Run group creation before migrations instead of a separate script

.github/workflows/test_debian_packages_on_ubuntu.yml

@@ -217,7 +217,6 @@ jobs:
       - name: Setup accounts in Rocky
         run: |
           DJANGO_SUPERUSER_PASSWORD=robotpassword sudo -E -u kat rocky-cli createsuperuser --noinput --email robot@localhost --full_name "Mr. Robot"
-          sudo -u kat rocky-cli setup_dev_account
 
       - name: Check Bytes API health or print response and logs
         run: |

docs/source/installation-and-deployment/production-debian-environment.rst

@@ -253,12 +253,6 @@ Create an admin user for OpenKAT
 
     sudo -u kat rocky-cli createsuperuser
 
-Create the default groups and permissions for KAT:
-
-.. code-block:: sh
-
-    sudo -u kat rocky-cli setup_dev_account
-
 Configure Bytes credentials
 ===========================
 

docs/source/installation-and-deployment/production-docker-environment.rst

@@ -70,18 +70,6 @@ With docker compose you would run this as:
 docker compose --env-file .env-prod -f docker-compose.release-example.yml exec rocky python3 manage.py createsuperuser
 ```
 
-We also need to create an organisation, this command will create a development organisation:
-
-```shell
-python3 manage.py setup_dev_account
-```
-
-With docker compose you would run this as:
-
-```shell
-docker compose --env-file .env-prod -f docker-compose.release-example.yml exec rocky python3 manage.py setup_dev_account
-```
-
 IPv6 support
 ============
 

rocky/Makefile

@@ -19,7 +19,6 @@ build-rocky-native:
 	python3 manage.py migrate
 	-python3 manage.py createsuperuser --no-input
 	python3 manage.py loaddata OOI_database_seed.json
-	python3 manage.py setup_dev_account
 	python3 manage.py compilemessages
 
 build-rocky-frontend:
@@ -111,7 +110,6 @@ test-prepare:
 	python3 manage.py migrate
 	DJANGO_SUPERUSER_PASSWORD=robotpassword python3 manage.py createsuperuser --email robot@localhost --noinput
 	python3 manage.py loaddata OOI_database_seed.json
-	python3 manage.py setup_dev_account
 
 test-rf: # Usage: `make test-rf headless=<bool>`
 	pip3 install robotframework robotframework-browser robotframework-debuglibrary robotframework-otp robotframework-postgresqldb

rocky/rocky/signals.py

@@ -1,15 +1,18 @@
 import datetime
+import logging
 
 from django.conf import settings
 from django.contrib.admin.models import LogEntry
+from django.contrib.auth.models import Group, Permission
 from django.contrib.auth.signals import user_logged_in, user_logged_out, user_login_failed
-from django.db.models.signals import post_delete, post_save, pre_save
+from django.core.exceptions import ObjectDoesNotExist
+from django.db.models.signals import post_delete, post_save, pre_migrate, pre_save
 from django.dispatch import receiver
 from httpx import HTTPError
 from katalogus.client import KATalogusClient, get_katalogus_client
 from katalogus.exceptions import KATalogusDownException, KATalogusException, KATalogusUnhealthyException
 from structlog import get_logger
-from tools.models import Organization
+from tools.models import GROUP_ADMIN, GROUP_CLIENT, GROUP_REDTEAM, Organization
 
 from octopoes.api.models import Declaration
 from octopoes.connector.octopoes import OctopoesAPIConnector
@@ -22,6 +25,12 @@
 # Signal sent when a user logs in
 @receiver(user_logged_in)
 def user_logged_in_callback(sender, request, user, **kwargs):
+    create_missing_groups()
+    logger.info("Groups ", username=user.get_username())
+
+
+@receiver(pre_migrate)
+def make_sure_groups_exist_before_migrating(sender, request, user, **kwargs):
     logger.info("User logged in", username=user.get_username())
 
 
@@ -150,3 +159,63 @@ def _get_healthy_octopoes(organization_code: str) -> OctopoesAPIConnector:
         raise OctopoesUnhealthyException
 
     return octopoes_client
+
+
+def get_permissions(codenames):
+    permission_objects = []
+    if codenames:
+        for codename in codenames:
+            try:
+                permission = Permission.objects.get(codename=codename)
+            except Permission.DoesNotExist:
+                raise ObjectDoesNotExist("Permission:" + codename + " does not exist.")
+            else:
+                permission_objects.append(permission.id)
+
+    return permission_objects
+
+
+def create_missing_groups():
+    group_redteam, group_redteam_created = Group.objects.get_or_create(name=GROUP_REDTEAM)
+    group_admin, group_admin_created = Group.objects.get_or_create(name=GROUP_ADMIN)
+    group_client, group_client_created = Group.objects.get_or_create(name=GROUP_CLIENT)
+
+    redteamer_permissions = [
+        "can_scan_organization",
+        "can_enable_disable_boefje",
+        "can_add_boefje",
+        "can_set_clearance_level",
+        "can_delete_oois",
+        "can_mute_findings",
+        "can_view_katalogus_settings",
+        "can_set_katalogus_settings",
+    ]
+
+    if group_redteam_created:
+        redteam_permissions = get_permissions(redteamer_permissions)
+        group_redteam.permissions.set(redteam_permissions)
+        logging.info("Group 'redteam' created successfully")
+
+    if group_admin_created:
+        admin_permissions = get_permissions(
+            redteamer_permissions
+            + [
+                "view_organization",
+                "view_organizationmember",
+                "add_organizationmember",
+                "change_organization",
+                "can_scan_organization",
+                "change_organizationmember",
+                "add_indemnification",
+                "can_recalculate_bits",
+            ]
+        )
+        group_admin.permissions.set(admin_permissions)
+        logging.info("Group 'admin' created successfully")
+
+    if group_client_created:
+        client_permissions = get_permissions(["can_scan_organization"])
+        group_client.permissions.set(client_permissions)
+        logging.info("Group 'clients' created successfully")
+
+    logging.info("Groups created successfully")

rocky/tools/management/commands/almost_flush.py

@@ -25,7 +25,6 @@ def handle(self, **options):
 
         call_command("flush", interactive=False)
         call_command("loaddata", "OOI_database_seed.json")
-        call_command("setup_dev_account")
 
         self.save_entities_again(device, first_user, groups, member, indemnification)
 

scripts/installation/openkat-install.sh

@@ -232,7 +232,6 @@ sudo -u kat update-mula-db
 if [[ ${2} != "no_super_user" ]]; then
     echo "Step 5 - Create Superuser & dev account"
     sudo -u kat rocky-cli createsuperuser
-    sudo -u kat rocky-cli setup_dev_account
 else
     echo "Step 5 - Option no_super_user passed; skipping creating superuser & dev account"
 fi

scripts/installation/openkat-reset.sh

@@ -80,7 +80,6 @@ sudo rabbitmqctl set_permissions -p "kat" "kat" ".*" ".*" ".*"
 echo "Migrate databases"
 sudo -u kat rocky-cli migrate
 sudo -u kat rocky-cli loaddata /usr/share/kat-rocky/OOI_database_seed.json
-sudo -u kat rocky-cli setup_dev_account
 sudo -u kat update-bytes-db
 sudo -u kat update-katalogus-db
 sudo -u kat update-mula-db