3 # :title: User management
\r
5 # rbot user management
\r
6 # Author:: Giuseppe Bilotta (giuseppe.bilotta@gmail.com)
\r
7 # Copyright:: Copyright (c) 2006 Giuseppe Bilotta
\r
12 require 'rbot/maskdb'
\r
14 # This would be a good idea if it was failproof, but the truth
\r
15 # is that other methods can indirectly modify the hash. *sigh*
\r
17 # class AuthNotifyingHash < Hash
\r
18 # %w(clear default= delete delete_if replace invert
\r
19 # merge! update rehash reject! replace shift []= store).each { |m|
\r
21 # define_method(m) { |*a|
\r
23 # Irc::Bot::Auth.manager.set_changed
\r
35 # This module contains the actual Authentication stuff
\r
39 Config.register Config::StringValue.new( 'auth.password',
\r
40 :default => 'rbotauth', :wizard => true,
\r
41 :on_change => Proc.new {|bot, v| bot.auth.botowner.password = v},
\r
42 :desc => _('Password for the bot owner'))
\r
43 Config.register Config::BooleanValue.new( 'auth.login_by_mask',
\r
45 :desc => _('Set false to prevent new botusers from logging in without a password when the user netmask is known'))
\r
46 Config.register Config::BooleanValue.new( 'auth.autologin',
\r
48 :desc => _('Set false to prevent new botusers from recognizing IRC users without a need to manually login'))
\r
49 Config.register Config::BooleanValue.new( 'auth.autouser',
\r
50 :default => 'false',
\r
51 :desc => _('Set true to allow new botusers to be created automatically'))
\r
52 # Config.register Config::IntegerValue.new( 'auth.default_level',
\r
53 # :default => 10, :wizard => true,
\r
54 # :desc => 'The default level for new/unknown users' )
\r
56 # Generate a random password of length _l_
\r
58 def Auth.random_password(l=8)
\r
61 pwd << (rand(26) + (rand(2) == 0 ? 65 : 97) ).chr
\r
67 # An Irc::Bot::Auth::Command defines a command by its "path":
\r
69 # base::command::subcommand::subsubcommand::subsubsubcommand
\r
73 attr_reader :command, :path
\r
75 # A method that checks if a given _cmd_ is in a form that can be
\r
76 # reduced into a canonical command path, and if so, returns it
\r
78 def sanitize_command_path(cmd)
\r
79 pre = cmd.to_s.downcase.gsub(/^\*?(?:::)?/,"").gsub(/::$/,"")
\r
80 return pre if pre.empty?
\r
81 return pre if pre =~ /^\S+(::\S+)*$/
\r
82 raise TypeError, "#{cmd.inspect} is not a valid command"
\r
85 # Creates a new Command from a given string; you can then access
\r
86 # the command as a symbol with the :command method and the whole
\r
89 # Command.new("core::auth::save").path => [:"*", :"core", :"core::auth", :"core::auth::save"]
\r
91 # Command.new("core::auth::save").command => :"core::auth::save"
\r
94 cmdpath = sanitize_command_path(cmd).split('::')
\r
95 seq = cmdpath.inject(["*"]) { |list, cmd|
\r
96 list << (list.length > 1 ? list.last + "::" : "") + cmd
\r
98 @path = seq.map { |k|
\r
101 @command = path.last
\r
102 debug "Created command #{@command.inspect} with path #{@path.pretty_inspect}"
\r
106 def to_irc_auth_command
\r
120 # Returns an Irc::Bot::Auth::Comand from the receiver
\r
121 def to_irc_auth_command
\r
122 Irc::Bot::Auth::Command.new(self)
\r
130 # Returns an Irc::Bot::Auth::Comand from the receiver
\r
131 def to_irc_auth_command
\r
132 Irc::Bot::Auth::Command.new(self)
\r
145 # This class describes a permission set
\r
146 class PermissionSet
\r
149 # Create a new (empty) PermissionSet
\r
155 # Inspection simply inspects the internal hash
\r
160 # Sets the permission for command _cmd_ to _val_,
\r
162 def set_permission(str, val)
\r
163 cmd = str.to_irc_auth_command
\r
166 @perm[cmd.command] = val
\r
168 @perm.delete(cmd.command)
\r
170 raise TypeError, "#{val.inspect} must be true or false" unless [true,false].include?(val)
\r
174 # Resets the permission for command _cmd_
\r
176 def reset_permission(cmd)
\r
177 set_permission(cmd, nil)
\r
180 # Tells if command _cmd_ is permitted. We do this by returning
\r
181 # the value of the deepest Command#path that matches.
