 +02:00
@require_auth(scopes=['users:write'])
2021-01-02 19:28:03 +01:00
def delete_user(
auth_user: User, user_name: str
2021-01-02 19:28:03 +01:00
) -> Union[Tuple[Dict, int], HttpResponse]:
"""
Delete a user account.
A user can only delete his own account.
An admin can delete all accounts except his account if he's the only
one admin.
**Scope**: ``users:write``
**Example request**:
.. sourcecode:: http
DELETE /api/users/john_doe HTTP/1.1
Content-Type: application/json
**Example response**:
.. sourcecode:: http
HTTP/1.1 204 NO CONTENT
Content-Type: application/json
:param string user_name: user name
:reqheader Authorization: OAuth 2.0 Bearer Token
:statuscode 204: user account deleted
:statuscode 401:
2023-06-18 20:45:39 +02:00
- ``provide a valid auth token``
- ``signature expired, please log in again``
- ``invalid token, please log in again``
:statuscode 403:
2023-06-18 20:45:39 +02:00
- ``you do not have permissions``
- ``you can not delete your account, no other user has admin rights``
:statuscode 404: ``user does not exist``
:statuscode 500: ``error, please try again or contact the administrator``
"""
try:
user = User.query.filter_by(username=user_name).first()
2021-01-01 16:39:25 +01:00
if not user:
return UserNotFoundErrorResponse()
if user.id != auth_user.id and not auth_user.admin:
2021-01-01 16:39:25 +01:00
return ForbiddenErrorResponse()
if (
user.admin is True
and User.query.filter_by(admin=True).count() == 1
):
return ForbiddenErrorResponse(
'you can not delete your account, '
'no other user has admin rights'
)
2021-01-01 16:39:25 +01:00
db.session.query(UserSportPreference).filter(
UserSportPreference.user_id == user.id
).delete()
db.session.query(Record).filter(Record.user_id == user.id).delete()
db.session.query(WorkoutSegment).filter(
WorkoutSegment.workout_id == Workout.id, Workout.user_id == user.id
).delete(synchronize_session=False)
db.session.query(Workout).filter(Workout.user_id == user.id).delete()
db.session.query(UserDataExport).filter(
UserDataExport.user_id == user.id
).delete()
db.session.flush()
2021-01-01 16:39:25 +01:00
user_picture = user.picture
db.session.delete(user)
db.session.commit()
if user_picture:
picture_path = get_absolute_file_path(user.picture)
if os.path.isfile(picture_path):
os.remove(picture_path)
shutil.rmtree(
get_absolute_file_path(f'exports/{user.id}'),
ignore_errors=True,
)
2021-01-01 16:39:25 +01:00
shutil.rmtree(
get_absolute_file_path(f'workouts/{user.id}'),
2021-01-01 16:39:25 +01:00
ignore_errors=True,
)
shutil.rmtree(
get_absolute_file_path(f'pictures/{user.id}'),
ignore_errors=True,
)
return {'status': 'no content'}, 204
except (
exc.IntegrityError,
exc.OperationalError,
ValueError,
OSError,
) as e:
2021-01-01 16:39:25 +01:00
return handle_error_and_return_response(e, db=db)