Support 202102 (#950)

* install django-grainy

* nsp to grainy first iteration

* nsp to grainy second iteration

* grainy and django-grainy pinned to latest releases

* Fix typo

* Update djangorestframework, peeringdb, django-ratelimit

* Rewrite login view ratelimit decorator

* Relock pipfile

* add list() to make copy of dictionaries before iterating

* relock pipfile with python3.9
change docker to use python3.9

* add ordering to admin search queryset for deskproticket and email

* add org api key and begin to write tests

* additional key tests

* add drf-api-keys to pipfile

* Wire orgapikey to modelviewsetpermissions

* Update api key helper functions

* add put test

* Add Org API key tab to frontend

* Add user api key model

* Update user key handling and tests

* Update APIPermissionsApplicator to make it work w requests

* Add org api key perm panel

* add org key permissions

* Add user api key views

* Add templates for handling user api key (adding, not revoking)

* relock pipfile

* assorted fixes and tweaks

* Add general user group permissions and org user group perms

* refactor org api key perms

* Add tests for api keys

* Add docstrings to permissions helpers

* Add api key examples

* squash migrations

* remove custom api key header config

* Change api key test setup

* Update permissions for grainy change

* Bump up pipfile and pipfile.lock

* Add API Key to Verification Queue Item

* Delete travis

* Add workaround to Dockerfile

* update pipfile and sort out migrations

* Add comment to Dockerfile

* Re-add API Key migrations

* Add locale to .gitignore

* remove suggest functionality from ix

* Update test to recognize that IX api no longer has suggest function

* Add test to outlaw POSTing an IX w its org equal to the suggest entity org

* Add meta information geowarning

* Add alert to demonstrate UI

* Add error to fac update

* Add template warning for geovalidation

* Add geowarning meta js

* cover absent meta_response test case

* Update styles for geowarning

* refactor geotag warning implementation

* null lat and long on unsuccessful geo locate

* modify geovalidation frontend update

* Add deskproticket model email field

* Add missing span

* add email to org keys

* Add email to org key tests

* update serializer with rdap validation wrapper

* update admin for api keys

* Enable writing an email as part of org key creation

* Add email validation to org api key form

* fix css style on perm row

* Add suggested info to api response

* display suggested address on frontend

* add needs geocode to serializer

* save lat long on forward geonormalization

* add address suggestion submit button

* Add suggested address popin to ADD facility form

* Fix css

* add lat and long rounding to geocodenabled model clean method

* add migration and regression test for lat long decimal db constraint

* Add another regression test for model decimal places

* Get deskpro functions passing isort and flake

* Update ticket_queue_deletion_prevented

* update ticket_queue_deletion_prevented for use with org api key

* add template for org key dpt from asnauto skipvq

* Update deskproticket for rdap error

* add facility aka

* add aka to serializer and views

* black and isort test api keys

* fix typo in org key deskpro template

* skip or rewrite unapplicable org key tests, and add as_set tests

* adjust api key test comments

* Add vqi_notify to signals

* Add reversion comments for api keys and helper function

* update how org keys are added to verification queue items

* rename verification queue item fk from api_key to org_key

* fix group id error

* update key tests with correct http header info

* check both user and key, not just user

* templates fiex

* adapt deskpro integration to work with email only

* make org api keys editable for desc and email

* pipfile relock

* edit test setupdata settings for groups

* Change comment to signify we don't need to remove code

* address untranslated accept button

* Add docstrings to the serializer functions

* Add loading shim

* Add migration for all longname and aka

* Add aka and long name to views and serializers

* delete migration w decimals

* standardize serializer lat and long fields

* Add clean rounding for lat and long

* fix serializer error

* api key admin improvements

* fix linebreak in user api key form

* remove debug prints

* Add rounding util

* Add rounding to lat and long fields

* remove 'clean' from geocode method (logic now in admin form)

* remove erroneous tests

* revert serializer changes

* Fix migrations

* Add long name and aka to admin models

* Update API key docs

* Add documentation for api keys

* fix typo

* fix org api key revoke broken by editable api keys

* doc tweaks

* doc tweaks

* doc tweaks

* black format

* fix migration hierarchy

* docs

* docs

* api key permissions screenshot

* formatting

* formatting

* padding fixed

* remove one image

* fix get_user_from_request type checking
take out POST only valdiator for entity suggest

* didnt mean to commit the django-peeringdb mount

* fix suggest on PUT net
fix tests

* black formatting

* update org key permission template

* install rust for cryptography

* pipfile relock (django-peeringdb to 2.6)