\r
184 cmd = str.to_irc_auth_command
\r
185 # TODO user-configurable list of always-allowed commands,
\r
186 # for admins that want to set permissions -* for everybody
\r
187 return true if cmd.command == :login
\r
189 cmd.path.reverse.each { |k|
\r
190 if @perm.has_key?(k)
\r
201 # This is the error that gets raised when an invalid password is met
\r
203 class InvalidPassword < RuntimeError
\r
207 # This is the basic class for bot users: they have a username, a
\r
208 # password, a list of netmasks to match against, and a list of
\r
209 # permissions. A BotUser can be marked as 'transient', usually meaning
\r
210 # it's not intended for permanent storage. Transient BotUsers have lower
\r
211 # priority than nontransient ones for autologin purposes.
\r
213 # To initialize a BotUser, you pass a _username_ and an optional
\r
214 # hash of options. Currently, only two options are recognized:
\r
216 # transient:: true or false, determines if the BotUser is transient or
\r
217 # permanent (default is false, permanent BotUser).
\r
219 # Transient BotUsers are initialized by prepending an
\r
220 # asterisk (*) to the username, and appending a sanitized
\r
221 # version of the object_id. The username can be empty.
\r
222 # A random password is generated.
\r
224 # Permanent Botusers need the username as is, and no
\r
225 # password is generated.
\r
227 # masks:: an array of Netmasks to initialize the NetmaskList. This
\r
228 # list is used as-is for permanent BotUsers.
\r
230 # Transient BotUsers will alter the list elements which are
\r
231 # Irc::User by globbing the nick and any initial nonletter
\r
232 # part of the ident.
\r
234 # The masks option is optional for permanent BotUsers, but
\r
235 # obligatory (non-empty) for transients.
\r
239 attr_reader :username
\r
240 attr_reader :password
\r
241 attr_reader :netmasks
\r
243 attr_writer :login_by_mask
\r
244 attr_writer :transient
\r
246 def autologin=(vnew)
\r
250 @netmasks.each { |n| Auth.manager.maskdb.remove(self, n) }
\r
251 elsif vnew && !vold
\r
252 @netmasks.each { |n| Auth.manager.maskdb.add(self, n) }
\r
256 # Checks if the BotUser is transient
\r
261 # Checks if the BotUser is permanent (not transient)
\r
266 # Sets if the BotUser is permanent or not
\r
267 def permanent=(bool)
\r
271 # Make the BotUser permanent
\r
272 def make_permanent(name)
\r
273 raise TypError, "permanent already" if permanent?
\r
274 @username = BotUser.sanitize_username(name)
\r
277 reset_password # or not?
\r
278 @netmasks.dup.each do |m|
\r
280 add_netmask(m.generalize)
\r
284 # Create a new BotUser with given username
\r
285 def initialize(username, options={})
\r
286 opts = {:transient => false}.merge(options)
\r
287 @transient = opts[:transient]
\r
291 @username << BotUser.sanitize_username(username) if username and not username.to_s.empty?
