From 14ae18c48a5afedc59ee650fd10c46971d1ef7c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.coop>
Date: Tue, 15 Nov 2022 12:08:17 +0100
Subject: [PATCH 1/3] profile modal refactoring

---
 canaille/static/js/confirm.js   | 2 +-
 canaille/templates/profile.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/canaille/static/js/confirm.js b/canaille/static/js/confirm.js
index 6ef00321..0673ffbd 100644
--- a/canaille/static/js/confirm.js
+++ b/canaille/static/js/confirm.js
@@ -1,6 +1,6 @@
 $('.confirm').click(function(e){
     e.preventDefault();
-    $('.ui.modal')
+    $('#modal-' + e.target.id + '.ui.modal')
         .modal({
             onApprove : function() {
                 $('.confirm').unbind('click').click();
diff --git a/canaille/templates/profile.html b/canaille/templates/profile.html
index 288c068f..16aedc6a 100644
--- a/canaille/templates/profile.html
+++ b/canaille/templates/profile.html
@@ -23,7 +23,7 @@
 
 {% block content %}
     {% if self_deletion or (user.can_manage_users and edited_user) %}
-        <div class="ui basic modal">
+        <div id="modal-delete" class="ui basic modal">
             <div class="ui icon header">
                 <i class="user minus icon"></i>
                 {% trans %}Account deletion{% endtrans %}

From 239cf6bcc7cffa559348dac44e4b38e7d1f32a01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.coop>
Date: Tue, 15 Nov 2022 12:09:03 +0100
Subject: [PATCH 2/3] Refactored LDAPObject

- delete attributes when value is [None]
- ability to set attributes other than those contained in MAY and MUST
  because some operational attributes does not appear in those
- Make python datetime.min match the minimum LDAP date
- Use enums to store LDAP syntaxes
---
 canaille/ldap_backend/ldapobject.py | 71 ++++++++++++++++++-----------
 1 file changed, 44 insertions(+), 27 deletions(-)

diff --git a/canaille/ldap_backend/ldapobject.py b/canaille/ldap_backend/ldapobject.py
index 6b94d45c..3b85589b 100644
--- a/canaille/ldap_backend/ldapobject.py
+++ b/canaille/ldap_backend/ldapobject.py
@@ -1,9 +1,19 @@
 import datetime
+from enum import Enum
 
 import ldap.dn
 import ldap.filter
 from flask import g
 
+LDAP_NULL_DATE = "000001010000Z"
+
+
+class Syntax(str, Enum):
+    GENERALIZED_TIME = "1.3.6.1.4.1.1466.115.121.1.24"
+    INTEGER = "1.3.6.1.4.1.1466.115.121.1.27"
+    JPEG = "1.3.6.1.4.1.1466.115.121.1.28"
+    BOOLEAN = "1.3.6.1.4.1.1466.115.121.1.7"
+
 
 class LDAPObject:
     _object_class_by_name = None
@@ -175,17 +185,25 @@ class LDAPObject:
         except KeyError:
             return value
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.24":  # Generalized Time
+        if syntax == Syntax.GENERALIZED_TIME:
             value = value.decode("utf-8")
-            return datetime.datetime.strptime(value, "%Y%m%d%H%M%SZ") if value else None
+            if value == LDAP_NULL_DATE:
+                # python cannot represent datetimes with year 0
+                return datetime.datetime.min
+            else:
+                return (
+                    datetime.datetime.strptime(value, "%Y%m%d%H%M%SZ")
+                    if value
+                    else None
+                )
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.27":  # Integer
+        if syntax == Syntax.INTEGER:
             return int(value.decode("utf-8"))
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.28":  # JPEG
+        if syntax == Syntax.JPEG:
             return value
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.7":  # Boolean
+        if syntax == Syntax.BOOLEAN:
             return value.decode("utf-8").upper() == "TRUE"
 
         return value.decode("utf-8")
@@ -197,16 +215,19 @@ class LDAPObject:
         except KeyError:
             return value
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.24":  # Generalized Time
-            return value.strftime("%Y%m%d%H%M%SZ").encode("utf-8")
+        if syntax == Syntax.GENERALIZED_TIME and isinstance(value, datetime.datetime):
+            if value == datetime.datetime.min:
+                return LDAP_NULL_DATE.encode("utf-8")
+            else:
+                return value.strftime("%Y%m%d%H%M%SZ").encode("utf-8")
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.27":  # Integer
+        if syntax == Syntax.INTEGER and isinstance(value, int):
             return str(value).encode("utf-8")
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.28":  # JPEG
+        if syntax == Syntax.JPEG:
             return value
 
-        if syntax == "1.3.6.1.4.1.1466.115.121.1.7":  # Boolean
+        if syntax == Syntax.BOOLEAN and isinstance(value, bool):
             return ("TRUE" if value else "FALSE").encode("utf-8")
 
         return value.encode("utf-8")
@@ -243,7 +264,7 @@ class LDAPObject:
             deletions = [
                 name
                 for name, value in self.changes.items()
-                if value is None and name in self.attrs
+                if (value is None or value == [None]) and name in self.attrs
             ]
             changes = {
                 name: value
@@ -333,20 +354,18 @@ class LDAPObject:
             else name
         )
 
