path: root/extensions/BMO/lib/Reports/Groups.pm

# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# This Source Code Form is "Incompatible With Secondary Licenses", as
# defined by the Mozilla Public License, v. 2.0.

package Bugzilla::Extension::BMO::Reports::Groups;

use 5.10.1;
use strict;
use warnings;

use Bugzilla::Constants;
use Bugzilla::Error;
use Bugzilla::Group;
use Bugzilla::User;
use Bugzilla::Util qw(trim datetime_from);
use JSON qw(encode_json);

sub admins_report {
    my ($vars) = @_;
    my $dbh = Bugzilla->dbh;
    my $user = Bugzilla->user;

    ($user->in_group('editbugs'))
        || ThrowUserError('auth_failure', { group  => 'editbugs',
                                            action => 'run',
                                            object => 'group_admins' });

    my @grouplist =
                  ($user->in_group('editusers') || $user->in_group('infrasec'))
                  ? map { lc($_->name) } Bugzilla::Group->get_all
                  : _get_permitted_membership_groups();

    my $groups = join(',', map { $dbh->quote($_) } @grouplist);

    my $query = "
        SELECT groups.id, " .
               $dbh->sql_group_concat('profiles.userid', "','", 1) . "
          FROM groups
               LEFT JOIN user_group_map
                    ON user_group_map.group_id = groups.id
                    AND user_group_map.isbless = 1
                    AND user_group_map.grant_type = 0
               LEFT JOIN profiles
                    ON user_group_map.user_id = profiles.userid
         WHERE groups.isbuggroup = 1
               AND groups.name IN ($groups)
      GROUP BY groups.name";

    my @groups;
    foreach my $row (@{ $dbh->selectall_arrayref($query) }) {
        my $group = Bugzilla::Group->new({ id => shift @$row, cache => 1});
        my @admins;
        if (my $admin_ids = shift @$row) {
            foreach my $uid (split(/,/, $admin_ids)) {
                push(@admins, Bugzilla::User->new({ id => $uid, cache => 1 }));
            }
        }
        push(@groups, { name        => $group->name,
                        description => $group->description,
                        owner       => $group->owner,
                        admins      => \@admins });
    }

    $vars->{'groups'} = \@groups;
}

sub membership_report {
    my ($page, $vars) = @_;
    my $dbh = Bugzilla->dbh;
    my $user = Bugzilla->user;
    my $cgi = Bugzilla->cgi;

    ($user->in_group('editusers') || $user->in_group('infrasec'))
        || ThrowUserError('auth_failure', { group  => 'editusers',
                                            action => 'run',
                                            object => 'group_admins' });

    my $who = $cgi->param('who');
    if (!defined($who) || $who eq '') {
        if ($page eq 'group_membership.txt') {
            print $cgi->redirect("page.cgi?id=group_membership.html&output=txt");
            exit;
        }
        $vars->{'output'} = $cgi->param('output');
        return;
    }

    Bugzilla::User::match_field({ 'who' => {'type' => 'multi'} });
    $who = Bugzilla->input_params->{'who'};
    $who = ref($who) ? $who : [ $who ];

    my @users;
    foreach my $login (@$who) {
        my $u = Bugzilla::User->new(login_to_id($login, 1));

        # this is lifted from $user->groups()
        # we need to show which groups are direct and which are inherited

        my $groups_to_check = $dbh->selectcol_arrayref(
            q{SELECT DISTINCT group_id
                FROM user_group_map
               WHERE user_id = ? AND isbless = 0}, undef, $u->id);

        my $rows = $dbh->selectall_arrayref(
            "SELECT DISTINCT grantor_id, member_id
               FROM group_group_map
              WHERE grant_type = " . GROUP_MEMBERSHIP);

        my %group_membership;
        foreach my $row (@$rows) {
            my ($grantor_id, $member_id) = @$row;
            push (@{ $group_membership{$member_id} }, $grantor_id);
        }

        my %checked_groups;
        my %direct_groups;
        my %indirect_groups;
        my %groups;

        foreach my $member_id (@$groups_to_check) {
            $direct_groups{$member_id} = 1;
        }

        while (scalar(@$groups_to_check) > 0) {
            my $member_id = shift @$groups_to_check;
            if (!$checked_groups{$member_id}) {
                $checked_groups{$member_id} = 1;
                my $members = $group_membership{$member_id};
                my @new_to_check = grep(!$checked_groups{$_}, @$members);
                push(@$groups_to_check, @new_to_check);
                foreach my $id (@new_to_check) {
                    $indirect_groups{$id} = $member_id;
                }
                $groups{$member_id} = 1;
            }
        }

        my @groups;
        my $ra_groups = Bugzilla::Group->new_from_list([keys %groups]);
        foreach my $group (@$ra_groups) {
            my $via;
            if ($direct_groups{$group->id}) {
                $via = '';
            } else {
                foreach my $g (@$ra_groups) {
                    if ($g->id == $indirect_groups{$group->id}) {
                        $via = $g->name;
                        last;
                    }
                }
            }
            push @groups, {
                name => $group->name,
                desc => $group->description,
                via  => $via,
            };
        }

        push @users, {
            user   => $u,
            groups => \@groups,
        };
    }