\r
292 @username << BotUser.sanitize_username(object_id)
\r
294 @login_by_mask=true
\r
297 @username = BotUser.sanitize_username(username)
\r
299 reset_login_by_mask
\r
303 @netmasks = NetmaskList.new
\r
304 if opts.key?(:masks) and opts[:masks]
\r
305 masks = opts[:masks]
\r
306 masks = [masks] unless masks.respond_to?(:each)
\r
308 mask = m.to_irc_netmask
\r
309 if @transient and User === m
\r
311 mask.host = m.host.dup
\r
312 mask.user = "*" + m.user.sub(/^\w?[^\w]+/,'')
\r
314 add_netmask(mask) unless mask.to_s == "*"
\r
317 raise "must provide a usable mask for transient BotUser #{@username}" if @transient and @netmasks.empty?
\r
324 str = self.__to_s__[0..-2]
\r
325 str << " (transient)" if @transient
\r
327 str << " @username=#{@username.inspect}"
\r
328 str << " @netmasks=#{@netmasks.inspect}"
\r
329 str << " @perm=#{@perm.inspect}"
\r
330 str << " @login_by_mask=#{@login_by_mask}"
\r
331 str << " @autologin=#{@autologin}"
\r
340 # Convert into a hash
\r
343 :username => @username,
\r
344 :password => @password,
\r
345 :netmasks => @netmasks,
\r
347 :login_by_mask => @login_by_mask,
\r
348 :autologin => @autologin,
\r
352 # Do we allow logging in without providing the password?
\r
358 # Reset the login-by-mask option
\r
360 def reset_login_by_mask
\r
361 @login_by_mask = Auth.manager.bot.config['auth.login_by_mask'] unless defined?(@login_by_mask)
\r
364 # Reset the autologin option
\r
366 def reset_autologin
\r
367 @autologin = Auth.manager.bot.config['auth.autologin'] unless defined?(@autologin)
\r
370 # Do we allow automatic logging in?
\r
376 # Restore from hash
\r
378 @username = h[:username] if h.has_key?(:username)
\r
379 @password = h[:password] if h.has_key?(:password)
\r
380 @login_by_mask = h[:login_by_mask] if h.has_key?(:login_by_mask)
\r
381 @autologin = h[:autologin] if h.has_key?(:autologin)
\r
382 if h.has_key?(:netmasks)
\r
383 @netmasks = h[:netmasks]
\r
384 @netmasks.each { |n| Auth.manager.maskdb.add(self, n) } if @autologin
\r
386 @perm = h[:perm] if h.has_key?(:perm)
\r
389 # This method sets the password if the proposed new password
\r
391 def password=(pwd=nil)
\r
397 raise InvalidPassword, "#{pass} contains invalid characters" if pass !~ /^[\x21-\x7e]+$/
\r
398 raise InvalidPassword, "#{pass} too short" if pass.length < 4
\r
400 rescue InvalidPassword => e
\r
403 raise InvalidPassword, "Exception #{e.inspect} while checking #{pass.inspect} (#{pwd.inspect})"
\r
408 # Resets the password by creating a new onw
\r
410 @password = Auth.random_password
\r
413 # Sets the permission for command _cmd_ to _val_ on channel _chan_
\r
415 def set_permission(cmd, val, chan="*")
\r
416 k = chan.to_s.to_sym
\r
417 @perm[k] = PermissionSet.new unless @perm.has_key?(k)
\r
418 @perm[k].set_permission(cmd, val)
\r
421 # Resets the permission for command _cmd_ on channel _chan_
\r
423 def reset_permission(cmd, chan ="*")
\r
424 set_permission(cmd, nil, chan)
\r
427 # Checks if BotUser is allowed to do something on channel _chan_,
\r
428 # or on all channels if _chan_ is nil
\r
430 def permit?(cmd, chan=nil)
\r
432 k = chan.to_s.to_sym
\r
437 if @perm.has_key?(k)
\r
438 allow = @perm[k].permit?(cmd)
\r
445 def add_netmask(mask)
\r
446 m = mask.to_irc_netmask
\r
449 Auth.manager.maskdb.add(self, m)
\r
450 Auth.manager.logout_transients(m) if self.permanent?
\r
454 # Removes a Netmask
\r
456 def delete_netmask(mask)
\r
457 m = mask.to_irc_netmask
\r
458 @netmasks.delete(m)
\r
459 Auth.manager.maskdb.remove(self, m) if self.autologin?
\r
462 # This method checks if BotUser has a Netmask that matches _user_
\r
465 user = usr.to_irc_user
\r
466 !!@netmasks.find { |n| user.matches? n }
\r
469 # This method gets called when User _user_ wants to log in.