-        if (not self.may or attribute_name not in self.may) and (
-            not self.must or attribute_name not in self.must
-        ):
-            return super().__getattribute__(attribute_name)
+        if attribute_name in self.ldap_object_attributes():
+            if (
+                not self.ldap_object_attributes()
+                or not self.ldap_object_attributes()[attribute_name].single_value
+            ):
+                return self.changes.get(name, self.attrs.get(attribute_name, []))
+            else:
+                return self.changes.get(
+                    attribute_name, self.attrs.get(attribute_name, [None])
+                )[0]
 
-        if (
-            not self.ldap_object_attributes()
-            or not self.ldap_object_attributes()[attribute_name].single_value
-        ):
-            return self.changes.get(name, self.attrs.get(attribute_name, []))
-
-        return self.changes.get(attribute_name, self.attrs.get(attribute_name, [None]))[
-            0
-        ]
+        return super().__getattribute__(attribute_name)
 
     def __setattr__(self, name, value):
         attribute_name = (
@@ -357,9 +376,7 @@ class LDAPObject:
 
         super().__setattr__(attribute_name, value)
 
-        if (self.may and attribute_name in self.may) or (
-            self.must and attribute_name in self.must
-        ):
+        if attribute_name in self.ldap_object_attributes():
             if self.ldap_object_attributes()[attribute_name].single_value:
                 self.changes[attribute_name] = [value]
             else:

From d559d8774a619a973660d3acdaa95af7ac50e370 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89loi=20Rivard?= <eloi@yaal.coop>
Date: Tue, 15 Nov 2022 12:47:44 +0100
Subject: [PATCH 3/3] Refactored demo instanciation

---
 demo/ldap-server.py                           | 22 ++++++++----------
 .../{memberof.ldif => memberof-config.ldif}   |  0
 tests/conftest.py                             | 23 +++++++++++++------
 3 files changed, 26 insertions(+), 19 deletions(-)
 rename demo/ldif/{memberof.ldif => memberof-config.ldif} (100%)

diff --git a/demo/ldap-server.py b/demo/ldap-server.py
index 8c59614d..2a572ce4 100644
--- a/demo/ldap-server.py
+++ b/demo/ldap-server.py
@@ -15,7 +15,7 @@ slapd = slapd.Slapd(
         "nis.ldif",
         "inetorgperson.ldif",
         "../canaille/ldap_backend/schemas/oauth2-openldap.ldif",
-        "ldif/memberof.ldif",
+        "ldif/memberof-config.ldif",
     ),
 )
 slapd.start()
@@ -39,17 +39,15 @@ try:
         + "\n"
     )
 
-    with open("ldif/bootstrap-tree.ldif") as fd:
-        try:
-            slapd.ldapadd(fd.read())
-        except RuntimeError:
-            pass
-
-    with open("ldif/bootstrap-data.ldif") as fd:
-        try:
-            slapd.ldapadd(fd.read())
-        except RuntimeError:
-            pass
+    for ldif in (
+        "ldif/bootstrap-tree.ldif",
+        "ldif/bootstrap-data.ldif",
+    ):
+        with open(ldif) as fd:
+            try:
+                slapd.ldapadd(fd.read())
+            except RuntimeError:
+                pass
 
     slapd.wait()
 finally:
diff --git a/demo/ldif/memberof.ldif b/demo/ldif/memberof-config.ldif
similarity index 100%
rename from demo/ldif/memberof.ldif
rename to demo/ldif/memberof-config.ldif
diff --git a/tests/conftest.py b/tests/conftest.py
index 34433237..77f9f4cf 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -27,6 +27,7 @@ class CustomSlapdObject(slapd.Slapd):
                 "nis.ldif",
                 "inetorgperson.ldif",
                 "canaille/ldap_backend/schemas/oauth2-openldap.ldif",
+                "demo/ldif/memberof-config.ldif",
             ),
         )
 
@@ -80,7 +81,7 @@ def keypair_path(keypair, tmp_path):
 
 
 @pytest.fixture(scope="session")
-def slapd_server():
+def raw_slapd_server():
     slapd = CustomSlapdObject()
     try:
         slapd.start()
@@ -110,17 +111,25 @@ def slapd_server():
             + "\n"
         )
 
-        LDAPObject.root_dn = slapd.suffix
-        User.base = "ou=users"
-        User.object_class = ["inetOrgPerson"]
-        Group.base = "ou=groups"
-        Group.object_class = ["groupOfNames"]
-
         yield slapd
     finally:
         slapd.stop()
 
 
+@pytest.fixture(scope="session")
+def slapd_server(raw_slapd_server):
+    for ldif in ("demo/ldif/bootstrap-tree.ldif",):
+        with open(ldif) as fd:
+            raw_slapd_server.ldapadd(fd.read())
+
+    LDAPObject.root_dn = raw_slapd_server.suffix
+    User.base = "ou=users"
+    User.object_class = ["inetOrgPerson"]
+    Group.base = "ou=groups"
+    Group.object_class = ["groupOfNames"]
+    yield raw_slapd_server
+
+
 @pytest.fixture
 def slapd_connection(slapd_server, testclient):
     g.ldap = ldap.ldapobject.SimpleLDAPObject(slapd_server.ldap_uri)