    $vars->{'who'} = $who;
    $vars->{'users'} = \@users;
}

sub members_report {
    my ($page, $vars) = @_;
    my $dbh = Bugzilla->dbh;
    my $user = Bugzilla->user;
    my $cgi = Bugzilla->cgi;

    ($user->in_group('editbugs'))
        || ThrowUserError('auth_failure', { group  => 'editbugs',
                                            action => 'run',
                                            object => 'group_admins' });

    my $privileged = $user->in_group('editusers') || $user->in_group('infrasec');
    $vars->{privileged} = $privileged;

    my @grouplist = $privileged
        ? map { lc($_->name) } Bugzilla::Group->get_all
        : _get_permitted_membership_groups();

    my $include_disabled = $cgi->param('include_disabled') ? 1 : 0;
    $vars->{'include_disabled'} = $include_disabled;

    # don't allow all groups, to avoid putting pain on the servers
    my @group_names =
        sort
        grep { !/^(?:bz_.+|canconfirm|editbugs|editbugs-team|everyone)$/ }
        @grouplist;
    unshift(@group_names, '');
    $vars->{'groups'} = \@group_names;

    # load selected group
    my $group = lc(trim($cgi->param('group') || ''));
    $group = '' unless grep { $_ eq $group } @group_names;
    return if $group eq '';
    my $group_obj = Bugzilla::Group->new({ name => $group });
    $vars->{'group'} = $group_obj;

    $vars->{'privileged'} = 1 if ($group_obj->owner && $group_obj->owner->id == $user->id);

    my @types;
    my $members = $group_obj->members_complete();
    foreach my $name (sort keys %$members) {
        push @types, {
            name    => ($name eq '_direct' ? 'direct' : $name),
            members => _filter_userlist($members->{$name}),
        }
    }

    # make it easy for the template to detect an empty group
    my $has_members = 0;
    foreach my $type (@types) {
        $has_members += scalar(@{ $type->{members} });
        last if $has_members;
    }
    @types = () unless $has_members;

    if ($page eq 'group_members.json') {
        my %users;
        foreach my $rh (@types) {
            foreach my $member (@{ $rh->{members} }) {
                my $login = $member->login;
                if (exists $users{$login}) {
                    push @{ $users{$login}->{groups} }, $rh->{name} if $privileged;
                }
                else {
                    my $rh_user = {
                        login      => $login,
                        membership => $rh->{name} eq 'direct' ? 'direct' : 'indirect',
                        rh_name => $rh->{name},
                    };
                    if ($privileged) {
                        $rh_user->{group}        = $rh->{name};
                        $rh_user->{groups}       = [ $rh->{name} ];
                        $rh_user->{lastseeon}    = $member->last_seen_date;
                        $rh_user->{mfa}          = $member->mfa;
                        $rh_user->{api_key_only} = $member->settings->{api_key_only}->{value} eq 'on'
                                                   ? JSON::true : JSON::false;
                    }
                    $users{$login} = $rh_user;
                }
            }
        }
        $vars->{types_json} = JSON->new->pretty->canonical->utf8->encode([ values %users ]);
    }
    else {
        my %users;
        foreach my $rh (@types) {
            foreach my $member (@{ $rh->{members} }) {
                $users{$member->login} = 1 unless exists $users{$member->login};
            }
        }
        $vars->{types} = \@types;
        $vars->{count} = scalar(keys %users);
    }
}

sub _filter_userlist {
    my ($list, $include_disabled) = @_;
    $list = [ grep { $_->is_enabled } @$list ] unless $include_disabled;
    my $now = DateTime->now();
    my $never = DateTime->from_epoch( epoch => 0 );
    foreach my $user (@$list) {
        my $last_seen = $user->last_seen_date ? datetime_from($user->last_seen_date) : $never;
        $user->{last_seen_days} = sprintf(
            '%.0f',
            $now->subtract_datetime_absolute($last_seen)->delta_seconds / (28 * 60 * 60));
    }
    return [ sort { lc($a->identity) cmp lc($b->identity) } @$list ];
}

# Groups that any user with editbugs can see the membership or admin lists for.
# Transparency FTW.
sub _get_permitted_membership_groups {
    my $user = Bugzilla->user;

    # Default publicly viewable groups
    my %default_public_groups = map { $_ => 1 } qw(
        bugzilla-approvers
        bugzilla-reviewers
        can_restrict_comments
        community-it-team
        mozilla-employee-confidential
        mozilla-foundation-confidential
        mozilla-reps
        qa-approvers
    );

    # We add the group to the permitted list if:
    # 1. it is a drivers group - this gives us a little
    #    future-proofing
    # 2. it is a one of the default public groups
    # 3. the user is the group's owner
    # 4. or the user can bless others into the group
    my @permitted_groups;
    foreach my $group (Bugzilla::Group->get_all) {
        my $name = $group->name;
        if ($name =~ /-drivers$/
            || exists $default_public_groups{$name}
            || ($group->owner && $group->owner->id == $user->id)
            || $user->can_bless($group->id))
        {
            push(@permitted_groups, $name);
        }
    }

    return @permitted_groups;
}

1;