\r
470 # It returns true or false depending on whether the password
\r
471 # is right. If it is, the Netmask of the user is added to the
\r
472 # list of acceptable Netmask unless it's already matched.
\r
473 def login(user, password=nil)
\r
474 if password == @password or (password.nil? and (@login_by_mask || @autologin) and knows?(user))
\r
475 add_netmask(user) unless knows?(user)
\r
476 debug "#{user} logged in as #{self.inspect}"
\r
483 # # This method gets called when User _user_ has logged out as this BotUser
\r
485 # delete_netmask(user) if knows?(user)
\r
488 # This method sanitizes a username by chomping, downcasing
\r
489 # and replacing any nonalphanumeric character with _
\r
491 def BotUser.sanitize_username(name)
\r
492 candidate = name.to_s.chomp.downcase.gsub(/[^a-z0-9]/,"_")
\r
493 raise "sanitized botusername #{candidate} too short" if candidate.length < 3
\r
499 # This is the default BotUser: it's used for all users which haven't
\r
500 # identified with the bot
\r
502 class DefaultBotUserClass < BotUser
\r
504 private :add_netmask, :delete_netmask
\r
508 # The default BotUser is named 'everyone'
\r
511 reset_login_by_mask
\r
514 @default_perm = PermissionSet.new
\r
517 # This method returns without changing anything
\r
519 def login_by_mask=(val)
\r
520 debug "Tried to change the login-by-mask for default bot user, ignoring"
\r
521 return @login_by_mask
\r
524 # The default botuser allows logins by mask
\r
526 def reset_login_by_mask
\r
527 @login_by_mask = true
\r
530 # This method returns without changing anything
\r
532 def autologin=(val)
\r
533 debug "Tried to change the autologin for default bot user, ignoring"
\r
537 # The default botuser doesn't allow autologin (meaningless)
\r
539 def reset_autologin
\r
543 # Sets the default permission for the default user (i.e. the ones
\r
544 # set by the BotModule writers) on all channels
\r
546 def set_default_permission(cmd, val)
\r
547 @default_perm.set_permission(Command.new(cmd), val)
\r
548 debug "Default permissions now: #{@default_perm.pretty_inspect}"
\r
551 # default knows everybody
\r
554 return true if user.to_irc_user
\r
557 # We always allow logging in as the default user
\r
558 def login(user, password)
\r
562 # DefaultBotUser will check the default_perm after checking
\r
564 # or on all channels if _chan_ is nil
\r
566 def permit?(cmd, chan=nil)
\r
567 allow = super(cmd, chan)
\r
568 if allow.nil? && chan.nil?
