Feat: Implemented SUDO Department & API Key, CA Serial

2026-03-08 18:10:26 +05:45
parent ff976ee1cc
commit f334000da3
16 changed files with 911 additions and 5 deletions
@@ -0,0 +1,137 @@
+"""Sudoer check and sudo-related endpoints."""
+from flask import request
+from gatehouse_app.api.v1 import api_v1_bp
+from gatehouse_app.utils.response import api_response
+from gatehouse_app.models.organization import OrganizationApiKey
+from gatehouse_app.models.ssh_ca.ssh_certificate import SSHCertificate
+from gatehouse_app.models.organization import Department, DepartmentMembership
+
+
+@api_v1_bp.route("/sudo/check", methods=["POST"])
+def check_sudoer():
+    """
+    Check if a user with a given certificate can sudo.
+    
+    This endpoint validates an API key for an organization, retrieves the certificate
+    by serial ID, finds the user and their departments, and checks if any of their
+    departments have sudo capability.
+    
+    Request body:
+        api_key: Organization API key (required)
+        certificate_serial: Certificate serial ID (required)
+    
+    Returns:
+        200: Sudoer status returned
+        400: Invalid request body
+        401: Invalid API key
+        403: Certificate not found or user not found
+        404: Organization or certificate not found
+    """
+    try:
+        data = request.get_json()
+        
+        if not data:
+            return api_response(
+                success=False,
+                message="Request body is required",
+                status=400,
+                error_type="INVALID_REQUEST",
+            )
+        
+        api_key = data.get("api_key")
+        certificate_serial = data.get("certificate_serial")
+        
+        if not api_key or certificate_serial is None:
+            return api_response(
+                success=False,
+                message="api_key and certificate_serial are required",
+                status=400,
+                error_type="MISSING_REQUIRED_FIELDS",
+            )
+        
+        # Find the certificate by serial
+        certificate = SSHCertificate.query.filter_by(
+            serial=certificate_serial,
+            deleted_at=None
+        ).first()
+        
+        if not certificate:
+            return api_response(
+                success=False,
+                message="Certificate not found",
+                status=404,
+                error_type="NOT_FOUND",
+            )
+        
+        # Get the CA and organization
+        ca = certificate.ca
+        if not ca:
+            return api_response(
+                success=False,
+                message="Certificate CA not found",
+                status=404,
+                error_type="NOT_FOUND",
+            )
+        
+        org_id = ca.organization_id
+        
+        # Verify the API key for this organization
+        org_api_key = OrganizationApiKey.verify_key(org_id, api_key)
+        
+        if not org_api_key:
+            return api_response(
+                success=False,
+                message="Invalid API key for organization",
+                status=401,
+                error_type="UNAUTHORIZED",
+            )
+        
+        # Get the user from the certificate
+        user = certificate.user
+        if not user:
+            return api_response(
+                success=False,
+                message="Certificate user not found",
+                status=404,
+                error_type="NOT_FOUND",
+            )
+        
+        # Get all departments the user belongs to
+        user_departments = DepartmentMembership.query.filter_by(
+            user_id=user.id,
+            deleted_at=None
+        ).all()
+        
+        # Check if any of the user's departments have sudo capability
+        can_sudo = False
+        sudoer_departments = []
+        
+        for dept_membership in user_departments:
+            dept = dept_membership.department
+            if dept and dept.can_sudo and dept.deleted_at is None:
+                can_sudo = True
+                sudoer_departments.append({
+                    "id": dept.id,
+                    "name": dept.name,
+                })
+        
+        return api_response(
+            data={
+                "can_sudo": can_sudo,
+                "user_id": user.id,
+                "user_email": user.email,
+                "certificate_serial": certificate.serial,
+                "sudoer_departments": sudoer_departments,
+                "all_departments_count": len(user_departments),
+            },
+            message="Sudoer status retrieved successfully",
+            status=200,
+        )
+    
+    except Exception as e:
+        return api_response(
+            success=False,
+            message=f"An error occurred: {str(e)}",
+            status=500,
+            error_type="INTERNAL_ERROR",
+        )