Co-authored-by: Stefan Pratter <stefan@20c.com>
Co-authored-by: Elliot Frank <elliot@20c.com>

peeringdb_server/rest.py

@@ -21,6 +21,7 @@ from django.utils import timezone
 from django.db.models import DateTimeField
 from django.utils.translation import ugettext_lazy as _
 from django_grainy.rest import ModelViewSetPermissions, PermissionDenied
+
 import reversion
 
 from peeringdb_server.models import Network, UTC, ProtectedAction
@@ -28,7 +29,13 @@ from peeringdb_server.serializers import ParentStatusException
 from peeringdb_server.api_cache import CacheRedirect, APICacheLoader
 from peeringdb_server.api_schema import BaseSchema
 from peeringdb_server.deskpro import ticket_queue_deletion_prevented
-from peeringdb_server.util import check_permissions, APIPermissionsApplicator
+from peeringdb_server.permissions import (
+    ModelViewSetPermissions,
+    check_permissions_from_request,
+    APIPermissionsApplicator,
+    get_org_key_from_request,
+    get_user_key_from_request,
+)
 
 
 class DataException(ValueError):
@@ -37,7 +44,7 @@ class DataException(ValueError):
 
 class DataMissingException(DataException):
 
-    """
+    """ ""
     Will be raised when the json data sent with a POST, PUT or PATCH
     request is missing
     """
@@ -490,7 +497,7 @@ class ModelViewSet(viewsets.ModelViewSet):
 
         print("done in %.5f seconds, %d queries" % (d, len(connection.queries)))
 
-        applicator = APIPermissionsApplicator(request.user)
+        applicator = APIPermissionsApplicator(request)
 
         if not applicator.is_generating_api_cache:
             r.data = applicator.apply(r.data)
@@ -508,7 +515,7 @@ class ModelViewSet(viewsets.ModelViewSet):
         d = time.time() - t
         print("done in %.5f seconds, %d queries" % (d, len(connection.queries)))
 
-        applicator = APIPermissionsApplicator(request.user)
+        applicator = APIPermissionsApplicator(request)
 
         if not applicator.is_generating_api_cache:
             r.data = applicator.apply(r.data)
@@ -543,9 +550,18 @@ class ModelViewSet(viewsets.ModelViewSet):
         """
         try:
             self.require_data(request)
+
+            org_key = get_org_key_from_request(request)
+            user_key = get_user_key_from_request(request)
+
             with reversion.create_revision():
-                if request.user:
+                if request.user and request.user.is_authenticated:
                     reversion.set_user(request.user)
+                if org_key:
+                    reversion.set_comment(f"API-key: {org_key.prefix}")
+                if user_key:
+                    reversion.set_comment(f"API-key: {user_key.prefix}")
+
                 r = super().create(request, *args, **kwargs)
                 if "_grainy" in r.data:
                     del r.data["_grainy"]
@@ -566,9 +582,17 @@ class ModelViewSet(viewsets.ModelViewSet):
         """
         try:
             self.require_data(request)
+
+            org_key = get_org_key_from_request(request)
+            user_key = get_user_key_from_request(request)
+
             with reversion.create_revision():
-                if request.user:
+                if request.user and request.user.is_authenticated:
                     reversion.set_user(request.user)
+                if org_key:
+                    reversion.set_comment(f"API-key: {org_key.prefix}")
+                if user_key:
+                    reversion.set_comment(f"API-key: {user_key.prefix}")
 
                 r = super().update(request, *args, **kwargs)
                 if "_grainy" in r.data:
@@ -609,10 +633,16 @@ class ModelViewSet(viewsets.ModelViewSet):
             except self.model.DoesNotExist:
                 return Response(status=status.HTTP_204_NO_CONTENT)
 
-            if check_permissions(request.user, obj, "d"):
+            user_key = get_user_key_from_request(request)
+            org_key = get_org_key_from_request(request)
+            if check_permissions_from_request(request, obj, "d"):
                 with reversion.create_revision():
-                    if request.user:
+                    if request.user and request.user.is_authenticated:
                         reversion.set_user(request.user)
+                    if org_key:
+                        reversion.set_comment(f"API-key: {org_key.prefix}")
+                    if user_key:
+                        reversion.set_comment(f"API-key: {user_key.prefix}")
                     obj.delete()
                 return Response(status=status.HTTP_204_NO_CONTENT)
             else:
@@ -622,7 +652,7 @@ class ModelViewSet(viewsets.ModelViewSet):
                 "Please contact {} to help with the deletion of this object"
             ).format(settings.DEFAULT_FROM_EMAIL)
 
-            ticket_queue_deletion_prevented(request.user, exc.protected_object)
+            ticket_queue_deletion_prevented(request, exc.protected_object)
 
             return Response(
                 status=status.HTTP_403_FORBIDDEN, data={"detail": exc_message}