\r
569 allow = @default_perm.permit?(cmd)
\r
576 # Returns the only instance of DefaultBotUserClass
\r
578 def Auth.defaultbotuser
\r
579 return DefaultBotUserClass.instance
\r
582 # This is the BotOwner: he can do everything
\r
584 class BotOwnerClass < BotUser
\r
589 @login_by_mask = false
\r
594 def permit?(cmd, chan=nil)
\r
600 # Returns the only instance of BotOwnerClass
\r
603 return BotOwnerClass.instance
\r
608 # Check if the current BotUser is the default one
\r
610 return DefaultBotUserClass === self
\r
613 # Check if the current BotUser is the owner
\r
615 return BotOwnerClass === self
\r
620 # This is the ManagerClass singleton, used to manage
\r
621 # Irc::User/Irc::Bot::Auth::BotUser connections and everything
\r
627 attr_reader :maskdb
\r
628 attr_reader :everyone
\r
629 attr_reader :botowner
\r
632 # The instance manages two <code>Hash</code>es: one that maps
\r
633 # <code>Irc::User</code>s onto <code>BotUser</code>s, and the other that maps
\r
634 # usernames onto <code>BotUser</code>
\r
636 @everyone = Auth::defaultbotuser
\r
637 @botowner = Auth::botowner
\r
641 def bot_associate(bot)
\r
642 raise "Cannot associate with a new bot! Save first" if defined?(@has_changes) && @has_changes
\r
649 # This variable is set to true when there have been changes
\r
650 # to the botusers list, so that we know when to save
\r
651 @has_changes = false
\r
655 @has_changes = true
\r
659 @has_changes = false
\r
666 # resets the hashes
\r
668 @botusers = Hash.new
\r
669 @maskdb = NetmaskDb.new
\r
670 @allbotusers = Hash.new
\r
671 [everyone, botowner].each do |x|
\r
672 @allbotusers[x.username.to_sym] = x
\r
676 def load_array(ary, forced)
\r
678 warning "Tried to load an empty array"
\r
681 raise "Won't load with unsaved changes" if @has_changes and not forced
\r
684 raise TypeError, "#{x} should be a Hash" unless x.kind_of?(Hash)
\r
689 get_botuser(u).from_hash(x)
\r
690 get_botuser(u).transient = false
\r
696 @allbotusers.values.map { |x|
\r
697 x.transient? ? nil : x.to_hash
\r
701 # checks if we know about a certain BotUser username
\r
702 def include?(botusername)
\r
703 @allbotusers.has_key?(botusername.to_sym)
\r
706 # Maps <code>Irc::User</code> to BotUser
\r
707 def irc_to_botuser(ircuser)
\r
708 logged = @botusers[ircuser.to_irc_user]
\r
709 return logged if logged
\r
710 return autologin(ircuser)
\r
713 # creates a new BotUser
\r
714 def create_botuser(name, password=nil)
\r
715 n = BotUser.sanitize_username(name)
\r
717 raise "botuser #{n} exists" if include?(k)
\r
718 bu = BotUser.new(n)
\r
719 bu.password = password
\r
720 @allbotusers[k] = bu
\r
724 # returns the botuser with name _name_
\r
725 def get_botuser(name)
\r
726 @allbotusers.fetch(BotUser.sanitize_username(name).to_sym)
\r
729 # Logs Irc::User _user_ in to BotUser _botusername_ with password _pwd_
\r
731 # raises an error if _botusername_ is not a known BotUser username
\r
733 # It is possible to autologin by Netmask, on request
\r
735 def login(user, botusername, pwd=nil)
\r
736 ircuser = user.to_irc_user
\r
737 n = BotUser.sanitize_username(botusername)
\r
739 raise "No such BotUser #{n}" unless include?(k)
\r
740 if @botusers.has_key?(ircuser)
\r
741 return true if @botusers[ircuser].username == n
\r
743 # @botusers[ircuser].logout(ircuser)
\r
745 bu = @allbotusers[k]
\r
746 if bu.login(ircuser, pwd)
\r
747 @botusers[ircuser] = bu
\r
753 # Tries to auto-login Irc::User _user_ by looking at the known botusers that allow autologin
\r
754 # and trying to login without a password
\r
756 def autologin(user)
\r
757 ircuser = user.to_irc_user
\r
758 debug "Trying to autologin #{ircuser}"
\r
759 return @botusers[ircuser] if @botusers.has_key?(ircuser)
\r
760 bu = maskdb.find(ircuser)
\r
762 debug "trying #{bu}"
\r
763 bu.login(ircuser) or raise '...what?!'
\r
764 @botusers[ircuser] = bu
\r
767 # Finally, create a transient if we're set to allow it
\r
768 if @bot.config['auth.autouser']
\r
769 bu = create_transient_botuser(ircuser)
\r
770 @botusers[ircuser] = bu
\r
776 # Creates a new transient BotUser associated with Irc::User _user_,
\r
777 # automatically logging him in. Note that transient botuser creation can
\r
778 # fail, typically if we don't have the complete user netmask (e.g. for
\r
779 # messages coming in from a linkbot)
\r
781 def create_transient_botuser(user)
\r
782 ircuser = user.to_irc_user
\r
785 bu = BotUser.new(ircuser, :transient => true, :masks => ircuser)
\r
788 warning "failed to create transient for #{user}"
\r
794 # Logs out any Irc::User matching Irc::Netmask _m_ and logged in
\r
795 # to a transient BotUser
\r
797 def logout_transients(m)
\r
798 debug "to check: #{@botusers.keys.join ' '}"
\r
799 @botusers.keys.each do |iu|
\r
800 debug "checking #{iu.fullform} against #{m.fullform}"
\r
802 bu.transient? or next
\r
803 iu.matches?(m) or next
\r
804 @botusers.delete(iu).autologin = false
\r
808 # Makes transient BotUser _user_ into a permanent BotUser
\r
809 # named _name_; if _user_ is an Irc::User, act on the transient
\r
810 # BotUser (if any) it's logged in as
\r
812 def make_permanent(user, name)
\r
813 # TODO merge BotUser instead?
\r
814 raise "there's already a BotUser called #{name}" if include?(name)
\r
818 when String, Irc::User
\r
819 tuser = irc_to_botuser(user)
\r
823 raise TypeError, "sorry, don't know how to make #{user.class} into a permanent BotUser"
\r
825 return nil unless tuser
\r
826 raise TypeError, "#{tuser} is not transient" unless tuser.transient?
\r
828 tuser.make_permanent(name)
\r
829 @allbotusers[tuser.username.to_sym] = tuser
\r
834 # Checks if User _user_ can do _cmd_ on _chan_.
\r
836 # Permission are checked in this order, until a true or false
\r
838 # * associated BotUser on _chan_
\r
839 # * associated BotUser on all channels
\r
840 # * everyone on _chan_
\r
841 # * everyone on all channels
\r
843 def permit?(user, cmdtxt, channel=nil)
\r
844 if user.class <= BotUser
\r
847 botuser = irc_to_botuser(user)
\r
849 cmd = cmdtxt.to_irc_auth_command
\r
861 allow = botuser.permit?(cmd, chan) if chan
\r
862 return allow unless allow.nil?
\r
863 allow = botuser.permit?(cmd)
\r
864 return allow unless allow.nil?
\r
866 unless botuser == everyone
\r
867 allow = everyone.permit?(cmd, chan) if chan
\r
868 return allow unless allow.nil?
\r
869 allow = everyone.permit?(cmd)
\r
870 return allow unless allow.nil?
\r
873 raise "Could not check permission for user #{user.inspect} to run #{cmdtxt.inspect} on #{chan.inspect}"
\r
876 # Checks if command _cmd_ is allowed to User _user_ on _chan_, optionally
\r
877 # telling if the user is authorized
\r
879 def allow?(cmdtxt, user, chan=nil)
\r
880 if permit?(user, cmdtxt, chan)
\r
883 # cmds = cmdtxt.split('::')
\r
884 # @bot.say chan, "you don't have #{cmds.last} (#{cmds.first}) permissions here" if chan
\r
885 @bot.say chan, _("%{user}, you don't have '%{command}' permissions here") %
\r
886 {:user=>user, :command=>cmdtxt} if chan
\r
893 # Returns the only instance of ManagerClass
\r
896 return ManagerClass.instance
\r
904 # A convenience method to automatically found the botuser
\r
905 # associated with the receiver
\r
908 Irc::Bot::Auth.manager.irc_to_botuser(self)
\r